docs(roadmap): mark UI/UX audit + design previews shipped, fix stale multi-node note

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.env.example

@@ -47,6 +47,16 @@ SECRETS_KEY=
 CONTAINR_AGENT_AUTH_TOKEN=replace_with_strong_agent_secret
 # Optional rotation list (comma-separated). When set, this takes precedence.
 # CONTAINR_AGENT_AUTH_TOKENS=current_secret,next_secret
+# Bundled agent binaries dir served at /api/agents/download/:platform.
+# CONTAINR_AGENT_BIN_DIR=/agents
+# Directory Traefik's file provider watches. The backend writes one
+# config per remote service here so domains route to node agents. The
+# infra compose wires a shared volume — set only for custom layouts.
+# TRAEFIK_DYNAMIC_DIR=/traefik-dynamic
+# Optional remote template catalog (another Containr instance). Its
+# templates merge into GET /templates as source:"registry" and
+# materialize locally on deploy. The bundled catalog works without it.
+# CONTAINR_TEMPLATE_REGISTRY_URL=https://templates.example.com
 CORS_ORIGINS=http://localhost:3000,http://localhost:8080
 # Optional build-time API URL overrides. Leave empty for the default
 # same-origin setup - the frontend nginx proxies /api to the backend, which

.github/compose.ci.yml

@@ -0,0 +1,18 @@
+# CI-only compose overlay: pull and build through mirror.gcr.io so shared
+# runner egress IPs never touch docker.io (anonymous pulls get 429'd).
+# Production refs in infra/docker-compose.yml stay unchanged.
+services:
+  postgres:
+    image: mirror.gcr.io/library/postgres:15-alpine
+  traefik:
+    image: mirror.gcr.io/library/traefik:v3.2
+  backend:
+    build:
+      args:
+        GO_IMAGE: mirror.gcr.io/library/golang:1.26-alpine
+        NODE_IMAGE: mirror.gcr.io/library/node:22-alpine
+  frontend:
+    build:
+      args:
+        NODE_IMAGE: mirror.gcr.io/library/node:22-alpine
+        NGINX_IMAGE: mirror.gcr.io/library/nginx:alpine

.github/workflows/ci.yml

@@ -163,11 +163,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Boot stack
+        # .github/compose.ci.yml swaps every docker.io ref for
+        # mirror.gcr.io — anonymous Hub pulls 429 on shared CI IPs.
         run: |
           BETTER_AUTH_SECRET=$(openssl rand -hex 32)
           BETTER_AUTH_INTERNAL_TOKEN=$(openssl rand -hex 32)
           export BETTER_AUTH_SECRET BETTER_AUTH_INTERNAL_TOKEN
-          docker compose -f infra/docker-compose.yml up -d --build postgres dragonfly backend frontend traefik
+          docker compose -f infra/docker-compose.yml -f .github/compose.ci.yml up -d --build postgres dragonfly backend frontend traefik
 
       - name: Wait for backend health
         run: |
@@ -204,7 +206,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Docker Buildx
+        # Mirror docker.io through gcr — shared CI IPs hit anonymous
+        # rate limits on base-image metadata resolution otherwise.
         uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."docker.io"]
+              mirrors = ["mirror.gcr.io"]
 
       - name: Login to GHCR
         if: github.event_name != 'pull_request'
@@ -248,6 +256,10 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta-backend.outputs.tags }}
           labels: ${{ steps.meta-backend.outputs.labels }}
+          # Stamp the release tag into the binary so the in-app upgrade
+          # check knows what it's running ("dev" disables it).
+          build-args: |
+            VERSION=${{ github.ref_type == 'tag' && github.ref_name || 'dev' }}
           cache-from: type=gha,scope=backend
           cache-to: type=gha,mode=max,scope=backend
 

.gitignore

@@ -124,3 +124,6 @@ ref/
 .playwright-mcp/
 canvas-*.png
 .vercel
+
+# Local design previews (not shipped)
+design/

README.md

@@ -49,7 +49,7 @@ dedicated console.
 - **Public project catalog** — approved projects are browsable anonymously; new projects stay private until an admin approves them
 - **Admin console** (`/admin`) — platform stats, project approval/edit/delete, user admin management
 - **Private networking** — every project gets an isolated Docker network; services reach each other by name (`web:3000`) and share variables via `${{service.KEY}}` references
-- **Deployments & builds** — Docker deploys with history, image rollback, live build status
+- **Deployments & builds** — Docker deploys with history, image rollback, live build status; git-sourced services build directly on remote node agents (no registry required)
 - **Runtime** — replicas, published ports, domains, health checks, restart policies; start/stop/restart/redeploy from canvas or service page
 - **Git integration** — GitHub, GitLab, Bitbucket, Gitea; webhooks, GitHub App
 - **Managed databases** — create PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Dragonfly, or ClickHouse directly from `/databases`, with backup/restore

ROADMAP2.md

@@ -1,6 +1,6 @@
 # Containr — Roadmap 2: The dflow Convergence
 
-Last verified: **2026-10-08** — deep pass over the full dflow codebase
+Last verified: **2026-10-10** — deep pass over the full dflow codebase
 (`~/Desktop/PROG+HTML/dflow`, community fork of dflow-sh/dflow, frozen for
 preservation) against Containr `main` (`15b5b0e`).
 
@@ -91,10 +91,10 @@ Legend: ✅ done · 🟡 partial/different · ❌ missing · ➖ not applicable
 | White-label (logo/favicon/title/OG/theme colors) | ❌ | `app_settings.branding` — **Containr remains the default brand** |
 | Activity feed (icon/severity/category/metadata, 90-day TTL job) | ✅ `/activity` + project view | — |
 | Admin metrics dashboard (users/servers/queued/failed counts) | 🟡 `/admin` exists | Extend |
-| **Impersonate user** | ❌ | Admin support tool |
+| **Impersonate user** | ✅ admin token + `impersonated_by` claim (browser swap pending) | Done (CLI/API/MCP) |
 | In-app docs (content-collections markdown) | ✅ `/docs` | — |
-| Dynamic client-side filter framework (535-line `filter.utils`) | 🟡 audit page filters only | Reuse pattern for tables |
-| Ops "bubble" (queue monitor, terminal, sync) | ❌ | Operations page |
+| Dynamic client-side filter framework (535-line `filter.utils`) | ✅ `dynamic-filter.ts` + URL state; audit/builds/activity | Done |
+| Ops "bubble" (queue monitor, terminal, sync) | ✅ `/operations` + interactive terminal | Done |
 
 #### Agent surface
 | dflow capability | Containr status | Action |
@@ -103,8 +103,8 @@ Legend: ✅ done · 🟡 partial/different · ❌ missing · ➖ not applicable
 | CLI | ❌ | none in dflow — **Containr CLI is a genuine leap past it** |
 | MCP | ❌ | none — same leap |
 | Railway migrator script | ❌ | `containr migrate railway` |
-| GitHub App **manifest flow** (instance self-provisions the App) | 🟡 env-configured App | `POST /git/github-app/manifest` flow |
-| fork-sync webhook deploy trigger | ❌ | ~20 lines on receiver |
+| GitHub App **manifest flow** (instance self-provisions the App) | ✅ manifest + convert + App webhook | Done |
+| fork-sync webhook deploy trigger | ✅ sync/repository_dispatch/workflow_run | Done |
 | Azure DevOps provider | ❌ | Optional (dflow does token-clone only) |
 
 ---
@@ -192,8 +192,11 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
   compares vs edge IP → `ok|wrong-target|pending`.
 - [x] **Maintenance mode + basic-auth gate** — Traefik middleware labels;
   no proxy code needed.
-- [ ] **Routing overrides** — `services.traefik_labels` jsonb with
-  allowlist validation (middlewares, headers, redirects).
+- [x] **Routing overrides** — `services.traefik_labels` jsonb with
+  allowlist validation. Keys `middlewares.<name>.<type>[.<field>]` scope
+  to the service router (`svc-<id>-<name>`), auto-attach after builtins;
+  router/service/provider-level keys rejected. API + CLI
+  (`--traefik-label`) + MCP + service page Access editor.
 - [x] **Builder override** — `services.builder` enum
   `auto|railpack|nixpacks|dockerfile|static`; static builder = build +
   nginx serve. Fixed hardcoded `nixpacks` + `BuildImage` stream drain bug.
@@ -223,58 +226,148 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
   {target_node_id}`: dump → stream transfer → provision → restore →
   re-point bound services. Deferred until Phase F lands real second
   nodes — nothing to migrate between today.
-- [ ] **Backup import** — upload archive → new restore point (pairs with
+- [x] **Backup import** — `POST /databases/:id/backups/import` accepts a
+  `.tar.gz` (multipart `file` or raw body, 2 GiB cap, gzip-magic
+  validated), stores it in the backups volume via a holder container,
+  registers a completed restore point, and ships offsite when a backup
+  target is configured. `api/backuptargets.go`. (pairs with
   migrators).
 
 ## 6. Phase E — Templates v2 (absorbs compose-catalog spec + dflow graph templates)
 
-- [ ] **Template = ordered service graph** — `services[]` entries with
+- [x] **Template = ordered service graph** — `services[]` entries with
   `{name, type, source, build, ports, volumes, variables, depends_on}`;
-  deploy order from dependency refs.
-- [ ] **Expressions** — `${{service.KEY}}` (already the runtime ref
-  syntax — reuse), `{{secret(len,"charset")}}`, `{{random:int}}`,
-  `{{VAR:-default}}`; `POST /templates/:id/plan` returns the resolved
-  graph without deploying (agents love this).
-- [ ] **Compose import** — `POST /templates/import/compose` (compose-go
-  parser → graph), `POST /templates/import/github` (compose file from
-  repo path). Implements `docs/superpowers/specs/2026-04-14-*`.
-- [ ] **Graph deploy pipeline** — creates project + services in
-  dependency order, resolves vars, triggers builds; defined
-  partial-failure policy.
-- [ ] **Visual template builder** — canvas mode: drop git/image/db
-  nodes, wire refs, set order, save/publish. Reuses existing canvas
-  primitives (dflow's `templates/compose` is exactly this).
-- [ ] **Catalog growth** — convert `templates/*.md` (20 app guides) into
-  real graph templates; screenshots + badges per the old spec.
+  deploy order from dependency refs. `templategraph.go`,
+  `topoSortServices`.
+- [x] **Expressions** — `{{service.KEY.prop}}` (host/port/user/password/
+  database/url), `{{secret}}`/`{{secret(N)}}`, `{{random:N}}`,
+  `{{VAR:-default}}` (incl. explicitly-empty defaults); `POST
+  /templates/:id/plan` returns the resolved graph without deploying.
+- [x] **Compose import** — `POST /templates/import/compose` (yaml →
+  graph, known DB images become managed databases), `POST
+  /templates/import/git` (compose file fetched from any git repo — clone
+  URL, ssh remote, or owner/repo via connected providers, `ref` selects
+  branch/commit); `templates import-compose|import-git` CLI, MCP tools,
+  paste-or-git toggle in the template UI.
+- [x] **Graph deploy pipeline** — creates services in dependency order,
+  resolves vars/secrets, triggers builds. `deployTemplateGraph`,
+  `POST /templates/deploy` (inline), `POST /projects/:id/import-compose`.
+- [x] **Visual template builder** — canvas mode in the template editor:
+  web/worker/cron/database nodes, handles wire `depends_on`, inspector
+  edits image/repo/engine/port/env/volumes, live validation, applies
+  back to the version-2 graph JSON. Positions persist under
+  `config.canvas`; flat legacy configs open as a single node.
+  `builder-model.ts` + `TemplateBuilder.tsx`.
+- [x] **Catalog growth** — seeded graph stacks for n8n, Gitea,
+  Nextcloud, Vaultwarden, Umami, Immich (Plausible already shipped).
+  `TestSeedTemplatesResolveCleanly` keeps every seed parseable,
+  topo-sortable, and fully resolved. Remaining single-service guides can
+  convert incrementally via the same endpoint.
 
 **Gate**: paste n8n compose → 3-service project with generated secrets
 and wired refs, one click or one CLI call.
 
 ## 7. Phase F — Nodes & infrastructure
 
-- [ ] **SSH bootstrap install** — `containr nodes add --ssh user@host` +
-  UI flow: one SSH session runs agent install (binary + systemd +
-  enroll token), SSH closed forever. dflow onboarding UX, agent-model
-  security.
-- [ ] **Mesh awareness** — agent detects + reports tailscale0/netbird0/
-  zt0 IPs at register; backend stores + displays. Optional
-  `TAILSCALE_AUTH_KEY` enroll-at-provision later.
-- [ ] **Node detail page** — placed services, telemetry history, agent
-  version + self-upgrade, **drain/cordon**, remove.
-- [ ] **Node housekeeping** — agent `prune` command (docker system
-  prune, bounded) + optional schedule (`setServerAutoCleanup` analog —
-  disk pressure is the #1 small-VPS killer).
-- [ ] **Multi-node scheduling** — wire `scheduling_rules` (table exists):
-  pin/spread/affinity, prefer-lowest-usage; deploy engine routes to
-  `services.node_id` via agent commands (agent already runs containers).
-- [ ] **Build-on-node** — agents currently `docker run` prebuilt images
-  only; extend agent to pull registry images (build stays central) —
-  private registry creds flow through Phase C.
+- [x] **SSH bootstrap install** — `containr nodes add <user@host>` mints an
+  enroll token, SSHes once (agent/key/default keys), runs
+  `GET /api/agents/install.sh | bash` remotely, closes the session.
+  `--print` emits the one-liner for manual runs; the Usage page shows the
+  same command. Agent binaries ship in the image under `/agents` and are
+  served at `/api/agents/download/{linux-amd64,linux-arm64}` (install
+  script falls back to GH releases). `cli/commands/nodes_add.go`,
+  `api/assets/install-agent.sh`, `agents.go:ServeInstallScript`/`ServeAgentBinary`.
+- [x] **Mesh awareness** — agent reports tailscale/netbird/wireguard/
+  zerotier interface IPs at register (`mesh` field, authoritative on
+  re-register), stored in `node_agents.metadata.mesh`, shown on the node
+  detail page. `TAILSCALE_AUTH_KEY` enroll-at-provision still open.
+- [x] **Node detail page** — `/nodes/:id` (admin): heartbeat telemetry
+  (cpu/mem sparklines over 1h/24h/7d via `GET /agents/:id/metrics`),
+  containers, command history, rename, auto-prune toggle, prune-now,
+  remove. Drain/cordon and self-upgrade deferred — they need
+  `services.node_id` routing which lands with multi-node scheduling.
+- [x] **Node housekeeping** — agent `prune` + `system_df` commands
+  (`docker system prune -af`, volumes excluded unless requested, optional
+  `--until`). `node_agents.auto_prune` + the health sweep enqueue a prune
+  at most once per 24h per node. Surfaces: `POST /agents/:id/prune`,
+  `nodes update --auto-prune` / `nodes prune [--volumes --until]` /
+  `nodes commands`, MCP `containr_nodes_update|prune|commands`
+  (confirm-gated), Usage-page per-node Prune button + auto toggle.
+  `cmd/agent/main.go`, `notification_producers.go:scheduleAutoPrune`.
+- [🟡] **Multi-node scheduling** — phase 1 shipped: `services.node_id`
+  pin (explicit / `auto` = least-loaded online / `local` = clear),
+  `NodeRunner` seam in the deploy engine routes reconcile to the agent's
+  command queue (`create_container` with image/env/cmd/ports/volumes/
+  labels/limits), `container_instances` inventory per (agent, service,
+  replica), remote stop/start/restart/delete fan-out, `GET
+  /nodes/options`, `--node` on services create/update + MCP + OpenAPI +
+  service-detail Placement section. Drain/cordon shipped:
+  `node_agents.schedulable`, `POST /agents/:id/cordon|uncordon|drain`
+  (drain evicts remote containers via the agent queue + unpins services
+  so they redeploy locally), `nodes cordon|uncordon|drain` CLI +
+  MCP (drain confirm-gated) + node-detail page controls; `auto` and
+  explicit pins skip cordoned nodes. Spread placement shipped:
+  `services.spread` distributes replicas deterministically across every
+  online schedulable agent (replica i → agents[i mod n]), mutually
+  exclusive with a pin; `auto` is now resource-aware — least memory
+  utilisation, then cpu, then container count, with uninstrumented
+  agents sorting last. Lifecycle and `GET /runtime` are
+  inventory-driven, so remote replicas show up and tear down wherever
+  they run. Remote ingress shipped: the agent reports assigned host
+  ports in the `create_container` result, the backend renders a
+  Traefik file-provider config per remote service into
+  `TRAEFIK_DYNAMIC_DIR` (shared volume, `watch=true`) pointing the
+  loadbalancer at each replica's mesh IP + published port; route files
+  are rewritten on every remote reconcile and removed on teardown or
+  local placement. Agents report managed-container states at every
+  heartbeat — exits, OOMs, and crash loops land in inventory between
+  reconciles (tombstones never resurrect). Remote sleep/wake shipped:
+  heartbeats carry per-container net counters, idle remote services
+  lose replicas via agent remove + tombstones, and the route file
+  repoints at `/internal/wake-page/:id` on the backend — first hit
+  retriggers the wake reconcile, which recreates replicas and restores
+  real upstreams. Remote nodes run
+  registry-pulled images only — git builds are the remaining
+  documented ceiling. Tag affinity shipped: `node_agents.tags`
+  (operator-set via `PUT /agents/:id` / `nodes update --tags`) +
+  `services.placement_tags` — `auto` and `spread` only consider
+  online schedulable agents carrying every required tag, tags are
+  re-evaluated each reconcile (a tag change re-spreads replicas),
+  unsatisfiable requirements fail with a clear error, pin + tags
+  and local + tags are rejected, empty array clears. Surfaces:
+  `--placement-tags` on services create/update, `--tags` on
+  `nodes update`, MCP args, OpenAPI, node-detail tag editor +
+  service-detail placement-tags input. Build-on-node and remote
+  sleep/wake both shipped (see below). Remaining: spread weighting
+  by real capacity.
+- [x] **Agent self-upgrade** — `POST /agents/:id/upgrade` enqueues a
+  `self_upgrade` command carrying platform + sha256 + server version;
+  the agent downloads its replacement from `GET /agents/download/
+  :platform`, verifies the checksum, sanity-checks `--version`,
+  atomically swaps its own executable, reports the result, then
+  re-execs (`syscall.Exec`) — no supervisor needed. Agents now stamp
+  `main.version` via ldflags at image build and report it at
+  register/heartbeat (`node_agents.version` refreshes on re-register;
+  older agents keep their stored value). Surfaces: `nodes upgrade`
+  CLI, `containr_nodes_upgrade` MCP (confirm-gated), node-detail page
+  button (online-gated). Ceilings: linux amd64/arm64 only; agents on
+  other platforms get a `NO_BINARY` 409.
+- [x] **Build-on-node** — private registry pulls + real builds shipped.
+  Git sources materialize via `internal/source` checkout (branch/commit,
+  `GIT_ASKPASS` credential injection, dumb-transport fallback), package
+  through `BuildManager.PackageContext`, ship as agent-token artifacts,
+  and `docker build` on the node (`build_image` command). Remote rollbacks
+  `docker save` → artifact → `load_image` on the node. Verified end-to-end
+  on a live agent (PR #60).
 - [ ] **IaC provisioning (ROADMAP §2.2, unchanged)** — Terraform/
   OpenTofu, `infra_connections`, Proxmox + AWS modules, + Hetzner module
   (dflow's second provider), cloud-init → auto-enroll.
-- [ ] **Global/wildcard domain per node** (`nodes.default_domain`) —
-  auto-domains for services on that node.
+- [x] **Global/wildcard domain per node** (`node_agents.default_domain`) —
+  `PUT /agents/:id {default_domain}`; domainless services placed on the
+  node get `<name>.<default_domain>` (pinned → node's base; spread →
+  union of eligible nodes). `serviceDomainNames` resolves them so
+  routing, wake placeholders, and `public_url` all pick them up.
+  CLI `nodes update --domain`, MCP arg, node-detail editor.
 
 ## 8. Phase G — Platform polish
 
@@ -332,13 +425,26 @@ and wired refs, one click or one CLI call.
   events (HMAC-verified) and enqueues matching services. Settings→env
   fallback wired into install-URL + installation-token paths.
   `containr admin github-app` CLI + MCP + OpenAPI.
-- [ ] **fork-sync trigger** — accept repo-sync events on webhook
-  receiver.
-- [ ] **Dynamic filter framework** — port dflow's `filter.utils`
-  pattern (typed filter configs → URL state → client filtering) for
-  audit logs, deployments, notifications tables.
-- [ ] **Notification producers round-out** — backups, agent offline,
-  upgrade available, security findings.
+- [x] **fork-sync trigger** — webhook receiver accepts `sync`,
+  `repository_dispatch`, and `workflow_run` events (no `ref`) alongside
+  pushes: branch falls back to the webhook filter, then the service's
+  own `git_branch`; repo-only matching when no branch is known.
+  Also fixed a latent bug where the webhook's deployment insert omitted
+  the NOT NULL `version` column — push-triggered deploys silently
+  failed for every service.
+- [x] **Dynamic filter framework** — ported dflow's `filter.utils`
+  pattern as `lib/dynamic-filter.ts` + `use-dynamic-filter.ts`
+  (`FilterConfig` schema → `FilterEngine` → `FilterBar`; state lives in
+  `?f.<key>` search params so filtered views are shareable links).
+  `useFilterState` exposes URL state pre-fetch for server-backed
+  filters. Applied: audit logs (server-backed), builds (server + client
+  date-range), activity (severity server + client category/search).
+  Notifications table has no list surface yet — apply when one lands.
+- [x] **Notification producers round-out** — all shipped: deployments
+  (deployments.go), backups (databases.go `createBackupProcess` → owner),
+  agent offline/online sweep (`reconcileAgentHealth` → admins),
+  upgrade-available (`checkForUpgrade`, tag-persisted) and security-scan
+  findings (`scanner.OnScanComplete` → project owner).
 - [x] **Sleep-on-idle / wake-on-traffic** (serverless-lite) —
   `services.sleep_enabled` + `sleep_idle_minutes` (PR #29). Sweeper
   polls container NetworkIO deltas; idle past threshold → workload
@@ -370,19 +476,27 @@ and wired refs, one click or one CLI call.
 
 ## 9. Phase H — Migration & ecosystem
 
-- [ ] **Railway migrator** — `containr migrate railway --token --project
-  --dry-run`: Railway GraphQL → services/vars/domains → recreate via
-  PAT. Landing-page pitch: "off Railway in one command."
-- [ ] **dflow importer** — `containr migrate dflow` via Payload REST
-  export or Mongo dump: servers→nodes, projects, services(+vars/
-  domains/volumes), databases, templates. Onboards dflow refugees.
+- [x] **Railway migrator** — `containr migrate railway --token --project
+  --environment --into --dry-run`: Railway GraphQL (backboard) →
+  services (git-repo/image + command + replicas), variables, custom +
+  service domains → recreates via the Containr API. Project tokens and
+  account tokens both supported. `cli/commands/migrate.go`.
+- [x] **dflow importer** — `containr migrate dflow --url --api-key
+  --project --into --dry-run`: pages the Payload REST collections
+  (users API-Key auth) → services (app→git/web, docker→image,
+  database→typed image + DATABASE_URL for external providers),
+  variables (empty encrypted values flagged), bind volumes, domains.
+  Soft-deleted services excluded. `cli/commands/migrate_dflow.go`.
 - [x] **`containr import compose`** — `POST /projects/:id/import-compose`
   deploys a compose file straight into a project; CLI `import compose`,
   MCP tool, workspace import modal; project delete cascades to
   graph-provisioned managed databases (`database_services.project_id`).
-- [ ] **Template registry** — optional `CONTAINR_TEMPLATE_REGISTRY_URL`
-  fetch/publish; bundled catalog works offline (dflow's self-contained
-  principle — nothing phones home).
+- [x] **Template registry** — `CONTAINR_TEMPLATE_REGISTRY_URL` merges a
+  remote Containr catalog into `GET /templates` as `source:"registry"`
+  (60s cache, dead registry never blocks local). `GET /templates/:id`
+  falls through to the registry; deploy materializes a deterministic
+  `reg-<hash>` private copy for the deployer so re-deploys don't dup.
+  `api/templateregistry.go`, `.env.example`.
 
 ## 9b. Phase I — Companion surfaces
 
@@ -395,28 +509,59 @@ and wired refs, one click or one CLI call.
     a prior deployment, database start/stop/restart/backup-now.
   - **Observe** — polling log tail (300 lines, 5s refresh), per-service
     deployment history, env-doctor issues surfaced on the service view.
-  - [ ] **env var edit + apply-redeploy, domain management, replica
-    scaling, cron execution history** — next iteration.
-  - [ ] **Push notifications** — zero-infra path = self-hosted
-    ntfy/Gotify relay (no Firebase dependency), FCM/APNs optional.
-  - [ ] **Offline resilience** — cached last-known state + unreachable
-    banner.
-- [ ] **Status/offline resilience** — app + CLI degrade gracefully when
-  the instance is unreachable (cached last-known state, clear banner).
+  - [x] **env var edit + domain management + replica scaling** (PR #61 —
+    mobile v1.5: variables editor, domains screen, scale + sleep
+    settings, notifications tab, cron jobs screen with run-now and
+    execution history).
+  - [x] **Push notifications** — per-user `notification_channels`
+    (ntfy + Gotify): every `insertUserNotification` fans out best-effort
+    to enabled channels; CRUD + live test-ping via web settings, CLI
+    `notifications channels`, and MCP. FCM/APNs remain optional.
+  - [x] **Offline resilience** — AsyncStorage-persisted query cache
+    (7d, high-churn keys excluded) + banner when the instance is
+    unreachable (`/health` ping + expo-network).
+- [x] **Status/offline resilience** — web persists the query cache to
+  localStorage (24h) and PlatformShell shows a "last-known data" banner
+  on offline/unreachable; CLI exits `ExitUnavailable` with a clean
+  "cannot reach" message (no stack traces).
 
 ## 10. Carried-over debt (ROADMAP.md items still open)
 
-- [ ] **Gateway traffic path** — mount `/g/:slug/*` → key → rate-limit →
-  `gateway/proxy.go` → metrics. Management API exists; proxy unwired.
-- [ ] **Preview environments runtime** — real build+deploy+subdomain+TTL
-  (bookkeeping only now). Pairs with clone + multi-domain.
-- [ ] **Environments** — env switcher, per-env vars/domains, promote.
-- [ ] **sqlc port** — ~140 raw `database/sql` sites → `sqlc/queries/`.
+- [x] **Gateway traffic path** — `/g/:slug/*` mounted → api_key auth →
+  rpm + monthly quota → `gateway/proxy.go` → usage_counters /
+  metrics_timeseries / incident_events.
+- [x] **Preview environments runtime** — previews are real service clones:
+  branch override, queued deployment, node-domain hostnames, TTL sweeper,
+  promote = redeploy of the source at the preview branch.
+- [x] **Environments** — CRUD (`GET/POST /projects/:id/environments`,
+  `DELETE /environments/:id`), switcher chips with service counts in the
+  workspace, CLI `environments` + MCP parity. Per-env vars/domains ride the
+  service's own scope (one env per service); promote ships via preview
+  promote.
+- [x] **sqlc port** — all static `database/sql` call sites → `sqlc/queries/` + generated `sqlcdb`. Merged: metrics + domains (#75), service clone/move (#76), preview environments (#77), deployments + rollback (#78), runtime ops (#79), cron (#80), sleep/wake sweeper (#81), git providers/repos/webhooks (#82), auth + security (#83), operations/settings/audit/activity/builds/misc + apwhy gateway (#84). Raw SQL remains only for runtime-assembled statements (filtered lists, sparse updates) and Better Auth `auth_users` probes.
 - [ ] **Tests** — canvas/wizard frontend coverage, deployment/template/
   webhook table tests, Playwright e2e golden path.
-- [ ] **First-run wizard** — admin → GitHub App (manifest flow from
-  Phase G makes this self-serve) → Tunnel → done.
-- [ ] **Self-upgrade loop verification**, docs freshness, v1.0.0 release.
+- [x] **UI/UX audit** — browser-driven pass over the whole app (PR #85):
+  fixed the stuck connectivity banner (`pingServer` returned
+  `undefined`), stale persisted sessions, fabricated observability
+  metrics (now real `getServiceMetrics` aggregation), mobile overflow,
+  Security blank state, deep-linkable service tabs, and a dozen
+  polish items.
+- [x] **Design previews** — gitignored `/design` holds three on-brand
+  HTML concepts (console, service detail, landing) on the product's
+  token system with a live white-label accent switcher.
+- [x] **First-run wizard** — public `GET /setup/status` + authed
+  `POST /setup/complete`; `/setup` page steps admin account → GitHub App
+  manifest flow (callback returns to the wizard via a session marker) →
+  optional Cloudflare tunnel token → done. Shell redirects signed-in
+  users to `/setup` while `needs_setup`; installs with existing projects
+  auto-complete so nobody gets nagged retroactively.
+- [x] **Self-upgrade loop verification** — live-verified: admin
+  `POST /agents/:id/upgrade` → `self_upgrade` command → agent downloads
+  `/api/agents/download/linux-amd64` → sha256 verify → `--version`
+  sanity → atomic rename → result posts → `syscall.Exec` re-exec. Agent
+  ran `v0.0.1-old`, came back `v9.9.9-test`, command row `completed`.
+- [ ] **Docs freshness, v1.0.0 release.**
 
 ## 11. Deliberately not imported from dflow
 

app/backend/Dockerfile

@@ -1,5 +1,7 @@
 # Build Go API binary
-FROM golang:1.26-alpine AS go-builder
+ARG GO_IMAGE=golang:1.26-alpine
+ARG NODE_IMAGE=node:22-alpine
+FROM ${GO_IMAGE} AS go-builder
 
 RUN apk add --no-cache git ca-certificates tzdata
 
@@ -9,10 +11,16 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main cmd/server/main.go
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo \
+    -ldflags "-X containr/internal/api.Version=${VERSION}" -o main cmd/server/main.go
+
+# Node-agent binaries served by the API for SSH/bootstrap installs.
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-X main.version=${VERSION}" -o /agents/containr-agent-linux-amd64 ./cmd/agent && \
+    CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-X main.version=${VERSION}" -o /agents/containr-agent-linux-arm64 ./cmd/agent
 
 # Build embedded Better Auth runtime dependencies
-FROM node:22-alpine AS auth-builder
+FROM ${NODE_IMAGE} AS auth-builder
 
 WORKDIR /auth
 
@@ -22,9 +30,9 @@ RUN npm ci --omit=dev
 COPY auth/src ./src
 
 # Final runtime image (Go API + Better Auth sidecar in one container)
-FROM node:22-alpine
+FROM ${NODE_IMAGE}
 
-RUN apk --no-cache add ca-certificates tzdata wget
+RUN apk --no-cache add ca-certificates tzdata wget git
 
 RUN addgroup -g 1001 -S appgroup && \
     adduser -u 1001 -S appuser -G appgroup
@@ -33,6 +41,7 @@ WORKDIR /app
 
 COPY --from=go-builder /app/main ./main
 COPY --from=go-builder /app/migrations_goose ./migrations_goose
+COPY --from=go-builder /agents /agents
 COPY --from=auth-builder /auth ./auth
 
 RUN chown -R appuser:appgroup /app

app/backend/cmd/agent/main.go

@@ -3,14 +3,18 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"log"
 	"net"
 	"net/http"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"runtime"
 	"strconv"
 	"strings"
@@ -104,7 +108,15 @@ type registerResponse struct {
 	Status  string `json:"status"`
 }
 
+// version is stamped at build time via -ldflags "-X main.version=…".
+// The server reports it on upgrades so agents can show what they run.
+var version = "dev"
+
 func main() {
+	if len(os.Args) > 1 && (os.Args[1] == "--version" || os.Args[1] == "version") {
+		fmt.Printf("containr-agent %s\n", version)
+		return
+	}
 	cfg, err := loadConfig()
 	if err != nil {
 		log.Fatal(err)
@@ -167,6 +179,9 @@ func register(ctx context.Context, client *http.Client, cfg agentConfig) (string
 		"ip_address":   cfg.IP,
 		"port":         cfg.Port,
 		"capabilities": detectCapabilities(),
+		"version":      firstEnv("CONTAINR_AGENT_VERSION", version),
+		// Always send mesh so a removed interface clears stored state.
+		"mesh": detectMeshInterfaces(),
 	}
 	var response registerResponse
 	if err := postJSON(ctx, client, cfg, "/api/agents/register", payload, &response); err != nil {
@@ -188,11 +203,93 @@ func sendHeartbeat(ctx context.Context, client *http.Client, cfg agentConfig, ag
 		"container_count": dockerContainerCount(),
 		"system_load":     readSystemLoad(),
 		"uptime":          readSystemUptime(),
-		"version":         firstEnv("CONTAINR_AGENT_VERSION", "dev"),
+		"version":         firstEnv("CONTAINR_AGENT_VERSION", version),
+		"containers":      managedContainerStates(),
 	}
 	return postJSON(ctx, client, cfg, "/api/agents/heartbeat", payload, nil)
 }
 
+// managedContainerStates lists every containr-managed container's docker
+// state plus cumulative network counters — state keeps runtime honest,
+// net bytes let the sleeper detect idle remote services.
+func managedContainerStates() []map[string]interface{} {
+	out, err := runDocker("ps", "-a",
+		"--filter", "label=containr.managed=true",
+		"--format", "{{.Names}}\t{{.State}}")
+	if err != nil {
+		return nil
+	}
+	netIO := containerNetIO()
+	var states []map[string]interface{}
+	for _, line := range strings.Split(out, "\n") {
+		parts := strings.SplitN(line, "\t", 2)
+		if len(parts) != 2 || parts[0] == "" {
+			continue
+		}
+		entry := map[string]interface{}{"name": parts[0], "state": parts[1]}
+		if io, ok := netIO[parts[0]]; ok {
+			entry["rx_bytes"], entry["tx_bytes"] = io[0], io[1]
+		}
+		states = append(states, entry)
+	}
+	return states
+}
+
+// containerNetIO snapshots cumulative rx/tx per running container. Stats
+// only covers running containers — stopped replicas report state without
+// counters, which is all the sleeper needs.
+func containerNetIO() map[string][2]int64 {
+	out, err := runDocker("stats", "--no-stream",
+		"--format", "{{.Name}}\t{{.NetIO}}")
+	if err != nil {
+		return nil
+	}
+	result := map[string][2]int64{}
+	for _, line := range strings.Split(out, "\n") {
+		parts := strings.SplitN(line, "\t", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		io := strings.Split(parts[1], "/")
+		if len(io) != 2 {
+			continue
+		}
+		result[parts[0]] = [2]int64{parseHumanBytes(io[0]), parseHumanBytes(io[1])}
+	}
+	return result
+}
+
+// parseHumanBytes converts docker's human units ("1.2kB", "3.4MB") to bytes.
+func parseHumanBytes(s string) int64 {
+	s = strings.TrimSpace(s)
+	var num float64
+	var unit string
+	if _, err := fmt.Sscanf(s, "%f%s", &num, &unit); err != nil {
+		return 0
+	}
+	switch strings.ToUpper(unit) {
+	case "B":
+		return int64(num)
+	case "KB":
+		return int64(num * 1e3)
+	case "MB":
+		return int64(num * 1e6)
+	case "GB":
+		return int64(num * 1e9)
+	case "TB":
+		return int64(num * 1e12)
+	case "KIB":
+		return int64(num * 1024)
+	case "MIB":
+		return int64(num * 1024 * 1024)
+	case "GIB":
+		return int64(num * 1024 * 1024 * 1024)
+	case "TIB":
+		return int64(num * 1024 * 1024 * 1024 * 1024)
+	}
+	return int64(num)
+}
+
 func processCommands(ctx context.Context, client *http.Client, cfg agentConfig, agentID string) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("%s/api/agents/%s/commands", cfg.APIURL, agentID), nil)
 	if err != nil {
@@ -214,7 +311,13 @@ func processCommands(ctx context.Context, client *http.Client, cfg agentConfig,
 		return err
 	}
 	for _, item := range list.Commands {
-		result, runErr := executeCommand(item)
+		var result, reexecPath string
+		var runErr error
+		if item.Type == "self_upgrade" {
+			result, reexecPath, runErr = selfUpgrade(cfg, item.Payload)
+		} else {
+			result, runErr = executeCommand(cfg, item)
+		}
 		status := "completed"
 		errText := ""
 		if runErr != nil {
@@ -230,11 +333,17 @@ func processCommands(ctx context.Context, client *http.Client, cfg agentConfig,
 		if err := postJSON(ctx, client, cfg, path, payload, nil); err != nil {
 			log.Printf("report command result failed: command=%s err=%v", item.ID, err)
 		}
+		// Re-exec AFTER the result posts — the new binary picks up the loop.
+		if reexecPath != "" {
+			if err := syscall.Exec(reexecPath, os.Args, os.Environ()); err != nil {
+				log.Fatalf("re-exec after upgrade failed: %v", err)
+			}
+		}
 	}
 	return nil
 }
 
-func executeCommand(item command) (string, error) {
+func executeCommand(cfg agentConfig, item command) (string, error) {
 	switch item.Type {
 	case "create_container":
 		return createContainer(item.Payload)
@@ -245,12 +354,100 @@ func executeCommand(item command) (string, error) {
 	case "restart_container":
 		return runDocker("restart", commandTarget(item.Payload))
 	case "remove_container":
-		return runDocker("rm", "-f", commandTarget(item.Payload))
+		out, err := runDocker("rm", "-f", commandTarget(item.Payload))
+		// A missing container is the desired end state — report success.
+		if err != nil && strings.Contains(out, "No such container") {
+			return out, nil
+		}
+		return out, err
+	case "build_image":
+		return buildImage(cfg, item.Payload)
+	case "load_image":
+		return loadImage(cfg, item.Payload)
+	case "prune":
+		return dockerPrune(item.Payload)
+	case "system_df":
+		return runDocker("system", "df", "--format", "json")
 	default:
 		return "", fmt.Errorf("unsupported command type %q", item.Type)
 	}
 }
 
+// selfUpgrade downloads the agent binary the server bundles for this
+// platform, verifies it, swaps it in atomically, and returns the path to
+// re-exec. On any failure the running binary is left untouched.
+func selfUpgrade(cfg agentConfig, payload map[string]interface{}) (string, string, error) {
+	platform := firstString(stringValue(payload["platform"]), runtime.GOOS+"-"+runtime.GOARCH)
+
+	exe, err := os.Executable()
+	if err != nil {
+		return "", "", fmt.Errorf("resolve own path: %w", err)
+	}
+	if resolved, err := filepath.EvalSymlinks(exe); err == nil {
+		exe = resolved
+	}
+
+	url := fmt.Sprintf("%s/api/agents/download/%s", cfg.APIURL, platform)
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return "", "", err
+	}
+	resp, err := (&http.Client{Timeout: 2 * time.Minute}).Do(req)
+	if err != nil {
+		return "", "", fmt.Errorf("download %s: %w", platform, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", "", fmt.Errorf("download %s: server returned %d", platform, resp.StatusCode)
+	}
+
+	newPath := exe + ".new"
+	out, err := os.OpenFile(newPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
+	if err != nil {
+		return "", "", fmt.Errorf("write %s: %w", newPath, err)
+	}
+	h := sha256.New()
+	if _, err := io.Copy(io.MultiWriter(out, h), resp.Body); err != nil {
+		out.Close()
+		os.Remove(newPath)
+		return "", "", fmt.Errorf("download write: %w", err)
+	}
+	out.Close()
+
+	if want := stringValue(payload["sha256"]); want != "" {
+		if got := hex.EncodeToString(h.Sum(nil)); got != want {
+			os.Remove(newPath)
+			return "", "", fmt.Errorf("sha256 mismatch: got %s want %s", got, want)
+		}
+	}
+
+	// Sanity: the new binary must at least report its version.
+	if verOut, err := exec.Command(newPath, "--version").CombinedOutput(); err != nil {
+		os.Remove(newPath)
+		return "", "", fmt.Errorf("new binary failed sanity check: %s", strings.TrimSpace(string(verOut)))
+	}
+
+	if err := os.Rename(newPath, exe); err != nil {
+		os.Remove(newPath)
+		return "", "", fmt.Errorf("swap binary: %w", err)
+	}
+	return fmt.Sprintf("upgraded to %s (%s)", firstString(stringValue(payload["version"]), "latest"), platform), exe, nil
+}
+
+// dockerPrune runs a bounded docker system prune. Volumes are excluded
+// unless the payload explicitly opts in — a stray volume prune destroys
+// database data.
+func dockerPrune(payload map[string]interface{}) (string, error) {
+	args := []string{"system", "prune", "-af"}
+	if boolValue(payload["volumes"]) {
+		args = append(args, "--volumes")
+	}
+	if until := stringValue(payload["until"]); until != "" {
+		args = append(args, "--filter", fmt.Sprintf("until=%s", until))
+	}
+	return runDocker(args...)
+}
+
 func createContainer(payload map[string]interface{}) (string, error) {
 	container, ok := payload["container"].(map[string]interface{})
 	if !ok {
@@ -263,7 +460,38 @@ func createContainer(payload map[string]interface{}) (string, error) {
 		return "", errors.New("container name and image are required")
 	}
 
-	args := []string{"run", "-d", "--name", name, "--restart", "unless-stopped"}
+	// Private registry: log in for the pull, then log back out so the
+	// credential doesn't linger in the node's docker config.
+	if reg, ok := container["registry"].(map[string]interface{}); ok {
+		if user := stringValue(reg["username"]); user != "" {
+			server := firstString(stringValue(reg["server"]), registryHostOf(image))
+			login := exec.Command("docker", "login", server, "-u", user, "--password-stdin")
+			login.Stdin = strings.NewReader(stringValue(reg["password"]))
+			if out, err := login.CombinedOutput(); err != nil {
+				return "", fmt.Errorf("registry login %s: %s", server, strings.TrimSpace(string(out)))
+			}
+			defer func() { _, _ = runDocker("logout", server) }()
+		}
+	}
+
+	// Redeploys reuse the deterministic name — clear the stale container
+	// first so `run` never fails on a name conflict.
+	_, _ = runDocker("rm", "-f", name)
+
+	args := []string{"run", "-d", "--name", name}
+	restart := firstString(stringValue(container["restart_policy"]), "unless-stopped")
+	args = append(args, "--restart", restart)
+	if labels, ok := container["labels"].(map[string]interface{}); ok {
+		for key, value := range labels {
+			args = append(args, "--label", fmt.Sprintf("%s=%v", key, value))
+		}
+	}
+	if mem := int64Value(container["memory"]); mem > 0 {
+		args = append(args, "--memory", fmt.Sprintf("%d", mem))
+	}
+	if cpus := floatValue(container["cpus"]); cpus > 0 {
+		args = append(args, "--cpus", fmt.Sprintf("%g", cpus))
+	}
 	if env, ok := container["environment"].(map[string]interface{}); ok {
 		for key, value := range env {
 			args = append(args, "-e", fmt.Sprintf("%s=%v", key, value))
@@ -278,8 +506,14 @@ func createContainer(payload map[string]interface{}) (string, error) {
 			hostPort := intValue(port["host_port"])
 			containerPort := intValue(port["container_port"])
 			protocol := firstString(stringValue(port["protocol"]), "tcp")
-			if hostPort > 0 && containerPort > 0 {
+			if containerPort <= 0 {
+				continue
+			}
+			if hostPort > 0 {
 				args = append(args, "-p", fmt.Sprintf("%d:%d/%s", hostPort, containerPort, protocol))
+			} else {
+				// Ephemeral host port — docker picks the binding.
+				args = append(args, "-p", fmt.Sprintf("%d/%s", containerPort, protocol))
 			}
 		}
 	}
@@ -301,7 +535,165 @@ func createContainer(payload map[string]interface{}) (string, error) {
 		}
 	}
 	args = append(args, image)
-	return runDocker(args...)
+	if cmd, ok := container["command"].([]interface{}); ok {
+		for _, arg := range cmd {
+			args = append(args, stringValue(arg))
+		}
+	}
+	if _, err := runDocker(args...); err != nil {
+		return "", err
+	}
+	// docker run -d returns before the entrypoint fails — a crash-looping
+	// service would be reported healthy. Give it a moment, then verify.
+	time.Sleep(1500 * time.Millisecond)
+	state, _ := runDocker("inspect", "-f", "{{.State.Status}}", name)
+	if state != "running" {
+		logs, _ := runDocker("logs", "--tail", "5", name)
+		return "", fmt.Errorf("container %s is %q after start: %s", name, state, logs)
+	}
+	// Report the real host port bindings — ephemeral publishes pick a port
+	// the server can't guess, and remote ingress needs the actual mapping.
+	hostPorts := map[string]string{}
+	portsJSON, _ := runDocker("inspect", "-f", "{{json .NetworkSettings.Ports}}", name)
+	var bindings map[string][]struct {
+		HostIP   string `json:"HostIp"`
+		HostPort string `json:"HostPort"`
+	}
+	if json.Unmarshal([]byte(portsJSON), &bindings) == nil {
+		for cport, addrs := range bindings {
+			for _, a := range addrs {
+				if a.HostPort != "" && a.HostPort != "0" {
+					hostPorts[cport] = a.HostPort
+				}
+			}
+		}
+	}
+	out, _ := json.Marshal(map[string]interface{}{"name": name, "host_ports": hostPorts})
+	return string(out), nil
+}
+
+// fetchArtifact downloads a server-side deploy artifact (build context or
+// docker-save tarball) into a temp file the docker CLI consumes.
+func fetchArtifact(cfg agentConfig, artifactID string) (*os.File, error) {
+	if len(artifactID) != 32 {
+		return nil, fmt.Errorf("invalid artifact id")
+	}
+	url := fmt.Sprintf("%s/api/agents/artifacts/%s", cfg.APIURL, artifactID)
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("X-Containr-Agent-Token", cfg.Token)
+	resp, err := (&http.Client{Timeout: 10 * time.Minute}).Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("download artifact: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("download artifact: server returned %d", resp.StatusCode)
+	}
+	f, err := os.CreateTemp("", "containr-artifact-*.tar")
+	if err != nil {
+		return nil, err
+	}
+	if _, err := io.Copy(f, resp.Body); err != nil {
+		f.Close()
+		os.Remove(f.Name())
+		return nil, fmt.Errorf("write artifact: %w", err)
+	}
+	if _, err := f.Seek(0, io.SeekStart); err != nil {
+		f.Close()
+		os.Remove(f.Name())
+		return nil, err
+	}
+	return f, nil
+}
+
+// buildImage docker-builds a packaged context tar on this node. The context
+// already carries its Dockerfile at the tar root, so `docker build -` can
+// stream it straight from stdin. Result reports the image digest so the
+// server records what each node actually produced.
+func buildImage(cfg agentConfig, payload map[string]interface{}) (string, error) {
+	image := stringValue(payload["image"])
+	artifactID := stringValue(payload["artifact_id"])
+	if image == "" || artifactID == "" {
+		return "", errors.New("build_image requires image and artifact_id")
+	}
+	f, err := fetchArtifact(cfg, artifactID)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	defer os.Remove(f.Name())
+
+	args := []string{"build", "-t", image}
+	if boolValue(payload["no_cache"]) {
+		args = append(args, "--no-cache")
+	}
+	// Bare --build-arg keys read their values from the process env — keeps
+	// token-bearing args out of the node's process list.
+	env := os.Environ()
+	if buildArgs, ok := payload["build_args"].(map[string]interface{}); ok {
+		for k, v := range buildArgs {
+			args = append(args, "--build-arg", k)
+			env = append(env, fmt.Sprintf("%s=%v", k, v))
+		}
+	}
+	args = append(args, "-")
+	cmd := exec.Command("docker", args...)
+	cmd.Stdin = f
+	cmd.Env = env
+	outBytes, err := cmd.CombinedOutput()
+	out := strings.TrimSpace(string(outBytes))
+	if err != nil {
+		return "", fmt.Errorf("docker build failed: %s", tailOutput(out, 4096))
+	}
+	digest, _ := runDocker("inspect", "-f", "{{.Id}}", image)
+	size, _ := runDocker("inspect", "-f", "{{.Size}}", image)
+	result, _ := json.Marshal(map[string]string{
+		"image": image, "id": digest, "size": size,
+		"log_tail": tailOutput(out, 4096),
+	})
+	return string(result), nil
+}
+
+// loadImage imports a docker-save tarball — rollbacks of locally-built tags
+// reach remote nodes this way since no registry serves containr-* images.
+func loadImage(cfg agentConfig, payload map[string]interface{}) (string, error) {
+	artifactID := stringValue(payload["artifact_id"])
+	if artifactID == "" {
+		return "", errors.New("load_image requires artifact_id")
+	}
+	f, err := fetchArtifact(cfg, artifactID)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	defer os.Remove(f.Name())
+	out, err := runDockerStdin(f, "load")
+	if err != nil {
+		return "", fmt.Errorf("docker load failed: %s", tailOutput(out, 4096))
+	}
+	return out, nil
+}
+
+// tailOutput bounds command results — full docker build logs would swamp
+// the agent_commands row.
+func tailOutput(s string, max int) string {
+	if len(s) <= max {
+		return s
+	}
+	return s[len(s)-max:]
+}
+
+// registryHostOf mirrors the server's registryHost: first path segment with
+// a "." or ":" is a registry host; bare names mean Docker Hub.
+func registryHostOf(imageRef string) string {
+	parts := strings.Split(imageRef, "/")
+	if len(parts) > 1 && (strings.Contains(parts[0], ".") || strings.Contains(parts[0], ":")) {
+		return parts[0]
+	}
+	return "docker.io"
 }
 
 func commandTarget(payload map[string]interface{}) string {
@@ -354,6 +746,42 @@ func detectCapabilities() capabilities {
 	}
 }
 
+// detectMeshInterfaces reports overlay-network interface IPs (tailscale,
+// netbird, zerotier, wireguard) so the backend can display reachable
+// mesh addresses alongside the primary IP.
+func detectMeshInterfaces() map[string]string {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return nil
+	}
+	mesh := map[string]string{}
+	for _, iface := range ifaces {
+		name := strings.ToLower(iface.Name)
+		isMesh := strings.HasPrefix(name, "tailscale") || strings.HasPrefix(name, "ts.") ||
+			strings.HasPrefix(name, "netbird") || strings.HasPrefix(name, "wt") ||
+			strings.HasPrefix(name, "zt") || strings.HasPrefix(name, "wg")
+		if !isMesh || iface.Flags&net.FlagUp == 0 {
+			continue
+		}
+		addrs, err := iface.Addrs()
+		if err != nil {
+			continue
+		}
+		for _, addr := range addrs {
+			ip, _, err := net.ParseCIDR(addr.String())
+			if err != nil || ip.IsLoopback() {
+				continue
+			}
+			if v4 := ip.To4(); v4 != nil {
+				mesh[iface.Name] = v4.String()
+			} else if _, exists := mesh[iface.Name]; !exists {
+				mesh[iface.Name] = ip.String()
+			}
+		}
+	}
+	return mesh
+}
+
 func collectResources(ip string) nodeResources {
 	mem := readMemory()
 	storage := readStorage("/")
@@ -469,6 +897,15 @@ func runDocker(args ...string) (string, error) {
 	return strings.TrimSpace(string(output)), err
 }
 
+// runDockerStdin pipes stdin into docker — build contexts and saved image
+// tarballs stream in without a second copy on disk.
+func runDockerStdin(stdin io.Reader, args ...string) (string, error) {
+	cmd := exec.Command("docker", args...)
+	cmd.Stdin = stdin
+	output, err := cmd.CombinedOutput()
+	return strings.TrimSpace(string(output)), err
+}
+
 func dockerAvailable() bool {
 	_, err := exec.LookPath("docker")
 	if err != nil {
@@ -564,3 +1001,35 @@ func boolValue(value interface{}) bool {
 	typed, _ := value.(bool)
 	return typed
 }
+
+func int64Value(value interface{}) int64 {
+	switch typed := value.(type) {
+	case int64:
+		return typed
+	case int:
+		return int64(typed)
+	case float64:
+		return int64(typed)
+	case json.Number:
+		out, _ := typed.Int64()
+		return out
+	default:
+		return 0
+	}
+}
+
+func floatValue(value interface{}) float64 {
+	switch typed := value.(type) {
+	case float64:
+		return typed
+	case int:
+		return float64(typed)
+	case int64:
+		return float64(typed)
+	case json.Number:
+		out, _ := typed.Float64()
+		return out
+	default:
+		return 0
+	}
+}

app/backend/internal/api/activity.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -180,13 +181,13 @@ func handleGetProjectActivity(c *gin.Context) {
 	}
 
 	// Access check: approved / owner / member / admin.
-	var visible bool
-	if err := db.QueryRow(
-		`SELECT p.is_approved OR p.owner_id = $2::uuid OR $3::bool
-			OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $2::uuid)
-		 FROM projects p WHERE p.id = $1`,
-		projectID, userID, contextIsAdmin(c),
-	).Scan(&visible); err != nil || !visible {
+	userUUID, _ := uuid.Parse(userID)
+	visible, err := sqlcdb.New(db.DB).CheckSecurityProjectAccess(context.Background(), sqlcdb.CheckSecurityProjectAccessParams{
+		ID:      uuid.MustParse(projectID),
+		OwnerID: userUUID,
+		Column3: contextIsAdmin(c),
+	})
+	if err != nil || !visible {
 		respondError(c, http.StatusNotFound, "NOT_FOUND", "project not found")
 		return
 	}
@@ -237,12 +238,12 @@ func StartAuditRetention(ctx context.Context, db *database.DB) {
 	}
 
 	prune := func() {
-		res, err := db.Exec(`DELETE FROM audit_logs WHERE created_at < NOW() - ($1::int * INTERVAL '1 day')`, days)
+		n, err := sqlcdb.New(db.DB).PruneAuditLogs(context.Background(), int32(days))
 		if err != nil {
 			log.Printf("audit retention prune failed: %v", err)
 			return
 		}
-		if n, _ := res.RowsAffected(); n > 0 {
+		if n > 0 {
 			log.Printf("audit retention: pruned %d rows older than %d days", n, days)
 		}
 	}
@@ -265,34 +266,24 @@ func StartAuditRetention(ctx context.Context, db *database.DB) {
 // backfillAuditMetadata classifies rows written before severity/category/label
 // existed so filters and the feed see uniform metadata.
 func backfillAuditMetadata(db *database.DB) {
-	cursor := uuid.Nil.String()
+	q := sqlcdb.New(db.DB)
+	cursor := uuid.Nil
 	for {
-		rows, err := db.Query(
-			`SELECT id::text, resource, action FROM audit_logs
-			 WHERE label = '' AND id > $1::uuid ORDER BY id LIMIT 500`, cursor)
+		rows, err := q.ListAuditBackfillBatch(context.Background(), cursor)
 		if err != nil {
 			log.Printf("audit backfill scan failed: %v", err)
 			return
 		}
-		type row struct{ id, resource, action string }
-		var batch []row
-		for rows.Next() {
-			var r row
-			if rows.Scan(&r.id, &r.resource, &r.action) == nil {
-				batch = append(batch, r)
-			}
-		}
-		rows.Close()
-		if len(batch) == 0 {
+		if len(rows) == 0 {
 			return
 		}
-		for _, r := range batch {
-			cursor = r.id
-			sev, cat, label := classifyAuditEvent(r.resource, r.action)
-			if _, err := db.Exec(
-				`UPDATE audit_logs SET severity = $1, category = $2, label = $3 WHERE id = $4::uuid`,
-				sev, cat, label, r.id,
-			); err != nil {
+		for _, r := range rows {
+			id, _ := uuid.Parse(r.ID)
+			cursor = id
+			sev, cat, label := classifyAuditEvent(r.Resource, r.Action)
+			if err := q.SetAuditLogMetadata(context.Background(), sqlcdb.SetAuditLogMetadataParams{
+				Severity: sev, Category: cat, Label: label, Column4: id,
+			}); err != nil {
 				log.Printf("audit backfill update failed: %v", err)
 			}
 		}

app/backend/internal/api/admin.go

@@ -52,15 +52,11 @@ func EnsureAdminAccount(ctx context.Context, db *database.DB, cfg *config.Config
 		return
 	}
 
-	var userID string
-	err = db.QueryRowContext(ctx, `
-		INSERT INTO users (email, password_hash, name, is_admin)
-		VALUES ($1, $2, $3, true)
-		ON CONFLICT (email) DO UPDATE
-		SET is_admin = true, updated_at = NOW()
-		RETURNING id
-	`, email, string(hashed), name).Scan(&userID)
-	if err != nil {
+	if _, err := sqlcdb.New(db.DB).UpsertAdminUser(ctx, sqlcdb.UpsertAdminUserParams{
+		Email:        email,
+		PasswordHash: string(hashed),
+		Name:         name,
+	}); err != nil {
 		log.Printf("Admin bootstrap failed to upsert user %s: %v", email, err)
 		return
 	}
@@ -185,24 +181,18 @@ func handleAdminOverview(c *gin.Context) {
 func handleAdminListUsers(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 
-	rows, err := db.QueryContext(c.Request.Context(), `
-		SELECT id, email, name, COALESCE(avatar_url, ''), is_admin, COALESCE(to_char(created_at, 'YYYY-MM-DD"T"HH24:MI:SS"Z"'), '')
-		FROM users
-		ORDER BY created_at ASC
-	`)
+	rows, err := sqlcdb.New(db.DB).ListAdminUsers(c.Request.Context())
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list users"})
 		return
 	}
-	defer rows.Close()
 
-	users := make([]adminUserRow, 0)
-	for rows.Next() {
-		var u adminUserRow
-		if err := rows.Scan(&u.ID, &u.Email, &u.Name, &u.AvatarURL, &u.IsAdmin, &u.CreatedAt); err != nil {
-			continue
-		}
-		users = append(users, u)
+	users := make([]adminUserRow, 0, len(rows))
+	for _, r := range rows {
+		users = append(users, adminUserRow{
+			ID: r.ID.String(), Email: r.Email, Name: r.Name,
+			AvatarURL: r.AvatarUrl, IsAdmin: r.IsAdmin, CreatedAt: r.CreatedAt,
+		})
 	}
 	c.JSON(http.StatusOK, gin.H{"users": users})
 }
@@ -229,15 +219,16 @@ func handleAdminSetUserAdmin(c *gin.Context) {
 		return
 	}
 
-	result, err := db.ExecContext(c.Request.Context(),
-		`UPDATE users SET is_admin = $1, updated_at = NOW() WHERE id = $2`,
-		req.IsAdmin, targetID,
-	)
+	targetUUID, _ := uuid.Parse(targetID)
+	n, err := sqlcdb.New(db.DB).SetUserAdmin(c.Request.Context(), sqlcdb.SetUserAdminParams{
+		IsAdmin: req.IsAdmin,
+		ID:      targetUUID,
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update user"})
 		return
 	}
-	if n, _ := result.RowsAffected(); n == 0 {
+	if n == 0 {
 		c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})
 		return
 	}
@@ -258,15 +249,13 @@ func handleAdminImpersonateUser(c *gin.Context) {
 		return
 	}
 
-	var email, name string
-	var isAdmin bool
-	err := db.QueryRowContext(c.Request.Context(),
-		`SELECT email, COALESCE(name, ''), is_admin FROM users WHERE id = $1`, targetID).
-		Scan(&email, &name, &isAdmin)
+	userUUID, _ := uuid.Parse(targetID)
+	info, err := sqlcdb.New(db.DB).GetAdminUserInfo(c.Request.Context(), userUUID)
 	if err != nil {
 		respondError(c, http.StatusNotFound, "NOT_FOUND", "user not found")
 		return
 	}
+	email, name, isAdmin := info.Email, info.Name, info.IsAdmin
 	if isAdmin {
 		respondError(c, http.StatusForbidden, "FORBIDDEN", "admin accounts cannot be impersonated")
 		return
@@ -286,9 +275,9 @@ func handleAdminImpersonateUser(c *gin.Context) {
 	}
 
 	LogAuditWithRequest(c, "user", targetID, "impersonate", map[string]interface{}{
-		"actor_id":    actorID,
+		"actor_id":     actorID,
 		"target_email": email,
-		"expires_at":  expiresAt.Format(time.RFC3339),
+		"expires_at":   expiresAt.Format(time.RFC3339),
 	})
 	c.JSON(http.StatusOK, gin.H{
 		"token":      token,

app/backend/internal/api/agents.go

@@ -6,13 +6,17 @@ import (
 	"crypto/sha256"
 	"crypto/subtle"
 	"database/sql"
+	_ "embed"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
+	"log"
 	"math"
 	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -26,16 +30,24 @@ import (
 
 // NodeAgent represents a container orchestration agent
 type NodeAgent struct {
-	ID            string                 `json:"id"`
-	Name          string                 `json:"name"`
-	Hostname      string                 `json:"hostname"`
-	IPAddress     string                 `json:"ip_address"`
-	Port          int                    `json:"port"`
-	Status        string                 `json:"status"`
-	Version       string                 `json:"version"`
-	Capabilities  AgentCapabilities      `json:"capabilities"`
-	Resources     NodeResources          `json:"resources"`
-	LastHeartbeat time.Time              `json:"last_heartbeat"`
+	ID            string            `json:"id"`
+	Name          string            `json:"name"`
+	Hostname      string            `json:"hostname"`
+	IPAddress     string            `json:"ip_address"`
+	Port          int               `json:"port"`
+	Status        string            `json:"status"`
+	Version       string            `json:"version"`
+	Capabilities  AgentCapabilities `json:"capabilities"`
+	Resources     NodeResources     `json:"resources"`
+	LastHeartbeat time.Time         `json:"last_heartbeat"`
+	AutoPrune     bool              `json:"auto_prune"`
+	Schedulable   bool              `json:"schedulable"`
+	// Tags are operator-set placement labels; services with placement_tags
+	// only schedule onto agents carrying every required tag.
+	Tags []string `json:"tags"`
+	// DefaultDomain is this node's base domain — services placed here with
+	// no explicit domains get <name>.<default_domain> automatically.
+	DefaultDomain string                 `json:"default_domain"`
 	CreatedAt     time.Time              `json:"created_at"`
 	UpdatedAt     time.Time              `json:"updated_at"`
 	Metadata      map[string]interface{} `json:"metadata"`
@@ -189,6 +201,17 @@ type AgentHeartbeat struct {
 	SystemLoad     SystemLoad    `json:"system_load"`
 	Uptime         int64         `json:"uptime"`
 	Version        string        `json:"version"`
+	// Containers reports managed-container liveness — {name, state} per
+	// containr.managed container on the node — so remote replica status
+	// reflects reality between reconciles (exits, OOMs, crash loops).
+	Containers []AgentContainerState `json:"containers,omitempty"`
+}
+
+type AgentContainerState struct {
+	Name    string `json:"name"`
+	State   string `json:"state"`
+	RxBytes int64  `json:"rx_bytes,omitempty"`
+	TxBytes int64  `json:"tx_bytes,omitempty"`
 }
 
 type SystemLoad struct {
@@ -225,16 +248,45 @@ func unmarshalRaw(raw pqtype.NullRawMessage, dst interface{}) {
 	}
 }
 
+// ListNodeOptions returns the minimal id/name/status list used by the service
+// placement picker — available to any authenticated user (no hostnames, IPs,
+// or telemetry).
+func (h *NodeAgentHandler) ListNodeOptions(c *gin.Context) {
+	rows, err := h.q.ListAgents(c.Request.Context())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list nodes"})
+		return
+	}
+	options := make([]gin.H, 0, len(rows))
+	for _, row := range rows {
+		var tags []string
+		if len(row.Tags) > 0 {
+			_ = json.Unmarshal(row.Tags, &tags)
+		}
+		options = append(options, gin.H{
+			"id":     row.ID,
+			"name":   row.Name,
+			"status": row.Status.String,
+			"tags":   tags,
+		})
+	}
+	c.JSON(http.StatusOK, gin.H{"nodes": options})
+}
+
 func agentFromRow(row sqlcdb.NodeAgent) NodeAgent {
 	agent := NodeAgent{
-		ID:        row.ID,
-		Name:      row.Name,
-		Hostname:  row.Hostname,
-		IPAddress: row.IpAddress,
-		Port:      int(row.Port),
-		Status:    row.Status.String,
-		Version:   row.Version.String,
-		Metadata:  map[string]interface{}{},
+		ID:            row.ID,
+		Name:          row.Name,
+		Hostname:      row.Hostname,
+		IPAddress:     row.IpAddress,
+		Port:          int(row.Port),
+		Status:        row.Status.String,
+		Version:       row.Version.String,
+		AutoPrune:     row.AutoPrune,
+		Schedulable:   row.Schedulable,
+		Tags:          []string{},
+		DefaultDomain: row.DefaultDomain,
+		Metadata:      map[string]interface{}{},
 	}
 	if row.LastHeartbeat.Valid {
 		agent.LastHeartbeat = row.LastHeartbeat.Time
@@ -248,6 +300,9 @@ func agentFromRow(row sqlcdb.NodeAgent) NodeAgent {
 	unmarshalRaw(row.Capabilities, &agent.Capabilities)
 	unmarshalRaw(row.Resources, &agent.Resources)
 	unmarshalRaw(row.Metadata, &agent.Metadata)
+	if len(row.Tags) > 0 {
+		_ = json.Unmarshal(row.Tags, &agent.Tags)
+	}
 	return agent
 }
 
@@ -326,7 +381,9 @@ func (h *NodeAgentHandler) RegisterAgent(c *gin.Context) {
 		IPAddress    string            `json:"ip_address" binding:"required"`
 		Port         int               `json:"port" binding:"required"`
 		Capabilities AgentCapabilities `json:"capabilities" binding:"required"`
+		Version      string            `json:"version"`
 		AuthToken    string            `json:"auth_token"`
+		Mesh         map[string]string `json:"mesh"`
 	}
 
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -341,24 +398,43 @@ func (h *NodeAgentHandler) RegisterAgent(c *gin.Context) {
 	}
 
 	ctx := c.Request.Context()
+	metadata := map[string]interface{}{}
+	// req.Mesh is authoritative when present (newer agents always send it,
+	// possibly empty); nil means an older agent — keep any stored value.
+	if req.Mesh != nil {
+		metadata["mesh"] = req.Mesh
+	}
 
 	// Re-registering an existing host updates it in place.
 	if existing, err := h.q.GetAgentByHostAndIP(ctx, sqlcdb.GetAgentByHostAndIPParams{
 		Hostname:  req.Hostname,
 		IpAddress: req.IPAddress,
 	}); err == nil {
+		if existing.Metadata.Valid && len(existing.Metadata.RawMessage) > 0 {
+			var prev map[string]interface{}
+			if err := json.Unmarshal(existing.Metadata.RawMessage, &prev); err == nil {
+				for k, v := range prev {
+					if _, ok := metadata[k]; !ok {
+						metadata[k] = v
+					}
+				}
+			}
+		}
 		updated, err := h.q.UpdateAgent(ctx, sqlcdb.UpdateAgentParams{
-			ID:            existing.ID,
-			Name:          req.Name,
-			Hostname:      existing.Hostname,
-			IpAddress:     existing.IpAddress,
-			Port:          int32(req.Port),
-			Status:        sql.NullString{String: "connecting", Valid: true},
-			Version:       existing.Version,
+			ID:        existing.ID,
+			Name:      req.Name,
+			Hostname:  existing.Hostname,
+			IpAddress: existing.IpAddress,
+			Port:      int32(req.Port),
+			Status:    sql.NullString{String: "connecting", Valid: true},
+			// Older agents don't report a version — keep whatever's stored.
+			Version:       sql.NullString{String: firstNonEmpty(req.Version, existing.Version.String), Valid: true},
 			Capabilities:  rawJSON(req.Capabilities),
 			Resources:     existing.Resources,
 			LastHeartbeat: sql.NullTime{Time: time.Now(), Valid: true},
-			Metadata:      existing.Metadata,
+			Metadata:      rawJSON(metadata),
+			AutoPrune:     existing.AutoPrune,
+			Schedulable:   existing.Schedulable,
 		})
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update agent"})
@@ -404,11 +480,11 @@ func (h *NodeAgentHandler) RegisterAgent(c *gin.Context) {
 		IpAddress:     req.IPAddress,
 		Port:          int32(req.Port),
 		Status:        sql.NullString{String: "connecting", Valid: true},
-		Version:       sql.NullString{},
+		Version:       sql.NullString{String: req.Version, Valid: req.Version != ""},
 		Capabilities:  rawJSON(req.Capabilities),
 		Resources:     rawJSON(resources),
 		LastHeartbeat: sql.NullTime{Time: time.Now(), Valid: true},
-		Metadata:      rawJSON(map[string]interface{}{}),
+		Metadata:      rawJSON(metadata),
 	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create agent"})
@@ -489,13 +565,46 @@ func (h *NodeAgentHandler) UpdateAgent(c *gin.Context) {
 		Resources:     rawJSON(agent.Resources),
 		LastHeartbeat: sql.NullTime{Time: agent.LastHeartbeat, Valid: !agent.LastHeartbeat.IsZero()},
 		Metadata:      rawJSON(agent.Metadata),
+		AutoPrune:     agent.AutoPrune,
+		Schedulable:   agent.Schedulable,
 	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update agent"})
 		return
 	}
 
-	c.JSON(http.StatusOK, gin.H{"agent": agentFromRow(updated)})
+	// Tags persist through their own column write — UpdateAgent keeps the
+	// register-path signature untouched.
+	resp := agentFromRow(updated)
+	if raw, ok := updates["default_domain"]; ok {
+		domain := strings.ToLower(strings.TrimSpace(fmt.Sprintf("%v", raw)))
+		if domain != "" && !validHostname(domain) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "default_domain must be a valid hostname", "code": "VALIDATION"})
+			return
+		}
+		if err := h.q.SetAgentDefaultDomain(ctx, sqlcdb.SetAgentDefaultDomainParams{ID: id, DefaultDomain: domain}); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update default domain"})
+			return
+		}
+		resp.DefaultDomain = domain
+	}
+	if raw, ok := updates["tags"]; ok {
+		var tags []string
+		if b, mErr := json.Marshal(raw); mErr == nil {
+			_ = json.Unmarshal(b, &tags)
+		}
+		tags = normalizePlacementTags(tags)
+		if err := h.q.SetAgentTags(ctx, sqlcdb.SetAgentTagsParams{
+			ID:      id,
+			Column2: json.RawMessage(tagsJSON(tags)),
+		}); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update agent tags"})
+			return
+		}
+		resp.Tags = tags
+	}
+
+	c.JSON(http.StatusOK, gin.H{"agent": resp})
 }
 
 // applyAgentUpdates merges whitelisted keys from an arbitrary update map.
@@ -516,6 +625,8 @@ func applyAgentUpdates(agent *NodeAgent, updates map[string]interface{}) {
 	remarshal("capabilities", &agent.Capabilities)
 	remarshal("resources", &agent.Resources)
 	remarshal("metadata", &agent.Metadata)
+	remarshal("auto_prune", &agent.AutoPrune)
+	remarshal("schedulable", &agent.Schedulable)
 }
 
 // DeleteAgent removes an agent
@@ -581,6 +692,22 @@ func (h *NodeAgentHandler) SendHeartbeat(c *gin.Context) {
 		return
 	}
 
+	// Reconcile remote container liveness — exits and crash loops surface
+	// in inventory between reconciles. Best-effort, never fatal.
+	for _, rc := range heartbeat.Containers {
+		if rc.Name == "" || rc.State == "" {
+			continue
+		}
+		stateJSON, _ := json.Marshal(rc.State)
+		bytesJSON, _ := json.Marshal(rc.RxBytes + rc.TxBytes)
+		_ = h.q.UpdateContainerStateByName(ctx, sqlcdb.UpdateContainerStateByNameParams{
+			Name:        rc.Name,
+			NodeAgentID: heartbeat.NodeAgentID,
+			Column3:     stateJSON,
+			Column4:     bytesJSON,
+		})
+	}
+
 	c.Status(http.StatusOK)
 }
 
@@ -650,9 +777,51 @@ func (h *NodeAgentHandler) CompleteCommand(c *gin.Context) {
 		h.updateContainerStatusAfterCommand(ctx, out)
 	}
 
+	// Command payloads can carry registry credentials — scrub them once the
+	// command is settled so secrets don't linger in the queue rows.
+	scrubCommandSecrets(ctx, h.q, commandID, command.Payload)
+
 	c.JSON(http.StatusOK, gin.H{"command": out})
 }
 
+// scrubCommandSecrets rewrites a completed command's payload with any
+// credential-bearing fields blanked — registry passwords and build-time
+// args (tokens like NPM_TOKEN ride along as build args). Best-effort — a
+// failed scrub leaves the row.
+func scrubCommandSecrets(ctx context.Context, q *sqlcdb.Queries, commandID string, payload pqtype.NullRawMessage) {
+	if !payload.Valid || len(payload.RawMessage) == 0 {
+		return
+	}
+	var doc map[string]interface{}
+	if err := json.Unmarshal(payload.RawMessage, &doc); err != nil {
+		return
+	}
+	dirty := false
+	if container, ok := doc["container"].(map[string]interface{}); ok {
+		if reg, ok := container["registry"].(map[string]interface{}); ok && reg["password"] != nil {
+			reg["password"] = "***"
+			dirty = true
+		}
+	}
+	for _, key := range []string{"build_args", "environment"} {
+		if args, ok := doc[key].(map[string]interface{}); ok && len(args) > 0 {
+			for k := range args {
+				args[k] = "***"
+			}
+			dirty = true
+		}
+	}
+	if !dirty {
+		return
+	}
+	if err := q.ScrubCommandPayload(ctx, sqlcdb.ScrubCommandPayloadParams{
+		ID:      commandID,
+		Payload: rawJSON(doc),
+	}); err != nil {
+		log.Printf("agents: scrub command %s payload: %v", commandID, err)
+	}
+}
+
 func (h *NodeAgentHandler) updateContainerStatusAfterCommand(ctx context.Context, command AgentCommand) {
 	row, err := h.q.GetContainer(ctx, *command.ContainerID)
 	if err != nil {
@@ -803,6 +972,103 @@ func (h *NodeAgentHandler) CreateContainer(c *gin.Context) {
 	c.JSON(http.StatusCreated, gin.H{"container": container})
 }
 
+// PruneAgent enqueues a bounded `docker system prune -af` command. Volumes
+// stay unless the caller explicitly opts in.
+func (h *NodeAgentHandler) PruneAgent(c *gin.Context) {
+	agentID := c.Param("id")
+	if _, err := h.q.GetAgent(c.Request.Context(), agentID); err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Agent not found"})
+		return
+	}
+	var req struct {
+		Until   string `json:"until"`   // e.g. "168h" — only prune objects older than this
+		Volumes bool   `json:"volumes"` // destructive — off by default
+	}
+	_ = c.ShouldBindJSON(&req)
+
+	command, err := h.q.CreateCommand(c.Request.Context(), sqlcdb.CreateCommandParams{
+		ID:          uuid.New().String(),
+		Type:        "prune",
+		NodeAgentID: agentID,
+		Payload:     rawJSON(map[string]interface{}{"until": req.Until, "volumes": req.Volumes}),
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to enqueue prune"})
+		return
+	}
+	c.JSON(http.StatusAccepted, gin.H{"command": command})
+}
+
+// UpgradeAgent enqueues a self_upgrade command: the agent downloads its
+// replacement binary from this server's bundled /download endpoint,
+// verifies the sha256, swaps it in, and re-execs. Fails fast when no
+// bundled binary exists for the agent's architecture.
+func (h *NodeAgentHandler) UpgradeAgent(c *gin.Context) {
+	ctx := c.Request.Context()
+	id := c.Param("id")
+	agent, err := h.q.GetAgent(ctx, id)
+	if err != nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Agent not found")
+		return
+	}
+	if agent.Status.String != "online" {
+		respondError(c, http.StatusConflict, "NODE_OFFLINE", "node is offline — reconnect it before upgrading")
+		return
+	}
+
+	arch := "amd64"
+	var caps struct {
+		SupportedArchitectures []string `json:"supported_architectures"`
+	}
+	unmarshalRaw(agent.Capabilities, &caps)
+	if len(caps.SupportedArchitectures) > 0 && caps.SupportedArchitectures[0] != "" {
+		arch = caps.SupportedArchitectures[0]
+	}
+	platform := "linux-" + arch // agents only ship for linux today
+
+	dir := os.Getenv("CONTAINR_AGENT_BIN_DIR")
+	if dir == "" {
+		dir = "/agents"
+	}
+	path := filepath.Join(dir, "containr-agent-"+platform)
+	sum, err := sha256File(path)
+	if err != nil {
+		respondError(c, http.StatusConflict, "NO_BINARY",
+			fmt.Sprintf("no bundled agent binary for %s on this server", platform))
+		return
+	}
+
+	command, err := h.q.CreateCommand(ctx, sqlcdb.CreateCommandParams{
+		ID:          uuid.New().String(),
+		Type:        "self_upgrade",
+		NodeAgentID: id,
+		Payload: rawJSON(map[string]interface{}{
+			"platform": platform,
+			"sha256":   sum,
+			"version":  Version,
+		}),
+	})
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to enqueue upgrade")
+		return
+	}
+	LogAuditWithRequest(c, "node", id, "upgrade", map[string]interface{}{"platform": platform, "version": Version})
+	c.JSON(http.StatusAccepted, gin.H{"command": command, "platform": platform, "version": Version})
+}
+
+func sha256File(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
 // ExecuteCommand executes a command on an agent
 func (h *NodeAgentHandler) ExecuteCommand(c *gin.Context) {
 	agentID := c.Param("id")
@@ -1214,9 +1480,49 @@ func (h *NodeAgentHandler) SetupPublicRoutes(router *gin.RouterGroup) {
 		agents.POST("/heartbeat", h.SendHeartbeat)
 		agents.GET("/:id/commands", h.GetPendingCommandsForAgent)
 		agents.POST("/:id/commands/:commandId/result", h.CompleteCommand)
+
+		// Bootstrap surface — the install script and agent binaries are
+		// public; the enroll token is the actual secret.
+		agents.GET("/install.sh", h.ServeInstallScript)
+		agents.GET("/download/:platform", h.ServeAgentBinary)
+
+		// Deploy artifacts (build contexts, image tarballs) — token-gated;
+		// the blobs are per-deployment source code, not public bootstrap.
+		agents.GET("/artifacts/:id", h.ServeArtifact)
 	}
 }
 
+//go:embed assets/install-agent.sh
+var agentInstallScript string
+
+// ServeInstallScript returns the agent bootstrap script. The script
+// downloads the binary from this instance first, GH releases second.
+func (h *NodeAgentHandler) ServeInstallScript(c *gin.Context) {
+	c.Data(http.StatusOK, "text/x-sh", []byte(agentInstallScript))
+}
+
+// ServeAgentBinary streams a bundled agent binary. Images ship the
+// linux binaries under CONTAINR_AGENT_BIN_DIR (default /agents).
+func (h *NodeAgentHandler) ServeAgentBinary(c *gin.Context) {
+	platform := c.Param("platform")
+	if platform != "linux-amd64" && platform != "linux-arm64" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "unsupported platform"})
+		return
+	}
+	dir := os.Getenv("CONTAINR_AGENT_BIN_DIR")
+	if dir == "" {
+		dir = "/agents"
+	}
+	path := filepath.Join(dir, "containr-agent-"+platform)
+	info, err := os.Stat(path)
+	if err != nil || info.IsDir() {
+		c.JSON(http.StatusNotFound, gin.H{"error": "no bundled binary for " + platform})
+		return
+	}
+	c.Header("Content-Disposition", `attachment; filename="containr-agent"`)
+	c.File(path)
+}
+
 // SetupAdminRoutes registers dashboard/control agent routes. Command
 // history and container details can leak sensitive output, so these stay
 // admin-only rather than joining the public read group.
@@ -1243,8 +1549,95 @@ func (h *NodeAgentHandler) SetupAdminRoutes(router *gin.RouterGroup) {
 		agents.DELETE("/:id/containers/:containerId", h.ContainerAction)
 
 		agents.GET("/:id/metrics", h.GetAgentMetrics)
+		agents.POST("/:id/cordon", h.CordonAgent)
+		agents.POST("/:id/uncordon", h.UncordonAgent)
+		agents.POST("/:id/drain", h.DrainAgent)
+		agents.POST("/:id/upgrade", h.UpgradeAgent)
+		agents.POST("/:id/prune", h.PruneAgent)
 		agents.POST("/:id/commands", h.ExecuteCommand)
 		agents.GET("/:id/commands", h.GetAgentCommands)
 		agents.GET("/:id/commands/:commandId", h.GetCommandStatus)
 	}
 }
+
+// setSchedulable flips the node's scheduling gate. Cordoned nodes keep
+// running their placed replicas but take no new pins or `auto` placements.
+func (h *NodeAgentHandler) setSchedulable(c *gin.Context, schedulable bool) {
+	id := c.Param("id")
+	if _, err := h.q.GetAgent(c.Request.Context(), id); err != nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Agent not found")
+		return
+	}
+	if err := h.q.SetAgentSchedulable(c.Request.Context(), sqlcdb.SetAgentSchedulableParams{
+		ID: id, Schedulable: schedulable,
+	}); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to update node")
+		return
+	}
+	LogAuditWithRequest(c, "node", id, map[bool]string{true: "uncordon", false: "cordon"}[schedulable], nil)
+	c.JSON(http.StatusOK, gin.H{"id": id, "schedulable": schedulable})
+}
+
+// CordonAgent blocks new placements on the node (explicit pins and `auto`).
+func (h *NodeAgentHandler) CordonAgent(c *gin.Context) { h.setSchedulable(c, false) }
+
+// UncordonAgent re-opens the node for placement.
+func (h *NodeAgentHandler) UncordonAgent(c *gin.Context) { h.setSchedulable(c, true) }
+
+// DrainAgent cordons the node, removes every service container via the agent
+// command queue, and clears the affected services' pins — they fall back to
+// the local host on next deploy and can be re-pinned to another node.
+// Requires the node to be online; an offline node can't acknowledge the
+// removals.
+func (h *NodeAgentHandler) DrainAgent(c *gin.Context) {
+	ctx := c.Request.Context()
+	id := c.Param("id")
+	agent, err := h.q.GetAgent(ctx, id)
+	if err != nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Agent not found")
+		return
+	}
+	if agent.Status.String != "online" {
+		respondError(c, http.StatusConflict, "NODE_OFFLINE",
+			"node is not online — reconnect it, or remove the containers manually")
+		return
+	}
+	if err := h.q.SetAgentSchedulable(ctx, sqlcdb.SetAgentSchedulableParams{
+		ID: id, Schedulable: false,
+	}); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to cordon node")
+		return
+	}
+
+	runner := &agentNodeRunner{q: h.q}
+	rows, err := h.q.ListContainersForAgent(ctx, id)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to list node containers")
+		return
+	}
+	services := map[string]bool{}
+	for _, row := range rows {
+		services[row.ServiceID] = true
+	}
+	var drained int
+	var firstErr error
+	for serviceID := range services {
+		if err := runner.RemoveService(ctx, serviceID, id); err != nil {
+			if firstErr == nil {
+				firstErr = err
+			}
+			continue
+		}
+		drained += 1
+	}
+	unpinned, _ := h.q.ClearServiceNodePins(ctx, sql.NullString{String: id, Valid: true})
+	if firstErr != nil {
+		respondError(c, http.StatusBadGateway, "DRAIN_PARTIAL",
+			fmt.Sprintf("drained %d service(s), unpinned %d — one failed: %v", drained, unpinned, firstErr))
+		return
+	}
+	LogAuditWithRequest(c, "node", id, "drain", map[string]interface{}{
+		"services": drained, "unpinned": unpinned,
+	})
+	c.JSON(http.StatusOK, gin.H{"id": id, "schedulable": false, "services_drained": drained, "services_unpinned": unpinned})
+}

app/backend/internal/api/apwhy_handlers.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"context"
 	"crypto/rand"
 	"database/sql"
@@ -14,6 +15,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/go-playground/validator/v10"
+	"github.com/google/uuid"
 	"github.com/lib/pq"
 	"golang.org/x/crypto/bcrypt"
 )
@@ -160,21 +162,22 @@ func handleAPwhyServiceValidate(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 	ctx := c.Request.Context()
 
-	var upstreamURL, healthPath string
-	var authHeader, authValue sql.NullString
-	var timeoutMs sql.NullInt64
-	err := db.QueryRowContext(ctx, `
-		SELECT upstream_url, health_path, upstream_auth_header, upstream_auth_value, request_timeout_ms
-		FROM api_services WHERE id = $1
-	`, serviceID).Scan(&upstreamURL, &healthPath, &authHeader, &authValue, &timeoutMs)
-	if err != nil {
+	svcUUID, parseErr := uuid.Parse(serviceID)
+	var svc sqlcdb.GetAPServiceForValidateRow
+	var err error
+	if parseErr == nil {
+		svc, err = sqlcdb.New(db.DB).GetAPServiceForValidate(ctx, svcUUID)
+	}
+	if parseErr != nil || err != nil {
 		sendErrorResponse(c, http.StatusNotFound, "SERVICE_NOT_FOUND", "Service not found", nil)
 		return
 	}
+	upstreamURL, healthPath := svc.UpstreamUrl, svc.HealthPath
+	authHeader, authValue := svc.UpstreamAuthHeader, svc.UpstreamAuthValue
 
 	timeout := 8000
-	if timeoutMs.Valid && timeoutMs.Int64 > 0 {
-		timeout = int(timeoutMs.Int64)
+	if svc.RequestTimeoutMs.Valid && svc.RequestTimeoutMs.Int32 > 0 {
+		timeout = int(svc.RequestTimeoutMs.Int32)
 	}
 	target := strings.TrimRight(upstreamURL, "/") + "/" + strings.TrimLeft(healthPath, "/")
 
@@ -203,17 +206,19 @@ func handleAPwhyServiceValidate(c *gin.Context) {
 		validationStatus = "healthy"
 	}
 
-	_, _ = db.ExecContext(ctx, `
-		UPDATE api_services
-		SET last_validation_at = NOW(), last_validation_status = $1, last_validation_message = $2, updated_at = NOW()
-		WHERE id = $3
-	`, validationStatus, message, serviceID)
+	q := sqlcdb.New(db.DB)
+	_ = q.SetAPServiceValidation(ctx, sqlcdb.SetAPServiceValidationParams{
+		LastValidationStatus:  sql.NullString{String: validationStatus, Valid: true},
+		LastValidationMessage: sql.NullString{String: message, Valid: true},
+		ID:                    svcUUID,
+	})
 
 	if !ok {
-		_, _ = db.ExecContext(ctx, `
-			INSERT INTO incident_events (service_id, code, message, severity, http_status, occurred_at)
-			VALUES ($1, 'SERVICE_VALIDATION_FAILED', $2, 'medium', $3, NOW())
-		`, serviceID, message, status)
+		_ = q.InsertServiceIncident(ctx, sqlcdb.InsertServiceIncidentParams{
+			ServiceID:  uuid.NullUUID{UUID: svcUUID, Valid: true},
+			Message:    message,
+			HttpStatus: sql.NullInt32{Int32: int32(status), Valid: true},
+		})
 	}
 
 	sendSuccessResponse(c, http.StatusOK, map[string]interface{}{
@@ -231,36 +236,24 @@ func handleAPwhyServicesList(c *gin.Context) {
 	ctx := context.Background()
 
 	// Query services from database
-	rows, err := db.QueryContext(ctx, `
-		SELECT id, name, slug, upstream_url, route_prefix, enabled, created_at, updated_at
-		FROM api_services
-		ORDER BY created_at DESC
-	`)
+	rows, err := sqlcdb.New(db.DB).ListAPServices(ctx)
 	if err != nil {
 		sendErrorResponse(c, http.StatusInternalServerError, "DATABASE_ERROR",
 			"Failed to query services", err.Error())
 		return
 	}
-	defer rows.Close()
-
-	services := make([]map[string]interface{}, 0)
-	for rows.Next() {
-		var id, name, slug, upstreamURL, routePrefix, createdAt, updatedAt string
-		var enabled int
-		err := rows.Scan(&id, &name, &slug, &upstreamURL, &routePrefix, &enabled, &createdAt, &updatedAt)
-		if err != nil {
-			continue // Skip malformed rows
-		}
 
+	services := make([]map[string]interface{}, 0, len(rows))
+	for _, r := range rows {
 		services = append(services, map[string]interface{}{
-			"id":          id,
-			"name":        name,
-			"slug":        slug,
-			"upstreamUrl": upstreamURL,
-			"routePrefix": routePrefix,
-			"enabled":     enabled != 0,
-			"createdAt":   createdAt,
-			"updatedAt":   updatedAt,
+			"id":          r.ID.String(),
+			"name":        r.Name,
+			"slug":        r.Slug,
+			"upstreamUrl": r.UpstreamUrl,
+			"routePrefix": r.RoutePrefix,
+			"enabled":     r.Enabled != 0,
+			"createdAt":   r.CreatedAt,
+			"updatedAt":   r.UpdatedAt,
 		})
 	}
 
@@ -299,14 +292,14 @@ func handleAPwhyServicesCreate(c *gin.Context) {
 	}
 
 	// id defaults to gen_random_uuid(); enabled defaults to 1.
-	var id string
-	err := db.QueryRowContext(ctx, `
-		INSERT INTO api_services (
-			name, slug, upstream_url, route_prefix, health_path,
-			rpm_limit, monthly_quota, created_at, updated_at
-		) VALUES ($1, $2, $3, $4, '/health', $5, $6, NOW(), NOW())
-		RETURNING id
-	`, req.Name, slug, req.UpstreamURL, req.RoutePrefix, rpmLimit, monthlyQuota).Scan(&id)
+	svcID, err := sqlcdb.New(db.DB).InsertAPService(ctx, sqlcdb.InsertAPServiceParams{
+		Name:         req.Name,
+		Slug:         slug,
+		UpstreamUrl:  req.UpstreamURL,
+		RoutePrefix:  req.RoutePrefix,
+		RpmLimit:     sql.NullInt32{Int32: int32(rpmLimit), Valid: true},
+		MonthlyQuota: sql.NullInt32{Int32: int32(monthlyQuota), Valid: true},
+	})
 
 	if err != nil {
 		if isUniqueViolation(err) {
@@ -320,7 +313,7 @@ func handleAPwhyServicesCreate(c *gin.Context) {
 	}
 
 	serviceData := map[string]interface{}{
-		"id":           id,
+		"id":           svcID.String(),
 		"name":         req.Name,
 		"slug":         slug,
 		"upstreamUrl":  req.UpstreamURL,
@@ -356,13 +349,15 @@ func handleAPwhyServicesPatch(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 
 	if input.Enabled != nil {
-		enabled := 0
+		enabled := int32(0)
 		if *input.Enabled {
 			enabled = 1
 		}
-		_, err := db.ExecContext(context.Background(),
-			"UPDATE api_services SET enabled = $1, updated_at = NOW() WHERE id = $2",
-			enabled, serviceID)
+		svcUUID, _ := uuid.Parse(serviceID)
+		err := sqlcdb.New(db.DB).SetAPServiceEnabled(context.Background(), sqlcdb.SetAPServiceEnabledParams{
+			Enabled: enabled,
+			ID:      svcUUID,
+		})
 
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{
@@ -383,11 +378,7 @@ func handleAPwhyServicesPatch(c *gin.Context) {
 func handleAPwhyKeysList(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 
-	rows, err := db.QueryContext(context.Background(), `
-		SELECT id, name, key_prefix, plan, enabled, rpm_limit, monthly_quota, created_at, updated_at
-		FROM api_keys 
-		ORDER BY created_at DESC
-	`)
+	rows, err := sqlcdb.New(db.DB).ListAPKeys(context.Background())
 	if err != nil {
 		c.JSON(http.StatusOK, gin.H{
 			"ok":   true,
@@ -395,34 +386,24 @@ func handleAPwhyKeysList(c *gin.Context) {
 		})
 		return
 	}
-	defer rows.Close()
-
-	keys := make([]map[string]interface{}, 0)
-	for rows.Next() {
-		var id, name, keyPrefix, plan, createdAt, updatedAt string
-		var enabled int
-		var rpmLimit, monthlyQuota sql.NullInt64
-
-		err := rows.Scan(&id, &name, &keyPrefix, &plan, &enabled, &rpmLimit, &monthlyQuota, &createdAt, &updatedAt)
-		if err != nil {
-			continue
-		}
 
+	keys := make([]map[string]interface{}, 0, len(rows))
+	for _, r := range rows {
 		key := map[string]interface{}{
-			"id":        id,
-			"name":      name,
-			"keyPrefix": keyPrefix,
-			"plan":      plan,
-			"enabled":   enabled != 0,
-			"createdAt": createdAt,
-			"updatedAt": updatedAt,
+			"id":        r.ID.String(),
+			"name":      r.Name,
+			"keyPrefix": r.KeyPrefix,
+			"plan":      r.Plan,
+			"enabled":   r.Enabled != 0,
+			"createdAt": r.CreatedAt,
+			"updatedAt": r.UpdatedAt,
 		}
 
-		if rpmLimit.Valid {
-			key["rpmLimit"] = rpmLimit.Int64
+		if r.RpmLimit.Valid {
+			key["rpmLimit"] = int64(r.RpmLimit.Int32)
 		}
-		if monthlyQuota.Valid {
-			key["monthlyQuota"] = monthlyQuota.Int64
+		if r.MonthlyQuota.Valid {
+			key["monthlyQuota"] = int64(r.MonthlyQuota.Int32)
 		}
 
 		keys = append(keys, key)
@@ -481,14 +462,14 @@ func handleAPwhyKeysCreate(c *gin.Context) {
 	}
 
 	// id defaults to gen_random_uuid(); enabled defaults to 1.
-	var id string
-	err = db.QueryRowContext(context.Background(), `
-		INSERT INTO api_keys (
-			name, key_hash, key_prefix, plan, allowed_service_ids,
-			rpm_limit, monthly_quota, created_at, updated_at
-		) VALUES ($1, $2, $3, $4, '[]', $5, $6, NOW(), NOW())
-		RETURNING id
-	`, input.Name, keyHash, keyPrefix, plan, rpmLimit, monthlyQuota).Scan(&id)
+	keyID, err := sqlcdb.New(db.DB).InsertAPKey(context.Background(), sqlcdb.InsertAPKeyParams{
+		Name:         input.Name,
+		KeyHash:      keyHash,
+		KeyPrefix:    keyPrefix,
+		Plan:         plan,
+		RpmLimit:     sql.NullInt32{Int32: int32(rpmLimit), Valid: true},
+		MonthlyQuota: sql.NullInt32{Int32: int32(monthlyQuota), Valid: true},
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{
@@ -501,7 +482,7 @@ func handleAPwhyKeysCreate(c *gin.Context) {
 	c.JSON(http.StatusCreated, gin.H{
 		"ok": true,
 		"data": gin.H{
-			"id":           id,
+			"id":           keyID.String(),
 			"name":         input.Name,
 			"plan":         plan,
 			"key":          apiKey, // Only return the actual key once
@@ -532,13 +513,15 @@ func handleAPwhyKeysPatch(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 
 	if input.Enabled != nil {
-		enabled := 0
+		enabled := int32(0)
 		if *input.Enabled {
 			enabled = 1
 		}
-		_, err := db.ExecContext(context.Background(),
-			"UPDATE api_keys SET enabled = $1, updated_at = NOW() WHERE id = $2",
-			enabled, keyID)
+		keyUUID, _ := uuid.Parse(keyID)
+		err := sqlcdb.New(db.DB).SetAPKeyEnabled(context.Background(), sqlcdb.SetAPKeyEnabledParams{
+			Enabled: enabled,
+			ID:      keyUUID,
+		})
 
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{
@@ -560,23 +543,27 @@ func handleAPwhyAnalyticsOps(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 
 	// Get counts from database
-	var totalServices, totalKeys, totalUsers int
+	q := sqlcdb.New(db.DB)
+	ctx := context.Background()
 
-	if err := db.QueryRowContext(context.Background(), "SELECT COUNT(*) FROM api_services").Scan(&totalServices); err != nil {
+	totalServices, err := q.CountAPServices(ctx)
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"ok":    false,
 			"error": "Failed to count services: " + err.Error(),
 		})
 		return
 	}
-	if err := db.QueryRowContext(context.Background(), "SELECT COUNT(*) FROM api_keys").Scan(&totalKeys); err != nil {
+	totalKeys, err := q.CountAPKeys(ctx)
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"ok":    false,
 			"error": "Failed to count api keys: " + err.Error(),
 		})
 		return
 	}
-	if err := db.QueryRowContext(context.Background(), "SELECT COUNT(*) FROM users").Scan(&totalUsers); err != nil {
+	totalUsers, err := q.CountUsers(ctx)
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"ok":    false,
 			"error": "Failed to count users: " + err.Error(),
@@ -584,8 +571,8 @@ func handleAPwhyAnalyticsOps(c *gin.Context) {
 		return
 	}
 
-	var totalRequests int
-	if err := db.QueryRowContext(context.Background(), "SELECT COALESCE(SUM(request_count), 0) FROM usage_counters").Scan(&totalRequests); err != nil {
+	totalRequests, err := q.SumUsageCounters(ctx)
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"ok":    false,
 			"error": "Failed to aggregate request counters: " + err.Error(),
@@ -593,12 +580,8 @@ func handleAPwhyAnalyticsOps(c *gin.Context) {
 		return
 	}
 
-	var requestsToday int
-	if err := db.QueryRowContext(context.Background(), `
-		SELECT COALESCE(SUM(value), 0)::int
-		FROM metrics_timeseries
-		WHERE metric = 'request_total' AND occurred_at >= DATE_TRUNC('day', NOW())
-	`).Scan(&requestsToday); err != nil {
+	requestsToday, err := q.SumRequestMetricSince(ctx, "day")
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"ok":    false,
 			"error": "Failed to aggregate today's requests: " + err.Error(),
@@ -606,12 +589,8 @@ func handleAPwhyAnalyticsOps(c *gin.Context) {
 		return
 	}
 
-	var requestsThisMonth int
-	if err := db.QueryRowContext(context.Background(), `
-		SELECT COALESCE(SUM(value), 0)::int
-		FROM metrics_timeseries
-		WHERE metric = 'request_total' AND occurred_at >= DATE_TRUNC('month', NOW())
-	`).Scan(&requestsThisMonth); err != nil {
+	requestsThisMonth, err := q.SumRequestMetricSince(ctx, "month")
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"ok":    false,
 			"error": "Failed to aggregate monthly requests: " + err.Error(),
@@ -636,94 +615,47 @@ func handleAPwhyAnalyticsOps(c *gin.Context) {
 func handleAPwhyAnalyticsTraffic(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 
+	q := sqlcdb.New(db.DB)
+	ctx := context.Background()
+
 	topServices := make([]map[string]interface{}, 0)
-	serviceRows, err := db.QueryContext(context.Background(), `
-		SELECT s.id, s.name, COALESCE(SUM(u.request_count), 0) AS total_requests
-		FROM api_services s
-		LEFT JOIN usage_counters u ON u.service_id = s.id
-		GROUP BY s.id, s.name
-		ORDER BY total_requests DESC, s.name ASC
-		LIMIT 10
-	`)
-	if err == nil {
-		defer serviceRows.Close()
-		for serviceRows.Next() {
-			var serviceID, serviceName string
-			var totalRequests int
-			if scanErr := serviceRows.Scan(&serviceID, &serviceName, &totalRequests); scanErr == nil {
-				topServices = append(topServices, map[string]interface{}{
-					"service_id": serviceID,
-					"name":       serviceName,
-					"requests":   totalRequests,
-				})
-			}
+	if serviceRows, err := q.ListTopAPServices(ctx); err == nil {
+		for _, r := range serviceRows {
+			topServices = append(topServices, map[string]interface{}{
+				"service_id": r.ID.String(),
+				"name":       r.Name,
+				"requests":   r.TotalRequests,
+			})
 		}
 	}
 
 	requestsByDay := make([]map[string]interface{}, 0)
-	trafficRows, err := db.QueryContext(context.Background(), `
-		SELECT TO_CHAR(DATE_TRUNC('day', occurred_at), 'YYYY-MM-DD') AS day_bucket, COUNT(*) AS total
-		FROM metrics_timeseries
-		WHERE metric = 'request_total' AND occurred_at >= NOW() - INTERVAL '7 days'
-		GROUP BY DATE_TRUNC('day', occurred_at)
-		ORDER BY DATE_TRUNC('day', occurred_at) ASC
-	`)
-	if err == nil {
-		defer trafficRows.Close()
-		for trafficRows.Next() {
-			var day string
-			var count int
-			if scanErr := trafficRows.Scan(&day, &count); scanErr == nil {
-				requestsByDay = append(requestsByDay, map[string]interface{}{
-					"day":      day,
-					"requests": count,
-				})
-			}
+	if trafficRows, err := q.ListRequestsByDay(ctx); err == nil {
+		for _, r := range trafficRows {
+			requestsByDay = append(requestsByDay, map[string]interface{}{
+				"day":      r.DayBucket,
+				"requests": r.Total,
+			})
 		}
 	}
 
 	statusCodes := make([]map[string]interface{}, 0)
-	statusRows, err := db.QueryContext(context.Background(), `
-		SELECT COALESCE(http_status, 0) AS status_code, COALESCE(SUM(count), 0) AS total
-		FROM incident_events
-		WHERE occurred_at >= NOW() - INTERVAL '7 days'
-		GROUP BY COALESCE(http_status, 0)
-		ORDER BY total DESC, status_code ASC
-	`)
-	if err == nil {
-		defer statusRows.Close()
-		for statusRows.Next() {
-			var code int
-			var total int
-			if scanErr := statusRows.Scan(&code, &total); scanErr == nil {
-				statusCodes = append(statusCodes, map[string]interface{}{
-					"status_code": code,
-					"count":       total,
-				})
-			}
+	if statusRows, err := q.ListIncidentStatusCodes(ctx); err == nil {
+		for _, r := range statusRows {
+			statusCodes = append(statusCodes, map[string]interface{}{
+				"status_code": r.StatusCode,
+				"count":       r.Total,
+			})
 		}
 	}
 
 	clientEvents := make([]map[string]interface{}, 0)
-	eventRows, err := db.QueryContext(context.Background(), `
-		SELECT COALESCE((labels_json::jsonb ->> 'path'), 'unknown') AS path, COUNT(*) AS total
-		FROM metrics_timeseries
-		WHERE metric = 'client_event' AND occurred_at >= NOW() - INTERVAL '7 days'
-		GROUP BY COALESCE((labels_json::jsonb ->> 'path'), 'unknown')
-		ORDER BY total DESC, path ASC
-		LIMIT 20
-	`)
-	if err == nil {
-		defer eventRows.Close()
-		for eventRows.Next() {
-			var path string
-			var total int
-			if scanErr := eventRows.Scan(&path, &total); scanErr == nil {
-				clientEvents = append(clientEvents, map[string]interface{}{
-					"path":  path,
-					"count": total,
-				})
-			}
+	if eventRows, err := q.ListClientEventPaths(ctx); err == nil {
+		for _, r := range eventRows {
+			clientEvents = append(clientEvents, map[string]interface{}{
+				"path":  r.Path,
+				"count": r.Total,
+			})
 		}
 	}
 

app/backend/internal/api/artifacts.go

@@ -0,0 +1,136 @@
+package api
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+// containrWorkDir is the build workspace root — same dir the BuildManager
+// was constructed with; checkouts and agent artifacts live beneath it.
+const containrWorkDir = "/tmp/containr-builds"
+
+// artifacts is a one-shot blob store for node agents: build contexts and
+// docker-save tarballs the server produced on behalf of a deployment. Files
+// live under workdir/artifacts/<id> and are removed when the deployment
+// finishes or after maxArtifactAge.
+var artifacts = &artifactStore{files: map[string]string{}}
+
+type artifactStore struct {
+	mu    sync.Mutex
+	dir   string
+	files map[string]string
+}
+
+const maxArtifactAge = 2 // hours — a deployment can never outlive this
+
+// initArtifacts points the store at dir (created on demand).
+func initArtifacts(dir string) {
+	artifacts.mu.Lock()
+	defer artifacts.mu.Unlock()
+	artifacts.dir = dir
+	_ = os.MkdirAll(dir, 0o755)
+}
+
+// artifactDir returns the store root, defaulting under the build workdir.
+func artifactDir() string {
+	artifacts.mu.Lock()
+	defer artifacts.mu.Unlock()
+	if artifacts.dir != "" {
+		return artifacts.dir
+	}
+	return filepath.Join(containrWorkDir, "artifacts")
+}
+
+// putArtifact streams rc into the store and returns the artifact id.
+func putArtifact(rc io.Reader) (string, error) {
+	buf := make([]byte, 16)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	id := hex.EncodeToString(buf)
+	dir := artifactDir()
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return "", err
+	}
+	path := filepath.Join(dir, id+".tar")
+	f, err := os.Create(path)
+	if err != nil {
+		return "", err
+	}
+	if _, err := io.Copy(f, rc); err != nil {
+		f.Close()
+		os.Remove(path)
+		return "", err
+	}
+	f.Close()
+
+	artifacts.mu.Lock()
+	artifacts.files[id] = path
+	artifacts.mu.Unlock()
+	return id, nil
+}
+
+// removeArtifact deletes the file and forgets the id. Safe on missing ids.
+func removeArtifact(id string) {
+	artifacts.mu.Lock()
+	path, ok := artifacts.files[id]
+	delete(artifacts.files, id)
+	artifacts.mu.Unlock()
+	if ok {
+		_ = os.Remove(path)
+		return
+	}
+	// Registered before a restart — remove best-effort by name.
+	if id != "" {
+		_ = os.Remove(filepath.Join(artifactDir(), id+".tar"))
+	}
+}
+
+// ServeArtifact streams a stored blob to a token-authenticated agent. Files
+// persist across downloads — spread builds share one context — and are
+// deleted by the deployment that created them.
+func (h *NodeAgentHandler) ServeArtifact(c *gin.Context) {
+	if !h.isValidAgentAuthToken(c.Request.Context(), agentAuthTokenFromRequest(c)) {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid auth token"})
+		return
+	}
+	id := c.Param("id")
+	raw, err := hex.DecodeString(id)
+	if len(id) != 32 || err != nil || len(raw) != 16 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Artifact not found"})
+		return
+	}
+	path := filepath.Join(artifactDir(), id+".tar")
+	info, err := os.Stat(path)
+	if err != nil || info.IsDir() {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Artifact not found"})
+		return
+	}
+	c.Header("Content-Type", "application/x-tar")
+	c.File(path)
+}
+
+// purgeStaleArtifacts drops files older than maxArtifactAge. Called on boot.
+func purgeStaleArtifacts() {
+	entries, err := os.ReadDir(artifactDir())
+	if err != nil {
+		return
+	}
+	for _, e := range entries {
+		info, err := e.Info()
+		if err != nil {
+			continue
+		}
+		if info.ModTime().Before(time.Now().Add(-maxArtifactAge * time.Hour)) {
+			_ = os.Remove(filepath.Join(artifactDir(), e.Name()))
+		}
+	}
+}

app/backend/internal/api/assets/install-agent.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Containr node agent installer.
+#   curl -fsSL <api>/api/agents/install.sh | bash -s -- --url <api> --token <enroll-token>
+#
+# One-shot: downloads the agent binary from the Containr instance (or GH
+# releases as fallback), writes a systemd unit, starts it. SSH is never
+# needed again — the agent heartbeats and polls commands outbound.
+set -euo pipefail
+
+API_URL=""
+TOKEN=""
+AGENT_NAME=""
+VERSION=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --url) API_URL="$2"; shift 2 ;;
+    --token) TOKEN="$2"; shift 2 ;;
+    --name) AGENT_NAME="$2"; shift 2 ;;
+    --version) VERSION="$2"; shift 2 ;;
+    *) echo "unknown flag: $1" >&2; exit 2 ;;
+  esac
+done
+
+[ -n "$API_URL" ] || { echo "--url is required" >&2; exit 2; }
+[ -n "$TOKEN" ] || { echo "--token is required (create one: containr nodes tokens create)" >&2; exit 2; }
+API_URL="${API_URL%/}"
+API_URL="${API_URL%/api/v1}"
+API_URL="${API_URL%/api}"
+
+info() { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
+err()  { printf '\033[1;31mError:\033[0m %s\n' "$*" >&2; }
+
+[ "$(id -u)" = "0" ] || { err "run as root (sudo bash -s -- --url … --token …)"; exit 1; }
+command -v docker >/dev/null 2>&1 || { err "docker not found"; exit 1; }
+command -v curl >/dev/null 2>&1 || { err "curl not found"; exit 1; }
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64|amd64) ARCH=amd64 ;;
+  aarch64|arm64) ARCH=arm64 ;;
+  *) err "unsupported architecture: $ARCH"; exit 1 ;;
+esac
+
+BIN=/usr/local/bin/containr-agent
+info "downloading containr-agent (linux/$ARCH)"
+if ! curl -fsSL "$API_URL/api/agents/download/linux-$ARCH" -o "$BIN" 2>/dev/null; then
+  info "instance has no bundled binary — trying GitHub releases"
+  REF="${VERSION:-latest}"
+  if [ "$REF" = "latest" ]; then
+    DL="https://github.com/Dvorinka/Containr/releases/latest/download/containr-agent-linux-$ARCH"
+  else
+    DL="https://github.com/Dvorinka/Containr/releases/download/$REF/containr-agent-linux-$ARCH"
+  fi
+  curl -fsSL "$DL" -o "$BIN" || { err "agent download failed"; exit 1; }
+fi
+chmod +x "$BIN"
+
+UNIT=/etc/systemd/system/containr-agent.service
+info "writing systemd unit"
+cat > "$UNIT" <<UNIT
+[Unit]
+Description=Containr node agent
+After=docker.service network-online.target
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Environment=CONTAINR_API_URL=$API_URL
+Environment=CONTAINR_AGENT_AUTH_TOKEN=$TOKEN
+Environment=CONTAINR_AGENT_NAME=${AGENT_NAME:-$(hostname)}
+Restart=always
+RestartSec=5
+ExecStart=$BIN
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+
+systemctl daemon-reload
+systemctl enable --now containr-agent
+info "agent installed and started — it should appear in Containr within ~15s"

app/backend/internal/api/audit.go

@@ -2,6 +2,9 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"context"
+	"database/sql"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -11,6 +14,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
 )
 
 type AuditLog struct {
@@ -98,16 +102,20 @@ func LogAudit(userID, resource, resourceID, action string, details map[string]in
 	}
 
 	detailsJSON, _ := json.Marshal(details)
-	resourceUUID := parseUUIDOrNil(resourceID)
-	userUUID := parseUUIDOrNil(userID)
 	severity, category, label := classifyAuditEvent(resource, action)
 
-	auditID := uuid.New().String()
-	_, err := db.Exec(
-		`INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, severity, category, label, created_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
-		auditID, userUUID, resource, resourceUUID, action, string(detailsJSON), severity, category, label, time.Now().UTC(),
-	)
+	err := sqlcdb.New(db.DB).InsertAuditLog(context.Background(), sqlcdb.InsertAuditLogParams{
+		ID:         uuid.New(),
+		UserID:     nullUUIDOrNil(userID),
+		Resource:   resource,
+		ResourceID: nullUUIDOrNil(resourceID),
+		Action:     action,
+		Details:    pqtype.NullRawMessage{RawMessage: detailsJSON, Valid: true},
+		Severity:   severity,
+		Category:   category,
+		Label:      label,
+		CreatedAt:  time.Now().UTC(),
+	})
 
 	if err != nil {
 	}
@@ -131,16 +139,24 @@ func LogAuditWithRequest(c *gin.Context, resource, resourceID, action string, de
 	if uid, ok := userID.(string); ok {
 		userIDStr = uid
 	}
-	userUUID := parseUUIDOrNil(userIDStr)
-	resourceUUID := parseUUIDOrNil(resourceID)
 	severity, category, label := classifyAuditEvent(resource, action)
 
-	auditID := uuid.New().String()
-	_, err := db.Exec(
-		`INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, ip_address, user_agent, severity, category, label, created_at)
-		 VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9, $10, $11, $12)`,
-		auditID, userUUID, resource, resourceUUID, action, string(detailsJSON), c.ClientIP(), c.GetHeader("User-Agent"), severity, category, label, time.Now().UTC(),
-	)
+	var inet pqtype.Inet
+	_ = inet.Scan(c.ClientIP())
+	err := sqlcdb.New(db.DB).InsertAuditLogWithRequest(context.Background(), sqlcdb.InsertAuditLogWithRequestParams{
+		ID:         uuid.New(),
+		UserID:     nullUUIDOrNil(userIDStr),
+		Resource:   resource,
+		ResourceID: nullUUIDOrNil(resourceID),
+		Action:     action,
+		Column6:    json.RawMessage(detailsJSON),
+		Column7:    inet,
+		UserAgent:  sql.NullString{String: c.GetHeader("User-Agent"), Valid: true},
+		Severity:   severity,
+		Category:   category,
+		Label:      label,
+		CreatedAt:  time.Now().UTC(),
+	})
 
 	if err != nil {
 	}
@@ -255,30 +271,29 @@ func handleGetResourceAuditLogs(c *gin.Context) {
 	resource := c.Param("resource")
 	resourceID := c.Param("id")
 
-	rows, err := db.Query(
-		`SELECT id, COALESCE(user_id::text, ''), resource, COALESCE(resource_id::text, ''), action, COALESCE(details::text, '{}'),
-		        COALESCE(ip_address::text, ''), COALESCE(user_agent, ''), created_at 
-		 FROM audit_logs 
-		 WHERE user_id::text = $1 AND resource = $2 AND resource_id::text = $3 
-		 ORDER BY created_at DESC 
-		 LIMIT 100`,
-		userID, resource, resourceID,
-	)
-
+	rows, err := sqlcdb.New(db.DB).ListResourceAuditLogs(context.Background(), sqlcdb.ListResourceAuditLogsParams{
+		UserID:     nullUUIDOrNil(userID),
+		Resource:   resource,
+		ResourceID: nullUUIDOrNil(resourceID),
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch audit logs"})
 		return
 	}
-	defer rows.Close()
 
 	var logs []AuditLog
-	for rows.Next() {
-		var log AuditLog
-		err := rows.Scan(&log.ID, &log.UserID, &log.Resource, &log.ResourceID, &log.Action, &log.Details, &log.IPAddress, &log.UserAgent, &log.CreatedAt)
-		if err != nil {
-			continue
-		}
-		logs = append(logs, log)
+	for _, row := range rows {
+		logs = append(logs, AuditLog{
+			ID:         row.ID.String(),
+			UserID:     row.UserID,
+			Resource:   row.Resource,
+			ResourceID: row.ResourceID,
+			Action:     row.Action,
+			Details:    row.Details,
+			IPAddress:  row.IpAddress,
+			UserAgent:  row.UserAgent,
+			CreatedAt:  row.CreatedAt,
+		})
 	}
 
 	c.JSON(http.StatusOK, gin.H{"audit_logs": logs})
@@ -302,3 +317,8 @@ func parseUUIDOrNil(raw string) interface{} {
 	}
 	return trimmed
 }
+
+func nullUUIDOrNil(raw string) uuid.NullUUID {
+	parsed, err := uuid.Parse(strings.TrimSpace(raw))
+	return uuid.NullUUID{UUID: parsed, Valid: err == nil}
+}

app/backend/internal/api/auth.go

@@ -3,6 +3,8 @@ package api
 import (
 	"bytes"
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"context"
 	"database/sql"
 	"encoding/json"
 	"errors"
@@ -63,11 +65,16 @@ func handleLogin(c *gin.Context) {
 	// Find user by email
 	var user User
 	var hashedPassword string
-	err := db.QueryRow(`
-		SELECT id, email, password_hash, name, COALESCE(avatar_url, ''), is_admin, created_at
-		FROM users
-		WHERE email = $1
-	`, req.Email).Scan(&user.ID, &user.Email, &hashedPassword, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
+	urow, err := sqlcdb.New(db.DB).GetUserByEmailForAuth(context.Background(), req.Email)
+	user = User{
+		ID:        urow.ID.String(),
+		Email:     urow.Email,
+		Name:      urow.Name,
+		AvatarURL: urow.AvatarUrl,
+		IsAdmin:   urow.IsAdmin,
+		CreatedAt: urow.CreatedAt.Time.String(),
+	}
+	hashedPassword = urow.PasswordHash
 
 	if err == sql.ErrNoRows {
 		authUser, ok := verifyBetterAuthCredentials(c, req.Email, req.Password)
@@ -257,25 +264,30 @@ func createLocalUserFromBetterAuth(db *database.DB, authUser betterAuthLoginUser
 	}
 
 	// A mirrored first account owns the platform, same as handleRegister.
-	var total int
-	if err := db.QueryRow("SELECT COUNT(*) FROM users").Scan(&total); err != nil {
+	q := sqlcdb.New(db.DB)
+	total64, err := q.CountUsers(context.Background())
+	if err != nil {
 		return User{}, err
 	}
 
-	var user User
-	err = db.QueryRow(`
-		INSERT INTO users (email, password_hash, name, avatar_url, is_admin)
-		VALUES ($1, $2, $3, NULLIF($4, ''), $5)
-		ON CONFLICT (email) DO UPDATE
-		SET name = EXCLUDED.name,
-		    avatar_url = COALESCE(EXCLUDED.avatar_url, users.avatar_url),
-		    updated_at = NOW()
-		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
-	`, email, string(hashedPassword), name, strings.TrimSpace(authUser.Image), total == 0).
-		Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
+	urow, err := q.UpsertLocalUser(context.Background(), sqlcdb.UpsertLocalUserParams{
+		Email:        email,
+		PasswordHash: string(hashedPassword),
+		Name:         name,
+		Column4:      strings.TrimSpace(authUser.Image),
+		IsAdmin:      total64 == 0,
+	})
 	if err != nil {
 		return User{}, err
 	}
+	user := User{
+		ID:        urow.ID.String(),
+		Email:     urow.Email,
+		Name:      urow.Name,
+		AvatarURL: urow.AvatarUrl,
+		IsAdmin:   urow.IsAdmin,
+		CreatedAt: urow.CreatedAt.Time.String(),
+	}
 
 	return user, nil
 }
@@ -302,8 +314,8 @@ func handleRegister(c *gin.Context) {
 		return
 	}
 
-	var existing int
-	err = db.QueryRow("SELECT COUNT(*) FROM users WHERE email = $1", strings.ToLower(strings.TrimSpace(req.Email))).Scan(&existing)
+	q := sqlcdb.New(db.DB)
+	existing, err := q.CountUsersByEmail(context.Background(), strings.ToLower(strings.TrimSpace(req.Email)))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
@@ -322,12 +334,20 @@ func handleRegister(c *gin.Context) {
 	}
 
 	// First account owns the platform.
-	var user User
-	err = db.QueryRow(`
-		INSERT INTO users (email, password_hash, name, is_admin)
-		VALUES ($1, $2, $3, $4)
-		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
-	`, req.Email, string(hashedPassword), req.Name, total == 0).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
+	urow, err := q.InsertUserAdmin(context.Background(), sqlcdb.InsertUserAdminParams{
+		Email:        req.Email,
+		PasswordHash: string(hashedPassword),
+		Name:         req.Name,
+		IsAdmin:      total == 0,
+	})
+	user := User{
+		ID:        urow.ID.String(),
+		Email:     urow.Email,
+		Name:      urow.Name,
+		AvatarURL: urow.AvatarUrl,
+		IsAdmin:   urow.IsAdmin,
+		CreatedAt: urow.CreatedAt.Time.String(),
+	}
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create user"})
@@ -365,8 +385,8 @@ func handleCreateUser(c *gin.Context) {
 		return
 	}
 
-	var existing int
-	if err := db.QueryRow("SELECT COUNT(*) FROM users WHERE email = $1", req.Email).Scan(&existing); err != nil {
+	existing, err := sqlcdb.New(db.DB).CountUsersByEmail(context.Background(), req.Email)
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
@@ -390,12 +410,19 @@ func handleCreateUser(c *gin.Context) {
 		return
 	}
 
-	var user User
-	err = db.QueryRow(`
-		INSERT INTO users (email, password_hash, name)
-		VALUES ($1, $2, $3)
-		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
-	`, req.Email, string(hashedPassword), req.Name).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
+	urow, err := sqlcdb.New(db.DB).InsertUser(context.Background(), sqlcdb.InsertUserParams{
+		Email:        req.Email,
+		PasswordHash: string(hashedPassword),
+		Name:         req.Name,
+	})
+	user := User{
+		ID:        urow.ID.String(),
+		Email:     urow.Email,
+		Name:      urow.Name,
+		AvatarURL: urow.AvatarUrl,
+		IsAdmin:   urow.IsAdmin,
+		CreatedAt: urow.CreatedAt.Time.String(),
+	}
 	if err != nil {
 		c.JSON(http.StatusConflict, gin.H{"error": "User already exists"})
 		return
@@ -458,10 +485,11 @@ func createBetterAuthUser(c *gin.Context, name string, email string, password st
 }
 
 func countLocalUsers(db *database.DB) (int, error) {
-	var count int
-	if err := db.QueryRow("SELECT COUNT(*) FROM users").Scan(&count); err != nil {
+	count64, err := sqlcdb.New(db.DB).CountUsers(context.Background())
+	if err != nil {
 		return 0, err
 	}
+	count := int(count64)
 	// Better Auth writes to auth_users; a row there only mirrors into users on
 	// the first authenticated call. Count it too or a second public sign-up
 	// slips through the bootstrap window. UNION by email avoids double-counting
@@ -489,11 +517,15 @@ func handleGetProfile(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 
 	var user User
-	err := db.QueryRow(`
-		SELECT id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
-		FROM users
-		WHERE id = $1
-	`, userID).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
+	urow, err := sqlcdb.New(db.DB).GetUserByID(context.Background(), uuid.MustParse(userID))
+	user = User{
+		ID:        urow.ID.String(),
+		Email:     urow.Email,
+		Name:      urow.Name,
+		AvatarURL: urow.AvatarUrl,
+		IsAdmin:   urow.IsAdmin,
+		CreatedAt: urow.CreatedAt.Time.String(),
+	}
 
 	if err == sql.ErrNoRows {
 		c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})
@@ -521,11 +553,11 @@ func handleUpdateProfile(c *gin.Context) {
 	}
 
 	// Update user profile
-	_, err := db.Exec(`
-		UPDATE users 
-		SET name = COALESCE($1, name), avatar_url = COALESCE($2, avatar_url)
-		WHERE id = $3
-	`, req.Name, req.AvatarURL, userID)
+	err := sqlcdb.New(db.DB).UpdateUserProfile(context.Background(), sqlcdb.UpdateUserProfileParams{
+		Column1: req.Name,
+		Column2: req.AvatarURL,
+		ID:      uuid.MustParse(userID),
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update profile"})

app/backend/internal/api/build.go

@@ -16,6 +16,7 @@ import (
 
 	"containr/internal/build"
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/docker"
 	"containr/internal/types"
 
@@ -669,39 +670,22 @@ func (h *BuildHandler) upsertBuild(status *BuildStatusResponse) error {
 	}
 
 	now := time.Now().UTC()
-	_, err := h.db.Exec(
-		`INSERT INTO builds
-		 (id, project_id, service_id, status, progress, started_at, completed_at, image_name, image_tag, size, error, log, metadata, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14, $14)
-		 ON CONFLICT (id) DO UPDATE SET
-		   project_id = EXCLUDED.project_id,
-		   service_id = EXCLUDED.service_id,
-		   status = EXCLUDED.status,
-		   progress = EXCLUDED.progress,
-		   started_at = EXCLUDED.started_at,
-		   completed_at = EXCLUDED.completed_at,
-		   image_name = EXCLUDED.image_name,
-		   image_tag = EXCLUDED.image_tag,
-		   size = EXCLUDED.size,
-		   error = EXCLUDED.error,
-		   log = EXCLUDED.log,
-		   metadata = EXCLUDED.metadata,
-		   updated_at = EXCLUDED.updated_at`,
-		status.ID,
-		nullIfEmptyString(status.ProjectID),
-		nullIfEmptyString(status.ServiceID),
-		status.Status,
-		status.Progress,
-		status.StartedAt,
-		status.CompletedAt,
-		status.ImageName,
-		status.ImageTag,
-		status.Size,
-		nullIfEmptyString(status.Error),
-		status.Log,
-		jsonOrEmptyObject(metadataRaw),
-		now,
-	)
+	err := sqlcdb.New(h.db.DB).UpsertBuild(context.Background(), sqlcdb.UpsertBuildParams{
+		ID:          status.ID,
+		ProjectID:   nsNullIfEmpty(status.ProjectID),
+		ServiceID:   nsNullIfEmpty(status.ServiceID),
+		Status:      status.Status,
+		Progress:    int32(status.Progress),
+		StartedAt:   status.StartedAt,
+		CompletedAt: ntPtr(status.CompletedAt),
+		ImageName:   status.ImageName,
+		ImageTag:    status.ImageTag,
+		Size:        status.Size,
+		Error:       nsNullIfEmpty(status.Error),
+		Log:         status.Log,
+		Column13:    json.RawMessage(jsonOrEmptyObject(metadataRaw)),
+		CreatedAt:   now,
+	})
 	if err != nil && h.isMissingBuildsTable(err) {
 		return nil
 	}
@@ -713,18 +697,37 @@ func (h *BuildHandler) getBuildFromDB(buildID string) (BuildStatusResponse, bool
 		return BuildStatusResponse{}, false, nil
 	}
 
-	row := h.db.QueryRow(
-		`SELECT id, project_id, service_id, status, progress, started_at, completed_at, image_name, image_tag, size, error, log, metadata
-		 FROM builds
-		 WHERE id = $1`,
-		buildID,
-	)
-
-	build, found, err := scanBuildRow(row.Scan)
-	if err != nil && h.isMissingBuildsTable(err) {
-		return BuildStatusResponse{}, false, nil
+	row, err := sqlcdb.New(h.db.DB).GetBuild(context.Background(), buildID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) || h.isMissingBuildsTable(err) {
+			return BuildStatusResponse{}, false, nil
+		}
+		return BuildStatusResponse{}, false, err
 	}
-	return build, found, err
+	build := BuildStatusResponse{
+		ID:        row.ID,
+		ProjectID: row.ProjectID.String,
+		ServiceID: row.ServiceID.String,
+		Status:    row.Status,
+		Progress:  int(row.Progress),
+		StartedAt: row.StartedAt.UTC(),
+		ImageName: row.ImageName,
+		ImageTag:  row.ImageTag,
+		Size:      row.Size,
+		Error:     row.Error.String,
+		Log:       row.Log,
+	}
+	if t := timePtrNT(row.CompletedAt); t != nil {
+		u := t.UTC()
+		build.CompletedAt = &u
+	}
+	if len(row.Metadata) > 0 {
+		metadata := map[string]string{}
+		if err := json.Unmarshal(row.Metadata, &metadata); err == nil {
+			build.Metadata = metadata
+		}
+	}
+	return build, true, nil
 }
 
 func (h *BuildHandler) listBuildsFromDB(projectID, serviceID, status string, page, limit int) ([]BuildStatusResponse, int, error) {
@@ -808,19 +811,11 @@ func (h *BuildHandler) cancelBuildInDB(buildID string) bool {
 		return false
 	}
 	now := time.Now().UTC()
-	result, err := h.db.Exec(
-		`UPDATE builds
-		 SET status = 'cancelled',
-		     progress = 100,
-		     completed_at = $1,
-		     log = COALESCE(log, '') || $2,
-		     updated_at = $1
-		 WHERE id = $3
-		   AND status NOT IN ('success', 'failed', 'cancelled')`,
-		now,
-		h.formatLogLine("Cancellation requested")+"\n",
-		buildID,
-	)
+	affected, err := sqlcdb.New(h.db.DB).CancelBuild(context.Background(), sqlcdb.CancelBuildParams{
+		CompletedAt: sql.NullTime{Time: now, Valid: true},
+		Log:         h.formatLogLine("Cancellation requested") + "\n",
+		ID:          buildID,
+	})
 	if err != nil {
 		if h.isMissingBuildsTable(err) {
 			return false
@@ -828,9 +823,7 @@ func (h *BuildHandler) cancelBuildInDB(buildID string) bool {
 		log.Printf("failed to cancel build %s in database: %v", buildID, err)
 		return false
 	}
-
-	affected, err := result.RowsAffected()
-	if err != nil || affected == 0 {
+	if affected == 0 {
 		return false
 	}
 
@@ -909,12 +902,9 @@ func scanBuildRow(scan func(dest ...interface{}) error) (BuildStatusResponse, bo
 	return parsed, true, nil
 }
 
-func nullIfEmptyString(value string) interface{} {
+func nsNullIfEmpty(value string) sql.NullString {
 	trimmed := strings.TrimSpace(value)
-	if trimmed == "" {
-		return nil
-	}
-	return trimmed
+	return sql.NullString{String: trimmed, Valid: trimmed != ""}
 }
 
 func jsonOrEmptyObject(raw []byte) string {

app/backend/internal/api/context_user.go

@@ -1,9 +1,11 @@
 package api
 
 import (
+	"context"
 	"net/http"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -57,15 +59,12 @@ func contextIsAdmin(c *gin.Context) bool {
 // public; unapproved ones are visible to the owner, project members, and
 // platform admins only.
 func projectReadAccess(c *gin.Context, db *database.DB, projectID uuid.UUID) (bool, bool) {
-	var isApproved bool
-	var ownerID string
-	err := db.QueryRow(
-		`SELECT is_approved, owner_id::text FROM projects WHERE id = $1`,
-		projectID,
-	).Scan(&isApproved, &ownerID)
+	q := sqlcdb.New(db.DB)
+	row, err := q.GetProjectReadAccess(context.Background(), projectID)
 	if err != nil {
 		return false, false
 	}
+	isApproved, ownerID := row.IsApproved, row.OwnerID
 	if isApproved || contextIsAdmin(c) {
 		return true, true
 	}
@@ -76,11 +75,11 @@ func projectReadAccess(c *gin.Context, db *database.DB, projectID uuid.UUID) (bo
 	if ownerID == userID {
 		return true, true
 	}
-	var member bool
-	if err := db.QueryRow(
-		`SELECT EXISTS(SELECT 1 FROM project_members WHERE project_id = $1 AND user_id = $2)`,
-		projectID, userID,
-	).Scan(&member); err == nil && member {
+	userUUID, _ := uuid.Parse(userID)
+	if member, err := q.ProjectMemberExists(context.Background(), sqlcdb.ProjectMemberExistsParams{
+		ProjectID: projectID,
+		UserID:    userUUID,
+	}); err == nil && member {
 		return true, true
 	}
 	return true, false
@@ -91,11 +90,8 @@ func projectReadAccess(c *gin.Context, db *database.DB, projectID uuid.UUID) (bo
 // project members, and platform admins may reach secret-adjacent data
 // such as variables and runtime logs.
 func projectManageAccess(c *gin.Context, db *database.DB, projectID uuid.UUID) (bool, bool) {
-	var ownerID string
-	err := db.QueryRow(
-		`SELECT owner_id::text FROM projects WHERE id = $1`,
-		projectID,
-	).Scan(&ownerID)
+	q := sqlcdb.New(db.DB)
+	ownerID, err := q.GetProjectOwnerText(context.Background(), projectID)
 	if err != nil {
 		return false, false
 	}
@@ -109,11 +105,11 @@ func projectManageAccess(c *gin.Context, db *database.DB, projectID uuid.UUID) (
 	if ownerID == userID {
 		return true, true
 	}
-	var member bool
-	if err := db.QueryRow(
-		`SELECT EXISTS(SELECT 1 FROM project_members WHERE project_id = $1 AND user_id = $2)`,
-		projectID, userID,
-	).Scan(&member); err == nil && member {
+	userUUID, _ := uuid.Parse(userID)
+	if member, err := q.ProjectMemberExists(context.Background(), sqlcdb.ProjectMemberExistsParams{
+		ProjectID: projectID,
+		UserID:    userUUID,
+	}); err == nil && member {
 		return true, true
 	}
 	return true, false
@@ -121,8 +117,7 @@ func projectManageAccess(c *gin.Context, db *database.DB, projectID uuid.UUID) (
 
 // serviceProjectID resolves the project that owns a service.
 func serviceProjectID(db *database.DB, serviceID uuid.UUID) (uuid.UUID, bool) {
-	var projectID uuid.UUID
-	err := db.QueryRow(`SELECT project_id FROM services WHERE id = $1`, serviceID).Scan(&projectID)
+	projectID, err := sqlcdb.New(db.DB).GetServiceProjectID(context.Background(), serviceID)
 	if err != nil {
 		return uuid.Nil, false
 	}

app/backend/internal/api/cron.go

@@ -65,13 +65,47 @@ type UpdateCronJobRequest struct {
 	Retention int    `json:"retention"`
 }
 
+// cronJobFrom maps the sqlc row onto the string-ID API model.
+func cronJobFrom(j sqlcdb.CronJob) CronJob {
+	return CronJob{
+		ID:         j.ID.String(),
+		ProjectID:  j.ProjectID.String(),
+		ServiceID:  j.ServiceID.String(),
+		Name:       j.Name,
+		Schedule:   j.Schedule,
+		Command:    j.Command,
+		Timezone:   j.Timezone.String,
+		Enabled:    j.Enabled.Bool,
+		LastRunAt:  timePtrNT(j.LastRunAt),
+		NextRunAt:  timePtrNT(j.NextRunAt),
+		LastStatus: j.LastStatus.String,
+		LastOutput: j.LastOutput.String,
+		Retention:  int(j.Retention.Int32),
+		CreatedAt:  j.CreatedAt.Time,
+		UpdatedAt:  j.UpdatedAt.Time,
+	}
+}
+
+// cronExecutionFrom maps the sqlc row onto the string-ID API model.
+func cronExecutionFrom(e sqlcdb.CronExecution) CronExecution {
+	return CronExecution{
+		ID:         e.ID.String(),
+		CronJobID:  e.CronJobID.String(),
+		StartedAt:  e.StartedAt,
+		FinishedAt: timePtrNT(e.FinishedAt),
+		Status:     e.Status.String,
+		Output:     e.Output.String,
+		Error:      e.Error.String,
+	}
+}
+
 // cronJobProjectID resolves the project a cron job belongs to.
 func cronJobProjectID(db *database.DB, jobID string) (uuid.UUID, bool) {
-	var projectID uuid.UUID
-	err := db.QueryRow(
-		`SELECT cj.project_id FROM cron_jobs cj WHERE cj.id = $1`,
-		jobID,
-	).Scan(&projectID)
+	id, err := uuid.Parse(jobID)
+	if err != nil {
+		return uuid.Nil, false
+	}
+	projectID, err := sqlcdb.New(db.DB).GetCronJobProjectID(context.Background(), id)
 	if err != nil {
 		return uuid.Nil, false
 	}
@@ -137,15 +171,14 @@ func handleCreateCronJob(c *gin.Context) {
 		return
 	}
 
-	var ownerCheck string
-	err := db.QueryRow(
-		`SELECT p.owner_id FROM projects p 
-		 JOIN services s ON s.project_id = p.id 
-		 WHERE s.id = $1`,
-		req.ServiceID,
-	).Scan(&ownerCheck)
+	svcID, err := uuid.Parse(req.ServiceID)
+	if err != nil {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+	ownerCheck, err := sqlcdb.New(db.DB).GetCronOwnerViaService(context.Background(), svcID)
 
-	if err != nil || (ownerCheck != userID && !contextIsAdmin(c)) {
+	if err != nil || (ownerCheck.String() != userID && !contextIsAdmin(c)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -178,11 +211,20 @@ func handleCreateCronJob(c *gin.Context) {
 		UpdatedAt: time.Now(),
 	}
 
-	_, err = db.Exec(
-		`INSERT INTO cron_jobs (id, project_id, service_id, name, schedule, command, timezone, enabled, next_run_at, retention, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`,
-		job.ID, job.ProjectID, job.ServiceID, job.Name, job.Schedule, job.Command, job.Timezone, job.Enabled, job.NextRunAt, job.Retention, job.CreatedAt, job.UpdatedAt,
-	)
+	err = sqlcdb.New(db.DB).InsertCronJob(context.Background(), sqlcdb.InsertCronJobParams{
+		ID:        uuid.MustParse(job.ID),
+		ProjectID: uuid.MustParse(job.ProjectID),
+		ServiceID: uuid.MustParse(job.ServiceID),
+		Name:      job.Name,
+		Schedule:  job.Schedule,
+		Command:   job.Command,
+		Timezone:  sql.NullString{String: job.Timezone, Valid: true},
+		Enabled:   sql.NullBool{Bool: job.Enabled, Valid: true},
+		NextRunAt: ntPtr(job.NextRunAt),
+		Retention: sql.NullInt32{Int32: int32(job.Retention), Valid: true},
+		CreatedAt: sql.NullTime{Time: job.CreatedAt, Valid: true},
+		UpdatedAt: sql.NullTime{Time: job.UpdatedAt, Valid: true},
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create cron job"})
@@ -201,22 +243,17 @@ func handleGetCronJob(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 	jobID := c.Param("id")
 
-	var job CronJob
-	err := db.QueryRow(
-		`SELECT cj.id, cj.project_id, cj.service_id, cj.name, cj.schedule, cj.timezone,
-		        cj.enabled, cj.last_run_at, cj.next_run_at, cj.last_status, cj.last_output,
-		        cj.retention, cj.created_at, cj.updated_at
-		 FROM cron_jobs cj
-		 WHERE cj.id = $1`,
-		jobID,
-	).Scan(&job.ID, &job.ProjectID, &job.ServiceID, &job.Name, &job.Schedule, &job.Timezone,
-		&job.Enabled, &job.LastRunAt, &job.NextRunAt, &job.LastStatus, &job.LastOutput,
-		&job.Retention, &job.CreatedAt, &job.UpdatedAt)
-
+	jid, err := uuid.Parse(jobID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Cron job not found"})
 		return
 	}
+	row, err := sqlcdb.New(db.DB).GetCronJob(context.Background(), jid)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Cron job not found"})
+		return
+	}
+	job := cronJobFrom(row)
 
 	projectID, found := cronJobProjectID(db, jobID)
 	if !found {
@@ -242,15 +279,14 @@ func handleUpdateCronJob(c *gin.Context) {
 		return
 	}
 
-	var ownerCheck string
-	err := db.QueryRow(
-		`SELECT p.owner_id FROM cron_jobs cj
-		 JOIN projects p ON cj.project_id = p.id
-		 WHERE cj.id = $1`,
-		jobID,
-	).Scan(&ownerCheck)
+	jid, err := uuid.Parse(jobID)
+	if err != nil {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+	ownerCheck, err := sqlcdb.New(db.DB).GetCronJobOwner(context.Background(), jid)
 
-	if err != nil || (ownerCheck != userID && !contextIsAdmin(c)) {
+	if err != nil || (ownerCheck.String() != userID && !contextIsAdmin(c)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -312,21 +348,19 @@ func handleDeleteCronJob(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 	jobID := c.Param("id")
 
-	var ownerCheck string
-	err := db.QueryRow(
-		`SELECT p.owner_id FROM cron_jobs cj
-		 JOIN projects p ON cj.project_id = p.id
-		 WHERE cj.id = $1`,
-		jobID,
-	).Scan(&ownerCheck)
+	jid, err := uuid.Parse(jobID)
+	if err != nil {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+	ownerCheck, err := sqlcdb.New(db.DB).GetCronJobOwner(context.Background(), jid)
 
-	if err != nil || (ownerCheck != userID && !contextIsAdmin(c)) {
+	if err != nil || (ownerCheck.String() != userID && !contextIsAdmin(c)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
 
-	_, err = db.Exec("DELETE FROM cron_jobs WHERE id = $1", jobID)
-	if err != nil {
+	if err := sqlcdb.New(db.DB).DeleteCronJob(context.Background(), jid); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete cron job"})
 		return
 	}
@@ -350,29 +384,20 @@ func handleGetCronExecutions(c *gin.Context) {
 		return
 	}
 
-	rows, err := db.Query(
-		`SELECT id, cron_job_id, started_at, finished_at, status, output, error
-		 FROM cron_executions 
-		 WHERE cron_job_id = $1 
-		 ORDER BY started_at DESC 
-		 LIMIT 100`,
-		jobID,
-	)
-
+	jid, err := uuid.Parse(jobID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch executions"})
+		return
+	}
+	rows, err := sqlcdb.New(db.DB).ListCronExecutions(context.Background(), jid)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch executions"})
 		return
 	}
-	defer rows.Close()
 
 	var executions []CronExecution
-	for rows.Next() {
-		var exec CronExecution
-		err := rows.Scan(&exec.ID, &exec.CronJobID, &exec.StartedAt, &exec.FinishedAt, &exec.Status, &exec.Output, &exec.Error)
-		if err != nil {
-			continue
-		}
-		executions = append(executions, exec)
+	for _, e := range rows {
+		executions = append(executions, cronExecutionFrom(e))
 	}
 
 	c.JSON(http.StatusOK, gin.H{"executions": executions})
@@ -383,29 +408,33 @@ func handleTriggerCronJob(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 	jobID := c.Param("id")
 
-	var job CronJob
-	var ownerCheck string
-	err := db.QueryRow(
-		`SELECT cj.service_id, cj.command, cj.schedule, cj.timezone, cj.retention, p.owner_id
-		 FROM cron_jobs cj
-		 JOIN projects p ON cj.project_id = p.id
-		 WHERE cj.id = $1`,
-		jobID,
-	).Scan(&job.ServiceID, &job.Command, &job.Schedule, &job.Timezone, &job.Retention, &ownerCheck)
-
-	if err != nil || (ownerCheck != userID && !contextIsAdmin(c)) {
+	jid, err := uuid.Parse(jobID)
+	if err != nil {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
+	trig, err := sqlcdb.New(db.DB).GetCronJobForTrigger(context.Background(), jid)
+	if err != nil || (trig.OwnerID.String() != userID && !contextIsAdmin(c)) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+	job := CronJob{
+		ServiceID: trig.ServiceID.String(),
+		Command:   trig.Command,
+		Schedule:  trig.Schedule,
+		Timezone:  trig.Timezone.String,
+		Retention: int(trig.Retention.Int32),
+	}
 
 	execID := uuid.New().String()
 	now := time.Now()
 
-	_, err = db.Exec(
-		`INSERT INTO cron_executions (id, cron_job_id, started_at, status)
-		 VALUES ($1, $2, $3, $4)`,
-		execID, jobID, now, "running",
-	)
+	_ = sqlcdb.New(db.DB).InsertCronExecution(context.Background(), sqlcdb.InsertCronExecutionParams{
+		ID:        uuid.MustParse(execID),
+		CronJobID: jid,
+		StartedAt: now,
+		Status:    sql.NullString{String: "running", Valid: true},
+	})
 
 	dockerClient, _ := c.Get("docker_client")
 	dockerCli, _ := dockerClient.(*docker.Client)
@@ -458,39 +487,25 @@ func StartCronScheduler(ctx context.Context, db *database.DB, dockerClient *dock
 }
 
 func runDueCronJobs(db *database.DB, dockerClient *docker.Client) {
-	rows, err := db.Query(
-		`SELECT id, project_id, service_id, name, schedule, command, timezone, enabled, retention
-		 FROM cron_jobs
-		 WHERE enabled = TRUE AND next_run_at IS NOT NULL AND next_run_at <= NOW()`)
+	q := sqlcdb.New(db.DB)
+	jobs, err := q.ListDueCronJobs(context.Background())
 	if err != nil {
 		log.Printf("cron scheduler: failed to list due jobs: %v", err)
 		return
 	}
-	defer rows.Close()
-
-	type dueJob struct {
-		CronJob
-		Command string
-	}
-	var jobs []dueJob
-	for rows.Next() {
-		var j dueJob
-		if err := rows.Scan(&j.ID, &j.ProjectID, &j.ServiceID, &j.Name, &j.Schedule,
-			&j.Command, &j.Timezone, &j.Enabled, &j.Retention); err != nil {
-			continue
-		}
-		jobs = append(jobs, j)
-	}
 
 	for _, j := range jobs {
 		execID := uuid.New().String()
-		if _, err := db.Exec(
-			`INSERT INTO cron_executions (id, cron_job_id, started_at, status) VALUES ($1, $2, $3, $4)`,
-			execID, j.ID, time.Now(), "running"); err != nil {
+		if err := q.InsertCronExecution(context.Background(), sqlcdb.InsertCronExecutionParams{
+			ID:        uuid.MustParse(execID),
+			CronJobID: j.ID,
+			StartedAt: time.Now(),
+			Status:    sql.NullString{String: "running", Valid: true},
+		}); err != nil {
 			log.Printf("cron scheduler: failed to record execution for %s: %v", j.ID, err)
 			continue
 		}
-		go executeCronJob(db, dockerClient, j.ID, j.ServiceID, execID, j.Command, j.Schedule, j.Timezone, j.Retention)
+		go executeCronJob(db, dockerClient, j.ID.String(), j.ServiceID.String(), execID, j.Command, j.Schedule, j.Timezone.String, int(j.Retention.Int32))
 	}
 }
 
@@ -584,23 +599,32 @@ func executeCronJob(db *database.DB, dockerClient *docker.Client, jobID, service
 	}
 
 	now := time.Now()
-	db.Exec(
-		`UPDATE cron_executions SET finished_at = $1, status = $2, output = $3, error = $4 WHERE id = $5`,
-		now, status, output, errText, execID,
-	)
+	q := sqlcdb.New(db.DB)
+	if eid, err := uuid.Parse(execID); err == nil {
+		_ = q.FinishCronExecution(context.Background(), sqlcdb.FinishCronExecutionParams{
+			FinishedAt: sql.NullTime{Time: now, Valid: true},
+			Status:     sql.NullString{String: status, Valid: true},
+			Output:     sql.NullString{String: output, Valid: true},
+			Error:      sql.NullString{String: errText, Valid: true},
+			ID:         eid,
+		})
+	}
 
 	next, _ := calculateNextRun(schedule, timezone)
-	db.Exec(
-		`UPDATE cron_jobs SET last_run_at = $1, last_status = $2, last_output = $3, next_run_at = $4 WHERE id = $5`,
-		now, status, output, next, jobID,
-	)
+	if jid, err := uuid.Parse(jobID); err == nil {
+		_ = q.UpdateCronJobRun(context.Background(), sqlcdb.UpdateCronJobRunParams{
+			LastRunAt:  sql.NullTime{Time: now, Valid: true},
+			LastStatus: sql.NullString{String: status, Valid: true},
+			LastOutput: sql.NullString{String: output, Valid: true},
+			NextRunAt:  ntPtr(next),
+			ID:         jid,
+		})
 
-	if retention > 0 {
-		db.Exec(
-			`DELETE FROM cron_executions WHERE cron_job_id = $1 AND id NOT IN (
-				SELECT id FROM cron_executions WHERE cron_job_id = $1
-				ORDER BY started_at DESC LIMIT $2)`,
-			jobID, retention,
-		)
+		if retention > 0 {
+			_ = q.TrimCronExecutions(context.Background(), sqlcdb.TrimCronExecutionsParams{
+				CronJobID: jid,
+				Limit:     int32(retention),
+			})
+		}
 	}
 }

app/backend/internal/api/cron_test.go

@@ -0,0 +1,193 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"strings"
+	"testing"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/google/uuid"
+)
+
+func TestCalculateNextRun(t *testing.T) {
+	cases := []struct {
+		name     string
+		schedule string
+		timezone string
+		wantErr  bool
+	}{
+		{"every minute", "* * * * *", "", false},
+		{"daily at 4am", "0 4 * * *", "UTC", false},
+		{"weekday run", "0 9 * * 1-5", "Europe/Prague", false},
+		{"whitespace tolerated", "  */15 * * * *  ", "", false},
+		{"empty schedule", "", "", true},
+		{"bad field count", "* * *", "", true},
+		{"garbage", "not a cron", "", true},
+		{"bad timezone", "0 4 * * *", "Mars/Olympus", true},
+	}
+	now := time.Now()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			next, err := calculateNextRun(tc.schedule, tc.timezone)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error, got next=%v", next)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if next == nil {
+				t.Fatal("expected non-nil next run")
+			}
+			if !next.After(now) {
+				t.Errorf("next run %v is not after %v", next, now)
+			}
+		})
+	}
+}
+
+func TestCalculateNextRunTimezone(t *testing.T) {
+	// CRON_TZ must change the computed instant: 04:00 in a fixed-offset zone
+	// lands at a different UTC hour than 04:00 UTC.
+	utcNext, err := calculateNextRun("0 4 * * *", "UTC")
+	if err != nil {
+		t.Fatalf("utc: %v", err)
+	}
+	tokyoNext, err := calculateNextRun("0 4 * * *", "Asia/Tokyo")
+	if err != nil {
+		t.Fatalf("tokyo: %v", err)
+	}
+	if utcNext.Equal(*tokyoNext) {
+		t.Fatalf("timezone had no effect: both %v", utcNext)
+	}
+	if !strings.EqualFold(utcNext.Location().String(), "Local") {
+		// UTC-scheduled runs still land in server-local time representation.
+		t.Logf("utc next: %v / tokyo next: %v", utcNext, tokyoNext)
+	}
+}
+
+// TestCronLiveInvariants exercises the cron.sql queries on live Postgres:
+// insert/read/owner join, execution lifecycle, run bookkeeping, retention trim.
+func TestCronLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	jobID := uuid.New()
+	suffix := strings.ReplaceAll(jobID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "cron-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "cron-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type)
+		VALUES ($1, $2, $3, $4, 'web', 'image')`,
+		serviceID, "cron-"+suffix, projectID, envID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	next, err := calculateNextRun("0 4 * * *", "UTC")
+	if err != nil {
+		t.Fatalf("schedule: %v", err)
+	}
+	must(q.InsertCronJob(ctx, sqlcdb.InsertCronJobParams{
+		ID: jobID, ProjectID: projectID, ServiceID: serviceID,
+		Name: "job-" + suffix, Schedule: "0 4 * * *", Command: "echo hi",
+		Timezone:  sql.NullString{String: "UTC", Valid: true},
+		Enabled:   sql.NullBool{Bool: true, Valid: true},
+		NextRunAt: ntPtr(next),
+	}))
+	job, err := q.GetCronJob(ctx, jobID)
+	if err != nil || job.Name != "job-"+suffix || job.Command != "echo hi" {
+		t.Fatalf("job: %v %+v", err, job)
+	}
+	owner, err := q.GetCronJobOwner(ctx, jobID)
+	if err != nil || owner != userID {
+		t.Fatalf("owner: %v %v", err, owner)
+	}
+	owner2, err := q.GetCronOwnerViaService(ctx, serviceID)
+	if err != nil || owner2 != userID {
+		t.Fatalf("owner via service: %v %v", err, owner2)
+	}
+	pid, err := q.GetCronJobProjectID(ctx, jobID)
+	if err != nil || pid != projectID {
+		t.Fatalf("project: %v %v", err, pid)
+	}
+
+	// Trigger-shaped read.
+	trig, err := q.GetCronJobForTrigger(ctx, jobID)
+	if err != nil || trig.ServiceID != serviceID || trig.OwnerID != userID {
+		t.Fatalf("trigger: %v %+v", err, trig)
+	}
+
+	// Execution lifecycle + retention trim.
+	for i := 0; i < 3; i++ {
+		execID := uuid.New()
+		must(q.InsertCronExecution(ctx, sqlcdb.InsertCronExecutionParams{
+			ID: execID, CronJobID: jobID,
+			StartedAt: time.Now().Add(time.Duration(i) * time.Second),
+			Status:    sql.NullString{String: "running", Valid: true},
+		}))
+		must(q.FinishCronExecution(ctx, sqlcdb.FinishCronExecutionParams{
+			FinishedAt: sql.NullTime{Time: time.Now(), Valid: true},
+			Status:     sql.NullString{String: "success", Valid: true},
+			Output:     sql.NullString{String: "ok", Valid: true},
+			Error:      sql.NullString{String: "", Valid: true},
+			ID:         execID,
+		}))
+	}
+	execs, err := q.ListCronExecutions(ctx, jobID)
+	if err != nil || len(execs) != 3 {
+		t.Fatalf("execs: %v %d", err, len(execs))
+	}
+	if execs[0].Status.String != "success" || !execs[0].FinishedAt.Valid {
+		t.Fatalf("exec row: %+v", execs[0])
+	}
+	must(q.TrimCronExecutions(ctx, sqlcdb.TrimCronExecutionsParams{CronJobID: jobID, Limit: 1}))
+	execs, _ = q.ListCronExecutions(ctx, jobID)
+	if len(execs) != 1 {
+		t.Fatalf("trim kept %d, want 1", len(execs))
+	}
+
+	must(q.UpdateCronJobRun(ctx, sqlcdb.UpdateCronJobRunParams{
+		LastRunAt:  sql.NullTime{Time: time.Now(), Valid: true},
+		LastStatus: sql.NullString{String: "success", Valid: true},
+		LastOutput: sql.NullString{String: "ok", Valid: true},
+		NextRunAt:  ntPtr(next),
+		ID:         jobID,
+	}))
+	job, _ = q.GetCronJob(ctx, jobID)
+	if job.LastStatus.String != "success" || !job.LastRunAt.Valid {
+		t.Fatalf("post-run job: %+v", job)
+	}
+
+	must(q.DeleteCronJob(ctx, jobID))
+	if _, err := q.GetCronJob(ctx, jobID); err == nil {
+		t.Fatal("deleted job still readable")
+	}
+}

app/backend/internal/api/databases.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"archive/tar"
+	"containr/internal/database"
 	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/docker"
@@ -1868,14 +1869,22 @@ func (h *DatabaseHandler) createBackupProcess(databaseID, backupID, backupPath s
 	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
 	defer cancel()
 
+	notify := func(title, body string) {
+		if row, err := h.queries.GetDatabaseServiceByID(context.Background(), databaseID); err == nil && row.UserID != "" {
+			insertUserNotification(&database.DB{DB: h.db}, row.UserID, "backup", title, body, "database", databaseID)
+		}
+	}
+
 	if h.dockerClient == nil {
 		_ = h.setDatabaseBackupStatus(backupID, "failed", "0 B", false)
+		notify("Database backup failed", "Backup could not start: docker unavailable.")
 		return
 	}
 
 	sizeLabel, err := h.snapshotDatabaseVolume(ctx, databaseID, backupPath)
 	if err != nil {
 		_ = h.setDatabaseBackupStatus(backupID, "failed", "0 B", false)
+		notify("Database backup failed", fmt.Sprintf("Snapshot failed: %v", err))
 		return
 	}
 	if dbRow, err := h.queries.GetDatabaseServiceByID(ctx, databaseID); err == nil {
@@ -1886,6 +1895,7 @@ func (h *DatabaseHandler) createBackupProcess(databaseID, backupID, backupPath s
 		}
 	}
 	_ = h.setDatabaseBackupStatus(backupID, "completed", sizeLabel, true)
+	notify("Database backup completed", fmt.Sprintf("Backup archived (%s).", sizeLabel))
 }
 
 func (h *DatabaseHandler) restoreBackupProcess(databaseID, backupID string, backupPath string) {

app/backend/internal/api/deployments.go

@@ -2,14 +2,20 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/docker"
+	"containr/internal/source"
+	"containr/internal/types"
 	"context"
+	"database/sql"
 	"errors"
 	"fmt"
 	"log/slog"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -33,6 +39,72 @@ type DeploymentModel struct {
 	UpdatedAt   time.Time  `json:"updated_at" db:"updated_at"`
 }
 
+// deploymentRowShape carries the deployment columns shared by the
+// generated list/detail/rollback row types.
+type deploymentRowShape struct {
+	ID          uuid.UUID
+	ServiceID   uuid.UUID
+	CommitHash  sql.NullString
+	Status      sql.NullString
+	ImageName   sql.NullString
+	ImageTag    sql.NullString
+	BuildLog    sql.NullString
+	RuntimeLog  sql.NullString
+	Error       sql.NullString
+	StartedAt   sql.NullTime
+	CompletedAt sql.NullTime
+	CreatedAt   sql.NullTime
+	UpdatedAt   sql.NullTime
+}
+
+func strPtrNS(v sql.NullString) *string {
+	if !v.Valid {
+		return nil
+	}
+	s := v.String
+	return &s
+}
+
+func ptrStr(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
+func timePtrNT(v sql.NullTime) *time.Time {
+	if !v.Valid {
+		return nil
+	}
+	t := v.Time
+	return &t
+}
+
+func ntPtr(t *time.Time) sql.NullTime {
+	if t == nil {
+		return sql.NullTime{}
+	}
+	return sql.NullTime{Time: *t, Valid: true}
+}
+
+func deploymentModelFrom(r deploymentRowShape) DeploymentModel {
+	return DeploymentModel{
+		ID:          r.ID,
+		ServiceID:   r.ServiceID,
+		CommitHash:  strPtrNS(r.CommitHash),
+		Status:      r.Status.String,
+		ImageName:   r.ImageName.String,
+		ImageTag:    r.ImageTag.String,
+		BuildLog:    r.BuildLog.String,
+		RuntimeLog:  r.RuntimeLog.String,
+		Error:       strPtrNS(r.Error),
+		StartedAt:   timePtrNT(r.StartedAt),
+		CompletedAt: timePtrNT(r.CompletedAt),
+		CreatedAt:   r.CreatedAt.Time,
+		UpdatedAt:   r.UpdatedAt.Time,
+	}
+}
+
 type CreateDeploymentRequest struct {
 	CommitHash string            `json:"commit_hash"`
 	Branch     string            `json:"branch"`
@@ -80,44 +152,29 @@ func handleGetDeployments(c *gin.Context) {
 
 	offset, limit := pageWindow(c, 50, 100)
 
-	var total int
-	_ = db.(*database.DB).QueryRow(
-		`SELECT COUNT(*) FROM deployments WHERE service_id = $1`, serviceID,
-	).Scan(&total)
+	q := sqlcdb.New(db.(*database.DB).DB)
+	total, _ := q.CountDeploymentsForService(c.Request.Context(), serviceID)
 
-	rows, err := db.(*database.DB).Query(
-		`SELECT id, service_id, commit_hash, status, image_name, image_tag,
-		        build_log, runtime_log, error, started_at, completed_at, created_at, updated_at
-		 FROM deployments
-		 WHERE service_id = $1
-		 ORDER BY created_at DESC
-		 LIMIT $2 OFFSET $3`,
-		serviceID, limit, offset,
-	)
+	rows, err := q.ListDeploymentsForService(c.Request.Context(), sqlcdb.ListDeploymentsForServiceParams{
+		ServiceID: serviceID, Limit: int32(limit), Offset: int32(offset)})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve deployments"})
 		return
 	}
-	defer rows.Close()
 
-	var deployments []DeploymentModel
-	for rows.Next() {
-		var d DeploymentModel
-		err := rows.Scan(
-			&d.ID, &d.ServiceID, &d.CommitHash, &d.Status, &d.ImageName, &d.ImageTag,
-			&d.BuildLog, &d.RuntimeLog, &d.Error, &d.StartedAt, &d.CompletedAt,
-			&d.CreatedAt, &d.UpdatedAt,
-		)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan deployment"})
-			return
-		}
-		deployments = append(deployments, d)
+	deployments := make([]DeploymentModel, 0, len(rows))
+	for _, r := range rows {
+		deployments = append(deployments, deploymentModelFrom(deploymentRowShape{
+			ID: r.ID, ServiceID: r.ServiceID, CommitHash: r.CommitHash, Status: r.Status,
+			ImageName: r.ImageName, ImageTag: r.ImageTag, BuildLog: r.BuildLog,
+			RuntimeLog: r.RuntimeLog, Error: r.Error, StartedAt: r.StartedAt,
+			CompletedAt: r.CompletedAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+		}))
 	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"deployments": deployments,
-		"pagination":  paginationMeta(offset, limit, total),
+		"pagination":  paginationMeta(offset, limit, int(total)),
 	})
 }
 
@@ -148,51 +205,33 @@ func handleGetRecentDeployments(c *gin.Context) {
 
 	offset, limit := pageWindow(c, 10, 50)
 
-	var total int
-	if err := db.(*database.DB).QueryRow(
-		`SELECT COUNT(*)
-		 FROM deployments d
-		 JOIN services s ON s.id = d.service_id
-		 JOIN projects p ON p.id = s.project_id
-		 WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
-		    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)`,
-		userID, isAdmin,
-	).Scan(&total); err != nil {
+	q := sqlcdb.New(db.(*database.DB).DB)
+	total, err := q.CountAccessibleDeployments(c.Request.Context(), sqlcdb.CountAccessibleDeploymentsParams{
+		OwnerID: userID, Column2: isAdmin})
+	if err != nil {
 		total = 0
 	}
 
-	rows, err := db.(*database.DB).Query(
-		`SELECT d.id, d.service_id, s.name, p.name, d.status,
-		        COALESCE(d.image_name, ''), d.started_at, d.completed_at, d.created_at
-		 FROM deployments d
-		 JOIN services s ON s.id = d.service_id
-		 JOIN projects p ON p.id = s.project_id
-		 WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
-		    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)
-		 ORDER BY d.created_at DESC
-		 LIMIT $3 OFFSET $4`,
-		userID, isAdmin, limit, offset,
-	)
+	rows, err := q.ListRecentAccessibleDeployments(c.Request.Context(), sqlcdb.ListRecentAccessibleDeploymentsParams{
+		OwnerID: userID, Column2: isAdmin, Limit: int32(limit), Offset: int32(offset)})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve deployments"})
 		return
 	}
-	defer rows.Close()
 
-	deployments := []RecentDeployment{}
-	for rows.Next() {
-		var d RecentDeployment
-		if err := rows.Scan(&d.ID, &d.ServiceID, &d.ServiceName, &d.ProjectName,
-			&d.Status, &d.ImageName, &d.StartedAt, &d.CompletedAt, &d.CreatedAt); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan deployment"})
-			return
-		}
-		deployments = append(deployments, d)
+	deployments := make([]RecentDeployment, 0, len(rows))
+	for _, r := range rows {
+		deployments = append(deployments, RecentDeployment{
+			ID: r.ID, ServiceID: r.ServiceID, ServiceName: r.ServiceName,
+			ProjectName: r.ProjectName, Status: r.Status.String, ImageName: r.ImageName,
+			StartedAt: timePtrNT(r.StartedAt), CompletedAt: timePtrNT(r.CompletedAt),
+			CreatedAt: r.CreatedAt.Time,
+		})
 	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"deployments": deployments,
-		"pagination":  paginationMeta(offset, limit, total),
+		"pagination":  paginationMeta(offset, limit, int(total)),
 	})
 }
 
@@ -226,38 +265,27 @@ func handleCreateDeployment(c *gin.Context) {
 		return
 	}
 
-	var service Service
-	var projectOwner string
-	err = db.(*database.DB).QueryRow(
-		`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
-		        s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at, p.owner_id
-		 FROM services s
-		 JOIN projects p ON s.project_id = p.id
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt, &projectOwner,
-	)
-
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+	sr, err := q.GetServiceForDeployWithOwner(ctx, serviceID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
+	service := serviceForDeployFromRow(sqlcdb.GetServiceForDeployRow{
+		ID: sr.ID, ProjectID: sr.ProjectID, Name: sr.Name, Type: sr.Type,
+		Status: sr.Status, Image: sr.Image, Command: sr.Command,
+		Environment: sr.Environment, GitRepo: sr.GitRepo, GitBranch: sr.GitBranch,
+		BuildPath: sr.BuildPath, Cpu: sr.Cpu, Memory: sr.Memory,
+		Replicas: sr.Replicas, Port: sr.Port, Domain: sr.Domain,
+		HealthcheckPath: sr.HealthcheckPath, RestartPolicy: sr.RestartPolicy,
+		Builder: sr.Builder, CpuReserve: sr.CpuReserve, MemoryReserve: sr.MemoryReserve,
+		StaticBuildCmd: sr.StaticBuildCmd, StaticDir: sr.StaticDir,
+		CreatedAt: sr.CreatedAt, UpdatedAt: sr.UpdatedAt,
+	})
+	projectOwner := sr.OwnerID
 
-	if projectOwner != userID.(string) {
+	if projectOwner.String() != userID.(string) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -283,12 +311,17 @@ func handleCreateDeployment(c *gin.Context) {
 		UpdatedAt:  now,
 	}
 
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO deployments
-		 (id, service_id, version, commit_hash, status, image_name, image_tag, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
-		d.ID, d.ServiceID, fmt.Sprintf("v%d", now.Unix()), d.CommitHash, d.Status, d.ImageName, d.ImageTag, d.CreatedAt, d.UpdatedAt,
-	)
+	err = q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID:         d.ID,
+		ServiceID:  d.ServiceID,
+		Version:    fmt.Sprintf("v%d", now.Unix()),
+		CommitHash: sql.NullString{String: ptrStr(d.CommitHash), Valid: d.CommitHash != nil},
+		Status:     sql.NullString{String: d.Status, Valid: true},
+		ImageName:  sql.NullString{String: d.ImageName, Valid: true},
+		ImageTag:   sql.NullString{String: d.ImageTag, Valid: true},
+		CreatedAt:  sql.NullTime{Time: d.CreatedAt, Valid: true},
+		UpdatedAt:  sql.NullTime{Time: d.UpdatedAt, Valid: true},
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create deployment"})
@@ -299,20 +332,20 @@ func handleCreateDeployment(c *gin.Context) {
 	if !exists || engine == nil {
 		unavailableErr := "Deployment engine unavailable. Docker may not be configured on this server."
 		completedAt := time.Now()
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE deployments
-			 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
-			 WHERE id = $3`,
-			unavailableErr, completedAt, d.ID,
-		)
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: unavailableErr, Valid: true},
+			CompletedAt: sql.NullTime{Time: completedAt, Valid: true},
+			ID:          d.ID,
+		})
 		d.Status = "failed"
 		d.Error = &unavailableErr
 		d.CompletedAt = &completedAt
 	} else {
-		_, err = db.(*database.DB).Exec(
-			`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
-			time.Now(), serviceID,
-		)
+		err = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "building", Valid: true},
+			UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+			ID:        serviceID,
+		})
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update service status"})
 			return
@@ -327,14 +360,17 @@ func handleCreateDeployment(c *gin.Context) {
 		})
 		if pos > 0 {
 			d.Status = "queued"
-			_, _ = db.(*database.DB).Exec(
-				`UPDATE deployments SET status = 'queued', updated_at = $1 WHERE id = $2`,
-				time.Now(), d.ID,
-			)
-			_, _ = db.(*database.DB).Exec(
-				`UPDATE services SET status = 'queued', updated_at = $1 WHERE id = $2`,
-				time.Now(), serviceID,
-			)
+			now := time.Now()
+			_ = q.SetDeploymentStatus(ctx, sqlcdb.SetDeploymentStatusParams{
+				Status:    sql.NullString{String: "queued", Valid: true},
+				UpdatedAt: sql.NullTime{Time: now, Valid: true},
+				ID:        d.ID,
+			})
+			_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+				Status:    sql.NullString{String: "queued", Valid: true},
+				UpdatedAt: sql.NullTime{Time: now, Valid: true},
+				ID:        serviceID,
+			})
 		}
 	}
 
@@ -376,6 +412,25 @@ func runDeploymentAndSyncWithImage(
 ) {
 	ctx, cancel := context.WithTimeout(parentCtx, 30*time.Minute)
 	defer cancel()
+	q := sqlcdb.New(db.DB)
+
+	// The checkout and any shipped artifacts die with this deployment.
+	var artifactIDs []string
+	checkoutRoot := filepath.Join(containrWorkDir, "repos", dbDeployment.ID.String())
+	defer func() {
+		_ = os.RemoveAll(checkoutRoot)
+		for _, id := range artifactIDs {
+			removeArtifact(id)
+		}
+	}()
+	failDeploy := func(msg string) {
+		failedAt := time.Now()
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: msg, Valid: true},
+			CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+			ID:          dbDeployment.ID,
+		})
+	}
 
 	sourcePath := strings.TrimSpace(service.BuildPath)
 	if sourcePath == "" {
@@ -402,11 +457,10 @@ func runDeploymentAndSyncWithImage(
 		replicas = 1
 	}
 
-	var publishedPort int32
 	// Best effort: reuse the host port from the last live deployment so public
 	// URLs survive redeploys. Column exists post-migration; older DBs get
 	// ephemeral ports.
-	_ = db.QueryRow(`SELECT published_port FROM services WHERE id = $1`, service.ID).Scan(&publishedPort)
+	publishedPort, _ := q.GetServicePublishedPort(ctx, service.ID)
 
 	publicPort := int32(service.Port)
 	if service.Builder == "static" && publicPort == 0 {
@@ -421,6 +475,35 @@ func runDeploymentAndSyncWithImage(
 		maintURL = maintenanceURL(db)
 	}
 
+	// Node-pinned and spread services dispatch to agent command queues.
+	nodeID := serviceNodeID(db, service.ID)
+	spread := serviceSpread(db, service.ID)
+	remote := nodeID != "" || spread
+
+	// Materialize the git checkout — local builds consume it directly;
+	// remote builds package it into a context artifact the node builds.
+	if service.GitRepo != "" && imageOverride == "" {
+		var ownerID string
+		if o, err := q.GetProjectOwner(ctx, service.ProjectID); err == nil {
+			ownerID = o.String()
+		}
+		branch := req.Branch
+		if branch == "" {
+			branch = service.GitBranch
+		}
+		cloneSpec, err := resolveGitCloneSpec(db, ownerID, service.GitRepo, branch, req.CommitHash, service.BuildPath)
+		if err != nil {
+			failDeploy("resolve git source: " + err.Error())
+			return
+		}
+		src, err := source.Checkout(ctx, checkoutRoot, cloneSpec)
+		if err != nil {
+			failDeploy("git checkout: " + err.Error())
+			return
+		}
+		sourcePath = src
+	}
+
 	deployReq := &deployment.DeploymentRequest{
 		ProjectID:   service.ProjectID.String(),
 		ServiceID:   service.ID.String(),
@@ -447,6 +530,8 @@ func runDeploymentAndSyncWithImage(
 			Maintenance:    maintenanceMode,
 			MaintenanceURL: maintURL,
 			BasicAuthUsers: basicAuthUsers,
+			NodeID:         nodeID,
+			Spread:         spread,
 		},
 		Trigger: deployment.TriggerConfig{
 			Type:      req.Trigger,
@@ -463,14 +548,38 @@ func runDeploymentAndSyncWithImage(
 		if image == "" {
 			image = service.Image
 		}
-		var ownerID string
-		_ = db.QueryRow(`SELECT owner_id FROM projects WHERE id = $1`, service.ProjectID).Scan(&ownerID)
-		auth := registryAuthFor(db, ownerID, image)
-		deployReq.BuildConfig = &deployment.BuildConfig{
-			BuildType:     "prebuilt",
-			PrebuiltImage: image,
-			PullUsername:  auth.Username,
-			PullPassword:  auth.Password,
+		if remote && strings.HasPrefix(image, "containr-") {
+			// Locally-built tag — no registry serves it. Ship the image
+			// itself as a docker-save artifact; the node loads it.
+			rc, err := engine.DockerClient().SaveImage(ctx, image)
+			if err != nil {
+				failDeploy("export rollback image: " + err.Error())
+				return
+			}
+			artifactID, err := putArtifact(rc)
+			_ = rc.Close()
+			if err != nil {
+				failDeploy("store rollback image artifact: " + err.Error())
+				return
+			}
+			artifactIDs = append(artifactIDs, artifactID)
+			deployReq.Config.RemoteLoad = &deployment.RemoteLoadSpec{ArtifactID: artifactID}
+			deployReq.BuildConfig = &deployment.BuildConfig{
+				BuildType:     "remote",
+				PrebuiltImage: image,
+			}
+		} else {
+			var ownerID string
+			if o, err := q.GetProjectOwner(ctx, service.ProjectID); err == nil {
+				ownerID = o.String()
+			}
+			auth := registryAuthFor(db, ownerID, image)
+			deployReq.BuildConfig = &deployment.BuildConfig{
+				BuildType:     "prebuilt",
+				PrebuiltImage: image,
+				PullUsername:  auth.Username,
+				PullPassword:  auth.Password,
+			}
 		}
 	} else {
 		// "auto" leaves BuildType empty so the manager detects it; the static
@@ -480,25 +589,64 @@ func runDeploymentAndSyncWithImage(
 		if service.Builder != "" && service.Builder != "auto" {
 			buildType = service.Builder
 		}
-		deployReq.BuildConfig = &deployment.BuildConfig{
-			BuildType:  buildType,
-			SourcePath: sourcePath,
-			Branch:     req.Branch,
-			Commit:     req.CommitHash,
-			NoCache:    req.NoCache,
-		}
+		buildArgs := map[string]string{}
+		buildCommand := ""
 		if buildType == "static" {
-			deployReq.BuildConfig.BuildCommand = firstNonEmpty(service.StaticBuildCmd, "npm ci && npm run build")
-			deployReq.BuildConfig.BuildArgs = map[string]string{"STATIC_DIR": firstNonEmpty(service.StaticDir, "dist")}
+			buildCommand = firstNonEmpty(service.StaticBuildCmd, "npm ci && npm run build")
+			buildArgs["STATIC_DIR"] = firstNonEmpty(service.StaticDir, "dist")
+		}
+		if remote {
+			// Package the context — the node docker-builds it itself.
+			packReq := &types.BuildRequest{
+				BuildType:    buildType,
+				SourcePath:   sourcePath,
+				BuildCommand: buildCommand,
+				BuildArgs:    buildArgs,
+				Environment:  env,
+			}
+			rc, err := engine.BuildManager().PackageContext(ctx, packReq)
+			if err != nil {
+				failDeploy("package build context: " + err.Error())
+				return
+			}
+			artifactID, err := putArtifact(rc)
+			_ = rc.Close()
+			if err != nil {
+				failDeploy("store build context artifact: " + err.Error())
+				return
+			}
+			artifactIDs = append(artifactIDs, artifactID)
+			deployReq.Config.RemoteBuild = &deployment.RemoteBuildSpec{
+				ArtifactID: artifactID,
+				BuildArgs:  buildArgs,
+				NoCache:    req.NoCache,
+			}
+			deployReq.BuildConfig = &deployment.BuildConfig{
+				BuildType: "remote",
+				Branch:    req.Branch,
+				Commit:    req.CommitHash,
+				NoCache:   req.NoCache,
+			}
+		} else {
+			deployReq.BuildConfig = &deployment.BuildConfig{
+				BuildType:    buildType,
+				SourcePath:   sourcePath,
+				BuildCommand: buildCommand,
+				BuildArgs:    buildArgs,
+				Branch:       req.Branch,
+				Commit:       req.CommitHash,
+				NoCache:      req.NoCache,
+			}
 		}
 	}
 
 	if msg := capacityCheck(parentCtx, db, engine.DockerClient(), service, replicas); msg != "" {
 		failedAt := time.Now()
-		_, _ = db.Exec(
-			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
-			msg, failedAt, dbDeployment.ID,
-		)
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: msg, Valid: true},
+			CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+			ID:          dbDeployment.ID,
+		})
 		return
 	}
 
@@ -506,16 +654,16 @@ func runDeploymentAndSyncWithImage(
 	if err != nil {
 		failedAt := time.Now()
 		failure := "Failed to start deployment engine: " + err.Error()
-		_, _ = db.Exec(
-			`UPDATE deployments
-			 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
-			 WHERE id = $3`,
-			failure, failedAt, dbDeployment.ID,
-		)
-		_, _ = db.Exec(
-			`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
-			failedAt, service.ID,
-		)
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: failure, Valid: true},
+			CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+			ID:          dbDeployment.ID,
+		})
+		_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "failed", Valid: true},
+			UpdatedAt: sql.NullTime{Time: failedAt, Valid: true},
+			ID:        service.ID,
+		})
 		return
 	}
 
@@ -530,16 +678,17 @@ func runDeploymentAndSyncWithImage(
 			if errors.Is(ctx.Err(), context.Canceled) {
 				finalStatus, finalErr = "cancelled", "Deployment cancelled"
 			}
-			_, _ = db.Exec(
-				`UPDATE deployments
-				 SET status = $1, error = $2, completed_at = $3, updated_at = $3
-				 WHERE id = $4`,
-				finalStatus, finalErr, failedAt, dbDeployment.ID,
-			)
-			_, _ = db.Exec(
-				`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`,
-				finalStatus, failedAt, service.ID,
-			)
+			_ = q.CompleteDeployment(ctx, sqlcdb.CompleteDeploymentParams{
+				Status:      sql.NullString{String: finalStatus, Valid: true},
+				Error:       sql.NullString{String: finalErr, Valid: true},
+				CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+				ID:          dbDeployment.ID,
+			})
+			_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+				Status:    sql.NullString{String: finalStatus, Valid: true},
+				UpdatedAt: sql.NullTime{Time: failedAt, Valid: true},
+				ID:        service.ID,
+			})
 			return
 		case <-syncTicker.C:
 			current, getErr := engine.GetDeployment(engineDeployment.ID)
@@ -550,49 +699,36 @@ func runDeploymentAndSyncWithImage(
 			dbStatus := mapEngineStatusToDBStatus(current.Status)
 			imageName, imageTag := splitImageReference(current.ImageName, dbDeployment.ImageTag)
 
-			var dbError interface{}
-			if current.Error != "" {
-				dbError = current.Error
-			}
-
-			_, _ = db.Exec(
-				`UPDATE deployments
-				 SET status = $1,
-				     image_name = $2,
-				     image_tag = $3,
-				     build_log = $4,
-				     runtime_log = $5,
-				     error = $6,
-				     started_at = $7,
-				     completed_at = $8,
-				     updated_at = $9
-				 WHERE id = $10`,
-				dbStatus,
-				imageName,
-				imageTag,
-				current.BuildLog,
-				current.DeployLog,
-				dbError,
-				current.StartedAt,
-				current.CompletedAt,
-				time.Now(),
-				dbDeployment.ID,
-			)
+			now := time.Now()
+			_ = q.SyncDeploymentProgress(ctx, sqlcdb.SyncDeploymentProgressParams{
+				Status:      sql.NullString{String: dbStatus, Valid: true},
+				ImageName:   sql.NullString{String: imageName, Valid: true},
+				ImageTag:    sql.NullString{String: imageTag, Valid: true},
+				BuildLog:    sql.NullString{String: current.BuildLog, Valid: true},
+				RuntimeLog:  sql.NullString{String: current.DeployLog, Valid: true},
+				Error:       sql.NullString{String: current.Error, Valid: current.Error != ""},
+				StartedAt:   ntPtr(current.StartedAt),
+				CompletedAt: ntPtr(current.CompletedAt),
+				UpdatedAt:   sql.NullTime{Time: now, Valid: true},
+				ID:          dbDeployment.ID,
+			})
 
 			switch dbStatus {
 			case "deployed":
-				_, _ = db.Exec(
-					`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`,
-					time.Now(), service.ID,
-				)
+				_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+					Status:    sql.NullString{String: "running", Valid: true},
+					UpdatedAt: sql.NullTime{Time: now, Valid: true},
+					ID:        service.ID,
+				})
 				insertUserNotification(db, userID, "deployment", "Deployment succeeded",
 					fmt.Sprintf("Service %s is now running.", service.Name), "service", service.ID.String())
 				return
 			case "failed":
-				_, _ = db.Exec(
-					`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
-					time.Now(), service.ID,
-				)
+				_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+					Status:    sql.NullString{String: "failed", Valid: true},
+					UpdatedAt: sql.NullTime{Time: now, Valid: true},
+					ID:        service.ID,
+				})
 				body := fmt.Sprintf("Service %s failed to deploy.", service.Name)
 				if current.Error != "" {
 					body = fmt.Sprintf("Service %s failed to deploy: %s", service.Name, current.Error)
@@ -644,21 +780,16 @@ func handleCancelDeployment(c *gin.Context) {
 		return
 	}
 
-	var status, owner string
-	var serviceID uuid.UUID
-	err = db.(*database.DB).QueryRow(
-		`SELECT d.status, d.service_id, p.owner_id
-		 FROM deployments d
-		 JOIN services s ON d.service_id = s.id
-		 JOIN projects p ON s.project_id = p.id
-		 WHERE d.id = $1`,
-		deploymentID,
-	).Scan(&status, &serviceID, &owner)
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+	access, err := q.GetDeploymentAccess(ctx, deploymentID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found", "code": "NOT_FOUND"})
 		return
 	}
-	if owner != userID.(string) && !contextIsAdmin(c) {
+	serviceID := access.ServiceID
+	status := access.Status.String
+	if access.OwnerID.String() != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied", "code": "FORBIDDEN"})
 		return
 	}
@@ -672,14 +803,17 @@ func handleCancelDeployment(c *gin.Context) {
 	switch getDeployQueue(c).Cancel(serviceID, deploymentID) {
 	case deployqueue.WasQueued:
 		now := time.Now()
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE deployments SET status = 'cancelled', error = 'Deployment cancelled', completed_at = $1, updated_at = $1 WHERE id = $2`,
-			now, deploymentID,
-		)
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE services SET status = 'cancelled', updated_at = $1 WHERE id = $2`,
-			now, serviceID,
-		)
+		_ = q.CompleteDeployment(ctx, sqlcdb.CompleteDeploymentParams{
+			Status:      sql.NullString{String: "cancelled", Valid: true},
+			Error:       sql.NullString{String: "Deployment cancelled", Valid: true},
+			CompletedAt: sql.NullTime{Time: now, Valid: true},
+			ID:          deploymentID,
+		})
+		_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "cancelled", Valid: true},
+			UpdatedAt: sql.NullTime{Time: now, Valid: true},
+			ID:        serviceID,
+		})
 		c.JSON(http.StatusOK, gin.H{"status": "cancelled"})
 	case deployqueue.WasActive:
 		c.JSON(http.StatusAccepted, gin.H{"status": "cancelling"})
@@ -693,9 +827,15 @@ func splitImageReference(image, fallbackTag string) (string, string) {
 		return "", fallbackTag
 	}
 
+	// Digest-pinned refs (name[:tag]@sha256:…) carry no usable tag — the
+	// colon lives inside the digest and must not be split.
+	if strings.Contains(image, "@") {
+		return image, fallbackTag
+	}
+
 	lastSlash := strings.LastIndex(image, "/")
 	lastColon := strings.LastIndex(image, ":")
-	if lastColon > lastSlash && !strings.Contains(image[lastColon:], "@") {
+	if lastColon > lastSlash {
 		return image[:lastColon], image[lastColon+1:]
 	}
 
@@ -716,27 +856,18 @@ func handleGetDeployment(c *gin.Context) {
 		return
 	}
 
-	var d DeploymentModel
-	var projectID uuid.UUID
-	err = db.(*database.DB).QueryRow(
-		`SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
-		        d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
-		        d.created_at, d.updated_at, p.id
-		 FROM deployments d
-		 JOIN services s ON d.service_id = s.id
-		 JOIN projects p ON s.project_id = p.id
-		 WHERE d.id = $1`,
-		deploymentID,
-	).Scan(
-		&d.ID, &d.ServiceID, &d.CommitHash, &d.Status, &d.ImageName, &d.ImageTag,
-		&d.BuildLog, &d.RuntimeLog, &d.Error, &d.StartedAt, &d.CompletedAt,
-		&d.CreatedAt, &d.UpdatedAt, &projectID,
-	)
-
+	r, err := sqlcdb.New(db.(*database.DB).DB).GetDeploymentWithProject(c.Request.Context(), deploymentID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
 		return
 	}
+	projectID := r.ProjectID
+	d := deploymentModelFrom(deploymentRowShape{
+		ID: r.ID, ServiceID: r.ServiceID, CommitHash: r.CommitHash, Status: r.Status,
+		ImageName: r.ImageName, ImageTag: r.ImageTag, BuildLog: r.BuildLog,
+		RuntimeLog: r.RuntimeLog, Error: r.Error, StartedAt: r.StartedAt,
+		CompletedAt: r.CompletedAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+	})
 
 	if _, allowed := projectReadAccess(c, db.(*database.DB), projectID); !allowed {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
@@ -766,33 +897,23 @@ func handleRollbackDeployment(c *gin.Context) {
 		return
 	}
 
-	var targetDeployment DeploymentModel
-	var serviceID uuid.UUID
-	var ownerCheck string
-
-	err = db.(*database.DB).QueryRow(
-		`SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag, 
-		        d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at, 
-		        d.created_at, d.updated_at, p.owner_id
-		 FROM deployments d
-		 JOIN services s ON d.service_id = s.id
-		 JOIN projects p ON s.project_id = p.id
-		 WHERE d.id = $1`,
-		deploymentID,
-	).Scan(
-		&targetDeployment.ID, &serviceID, &targetDeployment.CommitHash, &targetDeployment.Status,
-		&targetDeployment.ImageName, &targetDeployment.ImageTag, &targetDeployment.BuildLog,
-		&targetDeployment.RuntimeLog, &targetDeployment.Error, &targetDeployment.StartedAt,
-		&targetDeployment.CompletedAt, &targetDeployment.CreatedAt, &targetDeployment.UpdatedAt,
-		&ownerCheck,
-	)
-
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+	r, err := q.GetDeploymentForRollback(ctx, deploymentID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
 		return
 	}
+	serviceID := r.ServiceID
+	targetDeployment := deploymentModelFrom(deploymentRowShape{
+		ID: r.ID, ServiceID: r.ServiceID, CommitHash: r.CommitHash, Status: r.Status,
+		ImageName: r.ImageName, ImageTag: r.ImageTag, BuildLog: r.BuildLog,
+		RuntimeLog: r.RuntimeLog, Error: r.Error, StartedAt: r.StartedAt,
+		CompletedAt: r.CompletedAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+	})
+	ownerCheck := r.OwnerID
 
-	if ownerCheck != userID.(string) && !contextIsAdmin(c) {
+	if ownerCheck.String() != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -815,23 +936,28 @@ func handleRollbackDeployment(c *gin.Context) {
 		UpdatedAt:  now,
 	}
 
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO deployments
-		 (id, service_id, version, commit_hash, status, image_name, image_tag, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
-		rollback.ID, rollback.ServiceID, fmt.Sprintf("rollback-%d", now.Unix()), rollback.CommitHash, rollback.Status,
-		rollback.ImageName, rollback.ImageTag, rollback.CreatedAt, rollback.UpdatedAt,
-	)
+	err = q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID:         rollback.ID,
+		ServiceID:  rollback.ServiceID,
+		Version:    fmt.Sprintf("rollback-%d", now.Unix()),
+		CommitHash: sql.NullString{String: ptrStr(rollback.CommitHash), Valid: rollback.CommitHash != nil},
+		Status:     sql.NullString{String: rollback.Status, Valid: true},
+		ImageName:  sql.NullString{String: rollback.ImageName, Valid: true},
+		ImageTag:   sql.NullString{String: rollback.ImageTag, Valid: true},
+		CreatedAt:  sql.NullTime{Time: rollback.CreatedAt, Valid: true},
+		UpdatedAt:  sql.NullTime{Time: rollback.UpdatedAt, Valid: true},
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create rollback deployment"})
 		return
 	}
 
-	_, err = db.(*database.DB).Exec(
-		`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
-		time.Now(), serviceID,
-	)
+	err = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+		Status:    sql.NullString{String: "building", Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        serviceID,
+	})
 
 	// Real rollback: redeploy the target deployment's image.
 	engineValue, _ := c.Get("deployment_engine")
@@ -847,36 +973,18 @@ func handleRollbackDeployment(c *gin.Context) {
 		if engine == nil {
 			reason = "Deployment engine unavailable. Docker may not be configured on this server."
 		}
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
-			reason, completedAt, rollbackID,
-		)
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
-			completedAt, serviceID,
-		)
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: reason, Valid: true},
+			CompletedAt: sql.NullTime{Time: completedAt, Valid: true},
+			ID:          rollbackID,
+		})
+		_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "failed", Valid: true},
+			UpdatedAt: sql.NullTime{Time: completedAt, Valid: true},
+			ID:        serviceID,
+		})
 	} else {
-		var service Service
-		_ = db.(*database.DB).QueryRow(
-			`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
-			        s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
-			        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-			        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-			        COALESCE(s.restart_policy, 'unless-stopped'),
-			        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-			        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-			        COALESCE(s.static_dir, ''),
-			        s.created_at, s.updated_at
-			 FROM services s WHERE s.id = $1`, serviceID,
-		).Scan(
-			&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-			&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-			&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-			&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-			&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-			&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-			&service.CreatedAt, &service.UpdatedAt,
-		)
+		service, _ := loadServiceForDeploy(db.(*database.DB), serviceID)
 
 		rollbackReq := CreateDeploymentRequest{
 			CommitHash: func() string {

app/backend/internal/api/deployments_test.go

@@ -0,0 +1,46 @@
+package api
+
+import "testing"
+
+func TestSplitImageReference(t *testing.T) {
+	cases := []struct {
+		name      string
+		image     string
+		fallback  string
+		wantImage string
+		wantTag   string
+	}{
+		{"empty uses fallback tag", "", "latest", "", "latest"},
+		{"bare image", "nginx", "latest", "nginx", "latest"},
+		{"tagged image", "nginx:1.27", "latest", "nginx", "1.27"},
+		{"registry with port untagged", "registry.local:5000/app", "latest", "registry.local:5000/app", "latest"},
+		{"registry with port tagged", "registry.local:5000/app:v2", "latest", "registry.local:5000/app", "v2"},
+		{"digest stays whole", "nginx@sha256:abc123", "latest", "nginx@sha256:abc123", "latest"},
+		{"tag and digest", "nginx:1.27@sha256:abc", "latest", "nginx:1.27@sha256:abc", "latest"},
+		{"namespaced tagged", "ghcr.io/owner/repo:dev", "latest", "ghcr.io/owner/repo", "dev"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			img, tag := splitImageReference(tc.image, tc.fallback)
+			if img != tc.wantImage || tag != tc.wantTag {
+				t.Fatalf("splitImageReference(%q, %q) = (%q, %q), want (%q, %q)",
+					tc.image, tc.fallback, img, tag, tc.wantImage, tc.wantTag)
+			}
+		})
+	}
+}
+
+func TestMapEngineStatusToDBStatus(t *testing.T) {
+	cases := map[string]string{
+		"running":   "deployed",
+		"building":  "building",
+		"failed":    "failed",
+		"cancelled": "cancelled",
+		"queued":    "queued",
+	}
+	for in, want := range cases {
+		if got := mapEngineStatusToDBStatus(in); got != want {
+			t.Fatalf("mapEngineStatusToDBStatus(%q) = %q, want %q", in, got, want)
+		}
+	}
+}

app/backend/internal/api/domains.go

@@ -3,6 +3,8 @@ package api
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
+	"fmt"
 	"net"
 	"net/http"
 	"regexp"
@@ -10,6 +12,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -42,19 +45,26 @@ func validHostname(d string) bool {
 }
 
 func loadServiceDomains(db *database.DB, serviceID uuid.UUID) []ServiceDomain {
-	rows, err := db.Query(
-		`SELECT id, service_id, domain, is_default, cert_type, cert_status, last_checked_at, created_at
-		 FROM service_domains WHERE service_id = $1 ORDER BY is_default DESC, created_at ASC`, serviceID)
+	rows, err := sqlcdb.New(db.DB).ListServiceDomains(context.Background(), serviceID)
 	if err != nil {
 		return nil
 	}
-	defer rows.Close()
-	out := []ServiceDomain{}
-	for rows.Next() {
-		var d ServiceDomain
-		if err := rows.Scan(&d.ID, &d.ServiceID, &d.Domain, &d.IsDefault, &d.CertType, &d.CertStatus, &d.LastCheckedAt, &d.CreatedAt); err == nil {
-			out = append(out, d)
+	out := make([]ServiceDomain, 0, len(rows))
+	for _, r := range rows {
+		d := ServiceDomain{
+			ID:         r.ID,
+			ServiceID:  r.ServiceID,
+			Domain:     r.Domain,
+			IsDefault:  r.IsDefault,
+			CertType:   r.CertType,
+			CertStatus: r.CertStatus,
+			CreatedAt:  r.CreatedAt,
 		}
+		if r.LastCheckedAt.Valid {
+			t := r.LastCheckedAt.Time
+			d.LastCheckedAt = &t
+		}
+		out = append(out, d)
 	}
 	return out
 }
@@ -68,30 +78,95 @@ func serviceDomainNames(db *database.DB, serviceID uuid.UUID, fallback string) [
 	if len(out) == 0 && fallback != "" {
 		out = []string{fallback}
 	}
+	if len(out) == 0 {
+		out = serviceAutoDomains(db, serviceID)
+	}
+	return out
+}
+
+// dnsLabel normalizes a service name into a DNS label: lowercase alnum
+// plus single dashes, never leading/trailing, ≤63 chars.
+func dnsLabel(name string) string {
+	var b strings.Builder
+	lastWasSep := false
+	for _, r := range strings.ToLower(strings.TrimSpace(name)) {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') {
+			b.WriteRune(r)
+			lastWasSep = false
+			continue
+		}
+		if !lastWasSep && b.Len() > 0 {
+			b.WriteByte('-')
+			lastWasSep = true
+		}
+	}
+	out := strings.Trim(b.String(), "-")
+	if len(out) > 63 {
+		out = strings.Trim(out[:63], "-")
+	}
+	return out
+}
+
+// serviceAutoDomains generates <service>.<node-default-domain> hostnames
+// for services with no explicit domains. Pinned services take their node's
+// base domain; spread services union every eligible node's base domain.
+// Local services get nothing — there is no instance-level base domain yet.
+func serviceAutoDomains(db *database.DB, serviceID uuid.UUID) []string {
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+	brief, err := q.GetServicePlacementBrief(ctx, serviceID)
+	if err != nil {
+		return nil
+	}
+	label := dnsLabel(brief.Name)
+	if label == "" {
+		return nil
+	}
+
+	var bases []string
+	nodeID := brief.NodeID
+	spread := brief.Spread
+	switch {
+	case nodeID.Valid && nodeID.String != "":
+		if a, err := q.GetAgent(ctx, nodeID.String); err == nil && a.DefaultDomain != "" {
+			bases = []string{a.DefaultDomain}
+		}
+	case spread:
+		var err error
+		bases, err = q.ListSchedulableAgentDomains(ctx, json.RawMessage(tagsJSON(servicePlacementTags(db, serviceID))))
+		if err != nil {
+			bases = nil
+		}
+	}
+	out := make([]string, 0, len(bases))
+	for _, base := range bases {
+		out = append(out, label+"."+base)
+	}
 	return out
 }
 
 // syncDefaultDomain writes the is_default row back to services.domain so
 // legacy reads (CLI tables, public_url) keep working.
 func syncDefaultDomain(db *database.DB, serviceID uuid.UUID) {
-	var domain string
-	err := db.QueryRow(
-		`SELECT domain FROM service_domains WHERE service_id = $1 AND is_default`, serviceID).Scan(&domain)
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+	domain, err := q.GetServiceDomainDefault(ctx, serviceID)
 	if err == sql.ErrNoRows {
-		err = db.QueryRow(
-			`SELECT domain FROM service_domains WHERE service_id = $1 ORDER BY created_at ASC LIMIT 1`, serviceID).Scan(&domain)
+		domain, err = q.GetServiceDomainFirst(ctx, serviceID)
 	}
 	if err == sql.ErrNoRows {
 		domain = ""
 	}
-	_, _ = db.Exec(`UPDATE services SET domain = $1 WHERE id = $2`, domain, serviceID)
+	_ = q.SetServiceLegacyDomain(ctx, sqlcdb.SetServiceLegacyDomainParams{Domain: domain, ID: serviceID})
 }
 
 // serviceAccess loads the maintenance/basic-auth columns for the runtime spec.
 func serviceAccess(db *database.DB, serviceID uuid.UUID) (maintenance bool, basicAuth string) {
-	_ = db.QueryRow(`SELECT maintenance_mode, basic_auth_users FROM services WHERE id = $1`, serviceID).
-		Scan(&maintenance, &basicAuth)
-	return maintenance, basicAuth
+	row, err := sqlcdb.New(db.DB).GetServiceAccess(context.Background(), serviceID)
+	if err != nil {
+		return false, ""
+	}
+	return row.MaintenanceMode, row.BasicAuthUsers
 }
 
 // maintenanceURL is the redirect target for maintenance mode — the public
@@ -136,11 +211,12 @@ func basicAuthUsernames(encoded string) []string {
 // serviceWriteAccess mirrors the service update handler's access check.
 func serviceWriteAccess(c *gin.Context, db *database.DB, serviceID uuid.UUID) bool {
 	userID, _ := c.Get("user_id")
-	var ok bool
-	err := db.QueryRow(
-		`SELECT EXISTS(SELECT 1 FROM services s JOIN projects p ON s.project_id = p.id
-			WHERE s.id = $1 AND (p.owner_id = $2 OR $3::bool))`,
-		serviceID, userID, contextIsAdmin(c)).Scan(&ok)
+	uid, _ := uuid.Parse(fmt.Sprint(userID))
+	ok, err := sqlcdb.New(db.DB).ServiceWriteAccess(context.Background(), sqlcdb.ServiceWriteAccessParams{
+		ID:      serviceID,
+		OwnerID: uid,
+		Column3: contextIsAdmin(c),
+	})
 	return err == nil && ok
 }
 
@@ -187,9 +263,11 @@ func handleAddServiceDomain(c *gin.Context) {
 		return
 	}
 
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+
 	// First domain on a service becomes the default automatically.
-	var count int
-	_ = db.(*database.DB).QueryRow(`SELECT COUNT(*) FROM service_domains WHERE service_id = $1`, serviceID).Scan(&count)
+	count, _ := q.CountServiceDomains(ctx, serviceID)
 	makeDefault := req.IsDefault || count == 0
 
 	tx, err := db.(*database.DB).Begin()
@@ -198,19 +276,18 @@ func handleAddServiceDomain(c *gin.Context) {
 		return
 	}
 	defer tx.Rollback()
+	qtx := q.WithTx(tx)
 	if makeDefault {
-		if _, err := tx.Exec(`UPDATE service_domains SET is_default = false WHERE service_id = $1`, serviceID); err != nil {
+		if err := qtx.ClearServiceDomainDefault(ctx, serviceID); err != nil {
 			respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to add domain")
 			return
 		}
 	}
-	var inserted ServiceDomain
-	err = tx.QueryRow(
-		`INSERT INTO service_domains (service_id, domain, is_default)
-		 VALUES ($1, $2, $3)
-		 RETURNING id, service_id, domain, is_default, cert_type, cert_status, created_at`,
-		serviceID, domain, makeDefault).
-		Scan(&inserted.ID, &inserted.ServiceID, &inserted.Domain, &inserted.IsDefault, &inserted.CertType, &inserted.CertStatus, &inserted.CreatedAt)
+	row, err := qtx.CreateServiceDomain(ctx, sqlcdb.CreateServiceDomainParams{
+		ServiceID: serviceID,
+		Domain:    domain,
+		IsDefault: makeDefault,
+	})
 	if err != nil {
 		if strings.Contains(err.Error(), "duplicate") || strings.Contains(err.Error(), "unique") {
 			respondError(c, http.StatusConflict, "CONFLICT", "Domain already attached to this service")
@@ -224,7 +301,15 @@ func handleAddServiceDomain(c *gin.Context) {
 		return
 	}
 	syncDefaultDomain(db.(*database.DB), serviceID)
-	c.JSON(http.StatusCreated, gin.H{"domain": inserted})
+	c.JSON(http.StatusCreated, gin.H{"domain": ServiceDomain{
+		ID:         row.ID,
+		ServiceID:  row.ServiceID,
+		Domain:     row.Domain,
+		IsDefault:  row.IsDefault,
+		CertType:   row.CertType,
+		CertStatus: row.CertStatus,
+		CreatedAt:  row.CreatedAt,
+	}})
 }
 
 func handleDeleteServiceDomain(c *gin.Context) {
@@ -247,9 +332,8 @@ func handleDeleteServiceDomain(c *gin.Context) {
 		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid domain ID")
 		return
 	}
-	res, err := db.(*database.DB).Exec(
-		`DELETE FROM service_domains WHERE id = $1 AND service_id = $2`, domainID, serviceID)
-	affected, _ := res.RowsAffected()
+	affected, err := sqlcdb.New(db.(*database.DB).DB).DeleteServiceDomain(
+		c.Request.Context(), sqlcdb.DeleteServiceDomainParams{ID: domainID, ServiceID: serviceID})
 	if err != nil || affected == 0 {
 		respondError(c, http.StatusNotFound, "NOT_FOUND", "Domain not found")
 		return
@@ -278,14 +362,12 @@ func handleSetDefaultDomain(c *gin.Context) {
 		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid domain ID")
 		return
 	}
-	res, err := db.(*database.DB).Exec(
-		`UPDATE service_domains SET is_default = (id = $1) WHERE service_id = $2`,
-		domainID, serviceID)
+	affected, err := sqlcdb.New(db.(*database.DB).DB).SetServiceDomainDefault(
+		c.Request.Context(), sqlcdb.SetServiceDomainDefaultParams{ID: domainID, ServiceID: serviceID})
 	if err != nil {
 		respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to set default domain")
 		return
 	}
-	affected, _ := res.RowsAffected()
 	if affected == 0 {
 		respondError(c, http.StatusNotFound, "NOT_FOUND", "Domain not found")
 		return
@@ -353,7 +435,7 @@ func handleCheckServiceDomains(c *gin.Context) {
 			r.Status = "ok"
 		}
 		results = append(results, r)
-		_, _ = dbh.Exec(`UPDATE service_domains SET last_checked_at = NOW() WHERE id = $1`, d.ID)
+		_ = sqlcdb.New(dbh.DB).TouchServiceDomainChecked(c.Request.Context(), d.ID)
 	}
 	c.JSON(http.StatusOK, gin.H{"domains": results})
 }

app/backend/internal/api/domains_test.go

@@ -0,0 +1,601 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/google/uuid"
+)
+
+func testDSNString(t *testing.T) string {
+	t.Helper()
+	dsn := os.Getenv("METRICS_TEST_DSN")
+	if dsn == "" {
+		dsn = os.Getenv("DATABASE_URL")
+	}
+	if dsn == "" {
+		t.Skip("METRICS_TEST_DSN not set")
+	}
+	return dsn
+}
+
+func TestDNSLabel(t *testing.T) {
+	cases := map[string]string{
+		"my-app":        "my-app",
+		"My App_2":      "my-app-2",
+		"  web  ":       "web",
+		"__weird__name": "weird-name",
+		"---":           "",
+		"":              "",
+	}
+	for in, want := range cases {
+		if got := dnsLabel(in); got != want {
+			t.Errorf("dnsLabel(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestDNSLabelLengthCap(t *testing.T) {
+	long := "a" + string(make([]byte, 0)) + "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+	if got := dnsLabel(long); len(got) > 63 {
+		t.Fatalf("label over 63 chars: %d", len(got))
+	}
+}
+
+// Live invariant test against real Postgres — set METRICS_TEST_DSN (or
+// DATABASE_URL). Verifies the generated domain queries preserve the
+// default-domain and legacy services.domain invariants.
+func TestServiceDomainsLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	suffix := strings.ReplaceAll(serviceID.String()[:8], "-", "")
+
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "domtest-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "domtest-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type)
+		VALUES ($1, 'domtest-`+suffix+`', $2, $3, 'web', 'image')`,
+		serviceID, projectID, envID)
+	must(err)
+	defer func() {
+		_, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID)
+	}()
+
+	d1, err := q.CreateServiceDomain(ctx, sqlcdb.CreateServiceDomainParams{
+		ServiceID: serviceID, Domain: "a-" + suffix + ".example.com", IsDefault: true})
+	if err != nil {
+		t.Fatalf("create d1: %v", err)
+	}
+	d2, err := q.CreateServiceDomain(ctx, sqlcdb.CreateServiceDomainParams{
+		ServiceID: serviceID, Domain: "b-" + suffix + ".example.com", IsDefault: false})
+	if err != nil {
+		t.Fatalf("create d2: %v", err)
+	}
+
+	syncDefaultDomain(db, serviceID)
+	var legacy string
+	if err := db.QueryRow(`SELECT domain FROM services WHERE id = $1`, serviceID).Scan(&legacy); err != nil {
+		t.Fatalf("read legacy: %v", err)
+	}
+	if legacy != d1.Domain {
+		t.Fatalf("legacy domain = %q, want %q", legacy, d1.Domain)
+	}
+
+	// Switch default: exactly one row stays default, legacy follows.
+	if err := q.ClearServiceDomainDefault(ctx, serviceID); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	if _, err := q.SetServiceDomainDefault(ctx, sqlcdb.SetServiceDomainDefaultParams{
+		ID: d2.ID, ServiceID: serviceID}); err != nil {
+		t.Fatalf("set default: %v", err)
+	}
+	syncDefaultDomain(db, serviceID)
+	if err := db.QueryRow(`SELECT domain FROM services WHERE id = $1`, serviceID).Scan(&legacy); err != nil {
+		t.Fatalf("read legacy2: %v", err)
+	}
+	if legacy != d2.Domain {
+		t.Fatalf("legacy after switch = %q, want %q", legacy, d2.Domain)
+	}
+
+	doms := loadServiceDomains(db, serviceID)
+	if len(doms) != 2 || !doms[0].IsDefault || doms[0].Domain != d2.Domain {
+		t.Fatalf("list order wrong: %+v", doms)
+	}
+
+	// Deleting the default falls back to the remaining domain.
+	if _, err := q.DeleteServiceDomain(ctx, sqlcdb.DeleteServiceDomainParams{
+		ID: d2.ID, ServiceID: serviceID}); err != nil {
+		t.Fatalf("delete d2: %v", err)
+	}
+	syncDefaultDomain(db, serviceID)
+	if err := db.QueryRow(`SELECT domain FROM services WHERE id = $1`, serviceID).Scan(&legacy); err != nil {
+		t.Fatalf("read legacy3: %v", err)
+	}
+	if legacy != d1.Domain {
+		t.Fatalf("legacy after delete = %q, want %q", legacy, d1.Domain)
+	}
+}
+
+// Live clone test: cloneServiceRow must copy config, domains, and variables
+// verbatim, start stopped, and land in the target project/environment.
+func TestCloneServiceRowLive(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	suffix := strings.ReplaceAll(serviceID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "clone-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "clone-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type,
+		image_name, port, volumes, traefik_labels, maintenance_mode)
+		VALUES ($1, $2, $3, $4, 'web', 'image', 'traefik/whoami:latest', 80,
+			'[{"mount":"/data"}]'::jsonb,
+			'{"middlewares.rl.ratelimit.average":"100"}'::jsonb, true)`,
+		serviceID, "clonesrc-"+suffix, projectID, envID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	if _, err := q.CreateServiceDomain(ctx, sqlcdb.CreateServiceDomainParams{
+		ServiceID: serviceID, Domain: "src-" + suffix + ".example.com", IsDefault: true}); err != nil {
+		t.Fatalf("seed domain: %v", err)
+	}
+	if _, err := db.Exec(`INSERT INTO environment_variables (id, service_id, key, value, is_secret)
+		VALUES ($1, $2, 'FOO', 'bar', false)`, uuid.New(), serviceID); err != nil {
+		t.Fatalf("seed var: %v", err)
+	}
+
+	cloneID, err := cloneServiceRow(db, serviceID, projectID, "clone-"+suffix, "")
+	if err != nil {
+		t.Fatalf("clone: %v", err)
+	}
+
+	var status, imageName, env string
+	var maintenance bool
+	var volumes, labels []byte
+	if err := db.QueryRow(`SELECT status, image_name, COALESCE(environment,''), maintenance_mode,
+		volumes, traefik_labels FROM services WHERE id = $1`, cloneID).
+		Scan(&status, &imageName, &env, &maintenance, &volumes, &labels); err != nil {
+		t.Fatalf("read clone: %v", err)
+	}
+	if status != "stopped" || imageName != "traefik/whoami:latest" || env != "production" {
+		t.Fatalf("clone mismatch: %v %v %v", status, imageName, env)
+	}
+	if !maintenance || string(volumes) == "[]" || string(labels) == "{}" {
+		t.Fatalf("clone dropped config: maint=%v vol=%s labels=%s", maintenance, volumes, labels)
+	}
+	doms := loadServiceDomains(db, cloneID)
+	if len(doms) != 1 || doms[0].Domain != "src-"+suffix+".example.com" || !doms[0].IsDefault {
+		t.Fatalf("domains not cloned: %+v", doms)
+	}
+	var varVal string
+	if err := db.QueryRow(`SELECT value FROM environment_variables WHERE service_id = $1 AND key = 'FOO'`,
+		cloneID).Scan(&varVal); err != nil || varVal != "bar" {
+		t.Fatalf("vars not cloned: %v %q", err, varVal)
+	}
+}
+
+// Live preview-environment test: generated queries must preserve the
+// access-check join, the status-sync CASE, and the sweep listing.
+func TestPreviewEnvironmentsLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	srcID := uuid.New()
+	cloneID := uuid.New()
+	previewID := uuid.New()
+	suffix := strings.ReplaceAll(previewID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "prev-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "prev-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	for _, p := range [][3]interface{}{{srcID, "src-" + suffix, "running"}, {cloneID, "clone-" + suffix, "running"}} {
+		_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type, status)
+			VALUES ($1, $2, $3, $4, 'web', 'image', $5)`,
+			p[0], p[1], projectID, envID, p[2])
+		must(err)
+	}
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	must(q.CreatePreviewEnvironment(ctx, sqlcdb.CreatePreviewEnvironmentParams{
+		ID:               previewID,
+		ProjectID:        projectID,
+		ServiceID:        srcID,
+		PreviewServiceID: uuid.NullUUID{UUID: cloneID, Valid: true},
+		BranchName:       "feat-" + suffix,
+		Environment:      "preview-feat-" + suffix,
+		Status:           "building",
+		ExpiresAt:        time.Now().Add(-time.Hour), // already past TTL → sweepable
+	}))
+
+	// List + service join.
+	rows, err := q.ListPreviewEnvironmentsForProject(ctx, projectID)
+	if err != nil || len(rows) != 1 {
+		t.Fatalf("list: %v %d", err, len(rows))
+	}
+	if rows[0].ID != previewID || !rows[0].SvcID.Valid || rows[0].ServiceName.String != "src-"+suffix {
+		t.Fatalf("list row: %+v", rows[0])
+	}
+
+	// Access-check join: owner reads; a stranger does not.
+	if _, err := q.GetPreviewEnvironment(ctx, sqlcdb.GetPreviewEnvironmentParams{
+		ID: previewID, OwnerID: userID}); err != nil {
+		t.Fatalf("owner read: %v", err)
+	}
+	if _, err := q.GetPreviewEnvironment(ctx, sqlcdb.GetPreviewEnvironmentParams{
+		ID: previewID, OwnerID: uuid.New()}); err != nil {
+		t.Fatalf("approved project should be public-read: %v", err)
+	}
+
+	// Status sync folds clone's 'running' into the preview row.
+	if err := q.SyncPreviewStatuses(ctx); err != nil {
+		t.Fatalf("sync: %v", err)
+	}
+	var status string
+	if err := db.QueryRow(`SELECT status FROM preview_environments WHERE id = $1`, previewID).Scan(&status); err != nil {
+		t.Fatalf("read status: %v", err)
+	}
+	if status != "running" {
+		t.Fatalf("status after sync = %q, want running", status)
+	}
+
+	// TTL sweep picks it up (expired at insert), marks expired.
+	sweep, err := q.ListSweepablePreviews(ctx)
+	if err != nil {
+		t.Fatalf("sweep list: %v", err)
+	}
+	found := false
+	for _, s := range sweep {
+		if s.ID == previewID && s.PreviewServiceID.UUID == cloneID {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("sweepable list missing preview: %+v", sweep)
+	}
+	must(q.MarkPreviewEnvironmentStatus(ctx, sqlcdb.MarkPreviewEnvironmentStatusParams{Status: "expired", ID: previewID}))
+	sweep, _ = q.ListSweepablePreviews(ctx)
+	for _, s := range sweep {
+		if s.ID == previewID {
+			t.Fatal("expired preview still sweepable")
+		}
+	}
+
+	// Owner lookup and delete.
+	owner, err := q.GetPreviewEnvironmentOwner(ctx, previewID)
+	if err != nil || owner != userID {
+		t.Fatalf("owner: %v %v", owner, err)
+	}
+	must(q.DeletePreviewEnvironment(ctx, previewID))
+}
+
+// Live deployment lifecycle: generated queries preserve list ordering,
+// the access join, and the status-transition writes.
+func TestDeploymentsLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	deployID := uuid.New()
+	suffix := strings.ReplaceAll(deployID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "dep-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "dep-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type, status)
+		VALUES ($1, $2, $3, $4, 'web', 'image', 'running')`,
+		serviceID, "dep-"+suffix, projectID, envID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	must(q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID:        deployID,
+		ServiceID: serviceID,
+		Version:   "v1-" + suffix,
+		Status:    sql.NullString{String: "pending", Valid: true},
+	}))
+	total, err := q.CountDeploymentsForService(ctx, serviceID)
+	if err != nil || total != 1 {
+		t.Fatalf("count: %v %d", err, total)
+	}
+	rows, err := q.ListDeploymentsForService(ctx, sqlcdb.ListDeploymentsForServiceParams{
+		ServiceID: serviceID, Limit: 10, Offset: 0})
+	if err != nil || len(rows) != 1 || rows[0].ID != deployID {
+		t.Fatalf("list: %v %+v", err, rows)
+	}
+
+	// Access join returns owner.
+	access, err := q.GetDeploymentAccess(ctx, deployID)
+	if err != nil || access.OwnerID != userID || access.ServiceID != serviceID {
+		t.Fatalf("access: %v %+v", err, access)
+	}
+
+	// Recent feed honors the access predicate.
+	feed, err := q.ListRecentAccessibleDeployments(ctx, sqlcdb.ListRecentAccessibleDeploymentsParams{
+		OwnerID: userID, Limit: 10, Offset: 0})
+	if err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	found := false
+	for _, d := range feed {
+		if d.ID == deployID && d.ServiceName == "dep-"+suffix {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("feed missing deployment: %+v", feed)
+	}
+
+	// Status transitions.
+	must(q.SetDeploymentStatus(ctx, sqlcdb.SetDeploymentStatusParams{
+		Status: sql.NullString{String: "queued", Valid: true}, UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true}, ID: deployID}))
+	must(q.SyncDeploymentProgress(ctx, sqlcdb.SyncDeploymentProgressParams{
+		Status:    sql.NullString{String: "deployed", Valid: true},
+		ImageName: sql.NullString{String: "nginx", Valid: true},
+		ImageTag:  sql.NullString{String: "alpine", Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        deployID,
+	}))
+	r, err := q.GetDeploymentWithProject(ctx, deployID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if r.Status.String != "deployed" || r.ImageName.String != "nginx" || r.ProjectID != projectID {
+		t.Fatalf("post-sync row: %+v", r)
+	}
+	must(q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+		Error:       sql.NullString{String: "boom", Valid: true},
+		CompletedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:          deployID,
+	}))
+	r, _ = q.GetDeploymentWithProject(ctx, deployID)
+	if r.Status.String != "failed" || r.Error.String != "boom" {
+		t.Fatalf("post-fail row: %+v", r)
+	}
+}
+
+// TestRuntimeLiveInvariants exercises the runtime.sql queries: the
+// legacy-column COALESCE chain in GetServiceRuntimeWithOwner, the
+// deployed-image concat, and the conditional published-port update.
+func TestRuntimeLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	suffix := strings.ReplaceAll(serviceID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "rt-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "rt-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	// Only legacy columns populated — the COALESCE chain must surface them.
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type,
+		source_url, image_name, start_command, port) VALUES ($1, $2, $3, $4, 'worker', 'git', $5, $6, 'run.sh', 8080)`,
+		serviceID, "rt-"+suffix, projectID, envID, "https://git.example/x.git", "repo/img:latest")
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	row, err := q.GetServiceRuntimeWithOwner(ctx, serviceID)
+	if err != nil {
+		t.Fatalf("runtime row: %v", err)
+	}
+	if row.Type != "worker" || row.Image != "repo/img:latest" || row.Command != "run.sh" ||
+		row.GitRepo != "https://git.example/x.git" || row.OwnerID != userID {
+		t.Fatalf("COALESCE chain lost legacy columns: %+v", row)
+	}
+	svc := serviceFromRuntimeRow(row)
+	if svc.Type != "worker" || svc.Image != "repo/img:latest" || svc.Port != 8080 {
+		t.Fatalf("mapped service wrong: %+v", svc)
+	}
+
+	// Sibling refs + port lookup.
+	refs, err := q.ListProjectServiceRefs(ctx, projectID)
+	if err != nil || len(refs) != 1 || refs[0].Name != "rt-"+suffix {
+		t.Fatalf("refs: %v %+v", err, refs)
+	}
+	port, err := q.GetServicePort(ctx, serviceID)
+	if err != nil || port != 8080 {
+		t.Fatalf("port: %v %d", err, port)
+	}
+
+	// Variables round-trip.
+	_, err = db.Exec(`INSERT INTO environment_variables (id, service_id, key, value, is_secret)
+		VALUES (gen_random_uuid(), $1, 'API_KEY', 'shh', true), (gen_random_uuid(), $1, 'PLAIN', 'p', false)`,
+		serviceID)
+	must(err)
+	vars, err := q.ListServiceVariablesWithSecret(ctx, serviceID)
+	if err != nil || len(vars) != 2 {
+		t.Fatalf("vars: %v %+v", err, vars)
+	}
+	vals, err := q.ListServiceVariableValues(ctx, serviceID)
+	if err != nil || len(vals) != 2 {
+		t.Fatalf("vals: %v %+v", err, vals)
+	}
+	got, err := q.GetServiceVariableValue(ctx, sqlcdb.GetServiceVariableValueParams{ServiceID: serviceID, Key: "API_KEY"})
+	if err != nil || got != "shh" {
+		t.Fatalf("var value: %v %q", err, got)
+	}
+
+	// Node agent listing through container_instances.
+	_, err = db.Exec(`INSERT INTO node_agents (id, name, hostname, ip_address, port) VALUES ($1, $2, 'h', '127.0.0.1', 9999)`,
+		"agent-"+suffix, "agent-"+suffix)
+	must(err)
+	_, err = db.Exec(`INSERT INTO container_instances (id, name, image, project_id, service_id, node_agent_id)
+		VALUES ($1, 'c', 'img', $2, $3, $4)`,
+		"ci-"+suffix, projectID.String(), serviceID.String(), "agent-"+suffix)
+	must(err)
+	agents, err := q.ListNodeAgentsForService(ctx, serviceID.String())
+	if err != nil || len(agents) != 1 || agents[0] != "agent-"+suffix {
+		t.Fatalf("agents: %v %+v", err, agents)
+	}
+
+	// Last deployed image: only 'deployed' rows, latest first.
+	d1, d2 := uuid.New(), uuid.New()
+	must(q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID: d1, ServiceID: serviceID, Version: "v1",
+		Status: sql.NullString{String: "failed", Valid: true},
+	}))
+	must(q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID: d2, ServiceID: serviceID, Version: "v2",
+		Status: sql.NullString{String: "deployed", Valid: true},
+	}))
+	must(q.SyncDeploymentProgress(ctx, sqlcdb.SyncDeploymentProgressParams{
+		Status:    sql.NullString{String: "deployed", Valid: true},
+		ImageName: sql.NullString{String: "app", Valid: true},
+		ImageTag:  sql.NullString{String: "v2", Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        d2,
+	}))
+	img, err := q.GetLastDeployedImage(ctx, serviceID)
+	if err != nil || img != "app:v2" {
+		t.Fatalf("last image: %v %q", err, img)
+	}
+
+	// Conditional published-port update: writes once, no-ops on repeat.
+	must(q.SetServicePublishedPort(ctx, sqlcdb.SetServicePublishedPortParams{PublishedPort: 30001, ID: serviceID}))
+	p, err := q.GetServicePublishedPort(ctx, serviceID)
+	if err != nil || p != 30001 {
+		t.Fatalf("published port: %v %d", err, p)
+	}
+	must(q.SetServiceReplicas(ctx, sqlcdb.SetServiceReplicasParams{
+		Replicas: 3, UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true}, ID: serviceID}))
+	row, _ = q.GetServiceRuntimeWithOwner(ctx, serviceID)
+	if row.Replicas != 3 {
+		t.Fatalf("replicas: %+v", row)
+	}
+
+	// Sleeper reads: candidate sweep + domain/status text lookups.
+	_, err = db.Exec(`UPDATE services SET sleep_enabled = true, domain = 'rt.example.com', status = 'running' WHERE id = $1`, serviceID)
+	must(err)
+	cands, err := q.ListSleepCandidates(ctx)
+	if err != nil {
+		t.Fatalf("sleep candidates: %v", err)
+	}
+	var mine *sqlcdb.ListSleepCandidatesRow
+	for i := range cands {
+		if cands[i].ID == serviceID {
+			mine = &cands[i]
+		}
+	}
+	if mine == nil || mine.SleepIdleMinutes != 15 {
+		t.Fatalf("candidate missing/idle wrong: %+v", mine)
+	}
+	dom, err := q.GetServiceDomainText(ctx, serviceID)
+	if err != nil || dom != "rt.example.com" {
+		t.Fatalf("domain text: %v %q", err, dom)
+	}
+	st, err := q.GetServiceStatusText(ctx, serviceID)
+	if err != nil || st != "running" {
+		t.Fatalf("status text: %v %q", err, st)
+	}
+}

app/backend/internal/api/environments.go

@@ -0,0 +1,140 @@
+package api
+
+// Project environments — the named lanes services deploy into
+// (production/development/preview are seeded; custom names allowed).
+
+import (
+	"context"
+	"net/http"
+	"regexp"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+var envNamePattern = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,48}[a-z0-9])?$`)
+
+type environmentDTO struct {
+	ID           uuid.UUID `json:"id"`
+	Name         string    `json:"name"`
+	ProjectID    uuid.UUID `json:"project_id"`
+	CreatedAt    time.Time `json:"created_at"`
+	UpdatedAt    time.Time `json:"updated_at"`
+	ServiceCount int64     `json:"service_count"`
+}
+
+func toEnvironmentDTO(id uuid.UUID, name string, projectID uuid.UUID, created, updated time.Time, count int64) environmentDTO {
+	return environmentDTO{ID: id, Name: name, ProjectID: projectID, CreatedAt: created, UpdatedAt: updated, ServiceCount: count}
+}
+
+// handleListEnvironments returns the project's environments with live
+// service counts — the data behind the env switcher.
+func handleListEnvironments(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	projectID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid project ID")
+		return
+	}
+	if exists, allowed := projectReadAccess(c, db, projectID); !exists || !allowed {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Project not found")
+		return
+	}
+	rows, err := sqlcdb.New(db.DB).ListProjectEnvironments(context.Background(), projectID)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to list environments")
+		return
+	}
+	envs := make([]environmentDTO, 0, len(rows))
+	for _, r := range rows {
+		envs = append(envs, toEnvironmentDTO(r.ID, r.Name, r.ProjectID, r.CreatedAt.Time, r.UpdatedAt.Time, r.ServiceCount))
+	}
+	c.JSON(http.StatusOK, gin.H{"environments": envs})
+}
+
+// handleCreateEnvironment adds a named environment lane to the project.
+func handleCreateEnvironment(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	projectID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid project ID")
+		return
+	}
+	userID, exists := c.Get("user_id")
+	if !exists || !ownsProject(db, projectID, userID.(string), contextIsAdmin(c)) {
+		respondError(c, http.StatusForbidden, "FORBIDDEN", "Access denied")
+		return
+	}
+	var req struct {
+		Name string `json:"name" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "name is required")
+		return
+	}
+	name := strings.ToLower(strings.TrimSpace(req.Name))
+	if !envNamePattern.MatchString(name) {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Name must be lowercase alphanumeric with dashes, 1-50 chars")
+		return
+	}
+	q := sqlcdb.New(db.DB)
+	if _, err := q.GetProjectEnvironmentByName(context.Background(), sqlcdb.GetProjectEnvironmentByNameParams{
+		ProjectID: projectID, Name: name,
+	}); err == nil {
+		respondError(c, http.StatusConflict, "CONFLICT", "Environment already exists")
+		return
+	}
+	if err := q.InsertProjectEnvironment(context.Background(), sqlcdb.InsertProjectEnvironmentParams{
+		Name: name, ProjectID: projectID,
+	}); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create environment")
+		return
+	}
+	env, _ := q.GetProjectEnvironmentByName(context.Background(), sqlcdb.GetProjectEnvironmentByNameParams{
+		ProjectID: projectID, Name: name,
+	})
+	LogAuditWithRequest(c, "project", projectID.String(), "environment.create", map[string]interface{}{"name": name})
+	c.JSON(http.StatusCreated, gin.H{"environment": toEnvironmentDTO(env.ID, env.Name, env.ProjectID, env.CreatedAt.Time, env.UpdatedAt.Time, 0)})
+}
+
+// handleDeleteEnvironment removes an environment that holds no services.
+func handleDeleteEnvironment(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	envID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid environment ID")
+		return
+	}
+	userID, exists := c.Get("user_id")
+	if !exists {
+		respondError(c, http.StatusUnauthorized, "UNAUTHORIZED", "User not authenticated")
+		return
+	}
+	var projectID uuid.UUID
+	if projectID, err = sqlcdb.New(db.DB).GetEnvironmentProjectID(context.Background(), envID); err != nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Environment not found")
+		return
+	}
+	if !ownsProject(db, projectID, userID.(string), contextIsAdmin(c)) {
+		respondError(c, http.StatusForbidden, "FORBIDDEN", "Access denied")
+		return
+	}
+	q := sqlcdb.New(db.DB)
+	if n, err := q.CountEnvironmentServices(context.Background(), envID); err == nil && n > 0 {
+		respondError(c, http.StatusConflict, "CONFLICT", "Environment still contains services — move them first")
+		return
+	}
+	if err := q.DeleteProjectEnvironment(context.Background(), sqlcdb.DeleteProjectEnvironmentParams{
+		ID: envID, ProjectID: projectID,
+	}); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to delete environment")
+		return
+	}
+	LogAuditWithRequest(c, "project", projectID.String(), "environment.delete", map[string]interface{}{"environment_id": envID.String()})
+	c.JSON(http.StatusOK, gin.H{"message": "Environment deleted"})
+}

app/backend/internal/api/gateway_proxy.go

@@ -0,0 +1,324 @@
+package api
+
+// Data plane for the public API gateway: /g/:slug/* proxies to the
+// upstream_url of the matching api_services row. Callers authenticate with
+// api_keys (X-API-Key or Authorization: Bearer), pass the rpm + monthly
+// quota gates, and every request lands in usage_counters /
+// metrics_timeseries / incident_events for the /admin/gateway analytics
+// surfaces.
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"containr/internal/gateway"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// jarvis: ceiling — a single shared transport; per-request timeouts come
+// from api_services.request_timeout_ms on the request context.
+var gatewayHTTPClient = &http.Client{
+	Transport: &http.Transport{
+		MaxIdleConns:        100,
+		MaxIdleConnsPerHost: 10,
+		IdleConnTimeout:     90 * time.Second,
+	},
+}
+
+// gatewayRPM is a process-local per-minute counter map. Containr runs a
+// single API process, so an in-memory bucket is sufficient — a multi-node
+// control plane would need a Redis-backed limiter instead.
+var gatewayRPM = struct {
+	sync.Mutex
+	buckets map[string]*rpmBucket
+}{buckets: map[string]*rpmBucket{}}
+
+type rpmBucket struct {
+	window time.Time
+	count  int
+}
+
+// gatewayRateAllow returns false when the bucket for the current minute has
+// already reached limit. A limit <= 0 disables the check. `now` is injected
+// so tests can freeze the window.
+func gatewayRateAllow(bucketKey string, limit int, now time.Time) bool {
+	if limit <= 0 {
+		return true
+	}
+	window := now.Truncate(time.Minute)
+	gatewayRPM.Lock()
+	defer gatewayRPM.Unlock()
+	b := gatewayRPM.buckets[bucketKey]
+	if b == nil || !b.window.Equal(window) {
+		b = &rpmBucket{window: window}
+		gatewayRPM.buckets[bucketKey] = b
+		// Best-effort sweep so the map cannot grow without bound.
+		for k, old := range gatewayRPM.buckets {
+			if old.window.Before(window.Add(-time.Minute)) {
+				delete(gatewayRPM.buckets, k)
+			}
+		}
+	}
+	b.count++
+	return b.count <= limit
+}
+
+type gatewayService struct {
+	ID                 string
+	UpstreamURL        string
+	RoutePrefix        string
+	UpstreamAuthHeader sql.NullString
+	UpstreamAuthValue  sql.NullString
+	Enabled            bool
+	RPMLimit           sql.NullInt64
+	MonthlyQuota       sql.NullInt64
+	RequestTimeoutMS   int
+}
+
+type gatewayKey struct {
+	ID                string
+	Hash              string
+	Enabled           bool
+	RPMLimit          sql.NullInt64
+	MonthlyQuota      sql.NullInt64
+	AllowedServiceIDs string
+}
+
+// extractGatewayKey reads the caller's API key from X-API-Key first, then
+// Authorization: Bearer.
+func extractGatewayKey(c *gin.Context) string {
+	if k := strings.TrimSpace(c.GetHeader("X-API-Key")); k != "" {
+		return k
+	}
+	auth := strings.TrimSpace(c.GetHeader("Authorization"))
+	if len(auth) > 7 && strings.EqualFold(auth[:7], "Bearer ") {
+		return strings.TrimSpace(auth[7:])
+	}
+	return ""
+}
+
+// lookupGatewayService resolves the slug to an enabled service row.
+func lookupGatewayService(ctx context.Context, db *database.DB, slug string) (*gatewayService, error) {
+	r, err := sqlcdb.New(db.DB).GetAPServiceBySlug(ctx, slug)
+	if err != nil {
+		return nil, err
+	}
+	s := gatewayService{
+		ID:                 r.ID.String(),
+		UpstreamURL:        r.UpstreamUrl,
+		RoutePrefix:        r.RoutePrefix,
+		UpstreamAuthHeader: r.UpstreamAuthHeader,
+		UpstreamAuthValue:  r.UpstreamAuthValue,
+		Enabled:            r.Enabled != 0,
+		RPMLimit:           nullInt32To64(r.RpmLimit),
+		MonthlyQuota:       nullInt32To64(r.MonthlyQuota),
+		RequestTimeoutMS:   int(r.RequestTimeoutMs.Int32),
+	}
+	return &s, nil
+}
+
+func nullInt32To64(v sql.NullInt32) sql.NullInt64 {
+	return sql.NullInt64{Int64: int64(v.Int32), Valid: v.Valid}
+}
+
+// authenticateGatewayKey resolves a presented key by its indexed prefix and
+// bcrypt-verifies candidates. Returns nil when nothing matches.
+func authenticateGatewayKey(ctx context.Context, db *database.DB, presented string) (*gatewayKey, error) {
+	prefix := presented
+	if len(prefix) > 8 {
+		prefix = prefix[:8]
+	}
+	rows, err := sqlcdb.New(db.DB).ListAPKeysByPrefix(ctx, prefix)
+	if err != nil {
+		return nil, err
+	}
+	for _, r := range rows {
+		k := gatewayKey{
+			ID:                r.ID.String(),
+			Hash:              r.KeyHash,
+			Enabled:           r.Enabled != 0,
+			RPMLimit:          nullInt32To64(r.RpmLimit),
+			MonthlyQuota:      nullInt32To64(r.MonthlyQuota),
+			AllowedServiceIDs: r.AllowedServiceIds,
+		}
+		if bcrypt.CompareHashAndPassword([]byte(k.Hash), []byte(presented)) == nil {
+			return &k, nil
+		}
+	}
+	return nil, nil
+}
+
+// keyAllowsService applies the allowed_service_ids JSON allowlist. An empty
+// list means the key may call every service.
+func keyAllowsService(k *gatewayKey, serviceID string) bool {
+	var allowed []string
+	if err := json.Unmarshal([]byte(k.AllowedServiceIDs), &allowed); err != nil || len(allowed) == 0 {
+		return true
+	}
+	for _, id := range allowed {
+		if id == serviceID {
+			return true
+		}
+	}
+	return false
+}
+
+// monthlyKeyUsage / monthlyServiceUsage sum a counter dimension for the
+// current calendar month.
+func monthlyKeyUsage(ctx context.Context, db *database.DB, id, period string) (int64, error) {
+	keyUUID, _ := uuid.Parse(id)
+	return sqlcdb.New(db.DB).SumUsageByKey(ctx, sqlcdb.SumUsageByKeyParams{
+		ApiKeyID: keyUUID, PeriodMonth: period,
+	})
+}
+
+func monthlyServiceUsage(ctx context.Context, db *database.DB, id, period string) (int64, error) {
+	svcUUID, _ := uuid.Parse(id)
+	return sqlcdb.New(db.DB).SumUsageByService(ctx, sqlcdb.SumUsageByServiceParams{
+		ServiceID: svcUUID, PeriodMonth: period,
+	})
+}
+
+// recordGatewayRequest persists usage, metrics, and failure incidents for a
+// proxied call. Runs in the request path but is three small writes.
+func recordGatewayRequest(ctx context.Context, db *database.DB, svc *gatewayService, k *gatewayKey, status int, period string) {
+	q := sqlcdb.New(db.DB)
+	keyUUID, _ := uuid.Parse(k.ID)
+	svcUUID, _ := uuid.Parse(svc.ID)
+	_ = q.UpsertUsageCounter(ctx, sqlcdb.UpsertUsageCounterParams{
+		ApiKeyID: keyUUID, ServiceID: svcUUID, PeriodMonth: period,
+	})
+	_ = q.TouchAPKeyLastUsed(ctx, keyUUID)
+	labels, _ := json.Marshal(map[string]interface{}{
+		"service_id": svc.ID,
+		"key_id":     k.ID,
+		"status":     status,
+	})
+	_ = q.InsertMetricPoint(ctx, sql.NullString{String: string(labels), Valid: true})
+}
+
+func recordGatewayIncident(ctx context.Context, db *database.DB, svcID string, keyID *string, code, msg, severity string, status int) {
+	var kid uuid.NullUUID
+	if keyID != nil {
+		if u, err := uuid.Parse(*keyID); err == nil {
+			kid = uuid.NullUUID{UUID: u, Valid: true}
+		}
+	}
+	svcUUID, _ := uuid.Parse(svcID)
+	_ = sqlcdb.New(db.DB).InsertGatewayIncident(ctx, sqlcdb.InsertGatewayIncidentParams{
+		ServiceID:  uuid.NullUUID{UUID: svcUUID, Valid: svcUUID != uuid.Nil},
+		ApiKeyID:   kid,
+		Code:       code,
+		Message:    msg,
+		Severity:   severity,
+		HttpStatus: sql.NullInt32{Int32: int32(status), Valid: true},
+	})
+}
+
+// handleGatewayProxy is mounted at /g/:slug and /g/:slug/*path on the root
+// router — outside /api/v1 so route_prefix stays clean.
+func handleGatewayProxy(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	ctx := c.Request.Context()
+	slug := c.Param("slug")
+
+	svc, err := lookupGatewayService(ctx, db, slug)
+	if err == sql.ErrNoRows {
+		respondError(c, http.StatusNotFound, "SERVICE_NOT_FOUND", "Gateway service not found")
+		return
+	}
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to resolve gateway service")
+		return
+	}
+	if !svc.Enabled {
+		respondError(c, http.StatusServiceUnavailable, "SERVICE_DISABLED", "Gateway service is disabled")
+		return
+	}
+
+	presented := extractGatewayKey(c)
+	if presented == "" {
+		recordGatewayIncident(ctx, db, svc.ID, nil, "MISSING_API_KEY", "Request without API key", "low", http.StatusUnauthorized)
+		respondError(c, http.StatusUnauthorized, "API_KEY_REQUIRED", "An API key is required for this service")
+		return
+	}
+	key, err := authenticateGatewayKey(ctx, db, presented)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to authenticate API key")
+		return
+	}
+	// Disabled and unknown keys collapse to the same 401 — a disabled key
+	// must not leak its existence.
+	if key == nil || !key.Enabled {
+		recordGatewayIncident(ctx, db, svc.ID, nil, "INVALID_API_KEY", "Request with invalid or disabled API key", "low", http.StatusUnauthorized)
+		respondError(c, http.StatusUnauthorized, "INVALID_API_KEY", "Invalid API key")
+		return
+	}
+	if !keyAllowsService(key, svc.ID) {
+		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "KEY_SCOPE_DENIED", "API key not allowed on this service", "medium", http.StatusForbidden)
+		respondError(c, http.StatusForbidden, "KEY_SCOPE_DENIED", "API key is not permitted for this service")
+		return
+	}
+
+	now := time.Now()
+	if !gatewayRateAllow("key:"+key.ID, int(key.RPMLimit.Int64), now) ||
+		!gatewayRateAllow("svc:"+svc.ID, int(svc.RPMLimit.Int64), now) {
+		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "RATE_LIMITED", "Per-minute rate limit exceeded", "medium", http.StatusTooManyRequests)
+		respondError(c, http.StatusTooManyRequests, "RATE_LIMITED", "Rate limit exceeded")
+		return
+	}
+
+	period := now.Format("2006-01")
+	if key.MonthlyQuota.Valid && key.MonthlyQuota.Int64 > 0 {
+		if used, err := monthlyKeyUsage(ctx, db, key.ID, period); err == nil && used >= key.MonthlyQuota.Int64 {
+			respondError(c, http.StatusTooManyRequests, "QUOTA_EXCEEDED", "Monthly request quota exceeded")
+			return
+		}
+	}
+	if svc.MonthlyQuota.Valid && svc.MonthlyQuota.Int64 > 0 {
+		if used, err := monthlyServiceUsage(ctx, db, svc.ID, period); err == nil && used >= svc.MonthlyQuota.Int64 {
+			respondError(c, http.StatusTooManyRequests, "QUOTA_EXCEEDED", "Service monthly quota exceeded")
+			return
+		}
+	}
+
+	target, err := gateway.BuildTargetURL(svc.UpstreamURL, svc.RoutePrefix, c.Request.URL.Path, c.Request.URL.RawQuery)
+	if err != nil {
+		respondError(c, http.StatusBadGateway, "UPSTREAM_URL_INVALID", "Gateway upstream is misconfigured")
+		return
+	}
+	headers := map[string]string{}
+	if svc.UpstreamAuthHeader.Valid && svc.UpstreamAuthHeader.String != "" {
+		headers[svc.UpstreamAuthHeader.String] = svc.UpstreamAuthValue.String
+	}
+
+	timeout := time.Duration(svc.RequestTimeoutMS) * time.Millisecond
+	if timeout <= 0 {
+		timeout = 8 * time.Second
+	}
+	reqCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	status, _, err := gateway.ProxyRequest(gatewayHTTPClient, c.Writer, c.Request.WithContext(reqCtx), target, headers)
+	if err != nil {
+		recordGatewayIncident(reqCtx, db, svc.ID, &key.ID, "UPSTREAM_ERROR", err.Error(), "high", http.StatusBadGateway)
+		recordGatewayRequest(ctx, db, svc, key, http.StatusBadGateway, period)
+		respondError(c, http.StatusBadGateway, "UPSTREAM_ERROR", "Upstream request failed")
+		return
+	}
+
+	recordGatewayRequest(ctx, db, svc, key, status, period)
+	if status >= 500 {
+		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "UPSTREAM_5XX", "Upstream returned "+http.StatusText(status), "high", status)
+	}
+}

app/backend/internal/api/gateway_proxy_test.go

@@ -0,0 +1,81 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestGatewayRateAllow(t *testing.T) {
+	now := time.Date(2026, 10, 15, 12, 0, 30, 0, time.UTC)
+
+	for i := 0; i < 3; i++ {
+		if !gatewayRateAllow("test:a", 3, now) {
+			t.Fatalf("call %d within limit rejected", i+1)
+		}
+	}
+	if gatewayRateAllow("test:a", 3, now) {
+		t.Fatal("call beyond limit allowed")
+	}
+	if !gatewayRateAllow("test:a", 3, now.Add(time.Minute)) {
+		t.Fatal("new minute window still rejected")
+	}
+	if !gatewayRateAllow("test:unlimited", 0, now) {
+		t.Fatal("non-positive limit should disable the check")
+	}
+}
+
+func TestExtractGatewayKey(t *testing.T) {
+	mkctx := func(headers map[string]string) *gin.Context {
+		c, _ := gin.CreateTestContext(httptest.NewRecorder())
+		c.Request = httptest.NewRequest("GET", "/g/x", nil)
+		for k, v := range headers {
+			c.Request.Header.Set(k, v)
+		}
+		return c
+	}
+
+	if got := extractGatewayKey(mkctx(map[string]string{"X-API-Key": "ap_abc"})); got != "ap_abc" {
+		t.Fatalf("X-API-Key not extracted: %q", got)
+	}
+	if got := extractGatewayKey(mkctx(map[string]string{"Authorization": "Bearer ap_def"})); got != "ap_def" {
+		t.Fatalf("Bearer not extracted: %q", got)
+	}
+	// X-API-Key wins when both are present.
+	if got := extractGatewayKey(mkctx(map[string]string{
+		"X-API-Key":     "ap_first",
+		"Authorization": "Bearer ap_second",
+	})); got != "ap_first" {
+		t.Fatalf("X-API-Key should take precedence: %q", got)
+	}
+	if got := extractGatewayKey(mkctx(map[string]string{})); got != "" {
+		t.Fatalf("expected empty key, got %q", got)
+	}
+}
+
+func TestKeyAllowsService(t *testing.T) {
+	svcID := "11111111-2222-3333-4444-555555555555"
+	other := "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
+
+	cases := []struct {
+		name    string
+		allowed string
+		want    bool
+	}{
+		{"empty list permits all", "[]", true},
+		{"blank permits all", "", true},
+		{"invalid json permits all", "not-json", true},
+		{"listed service allowed", `["` + svcID + `"]`, true},
+		{"unlisted service denied", `["` + other + `"]`, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			k := &gatewayKey{AllowedServiceIDs: tc.allowed}
+			if got := keyAllowsService(k, svcID); got != tc.want {
+				t.Fatalf("keyAllowsService(%q) = %v, want %v", tc.allowed, got, tc.want)
+			}
+		})
+	}
+}

app/backend/internal/api/git.go

@@ -2,6 +2,8 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
@@ -92,41 +94,73 @@ type CreateWebhookRequest struct {
 	Branch string   `json:"branch"`
 }
 
+func gitRepoFrom(r sqlcdb.ListGitRepositoriesRow) GitRepository {
+	return GitRepository{
+		ID:            r.ID.String(),
+		ProviderID:    r.ProviderID.String(),
+		Name:          r.Name,
+		FullName:      r.FullName,
+		Description:   r.Description,
+		CloneURL:      r.CloneUrl,
+		WebhookURL:    r.WebhookUrl,
+		DefaultBranch: r.DefaultBranch.String,
+		IsPrivate:     r.IsPrivate.Bool,
+		UserID:        r.UserID.String(),
+		CreatedAt:     r.CreatedAt.Time,
+		UpdatedAt:     r.UpdatedAt.Time,
+	}
+}
+
+func gitRepoFromFullNameRow(r sqlcdb.GetGitRepositoryByFullNameRow) GitRepository {
+	return GitRepository{
+		ID:            r.ID.String(),
+		ProviderID:    r.ProviderID.String(),
+		Name:          r.Name,
+		FullName:      r.FullName,
+		Description:   r.Description,
+		CloneURL:      r.CloneUrl,
+		WebhookURL:    r.WebhookUrl,
+		DefaultBranch: r.DefaultBranch.String,
+		IsPrivate:     r.IsPrivate.Bool,
+		UserID:        r.UserID.String(),
+		CreatedAt:     r.CreatedAt.Time,
+		UpdatedAt:     r.UpdatedAt.Time,
+	}
+}
+
+func gitProviderFrom(p sqlcdb.ListGitProvidersRow) GitProvider {
+	return GitProvider{
+		ID:          p.ID.String(),
+		Name:        p.Name,
+		DisplayName: p.DisplayName,
+		APIUrl:      p.ApiUrl,
+		WebhookUrl:  p.WebhookUrl,
+		UserID:      p.UserID.String(),
+		CreatedAt:   p.CreatedAt.Time,
+		UpdatedAt:   p.UpdatedAt.Time,
+	}
+}
+
 func handleGetGitProviders(c *gin.Context) {
 	ctx, ok := requireGitRequestContext(c)
 	if !ok {
 		return
 	}
 
-	rows, err := ctx.db.Query(`
-		SELECT id, name, display_name, api_url, webhook_url, user_id, created_at, updated_at
-		FROM git_providers
-		WHERE user_id = $1
-		ORDER BY created_at DESC
-	`, ctx.userID)
+	userID, err := uuid.Parse(ctx.userID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
+		return
+	}
+	rows, err := sqlcdb.New(ctx.db.DB).ListGitProviders(context.Background(), userID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
-	defer rows.Close()
 
-	providers := make([]GitProvider, 0)
-	for rows.Next() {
-		var provider GitProvider
-		if err := rows.Scan(
-			&provider.ID,
-			&provider.Name,
-			&provider.DisplayName,
-			&provider.APIUrl,
-			&provider.WebhookUrl,
-			&provider.UserID,
-			&provider.CreatedAt,
-			&provider.UpdatedAt,
-		); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
-			return
-		}
-		providers = append(providers, provider)
+	providers := make([]GitProvider, 0, len(rows))
+	for _, p := range rows {
+		providers = append(providers, gitProviderFrom(p))
 	}
 
 	c.JSON(http.StatusOK, gin.H{"providers": providers})
@@ -173,21 +207,22 @@ func handleConnectGitHubApp(c *gin.Context) {
 		UserID:      ctx.userID,
 	}
 
-	if err := ctx.db.QueryRow(`
-		INSERT INTO git_providers (id, name, display_name, api_url, webhook_url, access_token, user_id, created_at, updated_at)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, NOW(), NOW())
-		ON CONFLICT (name, user_id)
-		DO UPDATE SET
-			display_name = EXCLUDED.display_name,
-			api_url = EXCLUDED.api_url,
-			webhook_url = EXCLUDED.webhook_url,
-			access_token = EXCLUDED.access_token,
-			updated_at = NOW()
-		RETURNING id, created_at, updated_at
-	`, provider.ID, provider.Name, provider.DisplayName, provider.APIUrl, provider.WebhookUrl, provider.AccessToken, provider.UserID).Scan(&provider.ID, &provider.CreatedAt, &provider.UpdatedAt); err != nil {
+	prow, err := sqlcdb.New(ctx.db.DB).UpsertGitHubAppProvider(context.Background(), sqlcdb.UpsertGitHubAppProviderParams{
+		ID:          uuid.MustParse(provider.ID),
+		Name:        provider.Name,
+		DisplayName: provider.DisplayName,
+		ApiUrl:      provider.APIUrl,
+		WebhookUrl:  provider.WebhookUrl,
+		AccessToken: provider.AccessToken,
+		UserID:      uuid.MustParse(provider.UserID),
+	})
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to connect GitHub App installation"})
 		return
 	}
+	provider.ID = prow.ID.String()
+	provider.CreatedAt = prow.CreatedAt.Time
+	provider.UpdatedAt = prow.UpdatedAt.Time
 
 	provider.AccessToken = ""
 	c.JSON(http.StatusOK, gin.H{
@@ -259,10 +294,16 @@ func handleCreateGitProvider(c *gin.Context) {
 		return
 	}
 
-	if _, err := ctx.db.Exec(`
-		INSERT INTO git_providers (id, name, display_name, api_url, webhook_url, access_token, user_id, created_at, updated_at)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, NOW(), NOW())
-	`, provider.ID, provider.Name, provider.DisplayName, provider.APIUrl, provider.WebhookUrl, provider.AccessToken, provider.UserID); err != nil {
+	q := sqlcdb.New(ctx.db.DB)
+	if err := q.InsertGitProvider(context.Background(), sqlcdb.InsertGitProviderParams{
+		ID:          uuid.MustParse(provider.ID),
+		Name:        provider.Name,
+		DisplayName: provider.DisplayName,
+		ApiUrl:      provider.APIUrl,
+		WebhookUrl:  provider.WebhookUrl,
+		AccessToken: provider.AccessToken,
+		UserID:      uuid.MustParse(provider.UserID),
+	}); err != nil {
 		if isUniqueConstraintError(err) {
 			c.JSON(http.StatusConflict, gin.H{"error": "Provider already connected for this account"})
 			return
@@ -271,13 +312,12 @@ func handleCreateGitProvider(c *gin.Context) {
 		return
 	}
 
-	if err := ctx.db.QueryRow(`
-		SELECT created_at, updated_at
-		FROM git_providers
-		WHERE id = $1
-	`, provider.ID).Scan(&provider.CreatedAt, &provider.UpdatedAt); err != nil {
+	if ts, err := q.GetGitProviderTimestamps(context.Background(), uuid.MustParse(provider.ID)); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to read created provider"})
 		return
+	} else {
+		provider.CreatedAt = ts.CreatedAt.Time
+		provider.UpdatedAt = ts.UpdatedAt.Time
 	}
 
 	provider.AccessToken = ""
@@ -296,12 +336,11 @@ func handleGetGitRepositories(c *gin.Context) {
 		return
 	}
 
-	var providerName, providerDisplayName, providerAccessToken, providerAPIURL string
-	err := ctx.db.QueryRow(`
-		SELECT name, display_name, access_token, api_url
-		FROM git_providers
-		WHERE id = $1 AND user_id = $2
-	`, providerID, ctx.userID).Scan(&providerName, &providerDisplayName, &providerAccessToken, &providerAPIURL)
+	q := sqlcdb.New(ctx.db.DB)
+	provRow, err := q.GetGitProviderForRepos(context.Background(), sqlcdb.GetGitProviderForReposParams{
+		ID:     uuid.MustParse(providerID),
+		UserID: uuid.MustParse(ctx.userID),
+	})
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "Provider not found"})
@@ -310,6 +349,10 @@ func handleGetGitRepositories(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
+	providerName := provRow.Name
+	providerDisplayName := provRow.DisplayName
+	providerAccessToken := provRow.AccessToken
+	providerAPIURL := provRow.ApiUrl
 
 	if c.DefaultQuery("sync", "1") != "0" {
 		if syncErr := syncProviderRepositories(ctx.db, providerID, ctx.userID, providerName, providerAPIURL, providerAccessToken); syncErr != nil {
@@ -324,53 +367,30 @@ func handleGetGitRepositories(c *gin.Context) {
 	}
 	offset := (page - 1) * limit
 	search := strings.TrimSpace(c.Query("search"))
-	searchNullable := sql.NullString{String: search, Valid: search != ""}
 
-	rows, err := ctx.db.Query(`
-		SELECT id, provider_id, name, full_name, COALESCE(description, ''), clone_url, COALESCE(webhook_url, ''),
-			   default_branch, is_private, user_id, created_at, updated_at
-		FROM git_repositories
-		WHERE provider_id = $1 AND user_id = $2
-		  AND ($3::text IS NULL OR full_name ILIKE ('%' || $3::text || '%') OR name ILIKE ('%' || $3::text || '%'))
-		ORDER BY updated_at DESC
-		LIMIT $4 OFFSET $5
-	`, providerID, ctx.userID, searchNullable, limit, offset)
+	repoRows, err := q.ListGitRepositories(context.Background(), sqlcdb.ListGitRepositoriesParams{
+		ProviderID: uuid.MustParse(providerID),
+		UserID:     uuid.MustParse(ctx.userID),
+		Column3:    search,
+		Limit:      int32(limit),
+		Offset:     int32(offset),
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
-	defer rows.Close()
 
-	repositories := make([]GitRepository, 0)
-	for rows.Next() {
-		var repo GitRepository
-		if err := rows.Scan(
-			&repo.ID,
-			&repo.ProviderID,
-			&repo.Name,
-			&repo.FullName,
-			&repo.Description,
-			&repo.CloneURL,
-			&repo.WebhookURL,
-			&repo.DefaultBranch,
-			&repo.IsPrivate,
-			&repo.UserID,
-			&repo.CreatedAt,
-			&repo.UpdatedAt,
-		); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
-			return
-		}
-		repositories = append(repositories, repo)
+	repositories := make([]GitRepository, 0, len(repoRows))
+	for _, r := range repoRows {
+		repositories = append(repositories, gitRepoFrom(r))
 	}
 
-	var total int
-	if err := ctx.db.QueryRow(`
-		SELECT COUNT(*)
-		FROM git_repositories
-		WHERE provider_id = $1 AND user_id = $2
-		  AND ($3::text IS NULL OR full_name ILIKE ('%' || $3::text || '%') OR name ILIKE ('%' || $3::text || '%'))
-	`, providerID, ctx.userID, searchNullable).Scan(&total); err != nil {
+	total, err := q.CountGitRepositories(context.Background(), sqlcdb.CountGitRepositoriesParams{
+		ProviderID: uuid.MustParse(providerID),
+		UserID:     uuid.MustParse(ctx.userID),
+		Column3:    search,
+	})
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
@@ -408,12 +428,11 @@ func handleConnectGitRepository(c *gin.Context) {
 		return
 	}
 
-	var providerName string
-	err := ctx.db.QueryRow(`
-		SELECT name
-		FROM git_providers
-		WHERE id = $1 AND user_id = $2
-	`, providerID, ctx.userID).Scan(&providerName)
+	q := sqlcdb.New(ctx.db.DB)
+	providerName, err := q.GetGitProviderName(context.Background(), sqlcdb.GetGitProviderNameParams{
+		ID:     uuid.MustParse(providerID),
+		UserID: uuid.MustParse(ctx.userID),
+	})
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "Provider not found"})
@@ -429,31 +448,16 @@ func handleConnectGitRepository(c *gin.Context) {
 		return
 	}
 
-	var existing GitRepository
-	err = ctx.db.QueryRow(`
-		SELECT id, provider_id, name, full_name, COALESCE(description, ''), clone_url, COALESCE(webhook_url, ''),
-			   default_branch, is_private, user_id, created_at, updated_at
-		FROM git_repositories
-		WHERE provider_id = $1 AND full_name = $2 AND user_id = $3
-	`, providerID, fullName, ctx.userID).Scan(
-		&existing.ID,
-		&existing.ProviderID,
-		&existing.Name,
-		&existing.FullName,
-		&existing.Description,
-		&existing.CloneURL,
-		&existing.WebhookURL,
-		&existing.DefaultBranch,
-		&existing.IsPrivate,
-		&existing.UserID,
-		&existing.CreatedAt,
-		&existing.UpdatedAt,
-	)
+	existingRow, err := q.GetGitRepositoryByFullName(context.Background(), sqlcdb.GetGitRepositoryByFullNameParams{
+		ProviderID: uuid.MustParse(providerID),
+		FullName:   fullName,
+		UserID:     uuid.MustParse(ctx.userID),
+	})
 	switch {
 	case err == nil:
 		c.JSON(http.StatusOK, gin.H{
 			"message":    "Repository already connected",
-			"repository": existing,
+			"repository": gitRepoFromFullNameRow(existingRow),
 		})
 		return
 	case !errors.Is(err, sql.ErrNoRows):
@@ -473,13 +477,18 @@ func handleConnectGitRepository(c *gin.Context) {
 		UserID:        ctx.userID,
 	}
 
-	if err := ctx.db.QueryRow(`
-		INSERT INTO git_repositories (
-			id, provider_id, name, full_name, description, clone_url, default_branch, is_private, user_id, created_at, updated_at
-		)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, NOW(), NOW())
-		RETURNING created_at, updated_at
-	`, repo.ID, repo.ProviderID, repo.Name, repo.FullName, repo.Description, repo.CloneURL, repo.DefaultBranch, repo.IsPrivate, repo.UserID).Scan(&repo.CreatedAt, &repo.UpdatedAt); err != nil {
+	ins, err := q.InsertGitRepository(context.Background(), sqlcdb.InsertGitRepositoryParams{
+		ID:            uuid.MustParse(repo.ID),
+		ProviderID:    uuid.MustParse(repo.ProviderID),
+		Name:          repo.Name,
+		FullName:      repo.FullName,
+		Description:   sql.NullString{String: repo.Description, Valid: true},
+		CloneUrl:      repo.CloneURL,
+		DefaultBranch: sql.NullString{String: repo.DefaultBranch, Valid: true},
+		IsPrivate:     sql.NullBool{Bool: repo.IsPrivate, Valid: true},
+		UserID:        uuid.MustParse(repo.UserID),
+	})
+	if err != nil {
 		if isUniqueConstraintError(err) {
 			c.JSON(http.StatusConflict, gin.H{"error": "Repository is already connected"})
 			return
@@ -487,6 +496,8 @@ func handleConnectGitRepository(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to connect repository"})
 		return
 	}
+	repo.CreatedAt = ins.CreatedAt.Time
+	repo.UpdatedAt = ins.UpdatedAt.Time
 
 	c.JSON(http.StatusCreated, gin.H{
 		"message":    "Repository connected successfully",
@@ -516,12 +527,10 @@ func handleCreateWebhook(c *gin.Context) {
 		return
 	}
 
-	var providerID string
-	err := ctx.db.QueryRow(`
-		SELECT provider_id
-		FROM git_repositories
-		WHERE id = $1 AND user_id = $2
-	`, repoID, ctx.userID).Scan(&providerID)
+	providerUUID, err := sqlcdb.New(ctx.db.DB).GetGitRepositoryProviderID(context.Background(), sqlcdb.GetGitRepositoryProviderIDParams{
+		ID:     uuid.MustParse(repoID),
+		UserID: uuid.MustParse(ctx.userID),
+	})
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "Repository not found"})
@@ -530,6 +539,7 @@ func handleCreateWebhook(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
+	providerID := providerUUID.String()
 
 	eventsJSON, err := json.Marshal(req.Events)
 	if err != nil {
@@ -552,23 +562,22 @@ func handleCreateWebhook(c *gin.Context) {
 		Active:     true,
 	}
 
-	if err := ctx.db.QueryRow(`
-		INSERT INTO git_webhooks (
-			id, repo_id, provider_id, events, webhook_secret, active, branch_filter, created_at, updated_at
-		)
-		VALUES ($1, $2, $3, $4, $5, TRUE, $6, NOW(), NOW())
-		ON CONFLICT (repo_id, provider_id)
-		DO UPDATE SET
-			events = EXCLUDED.events,
-			webhook_secret = EXCLUDED.webhook_secret,
-			active = TRUE,
-			branch_filter = EXCLUDED.branch_filter,
-			updated_at = NOW()
-		RETURNING id, active, created_at, updated_at
-	`, webhook.ID, webhook.RepoID, webhook.ProviderID, webhook.Events, webhook.Secret, strings.TrimSpace(req.Branch)).Scan(&webhook.ID, &webhook.Active, &webhook.CreatedAt, &webhook.UpdatedAt); err != nil {
+	wrow, err := sqlcdb.New(ctx.db.DB).UpsertGitWebhook(context.Background(), sqlcdb.UpsertGitWebhookParams{
+		ID:            uuid.MustParse(webhook.ID),
+		RepoID:        uuid.MustParse(webhook.RepoID),
+		ProviderID:    uuid.MustParse(webhook.ProviderID),
+		Events:        webhook.Events,
+		WebhookSecret: webhook.Secret,
+		BranchFilter:  sql.NullString{String: strings.TrimSpace(req.Branch), Valid: true},
+	})
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to configure webhook"})
 		return
 	}
+	webhook.ID = wrow.ID.String()
+	webhook.Active = wrow.Active.Bool
+	webhook.CreatedAt = wrow.CreatedAt.Time
+	webhook.UpdatedAt = wrow.UpdatedAt.Time
 
 	c.JSON(http.StatusCreated, gin.H{
 		"message": "Webhook configured successfully",
@@ -598,69 +607,39 @@ func handleGetConnectedRepositories(c *gin.Context) {
 	}
 	offset := (page - 1) * limit
 
-	rows, err := ctx.db.Query(`
-		SELECT r.id, r.provider_id, r.name, r.full_name, COALESCE(r.description, ''), r.clone_url,
-			   r.default_branch, r.is_private, r.user_id, r.created_at, r.updated_at,
-			   p.name as provider_name, p.display_name
-		FROM git_repositories r
-		JOIN git_providers p ON r.provider_id = p.id
-		WHERE r.user_id = $1
-		ORDER BY r.updated_at DESC
-		LIMIT $2 OFFSET $3
-	`, ctx.userID, limit, offset)
+	q := sqlcdb.New(ctx.db.DB)
+	repoRows, err := q.ListConnectedRepositories(context.Background(), sqlcdb.ListConnectedRepositoriesParams{
+		UserID: uuid.MustParse(ctx.userID),
+		Limit:  int32(limit),
+		Offset: int32(offset),
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
-	defer rows.Close()
-
-	repositories := make([]map[string]interface{}, 0)
-	for rows.Next() {
-		var repo GitRepository
-		var providerName, providerDisplayName string
-		if err := rows.Scan(
-			&repo.ID,
-			&repo.ProviderID,
-			&repo.Name,
-			&repo.FullName,
-			&repo.Description,
-			&repo.CloneURL,
-			&repo.DefaultBranch,
-			&repo.IsPrivate,
-			&repo.UserID,
-			&repo.CreatedAt,
-			&repo.UpdatedAt,
-			&providerName,
-			&providerDisplayName,
-		); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
-			return
-		}
 
+	repositories := make([]map[string]interface{}, 0, len(repoRows))
+	for _, r := range repoRows {
 		repositories = append(repositories, map[string]interface{}{
-			"id":             repo.ID,
-			"provider_id":    repo.ProviderID,
-			"name":           repo.Name,
-			"full_name":      repo.FullName,
-			"description":    repo.Description,
-			"clone_url":      repo.CloneURL,
-			"default_branch": repo.DefaultBranch,
-			"is_private":     repo.IsPrivate,
-			"created_at":     repo.CreatedAt,
-			"updated_at":     repo.UpdatedAt,
+			"id":             r.ID.String(),
+			"provider_id":    r.ProviderID.String(),
+			"name":           r.Name,
+			"full_name":      r.FullName,
+			"description":    r.Description,
+			"clone_url":      r.CloneUrl,
+			"default_branch": r.DefaultBranch.String,
+			"is_private":     r.IsPrivate.Bool,
+			"created_at":     r.CreatedAt.Time,
+			"updated_at":     r.UpdatedAt.Time,
 			"provider": map[string]string{
-				"name":         providerName,
-				"display_name": providerDisplayName,
+				"name":         r.ProviderName,
+				"display_name": r.DisplayName,
 			},
 		})
 	}
 
-	var total int
-	if err := ctx.db.QueryRow(`
-		SELECT COUNT(*)
-		FROM git_repositories
-		WHERE user_id = $1
-	`, ctx.userID).Scan(&total); err != nil {
+	total, err := q.CountUserRepositories(context.Background(), uuid.MustParse(ctx.userID))
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
@@ -705,20 +684,17 @@ func syncProviderRepositories(db *database.DB, providerID, userID, providerName,
 			defaultBranch = "main"
 		}
 
-		_, err := db.Exec(`
-			INSERT INTO git_repositories (
-				id, provider_id, name, full_name, description, clone_url, default_branch, is_private, user_id, created_at, updated_at
-			)
-			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, NOW(), NOW())
-			ON CONFLICT (provider_id, full_name)
-			DO UPDATE SET
-				name = EXCLUDED.name,
-				description = EXCLUDED.description,
-				clone_url = EXCLUDED.clone_url,
-				default_branch = EXCLUDED.default_branch,
-				is_private = EXCLUDED.is_private,
-				updated_at = NOW()
-		`, uuid.NewString(), providerID, repository.Name, repository.FullName, repository.Description, cloneURL, defaultBranch, repository.IsPrivate, userID)
+		err := sqlcdb.New(db.DB).UpsertGitRepository(context.Background(), sqlcdb.UpsertGitRepositoryParams{
+			ID:            uuid.New(),
+			ProviderID:    uuid.MustParse(providerID),
+			Name:          repository.Name,
+			FullName:      repository.FullName,
+			Description:   sql.NullString{String: repository.Description, Valid: true},
+			CloneUrl:      cloneURL,
+			DefaultBranch: sql.NullString{String: defaultBranch, Valid: true},
+			IsPrivate:     sql.NullBool{Bool: repository.IsPrivate, Valid: true},
+			UserID:        uuid.MustParse(userID),
+		})
 		if err != nil {
 			return err
 		}
@@ -1323,16 +1299,15 @@ func handleDeleteGitProvider(c *gin.Context) {
 		return
 	}
 
-	result, err := ctx.db.Exec(
-		"DELETE FROM git_providers WHERE id = $1 AND user_id = $2",
-		providerID, ctx.userID,
-	)
+	affected, err := sqlcdb.New(ctx.db.DB).DeleteGitProvider(context.Background(), sqlcdb.DeleteGitProviderParams{
+		ID:     uuid.MustParse(providerID),
+		UserID: uuid.MustParse(ctx.userID),
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete provider"})
 		return
 	}
 
-	affected, _ := result.RowsAffected()
 	if affected == 0 {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Provider not found"})
 		return
@@ -1362,12 +1337,10 @@ func handleGetGitRepositoryBranches(c *gin.Context) {
 		return
 	}
 
-	var providerName, providerAPIURL, providerAccessToken string
-	err := ctx.db.QueryRow(`
-		SELECT name, api_url, access_token
-		FROM git_providers
-		WHERE id = $1 AND user_id = $2
-	`, providerID, ctx.userID).Scan(&providerName, &providerAPIURL, &providerAccessToken)
+	pf, err := sqlcdb.New(ctx.db.DB).GetGitProviderForFetch(context.Background(), sqlcdb.GetGitProviderForFetchParams{
+		ID:     uuid.MustParse(providerID),
+		UserID: uuid.MustParse(ctx.userID),
+	})
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "Provider not found"})
@@ -1376,6 +1349,9 @@ func handleGetGitRepositoryBranches(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
+	providerName := pf.Name
+	providerAPIURL := pf.ApiUrl
+	providerAccessToken := pf.AccessToken
 
 	branches, err := fetchRepositoryBranches(providerName, providerAPIURL, providerAccessToken, owner, repo)
 	if err != nil {

app/backend/internal/api/git_receiver.go

@@ -5,14 +5,17 @@ import (
 	"crypto/hmac"
 	"crypto/sha256"
 	"crypto/subtle"
+	"database/sql"
 	"encoding/hex"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"strings"
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 
@@ -37,22 +40,15 @@ func handleGitWebhookPush(c *gin.Context) {
 		return
 	}
 
-	var (
-		secret       string
-		repoID       string
-		providerID   string
-		branchFilter string
-		active       bool
-	)
-	err := db.QueryRow(`
-		SELECT webhook_secret, repo_id, provider_id, COALESCE(branch_filter, ''), active
-		FROM git_webhooks WHERE id = $1`, webhookID).
-		Scan(&secret, &repoID, &providerID, &branchFilter, &active)
+	q := sqlcdb.New(db.DB)
+	hook, err := q.GetGitWebhookForPush(context.Background(), uuid.MustParse(webhookID))
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Webhook not found"})
 		return
 	}
-	if !active {
+	secret := hook.WebhookSecret
+	branchFilter := hook.BranchFilter
+	if !hook.Active.Bool {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Webhook is disabled"})
 		return
 	}
@@ -63,8 +59,7 @@ func handleGitWebhookPush(c *gin.Context) {
 		return
 	}
 
-	var providerName string
-	_ = db.QueryRow(`SELECT name FROM git_providers WHERE id = $1`, providerID).Scan(&providerName)
+	providerName, _ := q.GetGitProviderNameByID(context.Background(), hook.ProviderID)
 
 	if !verifyGitWebhookSignature(providerName, secret, c.Request, body) {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid signature"})
@@ -90,11 +85,24 @@ func handleGitWebhookPush(c *gin.Context) {
 		return
 	}
 
-	if !strings.HasPrefix(payload.Ref, "refs/heads/") {
+	// Non-push events that still mean "the repo changed": fork-sync bots
+	// (sync), repository_dispatch, workflow_run completions. They carry no
+	// `ref`, so fall back to the webhook's branch filter (or the service's
+	// own git_branch via the repo match below).
+	event := c.Request.Header.Get("X-GitHub-Event")
+	if event == "" {
+		event = c.Request.Header.Get("X-Gitea-Event")
+	}
+	syncEvent := event == "sync" || event == "repository_dispatch" || event == "workflow_run"
+
+	if !strings.HasPrefix(payload.Ref, "refs/heads/") && !syncEvent {
 		c.JSON(http.StatusAccepted, gin.H{"received": true, "ignored": "not a branch push"})
 		return
 	}
 	branch := strings.TrimPrefix(payload.Ref, "refs/heads/")
+	if branch == "" {
+		branch = branchFilter
+	}
 	if branchFilter != "" && branchFilter != branch {
 		c.JSON(http.StatusAccepted, gin.H{"received": true, "ignored": "branch not watched"})
 		return
@@ -104,14 +112,12 @@ func handleGitWebhookPush(c *gin.Context) {
 		commit = payload.After
 	}
 
-	var cloneURL, fullName, repoUserID string
-	err = db.QueryRow(
-		`SELECT clone_url, full_name, user_id FROM git_repositories WHERE id = $1`, repoID,
-	).Scan(&cloneURL, &fullName, &repoUserID)
+	repo, err := q.GetGitRepoForPush(context.Background(), hook.RepoID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Repository not found"})
 		return
 	}
+	cloneURL, fullName, repoUserID := repo.CloneUrl, repo.FullName, repo.UserID.String()
 
 	engineValue, _ := c.Get("deployment_engine")
 	engine, _ := engineValue.(*deployment.DeploymentEngine)
@@ -133,29 +139,37 @@ func handleGitWebhookPush(c *gin.Context) {
 // the pushed repo+branch. Shared by the per-repo webhook receiver and the
 // GitHub App webhook endpoint.
 func dispatchPushToServices(c *gin.Context, db *database.DB, engine *deployment.DeploymentEngine, cloneURL, fullName, branch, commit, repoUserID string) (int, error) {
-	rows, err := db.Query(`
-		SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
-		       s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
-		       s.created_at, s.updated_at
-		FROM services s
-		WHERE s.git_branch = $1 AND (s.git_repo = $2 OR s.git_repo = $3)`,
-		branch, cloneURL, fullName)
+	q := sqlcdb.New(db.DB)
+	ctx := context.Background()
+	// Sync-style events may carry no branch — empty branch matches all.
+	rows, err := q.ListServicesForPush(ctx, sqlcdb.ListServicesForPushParams{
+		GitBranch: sql.NullString{String: branch, Valid: true},
+		GitRepo:   sql.NullString{String: cloneURL, Valid: true},
+		GitRepo_2: sql.NullString{String: fullName, Valid: true},
+	})
 	if err != nil {
 		return 0, err
 	}
-	defer rows.Close()
 
 	var services []Service
-	for rows.Next() {
-		var s Service
-		if err := rows.Scan(
-			&s.ID, &s.ProjectID, &s.Name, &s.Type, &s.Status, &s.Image, &s.Command,
-			&s.Environment, &s.GitRepo, &s.GitBranch, &s.BuildPath, &s.CPU, &s.Memory,
-			&s.CreatedAt, &s.UpdatedAt,
-		); err != nil {
-			return 0, err
-		}
-		services = append(services, s)
+	for _, row := range rows {
+		services = append(services, Service{
+			ID:          row.ID,
+			ProjectID:   row.ProjectID,
+			Name:        row.Name,
+			Type:        row.Type,
+			Status:      row.Status,
+			Image:       row.Image,
+			Command:     row.Command,
+			Environment: row.Environment,
+			GitRepo:     row.GitRepo,
+			GitBranch:   row.GitBranch,
+			BuildPath:   row.BuildPath,
+			CPU:         row.Cpu,
+			Memory:      row.Memory,
+			CreatedAt:   row.CreatedAt.Time,
+			UpdatedAt:   row.UpdatedAt.Time,
+		})
 	}
 
 	enqueued := 0
@@ -173,44 +187,58 @@ func dispatchPushToServices(c *gin.Context, db *database.DB, engine *deployment.
 			CreatedAt:  now,
 			UpdatedAt:  now,
 		}
-		if _, err := db.Exec(
-			`INSERT INTO deployments
-			 (id, service_id, commit_hash, status, image_name, image_tag, created_at, updated_at)
-			 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
-			d.ID, d.ServiceID, d.CommitHash, d.Status, d.ImageName, d.ImageTag, d.CreatedAt, d.UpdatedAt,
-		); err != nil {
+		if err := q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+			ID:         d.ID,
+			ServiceID:  d.ServiceID,
+			Version:    fmt.Sprintf("v%d", now.Unix()),
+			CommitHash: sql.NullString{String: ptrStr(d.CommitHash), Valid: d.CommitHash != nil},
+			Status:     sql.NullString{String: d.Status, Valid: true},
+			ImageName:  sql.NullString{String: d.ImageName, Valid: true},
+			ImageTag:   sql.NullString{String: d.ImageTag, Valid: true},
+			CreatedAt:  sql.NullTime{Time: d.CreatedAt, Valid: true},
+			UpdatedAt:  sql.NullTime{Time: d.UpdatedAt, Valid: true},
+		}); err != nil {
 			continue
 		}
 		if engine == nil {
-			failedAt := time.Now()
 			failure := "Deployment engine unavailable. Docker may not be configured on this server."
-			_, _ = db.Exec(
-				`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
-				failure, failedAt, d.ID,
-			)
+			failedAt := time.Now()
+			_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+				Error:       sql.NullString{String: failure, Valid: true},
+				CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+				ID:          d.ID,
+			})
 			continue
 		}
-		_, _ = db.Exec(
-			`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
-			time.Now(), service.ID,
-		)
+		_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "building", Valid: true},
+			UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+			ID:        service.ID,
+		})
 		// Webhook pushes default to a clean build — stale layers are the
 		// classic silent-rollback failure (dflow convention).
-		webhookReq := CreateDeploymentRequest{CommitHash: commit, Branch: branch, Trigger: "webhook", NoCache: true}
+		branchForBuild := branch
+		if branchForBuild == "" {
+			branchForBuild = service.GitBranch
+		}
+		webhookReq := CreateDeploymentRequest{CommitHash: commit, Branch: branchForBuild, Trigger: "webhook", NoCache: true}
 		if pos := getDeployQueue(c).Enqueue(service.ID, deployqueue.Job{
 			DeploymentID: d.ID,
 			Run: func(jctx context.Context) {
 				runDeploymentAndSync(jctx, db, engine, &d, service, webhookReq, repoUserID)
 			},
 		}); pos > 0 {
-			_, _ = db.Exec(
-				`UPDATE deployments SET status = 'queued', updated_at = $1 WHERE id = $2`,
-				time.Now(), d.ID,
-			)
-			_, _ = db.Exec(
-				`UPDATE services SET status = 'queued', updated_at = $1 WHERE id = $2`,
-				time.Now(), service.ID,
-			)
+			now := sql.NullTime{Time: time.Now(), Valid: true}
+			_ = q.SetDeploymentStatus(ctx, sqlcdb.SetDeploymentStatusParams{
+				Status:    sql.NullString{String: "queued", Valid: true},
+				UpdatedAt: now,
+				ID:        d.ID,
+			})
+			_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+				Status:    sql.NullString{String: "queued", Valid: true},
+				UpdatedAt: now,
+				ID:        service.ID,
+			})
 		}
 		enqueued++
 	}

app/backend/internal/api/git_test.go

@@ -1,6 +1,16 @@
 package api
 
-import "testing"
+import (
+	"context"
+	"database/sql"
+	"strings"
+	"testing"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/google/uuid"
+)
 
 func TestNormalizeRepositoryFullName(t *testing.T) {
 	cases := []struct {
@@ -83,3 +93,195 @@ func TestDeriveCloneURL(t *testing.T) {
 		})
 	}
 }
+
+// Live invariant test against real Postgres — set METRICS_TEST_DSN (or
+// DATABASE_URL). Covers the generated git provider/repo/webhook queries plus
+// the push-dispatch service matcher (empty branch must match all branches).
+func TestGitLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	providerID := uuid.New()
+	repoID := uuid.New()
+	webhookID := uuid.New()
+	svcMain := uuid.New()
+	svcDev := uuid.New()
+	suffix := strings.ReplaceAll(userID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "git-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "git-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	// Provider lifecycle.
+	must(q.InsertGitProvider(ctx, sqlcdb.InsertGitProviderParams{
+		ID: providerID, Name: "github", DisplayName: "GitHub",
+		ApiUrl: "https://api.github.com", WebhookUrl: "https://hooks.test",
+		AccessToken: "tok", UserID: userID,
+	}))
+	providers, err := q.ListGitProviders(ctx, userID)
+	if err != nil || len(providers) == 0 {
+		t.Fatalf("providers: %v %v", err, providers)
+	}
+	name, err := q.GetGitProviderNameByID(ctx, providerID)
+	if err != nil || name != "github" {
+		t.Fatalf("provider name: %v %q", err, name)
+	}
+	fetch, err := q.GetGitProviderForFetch(ctx, sqlcdb.GetGitProviderForFetchParams{ID: providerID, UserID: userID})
+	if err != nil || fetch.AccessToken != "tok" || fetch.ApiUrl != "https://api.github.com" {
+		t.Fatalf("fetch: %v %+v", err, fetch)
+	}
+
+	// Repository insert + search.
+	cloneURL := "https://github.com/acme/svc-" + suffix + ".git"
+	fullName := "acme/svc-" + suffix
+	_, err = q.InsertGitRepository(ctx, sqlcdb.InsertGitRepositoryParams{
+		ID: repoID, ProviderID: providerID, Name: "svc-" + suffix, FullName: fullName,
+		Description:   sql.NullString{String: "", Valid: true},
+		CloneUrl:      cloneURL,
+		DefaultBranch: sql.NullString{String: "main", Valid: true},
+		IsPrivate:     sql.NullBool{Bool: false, Valid: true},
+		UserID:        userID,
+	})
+	must(err)
+	byName, err := q.GetGitRepositoryByFullName(ctx, sqlcdb.GetGitRepositoryByFullNameParams{
+		ProviderID: providerID, FullName: fullName, UserID: userID,
+	})
+	if err != nil || byName.ID != repoID || byName.CloneUrl != cloneURL {
+		t.Fatalf("repo by full name: %v %+v", err, byName)
+	}
+	all, err := q.ListGitRepositories(ctx, sqlcdb.ListGitRepositoriesParams{
+		ProviderID: providerID, UserID: userID, Column3: "", Limit: 50, Offset: 0,
+	})
+	if err != nil || len(all) == 0 {
+		t.Fatalf("repo list (empty search): %v %v", err, all)
+	}
+	hit, err := q.ListGitRepositories(ctx, sqlcdb.ListGitRepositoriesParams{
+		ProviderID: providerID, UserID: userID, Column3: "svc-" + suffix, Limit: 50, Offset: 0,
+	})
+	if err != nil || len(hit) != 1 || hit[0].ID != repoID {
+		t.Fatalf("repo list (matching search): %v %v", err, hit)
+	}
+	miss, err := q.ListGitRepositories(ctx, sqlcdb.ListGitRepositoriesParams{
+		ProviderID: providerID, UserID: userID, Column3: "zzz-no-match", Limit: 50, Offset: 0,
+	})
+	if err != nil || len(miss) != 0 {
+		t.Fatalf("repo list (non-matching search): %v %v", err, miss)
+	}
+	count, err := q.CountGitRepositories(ctx, sqlcdb.CountGitRepositoriesParams{
+		ProviderID: providerID, UserID: userID, Column3: "",
+	})
+	if err != nil || count < 1 {
+		t.Fatalf("repo count: %v %d", err, count)
+	}
+	// Upsert on (provider_id, full_name) conflict — updates rather than errors.
+	must(q.UpsertGitRepository(ctx, sqlcdb.UpsertGitRepositoryParams{
+		ID: uuid.New(), ProviderID: providerID, Name: "renamed-" + suffix, FullName: fullName,
+		Description:   sql.NullString{String: "d", Valid: true},
+		CloneUrl:      cloneURL,
+		DefaultBranch: sql.NullString{String: "main", Valid: true},
+		IsPrivate:     sql.NullBool{Bool: true, Valid: true},
+		UserID:        userID,
+	}))
+	byName, err = q.GetGitRepositoryByFullName(ctx, sqlcdb.GetGitRepositoryByFullNameParams{
+		ProviderID: providerID, FullName: fullName, UserID: userID,
+	})
+	if err != nil || byName.Name != "renamed-"+suffix {
+		t.Fatalf("repo after upsert: %v %+v", err, byName)
+	}
+
+	// Connected-repos join + webhook lifecycle.
+	connected, err := q.ListConnectedRepositories(ctx, sqlcdb.ListConnectedRepositoriesParams{
+		UserID: userID, Limit: 50, Offset: 0,
+	})
+	if err != nil || len(connected) == 0 {
+		t.Fatalf("connected repos: %v %v", err, connected)
+	}
+	wh, err := q.UpsertGitWebhook(ctx, sqlcdb.UpsertGitWebhookParams{
+		ID: webhookID, RepoID: repoID, ProviderID: providerID,
+		Events: "push", WebhookSecret: "sec-" + suffix,
+		BranchFilter: sql.NullString{String: "", Valid: true},
+	})
+	must(err)
+	if !wh.Active.Bool {
+		t.Fatalf("webhook inactive after upsert: %+v", wh)
+	}
+	push, err := q.GetGitWebhookForPush(ctx, webhookID)
+	if err != nil || push.WebhookSecret != "sec-"+suffix || push.ProviderID != providerID {
+		t.Fatalf("webhook for push: %v %+v", err, push)
+	}
+	pushRepo, err := q.GetGitRepoForPush(ctx, repoID)
+	if err != nil || pushRepo.CloneUrl != cloneURL || pushRepo.FullName != fullName || pushRepo.UserID != userID {
+		t.Fatalf("repo for push: %v %+v", err, pushRepo)
+	}
+
+	// Push-dispatch service matcher: branch filter and empty-branch match-all.
+	for id, branch := range map[uuid.UUID]string{svcMain: "main", svcDev: "dev"} {
+		_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type, git_repo, git_branch)
+			VALUES ($1, $2, $3, $4, 'web', 'git', $5, $6)`,
+			id, "svc-"+suffix+"-"+branch, projectID, envID, cloneURL, branch)
+		must(err)
+	}
+	servicesFor := func(branch string) []sqlcdb.ListServicesForPushRow {
+		rows, err := q.ListServicesForPush(ctx, sqlcdb.ListServicesForPushParams{
+			GitBranch: sql.NullString{String: branch, Valid: true},
+			GitRepo:   sql.NullString{String: cloneURL, Valid: true},
+			GitRepo_2: sql.NullString{String: fullName, Valid: true},
+		})
+		if err != nil {
+			t.Fatalf("services for push %q: %v", branch, err)
+		}
+		return rows
+	}
+	mainRows := servicesFor("main")
+	if len(mainRows) != 1 || mainRows[0].ID != svcMain || mainRows[0].GitBranch != "main" {
+		t.Fatalf("main branch dispatch: %+v", mainRows)
+	}
+	devRows := servicesFor("dev")
+	if len(devRows) != 1 || devRows[0].ID != svcDev {
+		t.Fatalf("dev branch dispatch: %+v", devRows)
+	}
+	allRows := servicesFor("")
+	if len(allRows) != 2 {
+		t.Fatalf("empty-branch dispatch should match all: %+v", allRows)
+	}
+	// Repo may also be referenced by its full_name.
+	fullRows, err := q.ListServicesForPush(ctx, sqlcdb.ListServicesForPushParams{
+		GitBranch: sql.NullString{String: "main", Valid: true},
+		GitRepo:   sql.NullString{String: "[email protected]:other/none.git", Valid: true},
+		GitRepo_2: sql.NullString{String: cloneURL, Valid: true},
+	})
+	if err != nil || len(fullRows) != 1 {
+		t.Fatalf("full-name repo match: %v %+v", err, fullRows)
+	}
+
+	// Provider delete is owner-scoped.
+	other, err := q.DeleteGitProvider(ctx, sqlcdb.DeleteGitProviderParams{ID: providerID, UserID: uuid.New()})
+	if err != nil || other != 0 {
+		t.Fatalf("foreign delete affected %d rows: %v", other, err)
+	}
+	deleted, err := q.DeleteGitProvider(ctx, sqlcdb.DeleteGitProviderParams{ID: providerID, UserID: userID})
+	if err != nil || deleted != 1 {
+		t.Fatalf("owner delete affected %d rows: %v", deleted, err)
+	}
+}

app/backend/internal/api/gitcreds.go

@@ -0,0 +1,93 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"containr/internal/source"
+
+	"github.com/google/uuid"
+)
+
+// resolveGitCloneSpec turns a service's git_repo (clone URL, ssh remote, or
+// owner/repo) into a source.Spec with the project owner's provider token.
+// Public repos get no token — the clone proceeds anonymously. github_app
+// providers store the installation id, not a usable token; a fresh
+// installation token is minted per deploy.
+func resolveGitCloneSpec(db *database.DB, ownerID, gitRepo, branch, commit, buildPath string) (source.Spec, error) {
+	raw := strings.TrimSpace(gitRepo)
+	cloneURL, err := source.NormalizeCloneURL(raw)
+	if err != nil {
+		return source.Spec{}, err
+	}
+
+	spec := source.Spec{Branch: branch, Commit: commit, BuildPath: buildPath}
+	q := sqlcdb.New(db.DB)
+	ctx := context.Background()
+
+	ownerUUID, _ := uuid.Parse(ownerID)
+	var providerID uuid.UUID
+	if !strings.Contains(cloneURL, "://") {
+		// Bare owner/repo — the connected repository row knows the host.
+		row, err := q.GetGitRepoCloneByFullName(ctx, sqlcdb.GetGitRepoCloneByFullNameParams{
+			FullName: cloneURL,
+			UserID:   ownerUUID,
+		})
+		if err != nil {
+			return source.Spec{}, fmt.Errorf("repository %s is not connected — connect it under Git settings or store a clone URL", raw)
+		}
+		cloneURL = row.CloneUrl
+		providerID = row.ProviderID
+	} else {
+		// URL form — match a connected repo for its provider when possible;
+		// an unmatched public URL still clones, just without credentials.
+		if pid, err := q.GetGitRepoProviderByCloneURL(ctx, sqlcdb.GetGitRepoProviderByCloneURLParams{
+			CloneUrl: cloneURL,
+			UserID:   ownerUUID,
+		}); err == nil {
+			providerID = pid
+		}
+	}
+
+	if err := source.ValidateRemoteURL(cloneURL); err != nil {
+		return source.Spec{}, err
+	}
+	spec.CloneURL = cloneURL
+
+	if providerID == uuid.Nil {
+		return spec, nil
+	}
+	prov, err := q.GetGitProviderForFetch(ctx, sqlcdb.GetGitProviderForFetchParams{
+		ID:     providerID,
+		UserID: ownerUUID,
+	})
+	if err != nil {
+		return spec, nil // provider row gone — anonymous clone still works for public repos
+	}
+	name, apiURL, token := prov.Name, prov.ApiUrl, prov.AccessToken
+
+	switch strings.ToLower(name) {
+	case "github_app":
+		installationID, err := strconv.ParseInt(strings.TrimSpace(token), 10, 64)
+		if err == nil && installationID > 0 {
+			if minted, err := getGitHubAppInstallationToken(apiURL, installationID); err == nil {
+				spec.Token = minted
+				spec.User = "x-access-token"
+			}
+		}
+	case "gitlab":
+		spec.Token = token
+		spec.User = "oauth2"
+	case "bitbucket":
+		spec.Token = token
+		spec.User = "x-token-auth"
+	default:
+		spec.Token = token
+		spec.User = "x-access-token"
+	}
+	return spec, nil
+}

app/backend/internal/api/github_app.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 
 	"github.com/gin-gonic/gin"
@@ -88,8 +89,8 @@ func handleAdminGitHubAppManifest(c *gin.Context) {
 
 	callbackURL := base + "/git/github-app/callback"
 	manifest, err := json.Marshal(map[string]interface{}{
-		"name":  name,
-		"url":   base,
+		"name": name,
+		"url":  base,
 		"hook_attributes": map[string]interface{}{
 			"url":    base + "/api/git/github-app/webhook",
 			"active": true,
@@ -206,9 +207,8 @@ func handleAdminGitHubAppConvert(c *gin.Context) {
 // GET /admin/git/github-app — provisioning status for the settings UI.
 func handleAdminGetGitHubApp(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
-	var stored string
 	source := "none"
-	if err := db.QueryRow(`SELECT value FROM app_settings WHERE key = $1`, settingGitHubAppID).Scan(&stored); err == nil && strings.TrimSpace(stored) != "" {
+	if v, err := sqlcdb.New(db.DB).GetAppSetting(c.Request.Context(), settingGitHubAppID); err == nil && strings.TrimSpace(v) != "" {
 		source = "settings"
 	} else if strings.TrimSpace(os.Getenv("GITHUB_APP_ID")) != "" {
 		source = "env"

app/backend/internal/api/ingress.go

@@ -0,0 +1,212 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"containr/internal/deployment"
+)
+
+// Remote ingress: replicas on node agents aren't on the hub's
+// containr-network, so Traefik's Docker provider can't see them. Instead
+// the backend renders one file-provider config per service into
+// TRAEFIK_DYNAMIC_DIR (a directory Traefik watches), pointing the
+// loadbalancer at the node's reachable IP + the ephemeral host port the
+// agent reported back after `create_container`.
+//
+// Empty dir → feature off (bare-metal dev). Files are best-effort: a
+// failed write never fails a reconcile.
+
+func ingressDir() string { return os.Getenv("TRAEFIK_DYNAMIC_DIR") }
+
+func ingressFile(serviceID string) string {
+	return filepath.Join(ingressDir(), "containr-"+serviceID+".yml")
+}
+
+// jsonInt coerces JSON-ish numbers (int/int32/int64/float64) to int —
+// spec fields arrive as int32, agent payloads unmarshal as float64.
+func jsonInt(v interface{}) int {
+	switch n := v.(type) {
+	case int:
+		return n
+	case int32:
+		return int(n)
+	case int64:
+		return int(n)
+	case float64:
+		return int(n)
+	}
+	return 0
+}
+
+// reportedHostPorts parses the agent's create_container result —
+// {"name": ..., "host_ports": {"80/tcp": "32768"}}. Older agents return a
+// bare name string; JSON parse failure means no port info.
+func reportedHostPorts(result string) map[string]string {
+	var out struct {
+		HostPorts map[string]string `json:"host_ports"`
+	}
+	if json.Unmarshal([]byte(result), &out) != nil {
+		return nil
+	}
+	return out.HostPorts
+}
+
+// nodeIngressIP picks the address the hub can reach the node on. Mesh
+// overlays first — the agent operator joined a mesh precisely so the hub
+// can reach it — then the reported primary IP as a LAN fallback.
+func nodeIngressIP(agent sqlcdb.NodeAgent) string {
+	var meta struct {
+		Mesh map[string]string `json:"mesh"`
+	}
+	_ = json.Unmarshal(agent.Metadata.RawMessage, &meta)
+	for _, prefix := range []string{"tailscale", "netbird", "wg", "zt"} {
+		var keys []string
+		for name := range meta.Mesh {
+			keys = append(keys, name)
+		}
+		sort.Strings(keys)
+		for _, name := range keys {
+			if strings.HasPrefix(name, prefix) && meta.Mesh[name] != "" {
+				return meta.Mesh[name]
+			}
+		}
+	}
+	return agent.IpAddress
+}
+
+// syncRemoteIngress rewrites the service's file-provider config from the
+// live remote replica set. Called after every remote reconcile so replica
+// adds/removals and node retargets converge the upstream list.
+func syncRemoteIngress(ctx context.Context, db *database.DB, spec deployment.RuntimeSpec) {
+	if ingressDir() == "" {
+		return
+	}
+	domains := spec.Domains
+	if len(domains) == 0 && spec.Domain != "" {
+		domains = []string{spec.Domain}
+	}
+	if len(domains) == 0 || spec.Port <= 0 {
+		removeServiceIngress(spec.ServiceID)
+		return
+	}
+
+	q := sqlcdb.New(db.DB)
+	rows, err := q.ListServiceContainers(ctx, spec.ServiceID)
+	if err != nil {
+		return
+	}
+	type upstream struct{ ip, port string }
+	var servers []upstream
+	for _, row := range rows {
+		var st struct {
+			State string `json:"state"`
+		}
+		_ = json.Unmarshal(row.Status.RawMessage, &st)
+		if st.State != "running" {
+			continue
+		}
+		var port string
+		var plist []map[string]interface{}
+		if err := json.Unmarshal(row.Ports.RawMessage, &plist); err == nil {
+			for _, p := range plist {
+				if hp, ok := p["host_port"].(float64); ok && hp > 0 {
+					port = fmt.Sprintf("%d", int(hp))
+				}
+			}
+		}
+		if port == "" {
+			continue
+		}
+		agent, err := q.GetAgent(ctx, row.NodeAgentID)
+		if err != nil {
+			continue
+		}
+		if ip := nodeIngressIP(agent); ip != "" {
+			servers = append(servers, upstream{ip, port})
+		}
+	}
+	if len(servers) == 0 {
+		removeServiceIngress(spec.ServiceID)
+		return
+	}
+
+	router := "svc-" + spec.ServiceID[:8]
+	rules := make([]string, 0, len(domains))
+	for _, d := range domains {
+		rules = append(rules, "Host(`"+d+"`)")
+	}
+	var b strings.Builder
+	b.WriteString("http:\n  routers:\n    " + router + ":\n")
+	b.WriteString("      rule: \"" + strings.Join(rules, " || ") + "\"\n")
+	b.WriteString("      entrypoints: [web]\n")
+	b.WriteString("      service: " + router + "\n")
+	b.WriteString("  services:\n    " + router + ":\n      loadBalancer:\n        servers:\n")
+	for _, s := range servers {
+		b.WriteString("          - url: \"http://" + s.ip + ":" + s.port + "\"\n")
+	}
+	// Atomic-ish: write temp then rename so Traefik's watcher never reads a
+	// truncated file.
+	tmp := ingressFile(spec.ServiceID) + ".tmp"
+	if err := os.WriteFile(tmp, []byte(b.String()), 0o644); err != nil {
+		return
+	}
+	_ = os.Rename(tmp, ingressFile(spec.ServiceID))
+}
+
+// removeServiceIngress deletes the service's remote route. Called on
+// remote teardown and when a service returns to local placement.
+func removeServiceIngress(serviceID string) {
+	if ingressDir() == "" {
+		return
+	}
+	_ = os.Remove(ingressFile(serviceID))
+}
+
+// wakeUpstreamURL is where a sleeping remote service's route points —
+// the backend's wake-page endpoint. Defaults to the compose service name;
+// TRAEFIK_BACKEND_URL overrides for custom layouts.
+func wakeUpstreamURL(apiPort int) string {
+	if v := strings.TrimSpace(os.Getenv("TRAEFIK_BACKEND_URL")); v != "" {
+		return strings.TrimRight(v, "/")
+	}
+	return fmt.Sprintf("http://containr-backend:%d", apiPort)
+}
+
+// writeWakeIngress routes the service's domains at the wake-page endpoint —
+// first hit triggers the wake reconcile and serves a reloading page.
+func writeWakeIngress(serviceID string, domains []string, apiPort int) {
+	if ingressDir() == "" {
+		return
+	}
+	sort.Strings(domains)
+	router := "svc-" + serviceID[:8] + "-wake"
+	rules := make([]string, 0, len(domains))
+	for _, d := range domains {
+		rules = append(rules, "Host(`"+d+"`)")
+	}
+	var b strings.Builder
+	mw := router + "-rw"
+	b.WriteString("http:\n  routers:\n    " + router + ":\n")
+	b.WriteString("      rule: \"" + strings.Join(rules, " || ") + "\"\n")
+	b.WriteString("      entrypoints: [web]\n")
+	b.WriteString("      service: " + router + "\n")
+	b.WriteString("      priority: 100\n")
+	b.WriteString("      middlewares: [" + mw + "]\n")
+	b.WriteString("  middlewares:\n    " + mw + ":\n")
+	b.WriteString("      replacePath:\n        path: \"/api/v1/internal/wake-page/" + serviceID + "\"\n")
+	b.WriteString("  services:\n    " + router + ":\n      loadBalancer:\n        servers:\n")
+	b.WriteString("          - url: \"" + wakeUpstreamURL(apiPort) + "\"\n")
+	tmp := ingressFile(serviceID) + ".tmp"
+	if err := os.WriteFile(tmp, []byte(b.String()), 0o644); err != nil {
+		return
+	}
+	_ = os.Rename(tmp, ingressFile(serviceID))
+}

app/backend/internal/api/invites.go

@@ -193,8 +193,8 @@ func handleAcceptInvite(c *gin.Context) {
 		return
 	}
 
-	var existing int
-	if err := db.QueryRow(`SELECT COUNT(*) FROM users WHERE email = $1`, req.Email).Scan(&existing); err != nil {
+	existing, err := q.CountUsersByEmail(c.Request.Context(), req.Email)
+	if err != nil {
 		respondError(c, http.StatusInternalServerError, "INTERNAL", "database error")
 		return
 	}
@@ -214,17 +214,23 @@ func handleAcceptInvite(c *gin.Context) {
 		return
 	}
 
-	var user User
-	err = db.QueryRow(`
-		INSERT INTO users (email, password_hash, name)
-		VALUES ($1, $2, $3)
-		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
-	`, req.Email, string(hashedPassword), strings.TrimSpace(req.Name)).
-		Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
+	row, err := q.InsertUser(c.Request.Context(), sqlcdb.InsertUserParams{
+		Email:        req.Email,
+		PasswordHash: string(hashedPassword),
+		Name:         strings.TrimSpace(req.Name),
+	})
 	if err != nil {
 		respondError(c, http.StatusConflict, "CONFLICT", "user already exists")
 		return
 	}
+	user := User{
+		ID:        row.ID.String(),
+		Email:     row.Email,
+		Name:      row.Name,
+		AvatarURL: row.AvatarUrl,
+		IsAdmin:   row.IsAdmin,
+		CreatedAt: row.CreatedAt.Time.String(),
+	}
 
 	userUUID, _ := uuid.Parse(user.ID)
 	if err := q.MarkUserInviteUsed(c.Request.Context(), sqlcdb.MarkUserInviteUsedParams{

app/backend/internal/api/metrics.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/docker"
 
 	containertypes "github.com/docker/docker/api/types/container"
@@ -60,17 +61,12 @@ func handleGetServiceMetrics(c *gin.Context) {
 		return
 	}
 
-	var projectID uuid.UUID
-	var status string
-	err = db.QueryRow(
-		`SELECT s.project_id, COALESCE(s.status, '')
-		 FROM services s WHERE s.id = $1`,
-		serviceID,
-	).Scan(&projectID, &status)
+	svc, err := sqlcdb.New(db.DB).GetServiceProjectAndStatus(context.Background(), serviceID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
+	projectID := svc.ProjectID
 	if _, allowed := projectReadAccess(c, db, projectID); !allowed {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return

app/backend/internal/api/noderunner.go

@@ -0,0 +1,495 @@
+package api
+
+import (
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"containr/internal/deployment"
+)
+
+// agentNodeRunner implements deployment.NodeRunner by dispatching container
+// lifecycle commands to a node agent's command queue and waiting for the
+// reported result. Domains route through the file provider —
+// syncRemoteIngress renders per-service configs from live inventory.
+type agentNodeRunner struct {
+	q  *sqlcdb.Queries
+	db *database.DB
+}
+
+func newAgentNodeRunner(db *database.DB) *agentNodeRunner {
+	return &agentNodeRunner{q: sqlcdb.New(db.DB), db: db}
+}
+
+// remoteContainerID is deterministic per (agent, service, replica) so redeploys
+// update the same inventory row instead of accumulating stale ones.
+func remoteContainerID(agentID, serviceID string, replica int) string {
+	sum := sha256.Sum256([]byte(agentID + "|" + serviceID + "|" + fmt.Sprint(replica)))
+	return fmt.Sprintf("%x-%x-%x-%x-%x", sum[0:4], sum[4:6], sum[6:8], sum[8:10], sum[10:16])
+}
+
+func remoteContainerName(serviceID string, replica int) string {
+	return fmt.Sprintf("containr-%s-%d", serviceID, replica)
+}
+
+func (r *agentNodeRunner) ReconcileOnNode(ctx context.Context, spec deployment.RuntimeSpec) (*deployment.RuntimeState, error) {
+	agent, err := r.q.GetAgent(ctx, spec.NodeID)
+	if err != nil {
+		return nil, fmt.Errorf("node %s not found", spec.NodeID)
+	}
+	if !agent.Status.Valid || agent.Status.String != "online" {
+		return nil, fmt.Errorf("node %s is %s — heartbeats resume scheduling when it reconnects", agent.Name, agent.Status.String)
+	}
+	return r.reconcileOnAgents(ctx, spec, func(int) string { return spec.NodeID })
+}
+
+// ReconcileSpread distributes replicas deterministically across online,
+// schedulable agents: replica i lands on agents[i % len(agents)], agents
+// sorted by id. Replicas wrap when they outnumber nodes. The local host is
+// not a spread target — pin "local" or leave unset for local execution.
+func (r *agentNodeRunner) ReconcileSpread(ctx context.Context, spec deployment.RuntimeSpec) (*deployment.RuntimeState, error) {
+	tagsRaw, _ := json.Marshal(spec.PlacementTags)
+	if len(spec.PlacementTags) == 0 {
+		tagsRaw = []byte("[]")
+	}
+	agents, err := r.q.ListSchedulableAgentsMatching(ctx, json.RawMessage(tagsRaw))
+	if err != nil {
+		return nil, fmt.Errorf("list schedulable nodes: %w", err)
+	}
+	if len(agents) == 0 {
+		if len(spec.PlacementTags) > 0 {
+			return nil, fmt.Errorf("no online schedulable nodes carry placement tags %v — tag a node or relax the requirement", spec.PlacementTags)
+		}
+		return nil, fmt.Errorf("no online schedulable nodes — connect an agent or unset spread")
+	}
+	return r.reconcileOnAgents(ctx, spec, func(i int) string {
+		return agents[i%len(agents)].ID
+	})
+}
+
+// ReconcileAuto resolves the least-loaded online agent matching the
+// service's placement tags and reconciles every replica onto it. Stale
+// replicas on other agents retire through reconcileOnAgents — a service
+// follows its tags when the matching set changes.
+func (r *agentNodeRunner) ReconcileAuto(ctx context.Context, spec deployment.RuntimeSpec) (*deployment.RuntimeState, error) {
+	tagsRaw, _ := json.Marshal(spec.PlacementTags)
+	if len(spec.PlacementTags) == 0 {
+		tagsRaw = []byte("[]")
+	}
+	agentID, err := r.q.PickLeastLoadedAgentMatching(ctx, json.RawMessage(tagsRaw))
+	if err != nil {
+		return nil, fmt.Errorf("no online nodes carry placement tags %v", spec.PlacementTags)
+	}
+	return r.reconcileOnAgents(ctx, spec, func(int) string { return agentID })
+}
+
+// RemoteRuntimeState reads the service's remote replicas from inventory.
+// Rows only carry the last dispatched state — the agent doesn't stream
+// container events — so "running" means "last create succeeded".
+func (r *agentNodeRunner) RemoteRuntimeState(ctx context.Context, serviceID string) (*deployment.RuntimeState, error) {
+	rows, err := r.q.ListServiceContainers(ctx, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	state := &deployment.RuntimeState{Status: "stopped"}
+	running := 0
+	for _, row := range rows {
+		var status struct {
+			State string `json:"state"`
+		}
+		unmarshalRaw(row.Status, &status)
+		if status.State == "" || status.State == "removed" {
+			continue
+		}
+		replica := -1
+		if idx, err := strconv.Atoi(strings.TrimPrefix(row.Name, fmt.Sprintf("containr-%s-", serviceID))); err == nil {
+			replica = idx
+		}
+		state.Containers = append(state.Containers, deployment.RuntimeContainer{
+			ID: row.ID, Name: row.Name, State: status.State, Replica: replica,
+		})
+		if status.State == "running" {
+			running++
+		}
+	}
+	if running > 0 {
+		state.Status = "running"
+	}
+	return state, nil
+}
+
+// reconcileOnAgents creates the service's replicas on the agents chosen by
+// targetFor and retires stale replicas on any agent — including leftovers
+// from a previous pin or a different spread assignment.
+func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment.RuntimeSpec, targetFor func(replica int) string) (*deployment.RuntimeState, error) {
+	replicas := spec.Replicas
+	if replicas < 1 {
+		replicas = 1
+	}
+
+	prefix := fmt.Sprintf("containr-%s-", spec.ServiceID)
+	existing, _ := r.q.ListServiceContainers(ctx, spec.ServiceID)
+	for _, row := range existing {
+		if !strings.HasPrefix(row.Name, prefix) {
+			continue
+		}
+		replica, err := strconv.Atoi(strings.TrimPrefix(row.Name, prefix))
+		keep := err == nil && replica < replicas && row.NodeAgentID == targetFor(replica)
+		if keep {
+			continue
+		}
+		if _, cmdErr := r.enqueueAndWait(ctx, row.NodeAgentID, "", "remove_container",
+			map[string]interface{}{"container_name": row.Name}); cmdErr != nil {
+			return nil, fmt.Errorf("remove stale replica %s on node %s: %w", row.Name, row.NodeAgentID, cmdErr)
+		}
+		_ = r.q.UpdateContainerStatus(ctx, sqlcdb.UpdateContainerStatusParams{
+			ID:     row.ID,
+			Status: rawJSON(map[string]interface{}{"state": "removed"}),
+		})
+	}
+
+	// Ship the image to every distinct target agent before replicas start.
+	// RemoteBuild nodes docker-build from the packaged context artifact;
+	// RemoteLoad nodes docker-load a saved tarball (local-tag rollbacks).
+	// Registry-pullable images skip this — docker run pulls on demand.
+	if spec.RemoteBuild != nil || spec.RemoteLoad != nil {
+		seen := map[string]bool{}
+		for i := 0; i < replicas; i++ {
+			agentID := targetFor(i)
+			if seen[agentID] {
+				continue
+			}
+			seen[agentID] = true
+			if spec.RemoteBuild != nil {
+				buildArgs := map[string]interface{}{}
+				for k, v := range spec.RemoteBuild.BuildArgs {
+					buildArgs[k] = v
+				}
+				_, err := r.enqueueAndWaitTimeout(ctx, agentID, "", "build_image",
+					map[string]interface{}{
+						"artifact_id": spec.RemoteBuild.ArtifactID,
+						"image":       spec.Image,
+						"build_args":  buildArgs,
+						"no_cache":    spec.RemoteBuild.NoCache,
+					}, 25*time.Minute)
+				if err != nil {
+					return nil, fmt.Errorf("build image on node %s: %w", agentID, err)
+				}
+			} else if spec.RemoteLoad != nil {
+				_, err := r.enqueueAndWaitTimeout(ctx, agentID, "", "load_image",
+					map[string]interface{}{
+						"artifact_id": spec.RemoteLoad.ArtifactID,
+					}, 10*time.Minute)
+				if err != nil {
+					return nil, fmt.Errorf("load image on node %s: %w", agentID, err)
+				}
+			}
+		}
+	}
+
+	state := &deployment.RuntimeState{Desired: replicas, Status: "running"}
+	for i := 0; i < replicas; i++ {
+		agentID := targetFor(i)
+		name := remoteContainerName(spec.ServiceID, i)
+		containerID := remoteContainerID(agentID, spec.ServiceID, i)
+		container, env, ports, volumes, restart := r.replicaPayload(spec, agentID, i, name)
+
+		_ = r.q.UpsertServiceContainer(ctx, sqlcdb.UpsertServiceContainerParams{
+			ID:            containerID,
+			Name:          name,
+			Image:         spec.Image,
+			ProjectID:     spec.ProjectID,
+			ServiceID:     spec.ServiceID,
+			NodeAgentID:   agentID,
+			Status:        rawJSON(map[string]interface{}{"state": "created", "health": "none"}),
+			Resources:     rawJSON(map[string]interface{}{"memory": spec.MemoryBytes, "cpus": float64(spec.NanoCPUs) / 1e9}),
+			Ports:         rawJSON(ports),
+			Environment:   rawJSON(env),
+			Volumes:       rawJSON(volumes),
+			Networks:      rawJSON([]string{}),
+			RestartPolicy: rawJSON(map[string]interface{}{"name": restart}),
+			HealthCheck:   rawJSON(map[string]interface{}{"path": spec.HealthPath}),
+		})
+
+		result, err := r.enqueueAndWait(ctx, agentID, containerID, "create_container",
+			map[string]interface{}{"container": container})
+		if err != nil {
+			return nil, fmt.Errorf("replica %d on node %s: %w", i, agentID, err)
+		}
+		if assigned := reportedHostPorts(result); len(assigned) > 0 {
+			for _, p := range ports {
+				pm, ok := p.(map[string]interface{})
+				if !ok {
+					continue
+				}
+				cport := jsonInt(pm["container_port"])
+				proto, _ := pm["protocol"].(string)
+				if hp, ok := assigned[fmt.Sprintf("%d/%s", cport, proto)]; ok {
+					if n, err := strconv.Atoi(hp); err == nil {
+						pm["host_port"] = n
+					}
+				}
+			}
+			_ = r.q.UpdateContainerPorts(ctx, sqlcdb.UpdateContainerPortsParams{
+				ID:     containerID,
+				Status: rawJSON(map[string]interface{}{"state": "running", "health": "none"}),
+				Ports:  rawJSON(ports),
+			})
+		} else {
+			_ = r.q.UpdateContainerStatus(ctx, sqlcdb.UpdateContainerStatusParams{
+				ID:     containerID,
+				Status: rawJSON(map[string]interface{}{"state": "running", "health": "none"}),
+			})
+		}
+		state.Containers = append(state.Containers, deployment.RuntimeContainer{
+			ID: containerID, Name: name, State: "running", Replica: i,
+		})
+	}
+	syncRemoteIngress(ctx, r.db, spec)
+	return state, nil
+}
+
+// replicaPayload builds the agent create_container payload for one replica.
+func (r *agentNodeRunner) replicaPayload(spec deployment.RuntimeSpec, agentID string, i int, name string) (map[string]interface{}, map[string]interface{}, []interface{}, []interface{}, string) {
+	ports := []interface{}{}
+	if spec.Port > 0 {
+		hostPort := spec.PublishedPort // 0 → ephemeral on the node
+		if i > 0 {
+			hostPort = 0 // only replica 0 claims the preferred host port
+		}
+		ports = append(ports, map[string]interface{}{
+			"published":      true,
+			"host_port":      hostPort,
+			"container_port": spec.Port,
+			"protocol":       "tcp",
+		})
+	}
+	volumes := make([]interface{}, 0, len(spec.Volumes))
+	for _, v := range spec.Volumes {
+		volumes = append(volumes, map[string]interface{}{
+			"source": v.Source, "target": v.Destination, "read_only": v.ReadOnly,
+		})
+	}
+	env := map[string]interface{}{}
+	for k, v := range spec.Env {
+		env[k] = v
+	}
+	restart := spec.RestartPolicy
+	if restart == "" {
+		restart = "unless-stopped"
+	}
+	cmd := make([]interface{}, 0, len(spec.Command))
+	for _, arg := range spec.Command {
+		cmd = append(cmd, arg)
+	}
+	return map[string]interface{}{
+		"name":           name,
+		"image":          spec.Image,
+		"command":        cmd,
+		"environment":    env,
+		"registry":       r.pullCredentials(spec.ProjectID, spec.Image),
+		"ports":          ports,
+		"volumes":        volumes,
+		"restart_policy": restart,
+		"memory":         spec.MemoryBytes,
+		"cpus":           float64(spec.NanoCPUs) / 1e9,
+		"labels": map[string]interface{}{
+			"containr.managed": "true",
+			"containr.project": spec.ProjectID,
+			"containr.service": spec.ServiceID,
+			"containr.replica": fmt.Sprint(i),
+			"containr.node":    agentID,
+		},
+	}, env, ports, volumes, restart
+}
+
+// pullCredentials resolves the project owner's registry auth for the image
+// host so private images pull on remote nodes. Empty map → anonymous pull.
+func (r *agentNodeRunner) pullCredentials(projectID, imageRef string) map[string]interface{} {
+	pid, _ := uuid.Parse(projectID)
+	ownerID, err := sqlcdb.New(r.db.DB).GetProjectOwnerText(context.Background(), pid)
+	if err != nil {
+		return map[string]interface{}{}
+	}
+	auth := registryAuthFor(r.db, ownerID, imageRef)
+	if auth.Username == "" {
+		return map[string]interface{}{}
+	}
+	return map[string]interface{}{
+		"server":   auth.ServerAddress,
+		"username": auth.Username,
+		"password": auth.Password,
+	}
+}
+
+// ControlService fans a lifecycle action out to every replica row the
+// service has on the agent. Actions map onto the agent's container commands;
+// "remove" also tombstones the inventory row.
+func (r *agentNodeRunner) ControlService(ctx context.Context, serviceID, agentID, action string) error {
+	cmdType := map[string]string{
+		"start":   "start_container",
+		"stop":    "stop_container",
+		"restart": "restart_container",
+		"remove":  "remove_container",
+	}[action]
+	if cmdType == "" {
+		return fmt.Errorf("unsupported action %q", action)
+	}
+	rows, err := r.q.ListContainersForAgent(ctx, agentID)
+	if err != nil {
+		return err
+	}
+	removed := map[string]interface{}{"state": "removed"}
+	for _, row := range rows {
+		if row.ServiceID != serviceID {
+			continue
+		}
+		// Tombstoned replicas are already gone remotely — skip the dispatch
+		// or a fresh docker rm on a missing name reports a false failure.
+		if action == "remove" {
+			var st struct {
+				State string `json:"state"`
+			}
+			if err := json.Unmarshal(row.Status.RawMessage, &st); err == nil && st.State == "removed" {
+				continue
+			}
+		}
+		if _, err := r.enqueueAndWait(ctx, agentID, row.ID, cmdType,
+			map[string]interface{}{"container_name": row.Name}); err != nil {
+			return fmt.Errorf("%s %s on node: %w", action, row.Name, err)
+		}
+		if action == "remove" {
+			_ = r.q.UpdateContainerStatus(ctx, sqlcdb.UpdateContainerStatusParams{
+				ID: row.ID, Status: rawJSON(removed)})
+		}
+	}
+	return nil
+}
+
+// RemoveService tears down every replica of the service on the agent and
+// clears the inventory rows.
+func (r *agentNodeRunner) RemoveService(ctx context.Context, serviceID, agentID string) error {
+	if err := r.ControlService(ctx, serviceID, agentID, "remove"); err != nil {
+		return err
+	}
+	if err := r.q.DeleteServiceContainersOnAgent(ctx, sqlcdb.DeleteServiceContainersOnAgentParams{
+		NodeAgentID: agentID,
+		ServiceID:   serviceID,
+	}); err != nil {
+		return err
+	}
+	removeServiceIngress(serviceID)
+	return nil
+}
+
+// RetireService removes the service's remote replicas wherever they run —
+// called when the service converges to local placement so a cleared pin or
+// removed tag requirement doesn't leave containers behind.
+func (r *agentNodeRunner) RetireService(ctx context.Context, serviceID string) error {
+	agentIDs, err := r.q.ListServiceAgents(ctx, serviceID)
+	if err != nil {
+		return err
+	}
+	for _, agentID := range agentIDs {
+		if err := r.RemoveService(ctx, serviceID, agentID); err != nil {
+			return fmt.Errorf("retire on node %s: %w", agentID, err)
+		}
+	}
+	removeServiceIngress(serviceID)
+	return nil
+}
+
+// enqueueAndWait pushes a command to the agent's queue and polls for the
+// reported result, returning the agent's result string on success. Agents
+// poll on their own interval (≥5s), so this blocks — it runs inside the
+// deploy queue worker, never on a request path.
+func (r *agentNodeRunner) enqueueAndWait(ctx context.Context, agentID, containerID, cmdType string, payload map[string]interface{}) (string, error) {
+	return r.enqueueAndWaitTimeout(ctx, agentID, containerID, cmdType, payload, 8*time.Minute)
+}
+
+func (r *agentNodeRunner) enqueueAndWaitTimeout(ctx context.Context, agentID, containerID, cmdType string, payload map[string]interface{}, timeout time.Duration) (string, error) {
+	var cid sql.NullString
+	if containerID != "" {
+		cid = sql.NullString{String: containerID, Valid: true}
+	}
+	cmd, err := r.q.CreateCommand(ctx, sqlcdb.CreateCommandParams{
+		ID:          uuid.New().String(),
+		Type:        cmdType,
+		NodeAgentID: agentID,
+		ContainerID: cid,
+		Payload:     rawJSON(payload),
+	})
+	if err != nil {
+		return "", err
+	}
+
+	deadline := time.Now().Add(timeout) // image pulls/builds on a cold node
+	for {
+		row, err := r.q.GetCommandForAgent(ctx, sqlcdb.GetCommandForAgentParams{
+			ID:          cmd.ID,
+			NodeAgentID: agentID,
+		})
+		if err == nil {
+			switch row.Status.String {
+			case "completed":
+				return row.Result.String, nil
+			case "failed":
+				if row.Error.Valid && row.Error.String != "" {
+					return "", fmt.Errorf("agent: %s", row.Error.String)
+				}
+				return "", fmt.Errorf("agent reported failure")
+			}
+		}
+		if time.Now().After(deadline) {
+			return "", fmt.Errorf("command %s timed out waiting for the agent", cmdType)
+		}
+		select {
+		case <-ctx.Done():
+			return "", ctx.Err()
+		case <-time.After(2 * time.Second):
+		}
+	}
+}
+
+// resolveNodePin validates or resolves a node_id request value. "auto" picks
+// the least-loaded online agent that carries every required placement tag;
+// "" / "local" clears the pin. An explicit pin bypasses tag filtering —
+// the operator is overriding placement on purpose.
+func resolveNodePin(ctx context.Context, db *database.DB, requested string, requiredTags []string) (string, error) {
+	requested = strings.TrimSpace(requested)
+	if requested == "" || requested == "local" {
+		return "", nil
+	}
+	q := sqlcdb.New(db.DB)
+	if requested == "auto" {
+		tagsRaw, _ := json.Marshal(requiredTags)
+		if len(requiredTags) == 0 {
+			tagsRaw = []byte("[]")
+		}
+		id, err := q.PickLeastLoadedAgentMatching(ctx, json.RawMessage(tagsRaw))
+		if err != nil {
+			if len(requiredTags) > 0 {
+				return "", fmt.Errorf("no online nodes carry placement tags %v", requiredTags)
+			}
+			return "", fmt.Errorf("no online nodes available")
+		}
+		return id, nil
+	}
+	agent, err := q.GetAgent(ctx, requested)
+	if err != nil {
+		return "", fmt.Errorf("node not found")
+	}
+	if !agent.Schedulable {
+		return "", fmt.Errorf("node %s is cordoned — uncordon it before pinning", agent.Name)
+	}
+	return requested, nil
+}

app/backend/internal/api/notification_channels.go

@@ -0,0 +1,225 @@
+package api
+
+// Push notification channels — self-hosted ntfy and Gotify endpoints users
+// attach to their account. insertUserNotification fans out best-effort.
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// jarvis: ceiling — one shared client; no retry/backoff, delivery is
+// best-effort and failures are silent by design (notifications must never
+// break the producing flow).
+var pushHTTPClient = &http.Client{Timeout: 5 * time.Second}
+
+type notificationChannelDTO struct {
+	ID        string `json:"id"`
+	Kind      string `json:"kind"`
+	Endpoint  string `json:"endpoint"`
+	Enabled   bool   `json:"enabled"`
+	CreatedAt string `json:"created_at"`
+}
+
+func mapChannel(row sqlcdb.NotificationChannel) notificationChannelDTO {
+	return notificationChannelDTO{
+		ID:        row.ID.String(),
+		Kind:      row.Kind,
+		Endpoint:  row.Endpoint,
+		Enabled:   row.Enabled,
+		CreatedAt: row.CreatedAt.Time.Format(time.RFC3339),
+	}
+}
+
+func handleListNotificationChannels(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	uid, _ := uuid.Parse(userID)
+	rows, err := sqlcdb.New(db.DB).ListAllNotificationChannelsByUser(c.Request.Context(), uid)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to list channels")
+		return
+	}
+	out := make([]notificationChannelDTO, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, mapChannel(r))
+	}
+	c.JSON(http.StatusOK, gin.H{"channels": out})
+}
+
+func handleCreateNotificationChannel(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	var req struct {
+		Kind     string `json:"kind" binding:"required,oneof=ntfy gotify"`
+		Endpoint string `json:"endpoint" binding:"required"`
+		Token    string `json:"token"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "kind (ntfy|gotify) and endpoint are required")
+		return
+	}
+	endpoint := strings.TrimRight(strings.TrimSpace(req.Endpoint), "/")
+	u, err := url.Parse(endpoint)
+	if err != nil || u.Scheme == "" || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "endpoint must be a valid http(s) URL")
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	uid, _ := uuid.Parse(userID)
+	row, err := sqlcdb.New(db.DB).InsertNotificationChannel(c.Request.Context(), sqlcdb.InsertNotificationChannelParams{
+		UserID:   uid,
+		Kind:     req.Kind,
+		Endpoint: endpoint,
+		Token:    sql.NullString{String: req.Token, Valid: req.Token != ""},
+	})
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create channel")
+		return
+	}
+	c.JSON(http.StatusCreated, gin.H{"channel": mapChannel(row)})
+}
+
+func handleDeleteNotificationChannel(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid channel id")
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	uid, _ := uuid.Parse(userID)
+	n, err := sqlcdb.New(db.DB).DeleteNotificationChannel(c.Request.Context(), sqlcdb.DeleteNotificationChannelParams{
+		ID: id, UserID: uid,
+	})
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to delete channel")
+		return
+	}
+	if n == 0 {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Channel not found")
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "Channel deleted"})
+}
+
+// handleTestNotificationChannel pushes a probe notification through the
+// channel — surfaces misconfiguration before real alerts depend on it.
+func handleTestNotificationChannel(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid channel id")
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	uid, _ := uuid.Parse(userID)
+	rows, err := sqlcdb.New(db.DB).ListAllNotificationChannelsByUser(c.Request.Context(), uid)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to load channel")
+		return
+	}
+	var target *sqlcdb.NotificationChannel
+	for i := range rows {
+		if rows[i].ID == id {
+			target = &rows[i]
+			break
+		}
+	}
+	if target == nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Channel not found")
+		return
+	}
+	if err := deliverPush(c.Request.Context(), *target, "test", "Containr test notification", "Your push channel is configured correctly."); err != nil {
+		respondError(c, http.StatusBadGateway, "DELIVERY_FAILED", fmt.Sprintf("Push failed: %v", err))
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "Test notification sent"})
+}
+
+// deliverPush sends one notification through a channel. ntfy expects the
+// body at POST {endpoint} with Title/Priority headers; Gotify takes JSON at
+// POST {endpoint}/message?token=...
+func deliverPush(ctx context.Context, ch sqlcdb.NotificationChannel, kind, title, body string) error {
+	var req *http.Request
+	var err error
+	switch ch.Kind {
+	case "ntfy":
+		req, err = http.NewRequestWithContext(ctx, http.MethodPost, ch.Endpoint, strings.NewReader(body))
+		if err == nil {
+			req.Header.Set("Title", title)
+			req.Header.Set("Tags", "containr,"+kind)
+			if ch.Token.Valid && ch.Token.String != "" {
+				req.Header.Set("Authorization", "Bearer "+ch.Token.String)
+			}
+		}
+	case "gotify":
+		payload, _ := json.Marshal(map[string]interface{}{
+			"title":    title,
+			"message":  body,
+			"priority": 5,
+		})
+		endpoint := ch.Endpoint + "/message"
+		if ch.Token.Valid && ch.Token.String != "" {
+			endpoint += "?token=" + url.QueryEscape(ch.Token.String)
+		}
+		req, err = http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(payload))
+		if err == nil {
+			req.Header.Set("Content-Type", "application/json")
+		}
+	default:
+		return fmt.Errorf("unsupported channel kind %q", ch.Kind)
+	}
+	if err != nil {
+		return err
+	}
+	res, err := pushHTTPClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode >= 400 {
+		return fmt.Errorf("push endpoint returned %d", res.StatusCode)
+	}
+	return nil
+}
+
+// fanoutUserPush delivers a notification to every enabled channel the user
+// configured. Errors are swallowed — the in-app row already landed.
+func fanoutUserPush(db *database.DB, userID, kind, title, body string) {
+	uid, err := uuid.Parse(userID)
+	if err != nil {
+		return
+	}
+	rows, err := sqlcdb.New(db.DB).ListNotificationChannelsByUser(context.Background(), uid)
+	if err != nil || len(rows) == 0 {
+		return
+	}
+	for _, ch := range rows {
+		_ = deliverPush(context.Background(), ch, kind, title, body)
+	}
+}

app/backend/internal/api/notification_channels_test.go

@@ -0,0 +1,80 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"containr/internal/database/sqlcdb"
+)
+
+func TestDeliverPushNtfy(t *testing.T) {
+	var gotAuth, gotTitle, gotTags, gotBody string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		gotTitle = r.Header.Get("Title")
+		gotTags = r.Header.Get("Tags")
+		b, _ := io.ReadAll(r.Body)
+		gotBody = string(b)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	ch := sqlcdb.NotificationChannel{
+		Kind:     "ntfy",
+		Endpoint: srv.URL + "/alerts",
+		Token:    sql.NullString{String: "tk_abc", Valid: true},
+	}
+	if err := deliverPush(context.Background(), ch, "deployment", "Deploy done", "svc is live"); err != nil {
+		t.Fatalf("deliverPush: %v", err)
+	}
+	if gotAuth != "Bearer tk_abc" {
+		t.Fatalf("auth header = %q", gotAuth)
+	}
+	if gotTitle != "Deploy done" || gotTags != "containr,deployment" || gotBody != "svc is live" {
+		t.Fatalf("title=%q tags=%q body=%q", gotTitle, gotTags, gotBody)
+	}
+}
+
+func TestDeliverPushGotify(t *testing.T) {
+	var gotPath, gotToken string
+	var payload map[string]interface{}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotToken = r.URL.Query().Get("token")
+		_ = json.NewDecoder(r.Body).Decode(&payload)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	ch := sqlcdb.NotificationChannel{
+		Kind:     "gotify",
+		Endpoint: srv.URL,
+		Token:    sql.NullString{String: "apptoken", Valid: true},
+	}
+	if err := deliverPush(context.Background(), ch, "backup", "Backup done", "db backup ok"); err != nil {
+		t.Fatalf("deliverPush: %v", err)
+	}
+	if gotPath != "/message" || gotToken != "apptoken" {
+		t.Fatalf("path=%q token=%q", gotPath, gotToken)
+	}
+	if payload["title"] != "Backup done" || payload["message"] != "db backup ok" {
+		t.Fatalf("payload = %v", payload)
+	}
+}
+
+func TestDeliverPushFailure(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	ch := sqlcdb.NotificationChannel{Kind: "ntfy", Endpoint: srv.URL}
+	if err := deliverPush(context.Background(), ch, "k", "t", "b"); err == nil {
+		t.Fatal("expected error on 500")
+	}
+}

app/backend/internal/api/notification_producers.go

@@ -0,0 +1,235 @@
+package api
+
+// Notification producers — the emitters behind `insertUserNotification`.
+// Deployment success/failure lives in deployments.go; this file covers
+// the remaining producers from the roadmap: admin fan-out helper, the
+// agent offline/online sweep, and the upgrade-available check.
+
+import (
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// Version is stamped at image build time via -ldflags "-X
+// containr/internal/api.Version=…". "dev" disables the upgrade check.
+var Version = "dev"
+
+// notifyAdmins inserts a notification for every admin user. Best-effort.
+func notifyAdmins(db *database.DB, kind, title, body, resourceType, resourceID string) {
+	if db == nil {
+		return
+	}
+	adminIDs, err := sqlcdb.New(db.DB).ListAdminUserIDs(context.Background())
+	if err != nil {
+		log.Printf("containr: notify admins lookup failed: %v", err)
+		return
+	}
+	for _, id := range adminIDs {
+		{
+			insertUserNotification(db, id.String(), kind, title, body, resourceType, resourceID)
+		}
+	}
+}
+
+// StartAgentHealthSweep marks agents offline when their heartbeat goes
+// stale (and back online when it resumes), notifying admins on each
+// transition. Heartbeats keep the row fresh via UpdateAgentHeartbeat.
+func StartAgentHealthSweep(ctx context.Context, db *database.DB) {
+	const staleAfter = 3 * time.Minute
+	go func() {
+		ticker := time.NewTicker(time.Minute)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				reconcileAgentHealth(db, staleAfter)
+			}
+		}
+	}()
+}
+
+type agentHealthRow struct {
+	id        string
+	name      string
+	status    string
+	stale     bool
+	autoPrune bool
+}
+
+func reconcileAgentHealth(db *database.DB, staleAfter time.Duration) {
+	cutoff := time.Now().Add(-staleAfter)
+	var agents []agentHealthRow
+	q := sqlcdb.New(db.DB)
+	agentRows, err := q.ListAgentHealthRows(context.Background(), sql.NullTime{Time: cutoff, Valid: true})
+	if err != nil {
+		log.Printf("containr: agent health sweep: %v", err)
+		return
+	}
+	for _, r := range agentRows {
+		agents = append(agents, agentHealthRow{
+			id: r.ID, name: r.Name, status: r.Status, stale: r.Stale, autoPrune: r.AutoPrune,
+		})
+	}
+
+	for _, a := range agents {
+		switch {
+		case a.stale && a.status != "offline":
+			if err := q.SetAgentStatus(context.Background(), sqlcdb.SetAgentStatusParams{
+				Status: sql.NullString{String: "offline", Valid: true}, ID: a.id,
+			}); err != nil {
+				continue
+			}
+			notifyAdmins(db, "agent", "Node agent offline",
+				fmt.Sprintf("Agent %s missed its heartbeat for over %s.", a.name, staleAfter), "agent", a.id)
+		case !a.stale && a.status == "offline":
+			if err := q.SetAgentStatus(context.Background(), sqlcdb.SetAgentStatusParams{
+				Status: sql.NullString{String: "online", Valid: true}, ID: a.id,
+			}); err != nil {
+				continue
+			}
+			notifyAdmins(db, "agent", "Node agent back online",
+				fmt.Sprintf("Agent %s resumed heartbeating.", a.name), "agent", a.id)
+		}
+	}
+
+	scheduleAutoPrune(db, agents)
+}
+
+// scheduleAutoPrune enqueues a `prune` command once per day for agents
+// with auto_prune enabled. Disk pressure is the most common small-VPS
+// failure — this is the dflow setServerAutoCleanup analog.
+func scheduleAutoPrune(db *database.DB, agents []agentHealthRow) {
+	q := sqlcdb.New(db.DB)
+	for _, a := range agents {
+		if !a.autoPrune || a.stale {
+			continue
+		}
+		last, err := q.GetLastAgentCommandByType(context.Background(),
+			sqlcdb.GetLastAgentCommandByTypeParams{NodeAgentID: a.id, Type: "prune"})
+		if err == nil && last.CreatedAt.Valid && time.Since(last.CreatedAt.Time) < 24*time.Hour {
+			continue
+		}
+		if _, err := q.CreateCommand(context.Background(), sqlcdb.CreateCommandParams{
+			ID:          uuid.New().String(),
+			Type:        "prune",
+			NodeAgentID: a.id,
+		}); err != nil {
+			log.Printf("containr: auto-prune enqueue failed for agent %s: %v", a.id, err)
+		}
+	}
+}
+
+// StartUpgradeCheck polls GitHub for the latest release once a day and
+// notifies admins when it is newer than the running version. The last
+// notified tag is persisted in app_settings so restarts don't re-fire.
+func StartUpgradeCheck(ctx context.Context, db *database.DB, currentVersion string) {
+	if currentVersion == "" || currentVersion == "dev" {
+		return
+	}
+	go func() {
+		checkForUpgrade(db, currentVersion)
+		ticker := time.NewTicker(24 * time.Hour)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				checkForUpgrade(db, currentVersion)
+			}
+		}
+	}()
+}
+
+func checkForUpgrade(db *database.DB, currentVersion string) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+		"https://api.github.com/repos/Dvorinka/Containr/releases/latest", nil)
+	if err != nil {
+		return
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("User-Agent", "containr-upgrade-check")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return
+	}
+	var release struct {
+		TagName string `json:"tag_name"`
+		HTMLURL string `json:"html_url"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&release); err != nil || release.TagName == "" {
+		return
+	}
+	if !semverNewer(release.TagName, currentVersion) {
+		return
+	}
+
+	lastNotified, _ := sqlcdb.New(db.DB).GetAppSetting(context.Background(), "upgrade_notified_tag")
+	if lastNotified == release.TagName {
+		return
+	}
+	notifyAdmins(db, "upgrade", "Containr update available",
+		fmt.Sprintf("Release %s is available (running %s). %s", release.TagName, currentVersion, release.HTMLURL),
+		"release", release.TagName)
+	_ = sqlcdb.New(db.DB).UpsertAppSettingValue(context.Background(), sqlcdb.UpsertAppSettingValueParams{
+		Key:   "upgrade_notified_tag",
+		Value: release.TagName,
+	})
+}
+
+// semverNewer reports whether candidate is a higher semver than current.
+// Non-semver input (e.g. "dev", commit hashes) compares false.
+func semverNewer(candidate, current string) bool {
+	parse := func(s string) ([]int, bool) {
+		s = strings.TrimPrefix(strings.TrimSpace(s), "v")
+		// Prerelease/build metadata sorts after the same base version
+		// upstream — for "is a newer release available" purposes the base
+		// comparison is what matters.
+		if j := strings.IndexAny(s, "-+"); j >= 0 {
+			s = s[:j]
+		}
+		parts := strings.Split(s, ".")
+		if len(parts) == 0 || len(parts) > 3 {
+			return nil, false
+		}
+		out := make([]int, 3)
+		for i, p := range parts {
+			n, err := strconv.Atoi(p)
+			if err != nil {
+				return nil, false
+			}
+			out[i] = n
+		}
+		return out, true
+	}
+	c, ok1 := parse(candidate)
+	cur, ok2 := parse(current)
+	if !ok1 || !ok2 {
+		return false
+	}
+	for i := 0; i < 3; i++ {
+		if c[i] != cur[i] {
+			return c[i] > cur[i]
+		}
+	}
+	return false
+}

app/backend/internal/api/notification_producers_test.go

@@ -0,0 +1,26 @@
+package api
+
+import "testing"
+
+func TestSemverNewer(t *testing.T) {
+	cases := []struct {
+		candidate, current string
+		want               bool
+	}{
+		{"v1.2.3", "v1.2.2", true},
+		{"1.3.0", "v1.2.9", true},
+		{"v2.0.0", "v1.9.9", true},
+		{"v1.2.3", "v1.2.3", false},
+		{"v1.2.0", "v1.2.3", false},
+		{"v1.10.0", "v1.9.9", true}, // numeric, not lexicographic
+		{"dev", "v1.0.0", false},
+		{"v1.0.0", "main", false},
+		{"v1.2.3-rc.1", "v1.2.2", true}, // prerelease suffix tolerated
+		{"", "v1.0.0", false},
+	}
+	for _, tc := range cases {
+		if got := semverNewer(tc.candidate, tc.current); got != tc.want {
+			t.Errorf("semverNewer(%q, %q) = %v, want %v", tc.candidate, tc.current, got, tc.want)
+		}
+	}
+}

app/backend/internal/api/notifications.go

@@ -41,6 +41,7 @@ func insertUserNotification(db *database.DB, userID, kind, title, body, resource
 		ResourceID:   sql.NullString{String: resourceID, Valid: resourceID != ""},
 		CreatedAt:    sql.NullTime{Time: time.Now(), Valid: true},
 	})
+	go fanoutUserPush(db, userID, kind, title, body)
 }
 
 func mapNotification(row sqlcdb.Notification) NotificationItem {

app/backend/internal/api/operations.go

@@ -1,13 +1,16 @@
 package api
 
 import (
+	"context"
 	"net/http"
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployqueue"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 )
 
 // GET /operations — a single cross-cutting view of platform work: active
@@ -55,91 +58,59 @@ func handleGetOperations(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 	isAdmin := contextIsAdmin(c)
 
-	// Same visibility rule as the deployment list endpoint.
-	visibility := `p.is_approved OR p.owner_id = $1 OR $2::bool
-	    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)`
+	userUUID, _ := uuid.Parse(userID)
+	q := sqlcdb.New(db.DB)
+	visibility := sqlcdb.ListActiveOperationDeploymentsParams{OwnerID: userUUID, Column2: isAdmin}
 
 	active := []operationDeployment{}
-	rows, err := db.Query(
-		`SELECT d.id, d.service_id, s.name, p.name, d.status,
-		        COALESCE(d.image_name, ''), d.error, d.started_at, d.completed_at, d.created_at
-		 FROM deployments d
-		 JOIN services s ON s.id = d.service_id
-		 JOIN projects p ON p.id = s.project_id
-		 WHERE d.status IN ('queued','pending','building','deploying','rolling_back')
-		   AND (`+visibility+`)
-		 ORDER BY d.created_at ASC`, userID, isAdmin)
-	if err == nil {
-		defer rows.Close()
-		for rows.Next() {
-			var d operationDeployment
-			var sid string
-			_ = rows.Scan(&d.ID, &sid, &d.ServiceName, &d.ProjectName, &d.Status, &d.Image, &d.Error, &d.StartedAt, &d.CompletedAt, &d.CreatedAt)
-			d.ServiceID = sid
-			active = append(active, d)
+	if rows, err := q.ListActiveOperationDeployments(context.Background(), visibility); err == nil {
+		for _, r := range rows {
+			active = append(active, operationDeployment{
+				ID: r.ID.String(), ServiceID: r.ServiceID.String(), ServiceName: r.ServiceName,
+				ProjectName: r.ProjectName, Status: r.Status.String, Image: r.Image,
+				Error: strPtrNS(r.Error), StartedAt: timePtrNT(r.StartedAt),
+				CompletedAt: timePtrNT(r.CompletedAt), CreatedAt: r.CreatedAt.Time,
+			})
 		}
 	}
 
 	recentFailed := []operationDeployment{}
-	rows2, err2 := db.Query(
-		`SELECT d.id, d.service_id, s.name, p.name, d.status,
-		        COALESCE(d.image_name, ''), d.error, d.started_at, d.completed_at, d.created_at
-		 FROM deployments d
-		 JOIN services s ON s.id = d.service_id
-		 JOIN projects p ON p.id = s.project_id
-		 WHERE d.status IN ('failed','cancelled','rolled_back')
-		   AND d.updated_at > NOW() - INTERVAL '24 hours'
-		   AND (`+visibility+`)
-		 ORDER BY d.updated_at DESC
-		 LIMIT 20`, userID, isAdmin)
-	if err2 == nil {
-		defer rows2.Close()
-		for rows2.Next() {
-			var d operationDeployment
-			var sid string
-			_ = rows2.Scan(&d.ID, &sid, &d.ServiceName, &d.ProjectName, &d.Status, &d.Image, &d.Error, &d.StartedAt, &d.CompletedAt, &d.CreatedAt)
-			d.ServiceID = sid
-			recentFailed = append(recentFailed, d)
+	if rows, err := q.ListRecentFailedDeployments(context.Background(), sqlcdb.ListRecentFailedDeploymentsParams{
+		OwnerID: userUUID, Column2: isAdmin,
+	}); err == nil {
+		for _, r := range rows {
+			recentFailed = append(recentFailed, operationDeployment{
+				ID: r.ID.String(), ServiceID: r.ServiceID.String(), ServiceName: r.ServiceName,
+				ProjectName: r.ProjectName, Status: r.Status.String, Image: r.Image,
+				Error: strPtrNS(r.Error), StartedAt: timePtrNT(r.StartedAt),
+				CompletedAt: timePtrNT(r.CompletedAt), CreatedAt: r.CreatedAt.Time,
+			})
 		}
 	}
 
 	cronRuns := []operationCronRun{}
-	rows3, err3 := db.Query(
-		`SELECT e.id, j.name, j.schedule, e.status, e.started_at, e.finished_at, e.error
-		 FROM cron_executions e
-		 JOIN cron_jobs j ON j.id = e.cron_job_id
-		 JOIN projects p ON p.id = j.project_id
-		 WHERE e.started_at > NOW() - INTERVAL '24 hours'
-		   AND (`+visibility+`)
-		 ORDER BY e.started_at DESC
-		 LIMIT 30`, userID, isAdmin)
-	if err3 == nil {
-		defer rows3.Close()
-		for rows3.Next() {
-			var r operationCronRun
-			_ = rows3.Scan(&r.ID, &r.JobName, &r.Schedule, &r.Status, &r.StartedAt, &r.FinishedAt, &r.Error)
-			cronRuns = append(cronRuns, r)
+	if rows, err := q.ListRecentCronRuns(context.Background(), sqlcdb.ListRecentCronRunsParams{
+		OwnerID: userUUID, Column2: isAdmin,
+	}); err == nil {
+		for _, r := range rows {
+			cronRuns = append(cronRuns, operationCronRun{
+				ID: r.ID.String(), JobName: r.JobName, Schedule: r.Schedule, Status: r.Status.String,
+				StartedAt: r.StartedAt, FinishedAt: timePtrNT(r.FinishedAt), Error: strPtrNS(r.Error),
+			})
 		}
 	}
 
 	backups := []operationBackup{}
-	rows4, err4 := db.Query(
-		`SELECT b.id, b.database_id, ds.name, b.status, b.size, b.created_at, b.completed_at
-		 FROM database_backups b
-		 JOIN database_services ds ON ds.id = b.database_id
-		 WHERE b.created_at > NOW() - INTERVAL '24 hours'
-		   AND (ds.user_id = $1 OR $2::bool)
-		 ORDER BY b.created_at DESC
-		 LIMIT 20`, userID, isAdmin)
-	if err4 == nil {
-		defer rows4.Close()
-		for rows4.Next() {
-			var b operationBackup
-			_ = rows4.Scan(&b.ID, &b.DatabaseID, &b.DBName, &b.Status, &b.Size, &b.CreatedAt, &b.Completed)
-			backups = append(backups, b)
+	if rows, err := q.ListRecentOperationBackups(context.Background(), sqlcdb.ListRecentOperationBackupsParams{
+		UserID: userID, Column2: isAdmin,
+	}); err == nil {
+		for _, r := range rows {
+			backups = append(backups, operationBackup{
+				ID: r.ID, DatabaseID: r.DatabaseID, DBName: r.DbName, Status: r.Status,
+				Size: r.Size, CreatedAt: r.CreatedAt.Time, Completed: timePtrNT(r.CompletedAt),
+			})
 		}
 	}
-
 	var queue []deployqueue.ServiceQueueState
 	if queueValue, exists := c.Get("deploy_queue"); exists && queueValue != nil {
 		queue = queueValue.(*deployqueue.Queue).Snapshot()

app/backend/internal/api/preview_environments.go

@@ -2,7 +2,12 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"containr/internal/deployment"
+	"containr/internal/deployqueue"
+	"context"
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"strings"
@@ -26,11 +31,77 @@ type PreviewEnvironment struct {
 	CreatedAt   time.Time  `json:"created_at" db:"created_at"`
 	UpdatedAt   time.Time  `json:"updated_at" db:"updated_at"`
 
+	// PreviewServiceID is the cloned service this preview actually deploys;
+	// its status is the source of truth while the preview is active.
+	PreviewServiceID *uuid.UUID `json:"preview_service_id,omitempty" db:"preview_service_id"`
+
 	// Related data
 	Service      *Service   `json:"service,omitempty"`
 	DeploymentID *uuid.UUID `json:"deployment_id,omitempty"`
 }
 
+// previewRowShape is the common column set the generated preview rows
+// carry — ListPreviewEnvironmentsForProjectRow and GetPreviewEnvironmentRow
+// share it.
+type previewRowShape struct {
+	ID               uuid.UUID
+	ProjectID        uuid.UUID
+	ServiceID        uuid.UUID
+	PreviewServiceID uuid.NullUUID
+	BranchName       string
+	PrNumber         sql.NullInt32
+	Environment      string
+	Status           string
+	Url              sql.NullString
+	ExpiresAt        time.Time
+	CreatedAt        sql.NullTime
+	UpdatedAt        sql.NullTime
+	SvcID            uuid.NullUUID
+	ServiceName      sql.NullString
+	ServiceType      sql.NullString
+}
+
+func previewFromRow(r previewRowShape) PreviewEnvironment {
+	env := PreviewEnvironment{
+		ID:          r.ID,
+		ProjectID:   r.ProjectID,
+		ServiceID:   r.ServiceID,
+		BranchName:  r.BranchName,
+		Environment: r.Environment,
+		Status:      r.Status,
+		URL:         r.Url.String,
+		CreatedAt:   r.CreatedAt.Time,
+		UpdatedAt:   r.UpdatedAt.Time,
+	}
+	if r.PreviewServiceID.Valid {
+		id := r.PreviewServiceID.UUID
+		env.PreviewServiceID = &id
+	}
+	if r.PrNumber.Valid {
+		n := int(r.PrNumber.Int32)
+		env.PRNumber = &n
+	}
+	if !r.ExpiresAt.IsZero() {
+		t := r.ExpiresAt
+		env.ExpiresAt = &t
+	}
+	if r.SvcID.Valid {
+		env.Service = &Service{
+			ID:   r.SvcID.UUID,
+			Name: r.ServiceName.String,
+			Type: r.ServiceType.String,
+		}
+	}
+	return env
+}
+
+func prNumberSQL(n *int) sql.NullInt32 {
+	if n == nil {
+		return sql.NullInt32{}
+	}
+	return sql.NullInt32{Int32: int32(*n), Valid: true}
+}
+
 // CreatePreviewEnvironmentRequest represents a request to create a preview environment
 type CreatePreviewEnvironmentRequest struct {
 	ProjectID  uuid.UUID `json:"project_id"`
@@ -77,51 +148,21 @@ func handleGetPreviewEnvironments(c *gin.Context) {
 	}
 
 	// Get preview environments for the project with service info
-	rows, err := db.(*database.DB).Query(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
-				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
-				s.id as service_id, s.name as service_name, s.type as service_type
-			FROM preview_environments pe
-			LEFT JOIN services s ON pe.service_id = s.id
-			WHERE pe.project_id = $1 
-			ORDER BY pe.created_at DESC`,
-		projectID,
-	)
+	rows, err := sqlcdb.New(db.(*database.DB).DB).ListPreviewEnvironmentsForProject(c.Request.Context(), projectID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve preview environments"})
 		return
 	}
-	defer rows.Close()
 
-	var environments []PreviewEnvironment
-	for rows.Next() {
-		var env PreviewEnvironment
-		var serviceID sql.NullString
-		var serviceName sql.NullString
-		var serviceType sql.NullString
-
-		err := rows.Scan(
-			&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
-			&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
-			&serviceID, &serviceName, &serviceType,
-		)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan preview environment"})
-			return
-		}
-
-		if serviceID.Valid {
-			parsedServiceID, parseErr := uuid.Parse(serviceID.String)
-			if parseErr == nil {
-				env.Service = &Service{
-					ID:   parsedServiceID,
-					Name: serviceName.String,
-					Type: serviceType.String,
-				}
-			}
-		}
-
-		environments = append(environments, env)
+	environments := make([]PreviewEnvironment, 0, len(rows))
+	for _, r := range rows {
+		environments = append(environments, previewFromRow(previewRowShape{
+			ID: r.ID, ProjectID: r.ProjectID, ServiceID: r.ServiceID,
+			PreviewServiceID: r.PreviewServiceID, BranchName: r.BranchName,
+			PrNumber: r.PrNumber, Environment: r.Environment, Status: r.Status,
+			Url: r.Url, ExpiresAt: r.ExpiresAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+			SvcID: r.SvcID, ServiceName: r.ServiceName, ServiceType: r.ServiceType,
+		}))
 	}
 
 	c.JSON(http.StatusOK, gin.H{"preview_environments": environments})
@@ -162,48 +203,37 @@ func handleCreatePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
-	// Check if project exists and user has access
-	var project Project
-	err = db.(*database.DB).QueryRow(
-		"SELECT id, name, owner_id FROM projects WHERE id = $1",
-		req.ProjectID,
-	).Scan(&project.ID, &project.Name, &project.OwnerID)
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
 
+	// Check if project exists and user has access
+	project, err := q.GetProjectBrief(ctx, req.ProjectID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
 		return
 	}
 
 	// Check if user owns the project
-	if project.OwnerID != userID.(string) && !contextIsAdmin(c) {
+	if project.OwnerID.String() != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
 
 	// Check if service exists and belongs to the project
-	var service Service
-	err = db.(*database.DB).QueryRow(
-		"SELECT id, name, COALESCE(type, service_type, '') FROM services WHERE id = $1 AND project_id = $2",
-		req.ServiceID, req.ProjectID,
-	).Scan(&service.ID, &service.Name, &service.Type)
-
+	service, err := q.GetServiceTypeBrief(ctx, sqlcdb.GetServiceTypeBriefParams{
+		ID: req.ServiceID, ProjectID: req.ProjectID})
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found or doesn't belong to this project"})
 		return
 	}
 
 	// Check if preview environment already exists for this branch and service
-	var count int
-	err = db.(*database.DB).QueryRow(
-		"SELECT COUNT(*) FROM preview_environments WHERE service_id = $1 AND branch_name = $2 AND status NOT IN ('expired', 'stopped')",
-		req.ServiceID, req.BranchName,
-	).Scan(&count)
-
+	count, err := q.CountActivePreviewsForBranch(ctx, sqlcdb.CountActivePreviewsForBranchParams{
+		ServiceID: req.ServiceID, BranchName: req.BranchName})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check existing preview environment"})
 		return
 	}
-
 	if count > 0 {
 		c.JSON(http.StatusConflict, gin.H{"error": "Preview environment already exists for this branch and service"})
 		return
@@ -215,87 +245,111 @@ func handleCreatePreviewEnvironment(c *gin.Context) {
 		ttlHours = 24 // Default 24 hours
 	}
 
-	// Create preview environment
+	// A preview is a real service: clone the source, pin it to the
+	// requested branch, swap its domains for a preview hostname, and run a
+	// normal deployment through the queue. Expiry sweeps the clone away.
+	envName := generatePreviewEnvironmentName(req.BranchName)
+	cloneName := previewServiceName(service.Name, req.BranchName)
+	cloneID, err := cloneServiceRow(db.(*database.DB), req.ServiceID, req.ProjectID, cloneName, "")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clone service for preview"})
+		return
+	}
+
+	// The clone's branch override is what makes it a preview — everything
+	// else (env vars, volumes, builder, resources) stays identical.
+	if err := q.UpdateServicePreviewBranch(ctx, sqlcdb.UpdateServicePreviewBranchParams{
+		GitBranch: sql.NullString{String: req.BranchName, Valid: true}, ID: cloneID}); err != nil {
+		_ = q.DeleteServiceByID(ctx, cloneID)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to configure preview service"})
+		return
+	}
+	// Cloned service_domains would collide with the parent's Traefik
+	// router — previews get their own hostname or none.
+	if err := q.DeleteAllServiceDomains(ctx, cloneID); err != nil {
+		_ = q.DeleteServiceByID(ctx, cloneID)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to configure preview domains"})
+		return
+	}
+	previewHost := resolvePreviewHost(db.(*database.DB), cloneID, envName)
+	if previewHost != "" {
+		_ = q.CreatePreviewDomain(ctx, sqlcdb.CreatePreviewDomainParams{
+			ServiceID: cloneID, Domain: previewHost})
+	}
+
+	expiresAt := time.Now().Add(time.Duration(ttlHours) * time.Hour)
 	env := PreviewEnvironment{
 		ID:          uuid.New(),
 		ProjectID:   req.ProjectID,
 		ServiceID:   req.ServiceID,
 		BranchName:  req.BranchName,
 		PRNumber:    req.PRNumber,
-		Environment: generatePreviewEnvironmentName(req.BranchName),
+		Environment: envName,
 		Status:      "building",
-		ExpiresAt:   &[]time.Time{time.Now().Add(time.Duration(ttlHours) * time.Hour)}[0],
+		ExpiresAt:   &expiresAt,
 		CreatedAt:   time.Now(),
 		UpdatedAt:   time.Now(),
 	}
+	if previewHost != "" {
+		env.URL = "https://" + previewHost
+	}
 
-	// Insert preview environment into database
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO preview_environments 
-			(id, project_id, service_id, branch_name, pr_number, environment, 
-			 status, url, expires_at, created_at, updated_at)
-			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`,
-		env.ID, env.ProjectID, env.ServiceID, env.BranchName, env.PRNumber,
-		env.Environment, env.Status, env.URL, env.ExpiresAt, env.CreatedAt, env.UpdatedAt,
-	)
-
+	err = q.CreatePreviewEnvironment(ctx, sqlcdb.CreatePreviewEnvironmentParams{
+		ID:               env.ID,
+		ProjectID:        env.ProjectID,
+		ServiceID:        env.ServiceID,
+		PreviewServiceID: uuid.NullUUID{UUID: cloneID, Valid: true},
+		BranchName:       env.BranchName,
+		PrNumber:         prNumberSQL(env.PRNumber),
+		Environment:      env.Environment,
+		Status:           env.Status,
+		Url:              sql.NullString{String: env.URL, Valid: env.URL != ""},
+		ExpiresAt:        *env.ExpiresAt,
+		CreatedAt:        sql.NullTime{Time: env.CreatedAt, Valid: true},
+		UpdatedAt:        sql.NullTime{Time: env.UpdatedAt, Valid: true},
+	})
 	if err != nil {
+		_ = q.DeleteServiceByID(ctx, cloneID)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create preview environment"})
 		return
 	}
 
 	deploymentID := uuid.New()
-	sanitizedBranch := strings.ReplaceAll(req.BranchName, "/", "-")
-	sanitizedBranch = strings.ReplaceAll(sanitizedBranch, "_", "-")
-	version := fmt.Sprintf("preview-%s-%d", sanitizedBranch, time.Now().Unix())
-	startedAt := time.Now().UTC()
-	completedAt := startedAt
-
-	_, deployErr := db.(*database.DB).Exec(
-		`INSERT INTO deployments
-			(id, service_id, version, commit_hash, status, started_at, completed_at, deployment_log, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW(), NOW())`,
-		deploymentID,
-		req.ServiceID,
-		version,
-		req.BranchName,
-		"running",
-		startedAt,
-		completedAt,
-		fmt.Sprintf("Preview environment %s activated for branch %s", env.Environment, req.BranchName),
-	)
-	if deployErr != nil {
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE preview_environments
-			 SET status = 'failed', updated_at = NOW()
-			 WHERE id = $1`,
-			env.ID,
-		)
+	err = q.InsertPendingDeployment(ctx, sqlcdb.InsertPendingDeploymentParams{
+		ID:         deploymentID,
+		ServiceID:  cloneID,
+		Version:    "preview-" + env.Environment,
+		CommitHash: sql.NullString{String: req.BranchName, Valid: true},
+	})
+	if err != nil {
+		_ = q.DeletePreviewEnvironment(ctx, env.ID)
+		_ = q.DeleteServiceByID(ctx, cloneID)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to provision preview deployment"})
 		return
 	}
-
-	if strings.TrimSpace(env.URL) == "" {
-		env.URL = fmt.Sprintf("https://%s.preview.containr.local", env.Environment)
-	}
-	env.Status = "running"
-	env.UpdatedAt = time.Now().UTC()
 	env.DeploymentID = &deploymentID
 
-	_, err = db.(*database.DB).Exec(
-		`UPDATE preview_environments
-		 SET status = $1, url = $2, updated_at = $3
-		 WHERE id = $4`,
-		env.Status,
-		env.URL,
-		env.UpdatedAt,
-		env.ID,
-	)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to finalize preview environment"})
-		return
+	if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+		if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+			cloneService, loadErr := loadServiceForDeploy(db.(*database.DB), cloneID)
+			if loadErr == nil {
+				engineInstance := engine
+				d := DeploymentModel{ID: deploymentID, ServiceID: cloneID, Status: "pending", CreatedAt: time.Now(), UpdatedAt: time.Now()}
+				getDeployQueue(c).Enqueue(cloneID, deployqueue.Job{
+					DeploymentID: deploymentID,
+					Run: func(jctx context.Context) {
+						runDeploymentAndSync(jctx, db.(*database.DB), engineInstance, &d, cloneService, CreateDeploymentRequest{Branch: req.BranchName, Trigger: "preview"}, userID.(string))
+					},
+				})
+			}
+		}
 	}
 
+	LogAuditWithRequest(c, "service", req.ServiceID.String(), "preview.create", map[string]interface{}{
+		"preview_environment_id": env.ID.String(),
+		"preview_service_id":     cloneID.String(),
+		"branch":                 req.BranchName,
+	})
 	c.JSON(http.StatusCreated, gin.H{"preview_environment": env})
 }
 
@@ -316,43 +370,20 @@ func handleGetPreviewEnvironment(c *gin.Context) {
 
 	// Public when the parent project is approved; otherwise owner/member/admin.
 	userID := optionalUserUUID(c)
-	var env PreviewEnvironment
-	var serviceID sql.NullString
-	var serviceName sql.NullString
-	var serviceType sql.NullString
-	err = db.(*database.DB).QueryRow(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number,
-				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
-				s.id as service_id, s.name as service_name, s.type as service_type
-			FROM preview_environments pe
-			LEFT JOIN services s ON pe.service_id = s.id
-			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND (p.is_approved OR p.owner_id = $2 OR $3::bool
-				OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $2))`,
-		envID, userID, contextIsAdmin(c),
-	).Scan(
-		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
-		&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
-		&serviceID, &serviceName, &serviceType,
-	)
-
+	r, err := sqlcdb.New(db.(*database.DB).DB).GetPreviewEnvironment(
+		c.Request.Context(), sqlcdb.GetPreviewEnvironmentParams{
+			ID: envID, OwnerID: userID, Column3: contextIsAdmin(c)})
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
 		return
 	}
-
-	// Populate service info if available
-	if serviceID.Valid {
-		parsedServiceID, parseErr := uuid.Parse(serviceID.String)
-		if parseErr == nil {
-			env.Service = &Service{
-				ID:   parsedServiceID,
-				Name: serviceName.String,
-				Type: serviceType.String,
-			}
-		}
-	}
-
+	env := previewFromRow(previewRowShape{
+		ID: r.ID, ProjectID: r.ProjectID, ServiceID: r.ServiceID,
+		PreviewServiceID: r.PreviewServiceID, BranchName: r.BranchName,
+		PrNumber: r.PrNumber, Environment: r.Environment, Status: r.Status,
+		Url: r.Url, ExpiresAt: r.ExpiresAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+		SvcID: r.SvcID, ServiceName: r.ServiceName, ServiceType: r.ServiceType,
+	})
 	c.JSON(http.StatusOK, gin.H{"preview_environment": env})
 }
 
@@ -385,24 +416,21 @@ func handleUpdatePreviewEnvironment(c *gin.Context) {
 	}
 
 	// Check if preview environment exists and user has access
-	var existingEnv PreviewEnvironment
-	err = db.(*database.DB).QueryRow(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
-				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at
-			FROM preview_environments pe
-			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)`,
-		envID, userID, contextIsAdmin(c),
-	).Scan(
-		&existingEnv.ID, &existingEnv.ProjectID, &existingEnv.ServiceID, &existingEnv.BranchName,
-		&existingEnv.PRNumber, &existingEnv.Environment, &existingEnv.Status, &existingEnv.URL,
-		&existingEnv.ExpiresAt, &existingEnv.CreatedAt, &existingEnv.UpdatedAt,
-	)
-
+	uid, _ := uuid.Parse(fmt.Sprint(userID))
+	q := sqlcdb.New(db.(*database.DB).DB)
+	r, err := q.GetPreviewEnvironmentForWrite(
+		c.Request.Context(), sqlcdb.GetPreviewEnvironmentForWriteParams{
+			ID: envID, OwnerID: uid, Column3: contextIsAdmin(c)})
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
 		return
 	}
+	existingEnv := previewFromRow(previewRowShape{
+		ID: r.ID, ProjectID: r.ProjectID, ServiceID: r.ServiceID,
+		BranchName: r.BranchName, PrNumber: r.PrNumber, Environment: r.Environment,
+		Status: r.Status, Url: r.Url, ExpiresAt: r.ExpiresAt,
+		CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+	})
 
 	// Update fields if provided
 	if req.Status != "" {
@@ -422,12 +450,17 @@ func handleUpdatePreviewEnvironment(c *gin.Context) {
 	existingEnv.UpdatedAt = time.Now()
 
 	// Update preview environment in database
-	_, err = db.(*database.DB).Exec(
-		`UPDATE preview_environments 
-			SET status = $1, url = $2, expires_at = $3, updated_at = $4
-			WHERE id = $5`,
-		existingEnv.Status, existingEnv.URL, existingEnv.ExpiresAt, existingEnv.UpdatedAt, existingEnv.ID,
-	)
+	expiresAt := time.Time{}
+	if existingEnv.ExpiresAt != nil {
+		expiresAt = *existingEnv.ExpiresAt
+	}
+	err = q.UpdatePreviewEnvironment(c.Request.Context(), sqlcdb.UpdatePreviewEnvironmentParams{
+		Status:    existingEnv.Status,
+		Url:       sql.NullString{String: existingEnv.URL, Valid: existingEnv.URL != ""},
+		ExpiresAt: expiresAt,
+		UpdatedAt: sql.NullTime{Time: existingEnv.UpdatedAt, Valid: true},
+		ID:        existingEnv.ID,
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update preview environment"})
@@ -459,49 +492,34 @@ func handleDeletePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
-	// Check if preview environment exists and user has access
-	var projectOwnerID string
-	err = db.(*database.DB).QueryRow(
-		`SELECT p.owner_id 
-			FROM preview_environments pe
-			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1`,
-		envID,
-	).Scan(&projectOwnerID)
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
 
+	// Check if preview environment exists and user has access
+	projectOwnerID, err := q.GetPreviewEnvironmentOwner(ctx, envID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
 		return
 	}
 
 	// Check if user owns the project
-	if projectOwnerID != userID.(string) && !contextIsAdmin(c) {
+	if projectOwnerID.String() != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
 
-	cleanupID := uuid.New()
-	cleanupStartedAt := time.Now().UTC()
-	cleanupCompletedAt := cleanupStartedAt
-
-	_, _ = db.(*database.DB).Exec(
-		`INSERT INTO deployments
-			(id, service_id, version, status, started_at, completed_at, deployment_log, created_at, updated_at)
-		 VALUES ($1, (SELECT service_id FROM preview_environments WHERE id = $2), $3, $4, $5, $6, $7, NOW(), NOW())`,
-		cleanupID,
-		envID,
-		"preview-cleanup",
-		"rolled_back",
-		cleanupStartedAt,
-		cleanupCompletedAt,
-		"Preview environment resources cleaned up",
-	)
+	// Tear down the clone's runtime and row — the preview is the clone.
+	if cloneID, err := q.GetPreviewServiceID(ctx, envID); err == nil && cloneID.Valid {
+		if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+			if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+				removeServiceRuntime(ctx, db.(*database.DB), engine, cloneID.UUID)
+			}
+		}
+		_ = q.DeleteServiceByID(ctx, cloneID.UUID)
+	}
 
 	// Delete preview environment
-	_, err = db.(*database.DB).Exec(
-		"DELETE FROM preview_environments WHERE id = $1",
-		envID,
-	)
+	err = q.DeletePreviewEnvironment(ctx, envID)
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete preview environment"})
@@ -539,22 +557,30 @@ func handlePromotePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
-	// Get preview environment details
-	var env PreviewEnvironment
-	err = db.(*database.DB).QueryRow(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.environment, pe.status
-			FROM preview_environments pe
-			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)`,
-		envID, userID, contextIsAdmin(c),
-	).Scan(
-		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.Environment, &env.Status,
-	)
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
 
+	// Get preview environment details
+	uid, _ := uuid.Parse(fmt.Sprint(userID))
+	r, err := q.GetPreviewEnvironmentForPromote(
+		ctx, sqlcdb.GetPreviewEnvironmentForPromoteParams{
+			ID: envID, OwnerID: uid, Column3: contextIsAdmin(c)})
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
 		return
 	}
+	env := PreviewEnvironment{
+		ID:          r.ID,
+		ProjectID:   r.ProjectID,
+		ServiceID:   r.ServiceID,
+		BranchName:  r.BranchName,
+		Environment: r.Environment,
+		Status:      r.Status,
+	}
+	if r.PreviewServiceID.Valid {
+		id := r.PreviewServiceID.UUID
+		env.PreviewServiceID = &id
+	}
 
 	// Check if preview environment is in a state that can be promoted
 	if env.Status != "running" {
@@ -562,39 +588,51 @@ func handlePromotePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
+	// Promote is a real redeploy: the source service builds the preview's
+	// branch onto its own deployment track.
 	deploymentID := uuid.New()
 	promotionVersion := fmt.Sprintf("promote-%s-%d", strings.ReplaceAll(env.BranchName, "/", "-"), time.Now().Unix())
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO deployments (id, service_id, version, status, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, NOW(), NOW())`,
-		deploymentID, env.ServiceID, promotionVersion, "pending",
-	)
+	err = q.InsertPendingDeployment(ctx, sqlcdb.InsertPendingDeploymentParams{
+		ID:         deploymentID,
+		ServiceID:  env.ServiceID,
+		Version:    promotionVersion,
+		CommitHash: sql.NullString{String: env.BranchName, Valid: true},
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create promotion deployment"})
 		return
 	}
 
-	if _, err := db.(*database.DB).Exec(
-		`UPDATE services
-		 SET environment = $1, updated_at = NOW()
-		 WHERE id = $2`,
-		req.TargetEnvironment, env.ServiceID,
-	); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update service target environment"})
+	sourceService, loadErr := loadServiceForDeploy(db.(*database.DB), env.ServiceID)
+	if loadErr != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load promotion target service"})
 		return
 	}
-
-	previewStatus := "stopped"
-	if req.CreateBackup {
-		previewStatus = "expired"
+	if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+		if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+			engineInstance := engine
+			d := DeploymentModel{ID: deploymentID, ServiceID: env.ServiceID, Status: "pending", CreatedAt: time.Now(), UpdatedAt: time.Now()}
+			getDeployQueue(c).Enqueue(env.ServiceID, deployqueue.Job{
+				DeploymentID: deploymentID,
+				Run: func(jctx context.Context) {
+					runDeploymentAndSync(jctx, db.(*database.DB), engineInstance, &d, sourceService, CreateDeploymentRequest{Branch: env.BranchName, Trigger: "promote"}, userID.(string))
+				},
+			})
+		}
 	}
 
-	if _, err := db.(*database.DB).Exec(
-		`UPDATE preview_environments
-		 SET status = $1, updated_at = NOW()
-		 WHERE id = $2`,
-		previewStatus, env.ID,
-	); err != nil {
+	// Promotion retires the preview — the clone's containers and row go.
+	if env.PreviewServiceID != nil {
+		if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+			if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+				removeServiceRuntime(ctx, db.(*database.DB), engine, *env.PreviewServiceID)
+			}
+		}
+		_ = q.DeleteServiceByID(ctx, *env.PreviewServiceID)
+	}
+
+	if err := q.MarkPreviewEnvironmentStatus(ctx, sqlcdb.MarkPreviewEnvironmentStatusParams{
+		Status: "stopped", ID: env.ID}); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update preview environment status"})
 		return
 	}
@@ -608,7 +646,7 @@ func handlePromotePreviewEnvironment(c *gin.Context) {
 			"create_backup":          req.CreateBackup,
 			"deployment_id":          deploymentID,
 			"status":                 "queued",
-			"preview_status":         previewStatus,
+			"preview_status":         "stopped",
 		},
 	})
 }
@@ -637,44 +675,46 @@ func handleCleanupExpiredPreviewEnvironments(c *gin.Context) {
 		return
 	}
 
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+	uid, _ := uuid.Parse(fmt.Sprint(userID))
+
 	// Find expired preview environments for user's projects
-	rows, err := db.(*database.DB).Query(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.environment
-			FROM preview_environments pe
-			JOIN projects p ON pe.project_id = p.id
-			WHERE (p.owner_id = $1 OR $2::bool) AND pe.expires_at < NOW() AND pe.status != 'expired'`,
-		userID, contextIsAdmin(c),
-	)
+	rows, err := q.ListExpiredPreviewsForUser(ctx, sqlcdb.ListExpiredPreviewsForUserParams{
+		OwnerID: uid, Column2: contextIsAdmin(c)})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to find expired preview environments"})
 		return
 	}
-	defer rows.Close()
 
-	var expiredEnvs []PreviewEnvironment
-	for rows.Next() {
-		var env PreviewEnvironment
-		err := rows.Scan(
-			&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.Environment,
-		)
-		if err != nil {
-			continue
+	expiredEnvs := make([]PreviewEnvironment, 0, len(rows))
+	for _, r := range rows {
+		env := PreviewEnvironment{
+			ID: r.ID, ProjectID: r.ProjectID, ServiceID: r.ServiceID,
+			BranchName: r.BranchName, Environment: r.Environment,
+		}
+		if r.PreviewServiceID.Valid {
+			id := r.PreviewServiceID.UUID
+			env.PreviewServiceID = &id
 		}
 		expiredEnvs = append(expiredEnvs, env)
 	}
 
-	// Mark expired environments as expired and trigger cleanup
+	// Mark expired environments as expired and tear down their clones
 	cleanupCount := 0
 	for _, env := range expiredEnvs {
-		// Update status to expired
-		_, err := db.(*database.DB).Exec(
-			"UPDATE preview_environments SET status = 'expired', updated_at = NOW() WHERE id = $1",
-			env.ID,
-		)
-		if err != nil {
+		if err := q.MarkPreviewEnvironmentStatus(ctx, sqlcdb.MarkPreviewEnvironmentStatusParams{
+			Status: "expired", ID: env.ID}); err != nil {
 			continue
 		}
-
+		if env.PreviewServiceID != nil {
+			if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+				if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+					removeServiceRuntime(ctx, db.(*database.DB), engine, *env.PreviewServiceID)
+				}
+			}
+			_ = q.DeleteServiceByID(ctx, *env.PreviewServiceID)
+		}
 		cleanupCount++
 	}
 
@@ -684,3 +724,124 @@ func handleCleanupExpiredPreviewEnvironments(c *gin.Context) {
 		"expired_environments": expiredEnvs,
 	})
 }
+
+// previewServiceName builds the clone's service name — deterministic enough
+// to spot in lists, short enough for dnsLabel-derived hostnames.
+func previewServiceName(serviceName, branch string) string {
+	label := dnsLabel(serviceName + "-" + branch)
+	if label == "" {
+		return "preview-" + uuid.NewString()[:8]
+	}
+	return label + "-preview"
+}
+
+// resolvePreviewHost picks a preview hostname under the clone's node default
+// domain — same source as serviceAutoDomains. Returns "" when no node
+// carries a default domain; the preview still runs, reachable internally.
+func resolvePreviewHost(db *database.DB, cloneID uuid.UUID, envName string) string {
+	label := dnsLabel(envName)
+	if label == "" {
+		return ""
+	}
+	q := sqlcdb.New(db.DB)
+	ctx := context.Background()
+	brief, err := q.GetServicePlacementBrief(ctx, cloneID)
+	if err != nil {
+		return ""
+	}
+	nodeID, spread := brief.NodeID, brief.Spread
+	var base string
+	switch {
+	case nodeID.Valid && nodeID.String != "":
+		if a, err := q.GetAgent(ctx, nodeID.String); err == nil {
+			base = a.DefaultDomain
+		}
+	case spread:
+		if bases, err := q.ListSchedulableAgentDomains(ctx, json.RawMessage(tagsJSON(servicePlacementTags(db, cloneID)))); err == nil && len(bases) > 0 {
+			base = bases[0]
+		}
+	default:
+		// Local preview: borrow the first node default domain if any —
+		// still better than no hostname for a Traefik-fronted local host.
+		if bases, err := q.ListSchedulableAgentDomains(ctx, json.RawMessage("[]")); err == nil && len(bases) > 0 {
+			base = bases[0]
+		}
+	}
+	if base == "" {
+		return ""
+	}
+	return label + "." + base
+}
+
+// loadServiceForDeploy hydrates the Service fields runDeploymentAndSync
+// needs — mirrors the loader in handleDeployService.
+func serviceForDeployFromRow(r sqlcdb.GetServiceForDeployRow) Service {
+	return Service{
+		ID: r.ID, ProjectID: r.ProjectID, Name: r.Name, Type: r.Type.String,
+		Status: r.Status.String, Image: r.Image.String, Command: r.Command.String,
+		Environment: r.Environment.String, GitRepo: r.GitRepo.String,
+		GitBranch: r.GitBranch.String, BuildPath: r.BuildPath.String,
+		CPU: r.Cpu.String, Memory: r.Memory.String,
+		Replicas: int(r.Replicas), Port: int(r.Port), Domain: r.Domain,
+		HealthCheckPath: r.HealthcheckPath, RestartPolicy: r.RestartPolicy,
+		Builder: r.Builder, CPUReserve: r.CpuReserve, MemoryReserve: r.MemoryReserve,
+		StaticBuildCmd: r.StaticBuildCmd, StaticDir: r.StaticDir,
+		CreatedAt: r.CreatedAt.Time, UpdatedAt: r.UpdatedAt.Time,
+	}
+}
+
+func loadServiceForDeploy(db *database.DB, serviceID uuid.UUID) (Service, error) {
+	r, err := sqlcdb.New(db.DB).GetServiceForDeploy(context.Background(), serviceID)
+	if err != nil {
+		return Service{}, err
+	}
+	return serviceForDeployFromRow(r), nil
+}
+
+// StartPreviewSweeper expires preview environments past their TTL — tears
+// down each clone's runtime and row, marks the preview expired.
+func StartPreviewSweeper(ctx context.Context, db *database.DB, engine *deployment.DeploymentEngine) {
+	if db == nil || engine == nil {
+		return
+	}
+	go func() {
+		ticker := time.NewTicker(time.Minute)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				sweepExpiredPreviews(ctx, db, engine)
+				syncPreviewStatuses(ctx, db)
+			}
+		}
+	}()
+}
+
+// sweepExpiredPreviews retires previews whose TTL elapsed.
+func sweepExpiredPreviews(ctx context.Context, db *database.DB, engine *deployment.DeploymentEngine) {
+	q := sqlcdb.New(db.DB)
+	rows, err := q.ListSweepablePreviews(ctx)
+	if err != nil {
+		return
+	}
+	var ids []uuid.UUID
+	for _, r := range rows {
+		ids = append(ids, r.ID)
+		if r.PreviewServiceID.Valid {
+			removeServiceRuntime(ctx, db, engine, r.PreviewServiceID.UUID)
+			_ = q.DeleteServiceByID(ctx, r.PreviewServiceID.UUID)
+		}
+	}
+	for _, id := range ids {
+		_ = q.MarkPreviewEnvironmentStatus(ctx, sqlcdb.MarkPreviewEnvironmentStatusParams{
+			Status: "expired", ID: id})
+	}
+}
+
+// syncPreviewStatuses folds the clone's live service status into the
+// preview row so list/detail endpoints reflect the real deploy state.
+func syncPreviewStatuses(ctx context.Context, db *database.DB) {
+	_ = sqlcdb.New(db.DB).SyncPreviewStatuses(ctx)
+}

app/backend/internal/api/preview_environments_test.go

@@ -0,0 +1,30 @@
+package api
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestPreviewServiceName(t *testing.T) {
+	cases := []struct {
+		svc, branch string
+		want        string
+	}{
+		{"whoami-web", "feature-x", "whoami-web-feature-x-preview"},
+		{"My App", "feat/JARV-123_foo", "my-app-feat-jarv-123-foo-preview"},
+		{"svc", "", "svc-preview"},
+	}
+	for _, tc := range cases {
+		got := previewServiceName(tc.svc, tc.branch)
+		if got != tc.want {
+			t.Fatalf("previewServiceName(%q,%q) = %q, want %q", tc.svc, tc.branch, got, tc.want)
+		}
+		if len(got) > 63 {
+			t.Fatalf("name exceeds DNS label limit: %q", got)
+		}
+	}
+	// A name that sanitizes to nothing must still be usable.
+	if got := previewServiceName("!!!", "%%%"); !strings.HasPrefix(got, "preview-") {
+		t.Fatalf("expected fallback name, got %q", got)
+	}
+}

app/backend/internal/api/projectvars.go

@@ -1,10 +1,12 @@
 package api
 
 import (
+	"context"
 	"net/http"
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/secrets"
 
 	"github.com/gin-gonic/gin"
@@ -112,7 +114,8 @@ func handleUpdateProjectVariables(c *gin.Context) {
 	}
 	defer tx.Rollback()
 
-	if _, err = tx.Exec(`DELETE FROM project_variables WHERE project_id = $1`, projectID); err != nil {
+	txq := sqlcdb.New(tx)
+	if err = txq.DeleteProjectVariables(c.Request.Context(), projectID); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clear existing variables"})
 		return
 	}
@@ -127,11 +130,15 @@ func handleUpdateProjectVariables(c *gin.Context) {
 		if v.IsSecret {
 			value = secrets.Encrypt(value)
 		}
-		if _, err = tx.Exec(
-			`INSERT INTO project_variables (id, project_id, key, value, is_secret, created_at, updated_at)
-			 VALUES ($1, $2, $3, $4, $5, $6, $7)`,
-			uuid.New(), projectID, v.Key, value, v.IsSecret, now, now,
-		); err != nil {
+		if err = txq.InsertProjectVariable(c.Request.Context(), sqlcdb.InsertProjectVariableParams{
+			ID:        uuid.New(),
+			ProjectID: projectID,
+			Key:       v.Key,
+			Value:     value,
+			IsSecret:  v.IsSecret,
+			CreatedAt: now,
+			UpdatedAt: now,
+		}); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to insert variable: " + v.Key})
 			return
 		}
@@ -168,11 +175,10 @@ func handleUpdateProjectVariables(c *gin.Context) {
 
 // resolveSharedVar returns the decrypted value of a project variable.
 func resolveSharedVar(db *database.DB, projectID uuid.UUID, key string) (string, bool) {
-	var value string
-	err := db.QueryRow(
-		`SELECT value FROM project_variables WHERE project_id = $1 AND key = $2`,
-		projectID, key,
-	).Scan(&value)
+	value, err := sqlcdb.New(db.DB).GetProjectVariableValue(context.Background(), sqlcdb.GetProjectVariableValueParams{
+		ProjectID: projectID,
+		Key:       key,
+	})
 	if err != nil {
 		return "", false
 	}

app/backend/internal/api/registries.go

@@ -1,11 +1,13 @@
 package api
 
 import (
+	"context"
 	"net/http"
 	"strings"
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/secrets"
 
 	"github.com/docker/docker/api/types/registry"
@@ -177,17 +179,17 @@ func handleDeleteRegistry(c *gin.Context) {
 // bare image names (nginx:latest).
 func registryAuthFor(db *database.DB, ownerID, imageRef string) registry.AuthConfig {
 	host := registryHost(imageRef)
-	var username, password string
-	err := db.QueryRow(
-		`SELECT username, password FROM registries WHERE owner_id = $1 AND host = $2`,
-		ownerID, host,
-	).Scan(&username, &password)
+	ownerUUID, _ := uuid.Parse(ownerID)
+	row, err := sqlcdb.New(db.DB).GetRegistryAuth(context.Background(), sqlcdb.GetRegistryAuthParams{
+		OwnerID: ownerUUID,
+		Host:    host,
+	})
 	if err != nil {
 		return registry.AuthConfig{}
 	}
 	return registry.AuthConfig{
-		Username:      username,
-		Password:      secrets.Decrypt(password),
+		Username:      row.Username,
+		Password:      secrets.Decrypt(row.Password),
 		ServerAddress: host,
 	}
 }

app/backend/internal/api/routes.go

@@ -5,11 +5,13 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"path/filepath"
 	"time"
 
 	"containr/internal/build"
 	"containr/internal/config"
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/docker"
@@ -20,6 +22,7 @@ import (
 	"containr/internal/secrets"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 )
 
 func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg *config.Config) {
@@ -43,6 +46,11 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		dockerClient = client
 		buildManager = build.NewBuildManager("/tmp/containr-builds", dockerClient)
 		deploymentEngine = deployment.NewDeploymentEngine(buildManager, dockerClient)
+		initArtifacts(filepath.Join("/tmp/containr-builds", "artifacts"))
+		purgeStaleArtifacts()
+		// Node-pinned services dispatch container lifecycle to the agent's
+		// command queue instead of the local Docker socket.
+		deploymentEngine.SetNodeRunner(newAgentNodeRunner(db))
 		// Restore managed sidecars (e.g. cloudflared) from saved settings.
 		syncManagedContainers(dockerClient, db)
 	}
@@ -77,19 +85,18 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		// 127.0.0.1 fallback stays for node-bound checks.
 		docker := dockerClient
 		haManager.WithServiceResolver(func(ctx context.Context, serviceID string) (string, int, error) {
-			var name, projectID string
-			var port int
-			err := db.QueryRowContext(ctx,
-				`SELECT name, project_id::text, COALESCE(port, 0) FROM services WHERE id = $1`,
-				serviceID,
-			).Scan(&name, &projectID, &port)
+			sid, err := uuid.Parse(serviceID)
 			if err != nil {
 				return "", 0, err
 			}
-			if err := docker.ConnectSelfToNetwork(ctx, deployment.ProjectNetworkName(projectID)); err != nil {
+			svc, err := sqlcdb.New(db.DB).GetServiceNameProjectPort(ctx, sid)
+			if err != nil {
 				return "", 0, err
 			}
-			return name, port, nil
+			if err := docker.ConnectSelfToNetwork(ctx, deployment.ProjectNetworkName(svc.ProjectID)); err != nil {
+				return "", 0, err
+			}
+			return svc.Name, int(svc.Port), nil
 		})
 	}
 	haAPIManager := NewHAManager(haManager)
@@ -105,10 +112,18 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 
 	// Sleep sweeper — scales idle services to zero and prunes wake containers.
 	StartSleepSweeper(context.Background(), db, dockerClient, deploymentEngine, cfg.Port)
+	StartPreviewSweeper(context.Background(), db, deploymentEngine)
 
 	// Audit retention — prunes rows past AUDIT_RETENTION_DAYS (default 90).
 	StartAuditRetention(context.Background(), db)
 
+	// Agent health — marks stale heartbeats offline, notifies admins on
+	// offline/recovery transitions.
+	StartAgentHealthSweep(context.Background(), db)
+
+	// Daily upgrade check — notifies admins when a newer release exists.
+	StartUpgradeCheck(context.Background(), db, Version)
+
 	// Initialize database handler
 	databaseHandler := NewDatabaseHandler(db.DB, dockerClient)
 
@@ -123,31 +138,25 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 	// Boot sweep: in-memory engine state dies on restart, so anything that
 	// looked in-flight is actually orphaned — mark it failed rather than
 	// leaving phantom 'building'/'queued' rows.
-	_, _ = db.Exec(
-		`UPDATE deployments SET status = 'failed', error = 'Interrupted by server restart', completed_at = NOW(), updated_at = NOW()
-		 WHERE status IN ('queued', 'pending', 'building', 'deploying', 'rolling_back')`,
-	)
+	bootQ := sqlcdb.New(db.DB)
+	_ = bootQ.FailInterruptedDeployments(context.Background())
 
 	// Boot sweep: encrypt any plaintext secret values left over from before
 	// encryption-at-rest landed. Transparent and idempotent.
-	if encRows, err := db.Query(`SELECT id, value FROM environment_variables WHERE is_secret = TRUE`); err == nil {
-		type encRow struct {
-			id    string
-			value string
-		}
-		var toEncrypt []encRow
-		for encRows.Next() {
-			var r encRow
-			if err := encRows.Scan(&r.id, &r.value); err == nil && !secrets.IsEncrypted(r.value) {
-				toEncrypt = append(toEncrypt, r)
+	if encRows, err := bootQ.ListSecretEnvVars(context.Background()); err == nil {
+		toEncrypt := 0
+		for _, r := range encRows {
+			if secrets.IsEncrypted(r.Value) {
+				continue
+			}
+			if err := bootQ.UpdateEnvVarValue(context.Background(), sqlcdb.UpdateEnvVarValueParams{
+				Value: secrets.Encrypt(r.Value), ID: r.ID,
+			}); err == nil {
+				toEncrypt++
 			}
 		}
-		encRows.Close()
-		for _, r := range toEncrypt {
-			_, _ = db.Exec(`UPDATE environment_variables SET value = $1, updated_at = NOW() WHERE id = $2`, secrets.Encrypt(r.value), r.id)
-		}
-		if len(toEncrypt) > 0 {
-			log.Printf("secrets: encrypted %d plaintext secret variable(s)", len(toEncrypt))
+		if toEncrypt > 0 {
+			log.Printf("secrets: encrypted %d plaintext secret variable(s)", toEncrypt)
 		}
 	}
 
@@ -256,6 +265,12 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 	// endpoint, verified against the provisioned webhook secret.
 	router.POST("/api/git/github-app/webhook", handleGitHubAppWebhook)
 
+	// Public API gateway data plane. Lives outside /api/v1 so each service's
+	// route_prefix (/g/<slug>) maps cleanly; auth is the caller's api_key,
+	// not a session.
+	router.Any("/g/:slug", handleGatewayProxy)
+	router.Any("/g/:slug/*path", handleGatewayProxy)
+
 	v1 := router.Group("/api/v1")
 	{
 		// Public routes (no authentication required)
@@ -266,6 +281,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			public.POST("/auth/register", handleRegister)
 			public.GET("/maintenance", handleMaintenancePage)
 			public.GET("/branding", handleGetBranding)
+			public.GET("/setup/status", handleSetupStatus)
 
 			// Invite accept flow — validates the link, then registers
 			// even while public signup is closed.
@@ -275,6 +291,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			// Wake callback for sleep-mode placeholders. Unauthenticated but
 			// non-destructive: it only reconciles the service back to running.
 			public.Any("/internal/wake/:id", handleServiceWake)
+			public.Any("/internal/wake-page/:id", handleServiceWakePage)
 		}
 
 		// Read routes — public browsing. OptionalAuth resolves a session when
@@ -286,6 +303,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			read.GET("/projects", handleGetProjects)
 			read.GET("/projects/:id", handleGetProject)
 			read.GET("/projects/:id/services", handleGetServices)
+			read.GET("/projects/:id/environments", handleListEnvironments)
 			read.GET("/projects/:id/preview-environments", handleGetPreviewEnvironments)
 			read.GET("/projects/:id/security/history", securityHandler.GetProjectSecurityHistory)
 			read.GET("/projects/:id/vulnerabilities", securityHandler.GetVulnerabilities)
@@ -333,6 +351,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		{
 			authed.GET("/user/profile", handleGetProfile)
 			authed.PUT("/user/profile", handleUpdateProfile)
+			authed.POST("/setup/complete", handleSetupComplete)
 
 			// Personal access tokens for CLI/MCP/agent auth.
 			authed.GET("/user/tokens", handleListUserTokens)
@@ -342,12 +361,17 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.GET("/notifications", handleListNotifications)
 			authed.POST("/notifications/:id/read", handleMarkNotificationRead)
 			authed.POST("/notifications/read-all", handleMarkAllNotificationsRead)
+			authed.GET("/notifications/channels", handleListNotificationChannels)
+			authed.POST("/notifications/channels", handleCreateNotificationChannel)
+			authed.POST("/notifications/channels/:id/test", handleTestNotificationChannel)
+			authed.DELETE("/notifications/channels/:id", handleDeleteNotificationChannel)
 
 			// WebSocket endpoint
 			authed.GET("/ws", handleWebSocket)
 
 			// Cross-cutting ops view — active/queued/failed work
 			authed.GET("/operations", handleGetOperations)
+			authed.GET("/nodes/options", agentHandler.ListNodeOptions)
 			authed.GET("/activity", handleGetActivity)
 			authed.GET("/projects/:id/activity", handleGetProjectActivity)
 
@@ -454,6 +478,8 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.POST("/databases/:id/backups/import", databaseHandler.ImportBackup)
 			authed.GET("/databases/:id/backups/:bid/download", databaseHandler.DownloadBackup)
 
+			authed.POST("/projects/:id/environments", handleCreateEnvironment)
+			authed.DELETE("/environments/:id", handleDeleteEnvironment)
 			authed.POST("/projects/:id/preview-environments", handleCreatePreviewEnvironment)
 			authed.PUT("/preview-environments/:id", handleUpdatePreviewEnvironment)
 			authed.DELETE("/preview-environments/:id", handleDeletePreviewEnvironment)
@@ -472,6 +498,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.POST("/templates/:id/deploy", handleCreateFromTemplate)
 			authed.POST("/templates/:id/plan", handlePlanTemplate)
 			authed.POST("/templates/import/compose", handleImportCompose)
+			authed.POST("/templates/import/git", handleImportGitCompose)
 			authed.POST("/templates/deploy", handleDeployInlineGraph)
 
 			authed.POST("/cron-jobs", handleCreateCronJob)

app/backend/internal/api/runtime.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
 	"net/http"
 	"regexp"
@@ -10,6 +11,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/secrets"
@@ -18,6 +20,56 @@ import (
 	"github.com/google/uuid"
 )
 
+// remoteAgentsForService lists every agent holding inventory rows for the
+// service — covers pinned placements, spread replicas, and leftovers from a
+// since-cleared pin.
+func remoteAgentsForService(ctx context.Context, db *database.DB, serviceID uuid.UUID) []string {
+	ids, err := sqlcdb.New(db.DB).ListNodeAgentsForService(ctx, serviceID.String())
+	if err != nil {
+		return nil
+	}
+	out := make([]string, 0, len(ids))
+	for _, id := range ids {
+		if id != "" {
+			out = append(out, id)
+		}
+	}
+	return out
+}
+
+// serviceLifecycle routes a start/stop/restart action to every agent holding
+// the service's replicas, then to the local Docker engine. Both run — a
+// service can't be pinned and local at once, but stale containers from a
+// cleared pin shouldn't survive a stop.
+func serviceLifecycle(ctx context.Context, db *database.DB, engine *deployment.DeploymentEngine, serviceID uuid.UUID, action string) error {
+	for _, agentID := range remoteAgentsForService(ctx, db, serviceID) {
+		if err := engine.ControlServiceOnNode(ctx, serviceID.String(), agentID, action); err != nil {
+			return err
+		}
+	}
+	switch action {
+	case "start":
+		return engine.StartService(ctx, serviceID.String())
+	case "stop":
+		return engine.StopService(ctx, serviceID.String())
+	case "restart":
+		if err := engine.StopService(ctx, serviceID.String()); err != nil {
+			return err
+		}
+		return engine.StartService(ctx, serviceID.String())
+	}
+	return fmt.Errorf("unsupported lifecycle action %q", action)
+}
+
+// removeServiceRuntime tears down replicas wherever they run — remote nodes
+// (pinned or spread) and the local Docker host.
+func removeServiceRuntime(ctx context.Context, db *database.DB, engine *deployment.DeploymentEngine, serviceID uuid.UUID) {
+	for _, agentID := range remoteAgentsForService(ctx, db, serviceID) {
+		_ = engine.RemoveServiceContainersOnNode(ctx, serviceID.String(), agentID)
+	}
+	_ = engine.RemoveServiceContainers(ctx, serviceID.String())
+}
+
 // serviceRuntimeSpec builds the container spec for a service: stored env vars
 // merged with ${{Service.KEY}} references resolved across the project.
 func serviceRuntimeSpec(db *database.DB, service Service) (deployment.RuntimeSpec, error) {
@@ -37,11 +89,16 @@ func serviceRuntimeSpec(db *database.DB, service Service) (deployment.RuntimeSpe
 		Domain:        service.Domain,
 		HealthPath:    service.HealthCheckPath,
 		RestartPolicy: service.RestartPolicy,
+		NodeID:        serviceNodeID(db, service.ID),
+		Spread:        serviceSpread(db, service.ID),
+		PlacementTags: servicePlacementTags(db, service.ID),
 	}
 	// Best effort: reuse the host port from the last live deployment so the
 	// public URL survives restarts. Column exists post-migration; older DBs
 	// silently get ephemeral ports.
-	_ = db.QueryRow(`SELECT published_port FROM services WHERE id = $1`, service.ID).Scan(&spec.PublishedPort)
+	if p, err := sqlcdb.New(db.DB).GetServicePublishedPort(context.Background(), service.ID); err == nil {
+		spec.PublishedPort = p
+	}
 	if cmd := strings.TrimSpace(service.Command); cmd != "" {
 		spec.Command = strings.Fields(cmd)
 	}
@@ -63,6 +120,7 @@ func serviceRuntimeSpec(db *database.DB, service Service) (deployment.RuntimeSpe
 	spec.Volumes = loadServiceVolumes(db, service.ID)
 	spec.Domains = serviceDomainNames(db, service.ID, service.Domain)
 	spec.Maintenance, spec.BasicAuthUsers = serviceAccess(db, service.ID)
+	spec.TraefikLabels = serviceTraefikLabels(db, service.ID)
 	if spec.Maintenance {
 		spec.MaintenanceURL = maintenanceURL(db)
 	}
@@ -78,42 +136,23 @@ var refVarPattern = regexp.MustCompile(`\$\{\{\s*([A-Za-z0-9_-]+)\.([A-Za-z_][A-
 // secrets) and expands ${{service.KEY}} references. KEY may be a variable on
 // the referenced service, or the builtins HOST (service name alias) and PORT.
 func resolveServiceEnv(db *database.DB, service Service) (map[string]string, error) {
-	rows, err := db.Query(
-		`SELECT key, value FROM environment_variables WHERE service_id = $1`,
-		service.ID,
-	)
+	q := sqlcdb.New(db.DB)
+	vars, err := q.ListServiceVariableValues(context.Background(), service.ID)
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
 
 	env := map[string]string{}
-	for rows.Next() {
-		var k, v string
-		if err := rows.Scan(&k, &v); err != nil {
-			return nil, err
-		}
-		env[k] = secrets.Decrypt(v)
+	for _, v := range vars {
+		env[v.Key] = secrets.Decrypt(v.Value)
 	}
 
-	var refServices []struct{ ID, Name string }
-	svcRows, err := db.Query(
-		`SELECT id, name FROM services WHERE project_id = $1`,
-		service.ProjectID,
-	)
+	refServices, err := q.ListProjectServiceRefs(context.Background(), service.ProjectID)
 	if err != nil {
 		return nil, err
 	}
-	defer svcRows.Close()
-	for svcRows.Next() {
-		var s struct{ ID, Name string }
-		if err := svcRows.Scan(&s.ID, &s.Name); err != nil {
-			return nil, err
-		}
-		refServices = append(refServices, s)
-	}
 
-	byName := map[string]string{}
+	byName := map[string]uuid.UUID{}
 	for _, s := range refServices {
 		byName[strings.ToLower(s.Name)] = s.ID
 	}
@@ -130,17 +169,15 @@ func resolveServiceEnv(db *database.DB, service Service) (map[string]string, err
 		case "HOST":
 			return serviceName, true
 		case "PORT":
-			var port int
-			if err := db.QueryRow(`SELECT COALESCE(port, 0) FROM services WHERE id = $1`, id).Scan(&port); err == nil && port > 0 {
-				return strconv.Itoa(port), true
+			if port, err := q.GetServicePort(context.Background(), id); err == nil && port > 0 {
+				return strconv.Itoa(int(port)), true
 			}
 			return "", false
 		}
-		var value string
-		err := db.QueryRow(
-			`SELECT value FROM environment_variables WHERE service_id = $1 AND key = $2`,
-			id, key,
-		).Scan(&value)
+		value, err := q.GetServiceVariableValue(context.Background(), sqlcdb.GetServiceVariableValueParams{
+			ServiceID: id,
+			Key:       key,
+		})
 		if err != nil {
 			return "", false
 		}
@@ -213,6 +250,15 @@ func parseMemoryLimit(mem string) int64 {
 	return 0
 }
 
+// setServiceStatusNow writes the stored status with a fresh updated_at.
+func setServiceStatusNow(db *database.DB, id uuid.UUID, status string) {
+	_ = sqlcdb.New(db.DB).SetServiceStatus(context.Background(), sqlcdb.SetServiceStatusParams{
+		Status:    sql.NullString{String: status, Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        id,
+	})
+}
+
 func getRuntimeEngine(c *gin.Context) (*deployment.DeploymentEngine, *database.DB, bool) {
 	dbValue, exists := c.Get("db")
 	if !exists {
@@ -227,6 +273,22 @@ func getRuntimeEngine(c *gin.Context) (*deployment.DeploymentEngine, *database.D
 	return engineValue.(*deployment.DeploymentEngine), dbValue.(*database.DB), true
 }
 
+// serviceFromRuntimeRow maps the sqlc runtime row (with legacy-column
+// fallbacks applied in SQL) onto the API Service model.
+func serviceFromRuntimeRow(r sqlcdb.GetServiceRuntimeWithOwnerRow) Service {
+	return Service{
+		ID: r.ID, ProjectID: r.ProjectID, Name: r.Name, Type: r.Type,
+		Status: r.Status, Image: r.Image, Command: r.Command,
+		Environment: r.Environment, GitRepo: r.GitRepo, GitBranch: r.GitBranch,
+		BuildPath: r.BuildPath, CPU: r.Cpu, Memory: r.Memory,
+		Replicas: int(r.Replicas), Port: int(r.Port), Domain: r.Domain,
+		HealthCheckPath: r.HealthcheckPath, RestartPolicy: r.RestartPolicy,
+		Builder: r.Builder, CPUReserve: r.CpuReserve,
+		MemoryReserve: r.MemoryReserve, StaticBuildCmd: r.StaticBuildCmd,
+		StaticDir: r.StaticDir, CreatedAt: r.CreatedAt.Time, UpdatedAt: r.UpdatedAt.Time,
+	}
+}
+
 func loadOwnedService(c *gin.Context, db *database.DB) (Service, bool) {
 	serviceID, err := uuid.Parse(c.Param("id"))
 	if err != nil {
@@ -239,43 +301,16 @@ func loadOwnedService(c *gin.Context, db *database.DB) (Service, bool) {
 		return Service{}, false
 	}
 
-	var service Service
-	var owner string
-	err = db.QueryRow(
-		`SELECT s.id, s.project_id, s.name,
-		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
-		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
-		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
-		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
-		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at, p.owner_id
-		 FROM services s JOIN projects p ON s.project_id = p.id
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt, &owner,
-	)
+	row, err := sqlcdb.New(db.DB).GetServiceRuntimeWithOwner(context.Background(), serviceID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return Service{}, false
 	}
-	if owner != userID.(string) && !isAdminUser(db, userID.(string)) {
+	if row.OwnerID.String() != userID.(string) && !isAdminUser(db, userID.(string)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return Service{}, false
 	}
-	return service, true
+	return serviceFromRuntimeRow(row), true
 }
 
 // loadReadableService loads a service when the caller may read its project:
@@ -287,39 +322,13 @@ func loadReadableService(c *gin.Context, db *database.DB) (Service, bool) {
 		return Service{}, false
 	}
 
-	var service Service
-	var projectID uuid.UUID
-	err = db.QueryRow(
-		`SELECT s.id, s.project_id, s.name,
-		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
-		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
-		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
-		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
-		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at, s.project_id
-		 FROM services s
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt, &projectID,
-	)
+	row, err := sqlcdb.New(db.DB).GetServiceRuntimeWithOwner(context.Background(), serviceID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return Service{}, false
 	}
-	if _, allowed := projectReadAccess(c, db, projectID); !allowed {
+	service := serviceFromRuntimeRow(row)
+	if _, allowed := projectReadAccess(c, db, service.ProjectID); !allowed {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return Service{}, false
 	}
@@ -341,6 +350,7 @@ func handleGetServiceRuntime(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	mergeRemoteRuntime(c.Request.Context(), engine, service.ID.String(), state)
 	engine.ProbeServiceHealth(c.Request.Context(), state, service.ProjectID.String(), service.Name, service.Port, service.HealthCheckPath)
 	persistPublishedPort(db, service.ID, state.Ports)
 	if host := requestHostname(c); host != "" {
@@ -369,7 +379,7 @@ func reconcileNow(c *gin.Context, engine *deployment.DeploymentEngine, db *datab
 		status = state.Status
 		persistPublishedPort(db, service.ID, state.Ports)
 	}
-	_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
+	setServiceStatusNow(db, service.ID, status)
 	c.JSON(http.StatusOK, gin.H{"runtime": state})
 	return true
 }
@@ -384,11 +394,11 @@ func handleServiceStart(c *gin.Context) {
 	if !ok {
 		return
 	}
-	if err := engine.StartService(c.Request.Context(), service.ID.String()); err != nil {
+	if err := serviceLifecycle(c.Request.Context(), db, engine, service.ID, "start"); err != nil {
 		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
 		return
 	}
-	_, _ = db.Exec(`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	setServiceStatusNow(db, service.ID, "running")
 	c.JSON(http.StatusOK, gin.H{"status": "running"})
 }
 
@@ -402,11 +412,11 @@ func handleServiceStop(c *gin.Context) {
 	if !ok {
 		return
 	}
-	if err := engine.StopService(c.Request.Context(), service.ID.String()); err != nil {
+	if err := serviceLifecycle(c.Request.Context(), db, engine, service.ID, "stop"); err != nil {
 		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
 		return
 	}
-	_, _ = db.Exec(`UPDATE services SET status = 'stopped', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	setServiceStatusNow(db, service.ID, "stopped")
 	c.JSON(http.StatusOK, gin.H{"status": "stopped"})
 }
 
@@ -421,15 +431,11 @@ func handleServiceRestart(c *gin.Context) {
 		return
 	}
 	ctx := c.Request.Context()
-	if err := engine.StopService(ctx, service.ID.String()); err != nil {
+	if err := serviceLifecycle(ctx, db, engine, service.ID, "restart"); err != nil {
 		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
 		return
 	}
-	if err := engine.StartService(ctx, service.ID.String()); err != nil {
-		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
-		return
-	}
-	_, _ = db.Exec(`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	setServiceStatusNow(db, service.ID, "running")
 	c.JSON(http.StatusOK, gin.H{"status": "running"})
 }
 
@@ -449,12 +455,8 @@ func handleServiceRedeploy(c *gin.Context) {
 	image := service.Image
 	if image == "" {
 		// Git-sourced service: reuse the last successful deployment image.
-		err := db.QueryRow(
-			`SELECT image_name || ':' || image_tag FROM deployments
-			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
-			 ORDER BY created_at DESC LIMIT 1`,
-			service.ID,
-		).Scan(&image)
+		var err error
+		image, err = sqlcdb.New(db.DB).GetLastDeployedImage(context.Background(), service.ID)
 		if err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "No deployable image yet — run a deployment first"})
 			return
@@ -500,7 +502,7 @@ func reconcileServiceJob(ctx context.Context, db *database.DB, engine *deploymen
 		if state.Status != "" {
 			status = state.Status
 		}
-		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
+		setServiceStatusNow(db, service.ID, status)
 	}
 	return state, nil
 }
@@ -519,12 +521,9 @@ func enqueueServiceRedeploy(c *gin.Context, db *database.DB, service Service) bo
 	}
 	image := service.Image
 	if image == "" {
-		if err := db.QueryRow(
-			`SELECT image_name || ':' || image_tag FROM deployments
-			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
-			 ORDER BY created_at DESC LIMIT 1`,
-			service.ID,
-		).Scan(&image); err != nil {
+		var err error
+		image, err = sqlcdb.New(db.DB).GetLastDeployedImage(context.Background(), service.ID)
+		if err != nil {
 			return false
 		}
 	}
@@ -535,16 +534,47 @@ func enqueueServiceRedeploy(c *gin.Context, db *database.DB, service Service) bo
 	return true
 }
 
+// mergeRemoteRuntime folds inventory-backed remote replica state into a
+// local runtime view so pinned and spread services report their containers.
+// Remote rows carry deterministic UUIDs, local ones Docker IDs — no overlap.
+func mergeRemoteRuntime(ctx context.Context, engine *deployment.DeploymentEngine, serviceID string, state *deployment.RuntimeState) {
+	remote, err := engine.RemoteRuntimeState(ctx, serviceID)
+	if err != nil || remote == nil {
+		return
+	}
+	running := 0
+	for _, c := range state.Containers {
+		if c.State == "running" {
+			running++
+		}
+	}
+	for _, rc := range remote.Containers {
+		state.Containers = append(state.Containers, rc)
+		if rc.State == "running" {
+			running++
+		}
+	}
+	switch {
+	case len(state.Containers) == 0:
+	case running == 0:
+		state.Status = "stopped"
+	case running < state.Desired:
+		state.Status = "degraded"
+	default:
+		state.Status = "running"
+	}
+}
+
 // persistPublishedPort records the host port Docker actually bound so later
 // redeploys can reuse it. Idempotent — only writes when the value changed.
 func persistPublishedPort(db *database.DB, serviceID uuid.UUID, ports []uint16) {
 	if len(ports) == 0 {
 		return
 	}
-	_, _ = db.Exec(
-		`UPDATE services SET published_port = $1 WHERE id = $2 AND published_port <> $1`,
-		int(ports[0]), serviceID,
-	)
+	_ = sqlcdb.New(db.DB).SetServicePublishedPort(context.Background(), sqlcdb.SetServicePublishedPortParams{
+		PublishedPort: int32(ports[0]),
+		ID:            serviceID,
+	})
 }
 
 // liveServiceStatus reconciles the stored status with real container state.
@@ -558,16 +588,22 @@ func liveServiceStatus(c *gin.Context, db *database.DB, service *Service) {
 	ctx, cancel := context.WithTimeout(c.Request.Context(), 3*time.Second)
 	defer cancel()
 	state, err := engine.RuntimeState(ctx, service.ID.String(), service.Replicas)
-	if err != nil || state == nil || len(state.Containers) == 0 {
+	if err != nil || state == nil {
+		return
+	}
+	mergeRemoteRuntime(ctx, engine, service.ID.String(), state)
+	if len(state.Containers) == 0 {
 		return
 	}
 	if state.Status != service.Status {
 		service.Status = state.Status
-		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, state.Status, time.Now(), service.ID)
+		setServiceStatusNow(db, service.ID, state.Status)
 	}
 	persistPublishedPort(db, service.ID, state.Ports)
 	if service.Domain != "" {
 		service.PublicURL = "https://" + service.Domain
+	} else if auto := serviceAutoDomains(db, service.ID); len(auto) > 0 {
+		service.PublicURL = "https://" + auto[0]
 	} else if len(state.URLs) > 0 {
 		service.PublicURL = rewriteLoopbackURL(state.URLs[0], requestHostname(c))
 	}
@@ -583,44 +619,22 @@ func runtimeScaleService(c *gin.Context, serviceID string, replicas int) error {
 		return fmt.Errorf("runtime unavailable")
 	}
 
-	var service Service
-	var owner string
-	err := db.QueryRow(
-		`SELECT s.id, s.project_id, s.name,
-		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
-		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
-		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
-		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
-		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at, p.owner_id
-		 FROM services s JOIN projects p ON s.project_id = p.id
-		 WHERE s.id = $1`, serviceID,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt, &owner,
-	)
+	q := sqlcdb.New(db.DB)
+	sid, err := uuid.Parse(serviceID)
 	if err != nil {
 		return err
 	}
+	row, err := q.GetServiceRuntimeWithOwner(context.Background(), sid)
+	if err != nil {
+		return err
+	}
+	service := serviceFromRuntimeRow(row)
 	if service.Image == "" {
-		if err := db.QueryRow(
-			`SELECT image_name || ':' || image_tag FROM deployments
-			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
-			 ORDER BY created_at DESC LIMIT 1`, service.ID,
-		).Scan(&service.Image); err != nil {
+		image, err := q.GetLastDeployedImage(context.Background(), service.ID)
+		if err != nil {
 			return fmt.Errorf("no deployed image to scale")
 		}
+		service.Image = image
 	}
 
 	spec, err := serviceRuntimeSpec(db, service)
@@ -638,7 +652,11 @@ func runtimeScaleService(c *gin.Context, serviceID string, replicas int) error {
 	if state != nil {
 		persistPublishedPort(db, service.ID, state.Ports)
 	}
-	_, _ = db.Exec(`UPDATE services SET replicas = $1, updated_at = $2 WHERE id = $3`, replicas, time.Now(), service.ID)
+	_ = q.SetServiceReplicas(context.Background(), sqlcdb.SetServiceReplicasParams{
+		Replicas:  int32(replicas),
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        service.ID,
+	})
 	return nil
 }
 
@@ -657,47 +675,34 @@ func handleServiceEnvCheck(c *gin.Context) {
 		return
 	}
 
-	rows, err := db.Query(
-		`SELECT key, value, COALESCE(is_secret, false) FROM environment_variables WHERE service_id = $1`,
-		service.ID,
-	)
+	q := sqlcdb.New(db.DB)
+	vars, err := q.ListServiceVariablesWithSecret(context.Background(), service.ID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	defer rows.Close()
 
 	var unresolved, empty, unreadable []string
 	var raw []struct{ key, val string }
-	for rows.Next() {
-		var k, v string
-		var secret bool
-		if err := rows.Scan(&k, &v, &secret); err != nil {
-			continue
-		}
-		decrypted := secrets.Decrypt(v)
-		if secret && secrets.IsEncrypted(v) && decrypted == v {
+	for _, v := range vars {
+		decrypted := secrets.Decrypt(v.Value)
+		if v.IsSecret && secrets.IsEncrypted(v.Value) && decrypted == v.Value {
 			// Ciphertext failed to decrypt — Decrypt returns the input.
-			unreadable = append(unreadable, k)
+			unreadable = append(unreadable, v.Key)
 			continue
 		}
 		if strings.TrimSpace(decrypted) == "" {
-			empty = append(empty, k)
+			empty = append(empty, v.Key)
 		}
-		raw = append(raw, struct{ key, val string }{k, decrypted})
+		raw = append(raw, struct{ key, val string }{v.Key, decrypted})
 	}
 
 	// Project siblings for ${{name.KEY}} resolution.
-	siblingIDs := map[string]string{}
-	svcRows, err := db.Query(`SELECT id, name FROM services WHERE project_id = $1`, service.ProjectID)
-	if err == nil {
-		for svcRows.Next() {
-			var id, name string
-			if err := svcRows.Scan(&id, &name); err == nil {
-				siblingIDs[strings.ToLower(name)] = id
-			}
+	siblingIDs := map[string]uuid.UUID{}
+	if refs, err := q.ListProjectServiceRefs(context.Background(), service.ProjectID); err == nil {
+		for _, s := range refs {
+			siblingIDs[strings.ToLower(s.Name)] = s.ID
 		}
-		svcRows.Close()
 	}
 
 	resolvable := func(serviceName, key string) bool {
@@ -709,20 +714,14 @@ func handleServiceEnvCheck(c *gin.Context) {
 			return true
 		}
 		if strings.EqualFold(key, "PORT") {
-			var port int
-			if err := db.QueryRow(`SELECT COALESCE(port, 0) FROM services WHERE id = $1`, id).Scan(&port); err == nil {
-				return port > 0
-			}
-			return false
+			port, err := q.GetServicePort(context.Background(), id)
+			return err == nil && port > 0
 		}
-		var n int
-		if err := db.QueryRow(
-			`SELECT COUNT(*) FROM environment_variables WHERE service_id = $1 AND key = $2`,
-			id, key,
-		).Scan(&n); err == nil {
-			return n > 0
-		}
-		return false
+		_, err := q.GetServiceVariableValue(context.Background(), sqlcdb.GetServiceVariableValueParams{
+			ServiceID: id,
+			Key:       key,
+		})
+		return err == nil
 	}
 
 	for _, kv := range raw {

app/backend/internal/api/security.go

@@ -2,7 +2,9 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/security"
+	"context"
 	"database/sql"
 	"encoding/json"
 	"fmt"
@@ -29,9 +31,27 @@ type SecurityHandler struct {
 func NewSecurityHandler(db *database.DB, encryptionKey string) *SecurityHandler {
 	encryptionManager, _ := security.NewEncryptionManager(encryptionKey)
 
+	scanner := security.NewScanner(db)
+	// Notify the project owner when a background scan completes — criticals
+	// earn a distinct title so they stand out in the notification list.
+	scanner.OnScanComplete = func(scan *security.SecurityScan) {
+		ownerID, err := sqlcdb.New(db.DB).GetProjectOwnerText(context.Background(), uuid.MustParse(scan.ProjectID))
+		if err != nil || ownerID == "" {
+			return
+		}
+		title := "Security scan completed"
+		if scan.Summary.Critical > 0 || scan.Summary.High > 0 {
+			title = "Security scan found issues"
+		}
+		insertUserNotification(db, ownerID, "security", title,
+			fmt.Sprintf("%s scan finished: %d critical, %d high, %d total findings (score %d/100).",
+				scan.ScanType, scan.Summary.Critical, scan.Summary.High, scan.Summary.Total, scan.Summary.Score),
+			"project", scan.ProjectID)
+	}
+
 	return &SecurityHandler{
 		db:                   db,
-		scanner:              security.NewScanner(db),
+		scanner:              scanner,
 		complianceManager:    security.NewComplianceManager(db),
 		encryptionManager:    encryptionManager,
 		dataRetentionManager: security.NewDataRetentionManager(encryptionManager),
@@ -63,14 +83,10 @@ func (sh *SecurityHandler) StartSecurityScan(c *gin.Context) {
 			return
 		}
 
-		var serviceExists bool
-		err := sh.db.QueryRow(
-			`SELECT EXISTS(
-				SELECT 1 FROM services WHERE id = $1 AND project_id = $2
-			)`,
-			req.ServiceID,
-			req.ProjectID,
-		).Scan(&serviceExists)
+		serviceExists, err := sqlcdb.New(sh.db.DB).ServiceExistsInProject(context.Background(), sqlcdb.ServiceExistsInProjectParams{
+			ID:        uuid.MustParse(req.ServiceID),
+			ProjectID: uuid.MustParse(req.ProjectID),
+		})
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to validate service"})
 			return
@@ -146,40 +162,30 @@ func (sh *SecurityHandler) GetVulnerabilities(c *gin.Context) {
 	}
 
 	// Query vulnerabilities
-	rows, err := sh.db.Query(`
-		SELECT id, type, severity, title, description, service_id, status, found_at, resolved_at
-		FROM vulnerabilities 
-		WHERE project_id = $1 
-		ORDER BY 
-			CASE severity 
-				WHEN 'critical' THEN 1 
-				WHEN 'high' THEN 2 
-				WHEN 'medium' THEN 3 
-				WHEN 'low' THEN 4 
-			END,
-			found_at DESC
-	`, projectID)
-
+	rows, err := sqlcdb.New(sh.db.DB).ListVulnerabilities(context.Background(), uuid.MustParse(projectID))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get vulnerabilities"})
 		return
 	}
-	defer rows.Close()
 
 	var vulnerabilities []security.Vulnerability
-	for rows.Next() {
-		var vuln security.Vulnerability
-		var resolvedAt *time.Time
-
-		err := rows.Scan(&vuln.ID, &vuln.Type, &vuln.Severity, &vuln.Title, &vuln.Description,
-			&vuln.ServiceID, &vuln.Status, &vuln.FoundAt, &resolvedAt)
-
-		if err != nil {
+	for _, row := range rows {
+		// NULL description/service_id failed the original scan and dropped
+		// the row — keep the same filter.
+		if !row.Description.Valid || !row.ServiceID.Valid {
 			continue
 		}
-
-		vuln.ResolvedAt = resolvedAt
-		vulnerabilities = append(vulnerabilities, vuln)
+		vulnerabilities = append(vulnerabilities, security.Vulnerability{
+			ID:          row.ID.String(),
+			Type:        row.Type,
+			Severity:    row.Severity,
+			Title:       row.Title,
+			Description: row.Description.String,
+			ServiceID:   row.ServiceID.UUID.String(),
+			Status:      row.Status,
+			FoundAt:     row.FoundAt,
+			ResolvedAt:  timePtrNT(row.ResolvedAt),
+		})
 	}
 
 	c.JSON(http.StatusOK, gin.H{"vulnerabilities": vulnerabilities})
@@ -209,11 +215,11 @@ func (sh *SecurityHandler) UpdateVulnerability(c *gin.Context) {
 		resolvedAt = &now
 	}
 
-	_, err := sh.db.Exec(`
-		UPDATE vulnerabilities 
-		SET status = $1, resolved_at = $2 
-		WHERE id = $3
-	`, req.Status, resolvedAt, vulnID)
+	err := sqlcdb.New(sh.db.DB).UpdateVulnerabilityStatus(context.Background(), sqlcdb.UpdateVulnerabilityStatusParams{
+		Status:     req.Status,
+		ResolvedAt: ntPtr(resolvedAt),
+		ID:         uuid.MustParse(vulnID),
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update vulnerability"})
@@ -253,13 +259,7 @@ func (sh *SecurityHandler) StartComplianceAssessment(c *gin.Context) {
 		return
 	}
 
-	var frameworkExists bool
-	err := sh.db.QueryRow(
-		`SELECT EXISTS(
-			SELECT 1 FROM compliance_frameworks WHERE id = $1
-		)`,
-		req.FrameworkID,
-	).Scan(&frameworkExists)
+	frameworkExists, err := sqlcdb.New(sh.db.DB).ComplianceFrameworkExists(context.Background(), uuid.MustParse(req.FrameworkID))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to validate framework"})
 		return
@@ -303,30 +303,25 @@ func (sh *SecurityHandler) GetComplianceReport(c *gin.Context) {
 
 // GetComplianceFrameworks retrieves available compliance frameworks
 func (sh *SecurityHandler) GetComplianceFrameworks(c *gin.Context) {
-	rows, err := sh.db.Query(`
-		SELECT id, name, description, version, enabled, created_at
-		FROM compliance_frameworks 
-		WHERE enabled = true 
-		ORDER BY name
-	`)
-
+	rows, err := sqlcdb.New(sh.db.DB).ListComplianceFrameworks(context.Background())
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get compliance frameworks"})
 		return
 	}
-	defer rows.Close()
 
 	var frameworks []security.ComplianceFramework
-	for rows.Next() {
-		var framework security.ComplianceFramework
-		err := rows.Scan(&framework.ID, &framework.Name, &framework.Description,
-			&framework.Version, &framework.Enabled, &framework.CreatedAt)
-
-		if err != nil {
+	for _, row := range rows {
+		if !row.Description.Valid {
 			continue
 		}
-
-		frameworks = append(frameworks, framework)
+		frameworks = append(frameworks, security.ComplianceFramework{
+			ID:          row.ID.String(),
+			Name:        row.Name,
+			Description: row.Description.String,
+			Version:     row.Version,
+			Enabled:     row.Enabled,
+			CreatedAt:   row.CreatedAt,
+		})
 	}
 
 	c.JSON(http.StatusOK, gin.H{"frameworks": frameworks})
@@ -367,23 +362,19 @@ func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
 		Resolved int `json:"resolved"`
 	}
 
-	err := sh.db.QueryRow(`
-		SELECT 
-			COUNT(*) as total,
-			COUNT(*) FILTER (WHERE severity = 'critical') as critical,
-			COUNT(*) FILTER (WHERE severity = 'high') as high,
-			COUNT(*) FILTER (WHERE severity = 'medium') as medium,
-			COUNT(*) FILTER (WHERE severity = 'low') as low,
-			COUNT(*) FILTER (WHERE status = 'open') as open,
-			COUNT(*) FILTER (WHERE status = 'resolved') as resolved
-		FROM vulnerabilities 
-		WHERE project_id = $1
-	`, projectID).Scan(&vulnMetrics.Total, &vulnMetrics.Critical, &vulnMetrics.High,
-		&vulnMetrics.Medium, &vulnMetrics.Low, &vulnMetrics.Open, &vulnMetrics.Resolved)
+	q := sqlcdb.New(sh.db.DB)
+	mrow, err := q.GetVulnerabilityMetrics(context.Background(), uuid.MustParse(projectID))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get vulnerability metrics"})
 		return
 	}
+	vulnMetrics.Total = int(mrow.Total)
+	vulnMetrics.Critical = int(mrow.Critical)
+	vulnMetrics.High = int(mrow.High)
+	vulnMetrics.Medium = int(mrow.Medium)
+	vulnMetrics.Low = int(mrow.Low)
+	vulnMetrics.Open = int(mrow.Open)
+	vulnMetrics.Resolved = int(mrow.Resolved)
 
 	// Get latest scan
 	var latestScan struct {
@@ -393,13 +384,11 @@ func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
 		Status    string    `json:"status"`
 	}
 
-	err = sh.db.QueryRow(`
-		SELECT id, COALESCE((summary->>'score')::int, 0), started_at as scanned_at, status
-		FROM security_scans
-		WHERE project_id = $1
-		ORDER BY started_at DESC
-		LIMIT 1
-	`, projectID).Scan(&latestScan.ID, &latestScan.Score, &latestScan.ScannedAt, &latestScan.Status)
+	srow, err := q.GetLatestSecurityScan(context.Background(), uuid.MustParse(projectID))
+	latestScan.ID = srow.ID.String()
+	latestScan.Score = int(srow.Score)
+	latestScan.ScannedAt = srow.ScannedAt
+	latestScan.Status = srow.Status
 
 	if err == sql.ErrNoRows {
 		latestScan = struct {
@@ -420,13 +409,10 @@ func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
 		LastAssessed  *time.Time `json:"last_assessed"`
 	}
 
-	err = sh.db.QueryRow(`
-		SELECT overall_status, score, assessment_date
-		FROM compliance_reports 
-		WHERE project_id = $1 
-		ORDER BY assessment_date DESC 
-		LIMIT 1
-	`, projectID).Scan(&complianceStatus.OverallStatus, &complianceStatus.Score, &complianceStatus.LastAssessed)
+	crow, err := q.GetLatestComplianceReport(context.Background(), uuid.MustParse(projectID))
+	complianceStatus.OverallStatus = crow.OverallStatus
+	complianceStatus.Score = int(crow.Score)
+	complianceStatus.LastAssessed = &crow.AssessmentDate
 
 	if err == sql.ErrNoRows {
 		complianceStatus = struct {
@@ -596,21 +582,11 @@ func (sh *SecurityHandler) requireProjectAccess(c *gin.Context, projectID string
 		return "", false
 	}
 
-	var hasAccess bool
-	err := sh.db.QueryRow(
-		`SELECT EXISTS (
-			SELECT 1
-			FROM projects p
-			WHERE p.id = $1
-			  AND (p.is_approved
-				   OR $3::bool
-				   OR p.owner_id = $2 OR EXISTS (
-					SELECT 1 FROM project_members pm
-					WHERE pm.project_id = p.id AND pm.user_id = $2
-			  ))
-		)`,
-		projectID, optionalUserUUID(c), contextIsAdmin(c),
-	).Scan(&hasAccess)
+	hasAccess, err := sqlcdb.New(sh.db.DB).CheckSecurityProjectAccess(context.Background(), sqlcdb.CheckSecurityProjectAccessParams{
+		ID:      uuid.MustParse(projectID),
+		OwnerID: optionalUserUUID(c),
+		Column3: contextIsAdmin(c),
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify project access"})
 		return "", false
@@ -631,7 +607,8 @@ func (sh *SecurityHandler) requireSecurityScanAccess(c *gin.Context, scanID stri
 	}
 
 	var projectID string
-	err := sh.db.QueryRow("SELECT project_id FROM security_scans WHERE id = $1", scanID).Scan(&projectID)
+	pid, err := sqlcdb.New(sh.db.DB).GetSecurityScanProjectID(context.Background(), uuid.MustParse(scanID))
+	projectID = pid.String()
 	if err == sql.ErrNoRows {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Security scan not found"})
 		return false
@@ -652,7 +629,8 @@ func (sh *SecurityHandler) requireComplianceReportAccess(c *gin.Context, reportI
 	}
 
 	var projectID string
-	err := sh.db.QueryRow("SELECT project_id FROM compliance_reports WHERE id = $1", reportID).Scan(&projectID)
+	pid, err := sqlcdb.New(sh.db.DB).GetComplianceReportProjectID(context.Background(), uuid.MustParse(reportID))
+	projectID = pid.String()
 	if err == sql.ErrNoRows {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Compliance report not found"})
 		return false
@@ -673,7 +651,8 @@ func (sh *SecurityHandler) requireVulnerabilityAccess(c *gin.Context, vulnID str
 	}
 
 	var projectID string
-	err := sh.db.QueryRow("SELECT project_id FROM vulnerabilities WHERE id = $1", vulnID).Scan(&projectID)
+	pid, err := sqlcdb.New(sh.db.DB).GetVulnerabilityProjectID(context.Background(), uuid.MustParse(vulnID))
+	projectID = pid.String()
 	if err == sql.ErrNoRows {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Vulnerability not found"})
 		return "", false

app/backend/internal/api/security_test.go

@@ -0,0 +1,212 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"strings"
+	"testing"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/google/uuid"
+)
+
+// Live invariant test against real Postgres — set METRICS_TEST_DSN (or
+// DATABASE_URL). Covers the generated auth/security queries: user upsert
+// conflict path, project-access EXISTS predicate, vulnerability ordering and
+// status update, latest-scan/report lookups, and the framework list.
+func TestSecurityLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	otherID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	scanID := uuid.New()
+	reportID := uuid.New()
+	frameworkID := uuid.New()
+	vulnCrit := uuid.New()
+	vulnLow := uuid.New()
+	suffix := strings.ReplaceAll(userID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test'), ($3, $4, 'x', 'other')`,
+		userID, "sec-"+suffix+"@test.local", otherID, "sec-"+suffix+"[email protected]")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, false)`,
+		projectID, "sec-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type)
+		VALUES ($1, $2, $3, $4, 'web', 'image')`,
+		serviceID, "sec-"+suffix, projectID, envID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id IN ($1, $2)`, userID, otherID) }()
+
+	// Auth queries: upsert conflicts update rather than error, counts see rows.
+	_, err = q.InsertUserAdmin(ctx, sqlcdb.InsertUserAdminParams{
+		Email: "ins-" + suffix + "@test.local", PasswordHash: "x", Name: "ins", IsAdmin: false,
+	})
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE email = $1`, "ins-"+suffix+"@test.local") }()
+	urow, err := q.UpsertLocalUser(ctx, sqlcdb.UpsertLocalUserParams{
+		Email: "ins-" + suffix + "@test.local", PasswordHash: "y", Name: "renamed",
+		Column4: "http://img", IsAdmin: false,
+	})
+	must(err)
+	if urow.Name != "renamed" || urow.AvatarUrl != "http://img" {
+		t.Fatalf("upsert: %+v", urow)
+	}
+	byEmail, err := q.GetUserByEmailForAuth(ctx, "ins-"+suffix+"@test.local")
+	must(err)
+	if byEmail.ID != urow.ID || byEmail.PasswordHash != "x" {
+		t.Fatalf("by email: %+v", byEmail)
+	}
+	count, err := q.CountUsersByEmail(ctx, "ins-"+suffix+"@test.local")
+	must(err)
+	if count != 1 {
+		t.Fatalf("count by email: %d", count)
+	}
+	byID, err := q.GetUserByID(ctx, urow.ID)
+	must(err)
+	if byID.Email != "ins-"+suffix+"@test.local" {
+		t.Fatalf("by id: %+v", byID)
+	}
+
+	// Access predicate: unapproved project is owner/admin/member only.
+	ownerAccess, err := q.CheckSecurityProjectAccess(ctx, sqlcdb.CheckSecurityProjectAccessParams{
+		ID: projectID, OwnerID: userID, Column3: false,
+	})
+	must(err)
+	if !ownerAccess {
+		t.Fatal("owner should have access")
+	}
+	strangerAccess, err := q.CheckSecurityProjectAccess(ctx, sqlcdb.CheckSecurityProjectAccessParams{
+		ID: projectID, OwnerID: otherID, Column3: false,
+	})
+	must(err)
+	if strangerAccess {
+		t.Fatal("stranger should not have access")
+	}
+	adminAccess, err := q.CheckSecurityProjectAccess(ctx, sqlcdb.CheckSecurityProjectAccessParams{
+		ID: projectID, OwnerID: otherID, Column3: true,
+	})
+	must(err)
+	if !adminAccess {
+		t.Fatal("admin should have access")
+	}
+	ownerText, err := q.GetProjectOwnerText(ctx, projectID)
+	must(err)
+	if ownerText != userID.String() {
+		t.Fatalf("owner text: %q", ownerText)
+	}
+	exists, err := q.ServiceExistsInProject(ctx, sqlcdb.ServiceExistsInProjectParams{
+		ID: serviceID, ProjectID: projectID,
+	})
+	must(err)
+	if !exists {
+		t.Fatal("service should exist in project")
+	}
+
+	// Scan/report/vuln rows via raw inserts (fixtures), reads via sqlc.
+	_, err = db.Exec(`INSERT INTO security_scans (id, project_id, service_id, scan_type, status, summary, started_at)
+		VALUES ($1, $2, $3, 'dependency', 'completed', '{"score": 85}', NOW() - interval '1 hour')`,
+		scanID, projectID, serviceID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO compliance_frameworks (id, name, description, version, enabled)
+		VALUES ($1, $2, 'desc', '1.0', true)`,
+		frameworkID, "fw-"+suffix)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM compliance_frameworks WHERE id = $1`, frameworkID) }()
+	_, err = db.Exec(`INSERT INTO compliance_reports (id, project_id, framework_id, overall_status, score, assessment_date)
+		VALUES ($1, $2, $3, 'compliant', 92, NOW() - interval '30 minutes')`,
+		reportID, projectID, frameworkID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM compliance_reports WHERE id = $1`, reportID) }()
+	_, err = db.Exec(`INSERT INTO vulnerabilities (id, type, severity, title, description, service_id, project_id, status, found_at)
+		VALUES ($1, 'dependency', 'low', 'low-v', 'd', $3, $4, 'open', NOW() - interval '2 hours'),
+		       ($2, 'dependency', 'critical', 'crit-v', 'd', $3, $4, 'open', NOW() - interval '1 hour')`,
+		vulnLow, vulnCrit, serviceID, projectID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM vulnerabilities WHERE project_id = $1`, projectID) }()
+	defer func() { _, _ = db.Exec(`DELETE FROM security_scans WHERE id = $1`, scanID) }()
+
+	// Severity ordering: critical first.
+	vulns, err := q.ListVulnerabilities(ctx, projectID)
+	must(err)
+	if len(vulns) != 2 || vulns[0].ID != vulnCrit {
+		t.Fatalf("vuln ordering: %+v", vulns)
+	}
+	metrics, err := q.GetVulnerabilityMetrics(ctx, projectID)
+	must(err)
+	if metrics.Total != 2 || metrics.Critical != 1 || metrics.Low != 1 || metrics.Open != 2 {
+		t.Fatalf("metrics: %+v", metrics)
+	}
+	must(q.UpdateVulnerabilityStatus(ctx, sqlcdb.UpdateVulnerabilityStatusParams{
+		Status:     "resolved",
+		ResolvedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:         vulnCrit,
+	}))
+	metrics, err = q.GetVulnerabilityMetrics(ctx, projectID)
+	must(err)
+	if metrics.Open != 1 || metrics.Resolved != 1 {
+		t.Fatalf("metrics after resolve: %+v", metrics)
+	}
+
+	// Latest scan/report lookups.
+	scan, err := q.GetLatestSecurityScan(ctx, projectID)
+	must(err)
+	if scan.ID != scanID || scan.Score != 85 || scan.Status != "completed" {
+		t.Fatalf("latest scan: %+v", scan)
+	}
+	report, err := q.GetLatestComplianceReport(ctx, projectID)
+	must(err)
+	if report.OverallStatus != "compliant" || report.Score != 92 {
+		t.Fatalf("latest report: %+v", report)
+	}
+
+	// Project-ID lookups used by the access guards.
+	scanPID, err := q.GetSecurityScanProjectID(ctx, scanID)
+	must(err)
+	reportPID, err := q.GetComplianceReportProjectID(ctx, reportID)
+	must(err)
+	vulnPID, err := q.GetVulnerabilityProjectID(ctx, vulnCrit)
+	must(err)
+	if scanPID != projectID || reportPID != projectID || vulnPID != projectID {
+		t.Fatalf("project id lookups: %v %v %v", scanPID, reportPID, vulnPID)
+	}
+
+	// Framework list only returns enabled rows.
+	frameworks, err := q.ListComplianceFrameworks(ctx)
+	must(err)
+	found := false
+	for _, f := range frameworks {
+		if f.ID == frameworkID && f.Enabled {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("enabled framework missing from list")
+	}
+	frameworkExists, err := q.ComplianceFrameworkExists(ctx, frameworkID)
+	must(err)
+	if !frameworkExists {
+		t.Fatal("framework should exist")
+	}
+}

app/backend/internal/api/service_ops.go

@@ -1,11 +1,14 @@
 package api
 
 import (
+	"context"
+	"database/sql"
 	"net/http"
 	"strings"
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -53,11 +56,8 @@ func handleCloneService(c *gin.Context) {
 	if name == "" {
 		name = source.Name + "-copy"
 	}
-	var count int
-	_ = db.(*database.DB).QueryRow(
-		`SELECT COUNT(*) FROM services WHERE project_id = $1 AND name = $2`,
-		targetProjectID, name,
-	).Scan(&count)
+	count, _ := sqlcdb.New(db.(*database.DB).DB).CountServicesByName(
+		c.Request.Context(), sqlcdb.CountServicesByNameParams{ProjectID: targetProjectID, Name: name})
 	if count > 0 {
 		c.JSON(http.StatusConflict, gin.H{"error": "Service name already exists in target project", "code": "CONFLICT"})
 		return
@@ -67,68 +67,74 @@ func handleCloneService(c *gin.Context) {
 	if req.Environment != "" {
 		environment = req.Environment
 	}
-	if environment == "" {
-		environment = "production"
-	}
-	environmentID, err := getProjectEnvironmentID(db.(*database.DB), targetProjectID, environment)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to resolve target environment"})
-		return
-	}
 
-	maintenance, basicAuth := serviceAccess(db.(*database.DB), source.ID)
-	newID := uuid.New()
-	now := time.Now()
-	// string() so pq sends text — []byte would go as bytea and fail ::jsonb.
-	volumesJSON := string(loadServiceVolumesJSON(db.(*database.DB), source.ID))
-
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO services
-			(id, project_id, name, environment_id, service_type, source_type, source_url, image_name,
-				 build_command, start_command, type, status, image, command, environment,
-				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
-				 healthcheck_path, restart_policy, volumes, maintenance_mode, basic_auth_users,
-				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
-				 created_at, updated_at)
-			SELECT $1, $2, $3, $4, service_type, source_type, source_url, image_name,
-				 build_command, start_command, type, 'stopped', image, command, $5,
-				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
-				 healthcheck_path, restart_policy, $6::jsonb, $7, $8,
-				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
-				 $9, $9
-			FROM services WHERE id = $10`,
-		newID, targetProjectID, name, environmentID, environment, volumesJSON,
-		maintenance, basicAuth, now, source.ID,
-	)
+	newID, err := cloneServiceRow(db.(*database.DB), source.ID, targetProjectID, name, environment)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clone service"})
 		return
 	}
 
-	if _, err := db.(*database.DB).Exec(
-		`INSERT INTO service_domains (service_id, domain, is_default, cert_type)
-		 SELECT $1, domain, is_default, cert_type FROM service_domains WHERE service_id = $2`,
-		newID, source.ID,
-	); err != nil {
-		_, _ = db.(*database.DB).Exec(`DELETE FROM services WHERE id = $1`, newID)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clone service domains"})
-		return
-	}
-	// Variable values are copied as stored — ciphertext stays ciphertext.
-	if _, err := db.(*database.DB).Exec(
-		`INSERT INTO environment_variables (id, service_id, key, value, is_secret)
-		 SELECT gen_random_uuid(), $1, key, value, is_secret FROM environment_variables WHERE service_id = $2`,
-		newID, source.ID,
-	); err != nil {
-		_, _ = db.(*database.DB).Exec(`DELETE FROM services WHERE id = $1`, newID)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clone service variables"})
-		return
-	}
-
 	LogAuditWithRequest(c, "service", source.ID.String(), "service.clone", map[string]interface{}{"cloned_to": newID.String(), "name": name})
 	c.JSON(http.StatusCreated, gin.H{"service_id": newID, "name": name, "message": "Service cloned"})
 }
 
+// cloneServiceRow copies a service's full configuration — source, build
+// settings, volumes, access gates, domains, and variables — under a new id
+// in the target project. The clone starts stopped. An empty environment
+// inherits the source's. Used by the clone endpoint and preview
+// environments, which additionally override git_branch and domains.
+func cloneServiceRow(db *database.DB, sourceID uuid.UUID, targetProjectID uuid.UUID, name, environment string) (uuid.UUID, error) {
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	sourceEnv, err := q.GetServiceEnvironment(ctx, sourceID)
+	if err != nil {
+		return uuid.Nil, err
+	}
+	if environment == "" {
+		environment = sourceEnv
+	}
+	if environment == "" {
+		environment = "production"
+	}
+	environmentID, err := getProjectEnvironmentID(db, targetProjectID, environment)
+	if err != nil {
+		return uuid.Nil, err
+	}
+
+	maintenance, basicAuth := serviceAccess(db, sourceID)
+	newID := uuid.New()
+	now := time.Now()
+
+	err = q.CloneServiceRow(ctx, sqlcdb.CloneServiceRowParams{
+		ID:              newID,
+		ProjectID:       targetProjectID,
+		Name:            name,
+		EnvironmentID:   environmentID,
+		Environment:     sql.NullString{String: environment, Valid: true},
+		MaintenanceMode: maintenance,
+		BasicAuthUsers:  basicAuth,
+		CreatedAt:       sql.NullTime{Time: now, Valid: true},
+		ID_2:            sourceID,
+	})
+	if err != nil {
+		return uuid.Nil, err
+	}
+
+	if err := q.CloneServiceDomains(ctx, sqlcdb.CloneServiceDomainsParams{
+		ServiceID: newID, ServiceID_2: sourceID}); err != nil {
+		_ = q.DeleteServiceByID(ctx, newID)
+		return uuid.Nil, err
+	}
+	// Variable values are copied as stored — ciphertext stays ciphertext.
+	if err := q.CloneServiceVariables(ctx, sqlcdb.CloneServiceVariablesParams{
+		ServiceID: newID, ServiceID_2: sourceID}); err != nil {
+		_ = q.DeleteServiceByID(ctx, newID)
+		return uuid.Nil, err
+	}
+	return newID, nil
+}
+
 type MoveServiceRequest struct {
 	ProjectID uuid.UUID `json:"project_id" binding:"required"`
 }
@@ -169,11 +175,8 @@ func handleMoveService(c *gin.Context) {
 		return
 	}
 
-	var count int
-	_ = db.(*database.DB).QueryRow(
-		`SELECT COUNT(*) FROM services WHERE project_id = $1 AND name = $2`,
-		req.ProjectID, service.Name,
-	).Scan(&count)
+	count, _ := sqlcdb.New(db.(*database.DB).DB).CountServicesByName(
+		c.Request.Context(), sqlcdb.CountServicesByNameParams{ProjectID: req.ProjectID, Name: service.Name})
 	if count > 0 {
 		c.JSON(http.StatusConflict, gin.H{"error": "A service with this name already exists in the target project", "code": "CONFLICT"})
 		return
@@ -189,15 +192,18 @@ func handleMoveService(c *gin.Context) {
 		return
 	}
 
-	res, err := db.(*database.DB).Exec(
-		`UPDATE services SET project_id = $1, environment_id = $2, updated_at = $3 WHERE id = $4`,
-		req.ProjectID, environmentID, time.Now(), serviceID,
-	)
+	n, err := sqlcdb.New(db.(*database.DB).DB).MoveServiceProject(
+		c.Request.Context(), sqlcdb.MoveServiceProjectParams{
+			ProjectID:     req.ProjectID,
+			EnvironmentID: environmentID,
+			UpdatedAt:     sql.NullTime{Time: time.Now(), Valid: true},
+			ID:            serviceID,
+		})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to move service"})
 		return
 	}
-	if n, _ := res.RowsAffected(); n == 0 {
+	if n == 0 {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found", "code": "NOT_FOUND"})
 		return
 	}
@@ -211,16 +217,10 @@ func ownsProject(db *database.DB, projectID uuid.UUID, userID string, isAdmin bo
 	if isAdmin {
 		return true
 	}
-	var owner string
-	err := db.QueryRow(`SELECT owner_id FROM projects WHERE id = $1`, projectID).Scan(&owner)
-	return err == nil && owner == userID
-}
-
-// loadServiceVolumesJSON returns the raw stored mounts for a verbatim copy.
-func loadServiceVolumesJSON(db *database.DB, serviceID uuid.UUID) []byte {
-	var raw []byte
-	if err := db.QueryRow(`SELECT volumes FROM services WHERE id = $1`, serviceID).Scan(&raw); err != nil || len(raw) == 0 {
-		return []byte("[]")
+	uid, err := uuid.Parse(userID)
+	if err != nil {
+		return false
 	}
-	return raw
+	owner, err := sqlcdb.New(db.DB).GetProjectOwner(context.Background(), projectID)
+	return err == nil && owner == uid
 }

app/backend/internal/api/services.go

@@ -2,12 +2,15 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"context"
+	"database/sql"
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"regexp"
 	"strings"
 	"time"
 
@@ -48,19 +51,171 @@ type Service struct {
 	StaticDir        string          `json:"static_dir,omitempty" db:"static_dir"`
 	SleepEnabled     bool            `json:"sleep_enabled" db:"-"`
 	SleepIdleMinutes int             `json:"sleep_idle_minutes" db:"-"`
-	CreatedAt        time.Time       `json:"created_at" db:"created_at"`
-	UpdatedAt        time.Time       `json:"updated_at" db:"updated_at"`
+	// NodeID pins the service to a node agent ("" = local Docker host,
+	// resolved "auto" picks the least-loaded online agent at write time).
+	NodeID   string `json:"node_id,omitempty" db:"-"`
+	NodeName string `json:"node_name,omitempty" db:"-"`
+	// Spread distributes replicas across every online, schedulable agent.
+	// Mutually exclusive with an explicit NodeID pin.
+	Spread bool `json:"spread" db:"-"`
+	// PlacementTags restrict auto/spread candidates to agents carrying all
+	// listed tags. An explicit pin overrides them — pin + tags is rejected.
+	PlacementTags []string `json:"placement_tags,omitempty" db:"-"`
+	// TraefikLabels holds per-service middleware overrides —
+	// "middlewares.<name>.<type>.<field>" → value. Lazy-read.
+	TraefikLabels map[string]string `json:"traefik_labels,omitempty" db:"-"`
+	CreatedAt     time.Time         `json:"created_at" db:"created_at"`
+	UpdatedAt     time.Time         `json:"updated_at" db:"updated_at"`
 }
 
 // loadServiceSleep fills the sleep-mode columns, which live outside the
 // wide service SELECTs. Missing columns (pre-migration) degrade to off.
 func loadServiceSleep(db *database.DB, s *Service) {
-	var idle int
-	if err := db.QueryRow(
-		`SELECT COALESCE(sleep_enabled, false), COALESCE(sleep_idle_minutes, 15) FROM services WHERE id = $1`,
-		s.ID,
-	).Scan(&s.SleepEnabled, &idle); err == nil {
-		s.SleepIdleMinutes = idle
+	row, err := sqlcdb.New(db.DB).GetServiceSleep(context.Background(), s.ID)
+	if err == nil {
+		s.SleepEnabled = row.SleepEnabled
+		s.SleepIdleMinutes = int(row.SleepIdleMinutes)
+	}
+}
+
+// serviceNodeID reads the pin column directly — kept out of the wide service
+// SELECTs so pre-migration schemas keep working.
+func serviceNodeID(db *database.DB, serviceID uuid.UUID) string {
+	id, err := sqlcdb.New(db.DB).GetServiceNodeID(context.Background(), serviceID)
+	if err == nil {
+		return id.String
+	}
+	return ""
+}
+
+// serviceSpread reads the spread column with the same lazy pattern.
+func serviceSpread(db *database.DB, serviceID uuid.UUID) bool {
+	spread, err := sqlcdb.New(db.DB).GetServiceSpread(context.Background(), serviceID)
+	return err == nil && spread
+}
+
+// servicePlacementTags reads the placement_tags column with the lazy pattern.
+func servicePlacementTags(db *database.DB, serviceID uuid.UUID) []string {
+	raw, err := sqlcdb.New(db.DB).GetServicePlacementTags(context.Background(), serviceID)
+	if err != nil {
+		return nil
+	}
+	var tags []string
+	if err := json.Unmarshal(raw, &tags); err != nil {
+		return nil
+	}
+	return tags
+}
+
+// normalizePlacementTags trims, lowercases, and dedupes tag input. Tags are
+// matched verbatim against node_agents.tags.
+func normalizePlacementTags(tags []string) []string {
+	seen := map[string]bool{}
+	out := make([]string, 0, len(tags))
+	for _, t := range tags {
+		t = strings.ToLower(strings.TrimSpace(t))
+		if t == "" || seen[t] {
+			continue
+		}
+		seen[t] = true
+		out = append(out, t)
+	}
+	return out
+}
+
+// traefikLabelKey matches "middlewares.<name>.<type>" with an optional
+// ".<subkey>" tail — e.g. "middlewares.rl.ratelimit.average".
+var traefikLabelKey = regexp.MustCompile(`^middlewares\.([A-Za-z0-9][A-Za-z0-9_-]{0,39})\.([A-Za-z]+)(\.[A-Za-z0-9_.*+-]+)?$`)
+
+// traefikMiddlewareTypes are the Traefik middleware kinds a service may
+// define. Router/service/provider-level keys are never accepted — those
+// would let a tenant hijack someone else's routing.
+var traefikMiddlewareTypes = map[string]bool{
+	"addprefix": true, "basicauth": true, "buffering": true, "chain": true,
+	"circuitbreaker": true, "compress": true, "digestauth": true,
+	"errors": true, "forwardauth": true, "grpcweb": true, "headers": true,
+	"inflightreq": true, "ipallowlist": true, "ipwhitelist": true,
+	"passtlsclientcert": true, "ratelimit": true, "redirectregex": true,
+	"redirectscheme": true, "replacepath": true, "replacepathregex": true,
+	"retry": true, "stripprefix": true, "stripprefixregex": true,
+}
+
+// normalizeTraefikLabels validates a raw override map. Returns the cleaned
+// map (middleware type lowercased — Traefik label keys are canonical-lower)
+// or an error naming the offending key.
+func normalizeTraefikLabels(raw map[string]string) (map[string]string, error) {
+	if len(raw) > 32 {
+		return nil, fmt.Errorf("traefik_labels: at most 32 entries (got %d)", len(raw))
+	}
+	out := make(map[string]string, len(raw))
+	names := map[string]bool{}
+	for k, v := range raw {
+		m := traefikLabelKey.FindStringSubmatch(k)
+		if m == nil {
+			return nil, fmt.Errorf("traefik_labels: invalid key %q — want middlewares.<name>.<type>[.<field>]", k)
+		}
+		mwType := strings.ToLower(m[2])
+		if !traefikMiddlewareTypes[mwType] {
+			return nil, fmt.Errorf("traefik_labels: unsupported middleware type %q", m[2])
+		}
+		if len(v) == 0 {
+			return nil, fmt.Errorf("traefik_labels: %q has an empty value", k)
+		}
+		if len(v) > 512 || strings.ContainsAny(v, "\r\n") {
+			return nil, fmt.Errorf("traefik_labels: %q value must be a single line under 512 chars", k)
+		}
+		out["middlewares."+m[1]+"."+mwType+m[3]] = v
+		names[m[1]] = true
+	}
+	if len(names) > 16 {
+		return nil, fmt.Errorf("traefik_labels: at most 16 middleware names")
+	}
+	return out, nil
+}
+
+// serviceTraefikLabels lazy-reads the traefik_labels column.
+func serviceTraefikLabels(db *database.DB, serviceID uuid.UUID) map[string]string {
+	raw, err := sqlcdb.New(db.DB).GetServiceTraefikLabels(context.Background(), serviceID)
+	if err != nil {
+		return nil
+	}
+	var labels map[string]string
+	if err := json.Unmarshal(raw, &labels); err != nil || len(labels) == 0 {
+		return nil
+	}
+	return labels
+}
+
+// traefikLabelsJSON marshals an override map for the jsonb column.
+func traefikLabelsJSON(labels map[string]string) []byte {
+	if len(labels) == 0 {
+		return []byte("{}")
+	}
+	raw, _ := json.Marshal(labels)
+	return raw
+}
+
+// tagsJSON marshals a tag list for a jsonb column; empty stays an array, not null.
+func tagsJSON(tags []string) []byte {
+	if len(tags) == 0 {
+		return []byte("[]")
+	}
+	raw, _ := json.Marshal(tags)
+	return raw
+}
+
+// loadServiceNode fills the pin + spread + placement tags + the agent's
+// display name for responses.
+func loadServiceNode(db *database.DB, s *Service) {
+	s.NodeID = serviceNodeID(db, s.ID)
+	s.Spread = serviceSpread(db, s.ID)
+	s.PlacementTags = servicePlacementTags(db, s.ID)
+	s.TraefikLabels = serviceTraefikLabels(db, s.ID)
+	if s.NodeID == "" {
+		return
+	}
+	if name, err := sqlcdb.New(db.DB).GetNodeAgentName(context.Background(), s.NodeID); err == nil {
+		s.NodeName = name
 	}
 }
 
@@ -75,8 +230,8 @@ type ServiceVolume struct {
 // loadServiceVolumes reads the JSONB column; absent/invalid data degrades
 // to no mounts rather than failing the request.
 func loadServiceVolumes(db *database.DB, serviceID uuid.UUID) []deployment.VolumeMount {
-	var raw []byte
-	if err := db.QueryRow(`SELECT volumes FROM services WHERE id = $1`, serviceID).Scan(&raw); err != nil {
+	raw, err := sqlcdb.New(db.DB).GetServiceVolumes(context.Background(), serviceID)
+	if err != nil {
 		return nil
 	}
 	var stored []ServiceVolume
@@ -141,6 +296,23 @@ type CreateServiceRequest struct {
 	MemoryReserve   string          `json:"memory_reserve"`
 	StaticBuildCmd  string          `json:"static_build_cmd"`
 	StaticDir       string          `json:"static_dir"`
+	// SleepEnabled/SleepIdleMinutes opt the service into scale-to-zero at
+	// create time — previously update-only, which surprised API/CLI users.
+	SleepEnabled     *bool `json:"sleep_enabled"`
+	SleepIdleMinutes *int  `json:"sleep_idle_minutes"`
+	// NodeID pins placement to a node agent; "auto" picks the least-loaded
+	// online agent, "local"/"" runs on the Containr host.
+	NodeID string `json:"node_id"`
+	// Spread distributes replicas across every online, schedulable agent.
+	// Mutually exclusive with an explicit node pin.
+	Spread *bool `json:"spread"`
+	// PlacementTags restrict auto/spread candidates to agents carrying all
+	// listed tags. Mutually exclusive with an explicit node pin.
+	PlacementTags []string `json:"placement_tags"`
+	// TraefikLabels defines extra Traefik middlewares for this service's
+	// router — keys "middlewares.<name>.<type>[.<field>]", validated against
+	// an allowlist. Defined middlewares attach to the router automatically.
+	TraefikLabels map[string]string `json:"traefik_labels"`
 }
 
 // UpdateServiceRequest represents a request to update a service
@@ -170,6 +342,18 @@ type UpdateServiceRequest struct {
 	StaticDir        *string          `json:"static_dir"`
 	SleepEnabled     *bool            `json:"sleep_enabled"`
 	SleepIdleMinutes *int             `json:"sleep_idle_minutes"`
+	// NodeID pins placement; pointer so "local"/"" explicitly clears the pin.
+	NodeID *string `json:"node_id"`
+	// Spread toggles multi-node replica distribution; pointer so false is
+	// a real update, not a missing field.
+	Spread *bool `json:"spread"`
+	// PlacementTags restrict auto/spread candidates to agents carrying all
+	// listed tags; pointer so [] clears the requirement. Mutually exclusive
+	// with an explicit node pin.
+	PlacementTags *[]string `json:"placement_tags"`
+	// TraefikLabels replaces the service's middleware overrides; pointer so
+	// {} clears them and nil leaves them untouched.
+	TraefikLabels *map[string]string `json:"traefik_labels"`
 }
 
 // handleGetServices retrieves all services for a project
@@ -253,6 +437,7 @@ func handleGetServices(c *gin.Context) {
 	// Reconcile stored status with live container state (no-op without Docker).
 	for i := range services {
 		liveServiceStatus(c, db.(*database.DB), &services[i])
+		loadServiceNode(db.(*database.DB), &services[i])
 	}
 
 	c.JSON(http.StatusOK, gin.H{"services": services})
@@ -372,6 +557,14 @@ func handleCreateService(c *gin.Context) {
 	if service.Builder == "static" && service.StaticDir == "" {
 		service.StaticDir = "dist"
 	}
+	if len(req.TraefikLabels) > 0 {
+		labels, err := normalizeTraefikLabels(req.TraefikLabels)
+		if err != nil {
+			respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
+			return
+		}
+		service.TraefikLabels = labels
+	}
 	for label, check := range map[string]func(string) error{
 		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
 		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
@@ -409,6 +602,39 @@ func handleCreateService(c *gin.Context) {
 
 	sourceType := inferServiceSourceType(service)
 
+	if req.SleepEnabled != nil {
+		service.SleepEnabled = *req.SleepEnabled
+	}
+	if req.SleepIdleMinutes != nil {
+		if *req.SleepIdleMinutes < 1 || *req.SleepIdleMinutes > 1440 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "sleep_idle_minutes must be 1-1440", "code": "VALIDATION"})
+			return
+		}
+		service.SleepIdleMinutes = *req.SleepIdleMinutes
+	}
+	if req.Spread != nil {
+		service.Spread = *req.Spread
+	}
+	service.PlacementTags = normalizePlacementTags(req.PlacementTags)
+	if req.NodeID != "" {
+		if service.Spread && req.NodeID != "auto" && req.NodeID != "local" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "spread and an explicit node pin are mutually exclusive", "code": "VALIDATION"})
+			return
+		}
+		if len(service.PlacementTags) > 0 && req.NodeID != "auto" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "placement tags only apply to remote placement — set node_id=\"auto\" or omit it", "code": "VALIDATION"})
+			return
+		}
+		nodeID, nodeErr := resolveNodePin(c.Request.Context(), db.(*database.DB), req.NodeID, service.PlacementTags)
+		if nodeErr != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": nodeErr.Error(), "code": "VALIDATION"})
+			return
+		}
+		if !service.Spread {
+			service.NodeID = nodeID
+		}
+	}
+
 	// Insert service into database
 	_, err = db.(*database.DB).Exec(
 		`INSERT INTO services
@@ -417,16 +643,24 @@ func handleCreateService(c *gin.Context) {
 				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
 				 healthcheck_path, restart_policy, volumes,
 				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
-				 created_at, updated_at)
+				 node_id, spread, placement_tags, sleep_enabled, sleep_idle_minutes,
+				 traefik_labels, created_at, updated_at)
 			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26,
-					$27, $28, $29, $30, $31, $32, $33)`,
+					$27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39)`,
 		service.ID, service.ProjectID, service.Name, environmentID, service.Type,
 		sourceType, firstNonEmpty(service.GitRepo, service.Image), service.Image,
 		"", service.Command, service.Type, service.Status, service.Image, service.Command,
 		service.Environment, service.GitRepo, service.GitBranch, service.BuildPath, service.CPU, service.Memory,
 		service.Replicas, service.Port, service.Domain, service.HealthCheckPath, service.RestartPolicy,
 		volumesJSON, service.Builder, service.CPUReserve, service.MemoryReserve,
-		service.StaticBuildCmd, service.StaticDir, service.CreatedAt, service.UpdatedAt,
+		service.StaticBuildCmd, service.StaticDir,
+		sql.NullString{String: service.NodeID, Valid: service.NodeID != ""},
+		service.Spread,
+		tagsJSON(service.PlacementTags),
+		service.SleepEnabled,
+		sql.NullInt32{Int32: int32(service.SleepIdleMinutes), Valid: service.SleepIdleMinutes > 0},
+		traefikLabelsJSON(service.TraefikLabels),
+		service.CreatedAt, service.UpdatedAt,
 	)
 
 	if err != nil {
@@ -456,19 +690,19 @@ func handleCreateService(c *gin.Context) {
 
 	LogAuditWithRequest(c, "service", service.ID.String(), "create", map[string]interface{}{
 		"name": service.Name, "type": service.Type, "project_id": service.ProjectID,
+		"node_id": service.NodeID,
 	})
+	loadServiceNode(db.(*database.DB), &service)
 
 	c.JSON(http.StatusCreated, gin.H{"service": service})
 }
 
 func getProjectEnvironmentID(db *database.DB, projectID uuid.UUID, environment string) (uuid.UUID, error) {
-	var environmentID uuid.UUID
-	err := db.QueryRow(
-		"SELECT id FROM environments WHERE project_id = $1 AND name = $2",
-		projectID,
-		environment,
-	).Scan(&environmentID)
-	return environmentID, err
+	row, err := sqlcdb.New(db.DB).GetProjectEnvironmentByName(context.Background(), sqlcdb.GetProjectEnvironmentByNameParams{
+		ProjectID: projectID,
+		Name:      environment,
+	})
+	return row.ID, err
 }
 
 func inferServiceSourceType(service Service) string {
@@ -547,6 +781,7 @@ func handleGetService(c *gin.Context) {
 	}
 	service.Domains = loadServiceDomains(db.(*database.DB), service.ID)
 	loadServiceSleep(db.(*database.DB), &service)
+	loadServiceNode(db.(*database.DB), &service)
 	maintenance, basicAuth := serviceAccess(db.(*database.DB), service.ID)
 	service.MaintenanceMode = maintenance
 	service.BasicAuth = basicAuthUsernames(basicAuth)
@@ -699,6 +934,16 @@ func handleUpdateService(c *gin.Context) {
 		}
 		existingService.SleepIdleMinutes = *req.SleepIdleMinutes
 	}
+	if req.TraefikLabels != nil {
+		labels, err := normalizeTraefikLabels(*req.TraefikLabels)
+		if err != nil {
+			respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
+			return
+		}
+		existingService.TraefikLabels = labels
+	} else {
+		existingService.TraefikLabels = serviceTraefikLabels(db.(*database.DB), serviceID)
+	}
 	for label, check := range map[string]func(string) error{
 		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
 		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
@@ -725,6 +970,44 @@ func handleUpdateService(c *gin.Context) {
 		volumesArg = volumesJSON
 	}
 
+	if req.Spread != nil {
+		existingService.Spread = *req.Spread
+	} else {
+		existingService.Spread = serviceSpread(db.(*database.DB), serviceID)
+	}
+	if req.PlacementTags != nil {
+		existingService.PlacementTags = normalizePlacementTags(*req.PlacementTags)
+	} else {
+		existingService.PlacementTags = servicePlacementTags(db.(*database.DB), serviceID)
+	}
+	if req.NodeID != nil {
+		nodeValue := strings.TrimSpace(*req.NodeID)
+		if existingService.Spread && nodeValue != "" && nodeValue != "auto" && nodeValue != "local" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "spread and an explicit node pin are mutually exclusive — set spread=false first", "code": "VALIDATION"})
+			return
+		}
+		if len(existingService.PlacementTags) > 0 && nodeValue != "" && nodeValue != "auto" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "service has placement tags — clear them (placement_tags=[]) before pinning or going local", "code": "VALIDATION"})
+			return
+		}
+		nodeID, nodeErr := resolveNodePin(c.Request.Context(), db.(*database.DB), nodeValue, existingService.PlacementTags)
+		if nodeErr != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": nodeErr.Error(), "code": "VALIDATION"})
+			return
+		}
+		existingService.NodeID = nodeID
+	} else {
+		existingService.NodeID = serviceNodeID(db.(*database.DB), serviceID)
+	}
+	if existingService.Spread && existingService.NodeID != "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "service already has an explicit node pin — clear it (node_id=\"local\") before enabling spread", "code": "VALIDATION"})
+		return
+	}
+	if len(existingService.PlacementTags) > 0 && existingService.NodeID != "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "service already has an explicit node pin — clear it (node_id=\"local\") before setting placement tags", "code": "VALIDATION"})
+		return
+	}
+
 	existingService.UpdatedAt = time.Now()
 
 	// Update service in database
@@ -736,7 +1019,8 @@ func handleUpdateService(c *gin.Context) {
 				restart_policy = $15, volumes = COALESCE($17::jsonb, volumes), updated_at = $16,
 				builder = $19, cpu_reserve = $20, memory_reserve = $21,
 				static_build_cmd = $22, static_dir = $23,
-				sleep_enabled = $24, sleep_idle_minutes = $25
+				sleep_enabled = $24, sleep_idle_minutes = $25, node_id = $26, spread = $27,
+				placement_tags = $28::jsonb, traefik_labels = $29::jsonb
 			WHERE id = $18`,
 		existingService.Name, existingService.Type, existingService.Image, existingService.Command,
 		existingService.Environment, existingService.GitRepo, existingService.GitBranch,
@@ -747,6 +1031,10 @@ func handleUpdateService(c *gin.Context) {
 		existingService.Builder, existingService.CPUReserve, existingService.MemoryReserve,
 		existingService.StaticBuildCmd, existingService.StaticDir,
 		existingService.SleepEnabled, existingService.SleepIdleMinutes,
+		sql.NullString{String: existingService.NodeID, Valid: existingService.NodeID != ""},
+		existingService.Spread,
+		tagsJSON(existingService.PlacementTags),
+		traefikLabelsJSON(existingService.TraefikLabels),
 	)
 
 	if err != nil {
@@ -816,6 +1104,7 @@ func handleUpdateService(c *gin.Context) {
 		}
 	}
 
+	loadServiceNode(db.(*database.DB), &existingService)
 	c.JSON(http.StatusOK, gin.H{"service": existingService})
 }
 
@@ -865,7 +1154,7 @@ func handleDeleteService(c *gin.Context) {
 	// Remove runtime containers before dropping the row.
 	if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
 		if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
-			_ = engine.RemoveServiceContainers(c.Request.Context(), serviceID.String())
+			removeServiceRuntime(c.Request.Context(), db.(*database.DB), engine, serviceID)
 		}
 	}
 

app/backend/internal/api/services_routing_test.go

@@ -0,0 +1,64 @@
+package api
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestNormalizeTraefikLabels(t *testing.T) {
+	valid := map[string]string{
+		"middlewares.rl.ratelimit.average":                             "100",
+		"middlewares.rl.ratelimit.period":                              "1m",
+		"middlewares.sec.headers.customrequestheaders.X-Frame-Options": "DENY",
+		"middlewares.gzip.compress":                                    "true",
+	}
+	out, err := normalizeTraefikLabels(valid)
+	if err != nil {
+		t.Fatalf("valid labels rejected: %v", err)
+	}
+	if len(out) != len(valid) {
+		t.Fatalf("expected %d labels, got %d", len(valid), len(out))
+	}
+	if out["middlewares.gzip.compress"] != "true" {
+		t.Fatalf("flag-style middleware missing: %v", out)
+	}
+}
+
+func TestNormalizeTraefikLabelsLowercasesType(t *testing.T) {
+	out, err := normalizeTraefikLabels(map[string]string{
+		"middlewares.rl.RateLimit.average": "10",
+	})
+	if err != nil {
+		t.Fatalf("mixed-case type rejected: %v", err)
+	}
+	if out["middlewares.rl.ratelimit.average"] != "10" {
+		t.Fatalf("type not lowercased: %v", out)
+	}
+}
+
+func TestNormalizeTraefikLabelsRejects(t *testing.T) {
+	cases := map[string]string{
+		"traefik.enable":                                 "true", // provider-level
+		"middlewares..ratelimit.average":                 "1",    // empty name
+		"middlewares.x.evilinject.thing":                 "1",    // unknown type
+		"routers.svc.rule":                               "x",    // router hijack
+		"middlewares.x.ratelimit.average.bad\ninjection": "1",    // control char in key fails regex
+	}
+	for k, v := range cases {
+		if _, err := normalizeTraefikLabels(map[string]string{k: v}); err == nil {
+			t.Fatalf("key %q should have been rejected", k)
+		}
+	}
+}
+
+func TestNormalizeTraefikLabelsRejectsBadValues(t *testing.T) {
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": ""}); err == nil {
+		t.Fatal("empty value accepted")
+	}
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": strings.Repeat("x", 600)}); err == nil {
+		t.Fatal("oversized value accepted")
+	}
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": "1\nmalicious"}); err == nil {
+		t.Fatal("newline value accepted")
+	}
+}

app/backend/internal/api/settings.go

@@ -10,11 +10,13 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/docker"
 
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/registry"
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 )
 
 // Platform setting keys. Values stored in app_settings take precedence over
@@ -70,8 +72,7 @@ func handleGetBranding(c *gin.Context) {
 // then the caller's default.
 func settingValue(db *database.DB, key, envKey, fallback string) string {
 	if db != nil && db.DB != nil {
-		var value string
-		err := db.QueryRow(`SELECT value FROM app_settings WHERE key = $1`, key).Scan(&value)
+		value, err := sqlcdb.New(db.DB).GetAppSetting(context.Background(), key)
 		if err == nil {
 			return value
 		}
@@ -88,18 +89,15 @@ func settingValue(db *database.DB, key, envKey, fallback string) string {
 }
 
 func setSetting(db *database.DB, key, value string, secret bool) error {
-	_, err := db.Exec(`
-		INSERT INTO app_settings (key, value, is_secret, updated_at)
-		VALUES ($1, $2, $3, NOW())
-		ON CONFLICT (key) DO UPDATE
-		SET value = EXCLUDED.value, is_secret = EXCLUDED.is_secret, updated_at = NOW()
-	`, key, value, secret)
-	return err
+	return sqlcdb.New(db.DB).UpsertAppSetting(context.Background(), sqlcdb.UpsertAppSettingParams{
+		Key:      key,
+		Value:    value,
+		IsSecret: secret,
+	})
 }
 
 func deleteSetting(db *database.DB, key string) error {
-	_, err := db.Exec(`DELETE FROM app_settings WHERE key = $1`, key)
-	return err
+	return sqlcdb.New(db.DB).DeleteAppSetting(context.Background(), key)
 }
 
 // signupEnabled controls whether public registration stays open after the
@@ -110,11 +108,12 @@ func signupEnabled(db *database.DB) bool {
 }
 
 func isAdminUser(db *database.DB, userID string) bool {
-	var isAdmin bool
-	if err := db.QueryRow(`SELECT is_admin FROM users WHERE id = $1`, userID).Scan(&isAdmin); err != nil {
+	parsed, err := uuid.Parse(userID)
+	if err != nil {
 		return false
 	}
-	return isAdmin
+	isAdmin, err := sqlcdb.New(db.DB).GetUserIsAdmin(context.Background(), parsed)
+	return err == nil && isAdmin
 }
 
 func requireAdmin(c *gin.Context) (*database.DB, bool) {
@@ -242,8 +241,7 @@ func handleUpdateSettings(c *gin.Context) {
 // resolvedTunnelToken prefers the in-app value and falls back to the env.
 func resolvedTunnelToken(db *database.DB) (string, string) {
 	if db != nil && db.DB != nil {
-		var value string
-		if err := db.QueryRow(`SELECT value FROM app_settings WHERE key = $1`, settingCloudflareTunnelToken).Scan(&value); err == nil && strings.TrimSpace(value) != "" {
+		if value, err := sqlcdb.New(db.DB).GetAppSetting(context.Background(), settingCloudflareTunnelToken); err == nil && strings.TrimSpace(value) != "" {
 			return strings.TrimSpace(value), "app"
 		}
 	}

app/backend/internal/api/setup.go

@@ -0,0 +1,79 @@
+package api
+
+// First-run setup wizard state. GET /setup/status is public so the web
+// shell can redirect fresh installs before a session exists; the flag
+// lives in app_settings so it survives restarts.
+
+import (
+	"context"
+	"net/http"
+	"strings"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/gin-gonic/gin"
+)
+
+const settingSetupCompleted = "setup_completed"
+
+// setupComplete resolves the flag. Installs that predate the wizard
+// (users + projects already exist) auto-complete — nobody who has been
+// running Containr for months should get a welcome screen.
+func setupComplete(db *database.DB, hasUsers bool) bool {
+	if strings.EqualFold(settingValue(db, settingSetupCompleted, "", ""), "true") {
+		return true
+	}
+	if !hasUsers {
+		return false
+	}
+	if projects, err := sqlcdb.New(db.DB).CountProjects(context.Background()); err == nil && projects > 0 {
+		return true
+	}
+	return false
+}
+
+// GET /api/v1/setup/status — public: fresh installs hit it before any
+// session exists.
+func handleSetupStatus(c *gin.Context) {
+	db, ok := c.MustGet("db").(*database.DB)
+	if !ok {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Database connection not available")
+		return
+	}
+	count, err := countLocalUsers(db)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to inspect setup state")
+		return
+	}
+	hasUsers := count > 0
+	completed := setupComplete(db, hasUsers)
+	tunnelToken, _ := resolvedTunnelToken(db)
+	c.JSON(http.StatusOK, gin.H{
+		"has_users":       hasUsers,
+		"setup_completed": completed,
+		"needs_setup":     !completed,
+		"has_github_app":  githubAppConfigured(db),
+		"has_tunnel":      tunnelToken != "",
+		"signup_enabled":  signupEnabled(db),
+	})
+}
+
+// POST /api/v1/setup/complete — marks the wizard done. Open to any
+// authenticated user: the first account is the owner, and the flag only
+// suppresses a banner.
+func handleSetupComplete(c *gin.Context) {
+	if _, ok := requireAuthenticatedUserID(c); !ok {
+		return
+	}
+	db, ok := c.MustGet("db").(*database.DB)
+	if !ok {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Database connection not available")
+		return
+	}
+	if err := setSetting(db, settingSetupCompleted, "true", false); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to save setup state")
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "Setup completed"})
+}

app/backend/internal/api/sleeper.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/docker"
 
@@ -85,22 +86,32 @@ type sleepCandidate struct {
 }
 
 func sweepSleeping(ctx context.Context, db *database.DB, dc *docker.Client, engine *deployment.DeploymentEngine, apiPort int) {
-	rows, err := db.QueryContext(ctx,
-		`SELECT id, project_id, name, COALESCE(status,''), COALESCE(sleep_idle_minutes,15)
-		 FROM services WHERE sleep_enabled AND COALESCE(status,'') IN ('running','deployed','degraded','starting')`)
+	sweepRows, err := sqlcdb.New(db.DB).ListSleepCandidates(ctx)
 	if err != nil {
 		return
 	}
 	var candidates []sleepCandidate
-	for rows.Next() {
-		var s sleepCandidate
-		if err := rows.Scan(&s.ID, &s.ProjectID, &s.Name, &s.Status, &s.IdleMinutes); err == nil {
-			candidates = append(candidates, s)
-		}
+	for _, r := range sweepRows {
+		candidates = append(candidates, sleepCandidate{
+			ID: r.ID, ProjectID: r.ProjectID, Name: r.Name,
+			Status: r.Status, IdleMinutes: int(r.SleepIdleMinutes),
+		})
 	}
-	rows.Close()
 
+	q := sqlcdb.New(db.DB)
 	for _, svc := range candidates {
+		// Remote replicas live in inventory, not the local docker host —
+		// idleness comes from heartbeat-reported net counters instead.
+		if remote := remoteLiveContainers(ctx, q, svc.ID.String()); len(remote) > 0 {
+			var total uint64
+			for _, row := range remote {
+				total += rowNetBytes(row)
+			}
+			if markIdle(svc.ID, total, time.Duration(svc.IdleMinutes)*time.Minute) {
+				putToSleepRemote(ctx, db, q, svc, apiPort)
+			}
+			continue
+		}
 		containers, err := engine.ListServiceContainers(ctx, svc.ID.String())
 		if err != nil || len(containers) == 0 {
 			continue
@@ -125,6 +136,64 @@ func sweepSleeping(ctx context.Context, db *database.DB, dc *docker.Client, engi
 	}
 }
 
+// remoteLiveContainers returns inventory rows whose replicas are alive on
+// node agents — the signal that idleness must be measured remotely.
+func remoteLiveContainers(ctx context.Context, q *sqlcdb.Queries, serviceID string) []sqlcdb.ListServiceContainersRow {
+	rows, err := q.ListServiceContainers(ctx, serviceID)
+	if err != nil {
+		return nil
+	}
+	live := rows[:0]
+	for _, row := range rows {
+		var st struct {
+			State string `json:"state"`
+		}
+		if err := json.Unmarshal(row.Status.RawMessage, &st); err == nil &&
+			st.State != "" && st.State != "removed" && st.State != "sleeping" {
+			live = append(live, row)
+		}
+	}
+	return live
+}
+
+// rowNetBytes reads the cumulative rx+tx the agent reported at its last
+// heartbeat — 0 for rows written before the counter existed.
+func rowNetBytes(row sqlcdb.ListServiceContainersRow) uint64 {
+	var res struct {
+		NetBytes uint64 `json:"net_bytes"`
+	}
+	_ = json.Unmarshal(row.Resources.RawMessage, &res)
+	return res.NetBytes
+}
+
+// putToSleepRemote removes the service's remote replicas via their agents,
+// marks the service sleeping, and repoints the domain route at the wake
+// endpoint so inbound traffic brings it back.
+func putToSleepRemote(ctx context.Context, db *database.DB, q *sqlcdb.Queries, svc sleepCandidate, apiPort int) {
+	runner := newAgentNodeRunner(db)
+	for _, agentID := range remoteAgentsForService(ctx, db, svc.ID) {
+		if err := runner.ControlService(ctx, svc.ID.String(), agentID, "remove"); err != nil {
+			log.Printf("sleep: remote remove on %s failed: %v", agentID, err)
+			continue
+		}
+		_ = q.DeleteServiceContainersOnAgent(ctx, sqlcdb.DeleteServiceContainersOnAgentParams{
+			NodeAgentID: agentID,
+			ServiceID:   svc.ID.String(),
+		})
+	}
+	tracker.mu.Lock()
+	delete(tracker.activity, svc.ID)
+	tracker.mu.Unlock()
+	setServiceStatusNow(db, svc.ID, "sleeping")
+	log.Printf("sleep: %s (%s) remote replicas removed after idle timeout", svc.Name, svc.ID)
+
+	domain, _ := q.GetServiceDomainText(ctx, svc.ID)
+	domains := serviceDomainNames(db, svc.ID, domain)
+	if len(domains) > 0 {
+		writeWakeIngress(svc.ID.String(), domains, apiPort)
+	}
+}
+
 // markIdle returns true when the network counter stopped growing past the
 // timeout. First sighting only sets the baseline — no idle without history.
 func markIdle(id uuid.UUID, bytes uint64, timeout time.Duration) bool {
@@ -177,11 +246,10 @@ func putToSleep(ctx context.Context, db *database.DB, dc *docker.Client, engine
 	tracker.mu.Lock()
 	delete(tracker.activity, svc.ID)
 	tracker.mu.Unlock()
-	_, _ = db.Exec(`UPDATE services SET status = 'sleeping', updated_at = $1 WHERE id = $2`, time.Now(), svc.ID)
+	setServiceStatusNow(db, svc.ID, "sleeping")
 	log.Printf("sleep: %s (%s) scaled to zero after idle timeout", svc.Name, svc.ID)
 
-	var domain string
-	_ = db.QueryRow(`SELECT COALESCE(domain,'') FROM services WHERE id = $1`, svc.ID).Scan(&domain)
+	domain, _ := sqlcdb.New(db.DB).GetServiceDomainText(ctx, svc.ID)
 	domains := serviceDomainNames(db, svc.ID, domain)
 	if len(domains) == 0 {
 		return
@@ -191,9 +259,20 @@ func putToSleep(ctx context.Context, db *database.DB, dc *docker.Client, engine
 	}
 }
 
+// wakeCGIScript is installed as /cgi-bin/wake in the wake container. It
+// fires the wake callback on the first reachable candidate URL, in the
+// background, then serves the reloading placeholder page. Deliberately
+// single-quote-free — the file is written through printf '%s'.
+const wakeCGIScript = `#!/bin/sh
+for u in $WAKE_URLS; do wget -q -O /dev/null --timeout=20 "$u" && break; done >/dev/null 2>&1 &
+printf "Content-Type: text/html\r\n\r\n"
+printf "%s" "$WAKE_PAGE"
+`
+
 // spawnWakeContainer runs a busybox httpd holding the service's Traefik
-// host rule at higher priority. On boot it calls the wake endpoint, then
-// keeps serving a reloading page until the next reconcile removes it.
+// host rule at higher priority. Inbound hits redirect to /cgi-bin/wake,
+// which calls the internal wake endpoint and serves a reloading page
+// until the reconcile removes the placeholder.
 func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client, engine *deployment.DeploymentEngine, svc sleepCandidate, domains []string, apiPort int) error {
 	edgeNet := ""
 	for _, n := range networkList(ctx, dc) {
@@ -223,19 +302,25 @@ func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client,
 		"traefik.http.services." + router + ".loadbalancer.server.port": "80",
 	}
 
-	wakeURL := wakeEndpointURL(ctx, dc, apiPort, svc.ID, edgeNet)
+	wakeURLs := wakeEndpointURLs(ctx, dc, apiPort, svc.ID, edgeNet)
 	page := `<!doctype html><html><head><meta http-equiv="refresh" content="4"><title>Waking up</title>` +
 		`<style>body{font-family:system-ui,sans-serif;background:#0b0d12;color:#dde2ea;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}` +
 		`.card{text-align:center;max-width:34rem;padding:2rem}h1{font-size:1.25rem;font-weight:600}p{color:#98a2b3}</style></head>` +
 		`<body><div class="card"><h1>Service is waking up</h1><p>This Containr service was sleeping and is resuming now. The page reloads automatically.</p></div></body></html>`
-	// httpd without -f daemonizes, so the sequence is: write page, start
-	// httpd, fire the wake callback, then hold PID1 on sleep infinity.
+	// The wake callback must fire when a request arrives, not at boot —
+	// firing unconditionally makes the service flap sleep→wake forever.
+	// index.html redirects to /cgi-bin/wake; the CGI fires the callback
+	// (first reachable URL wins) and serves the reloading page.
+	indexPage := `<!doctype html><html><head><meta http-equiv="refresh" content="0;url=/cgi-bin/wake"></head><body></body></html>`
+	// httpd without -f daemonizes, so PID1 ends on sleep infinity. URLs
+	// and the page travel via env so the CGI script needs no quoting.
 	cmd := fmt.Sprintf(
-		`mkdir -p /www && printf '%%s' '%s' > /www/index.html && `+
-			`httpd -p 80 -h /www && `+
-			`(sleep 2; wget -q -O /dev/null --timeout=20 '%s' 2>/dev/null || true) && `+
-			`sleep infinity`,
-		strings.ReplaceAll(page, "'", "'\\''"), wakeURL)
+		`mkdir -p /www/cgi-bin && printf '%%s' '%s' > /www/index.html && `+
+			`printf '%%s' '%s' > /www/cgi-bin/wake && chmod +x /www/cgi-bin/wake && `+
+			`printf '%%s\n' 'E404:/cgi-bin/wake' > /www/httpd.conf && `+
+			`httpd -p 80 -h /www && sleep infinity`,
+		strings.ReplaceAll(indexPage, "'", "'\\''"),
+		strings.ReplaceAll(wakeCGIScript, "'", "'\\''"))
 
 	endpoints := map[string]*network.EndpointSettings{edgeNet: {}}
 	if ownNet := dc.OwnNetworkName(ctx); ownNet != "" && ownNet != edgeNet {
@@ -256,9 +341,13 @@ func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client,
 	}
 
 	id, err := dc.CreateContainer(ctx, docker.ContainerConfig{
-		Name:     name,
-		Image:    wakeImage,
-		Cmd:      []string{"sh", "-c", cmd},
+		Name:  name,
+		Image: wakeImage,
+		Cmd:   []string{"sh", "-c", cmd},
+		Env: []string{
+			"WAKE_URLS=" + strings.Join(wakeURLs, " "),
+			"WAKE_PAGE=" + page,
+		},
 		Labels:   labels,
 		Networks: endpoints,
 	})
@@ -280,25 +369,41 @@ func networkList(ctx context.Context, dc *docker.Client) []string {
 	return names
 }
 
-// wakeEndpointURL builds the internal URL the wake container calls. The
-// edge network's gateway reaches the host's published API port; when the
-// API itself is containerized its own name resolves on the shared network.
-func wakeEndpointURL(ctx context.Context, dc *docker.Client, apiPort int, serviceID uuid.UUID, edgeNet string) string {
+// wakeEndpointURLs builds ordered candidate URLs for the wake container to
+// call, deduplicated. No single address covers every topology: a containerized
+// API resolves by name on the shared network; Docker Desktop containers reach
+// the host via host.docker.internal; on native Docker the edge network's
+// gateway routes to host-published ports. busybox wget walks the chain until
+// one answers.
+func wakeEndpointURLs(ctx context.Context, dc *docker.Client, apiPort int, serviceID uuid.UUID, edgeNet string) []string {
+	var hosts []string
 	if dc.OwnNetworkName(ctx) != "" {
 		if self, err := dc.GetContainer(ctx, selfID()); err == nil {
-			name := strings.TrimPrefix(self.Name, "/")
-			if name != "" {
-				return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", name, apiPort, serviceID)
+			if name := strings.TrimPrefix(self.Name, "/"); name != "" {
+				hosts = append(hosts, name)
 			}
 		}
 	}
+	hosts = append(hosts, "host.docker.internal")
 	if gw := networkGateway(ctx, dc, edgeNet); gw != "" {
-		return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", gw, apiPort, serviceID)
+		hosts = append(hosts, gw)
 	}
 	if probe := dc.HostProbeHost(ctx); probe != "" {
-		return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", probe, apiPort, serviceID)
+		hosts = append(hosts, probe)
 	}
-	return fmt.Sprintf("http://127.0.0.1:%d/api/v1/internal/wake/%s", apiPort, serviceID)
+	seen := map[string]bool{}
+	var urls []string
+	for _, h := range hosts {
+		if h == "" || seen[h] {
+			continue
+		}
+		seen[h] = true
+		urls = append(urls, fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", h, apiPort, serviceID))
+	}
+	if len(urls) == 0 {
+		urls = append(urls, fmt.Sprintf("http://127.0.0.1:%d/api/v1/internal/wake/%s", apiPort, serviceID))
+	}
+	return urls
 }
 
 func networkGateway(ctx context.Context, dc *docker.Client, name string) string {
@@ -334,7 +439,9 @@ func pruneWakeContainers(ctx context.Context, db *database.DB, dc *docker.Client
 			}
 		}
 		var status string
-		_ = db.QueryRow(`SELECT COALESCE(status,'') FROM services WHERE id = $1`, svcID).Scan(&status)
+		if sid, err := uuid.Parse(svcID); err == nil {
+			status, _ = sqlcdb.New(db.DB).GetServiceStatusText(ctx, sid)
+		}
 		if live > 0 || status == "stopped" || status == "" {
 			_ = dc.RemoveContainer(ctx, c.ID, true)
 		}
@@ -346,62 +453,62 @@ func pruneWakeContainers(ctx context.Context, db *database.DB, dc *docker.Client
 // idempotent and non-destructive, so no token is required; the endpoint
 // never mutates configuration.
 func handleServiceWake(c *gin.Context) {
+	code, body := triggerServiceWake(c)
+	if code != 0 {
+		c.JSON(code, body)
+	}
+}
+
+// handleServiceWakePage is the remote ingress wake target — Traefik routes
+// a sleeping remote service's domain here via the file provider. Every hit
+// (re)triggers the wake reconcile and returns a reloading page.
+func handleServiceWakePage(c *gin.Context) {
+	triggerServiceWake(c)
+	c.Header("Content-Type", "text/html; charset=utf-8")
+	c.String(http.StatusOK, wakePageHTML)
+}
+
+const wakePageHTML = `<!doctype html><html><head><meta http-equiv="refresh" content="4"><title>Waking up</title>` +
+	`<style>body{font-family:system-ui,sans-serif;background:#0b0d12;color:#dde2ea;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}` +
+	`.card{text-align:center;max-width:34rem;padding:2rem}h1{font-size:1.25rem;font-weight:600}p{color:#98a2b3}</style></head>` +
+	`<body><div class="card"><h1>Service is waking up</h1><p>This Containr service was sleeping and is resuming now. The page reloads automatically.</p></div></body></html>`
+
+// triggerServiceWake loads the service and reconciles it back to running
+// in the background. Returns (0, nil) when a response was already written
+// by an embedded handler path, else the JSON status to send.
+func triggerServiceWake(c *gin.Context) (int, gin.H) {
 	dbVal, _ := c.Get("db")
 	db := dbVal.(*database.DB)
 	engineVal, _ := c.Get("deployment_engine")
 	engine, _ := engineVal.(*deployment.DeploymentEngine)
 	if engine == nil {
-		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "deployment engine unavailable"})
-		return
+		return http.StatusServiceUnavailable, gin.H{"error": "deployment engine unavailable"}
 	}
 	id, err := uuid.Parse(c.Param("id"))
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid service id"})
-		return
+		return http.StatusBadRequest, gin.H{"error": "invalid service id"}
 	}
-	var service Service
-	err = db.QueryRow(
-		`SELECT s.id, s.project_id, s.name,
-		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
-		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
-		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
-		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
-		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at
-		 FROM services s WHERE s.id = $1`, id,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt,
-	)
+	row, err := sqlcdb.New(db.DB).GetServiceRuntimeWithOwner(context.Background(), id)
 	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "service not found"})
-		return
+		return http.StatusNotFound, gin.H{"error": "service not found"}
 	}
+	service := serviceFromRuntimeRow(row)
 	if service.Status == "running" || service.Status == "deployed" {
-		c.JSON(http.StatusOK, gin.H{"status": service.Status})
-		return
+		return http.StatusOK, gin.H{"status": service.Status}
 	}
 	go func() {
 		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
 		defer cancel()
 		spec, err := serviceRuntimeSpec(db, service)
 		if err != nil {
+			log.Printf("wake: runtime spec for %s failed: %v", service.ID, err)
+			setServiceStatusNow(db, service.ID, "failed")
 			return
 		}
 		state, err := engine.ReconcileService(ctx, spec)
 		if err != nil {
-			_, _ = db.Exec(`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+			log.Printf("wake: reconcile for %s failed: %v", service.ID, err)
+			setServiceStatusNow(db, service.ID, "failed")
 			return
 		}
 		status := "running"
@@ -409,9 +516,9 @@ func handleServiceWake(c *gin.Context) {
 			status = state.Status
 			persistPublishedPort(db, service.ID, state.Ports)
 		}
-		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
+		setServiceStatusNow(db, service.ID, status)
 	}()
-	c.JSON(http.StatusAccepted, gin.H{"status": "waking"})
+	return http.StatusAccepted, gin.H{"status": "waking"}
 }
 
 // handleServiceSleep puts a service to sleep immediately (owner+ only).
@@ -430,15 +537,18 @@ func handleServiceSleep(c *gin.Context) {
 	if !ok {
 		return
 	}
-	var port int
-	_ = db.QueryRow(`SELECT COALESCE(port,0) FROM services WHERE id = $1`, service.ID).Scan(&port)
 	svc := sleepCandidate{
 		ID:        service.ID,
 		ProjectID: service.ProjectID,
 		Name:      service.Name,
 		Status:    service.Status,
 	}
-	go putToSleep(context.Background(), db, dc, engine, svc, apiPortFromContext(c))
+	q := sqlcdb.New(db.DB)
+	if len(remoteLiveContainers(c.Request.Context(), q, service.ID.String())) > 0 {
+		go putToSleepRemote(context.Background(), db, q, svc, apiPortFromContext(c))
+	} else {
+		go putToSleep(context.Background(), db, dc, engine, svc, apiPortFromContext(c))
+	}
 	c.JSON(http.StatusAccepted, gin.H{"status": "sleeping"})
 }
 

app/backend/internal/api/templategraph.go

@@ -11,6 +11,8 @@ import (
 	"log"
 	"math/big"
 	"net/http"
+	"os"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
@@ -22,6 +24,7 @@ import (
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/secrets"
+	"containr/internal/source"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -227,7 +230,9 @@ func resolveStaticExpr(value string, userVars map[string]string, unresolved *[]s
 		if val, ok := userVars[key]; ok {
 			return val
 		}
-		if sub[2] != "" {
+		// {{VAR:-x}} supplies a default; {{VAR:-}} declares an explicitly
+		// empty one. Both resolve — only a bare {{VAR}} is unresolved.
+		if strings.Contains(m, ":-") {
 			return sub[2]
 		}
 		if unresolved != nil {
@@ -635,19 +640,20 @@ func deployTemplateGraph(
 	createdServiceIDs := []uuid.UUID{}
 	createdDatabaseIDs := []string{}
 	cleanup := func() {
+		q := sqlcdb.New(db.DB)
 		for _, sid := range createdServiceIDs {
 			if engine != nil {
-				_ = engine.RemoveServiceContainers(context.Background(), sid.String())
+				removeServiceRuntime(context.Background(), db, engine, sid)
 			}
-			_, _ = db.Exec(`DELETE FROM environment_variables WHERE service_id = $1`, sid)
-			_, _ = db.Exec(`DELETE FROM services WHERE id = $1`, sid)
+			_ = q.DeleteEnvVarsForService(context.Background(), sid)
+			_ = q.DeleteServiceByID(context.Background(), sid)
 		}
 		for _, did := range createdDatabaseIDs {
 			if dbHandler != nil && dbHandler.dockerClient != nil {
 				_ = dbHandler.dockerClient.RemoveContainer(context.Background(), managedDatabaseContainerName(did), true)
 				_ = dbHandler.dockerClient.RemoveVolume(context.Background(), managedDatabaseVolumeName(did), true)
 			}
-			_, _ = db.Exec(`DELETE FROM database_services WHERE id = $1`, did)
+			_ = q.DeleteDatabaseServiceByID(context.Background(), did)
 		}
 	}
 
@@ -767,14 +773,19 @@ func deployTemplateGraph(
 		if builder == "" {
 			builder = "auto"
 		}
-		if _, err = tx.ExecContext(ctx,
-			`UPDATE services SET port = $1, healthcheck_path = $2, volumes = COALESCE($3::jsonb, '[]'::jsonb),
-			        git_repo = NULLIF($4, ''), git_branch = NULLIF($5, ''), builder = $6
-			 WHERE id = $7`,
-			m.spec.Port, strings.TrimSpace(m.spec.HealthCheck), volumesJSON,
-			strings.TrimSpace(m.spec.Repo), strings.TrimSpace(m.spec.Branch), builder,
-			serviceID,
-		); err != nil {
+		var volumesRaw json.RawMessage
+		if s, ok := volumesJSON.(string); ok {
+			volumesRaw = json.RawMessage(s)
+		}
+		if err = sqlcdb.New(tx).UpdateServiceDeployMeta(ctx, sqlcdb.UpdateServiceDeployMetaParams{
+			Port:            int32(m.spec.Port),
+			HealthcheckPath: strings.TrimSpace(m.spec.HealthCheck),
+			Column3:         volumesRaw,
+			Column4:         strings.TrimSpace(m.spec.Repo),
+			Column5:         strings.TrimSpace(m.spec.Branch),
+			Builder:         builder,
+			ID:              serviceID,
+		}); err != nil {
 			tx.Rollback()
 			cleanup()
 			return nil, &gin.H{"error": "Failed to configure service"}
@@ -856,15 +867,24 @@ func queueTemplateDeployment(c *gin.Context, db *database.DB, engine *deployment
 		CreatedAt: now,
 		UpdatedAt: now,
 	}
-	if _, err := db.Exec(
-		`INSERT INTO deployments
-		 (id, service_id, version, commit_hash, status, image_name, image_tag, created_at, updated_at)
-		 VALUES ($1, $2, $3, NULL, $4, '', '', $5, $6)`,
-		dep.ID, dep.ServiceID, fmt.Sprintf("v%d", now.Unix()), dep.Status, dep.CreatedAt, dep.UpdatedAt,
-	); err != nil {
+	q := sqlcdb.New(db.DB)
+	if err := q.InsertDeployment(context.Background(), sqlcdb.InsertDeploymentParams{
+		ID:        dep.ID,
+		ServiceID: dep.ServiceID,
+		Version:   fmt.Sprintf("v%d", now.Unix()),
+		Status:    sql.NullString{String: dep.Status, Valid: true},
+		ImageName: sql.NullString{String: "", Valid: true},
+		ImageTag:  sql.NullString{String: "", Valid: true},
+		CreatedAt: sql.NullTime{Time: dep.CreatedAt, Valid: true},
+		UpdatedAt: sql.NullTime{Time: dep.UpdatedAt, Valid: true},
+	}); err != nil {
 		return uuid.Nil
 	}
-	_, _ = db.Exec(`UPDATE services SET status = 'queued', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	_ = q.SetServiceStatus(context.Background(), sqlcdb.SetServiceStatusParams{
+		Status:    sql.NullString{String: "queued", Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        service.ID,
+	})
 
 	getDeployQueue(c).Enqueue(service.ID, deployqueue.Job{
 		DeploymentID: dep.ID,
@@ -1112,6 +1132,130 @@ func handleImportCompose(c *gin.Context) {
 	})
 }
 
+// handleImportGitCompose fetches a compose file out of a git repository and
+// runs it through the same conversion as handleImportCompose. Works with any
+// git remote — connected providers (including GitHub App installs) supply
+// credentials for private repos. Nothing is persisted; the response feeds
+// the template create form or a direct deploy.
+func handleImportGitCompose(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+
+	var req struct {
+		Repo string `json:"repo" binding:"required"`
+		Path string `json:"path"`
+		Ref  string `json:"ref"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	branch, commit := "", ""
+	if ref := strings.TrimSpace(req.Ref); ref != "" {
+		if isCommitSHA(ref) {
+			commit = ref
+		} else {
+			branch = ref
+		}
+	}
+	spec, err := resolveGitCloneSpec(db, userID, req.Repo, branch, commit, "")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "code": "VALIDATION"})
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 2*time.Minute)
+	defer cancel()
+	checkoutRoot := filepath.Join(containrWorkDir, "repos", "import-"+uuid.NewString())
+	defer os.RemoveAll(checkoutRoot)
+	repoDir, err := source.Checkout(ctx, checkoutRoot, spec)
+	if err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": "git fetch failed: " + err.Error(), "code": "GIT_FETCH"})
+		return
+	}
+
+	// Default search order mirrors common compose conventions.
+	candidates := []string{req.Path}
+	if strings.TrimSpace(req.Path) == "" {
+		candidates = []string{"compose.yaml", "compose.yml", "docker-compose.yml", "docker-compose.yaml"}
+	}
+	var raw []byte
+	for _, rel := range candidates {
+		p, rerr := resolveRepoFile(repoDir, rel)
+		if rerr != nil {
+			continue
+		}
+		raw, err = os.ReadFile(p)
+		if err == nil {
+			break
+		}
+	}
+	if raw == nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "compose file not found in repository", "code": "NOT_FOUND"})
+		return
+	}
+	if len(raw) > 512*1024 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Compose file exceeds 512 KiB"})
+		return
+	}
+
+	var file composeFileDef
+	if err := yaml.Unmarshal(raw, &file); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid compose YAML: " + err.Error()})
+		return
+	}
+	services, warnings, convErr := composeToSpecs(&file)
+	if convErr != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": convErr.Error()})
+		return
+	}
+	config := TemplateConfig{Version: 2, Services: services}
+	configJSON, _ := json.Marshal(config)
+	c.JSON(http.StatusOK, gin.H{
+		"config":    json.RawMessage(configJSON),
+		"variables": []TemplateVariable{},
+		"warnings":  warnings,
+	})
+}
+
+// resolveRepoFile maps a repo-relative file path onto the checkout and
+// rejects escapes — same containment rule as ResolveBuildPath, for files.
+func resolveRepoFile(checkoutDir, rel string) (string, error) {
+	rel = strings.TrimSpace(rel)
+	if rel == "" || filepath.IsAbs(rel) {
+		return "", fmt.Errorf("invalid repo path %q", rel)
+	}
+	clean := filepath.Clean(rel)
+	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("path escapes the checkout: %q", rel)
+	}
+	resolved := filepath.Join(checkoutDir, clean)
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "", fmt.Errorf("path %q not found in checkout", rel)
+	}
+	if !info.Mode().IsRegular() {
+		return "", fmt.Errorf("path %q is not a file", rel)
+	}
+	return resolved, nil
+}
+
+func isCommitSHA(ref string) bool {
+	if len(ref) != 40 {
+		return false
+	}
+	for _, r := range ref {
+		if !('0' <= r && r <= '9') && !('a' <= r && r <= 'f') {
+			return false
+		}
+	}
+	return true
+}
+
 // composeToSpecs converts a parsed compose file into graph service specs.
 // Compose service names become keys; declaration order follows YAML document
 // order — yaml.v3 maps lose order, so sort keys for stability.

app/backend/internal/api/templategraph_compose_test.go

@@ -1,6 +1,8 @@
 package api
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -124,3 +126,42 @@ func TestComposeToSpecsWarnings(t *testing.T) {
 		t.Errorf("missing env warning: %v", warnings)
 	}
 }
+
+func TestResolveRepoFileContainment(t *testing.T) {
+	dir := t.TempDir()
+	inner := filepath.Join(dir, "sub")
+	if err := os.MkdirAll(inner, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(inner, "compose.yml"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	p, err := resolveRepoFile(dir, "sub/compose.yml")
+	if err != nil {
+		t.Fatalf("valid file rejected: %v", err)
+	}
+	if p != filepath.Join(dir, "sub", "compose.yml") {
+		t.Errorf("unexpected path %q", p)
+	}
+
+	for _, bad := range []string{"", "/etc/passwd", "../escape.yml", "..", "sub/../../out.yml"} {
+		if _, err := resolveRepoFile(dir, bad); err == nil {
+			t.Errorf("path %q should have been rejected", bad)
+		}
+	}
+	if _, err := resolveRepoFile(dir, "sub"); err == nil {
+		t.Error("directory accepted as file")
+	}
+}
+
+func TestIsCommitSHA(t *testing.T) {
+	if !isCommitSHA("0123456789abcdef0123456789abcdef01234567") {
+		t.Error("40-hex ref not recognised as a commit")
+	}
+	for _, bad := range []string{"main", "v1.2.3", "0123456789abcdef0123456789abcdef0123456", "0123456789abcdef0123456789abcdef0123456G"} {
+		if isCommitSHA(bad) {
+			t.Errorf("ref %q misclassified as commit SHA", bad)
+		}
+	}
+}

app/backend/internal/api/templateregistry.go

@@ -0,0 +1,186 @@
+package api
+
+// Template registry — CONTAINR_TEMPLATE_REGISTRY_URL points at another
+// Containr instance (or any server answering the same template shape):
+//   GET {base}/api/v1/templates     → {"templates": [ServiceTemplate…]}
+//   GET {base}/api/v1/templates/:id → {"template": …, "config": …, "variables": …}
+// Registry entries merge into the catalog as source:"registry"; deploying
+// one materializes it as a user template for the deployer first. The
+// bundled catalog always works offline — a dead registry never blocks it.
+
+import (
+	"containr/internal/database/sqlcdb"
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
+)
+
+const registryCacheTTL = 60 * time.Second
+
+var registryCache struct {
+	mu        sync.Mutex
+	fetchedAt time.Time
+	templates []ServiceTemplate
+}
+
+func registryBaseURL() string {
+	base := strings.TrimRight(strings.TrimSpace(os.Getenv("CONTAINR_TEMPLATE_REGISTRY_URL")), "/")
+	base = strings.TrimSuffix(base, "/api/v1")
+	return base
+}
+
+// fetchRegistryTemplates lists the remote catalog, cached for
+// registryCacheTTL. Failures degrade to an empty list — never fatal.
+func fetchRegistryTemplates(ctx context.Context) []ServiceTemplate {
+	if registryBaseURL() == "" {
+		return nil
+	}
+	registryCache.mu.Lock()
+	fresh := time.Since(registryCache.fetchedAt) < registryCacheTTL && registryCache.templates != nil
+	cached := registryCache.templates
+	registryCache.mu.Unlock()
+	if fresh {
+		return cached
+	}
+
+	var templates []ServiceTemplate
+	var payload struct {
+		Templates []ServiceTemplate `json:"templates"`
+	}
+	if err := registryGet(ctx, "/api/v1/templates", &payload); err == nil {
+		templates = payload.Templates
+	}
+	for i := range templates {
+		templates[i].Source = "registry"
+	}
+
+	registryCache.mu.Lock()
+	registryCache.fetchedAt = time.Now()
+	registryCache.templates = templates
+	registryCache.mu.Unlock()
+	return templates
+}
+
+// fetchRegistryTemplate fetches one remote template's full document
+// (template + config + variables). nil when the registry lacks it.
+func fetchRegistryTemplate(ctx context.Context, id string) *ServiceTemplate {
+	base := registryBaseURL()
+	if base == "" {
+		return nil
+	}
+	var payload struct {
+		Template  ServiceTemplate    `json:"template"`
+		Config    json.RawMessage    `json:"config"`
+		Variables []TemplateVariable `json:"variables"`
+	}
+	if err := registryGet(ctx, "/api/v1/templates/"+id, &payload); err != nil {
+		return nil
+	}
+	t := payload.Template
+	if t.ID == "" {
+		t.ID = id
+	}
+	t.Source = "registry"
+	// The detail endpoint returns config/variables decoded; store them back
+	// as raw JSON so they can persist unmodified into a local copy.
+	if len(payload.Config) > 0 {
+		t.Config = string(payload.Config)
+	}
+	if payload.Variables != nil {
+		if raw, err := json.Marshal(payload.Variables); err == nil {
+			t.Variables = string(raw)
+		}
+	}
+	return &t
+}
+
+func registryGet(ctx context.Context, path string, out interface{}) error {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, registryBaseURL()+path, nil)
+	if err != nil {
+		return err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return errRegistry{resp.StatusCode}
+	}
+	return json.NewDecoder(resp.Body).Decode(out)
+}
+
+type errRegistry struct{ status int }
+
+func (e errRegistry) Error() string { return "template registry status " + http.StatusText(e.status) }
+
+// respondRegistryTemplate answers GET /templates/:id for a registry-only
+// template with the same envelope shape as local templates.
+func respondRegistryTemplate(c *gin.Context, t *ServiceTemplate) {
+	config := json.RawMessage(t.Config)
+	if len(config) == 0 {
+		config = json.RawMessage(`{}`)
+	}
+	variables := json.RawMessage(t.Variables)
+	if len(variables) == 0 {
+		variables = json.RawMessage(`[]`)
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"template":  t,
+		"config":    config,
+		"variables": variables,
+	})
+}
+
+// materializeRegistryTemplate copies a registry template into the local
+// catalog as a private template owned by the deployer, so the normal
+// deploy path (and future re-deploys) work without the registry. The
+// local id is deterministic per (registry, template, user) so repeat
+// deploys reuse the same copy instead of accumulating duplicates.
+func materializeRegistryTemplate(c *gin.Context, q *sqlcdb.Queries, userID, templateID string) (sqlcdb.ServiceTemplate, error) {
+	ownerUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return sqlcdb.ServiceTemplate{}, err
+	}
+	sum := sha256.Sum256([]byte(registryBaseURL() + "|" + templateID + "|" + userID))
+	localID := "reg-" + hex.EncodeToString(sum[:8])
+	if existing, err := q.GetServiceTemplateByID(c.Request.Context(), localID); err == nil {
+		return existing, nil
+	}
+
+	rt := fetchRegistryTemplate(c.Request.Context(), templateID)
+	if rt == nil {
+		return sqlcdb.ServiceTemplate{}, sql.ErrNoRows
+	}
+	variables := pqtype.NullRawMessage{}
+	if rt.Variables != "" {
+		variables = pqtype.NullRawMessage{RawMessage: json.RawMessage(rt.Variables), Valid: true}
+	}
+	if err := q.CreateUserTemplate(c.Request.Context(), sqlcdb.CreateUserTemplateParams{
+		ID:          localID,
+		Name:        rt.Name,
+		Description: nullableText(rt.Description),
+		Category:    rt.Category,
+		Logo:        nullableText(rt.Logo),
+		Config:      json.RawMessage(rt.Config),
+		Variables:   variables,
+		OwnerID:     uuid.NullUUID{UUID: ownerUUID, Valid: true},
+		IsPublic:    false,
+	}); err != nil {
+		return sqlcdb.ServiceTemplate{}, err
+	}
+	return q.GetServiceTemplateByID(c.Request.Context(), localID)
+}

app/backend/internal/api/templates.go

@@ -21,18 +21,20 @@ import (
 )
 
 type ServiceTemplate struct {
-	ID          string    `json:"id" db:"id"`
-	Name        string    `json:"name" db:"name"`
-	Description string    `json:"description" db:"description"`
-	Category    string    `json:"category" db:"category"`
-	Logo        string    `json:"logo" db:"logo"`
-	Config      string    `json:"config" db:"config"`
-	Variables   string    `json:"variables" db:"variables"`
-	IsOfficial  bool      `json:"is_official" db:"is_official"`
-	OwnerID     string    `json:"owner_id,omitempty" db:"owner_id"`
-	IsPublic    bool      `json:"is_public" db:"is_public"`
-	CreatedAt   time.Time `json:"created_at" db:"created_at"`
-	UpdatedAt   time.Time `json:"updated_at" db:"updated_at"`
+	ID          string `json:"id" db:"id"`
+	Name        string `json:"name" db:"name"`
+	Description string `json:"description" db:"description"`
+	Category    string `json:"category" db:"category"`
+	Logo        string `json:"logo" db:"logo"`
+	Config      string `json:"config" db:"config"`
+	Variables   string `json:"variables" db:"variables"`
+	IsOfficial  bool   `json:"is_official" db:"is_official"`
+	OwnerID     string `json:"owner_id,omitempty" db:"owner_id"`
+	IsPublic    bool   `json:"is_public" db:"is_public"`
+	// Source marks catalog origin: "" (local/official) or "registry".
+	Source    string    `json:"source,omitempty" db:"-"`
+	CreatedAt time.Time `json:"created_at" db:"created_at"`
+	UpdatedAt time.Time `json:"updated_at" db:"updated_at"`
 }
 
 type TemplateConfig struct {
@@ -97,10 +99,24 @@ func handleGetTemplates(c *gin.Context) {
 	}
 
 	templates := make([]ServiceTemplate, 0, len(templateRows))
+	localIDs := make(map[string]bool, len(templateRows))
 	for _, row := range templateRows {
+		localIDs[row.ID] = true
 		templates = append(templates, mapSQLCTemplate(row))
 	}
 
+	// Merge the configured remote registry (CONTAINR_TEMPLATE_REGISTRY_URL).
+	// Registry ids never shadow local templates.
+	for _, t := range fetchRegistryTemplates(ctx) {
+		if localIDs[t.ID] {
+			continue
+		}
+		if category != "" && t.Category != category {
+			continue
+		}
+		templates = append(templates, t)
+	}
+
 	c.JSON(http.StatusOK, gin.H{"templates": templates})
 }
 
@@ -112,6 +128,11 @@ func handleGetTemplate(c *gin.Context) {
 	row, err := queries.GetServiceTemplateByID(c.Request.Context(), templateID)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
+			// Registry fallback — remote templates materialize read-only.
+			if rt := fetchRegistryTemplate(c.Request.Context(), templateID); rt != nil {
+				respondRegistryTemplate(c, rt)
+				return
+			}
 			c.JSON(http.StatusNotFound, gin.H{"error": "Template not found"})
 			return
 		}
@@ -190,11 +211,18 @@ func handleCreateFromTemplate(c *gin.Context) {
 	templateRow, err := queries.GetServiceTemplateByID(ctx, templateID)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			c.JSON(http.StatusNotFound, gin.H{"error": "Template not found"})
+			// Registry template — materialize a local copy for the
+			// deployer, then continue down the normal deploy path.
+			row, mErr := materializeRegistryTemplate(c, queries, userID, templateID)
+			if mErr != nil {
+				c.JSON(http.StatusNotFound, gin.H{"error": "Template not found"})
+				return
+			}
+			templateRow = row
+		} else {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch template"})
 			return
 		}
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch template"})
-		return
 	}
 
 	template := mapSQLCTemplate(templateRow)
@@ -383,12 +411,11 @@ func handleCreateFromTemplate(c *gin.Context) {
 		return
 	}
 
-	// sqlc's schema predates the runtime columns; port and healthcheck_path are
-	// written via raw SQL like every other service mutation path.
-	if _, err = tx.ExecContext(ctx,
-		`UPDATE services SET port = $1, healthcheck_path = $2 WHERE id = $3`,
-		config.Port, strings.TrimSpace(config.HealthCheck), serviceID,
-	); err != nil {
+	if err = sqlcdb.New(tx).UpdateServiceRuntimeMeta(ctx, sqlcdb.UpdateServiceRuntimeMetaParams{
+		Port:            int32(config.Port),
+		HealthcheckPath: strings.TrimSpace(config.HealthCheck),
+		ID:              serviceID,
+	}); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create service from template"})
 		return
 	}
@@ -1074,6 +1101,98 @@ func SeedTemplates() []ServiceTemplate {
 			Variables:  `[{"key":"APP_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
 			IsOfficial: true,
 		},
+		{
+			ID:          "tpl-n8n",
+			Name:        "n8n + PostgreSQL + Redis",
+			Description: "Workflow automation in queue mode with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/n8n",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"n8n","POSTGRES_USER":"n8n"},"volumes":[{"source":"n8n-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"n8n","type":"web","runtime":"docker.n8n.io/n8nio/n8n:latest","port":5678,"health_check":"/healthz","depends_on":["db","redis"],
+				 "environment":{"DB_TYPE":"postgresdb","DB_POSTGRESDB_HOST":"{{service.db.host}}","DB_POSTGRESDB_PORT":"5432","DB_POSTGRESDB_DATABASE":"{{service.db.database}}","DB_POSTGRESDB_USER":"{{service.db.user}}","DB_POSTGRESDB_PASSWORD":"{{service.db.password}}","QUEUE_BULL_REDIS_HOST":"{{service.redis.host}}","QUEUE_BULL_REDIS_PASSWORD":"{{service.redis.password}}","EXECUTIONS_MODE":"queue","N8N_ENCRYPTION_KEY":"{{secret(32)}}","N8N_HOST":"{{APP_URL:-http://localhost:5678}}","N8N_EDITOR_BASE_URL":"{{APP_URL:-http://localhost:5678}}"},
+				 "volumes":[{"source":"n8n-data","target":"/home/node/.n8n"}]},
+				{"key":"worker","name":"n8n-worker","type":"worker","runtime":"docker.n8n.io/n8nio/n8n:latest","start_command":"worker","depends_on":["n8n","db","redis"],
+				 "environment":{"DB_TYPE":"postgresdb","DB_POSTGRESDB_HOST":"{{service.db.host}}","DB_POSTGRESDB_PORT":"5432","DB_POSTGRESDB_DATABASE":"{{service.db.database}}","DB_POSTGRESDB_USER":"{{service.db.user}}","DB_POSTGRESDB_PASSWORD":"{{service.db.password}}","QUEUE_BULL_REDIS_HOST":"{{service.redis.host}}","QUEUE_BULL_REDIS_PASSWORD":"{{service.redis.password}}","EXECUTIONS_MODE":"queue","N8N_ENCRYPTION_KEY":"{{secret(32)}}","QUEUE_HEALTH_CHECK_ACTIVE":"true"},
+				 "volumes":[{"source":"n8n-data","target":"/home/node/.n8n"}]}]}`,
+			Variables:  `[{"key":"APP_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-gitea",
+			Name:        "Gitea + PostgreSQL",
+			Description: "Self-hosted git service with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/gitea",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"gitea","POSTGRES_USER":"gitea"},"volumes":[{"source":"gitea-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"gitea","type":"web","runtime":"gitea/gitea:latest","port":3000,"health_check":"/api/healthz","depends_on":["db"],
+				 "environment":{"GITEA__database__DB_TYPE":"postgres","GITEA__database__HOST":"{{service.db.host}}:{{service.db.port}}","GITEA__database__NAME":"{{service.db.database}}","GITEA__database__USER":"{{service.db.user}}","GITEA__database__PASSWD":"{{service.db.password}}","GITEA__security__INSTALL_LOCK":"true","GITEA__security__SECRET_KEY":"{{secret(32)}}","GITEA__security__INTERNAL_TOKEN":"{{secret(64)}}","GITEA__server__DOMAIN":"{{DOMAIN:-localhost}}","GITEA__server__ROOT_URL":"{{ROOT_URL:-http://localhost:3000}}","GITEA__server__SSH_PORT":"2222","USER_UID":"1000","USER_GID":"1000"},
+				 "volumes":[{"source":"gitea-data","target":"/data"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Public domain","default":"","required":false,"secret":false},{"key":"ROOT_URL","label":"Root URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-nextcloud",
+			Name:        "Nextcloud + PostgreSQL + Redis",
+			Description: "Self-hosted file sync and collaboration with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/nextcloud",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"nextcloud","POSTGRES_USER":"nextcloud"},"volumes":[{"source":"nextcloud-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"nextcloud","type":"web","runtime":"nextcloud:latest","port":80,"depends_on":["db","redis"],
+				 "environment":{"POSTGRES_HOST":"{{service.db.host}}","POSTGRES_DB":"{{service.db.database}}","POSTGRES_USER":"{{service.db.user}}","POSTGRES_PASSWORD":"{{service.db.password}}","REDIS_HOST":"{{service.redis.host}}","REDIS_HOST_PASSWORD":"{{service.redis.password}}","NEXTCLOUD_ADMIN_USER":"admin","NEXTCLOUD_ADMIN_PASSWORD":"{{secret(24)}}","NEXTCLOUD_TRUSTED_DOMAINS":"{{DOMAIN:-localhost}}","OVERWRITEHOST":"{{DOMAIN:-}}","OVERWRITEPROTOCOL":"https"},
+				 "volumes":[{"source":"nextcloud-data","target":"/var/www/html"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Trusted domain","default":"localhost","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-vaultwarden",
+			Name:        "Vaultwarden + PostgreSQL",
+			Description: "Bitwarden-compatible password manager with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/vaultwarden",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"vaultwarden","POSTGRES_USER":"vaultwarden"},"volumes":[{"source":"vaultwarden-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"vaultwarden","type":"web","runtime":"vaultwarden/server:latest","port":80,"health_check":"/alive","depends_on":["db"],
+				 "environment":{"DATABASE_URL":"{{service.db.url}}","ADMIN_TOKEN":"{{secret(48)}}","DOMAIN":"{{DOMAIN:-http://localhost:80}}","SIGNUPS_ALLOWED":"false","WEBSOCKET_ENABLED":"true"},
+				 "volumes":[{"source":"vaultwarden-data","target":"/data"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Public URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-umami",
+			Name:        "Umami + PostgreSQL",
+			Description: "Lightweight privacy-first web analytics with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/umami",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"umami","POSTGRES_USER":"umami"},"volumes":[{"source":"umami-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"umami","type":"web","runtime":"ghcr.io/umami-software/umami:postgresql-latest","port":3000,"depends_on":["db"],
+				 "environment":{"DATABASE_URL":"{{service.db.url}}","APP_SECRET":"{{secret(32)}}"}}]}`,
+			Variables:  `[]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-immich",
+			Name:        "Immich + PostgreSQL + Redis",
+			Description: "Self-hosted photo and video backup with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/immich",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"immich","POSTGRES_USER":"immich"},"volumes":[{"source":"immich-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"ml","name":"immich-machine-learning","type":"worker","runtime":"ghcr.io/immich-app/immich-machine-learning:release",
+				 "environment":{"DB_DATABASE_NAME":"{{service.db.database}}","DB_HOSTNAME":"{{service.db.host}}","DB_USERNAME":"{{service.db.user}}","DB_PASSWORD":"{{service.db.password}}","REDIS_HOSTNAME":"{{service.redis.host}}","REDIS_PASSWORD":"{{service.redis.password}}"},
+				 "volumes":[{"source":"immich-model-cache","target":"/cache"}]},
+				{"key":"immich","name":"immich-server","type":"web","runtime":"ghcr.io/immich-app/immich-server:release","port":2283,"health_check":"/api/server/ping","depends_on":["db","redis","ml"],
+				 "environment":{"DB_DATABASE_NAME":"{{service.db.database}}","DB_HOSTNAME":"{{service.db.host}}","DB_USERNAME":"{{service.db.user}}","DB_PASSWORD":"{{service.db.password}}","REDIS_HOSTNAME":"{{service.redis.host}}","REDIS_PASSWORD":"{{service.redis.password}}"},
+				 "volumes":[{"source":"immich-upload","target":"/usr/src/app/upload"}]}]}`,
+			Variables:  `[]`,
+			IsOfficial: true,
+		},
 	}
 	return templates
 }

app/backend/internal/api/templates_test.go

@@ -1,6 +1,9 @@
 package api
 
-import "testing"
+import (
+	"encoding/json"
+	"testing"
+)
 
 func TestNormalizeTemplateServiceType(t *testing.T) {
 	valid := []string{"web", "worker", "database", "cron"}
@@ -71,3 +74,32 @@ func TestResolveTemplateRuntimeImage(t *testing.T) {
 		t.Fatalf("expected unknown runtime passthrough, got %q", got)
 	}
 }
+
+func TestSeedTemplatesResolveCleanly(t *testing.T) {
+	for _, tpl := range SeedTemplates() {
+		var config TemplateConfig
+		if err := json.Unmarshal([]byte(tpl.Config), &config); err != nil {
+			t.Fatalf("%s: invalid config JSON: %v", tpl.ID, err)
+		}
+		var variables []TemplateVariable
+		if err := json.Unmarshal([]byte(tpl.Variables), &variables); err != nil {
+			t.Fatalf("%s: invalid variables JSON: %v", tpl.ID, err)
+		}
+		if len(config.Services) == 0 {
+			continue // legacy single-service template
+		}
+		sorted, err := topoSortServices(config.Services)
+		if err != nil {
+			t.Fatalf("%s: topo sort: %v", tpl.ID, err)
+		}
+		if err := validateTemplateGraph(sorted); err != nil {
+			t.Fatalf("%s: graph validation: %v", tpl.ID, err)
+		}
+		// User vars left empty — every expression must still resolve via
+		// defaults, secrets, or service refs.
+		graph := resolveTemplateGraph(sorted, map[string]string{})
+		if len(graph.unresolved) > 0 {
+			t.Fatalf("%s: unresolved expressions: %v", tpl.ID, graph.unresolved)
+		}
+	}
+}

app/backend/internal/api/variables.go

@@ -1,11 +1,14 @@
 package api
 
 import (
-	"containr/internal/database"
-	"containr/internal/secrets"
+	"database/sql"
 	"net/http"
 	"time"
 
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"containr/internal/secrets"
+
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
@@ -147,7 +150,8 @@ func handleUpdateVariables(c *gin.Context) {
 	}
 	defer tx.Rollback()
 
-	_, err = tx.Exec("DELETE FROM environment_variables WHERE service_id = $1", serviceID)
+	txq := sqlcdb.New(tx)
+	err = txq.DeleteEnvVarsForService(c.Request.Context(), serviceID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clear existing variables"})
 		return
@@ -164,12 +168,15 @@ func handleUpdateVariables(c *gin.Context) {
 		if v.IsSecret {
 			value = secrets.Encrypt(value)
 		}
-		varID := uuid.New()
-		_, err = tx.Exec(
-			`INSERT INTO environment_variables (id, service_id, key, value, is_secret, created_at, updated_at)
-			 VALUES ($1, $2, $3, $4, $5, $6, $7)`,
-			varID, serviceID, v.Key, value, v.IsSecret, now, now,
-		)
+		err = txq.InsertEnvVar(c.Request.Context(), sqlcdb.InsertEnvVarParams{
+			ID:        uuid.New(),
+			ServiceID: serviceID,
+			Key:       v.Key,
+			Value:     value,
+			IsSecret:  sql.NullBool{Bool: v.IsSecret, Valid: true},
+			CreatedAt: sql.NullTime{Time: now, Valid: true},
+			UpdatedAt: sql.NullTime{Time: now, Valid: true},
+		})
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to insert variable: " + v.Key})
 			return

app/backend/internal/api/webhooks_test.go

@@ -31,3 +31,33 @@ func TestWebhookEventMatches(t *testing.T) {
 		}
 	}
 }
+
+func TestValidWebhookURL(t *testing.T) {
+	cases := []struct {
+		name    string
+		url     string
+		wantErr bool
+	}{
+		{"https", "https://hooks.example.com/wh/abc", false},
+		{"http", "http://internal.lan:8080/notify", false},
+		{"whitespace trimmed", "  https://example.com/hook  ", false},
+		{"with query", "https://example.com/hook?token=x", false},
+		{"ftp rejected", "ftp://files.example.com/x", true},
+		{"no scheme", "example.com/hook", true},
+		{"bare scheme", "https://", true},
+		{"empty", "", true},
+		{"javascript rejected", "javascript:alert(1)", true},
+		{"host empty", "http:///path-only", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validWebhookURL(tc.url)
+			if tc.wantErr && err == nil {
+				t.Errorf("validWebhookURL(%q) = nil, want error", tc.url)
+			}
+			if !tc.wantErr && err != nil {
+				t.Errorf("validWebhookURL(%q) = %v, want nil", tc.url, err)
+			}
+		})
+	}
+}

app/backend/internal/build/dockerfile.go

@@ -539,12 +539,16 @@ func createBuildContext(sourcePath, dockerfileContent string) (io.ReadCloser, er
 		return nil, err
 	}
 
-	// Add source files to tar
+	// Add source files to tar. The checkout's .git metadata is never build
+	// context — it bloats the tar and ships clone URLs to remote daemons.
 	err = filepath.Walk(sourcePath, func(file string, fi os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
 		if fi.IsDir() {
+			if fi.Name() == ".git" {
+				return filepath.SkipDir
+			}
 			return nil
 		}
 

app/backend/internal/build/manager.go

@@ -3,6 +3,8 @@ package build
 import (
 	"context"
 	"fmt"
+	"io"
+	"os"
 	"path/filepath"
 	"time"
 
@@ -92,6 +94,75 @@ func (bm *BuildManager) Build(ctx context.Context, req *types.BuildRequest) (*ty
 	}
 }
 
+// PackageContext produces the same build-context tar Build would hand the
+// local daemon, without building it. Node agents download the tar and run
+// docker build themselves — the Dockerfile lands at the tar root.
+func (bm *BuildManager) PackageContext(ctx context.Context, req *types.BuildRequest) (io.ReadCloser, error) {
+	if req.BuildType == "" {
+		detectedType, err := bm.DetectBuildType(ctx, req.SourcePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to detect build type: %w", err)
+		}
+		req.BuildType = string(detectedType)
+	}
+
+	var dockerfileContent string
+	switch BuildType(req.BuildType) {
+	case BuildTypeDockerfile:
+		name, err := bm.dockerfileBuilder.DetectDockerfile(ctx, req.SourcePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to detect Dockerfile: %w", err)
+		}
+		path := filepath.Join(req.SourcePath, name)
+		if optimized, err := bm.dockerfileBuilder.OptimizeDockerfile(ctx, path); err == nil {
+			path = optimized
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read Dockerfile: %w", err)
+		}
+		dockerfileContent = string(data)
+	case BuildTypeRailpack:
+		if err := bm.railpackBuilder.DetectRailpack(ctx, req.SourcePath); err != nil {
+			return nil, fmt.Errorf("Railpack cannot build this project: %w", err)
+		}
+		content, err := bm.railpackBuilder.generateDockerfile(ctx, req.SourcePath, &RailpackConfig{
+			BuildCmd: req.BuildCommand,
+			StartCmd: req.StartCommand,
+			Env:      req.Environment,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate Dockerfile with Railpack: %w", err)
+		}
+		dockerfileContent = content
+	case BuildTypeNixpacks:
+		plan, err := bm.nixpacksBuilder.GeneratePlan(ctx, req.SourcePath, &NixpacksConfig{
+			BuildCmd: req.BuildCommand,
+			StartCmd: req.StartCommand,
+			Env:      req.Environment,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate build plan: %w", err)
+		}
+		path, err := bm.nixpacksBuilder.generateDockerfile(plan)
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate Dockerfile: %w", err)
+		}
+		defer os.Remove(path)
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read generated Dockerfile: %w", err)
+		}
+		dockerfileContent = string(data)
+	case BuildTypeStatic:
+		dockerfileContent = staticDockerfile
+	default:
+		return nil, fmt.Errorf("unsupported build type for remote packaging: %s", req.BuildType)
+	}
+
+	return createBuildContext(req.SourcePath, dockerfileContent)
+}
+
 // buildPrebuilt handles prebuilt image deployments
 func (bm *BuildManager) buildPrebuilt(ctx context.Context, req *types.BuildRequest) (*types.BuildResponse, error) {
 	if req.PrebuiltImage == "" {

app/backend/internal/build/nixpacks.go

@@ -476,17 +476,22 @@ func (n *NixpacksBuilder) Build(ctx context.Context, req *types.BuildRequest) (*
 	}
 
 	// Create temporary Dockerfile
-	dockerfile, err := n.generateDockerfile(plan)
+	dockerfilePath, err := n.generateDockerfile(plan)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate Dockerfile: %w", err)
 	}
-	defer os.Remove(dockerfile)
+	defer os.Remove(dockerfilePath)
 
 	// Build Docker image
 	imageName := fmt.Sprintf("%s:%s", req.ImageName, req.ImageTag)
 
-	// Create build context tar
-	buildCtx, err := createBuildContext(req.SourcePath, dockerfile)
+	// Create build context tar — createBuildContext takes the Dockerfile
+	// contents, not its path.
+	dockerfileData, err := os.ReadFile(dockerfilePath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read generated Dockerfile: %w", err)
+	}
+	buildCtx, err := createBuildContext(req.SourcePath, string(dockerfileData))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create build context: %w", err)
 	}

app/backend/internal/cli/commands/environments.go

@@ -0,0 +1,97 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// EnvironmentsCmd manages a project's environment lanes
+// (production/development/preview are seeded; custom names allowed).
+var EnvironmentsCmd = &cobra.Command{
+	Use:     "environments",
+	Aliases: []string{"env", "envs"},
+	Short:   "Manage project environments",
+}
+
+var envListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List environments in a project",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		project, _ := cmd.Flags().GetString("project")
+		if project == "" {
+			return fmt.Errorf("--project is required")
+		}
+		data, err := c.Do("GET", "/projects/"+project+"/environments", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "environments")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, e := range items {
+			rows = append(rows, []string{
+				str(e, "id"), str(e, "name"), str(e, "service_count"), relTime(e, "created_at"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "SERVICES", "CREATED"}, rows)
+		return nil
+	},
+}
+
+var envCreateCmd = &cobra.Command{
+	Use:   "create <name>",
+	Short: "Create an environment in a project",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		project, _ := cmd.Flags().GetString("project")
+		if project == "" {
+			return fmt.Errorf("--project is required")
+		}
+		data, err := c.Do("POST", "/projects/"+project+"/environments", map[string]interface{}{
+			"name": args[0],
+		})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var envDeleteCmd = &cobra.Command{
+	Use:   "delete <id>",
+	Short: "Delete an empty environment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if !Confirm("Delete environment " + args[0] + "?") {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		_, err = c.Do("DELETE", "/environments/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		fmt.Println("Environment deleted")
+		return nil
+	},
+}
+
+func init() {
+	envListCmd.Flags().String("project", "", "project ID (required)")
+	envCreateCmd.Flags().String("project", "", "project ID (required)")
+	EnvironmentsCmd.AddCommand(envListCmd, envCreateCmd, envDeleteCmd)
+}

app/backend/internal/cli/commands/exec.go

@@ -4,9 +4,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
-	"os/signal"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/gorilla/websocket"
@@ -44,20 +42,13 @@ var ShellCmd = &cobra.Command{
 			if err == nil {
 				defer term.Restore(fd, oldState)
 			}
-			if w, h, err := term.GetSize(fd); err == nil {
-				_ = conn.WriteJSON(map[string]interface{}{"type": "resize", "cols": w, "rows": h})
-			}
-			// Forward SIGWINCH resizes.
-			sigCh := make(chan os.Signal, 1)
-			signal.Notify(sigCh, syscall.SIGWINCH)
-			defer signal.Stop(sigCh)
-			go func() {
-				for range sigCh {
-					if w, h, err := term.GetSize(fd); err == nil {
-						_ = conn.WriteJSON(map[string]interface{}{"type": "resize", "cols": w, "rows": h})
-					}
+			sendSize := func() {
+				if w, h, err := term.GetSize(fd); err == nil {
+					_ = conn.WriteJSON(map[string]interface{}{"type": "resize", "cols": w, "rows": h})
 				}
-			}()
+			}
+			sendSize()
+			defer watchResize(sendSize)()
 		}
 
 		done := make(chan struct{})

app/backend/internal/cli/commands/exec_resize_unix.go

@@ -0,0 +1,30 @@
+//go:build !windows
+
+package commands
+
+import (
+	"os"
+	"os/signal"
+	"syscall"
+)
+
+// watchResize forwards SIGWINCH events to send. Returns a stop func.
+func watchResize(send func()) func() {
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, syscall.SIGWINCH)
+	done := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-sigCh:
+				send()
+			case <-done:
+				return
+			}
+		}
+	}()
+	return func() {
+		signal.Stop(sigCh)
+		close(done)
+	}
+}

app/backend/internal/cli/commands/exec_resize_windows.go

@@ -0,0 +1,8 @@
+//go:build windows
+
+package commands
+
+// watchResize is a no-op on Windows — console resize events don't map to a
+// signal. The initial size is still sent, and Windows Terminal resize is rare
+// enough to accept stale dimensions for now.
+func watchResize(send func()) func() { return func() {} }

app/backend/internal/cli/commands/migrate.go

@@ -0,0 +1,374 @@
+package commands
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+)
+
+const railwayAPI = "https://backboard.railway.com/graphql/v2"
+
+// railwaySource mirrors the Railway serviceInstance.source union.
+type railwaySource struct {
+	Repo  string `json:"repo"`
+	Image string `json:"image"`
+}
+
+type railwayServicePlan struct {
+	ID        string
+	Name      string
+	Source    railwaySource
+	Command   string
+	Replicas  int
+	Domains   []string
+	Variables map[string]string
+}
+
+// MigrateCmd imports workloads from other platforms.
+var MigrateCmd = &cobra.Command{
+	Use:   "migrate",
+	Short: "Import workloads from other platforms",
+}
+
+var migrateRailwayCmd = &cobra.Command{
+	Use:   "railway",
+	Short: "Migrate a Railway project into Containr",
+	Long: `Pulls a Railway project's services, variables, and domains via the
+public GraphQL API and recreates them in Containr.
+
+  containr migrate railway --token <railway-token> --project <id> --dry-run
+  containr migrate railway --token <railway-token> --project <id> --into <project-id>
+
+Token: account/workspace token (Authorization: Bearer) or a project token.
+--into defaults to creating a project named after the Railway project.`,
+	Args: cobra.NoArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		token, _ := cmd.Flags().GetString("token")
+		if token == "" {
+			token = os.Getenv("RAILWAY_TOKEN")
+		}
+		if token == "" {
+			return &APIError{Message: "pass --token or set RAILWAY_TOKEN", ExitCode: ExitError}
+		}
+		projectID, _ := cmd.Flags().GetString("project")
+		envName, _ := cmd.Flags().GetString("environment")
+		into, _ := cmd.Flags().GetString("into")
+		dryRun, _ := cmd.Flags().GetBool("dry-run")
+
+		projectName, envID, services, err := railwayProject(projectID, envName, token)
+		if err != nil {
+			return err
+		}
+		if len(services) == 0 {
+			return &APIError{Message: "no services found in that Railway project/environment", ExitCode: ExitError}
+		}
+
+		plans := make([]railwayServicePlan, 0, len(services))
+		for _, svc := range services {
+			plan, err := railwayServiceDetail(svc, envID, token)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "warning: %s: %v — skipping\n", svc["name"], err)
+				continue
+			}
+			plans = append(plans, plan)
+		}
+		if len(plans) == 0 {
+			return &APIError{Message: "no migratable services", ExitCode: ExitError}
+		}
+
+		fmt.Printf("Railway project %q → %d service(s)\n", projectName, len(plans))
+		for _, p := range plans {
+			src := p.Source.Image
+			if src == "" {
+				src = railwayRepoURL(p.Source.Repo)
+			}
+			fmt.Printf("  %s  src=%s replicas=%d vars=%d domains=%d\n",
+				p.Name, src, max(p.Replicas, 1), len(p.Variables), len(p.Domains))
+		}
+
+		if dryRun {
+			fmt.Println("\nDry run — pass without --dry-run to create these resources.")
+			return nil
+		}
+
+		c, err := client()
+		if err != nil {
+			return err
+		}
+
+		target := into
+		if target == "" {
+			data, err := c.Do("POST", "/projects", map[string]interface{}{
+				"name":        projectName,
+				"description": "Imported from Railway",
+			})
+			if err != nil {
+				return err
+			}
+			p, _ := unwrapObject(data, "project")
+			target = str(p, "id")
+			if target == "" || target == "-" {
+				return &APIError{Message: "project created but id missing from response", ExitCode: ExitError}
+			}
+			fmt.Printf("Created project %s (%s)\n", projectName, target)
+		}
+
+		for _, p := range plans {
+			body := map[string]interface{}{
+				"name":        p.Name,
+				"type":        "web",
+				"environment": "production",
+			}
+			if p.Source.Image != "" {
+				body["image"] = p.Source.Image
+			} else if repo := railwayRepoURL(p.Source.Repo); repo != "" {
+				body["git_repo"] = repo
+			} else {
+				fmt.Fprintf(os.Stderr, "warning: %s has no source — skipping\n", p.Name)
+				continue
+			}
+			if p.Command != "" {
+				body["command"] = p.Command
+			}
+			if p.Replicas > 1 {
+				body["replicas"] = p.Replicas
+			}
+			data, err := c.Do("POST", "/projects/"+target+"/services", body)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "error: create %s: %v\n", p.Name, err)
+				continue
+			}
+			svc, _ := unwrapObject(data, "service")
+			svcID := str(svc, "id")
+			fmt.Printf("  created service %s (%s)\n", p.Name, svcID)
+
+			if len(p.Variables) > 0 && svcID != "" && svcID != "-" {
+				vars := make([]map[string]interface{}, 0, len(p.Variables))
+				for k, v := range p.Variables {
+					vars = append(vars, map[string]interface{}{"key": k, "value": v, "is_secret": false})
+				}
+				if _, err := c.Do("PUT", "/services/"+svcID+"/variables",
+					map[string]interface{}{"variables": vars}); err != nil {
+					fmt.Fprintf(os.Stderr, "  warning: variables for %s: %v\n", p.Name, err)
+				}
+			}
+			for _, domain := range p.Domains {
+				if svcID == "" || svcID == "-" {
+					break
+				}
+				if _, err := c.Do("POST", "/services/"+svcID+"/domains",
+					map[string]interface{}{"domain": domain}); err != nil {
+					fmt.Fprintf(os.Stderr, "  warning: domain %s: %v\n", domain, err)
+				}
+			}
+		}
+		fmt.Println("Done. Railway deploy triggers are not migrated — redeploy each service when ready.")
+		return nil
+	},
+}
+
+// railwayGraphQL posts a query; Railway returns 200 with an errors array on
+// partial failures — treat errors as fatal, the migration needs clean data.
+func railwayGraphQL(token, query string, variables map[string]interface{}) (map[string]interface{}, error) {
+	body, _ := json.Marshal(map[string]interface{}{"query": query, "variables": variables})
+	req, err := http.NewRequest(http.MethodPost, railwayAPI, bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	// Project tokens use a dedicated header; account/workspace tokens use Bearer.
+	if strings.HasPrefix(token, "rw_pat") || strings.HasPrefix(token, "rw_pt") {
+		req.Header.Set("Project-Access-Token", token)
+	} else {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	var out struct {
+		Data   map[string]interface{} `json:"data"`
+		Errors []struct {
+			Message string `json:"message"`
+		} `json:"errors"`
+	}
+	if err := json.Unmarshal(raw, &out); err != nil {
+		return nil, fmt.Errorf("railway response not JSON (status %d)", resp.StatusCode)
+	}
+	if len(out.Errors) > 0 {
+		return nil, fmt.Errorf("railway: %s", out.Errors[0].Message)
+	}
+	if resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("railway status %d", resp.StatusCode)
+	}
+	return out.Data, nil
+}
+
+// railwayProject resolves the project (by id, or sole accessible project) and
+// returns its name, the target environment id, and its services.
+func railwayProject(projectID, envName, token string) (string, string, []map[string]interface{}, error) {
+	if projectID == "" {
+		data, err := railwayGraphQL(token,
+			`query { projects(first: 100) { edges { node { id name } } } }`, nil)
+		if err != nil {
+			return "", "", nil, err
+		}
+		projects := edgesOf(data, "projects")
+		if len(projects) == 1 {
+			projectID = str(projects[0], "id")
+		} else {
+			for _, p := range projects {
+				fmt.Fprintf(os.Stderr, "  %s  %s\n", str(p, "id"), str(p, "name"))
+			}
+			return "", "", nil, &APIError{
+				Message:  "multiple projects — pass --project <id> (listed above)",
+				ExitCode: ExitError,
+			}
+		}
+	}
+
+	data, err := railwayGraphQL(token, `query ($id: String!) {
+		project(id: $id) {
+			name
+			environments { edges { node { id name } } }
+			services { edges { node { id name } } }
+		}
+	}`, map[string]interface{}{"id": projectID})
+	if err != nil {
+		return "", "", nil, err
+	}
+	project, _ := data["project"].(map[string]interface{})
+	if project == nil {
+		return "", "", nil, &APIError{Message: "railway project not found", ExitCode: ExitNotFound}
+	}
+	envs := edgesOf(project, "environments")
+	envID := ""
+	for _, e := range envs {
+		if str(e, "name") == envName {
+			envID = str(e, "id")
+			break
+		}
+	}
+	if envID == "" && len(envs) == 1 {
+		envID = str(envs[0], "id")
+	}
+	if envID == "" {
+		names := make([]string, 0, len(envs))
+		for _, e := range envs {
+			names = append(names, str(e, "name"))
+		}
+		return "", "", nil, &APIError{
+			Message:  fmt.Sprintf("environment %q not found (have: %s)", envName, strings.Join(names, ", ")),
+			ExitCode: ExitError,
+		}
+	}
+	return str(project, "name"), envID, edgesOf(project, "services"), nil
+}
+
+// railwayServiceDetail pulls source, command, replicas, domains, and
+// variables for one service in the target environment.
+func railwayServiceDetail(svc map[string]interface{}, envID, token string) (railwayServicePlan, error) {
+	plan := railwayServicePlan{
+		ID:   str(svc, "id"),
+		Name: str(svc, "name"),
+	}
+	data, err := railwayGraphQL(token, `query ($sid: String!, $eid: String!) {
+		serviceInstance(serviceId: $sid, environmentId: $eid) {
+			startCommand
+			numReplicas
+			source { repo image }
+			domains { serviceDomains { domain } customDomains { domain } }
+		}
+	}`, map[string]interface{}{"sid": plan.ID, "eid": envID})
+	if err != nil {
+		return plan, err
+	}
+	inst, _ := data["serviceInstance"].(map[string]interface{})
+	if inst == nil {
+		return plan, fmt.Errorf("no service instance in this environment")
+	}
+	if src, ok := inst["source"].(map[string]interface{}); ok {
+		plan.Source = railwaySource{Repo: str(src, "repo"), Image: str(src, "image")}
+	}
+	if cmd, ok := inst["startCommand"].(string); ok {
+		plan.Command = cmd
+	}
+	if n, ok := inst["numReplicas"].(float64); ok {
+		plan.Replicas = int(n)
+	}
+	if domains, ok := inst["domains"].(map[string]interface{}); ok {
+		for _, group := range []string{"serviceDomains", "customDomains"} {
+			if list, ok := domains[group].([]interface{}); ok {
+				for _, d := range list {
+					if m, ok := d.(map[string]interface{}); ok {
+						if dom := str(m, "domain"); dom != "" && dom != "-" {
+							plan.Domains = append(plan.Domains, dom)
+						}
+					}
+				}
+			}
+		}
+	}
+
+	vdata, err := railwayGraphQL(token, `query ($sid: String!, $eid: String!) {
+		variables(serviceId: $sid, environmentId: $eid)
+	}`, map[string]interface{}{"sid": plan.ID, "eid": envID})
+	if err == nil {
+		if vars, ok := vdata["variables"].(map[string]interface{}); ok {
+			plan.Variables = map[string]string{}
+			for k, v := range vars {
+				if s, ok := v.(string); ok {
+					// Railway reference variables (${{…}}) resolve at deploy
+					// time — carry them literally so they stay visible.
+					plan.Variables[k] = s
+				}
+			}
+		}
+	}
+	return plan, nil
+}
+
+// railwayRepoURL normalizes Railway's "owner/repo" to a cloneable https URL.
+func railwayRepoURL(repo string) string {
+	repo = strings.TrimSpace(repo)
+	if repo == "" || repo == "-" {
+		return ""
+	}
+	if strings.Contains(repo, "://") || strings.HasPrefix(repo, "git@") {
+		return repo
+	}
+	return "https://github.com/" + repo
+}
+
+func edgesOf(obj map[string]interface{}, key string) []map[string]interface{} {
+	conn, _ := obj[key].(map[string]interface{})
+	edges, _ := conn["edges"].([]interface{})
+	out := make([]map[string]interface{}, 0, len(edges))
+	for _, e := range edges {
+		if m, ok := e.(map[string]interface{}); ok {
+			if node, ok := m["node"].(map[string]interface{}); ok {
+				out = append(out, node)
+			}
+		}
+	}
+	return out
+}
+
+func init() {
+	migrateRailwayCmd.Flags().String("token", "", "Railway API token (or RAILWAY_TOKEN env)")
+	migrateRailwayCmd.Flags().String("project", "", "Railway project id (lists yours when omitted and >1 exists)")
+	migrateRailwayCmd.Flags().String("environment", "production", "Railway environment name")
+	migrateRailwayCmd.Flags().String("into", "", "existing Containr project id (default: create one)")
+	migrateRailwayCmd.Flags().Bool("dry-run", false, "print the plan without creating anything")
+	MigrateCmd.AddCommand(migrateRailwayCmd)
+}

app/backend/internal/cli/commands/migrate_dflow.go

@@ -0,0 +1,441 @@
+package commands
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+)
+
+// dflow runs on Payload CMS — every collection is a plain REST resource under
+// /api/<slug> returning {docs, page, totalPages, hasNextPage}. Auth is a
+// Payload API key on the users collection: "Authorization: users API-Key <k>".
+
+type dflowServicePlan struct {
+	ID          string
+	Name        string
+	Description string
+	Type        string // web | database
+	Image       string
+	GitRepo     string
+	GitBranch   string
+	BuildPath   string
+	Port        int
+	Variables   map[string]string
+	Domains     []string
+	Volumes     []map[string]string
+}
+
+var migrateDflowCmd = &cobra.Command{
+	Use:   "dflow",
+	Short: "Migrate a dflow (Payload CMS) project into Containr",
+	Long: `Pulls a dflow project's services, variables, volumes, and domains via the
+Payload REST API and recreates them in Containr.
+
+  containr migrate dflow --url https://dflow.example.com --api-key <key> --dry-run
+  containr migrate dflow --url https://dflow.example.com --api-key <key> --project <id>
+
+Auth: a Payload API key from a dflow admin user (users API-Key). Encrypted
+fields (variables, git tokens) only come back decrypted if the API key belongs
+to a user with access — empty values are flagged so nothing is silently lost.`,
+	Args: cobra.NoArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		base, _ := cmd.Flags().GetString("url")
+		if base == "" {
+			base = os.Getenv("DFLOW_URL")
+		}
+		if base == "" {
+			return &APIError{Message: "pass --url or set DFLOW_URL", ExitCode: ExitError}
+		}
+		base = strings.TrimSuffix(base, "/")
+		key, _ := cmd.Flags().GetString("api-key")
+		if key == "" {
+			key = os.Getenv("DFLOW_API_KEY")
+		}
+		if key == "" {
+			return &APIError{Message: "pass --api-key or set DFLOW_API_KEY", ExitCode: ExitError}
+		}
+		projectID, _ := cmd.Flags().GetString("project")
+		into, _ := cmd.Flags().GetString("into")
+		dryRun, _ := cmd.Flags().GetBool("dry-run")
+
+		projectName, services, err := dflowProject(base, key, projectID)
+		if err != nil {
+			return err
+		}
+		if len(services) == 0 {
+			return &APIError{Message: "no services found in that dflow project", ExitCode: ExitError}
+		}
+
+		plans := make([]dflowServicePlan, 0, len(services))
+		for _, svc := range services {
+			plan, warn := dflowServicePlanOf(svc)
+			for _, w := range warn {
+				fmt.Fprintf(os.Stderr, "  warning: %s: %s\n", plan.Name, w)
+			}
+			plans = append(plans, plan)
+		}
+
+		fmt.Printf("dflow project %q → %d service(s)\n", projectName, len(plans))
+		for _, p := range plans {
+			src := p.Image
+			if src == "" {
+				src = p.GitRepo
+			}
+			fmt.Printf("  %s  type=%s src=%s vars=%d domains=%d volumes=%d\n",
+				p.Name, p.Type, src, len(p.Variables), len(p.Domains), len(p.Volumes))
+		}
+
+		if dryRun {
+			fmt.Println("\nDry run — pass without --dry-run to create these resources.")
+			return nil
+		}
+
+		c, err := client()
+		if err != nil {
+			return err
+		}
+
+		target := into
+		if target == "" {
+			data, err := c.Do("POST", "/projects", map[string]interface{}{
+				"name":        projectName,
+				"description": "Imported from dflow",
+			})
+			if err != nil {
+				return err
+			}
+			p, _ := unwrapObject(data, "project")
+			target = str(p, "id")
+			if target == "" || target == "-" {
+				return &APIError{Message: "project created but id missing from response", ExitCode: ExitError}
+			}
+			fmt.Printf("Created project %s (%s)\n", projectName, target)
+		}
+
+		for _, p := range plans {
+			body := map[string]interface{}{
+				"name":        p.Name,
+				"type":        p.Type,
+				"environment": "production",
+			}
+			if p.Image != "" {
+				body["image"] = p.Image
+			}
+			if p.GitRepo != "" {
+				body["git_repo"] = p.GitRepo
+			}
+			if p.GitBranch != "" {
+				body["git_branch"] = p.GitBranch
+			}
+			if p.BuildPath != "" {
+				body["build_path"] = p.BuildPath
+			}
+			if p.Port > 0 {
+				body["port"] = p.Port
+			}
+			if len(p.Volumes) > 0 {
+				vols := make([]map[string]interface{}, 0, len(p.Volumes))
+				for _, v := range p.Volumes {
+					vols = append(vols, map[string]interface{}{
+						"type": "bind", "source": v["source"], "target": v["target"],
+					})
+				}
+				body["volumes"] = vols
+			}
+			data, err := c.Do("POST", "/projects/"+target+"/services", body)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "error: create %s: %v\n", p.Name, err)
+				continue
+			}
+			svc, _ := unwrapObject(data, "service")
+			svcID := str(svc, "id")
+			fmt.Printf("  created service %s (%s)\n", p.Name, svcID)
+
+			if len(p.Variables) > 0 && svcID != "" && svcID != "-" {
+				vars := make([]map[string]interface{}, 0, len(p.Variables))
+				for k, v := range p.Variables {
+					vars = append(vars, map[string]interface{}{"key": k, "value": v, "is_secret": false})
+				}
+				if _, err := c.Do("PUT", "/services/"+svcID+"/variables",
+					map[string]interface{}{"variables": vars}); err != nil {
+					fmt.Fprintf(os.Stderr, "  warning: variables for %s: %v\n", p.Name, err)
+				}
+			}
+			for _, domain := range p.Domains {
+				if svcID == "" || svcID == "-" {
+					break
+				}
+				if _, err := c.Do("POST", "/services/"+svcID+"/domains",
+					map[string]interface{}{"domain": domain}); err != nil {
+					fmt.Fprintf(os.Stderr, "  warning: domain %s: %v\n", domain, err)
+				}
+			}
+		}
+		fmt.Println("Done. Git credentials, deployment history, and server topology are not migrated — reconnect repos and redeploy each service when ready.")
+		return nil
+	},
+}
+
+// dflowGet performs an authenticated Payload REST call.
+func dflowGet(base, apiKey, path string, q url.Values) (map[string]interface{}, error) {
+	u := base + "/api/" + path
+	if len(q) > 0 {
+		u += "?" + q.Encode()
+	}
+	req, err := http.NewRequest(http.MethodGet, u, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "users API-Key "+apiKey)
+	req.Header.Set("Accept", "application/json")
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 16<<20))
+	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
+		return nil, &APIError{Message: "dflow rejected the API key — needs an admin user's users API-Key", ExitCode: ExitAuth}
+	}
+	var out map[string]interface{}
+	if err := json.Unmarshal(raw, &out); err != nil {
+		return nil, fmt.Errorf("dflow response not JSON (status %d)", resp.StatusCode)
+	}
+	if resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("dflow status %d", resp.StatusCode)
+	}
+	return out, nil
+}
+
+// dflowCollection pages through a Payload collection.
+func dflowCollection(base, apiKey, collection string, q url.Values) ([]map[string]interface{}, error) {
+	var docs []map[string]interface{}
+	for page := 1; ; page++ {
+		params := url.Values{}
+		for k, v := range q {
+			params[k] = v
+		}
+		params.Set("limit", "100")
+		params.Set("depth", "0")
+		params.Set("page", fmt.Sprint(page))
+		data, err := dflowGet(base, apiKey, collection, params)
+		if err != nil {
+			return nil, err
+		}
+		list, _ := data["docs"].([]interface{})
+		for _, d := range list {
+			if m, ok := d.(map[string]interface{}); ok {
+				docs = append(docs, m)
+			}
+		}
+		next, _ := data["hasNextPage"].(bool)
+		if !next {
+			return docs, nil
+		}
+	}
+}
+
+// dflowProject resolves the project (by id, or sole project) and returns its
+// name plus its services.
+func dflowProject(base, apiKey, projectID string) (string, []map[string]interface{}, error) {
+	if projectID == "" {
+		projects, err := dflowCollection(base, apiKey, "projects", nil)
+		if err != nil {
+			return "", nil, err
+		}
+		if len(projects) == 1 {
+			projectID = str(projects[0], "id")
+		} else {
+			for _, p := range projects {
+				fmt.Fprintf(os.Stderr, "  %s  %s\n", str(p, "id"), str(p, "name"))
+			}
+			return "", nil, &APIError{
+				Message:  "multiple projects — pass --project <id> (listed above)",
+				ExitCode: ExitError,
+			}
+		}
+	}
+
+	projects, err := dflowCollection(base, apiKey, "projects",
+		url.Values{"where[id][equals]": {projectID}})
+	if err != nil {
+		return "", nil, err
+	}
+	if len(projects) == 0 {
+		return "", nil, &APIError{Message: "dflow project not found", ExitCode: ExitNotFound}
+	}
+	name := str(projects[0], "name")
+
+	q := url.Values{
+		"where[project][equals]":     {projectID},
+		"where[deletedAt][exists]":   {"false"},
+		"where[_status][not_equals]": {"draft"},
+	}
+	services, err := dflowCollection(base, apiKey, "services", q)
+	if err != nil {
+		return "", nil, err
+	}
+	return name, services, nil
+}
+
+// dflowServicePlanOf maps a Payload service doc onto a Containr create plan.
+func dflowServicePlanOf(svc map[string]interface{}) (dflowServicePlan, []string) {
+	var warn []string
+	plan := dflowServicePlan{
+		ID:          str(svc, "id"),
+		Name:        str(svc, "name"),
+		Description: str(svc, "description"),
+		Variables:   map[string]string{},
+	}
+	switch str(svc, "type") {
+	case "app":
+		plan.Type = "web"
+		settings := dflowProviderSettings(svc)
+		plan.GitRepo = dflowRepoURL(str(svc, "providerType"), str(settings, "owner"), str(settings, "repository"))
+		plan.GitBranch = str(settings, "branch")
+		plan.BuildPath = str(settings, "buildPath")
+		plan.Port = int(num(settings, "port"))
+		if plan.GitRepo == "" {
+			warn = append(warn, "no repository settings — importing with no source")
+		}
+	case "docker":
+		plan.Type = "web"
+		d, _ := svc["dockerDetails"].(map[string]interface{})
+		plan.Image = normalizeDockerImage(str(d, "url"))
+		for _, p := range listOf(d, "ports") {
+			if plan.Port == 0 {
+				plan.Port = int(num(p, "containerPort"))
+			}
+		}
+		if plan.Image == "" {
+			warn = append(warn, "no docker image url — importing with no source")
+		}
+	case "database":
+		plan.Type = "database"
+		d, _ := svc["databaseDetails"].(map[string]interface{})
+		dbType := str(d, "type")
+		version := str(d, "version")
+		if dbType != "" {
+			plan.Image = dbType + ":" + firstOf(version, "latest")
+		}
+		if str(d, "provider") == "external" {
+			if conn := str(d, "connectionUrl"); conn != "" {
+				plan.Variables["DATABASE_URL"] = conn
+			} else if str(d, "host") != "" {
+				warn = append(warn, "external database has host but no connectionUrl — set DATABASE_URL manually")
+			}
+		}
+	default:
+		plan.Type = "web"
+		warn = append(warn, fmt.Sprintf("unknown type %q — imported as web", str(svc, "type")))
+	}
+
+	for _, v := range listOf(svc, "variables") {
+		k, val := str(v, "key"), str(v, "value")
+		if k == "" {
+			continue
+		}
+		if val == "" {
+			warn = append(warn, fmt.Sprintf("variable %s came back empty (encrypted field?)", k))
+		}
+		plan.Variables[k] = val
+	}
+	for _, d := range listOf(svc, "domains") {
+		if dom := str(d, "domain"); dom != "" && dom != "-" {
+			plan.Domains = append(plan.Domains, dom)
+		}
+	}
+	for _, v := range listOf(svc, "volumes") {
+		host, container := str(v, "hostPath"), str(v, "containerPath")
+		if host != "" && container != "" {
+			plan.Volumes = append(plan.Volumes, map[string]string{"source": host, "target": container})
+		}
+	}
+	return plan, warn
+}
+
+// dflowProviderSettings picks the populated <provider>Settings group.
+func dflowProviderSettings(svc map[string]interface{}) map[string]interface{} {
+	for _, key := range []string{"githubSettings", "gitlabSettings", "bitbucketSettings", "giteaSettings", "azureSettings"} {
+		if g, ok := svc[key].(map[string]interface{}); ok && str(g, "repository") != "" {
+			return g
+		}
+	}
+	return nil
+}
+
+// dflowRepoURL builds a cloneable https URL for the known git providers.
+func dflowRepoURL(providerType, owner, repo string) string {
+	repo = strings.TrimSuffix(strings.TrimSpace(repo), ".git")
+	owner = strings.TrimSpace(owner)
+	if repo == "" {
+		return ""
+	}
+	if strings.Contains(repo, "://") || strings.HasPrefix(repo, "git@") {
+		return repo
+	}
+	switch providerType {
+	case "gitlab":
+		return "https://gitlab.com/" + owner + "/" + repo
+	case "bitbucket":
+		return "https://bitbucket.org/" + owner + "/" + repo
+	case "azureDevOps":
+		return "https://dev.azure.com/" + owner + "/_git/" + repo
+	case "gitea":
+		return "" // host unknown — user must reconnect the repo
+	default:
+		if owner == "" {
+			return ""
+		}
+		return "https://github.com/" + owner + "/" + repo
+	}
+}
+
+// normalizeDockerImage fixes common dflow registry URL typos (ghrc://).
+func normalizeDockerImage(image string) string {
+	image = strings.TrimSpace(image)
+	if strings.HasPrefix(image, "ghrc://") {
+		return "ghcr.io/" + strings.TrimPrefix(image, "ghrc://")
+	}
+	return image
+}
+
+func listOf(m map[string]interface{}, key string) []map[string]interface{} {
+	raw, _ := m[key].([]interface{})
+	out := make([]map[string]interface{}, 0, len(raw))
+	for _, item := range raw {
+		if v, ok := item.(map[string]interface{}); ok {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+func num(m map[string]interface{}, key string) float64 {
+	v, _ := m[key].(float64)
+	return v
+}
+
+func firstOf(v, fallback string) string {
+	if v == "" {
+		return fallback
+	}
+	return v
+}
+
+func init() {
+	migrateDflowCmd.Flags().String("url", "", "dflow base URL (or DFLOW_URL env)")
+	migrateDflowCmd.Flags().String("api-key", "", "dflow admin API key (or DFLOW_API_KEY env)")
+	migrateDflowCmd.Flags().String("project", "", "dflow project id (lists yours when omitted and >1 exists)")
+	migrateDflowCmd.Flags().String("into", "", "existing Containr project id (default: create one)")
+	migrateDflowCmd.Flags().Bool("dry-run", false, "print the plan without creating anything")
+	MigrateCmd.AddCommand(migrateDflowCmd)
+}

app/backend/internal/cli/commands/migrate_test.go

@@ -0,0 +1,122 @@
+package commands
+
+import "testing"
+
+func TestRailwayRepoURL(t *testing.T) {
+	cases := map[string]string{
+		"owner/repo":             "https://github.com/owner/repo",
+		"https://gitlab.com/a/b": "https://gitlab.com/a/b",
+		"[email protected]:a/b.git": "[email protected]:a/b.git",
+		"":                       "",
+		"-":                      "",
+		"  spaced/x  ":           "https://github.com/spaced/x",
+	}
+	for in, want := range cases {
+		if got := railwayRepoURL(in); got != want {
+			t.Errorf("railwayRepoURL(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestEdgesOf(t *testing.T) {
+	obj := map[string]interface{}{
+		"services": map[string]interface{}{
+			"edges": []interface{}{
+				map[string]interface{}{"node": map[string]interface{}{"id": "a", "name": "web"}},
+				map[string]interface{}{"node": map[string]interface{}{"id": "b", "name": "api"}},
+			},
+		},
+	}
+	nodes := edgesOf(obj, "services")
+	if len(nodes) != 2 || str(nodes[0], "name") != "web" {
+		t.Fatalf("edgesOf returned %+v", nodes)
+	}
+	if got := edgesOf(obj, "missing"); len(got) != 0 {
+		t.Fatalf("edgesOf(missing) = %+v, want empty", got)
+	}
+	if got := edgesOf(map[string]interface{}{"services": nil}, "services"); len(got) != 0 {
+		t.Fatalf("edgesOf(nil conn) = %+v, want empty", got)
+	}
+}
+
+func TestDflowServicePlanOf(t *testing.T) {
+	appSvc := map[string]interface{}{
+		"id":           "s1",
+		"name":         "api",
+		"type":         "app",
+		"providerType": "github",
+		"githubSettings": map[string]interface{}{
+			"owner": "acme", "repository": "api", "branch": "main",
+			"buildPath": "/", "port": float64(8080),
+		},
+		"variables": []interface{}{
+			map[string]interface{}{"key": "FOO", "value": "bar"},
+			map[string]interface{}{"key": "EMPTY", "value": ""},
+		},
+		"domains": []interface{}{
+			map[string]interface{}{"domain": "api.example.com"},
+		},
+		"volumes": []interface{}{
+			map[string]interface{}{"hostPath": "/data", "containerPath": "/app/data"},
+		},
+	}
+	plan, warn := dflowServicePlanOf(appSvc)
+	if plan.Type != "web" || plan.GitRepo != "https://github.com/acme/api" || plan.Port != 8080 {
+		t.Fatalf("app plan = %+v", plan)
+	}
+	if plan.Variables["FOO"] != "bar" || len(plan.Domains) != 1 || len(plan.Volumes) != 1 {
+		t.Fatalf("plan detail = %+v", plan)
+	}
+	if len(warn) != 1 { // EMPTY value flagged
+		t.Fatalf("warnings = %v", warn)
+	}
+
+	dbSvc := map[string]interface{}{
+		"id": "s2", "name": "pg", "type": "database",
+		"databaseDetails": map[string]interface{}{
+			"type": "postgres", "version": "16", "provider": "external",
+			"connectionUrl": "postgres://u:p@h:5432/db",
+		},
+	}
+	dplan, _ := dflowServicePlanOf(dbSvc)
+	if dplan.Type != "database" || dplan.Image != "postgres:16" {
+		t.Fatalf("db plan = %+v", dplan)
+	}
+	if dplan.Variables["DATABASE_URL"] != "postgres://u:p@h:5432/db" {
+		t.Fatalf("db vars = %+v", dplan.Variables)
+	}
+
+	dockerSvc := map[string]interface{}{
+		"id": "s3", "name": "img", "type": "docker",
+		"dockerDetails": map[string]interface{}{
+			"url": "ghrc://acme/web:v1",
+			"ports": []interface{}{
+				map[string]interface{}{"hostPort": float64(80), "containerPort": float64(3000), "scheme": "http"},
+			},
+		},
+	}
+	iplan, _ := dflowServicePlanOf(dockerSvc)
+	if iplan.Image != "ghcr.io/acme/web:v1" || iplan.Port != 3000 {
+		t.Fatalf("docker plan = %+v", iplan)
+	}
+}
+
+func TestDflowRepoURL(t *testing.T) {
+	cases := []struct {
+		provider, owner, repo, want string
+	}{
+		{"github", "acme", "api", "https://github.com/acme/api"},
+		{"gitlab", "acme", "api", "https://gitlab.com/acme/api"},
+		{"bitbucket", "acme", "api", "https://bitbucket.org/acme/api"},
+		{"gitea", "acme", "api", ""},
+		{"github", "acme", "api.git", "https://github.com/acme/api"},
+		{"github", "", "api", ""},
+		{"github", "acme", "", ""},
+		{"github", "acme", "https://git.example.com/a/b", "https://git.example.com/a/b"},
+	}
+	for _, c := range cases {
+		if got := dflowRepoURL(c.provider, c.owner, c.repo); got != c.want {
+			t.Errorf("dflowRepoURL(%q,%q,%q) = %q, want %q", c.provider, c.owner, c.repo, got, c.want)
+		}
+	}
+}

app/backend/internal/cli/commands/nodes.go

@@ -2,6 +2,7 @@ package commands
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/spf13/cobra"
 )
@@ -81,6 +82,164 @@ var nodesDeleteCmd = &cobra.Command{
 	},
 }
 
+var nodesUpdateCmd = &cobra.Command{
+	Use:   "update <id>",
+	Short: "Update a node agent (--name, --auto-prune, --tags, --domain)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{}
+		if cmd.Flags().Changed("name") {
+			body["name"], _ = cmd.Flags().GetString("name")
+		}
+		if cmd.Flags().Changed("auto-prune") {
+			body["auto_prune"], _ = cmd.Flags().GetBool("auto-prune")
+		}
+		if cmd.Flags().Changed("tags") {
+			raw, _ := cmd.Flags().GetString("tags")
+			tags := []string{}
+			for _, t := range strings.Split(raw, ",") {
+				if t = strings.TrimSpace(t); t != "" {
+					tags = append(tags, t)
+				}
+			}
+			body["tags"] = tags
+		}
+		if cmd.Flags().Changed("domain") {
+			body["default_domain"], _ = cmd.Flags().GetString("domain")
+		}
+		if len(body) == 0 {
+			return &APIError{Message: "nothing to update — pass --name, --auto-prune, --tags or --domain", ExitCode: ExitError}
+		}
+		data, err := c.Do("PUT", "/agents/"+args[0], body)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodesPruneCmd = &cobra.Command{
+	Use:   "prune <id>",
+	Short: "Enqueue a bounded docker system prune on a node",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		volumes, _ := cmd.Flags().GetBool("volumes")
+		if volumes && !Confirm("Prune INCLUDING volumes? This can delete database data.") {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		until, _ := cmd.Flags().GetString("until")
+		data, err := c.Do("POST", "/agents/"+args[0]+"/prune",
+			map[string]interface{}{"until": until, "volumes": volumes})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodesCordonCmd = &cobra.Command{
+	Use:   "cordon <id>",
+	Short: "Stop new placements on a node (running replicas stay)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/agents/"+args[0]+"/cordon", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodesUncordonCmd = &cobra.Command{
+	Use:   "uncordon <id>",
+	Short: "Re-open a node for placement",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/agents/"+args[0]+"/uncordon", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodesDrainCmd = &cobra.Command{
+	Use:   "drain <id>",
+	Short: "Cordon a node, remove its service containers, unpin affected services",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Drain node %s? Its service containers are removed and services unpinned (they redeploy locally).", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		data, err := c.Do("POST", "/agents/"+args[0]+"/drain", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodesUpgradeCmd = &cobra.Command{
+	Use:   "upgrade <id>",
+	Short: "Upgrade the node agent to the server's bundled binary",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/agents/"+args[0]+"/upgrade", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodesCommandsCmd = &cobra.Command{
+	Use:   "commands <id>",
+	Short: "List recent commands sent to a node agent",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/agents/"+args[0]+"/commands", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
 // Agent tokens (cagt_) onboard new nodes.
 var nodeTokensCmd = &cobra.Command{
 	Use:   "tokens",
@@ -145,6 +304,12 @@ var nodeTokensRevokeCmd = &cobra.Command{
 }
 
 func init() {
+	nodesUpdateCmd.Flags().String("name", "", "node display name")
+	nodesUpdateCmd.Flags().Bool("auto-prune", false, "enqueue a daily bounded docker prune")
+	nodesUpdateCmd.Flags().String("tags", "", "comma-separated placement tags (services with placement_tags only schedule onto matching nodes)")
+	nodesUpdateCmd.Flags().String("domain", "", "base domain for this node — domainless services placed here get <name>.<domain> automatically (empty clears)")
+	nodesPruneCmd.Flags().String("until", "", "only prune objects older than this duration (e.g. 168h)")
+	nodesPruneCmd.Flags().Bool("volumes", false, "also prune volumes (destructive — asks twice)")
 	nodeTokensCmd.AddCommand(nodeTokensIssueCmd, nodeTokensListCmd, nodeTokensRevokeCmd)
-	NodesCmd.AddCommand(nodesListCmd, nodesGetCmd, nodesDeleteCmd, nodeTokensCmd)
+	NodesCmd.AddCommand(nodesListCmd, nodesGetCmd, nodesUpdateCmd, nodesCordonCmd, nodesUncordonCmd, nodesDrainCmd, nodesUpgradeCmd, nodesPruneCmd, nodesCommandsCmd, nodesDeleteCmd, nodeTokensCmd)
 }

app/backend/internal/cli/commands/nodes_add.go

@@ -0,0 +1,214 @@
+package commands
+
+// SSH node bootstrap — one SSH session installs the agent (binary +
+// systemd + enroll token), then SSH is never needed again. SSH keys
+// stay client-side; the server only sees the resulting agent.
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
+	"golang.org/x/term"
+)
+
+var (
+	nodeSSHKey   string
+	nodeSSHName  string
+	nodeSSHPrint bool
+)
+
+var nodesAddCmd = &cobra.Command{
+	Use:   "add <[user@]host[:port]>",
+	Short: "Bootstrap a node agent over SSH (one session, then closed)",
+	Long: `Installs the containr agent on a remote host:
+
+  1. mints a single-use enroll token via the API
+  2. SSHes in (agent socket, --key, or default key files)
+  3. runs the instance's install script remotely
+  4. closes the session — the agent heartbeats outbound from then on
+
+Use --print to skip SSH and emit the remote one-liner for manual runs.`,
+	Args: cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+
+		// Mint the enroll token first — SSH failures then don't leave
+		// partial state on the remote.
+		body := map[string]interface{}{"label": "bootstrap"}
+		if nodeSSHName != "" {
+			body["label"] = "bootstrap:" + nodeSSHName
+		}
+		tokenData, err := c.Do("POST", "/agent-tokens", body)
+		if err != nil {
+			return err
+		}
+		tokenObj, err := unwrapObject(tokenData, "token")
+		if err != nil {
+			return err
+		}
+		token := str(tokenObj, "token")
+		if token == "" {
+			return &APIError{Message: "enroll token missing from response", ExitCode: ExitError}
+		}
+
+		// Agent bootstrap endpoints live at /api/agents (no /v1) — strip
+		// the API version suffix off the client base.
+		apiRoot := strings.TrimSuffix(c.BaseURL, "/api/v1")
+		installCmd := fmt.Sprintf(
+			`curl -fsSL %q | bash -s -- --url %q --token %q --name %q`,
+			apiRoot+"/api/agents/install.sh", apiRoot, token, firstNonEmptyStr(nodeSSHName, nodeSSHTarget(args[0]).host),
+		)
+
+		if nodeSSHPrint {
+			fmt.Println(installCmd)
+			return nil
+		}
+
+		target := nodeSSHTarget(args[0])
+		if err := sshBootstrap(target, installCmd); err != nil {
+			return err
+		}
+		fmt.Printf("agent installing on %s — it should appear in `containr nodes list` within ~15s\n", target.host)
+		return nil
+	},
+}
+
+type sshTarget struct {
+	user string
+	host string
+	port string
+}
+
+func nodeSSHTarget(raw string) sshTarget {
+	t := sshTarget{port: "22"}
+	rest := raw
+	if at := strings.LastIndex(rest, "@"); at >= 0 {
+		t.user = rest[:at]
+		rest = rest[at+1:]
+	}
+	if colon := strings.LastIndex(rest, ":"); colon >= 0 && !strings.Contains(rest, "]") {
+		t.host, t.port = rest[:colon], rest[colon+1:]
+	} else {
+		t.host = rest
+	}
+	if t.user == "" {
+		if u, err := user.Current(); err == nil {
+			t.user = u.Username
+		}
+	}
+	return t
+}
+
+func sshAuthMethods(keyPath string) []ssh.AuthMethod {
+	var methods []ssh.AuthMethod
+
+	// ssh-agent first — matches how people actually manage keys.
+	if sock := os.Getenv("SSH_AUTH_SOCK"); sock != "" {
+		if conn, err := net.Dial("unix", sock); err == nil {
+			defer conn.Close()
+			methods = append(methods, ssh.PublicKeysCallback(agent.NewClient(conn).Signers))
+		}
+	}
+
+	var keyFiles []string
+	if keyPath != "" {
+		keyFiles = []string{keyPath}
+	} else if home, err := os.UserHomeDir(); err == nil {
+		for _, name := range []string{"id_ed25519", "id_rsa", "id_ecdsa"} {
+			p := filepath.Join(home, ".ssh", name)
+			if _, err := os.Stat(p); err == nil {
+				keyFiles = append(keyFiles, p)
+			}
+		}
+	}
+	for _, p := range keyFiles {
+		if signer, err := sshPrivateKey(p); err == nil {
+			methods = append(methods, ssh.PublicKeys(signer))
+		}
+	}
+	return methods
+}
+
+func sshPrivateKey(path string) (ssh.Signer, error) {
+	pem, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	signer, err := ssh.ParsePrivateKey(pem)
+	if err != nil {
+		var missing *ssh.PassphraseMissingError
+		if errors.As(err, &missing) {
+			fmt.Fprintf(os.Stderr, "passphrase for %s: ", path)
+			pass, readErr := term.ReadPassword(int(os.Stdin.Fd()))
+			fmt.Fprintln(os.Stderr)
+			if readErr != nil {
+				return nil, readErr
+			}
+			return ssh.ParsePrivateKeyWithPassphrase(pem, pass)
+		}
+		return nil, err
+	}
+	return signer, nil
+}
+
+func sshBootstrap(t sshTarget, remoteCmd string) error {
+	config := &ssh.ClientConfig{
+		User:            t.user,
+		Auth:            sshAuthMethods(nodeSSHKey),
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // jarvis: TOFU would be better; ssh_known_hosts parsing is the upgrade path
+		Timeout:         15 * time.Second,
+	}
+	if len(config.Auth) == 0 {
+		return &APIError{Message: "no SSH auth methods (ssh-agent empty, no usable keys)", ExitCode: ExitError}
+	}
+
+	conn, err := ssh.Dial("tcp", net.JoinHostPort(t.host, t.port), config)
+	if err != nil {
+		return &APIError{Message: fmt.Sprintf("ssh connect: %v", err), ExitCode: ExitError}
+	}
+	defer conn.Close()
+
+	session, err := conn.NewSession()
+	if err != nil {
+		return err
+	}
+	defer session.Close()
+	session.Stdout = os.Stdout
+	session.Stderr = os.Stderr
+
+	// Root shells run directly; otherwise escalate via sudo. NOPASSWD
+	// sudo is assumed — a password prompt here means the operator should
+	// use --print and run the command themselves.
+	if t.user == "root" {
+		return session.Run(remoteCmd)
+	}
+	return session.Run("sudo -n " + remoteCmd)
+}
+
+func firstNonEmptyStr(values ...string) string {
+	for _, v := range values {
+		if v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+func init() {
+	nodesAddCmd.Flags().StringVar(&nodeSSHKey, "key", "", "SSH private key path (defaults: agent, ~/.ssh/id_*)")
+	nodesAddCmd.Flags().StringVar(&nodeSSHName, "name", "", "node display name (defaults to remote hostname)")
+	nodesAddCmd.Flags().BoolVar(&nodeSSHPrint, "print", false, "print the remote install command instead of running SSH")
+	NodesCmd.AddCommand(nodesAddCmd)
+}

app/backend/internal/cli/commands/notifications.go

@@ -1,6 +1,8 @@
 package commands
 
 import (
+	"fmt"
+
 	"github.com/spf13/cobra"
 )
 
@@ -60,6 +62,104 @@ var notifReadCmd = &cobra.Command{
 	},
 }
 
+var notifChannelsCmd = &cobra.Command{
+	Use:   "channels",
+	Short: "Manage push notification channels (ntfy/Gotify)",
+}
+
+var notifChannelsListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List push channels",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/notifications/channels", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "channels")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, n := range items {
+			rows = append(rows, []string{
+				str(n, "id"), str(n, "kind"), str(n, "endpoint"), str(n, "enabled"), relTime(n, "created_at"),
+			})
+		}
+		printRows(data, []string{"ID", "KIND", "ENDPOINT", "ENABLED", "AGE"}, rows)
+		return nil
+	},
+}
+
+var notifChannelsAddCmd = &cobra.Command{
+	Use:   "add <ntfy|gotify> <endpoint>",
+	Short: "Add a push channel (endpoint includes topic for ntfy)",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		token, _ := cmd.Flags().GetString("token")
+		data, err := c.Do("POST", "/notifications/channels", map[string]interface{}{
+			"kind":     args[0],
+			"endpoint": args[1],
+			"token":    token,
+		})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var notifChannelsTestCmd = &cobra.Command{
+	Use:   "test <id>",
+	Short: "Send a test notification through a channel",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/notifications/channels/"+args[0]+"/test", map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var notifChannelsRemoveCmd = &cobra.Command{
+	Use:   "remove <id>",
+	Short: "Remove a push channel",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		yes, _ := cmd.Flags().GetBool("yes")
+		if !yes && !Confirm(fmt.Sprintf("Remove channel %s?", args[0])) {
+			return nil
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("DELETE", "/notifications/channels/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
 func init() {
-	NotificationsCmd.AddCommand(notifListCmd, notifReadCmd)
+	notifChannelsAddCmd.Flags().String("token", "", "Auth token (ntfy access token or Gotify app token)")
+	notifChannelsRemoveCmd.Flags().Bool("yes", false, "Skip confirmation")
+	notifChannelsCmd.AddCommand(notifChannelsListCmd, notifChannelsAddCmd, notifChannelsTestCmd, notifChannelsRemoveCmd)
+	NotificationsCmd.AddCommand(notifListCmd, notifReadCmd, notifChannelsCmd)
 }

app/backend/internal/cli/commands/services.go

@@ -60,7 +60,7 @@ var servicesGetCmd = &cobra.Command{
 			return nil
 		}
 		s, _ := unwrapObject(data, "service")
-		for _, k := range []string{"id", "name", "type", "status", "environment", "image", "git_repo", "git_branch", "domain", "port"} {
+		for _, k := range []string{"id", "name", "type", "status", "environment", "image", "git_repo", "git_branch", "domain", "port", "node_name"} {
 			fmt.Printf("%-14s %s\n", k+":", str(s, k))
 		}
 		return nil
@@ -79,7 +79,7 @@ var servicesCreateCmd = &cobra.Command{
 		body := map[string]interface{}{
 			"name": args[1],
 		}
-		for _, f := range []string{"type", "image", "git-repo", "git-branch", "build-path", "command", "environment", "domain", "restart-policy", "healthcheck-path", "cpu", "memory", "builder", "cpu-reserve", "memory-reserve", "static-cmd", "static-dir"} {
+		for _, f := range []string{"type", "image", "git-repo", "git-branch", "build-path", "command", "environment", "domain", "restart-policy", "healthcheck-path", "cpu", "memory", "builder", "cpu-reserve", "memory-reserve", "static-cmd", "static-dir", "node"} {
 			if v, _ := cmd.Flags().GetString(f); v != "" {
 				key := f
 				// JSON uses snake_case keys matching the API schema.
@@ -102,6 +102,8 @@ var servicesCreateCmd = &cobra.Command{
 					key = "static_build_cmd"
 				case "static-dir":
 					key = "static_dir"
+				case "node":
+					key = "node_id"
 				}
 				body[key] = v
 			}
@@ -112,6 +114,31 @@ var servicesCreateCmd = &cobra.Command{
 		if v, _ := cmd.Flags().GetInt("replicas"); v > 0 {
 			body["replicas"] = v
 		}
+		if v, _ := cmd.Flags().GetBool("spread"); v {
+			body["spread"] = v
+		}
+		if cmd.Flags().Changed("sleep") {
+			v, _ := cmd.Flags().GetBool("sleep")
+			body["sleep_enabled"] = v
+		}
+		if cmd.Flags().Changed("sleep-idle") {
+			v, _ := cmd.Flags().GetInt("sleep-idle")
+			body["sleep_idle_minutes"] = v
+		}
+		if v, _ := cmd.Flags().GetString("placement-tags"); v != "" {
+			tags := []string{}
+			for _, t := range strings.Split(v, ",") {
+				if t = strings.TrimSpace(t); t != "" {
+					tags = append(tags, t)
+				}
+			}
+			body["placement_tags"] = tags
+		}
+		if labels, err := traefikLabelFlag(cmd); err != nil {
+			return err
+		} else if labels != nil {
+			body["traefik_labels"] = labels
+		}
 		data, err := c.Do("POST", "/projects/"+args[0]+"/services", body)
 		if err != nil {
 			return err
@@ -126,6 +153,28 @@ var servicesCreateCmd = &cobra.Command{
 	},
 }
 
+// traefikLabelFlag parses --traefik-label key=value pairs into the API's
+// map shape. Returns nil when the flag was never passed; an empty map when
+// only empty values were given (clears overrides on update).
+func traefikLabelFlag(cmd *cobra.Command) (map[string]string, error) {
+	if !cmd.Flags().Changed("traefik-label") {
+		return nil, nil
+	}
+	pairs, _ := cmd.Flags().GetStringArray("traefik-label")
+	labels := map[string]string{}
+	for _, p := range pairs {
+		if strings.TrimSpace(p) == "" {
+			continue
+		}
+		k, v, ok := strings.Cut(p, "=")
+		if !ok || strings.TrimSpace(k) == "" {
+			return nil, &APIError{Message: fmt.Sprintf("invalid --traefik-label %q — want key=value", p), ExitCode: ExitError}
+		}
+		labels[strings.TrimSpace(k)] = v
+	}
+	return labels, nil
+}
+
 var servicesDeleteCmd = &cobra.Command{
 	Use:   "delete <id>",
 	Short: "Delete a service",
@@ -159,7 +208,7 @@ var servicesUpdateCmd = &cobra.Command{
 			return err
 		}
 		body := map[string]interface{}{}
-		for _, f := range []string{"name", "image", "command", "domain", "restart-policy", "healthcheck-path", "cpu", "memory", "builder", "cpu-reserve", "memory-reserve", "static-cmd", "static-dir"} {
+		for _, f := range []string{"name", "image", "command", "domain", "restart-policy", "healthcheck-path", "cpu", "memory", "builder", "cpu-reserve", "memory-reserve", "static-cmd", "static-dir", "node"} {
 			if cmd.Flags().Changed(f) {
 				key := f
 				switch f {
@@ -175,6 +224,8 @@ var servicesUpdateCmd = &cobra.Command{
 					key = "static_build_cmd"
 				case "static-dir":
 					key = "static_dir"
+				case "node":
+					key = "node_id"
 				}
 				v, _ := cmd.Flags().GetString(f)
 				body[key] = v
@@ -199,10 +250,29 @@ var servicesUpdateCmd = &cobra.Command{
 			v, _ := cmd.Flags().GetBool("sleep")
 			body["sleep_enabled"] = v
 		}
+		if cmd.Flags().Changed("spread") {
+			v, _ := cmd.Flags().GetBool("spread")
+			body["spread"] = v
+		}
+		if cmd.Flags().Changed("placement-tags") {
+			v, _ := cmd.Flags().GetString("placement-tags")
+			tags := []string{}
+			for _, t := range strings.Split(v, ",") {
+				if t = strings.TrimSpace(t); t != "" {
+					tags = append(tags, t)
+				}
+			}
+			body["placement_tags"] = tags
+		}
 		if cmd.Flags().Changed("sleep-idle") {
 			v, _ := cmd.Flags().GetInt("sleep-idle")
 			body["sleep_idle_minutes"] = v
 		}
+		if labels, err := traefikLabelFlag(cmd); err != nil {
+			return err
+		} else if labels != nil {
+			body["traefik_labels"] = labels
+		}
 		if cmd.Flags().Changed("maintenance") {
 			v, _ := cmd.Flags().GetString("maintenance")
 			body["maintenance_mode"] = v == "on" || v == "true"
@@ -490,6 +560,12 @@ func init() {
 	f.String("memory-reserve", "", "soft memory reservation (e.g. 128Mi)")
 	f.String("static-cmd", "", "build command for the static builder")
 	f.String("static-dir", "", "output dir for the static builder (default dist)")
+	f.String("node", "", "pin to a node agent id, or 'auto' for least-loaded")
+	f.Bool("spread", false, "distribute replicas across all online schedulable nodes")
+	f.Bool("sleep", false, "enable scale-to-zero on idle (sleep mode)")
+	f.Int("sleep-idle", 0, "idle minutes before sleeping (1-1440)")
+	f.String("placement-tags", "", "comma-separated node tags required for remote placement (auto/spread only)")
+	f.StringArray("traefik-label", nil, "Traefik middleware override, key=value (e.g. middlewares.rl.ratelimit.average=100); repeatable")
 
 	uf := servicesUpdateCmd.Flags()
 	uf.String("name", "", "service name")
@@ -514,6 +590,10 @@ func init() {
 	uf.String("static-dir", "", "output dir for the static builder (empty clears)")
 	uf.Bool("sleep", false, "enable scale-to-zero on idle (sleep mode)")
 	uf.Int("sleep-idle", 0, "idle minutes before sleeping (1-1440)")
+	uf.StringArray("traefik-label", nil, "Traefik middleware override, key=value; repeatable; empty list clears via --traefik-label ''")
+	uf.String("node", "", "pin to a node agent id, 'auto' for least-loaded, 'local' to clear")
+	uf.Bool("spread", false, "spread replicas across all online schedulable nodes (--spread=false to disable)")
+	uf.String("placement-tags", "", "comma-separated node tags required for remote placement (empty clears)")
 
 	for _, a := range []string{"start", "stop", "restart", "redeploy", "sleep", "wake"} {
 		verb := a

app/backend/internal/cli/commands/templates.go

@@ -194,6 +194,32 @@ var templatesImportComposeCmd = &cobra.Command{
 	},
 }
 
+var templatesImportGitCmd = &cobra.Command{
+	Use:   "import-git <repo> [path]",
+	Short: "Fetch a compose file from a git repo and convert it into a template graph config",
+	Long:  "repo accepts a clone URL, ssh remote, or owner/repo shorthand resolved via connected git providers (private repos included). path defaults to compose.yaml/yml or docker-compose.yml/yaml. --ref selects a branch or commit.",
+	Args:  cobra.RangeArgs(1, 2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		body := map[string]string{"repo": args[0]}
+		if len(args) > 1 {
+			body["path"] = args[1]
+		}
+		if v, _ := cmd.Flags().GetString("ref"); v != "" {
+			body["ref"] = v
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/templates/import/git", body)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
 var templatesDeployGraphCmd = &cobra.Command{
 	Use:   "deploy-graph <project-id> <config.json|->",
 	Short: "Deploy an ad-hoc service graph (v2 config with services[]) without a stored template",
@@ -257,5 +283,6 @@ func init() {
 	templatesDeployCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
 	templatesPlanCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
 	templatesDeployGraphCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
-	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd, templatesPlanCmd, templatesImportComposeCmd, templatesDeployGraphCmd)
+	templatesImportGitCmd.Flags().String("ref", "", "git branch or commit (default: remote HEAD)")
+	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd, templatesPlanCmd, templatesImportComposeCmd, templatesImportGitCmd, templatesDeployGraphCmd)
 }

app/backend/internal/cli/root.go

@@ -94,6 +94,8 @@ func init() {
 	rootCmd.AddCommand(commands.BannersCmd)
 	rootCmd.AddCommand(commands.InvitesCmd)
 	rootCmd.AddCommand(commands.UpCmd)
+	rootCmd.AddCommand(commands.MigrateCmd)
+	rootCmd.AddCommand(commands.EnvironmentsCmd)
 }
 
 func initConfig() {

app/backend/internal/database/sqlcdb/agents.sql.go

@@ -14,6 +14,18 @@ import (
 	"github.com/sqlc-dev/pqtype"
 )
 
+const clearServiceNodePins = `-- name: ClearServiceNodePins :execrows
+UPDATE services SET node_id = NULL, updated_at = NOW() WHERE node_id = $1
+`
+
+func (q *Queries) ClearServiceNodePins(ctx context.Context, nodeID sql.NullString) (int64, error) {
+	result, err := q.db.ExecContext(ctx, clearServiceNodePins, nodeID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
 const completeCommand = `-- name: CompleteCommand :one
 UPDATE agent_commands SET
     status = $3,
@@ -63,7 +75,7 @@ INSERT INTO node_agents (
     id, name, hostname, ip_address, port, status, version,
     capabilities, resources, last_heartbeat, metadata
 ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
-RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata
+RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain
 `
 
 type CreateAgentParams struct {
@@ -109,6 +121,10 @@ func (q *Queries) CreateAgent(ctx context.Context, arg CreateAgentParams) (NodeA
 		&i.CreatedAt,
 		&i.UpdatedAt,
 		&i.Metadata,
+		&i.AutoPrune,
+		&i.Schedulable,
+		&i.Tags,
+		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -228,8 +244,22 @@ func (q *Queries) DeleteAgent(ctx context.Context, id string) error {
 	return err
 }
 
+const deleteServiceContainersOnAgent = `-- name: DeleteServiceContainersOnAgent :exec
+DELETE FROM container_instances WHERE node_agent_id = $1 AND service_id = $2
+`
+
+type DeleteServiceContainersOnAgentParams struct {
+	NodeAgentID string `json:"node_agent_id"`
+	ServiceID   string `json:"service_id"`
+}
+
+func (q *Queries) DeleteServiceContainersOnAgent(ctx context.Context, arg DeleteServiceContainersOnAgentParams) error {
+	_, err := q.db.ExecContext(ctx, deleteServiceContainersOnAgent, arg.NodeAgentID, arg.ServiceID)
+	return err
+}
+
 const getAgent = `-- name: GetAgent :one
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata FROM node_agents WHERE id = $1
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents WHERE id = $1
 `
 
 func (q *Queries) GetAgent(ctx context.Context, id string) (NodeAgent, error) {
@@ -249,12 +279,16 @@ func (q *Queries) GetAgent(ctx context.Context, id string) (NodeAgent, error) {
 		&i.CreatedAt,
 		&i.UpdatedAt,
 		&i.Metadata,
+		&i.AutoPrune,
+		&i.Schedulable,
+		&i.Tags,
+		&i.DefaultDomain,
 	)
 	return i, err
 }
 
 const getAgentByHostAndIP = `-- name: GetAgentByHostAndIP :one
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata FROM node_agents
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents
 WHERE hostname = $1 AND ip_address = $2
 LIMIT 1
 `
@@ -281,6 +315,10 @@ func (q *Queries) GetAgentByHostAndIP(ctx context.Context, arg GetAgentByHostAnd
 		&i.CreatedAt,
 		&i.UpdatedAt,
 		&i.Metadata,
+		&i.AutoPrune,
+		&i.Schedulable,
+		&i.Tags,
+		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -378,6 +416,36 @@ func (q *Queries) GetContainerForAgent(ctx context.Context, arg GetContainerForA
 	return i, err
 }
 
+const getLastAgentCommandByType = `-- name: GetLastAgentCommandByType :one
+SELECT id, type, node_agent_id, container_id, payload, status, result, error, created_at, updated_at, completed_at FROM agent_commands
+WHERE node_agent_id = $1 AND type = $2
+ORDER BY created_at DESC LIMIT 1
+`
+
+type GetLastAgentCommandByTypeParams struct {
+	NodeAgentID string `json:"node_agent_id"`
+	Type        string `json:"type"`
+}
+
+func (q *Queries) GetLastAgentCommandByType(ctx context.Context, arg GetLastAgentCommandByTypeParams) (AgentCommand, error) {
+	row := q.db.QueryRowContext(ctx, getLastAgentCommandByType, arg.NodeAgentID, arg.Type)
+	var i AgentCommand
+	err := row.Scan(
+		&i.ID,
+		&i.Type,
+		&i.NodeAgentID,
+		&i.ContainerID,
+		&i.Payload,
+		&i.Status,
+		&i.Result,
+		&i.Error,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.CompletedAt,
+	)
+	return i, err
+}
+
 const insertAgentHeartbeat = `-- name: InsertAgentHeartbeat :exec
 INSERT INTO agent_heartbeats (
     id, node_agent_id, timestamp, status, resources,
@@ -458,7 +526,7 @@ func (q *Queries) ListAgentHeartbeatsSince(ctx context.Context, arg ListAgentHea
 }
 
 const listAgents = `-- name: ListAgents :many
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata FROM node_agents ORDER BY created_at ASC
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents ORDER BY created_at ASC
 `
 
 func (q *Queries) ListAgents(ctx context.Context) ([]NodeAgent, error) {
@@ -484,6 +552,10 @@ func (q *Queries) ListAgents(ctx context.Context) ([]NodeAgent, error) {
 			&i.CreatedAt,
 			&i.UpdatedAt,
 			&i.Metadata,
+			&i.AutoPrune,
+			&i.Schedulable,
+			&i.Tags,
+			&i.DefaultDomain,
 		); err != nil {
 			return nil, err
 		}
@@ -627,6 +699,296 @@ func (q *Queries) ListPendingCommands(ctx context.Context, nodeAgentID string) (
 	return items, nil
 }
 
+const listSchedulableAgentDomains = `-- name: ListSchedulableAgentDomains :many
+SELECT DISTINCT default_domain FROM node_agents
+WHERE status = 'online' AND schedulable
+  AND default_domain <> ''
+  AND tags @> $1::jsonb
+ORDER BY default_domain
+`
+
+// Base domains of every online, schedulable agent carrying the required
+// placement tags — auto-domain candidates for spread services.
+func (q *Queries) ListSchedulableAgentDomains(ctx context.Context, dollar_1 json.RawMessage) ([]string, error) {
+	rows, err := q.db.QueryContext(ctx, listSchedulableAgentDomains, dollar_1)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []string{}
+	for rows.Next() {
+		var default_domain string
+		if err := rows.Scan(&default_domain); err != nil {
+			return nil, err
+		}
+		items = append(items, default_domain)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listSchedulableAgents = `-- name: ListSchedulableAgents :many
+SELECT id, name FROM node_agents
+WHERE status = 'online' AND schedulable
+ORDER BY id
+`
+
+type ListSchedulableAgentsRow struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+func (q *Queries) ListSchedulableAgents(ctx context.Context) ([]ListSchedulableAgentsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listSchedulableAgents)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListSchedulableAgentsRow{}
+	for rows.Next() {
+		var i ListSchedulableAgentsRow
+		if err := rows.Scan(&i.ID, &i.Name); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listSchedulableAgentsMatching = `-- name: ListSchedulableAgentsMatching :many
+SELECT id, name FROM node_agents
+WHERE status = 'online' AND schedulable
+  AND tags @> $1::jsonb
+ORDER BY id
+`
+
+type ListSchedulableAgentsMatchingRow struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+// Only agents carrying every required placement tag (jsonb array containment).
+func (q *Queries) ListSchedulableAgentsMatching(ctx context.Context, dollar_1 json.RawMessage) ([]ListSchedulableAgentsMatchingRow, error) {
+	rows, err := q.db.QueryContext(ctx, listSchedulableAgentsMatching, dollar_1)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListSchedulableAgentsMatchingRow{}
+	for rows.Next() {
+		var i ListSchedulableAgentsMatchingRow
+		if err := rows.Scan(&i.ID, &i.Name); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceAgents = `-- name: ListServiceAgents :many
+SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1
+`
+
+// Distinct agents holding inventory rows for a service.
+func (q *Queries) ListServiceAgents(ctx context.Context, serviceID string) ([]string, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceAgents, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []string{}
+	for rows.Next() {
+		var node_agent_id string
+		if err := rows.Scan(&node_agent_id); err != nil {
+			return nil, err
+		}
+		items = append(items, node_agent_id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceContainers = `-- name: ListServiceContainers :many
+SELECT id, name, node_agent_id, status, ports, resources FROM container_instances
+WHERE service_id = $1
+`
+
+type ListServiceContainersRow struct {
+	ID          string                `json:"id"`
+	Name        string                `json:"name"`
+	NodeAgentID string                `json:"node_agent_id"`
+	Status      pqtype.NullRawMessage `json:"status"`
+	Ports       pqtype.NullRawMessage `json:"ports"`
+	Resources   pqtype.NullRawMessage `json:"resources"`
+}
+
+func (q *Queries) ListServiceContainers(ctx context.Context, serviceID string) ([]ListServiceContainersRow, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceContainers, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListServiceContainersRow{}
+	for rows.Next() {
+		var i ListServiceContainersRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.NodeAgentID,
+			&i.Status,
+			&i.Ports,
+			&i.Resources,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const pickLeastLoadedAgent = `-- name: PickLeastLoadedAgent :one
+SELECT a.id FROM node_agents a
+LEFT JOIN LATERAL (
+    SELECT h.container_count FROM agent_heartbeats h
+    WHERE h.node_agent_id = a.id
+    ORDER BY h.timestamp DESC LIMIT 1
+) h ON true
+WHERE a.status = 'online' AND a.schedulable
+ORDER BY
+    COALESCE(
+        (a.resources->'memory'->>'used')::double precision
+        / NULLIF((a.resources->'memory'->>'total')::double precision, 0),
+        1.0
+    ) ASC,
+    COALESCE((a.resources->'cpu'->>'usage')::double precision, 100.0) ASC,
+    COALESCE(h.container_count, 0) ASC,
+    a.created_at ASC
+LIMIT 1
+`
+
+// Resource-aware: lowest memory utilisation first, then cpu, then container
+// count. Agents without telemetry sort last (NULL → worst score).
+func (q *Queries) PickLeastLoadedAgent(ctx context.Context) (string, error) {
+	row := q.db.QueryRowContext(ctx, pickLeastLoadedAgent)
+	var id string
+	err := row.Scan(&id)
+	return id, err
+}
+
+const pickLeastLoadedAgentMatching = `-- name: PickLeastLoadedAgentMatching :one
+SELECT a.id FROM node_agents a
+LEFT JOIN LATERAL (
+    SELECT h.container_count FROM agent_heartbeats h
+    WHERE h.node_agent_id = a.id
+    ORDER BY h.timestamp DESC LIMIT 1
+) h ON true
+WHERE a.status = 'online' AND a.schedulable
+  AND a.tags @> $1::jsonb
+ORDER BY
+    COALESCE(
+        (a.resources->'memory'->>'used')::double precision
+        / NULLIF((a.resources->'memory'->>'total')::double precision, 0),
+        1.0
+    ) ASC,
+    COALESCE((a.resources->'cpu'->>'usage')::double precision, 100.0) ASC,
+    COALESCE(h.container_count, 0) ASC,
+    a.created_at ASC
+LIMIT 1
+`
+
+// Same resource-aware ordering as PickLeastLoadedAgent, restricted to agents
+// carrying every required placement tag.
+func (q *Queries) PickLeastLoadedAgentMatching(ctx context.Context, dollar_1 json.RawMessage) (string, error) {
+	row := q.db.QueryRowContext(ctx, pickLeastLoadedAgentMatching, dollar_1)
+	var id string
+	err := row.Scan(&id)
+	return id, err
+}
+
+const scrubCommandPayload = `-- name: ScrubCommandPayload :exec
+UPDATE agent_commands SET payload = $2, updated_at = NOW() WHERE id = $1
+`
+
+type ScrubCommandPayloadParams struct {
+	ID      string                `json:"id"`
+	Payload pqtype.NullRawMessage `json:"payload"`
+}
+
+func (q *Queries) ScrubCommandPayload(ctx context.Context, arg ScrubCommandPayloadParams) error {
+	_, err := q.db.ExecContext(ctx, scrubCommandPayload, arg.ID, arg.Payload)
+	return err
+}
+
+const setAgentDefaultDomain = `-- name: SetAgentDefaultDomain :exec
+UPDATE node_agents SET default_domain = $2, updated_at = NOW() WHERE id = $1
+`
+
+type SetAgentDefaultDomainParams struct {
+	ID            string `json:"id"`
+	DefaultDomain string `json:"default_domain"`
+}
+
+func (q *Queries) SetAgentDefaultDomain(ctx context.Context, arg SetAgentDefaultDomainParams) error {
+	_, err := q.db.ExecContext(ctx, setAgentDefaultDomain, arg.ID, arg.DefaultDomain)
+	return err
+}
+
+const setAgentSchedulable = `-- name: SetAgentSchedulable :exec
+UPDATE node_agents SET schedulable = $2, updated_at = NOW() WHERE id = $1
+`
+
+type SetAgentSchedulableParams struct {
+	ID          string `json:"id"`
+	Schedulable bool   `json:"schedulable"`
+}
+
+func (q *Queries) SetAgentSchedulable(ctx context.Context, arg SetAgentSchedulableParams) error {
+	_, err := q.db.ExecContext(ctx, setAgentSchedulable, arg.ID, arg.Schedulable)
+	return err
+}
+
+const setAgentTags = `-- name: SetAgentTags :exec
+UPDATE node_agents SET tags = $2::jsonb, updated_at = NOW() WHERE id = $1
+`
+
+type SetAgentTagsParams struct {
+	ID      string          `json:"id"`
+	Column2 json.RawMessage `json:"column_2"`
+}
+
+func (q *Queries) SetAgentTags(ctx context.Context, arg SetAgentTagsParams) error {
+	_, err := q.db.ExecContext(ctx, setAgentTags, arg.ID, arg.Column2)
+	return err
+}
+
 const updateAgent = `-- name: UpdateAgent :one
 UPDATE node_agents SET
     name = $2,
@@ -639,9 +1001,11 @@ UPDATE node_agents SET
     resources = $9,
     last_heartbeat = $10,
     metadata = $11,
+    auto_prune = $12,
+    schedulable = $13,
     updated_at = NOW()
 WHERE id = $1
-RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata
+RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain
 `
 
 type UpdateAgentParams struct {
@@ -656,6 +1020,8 @@ type UpdateAgentParams struct {
 	Resources     pqtype.NullRawMessage `json:"resources"`
 	LastHeartbeat sql.NullTime          `json:"last_heartbeat"`
 	Metadata      pqtype.NullRawMessage `json:"metadata"`
+	AutoPrune     bool                  `json:"auto_prune"`
+	Schedulable   bool                  `json:"schedulable"`
 }
 
 func (q *Queries) UpdateAgent(ctx context.Context, arg UpdateAgentParams) (NodeAgent, error) {
@@ -671,6 +1037,8 @@ func (q *Queries) UpdateAgent(ctx context.Context, arg UpdateAgentParams) (NodeA
 		arg.Resources,
 		arg.LastHeartbeat,
 		arg.Metadata,
+		arg.AutoPrune,
+		arg.Schedulable,
 	)
 	var i NodeAgent
 	err := row.Scan(
@@ -687,6 +1055,10 @@ func (q *Queries) UpdateAgent(ctx context.Context, arg UpdateAgentParams) (NodeA
 		&i.CreatedAt,
 		&i.UpdatedAt,
 		&i.Metadata,
+		&i.AutoPrune,
+		&i.Schedulable,
+		&i.Tags,
+		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -717,6 +1089,53 @@ func (q *Queries) UpdateAgentHeartbeat(ctx context.Context, arg UpdateAgentHeart
 	return err
 }
 
+const updateContainerPorts = `-- name: UpdateContainerPorts :exec
+UPDATE container_instances SET status = $2, ports = $3, updated_at = NOW()
+WHERE id = $1
+`
+
+type UpdateContainerPortsParams struct {
+	ID     string                `json:"id"`
+	Status pqtype.NullRawMessage `json:"status"`
+	Ports  pqtype.NullRawMessage `json:"ports"`
+}
+
+// Agent reports the real host bindings after create — persist them with
+// the status flip so ingress can route to the assigned port.
+func (q *Queries) UpdateContainerPorts(ctx context.Context, arg UpdateContainerPortsParams) error {
+	_, err := q.db.ExecContext(ctx, updateContainerPorts, arg.ID, arg.Status, arg.Ports)
+	return err
+}
+
+const updateContainerStateByName = `-- name: UpdateContainerStateByName :exec
+UPDATE container_instances SET
+    status = jsonb_set(status, '{state}', $3::jsonb),
+    resources = jsonb_set(COALESCE(resources, '{}'::jsonb), '{net_bytes}', $4::jsonb),
+    updated_at = NOW()
+WHERE name = $1 AND node_agent_id = $2
+  AND status->>'state' IS DISTINCT FROM 'removed'
+`
+
+type UpdateContainerStateByNameParams struct {
+	Name        string          `json:"name"`
+	NodeAgentID string          `json:"node_agent_id"`
+	Column3     json.RawMessage `json:"column_3"`
+	Column4     json.RawMessage `json:"column_4"`
+}
+
+// Agent heartbeat reports real docker state + net counters; reconcile
+// inventory for rows this node owns. Tombstones win — never resurrect a
+// removed replica. $4 is the cumulative rx+tx byte counter.
+func (q *Queries) UpdateContainerStateByName(ctx context.Context, arg UpdateContainerStateByNameParams) error {
+	_, err := q.db.ExecContext(ctx, updateContainerStateByName,
+		arg.Name,
+		arg.NodeAgentID,
+		arg.Column3,
+		arg.Column4,
+	)
+	return err
+}
+
 const updateContainerStatus = `-- name: UpdateContainerStatus :exec
 UPDATE container_instances SET status = $2, updated_at = NOW()
 WHERE id = $1
@@ -731,3 +1150,52 @@ func (q *Queries) UpdateContainerStatus(ctx context.Context, arg UpdateContainer
 	_, err := q.db.ExecContext(ctx, updateContainerStatus, arg.ID, arg.Status)
 	return err
 }
+
+const upsertServiceContainer = `-- name: UpsertServiceContainer :exec
+INSERT INTO container_instances (
+    id, name, image, project_id, service_id, node_agent_id,
+    status, resources, ports, environment, volumes, networks,
+    restart_policy, health_check
+) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
+ON CONFLICT (id) DO UPDATE SET
+    image = EXCLUDED.image,
+    status = EXCLUDED.status,
+    updated_at = NOW()
+`
+
+type UpsertServiceContainerParams struct {
+	ID            string                `json:"id"`
+	Name          string                `json:"name"`
+	Image         string                `json:"image"`
+	ProjectID     string                `json:"project_id"`
+	ServiceID     string                `json:"service_id"`
+	NodeAgentID   string                `json:"node_agent_id"`
+	Status        pqtype.NullRawMessage `json:"status"`
+	Resources     pqtype.NullRawMessage `json:"resources"`
+	Ports         pqtype.NullRawMessage `json:"ports"`
+	Environment   pqtype.NullRawMessage `json:"environment"`
+	Volumes       pqtype.NullRawMessage `json:"volumes"`
+	Networks      pqtype.NullRawMessage `json:"networks"`
+	RestartPolicy pqtype.NullRawMessage `json:"restart_policy"`
+	HealthCheck   pqtype.NullRawMessage `json:"health_check"`
+}
+
+func (q *Queries) UpsertServiceContainer(ctx context.Context, arg UpsertServiceContainerParams) error {
+	_, err := q.db.ExecContext(ctx, upsertServiceContainer,
+		arg.ID,
+		arg.Name,
+		arg.Image,
+		arg.ProjectID,
+		arg.ServiceID,
+		arg.NodeAgentID,
+		arg.Status,
+		arg.Resources,
+		arg.Ports,
+		arg.Environment,
+		arg.Volumes,
+		arg.Networks,
+		arg.RestartPolicy,
+		arg.HealthCheck,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/apwhy.sql.go

@@ -0,0 +1,636 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: apwhy.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const countAPKeys = `-- name: CountAPKeys :one
+SELECT COUNT(*) FROM api_keys
+`
+
+func (q *Queries) CountAPKeys(ctx context.Context) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countAPKeys)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const countAPServices = `-- name: CountAPServices :one
+SELECT COUNT(*) FROM api_services
+`
+
+func (q *Queries) CountAPServices(ctx context.Context) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countAPServices)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const getAPServiceBySlug = `-- name: GetAPServiceBySlug :one
+SELECT id, upstream_url, route_prefix, upstream_auth_header,
+       upstream_auth_value, enabled, rpm_limit, monthly_quota,
+       request_timeout_ms
+FROM api_services WHERE slug = $1
+`
+
+type GetAPServiceBySlugRow struct {
+	ID                 uuid.UUID      `json:"id"`
+	UpstreamUrl        string         `json:"upstream_url"`
+	RoutePrefix        string         `json:"route_prefix"`
+	UpstreamAuthHeader sql.NullString `json:"upstream_auth_header"`
+	UpstreamAuthValue  sql.NullString `json:"upstream_auth_value"`
+	Enabled            int32          `json:"enabled"`
+	RpmLimit           sql.NullInt32  `json:"rpm_limit"`
+	MonthlyQuota       sql.NullInt32  `json:"monthly_quota"`
+	RequestTimeoutMs   sql.NullInt32  `json:"request_timeout_ms"`
+}
+
+func (q *Queries) GetAPServiceBySlug(ctx context.Context, slug string) (GetAPServiceBySlugRow, error) {
+	row := q.db.QueryRowContext(ctx, getAPServiceBySlug, slug)
+	var i GetAPServiceBySlugRow
+	err := row.Scan(
+		&i.ID,
+		&i.UpstreamUrl,
+		&i.RoutePrefix,
+		&i.UpstreamAuthHeader,
+		&i.UpstreamAuthValue,
+		&i.Enabled,
+		&i.RpmLimit,
+		&i.MonthlyQuota,
+		&i.RequestTimeoutMs,
+	)
+	return i, err
+}
+
+const getAPServiceForValidate = `-- name: GetAPServiceForValidate :one
+SELECT upstream_url, health_path, upstream_auth_header, upstream_auth_value, request_timeout_ms
+FROM api_services WHERE id = $1
+`
+
+type GetAPServiceForValidateRow struct {
+	UpstreamUrl        string         `json:"upstream_url"`
+	HealthPath         string         `json:"health_path"`
+	UpstreamAuthHeader sql.NullString `json:"upstream_auth_header"`
+	UpstreamAuthValue  sql.NullString `json:"upstream_auth_value"`
+	RequestTimeoutMs   sql.NullInt32  `json:"request_timeout_ms"`
+}
+
+func (q *Queries) GetAPServiceForValidate(ctx context.Context, id uuid.UUID) (GetAPServiceForValidateRow, error) {
+	row := q.db.QueryRowContext(ctx, getAPServiceForValidate, id)
+	var i GetAPServiceForValidateRow
+	err := row.Scan(
+		&i.UpstreamUrl,
+		&i.HealthPath,
+		&i.UpstreamAuthHeader,
+		&i.UpstreamAuthValue,
+		&i.RequestTimeoutMs,
+	)
+	return i, err
+}
+
+const insertAPKey = `-- name: InsertAPKey :one
+INSERT INTO api_keys (
+    name, key_hash, key_prefix, plan, allowed_service_ids,
+    rpm_limit, monthly_quota, created_at, updated_at
+) VALUES ($1, $2, $3, $4, '[]', $5, $6, NOW(), NOW())
+RETURNING id
+`
+
+type InsertAPKeyParams struct {
+	Name         string        `json:"name"`
+	KeyHash      string        `json:"key_hash"`
+	KeyPrefix    string        `json:"key_prefix"`
+	Plan         string        `json:"plan"`
+	RpmLimit     sql.NullInt32 `json:"rpm_limit"`
+	MonthlyQuota sql.NullInt32 `json:"monthly_quota"`
+}
+
+func (q *Queries) InsertAPKey(ctx context.Context, arg InsertAPKeyParams) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, insertAPKey,
+		arg.Name,
+		arg.KeyHash,
+		arg.KeyPrefix,
+		arg.Plan,
+		arg.RpmLimit,
+		arg.MonthlyQuota,
+	)
+	var id uuid.UUID
+	err := row.Scan(&id)
+	return id, err
+}
+
+const insertAPService = `-- name: InsertAPService :one
+INSERT INTO api_services (
+    name, slug, upstream_url, route_prefix, health_path,
+    rpm_limit, monthly_quota, created_at, updated_at
+) VALUES ($1, $2, $3, $4, '/health', $5, $6, NOW(), NOW())
+RETURNING id
+`
+
+type InsertAPServiceParams struct {
+	Name         string        `json:"name"`
+	Slug         string        `json:"slug"`
+	UpstreamUrl  string        `json:"upstream_url"`
+	RoutePrefix  string        `json:"route_prefix"`
+	RpmLimit     sql.NullInt32 `json:"rpm_limit"`
+	MonthlyQuota sql.NullInt32 `json:"monthly_quota"`
+}
+
+func (q *Queries) InsertAPService(ctx context.Context, arg InsertAPServiceParams) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, insertAPService,
+		arg.Name,
+		arg.Slug,
+		arg.UpstreamUrl,
+		arg.RoutePrefix,
+		arg.RpmLimit,
+		arg.MonthlyQuota,
+	)
+	var id uuid.UUID
+	err := row.Scan(&id)
+	return id, err
+}
+
+const insertGatewayIncident = `-- name: InsertGatewayIncident :exec
+INSERT INTO incident_events (service_id, api_key_id, code, message, severity, http_status, occurred_at)
+VALUES ($1, $2, $3, $4, $5, $6, NOW())
+`
+
+type InsertGatewayIncidentParams struct {
+	ServiceID  uuid.NullUUID `json:"service_id"`
+	ApiKeyID   uuid.NullUUID `json:"api_key_id"`
+	Code       string        `json:"code"`
+	Message    string        `json:"message"`
+	Severity   string        `json:"severity"`
+	HttpStatus sql.NullInt32 `json:"http_status"`
+}
+
+func (q *Queries) InsertGatewayIncident(ctx context.Context, arg InsertGatewayIncidentParams) error {
+	_, err := q.db.ExecContext(ctx, insertGatewayIncident,
+		arg.ServiceID,
+		arg.ApiKeyID,
+		arg.Code,
+		arg.Message,
+		arg.Severity,
+		arg.HttpStatus,
+	)
+	return err
+}
+
+const insertMetricPoint = `-- name: InsertMetricPoint :exec
+INSERT INTO metrics_timeseries (metric, value, labels_json, occurred_at)
+VALUES ('gateway_request', 1, $1, NOW())
+`
+
+func (q *Queries) InsertMetricPoint(ctx context.Context, labelsJson sql.NullString) error {
+	_, err := q.db.ExecContext(ctx, insertMetricPoint, labelsJson)
+	return err
+}
+
+const insertServiceIncident = `-- name: InsertServiceIncident :exec
+INSERT INTO incident_events (service_id, code, message, severity, http_status, occurred_at)
+VALUES ($1, 'SERVICE_VALIDATION_FAILED', $2, 'medium', $3, NOW())
+`
+
+type InsertServiceIncidentParams struct {
+	ServiceID  uuid.NullUUID `json:"service_id"`
+	Message    string        `json:"message"`
+	HttpStatus sql.NullInt32 `json:"http_status"`
+}
+
+func (q *Queries) InsertServiceIncident(ctx context.Context, arg InsertServiceIncidentParams) error {
+	_, err := q.db.ExecContext(ctx, insertServiceIncident, arg.ServiceID, arg.Message, arg.HttpStatus)
+	return err
+}
+
+const listAPKeys = `-- name: ListAPKeys :many
+SELECT id, name, key_prefix, plan, enabled, rpm_limit, monthly_quota,
+       to_char(created_at, 'YYYY-MM-DD"T"HH24:MI:SS"Z"') AS created_at,
+       to_char(updated_at, 'YYYY-MM-DD"T"HH24:MI:SS"Z"') AS updated_at
+FROM api_keys
+ORDER BY created_at DESC
+`
+
+type ListAPKeysRow struct {
+	ID           uuid.UUID     `json:"id"`
+	Name         string        `json:"name"`
+	KeyPrefix    string        `json:"key_prefix"`
+	Plan         string        `json:"plan"`
+	Enabled      int32         `json:"enabled"`
+	RpmLimit     sql.NullInt32 `json:"rpm_limit"`
+	MonthlyQuota sql.NullInt32 `json:"monthly_quota"`
+	CreatedAt    string        `json:"created_at"`
+	UpdatedAt    string        `json:"updated_at"`
+}
+
+func (q *Queries) ListAPKeys(ctx context.Context) ([]ListAPKeysRow, error) {
+	rows, err := q.db.QueryContext(ctx, listAPKeys)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListAPKeysRow{}
+	for rows.Next() {
+		var i ListAPKeysRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.KeyPrefix,
+			&i.Plan,
+			&i.Enabled,
+			&i.RpmLimit,
+			&i.MonthlyQuota,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listAPKeysByPrefix = `-- name: ListAPKeysByPrefix :many
+SELECT id, key_hash, enabled, rpm_limit, monthly_quota, allowed_service_ids
+FROM api_keys WHERE key_prefix = $1
+`
+
+type ListAPKeysByPrefixRow struct {
+	ID                uuid.UUID     `json:"id"`
+	KeyHash           string        `json:"key_hash"`
+	Enabled           int32         `json:"enabled"`
+	RpmLimit          sql.NullInt32 `json:"rpm_limit"`
+	MonthlyQuota      sql.NullInt32 `json:"monthly_quota"`
+	AllowedServiceIds string        `json:"allowed_service_ids"`
+}
+
+func (q *Queries) ListAPKeysByPrefix(ctx context.Context, keyPrefix string) ([]ListAPKeysByPrefixRow, error) {
+	rows, err := q.db.QueryContext(ctx, listAPKeysByPrefix, keyPrefix)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListAPKeysByPrefixRow{}
+	for rows.Next() {
+		var i ListAPKeysByPrefixRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.KeyHash,
+			&i.Enabled,
+			&i.RpmLimit,
+			&i.MonthlyQuota,
+			&i.AllowedServiceIds,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listAPServices = `-- name: ListAPServices :many
+SELECT id, name, slug, upstream_url, route_prefix, enabled,
+       to_char(created_at, 'YYYY-MM-DD"T"HH24:MI:SS"Z"') AS created_at,
+       to_char(updated_at, 'YYYY-MM-DD"T"HH24:MI:SS"Z"') AS updated_at
+FROM api_services
+ORDER BY created_at DESC
+`
+
+type ListAPServicesRow struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	Slug        string    `json:"slug"`
+	UpstreamUrl string    `json:"upstream_url"`
+	RoutePrefix string    `json:"route_prefix"`
+	Enabled     int32     `json:"enabled"`
+	CreatedAt   string    `json:"created_at"`
+	UpdatedAt   string    `json:"updated_at"`
+}
+
+func (q *Queries) ListAPServices(ctx context.Context) ([]ListAPServicesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listAPServices)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListAPServicesRow{}
+	for rows.Next() {
+		var i ListAPServicesRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Slug,
+			&i.UpstreamUrl,
+			&i.RoutePrefix,
+			&i.Enabled,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listClientEventPaths = `-- name: ListClientEventPaths :many
+SELECT COALESCE((labels_json::jsonb ->> 'path'), 'unknown') AS path, COUNT(*) AS total
+FROM metrics_timeseries
+WHERE metric = 'client_event' AND occurred_at >= NOW() - INTERVAL '7 days'
+GROUP BY COALESCE((labels_json::jsonb ->> 'path'), 'unknown')
+ORDER BY total DESC, path ASC
+LIMIT 20
+`
+
+type ListClientEventPathsRow struct {
+	Path  interface{} `json:"path"`
+	Total int64       `json:"total"`
+}
+
+func (q *Queries) ListClientEventPaths(ctx context.Context) ([]ListClientEventPathsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listClientEventPaths)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListClientEventPathsRow{}
+	for rows.Next() {
+		var i ListClientEventPathsRow
+		if err := rows.Scan(&i.Path, &i.Total); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listIncidentStatusCodes = `-- name: ListIncidentStatusCodes :many
+SELECT COALESCE(http_status, 0) AS status_code, COALESCE(SUM(count), 0) AS total
+FROM incident_events
+WHERE occurred_at >= NOW() - INTERVAL '7 days'
+GROUP BY COALESCE(http_status, 0)
+ORDER BY total DESC, status_code ASC
+`
+
+type ListIncidentStatusCodesRow struct {
+	StatusCode int32       `json:"status_code"`
+	Total      interface{} `json:"total"`
+}
+
+func (q *Queries) ListIncidentStatusCodes(ctx context.Context) ([]ListIncidentStatusCodesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listIncidentStatusCodes)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListIncidentStatusCodesRow{}
+	for rows.Next() {
+		var i ListIncidentStatusCodesRow
+		if err := rows.Scan(&i.StatusCode, &i.Total); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRequestsByDay = `-- name: ListRequestsByDay :many
+SELECT TO_CHAR(DATE_TRUNC('day', occurred_at), 'YYYY-MM-DD') AS day_bucket, COUNT(*) AS total
+FROM metrics_timeseries
+WHERE metric = 'request_total' AND occurred_at >= NOW() - INTERVAL '7 days'
+GROUP BY DATE_TRUNC('day', occurred_at)
+ORDER BY DATE_TRUNC('day', occurred_at) ASC
+`
+
+type ListRequestsByDayRow struct {
+	DayBucket string `json:"day_bucket"`
+	Total     int64  `json:"total"`
+}
+
+func (q *Queries) ListRequestsByDay(ctx context.Context) ([]ListRequestsByDayRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRequestsByDay)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRequestsByDayRow{}
+	for rows.Next() {
+		var i ListRequestsByDayRow
+		if err := rows.Scan(&i.DayBucket, &i.Total); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listTopAPServices = `-- name: ListTopAPServices :many
+SELECT s.id, s.name, COALESCE(SUM(u.request_count), 0) AS total_requests
+FROM api_services s
+LEFT JOIN usage_counters u ON u.service_id = s.id
+GROUP BY s.id, s.name
+ORDER BY total_requests DESC, s.name ASC
+LIMIT 10
+`
+
+type ListTopAPServicesRow struct {
+	ID            uuid.UUID   `json:"id"`
+	Name          string      `json:"name"`
+	TotalRequests interface{} `json:"total_requests"`
+}
+
+func (q *Queries) ListTopAPServices(ctx context.Context) ([]ListTopAPServicesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listTopAPServices)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListTopAPServicesRow{}
+	for rows.Next() {
+		var i ListTopAPServicesRow
+		if err := rows.Scan(&i.ID, &i.Name, &i.TotalRequests); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const setAPKeyEnabled = `-- name: SetAPKeyEnabled :exec
+UPDATE api_keys SET enabled = $1, updated_at = NOW() WHERE id = $2
+`
+
+type SetAPKeyEnabledParams struct {
+	Enabled int32     `json:"enabled"`
+	ID      uuid.UUID `json:"id"`
+}
+
+func (q *Queries) SetAPKeyEnabled(ctx context.Context, arg SetAPKeyEnabledParams) error {
+	_, err := q.db.ExecContext(ctx, setAPKeyEnabled, arg.Enabled, arg.ID)
+	return err
+}
+
+const setAPServiceEnabled = `-- name: SetAPServiceEnabled :exec
+UPDATE api_services SET enabled = $1, updated_at = NOW() WHERE id = $2
+`
+
+type SetAPServiceEnabledParams struct {
+	Enabled int32     `json:"enabled"`
+	ID      uuid.UUID `json:"id"`
+}
+
+func (q *Queries) SetAPServiceEnabled(ctx context.Context, arg SetAPServiceEnabledParams) error {
+	_, err := q.db.ExecContext(ctx, setAPServiceEnabled, arg.Enabled, arg.ID)
+	return err
+}
+
+const setAPServiceValidation = `-- name: SetAPServiceValidation :exec
+UPDATE api_services
+SET last_validation_at = NOW(), last_validation_status = $1, last_validation_message = $2, updated_at = NOW()
+WHERE id = $3
+`
+
+type SetAPServiceValidationParams struct {
+	LastValidationStatus  sql.NullString `json:"last_validation_status"`
+	LastValidationMessage sql.NullString `json:"last_validation_message"`
+	ID                    uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) SetAPServiceValidation(ctx context.Context, arg SetAPServiceValidationParams) error {
+	_, err := q.db.ExecContext(ctx, setAPServiceValidation, arg.LastValidationStatus, arg.LastValidationMessage, arg.ID)
+	return err
+}
+
+const sumRequestMetricSince = `-- name: SumRequestMetricSince :one
+SELECT COALESCE(SUM(value), 0)::int
+FROM metrics_timeseries
+WHERE metric = 'request_total' AND occurred_at >= DATE_TRUNC($1::text, NOW())
+`
+
+func (q *Queries) SumRequestMetricSince(ctx context.Context, dollar_1 string) (int32, error) {
+	row := q.db.QueryRowContext(ctx, sumRequestMetricSince, dollar_1)
+	var column_1 int32
+	err := row.Scan(&column_1)
+	return column_1, err
+}
+
+const sumUsageByKey = `-- name: SumUsageByKey :one
+SELECT COALESCE(SUM(request_count), 0)::bigint FROM usage_counters
+WHERE api_key_id = $1 AND period_month = $2
+`
+
+type SumUsageByKeyParams struct {
+	ApiKeyID    uuid.UUID `json:"api_key_id"`
+	PeriodMonth string    `json:"period_month"`
+}
+
+func (q *Queries) SumUsageByKey(ctx context.Context, arg SumUsageByKeyParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, sumUsageByKey, arg.ApiKeyID, arg.PeriodMonth)
+	var column_1 int64
+	err := row.Scan(&column_1)
+	return column_1, err
+}
+
+const sumUsageByService = `-- name: SumUsageByService :one
+SELECT COALESCE(SUM(request_count), 0)::bigint FROM usage_counters
+WHERE service_id = $1 AND period_month = $2
+`
+
+type SumUsageByServiceParams struct {
+	ServiceID   uuid.UUID `json:"service_id"`
+	PeriodMonth string    `json:"period_month"`
+}
+
+func (q *Queries) SumUsageByService(ctx context.Context, arg SumUsageByServiceParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, sumUsageByService, arg.ServiceID, arg.PeriodMonth)
+	var column_1 int64
+	err := row.Scan(&column_1)
+	return column_1, err
+}
+
+const sumUsageCounters = `-- name: SumUsageCounters :one
+SELECT COALESCE(SUM(request_count), 0) FROM usage_counters
+`
+
+func (q *Queries) SumUsageCounters(ctx context.Context) (interface{}, error) {
+	row := q.db.QueryRowContext(ctx, sumUsageCounters)
+	var coalesce interface{}
+	err := row.Scan(&coalesce)
+	return coalesce, err
+}
+
+const touchAPKeyLastUsed = `-- name: TouchAPKeyLastUsed :exec
+UPDATE api_keys SET last_used_at = NOW() WHERE id = $1
+`
+
+func (q *Queries) TouchAPKeyLastUsed(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, touchAPKeyLastUsed, id)
+	return err
+}
+
+const upsertUsageCounter = `-- name: UpsertUsageCounter :exec
+INSERT INTO usage_counters (api_key_id, service_id, period_month, request_count, updated_at)
+VALUES ($1, $2, $3, 1, NOW())
+ON CONFLICT (api_key_id, service_id, period_month)
+DO UPDATE SET request_count = usage_counters.request_count + 1, updated_at = NOW()
+`
+
+type UpsertUsageCounterParams struct {
+	ApiKeyID    uuid.UUID `json:"api_key_id"`
+	ServiceID   uuid.UUID `json:"service_id"`
+	PeriodMonth string    `json:"period_month"`
+}
+
+func (q *Queries) UpsertUsageCounter(ctx context.Context, arg UpsertUsageCounterParams) error {
+	_, err := q.db.ExecContext(ctx, upsertUsageCounter, arg.ApiKeyID, arg.ServiceID, arg.PeriodMonth)
+	return err
+}

app/backend/internal/database/sqlcdb/audit.sql.go

@@ -0,0 +1,218 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: audit.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
+)
+
+const insertAuditLog = `-- name: InsertAuditLog :exec
+INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, severity, category, label, created_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+`
+
+type InsertAuditLogParams struct {
+	ID         uuid.UUID             `json:"id"`
+	UserID     uuid.NullUUID         `json:"user_id"`
+	Resource   string                `json:"resource"`
+	ResourceID uuid.NullUUID         `json:"resource_id"`
+	Action     string                `json:"action"`
+	Details    pqtype.NullRawMessage `json:"details"`
+	Severity   string                `json:"severity"`
+	Category   string                `json:"category"`
+	Label      string                `json:"label"`
+	CreatedAt  time.Time             `json:"created_at"`
+}
+
+func (q *Queries) InsertAuditLog(ctx context.Context, arg InsertAuditLogParams) error {
+	_, err := q.db.ExecContext(ctx, insertAuditLog,
+		arg.ID,
+		arg.UserID,
+		arg.Resource,
+		arg.ResourceID,
+		arg.Action,
+		arg.Details,
+		arg.Severity,
+		arg.Category,
+		arg.Label,
+		arg.CreatedAt,
+	)
+	return err
+}
+
+const insertAuditLogWithRequest = `-- name: InsertAuditLogWithRequest :exec
+INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, ip_address, user_agent, severity, category, label, created_at)
+VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7::inet, $8, $9, $10, $11, $12)
+`
+
+type InsertAuditLogWithRequestParams struct {
+	ID         uuid.UUID       `json:"id"`
+	UserID     uuid.NullUUID   `json:"user_id"`
+	Resource   string          `json:"resource"`
+	ResourceID uuid.NullUUID   `json:"resource_id"`
+	Action     string          `json:"action"`
+	Column6    json.RawMessage `json:"column_6"`
+	Column7    pqtype.Inet     `json:"column_7"`
+	UserAgent  sql.NullString  `json:"user_agent"`
+	Severity   string          `json:"severity"`
+	Category   string          `json:"category"`
+	Label      string          `json:"label"`
+	CreatedAt  time.Time       `json:"created_at"`
+}
+
+func (q *Queries) InsertAuditLogWithRequest(ctx context.Context, arg InsertAuditLogWithRequestParams) error {
+	_, err := q.db.ExecContext(ctx, insertAuditLogWithRequest,
+		arg.ID,
+		arg.UserID,
+		arg.Resource,
+		arg.ResourceID,
+		arg.Action,
+		arg.Column6,
+		arg.Column7,
+		arg.UserAgent,
+		arg.Severity,
+		arg.Category,
+		arg.Label,
+		arg.CreatedAt,
+	)
+	return err
+}
+
+const listAuditBackfillBatch = `-- name: ListAuditBackfillBatch :many
+SELECT id::text, resource, action FROM audit_logs
+WHERE label = '' AND id > $1::uuid ORDER BY id LIMIT 500
+`
+
+type ListAuditBackfillBatchRow struct {
+	ID       string `json:"id"`
+	Resource string `json:"resource"`
+	Action   string `json:"action"`
+}
+
+func (q *Queries) ListAuditBackfillBatch(ctx context.Context, dollar_1 uuid.UUID) ([]ListAuditBackfillBatchRow, error) {
+	rows, err := q.db.QueryContext(ctx, listAuditBackfillBatch, dollar_1)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListAuditBackfillBatchRow{}
+	for rows.Next() {
+		var i ListAuditBackfillBatchRow
+		if err := rows.Scan(&i.ID, &i.Resource, &i.Action); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listResourceAuditLogs = `-- name: ListResourceAuditLogs :many
+SELECT id, COALESCE(user_id::text, '')::text AS user_id, resource,
+       COALESCE(resource_id::text, '')::text AS resource_id, action,
+       COALESCE(details::text, '{}')::text AS details,
+       COALESCE(ip_address::text, '')::text AS ip_address,
+       COALESCE(user_agent, '') AS user_agent, created_at
+FROM audit_logs
+WHERE user_id::text = $1 AND resource = $2 AND resource_id::text = $3
+ORDER BY created_at DESC
+LIMIT 100
+`
+
+type ListResourceAuditLogsParams struct {
+	UserID     uuid.NullUUID `json:"user_id"`
+	Resource   string        `json:"resource"`
+	ResourceID uuid.NullUUID `json:"resource_id"`
+}
+
+type ListResourceAuditLogsRow struct {
+	ID         uuid.UUID `json:"id"`
+	UserID     string    `json:"user_id"`
+	Resource   string    `json:"resource"`
+	ResourceID string    `json:"resource_id"`
+	Action     string    `json:"action"`
+	Details    string    `json:"details"`
+	IpAddress  string    `json:"ip_address"`
+	UserAgent  string    `json:"user_agent"`
+	CreatedAt  time.Time `json:"created_at"`
+}
+
+func (q *Queries) ListResourceAuditLogs(ctx context.Context, arg ListResourceAuditLogsParams) ([]ListResourceAuditLogsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listResourceAuditLogs, arg.UserID, arg.Resource, arg.ResourceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListResourceAuditLogsRow{}
+	for rows.Next() {
+		var i ListResourceAuditLogsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.UserID,
+			&i.Resource,
+			&i.ResourceID,
+			&i.Action,
+			&i.Details,
+			&i.IpAddress,
+			&i.UserAgent,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const pruneAuditLogs = `-- name: PruneAuditLogs :execrows
+DELETE FROM audit_logs WHERE created_at < NOW() - ($1::int * INTERVAL '1 day')
+`
+
+func (q *Queries) PruneAuditLogs(ctx context.Context, dollar_1 int32) (int64, error) {
+	result, err := q.db.ExecContext(ctx, pruneAuditLogs, dollar_1)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const setAuditLogMetadata = `-- name: SetAuditLogMetadata :exec
+UPDATE audit_logs SET severity = $1, category = $2, label = $3 WHERE id = $4::uuid
+`
+
+type SetAuditLogMetadataParams struct {
+	Severity string    `json:"severity"`
+	Category string    `json:"category"`
+	Label    string    `json:"label"`
+	Column4  uuid.UUID `json:"column_4"`
+}
+
+func (q *Queries) SetAuditLogMetadata(ctx context.Context, arg SetAuditLogMetadataParams) error {
+	_, err := q.db.ExecContext(ctx, setAuditLogMetadata,
+		arg.Severity,
+		arg.Category,
+		arg.Label,
+		arg.Column4,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/auth.sql.go

@@ -0,0 +1,335 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: auth.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const countUsers = `-- name: CountUsers :one
+SELECT COUNT(*) FROM users
+`
+
+func (q *Queries) CountUsers(ctx context.Context) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countUsers)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const countUsersByEmail = `-- name: CountUsersByEmail :one
+SELECT COUNT(*) FROM users WHERE email = $1
+`
+
+func (q *Queries) CountUsersByEmail(ctx context.Context, email string) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countUsersByEmail, email)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const getAdminUserInfo = `-- name: GetAdminUserInfo :one
+SELECT email, COALESCE(name, '') AS name, is_admin
+FROM users WHERE id = $1
+`
+
+type GetAdminUserInfoRow struct {
+	Email   string `json:"email"`
+	Name    string `json:"name"`
+	IsAdmin bool   `json:"is_admin"`
+}
+
+func (q *Queries) GetAdminUserInfo(ctx context.Context, id uuid.UUID) (GetAdminUserInfoRow, error) {
+	row := q.db.QueryRowContext(ctx, getAdminUserInfo, id)
+	var i GetAdminUserInfoRow
+	err := row.Scan(&i.Email, &i.Name, &i.IsAdmin)
+	return i, err
+}
+
+const getUserByEmailForAuth = `-- name: GetUserByEmailForAuth :one
+SELECT id, email, password_hash, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at
+FROM users WHERE email = $1
+`
+
+type GetUserByEmailForAuthRow struct {
+	ID           uuid.UUID    `json:"id"`
+	Email        string       `json:"email"`
+	PasswordHash string       `json:"password_hash"`
+	Name         string       `json:"name"`
+	AvatarUrl    string       `json:"avatar_url"`
+	IsAdmin      bool         `json:"is_admin"`
+	CreatedAt    sql.NullTime `json:"created_at"`
+}
+
+func (q *Queries) GetUserByEmailForAuth(ctx context.Context, email string) (GetUserByEmailForAuthRow, error) {
+	row := q.db.QueryRowContext(ctx, getUserByEmailForAuth, email)
+	var i GetUserByEmailForAuthRow
+	err := row.Scan(
+		&i.ID,
+		&i.Email,
+		&i.PasswordHash,
+		&i.Name,
+		&i.AvatarUrl,
+		&i.IsAdmin,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const getUserByID = `-- name: GetUserByID :one
+SELECT id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at
+FROM users WHERE id = $1
+`
+
+type GetUserByIDRow struct {
+	ID        uuid.UUID    `json:"id"`
+	Email     string       `json:"email"`
+	Name      string       `json:"name"`
+	AvatarUrl string       `json:"avatar_url"`
+	IsAdmin   bool         `json:"is_admin"`
+	CreatedAt sql.NullTime `json:"created_at"`
+}
+
+func (q *Queries) GetUserByID(ctx context.Context, id uuid.UUID) (GetUserByIDRow, error) {
+	row := q.db.QueryRowContext(ctx, getUserByID, id)
+	var i GetUserByIDRow
+	err := row.Scan(
+		&i.ID,
+		&i.Email,
+		&i.Name,
+		&i.AvatarUrl,
+		&i.IsAdmin,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const insertUser = `-- name: InsertUser :one
+INSERT INTO users (email, password_hash, name)
+VALUES ($1, $2, $3)
+RETURNING id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at
+`
+
+type InsertUserParams struct {
+	Email        string `json:"email"`
+	PasswordHash string `json:"password_hash"`
+	Name         string `json:"name"`
+}
+
+type InsertUserRow struct {
+	ID        uuid.UUID    `json:"id"`
+	Email     string       `json:"email"`
+	Name      string       `json:"name"`
+	AvatarUrl string       `json:"avatar_url"`
+	IsAdmin   bool         `json:"is_admin"`
+	CreatedAt sql.NullTime `json:"created_at"`
+}
+
+func (q *Queries) InsertUser(ctx context.Context, arg InsertUserParams) (InsertUserRow, error) {
+	row := q.db.QueryRowContext(ctx, insertUser, arg.Email, arg.PasswordHash, arg.Name)
+	var i InsertUserRow
+	err := row.Scan(
+		&i.ID,
+		&i.Email,
+		&i.Name,
+		&i.AvatarUrl,
+		&i.IsAdmin,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const insertUserAdmin = `-- name: InsertUserAdmin :one
+INSERT INTO users (email, password_hash, name, is_admin)
+VALUES ($1, $2, $3, $4)
+RETURNING id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at
+`
+
+type InsertUserAdminParams struct {
+	Email        string `json:"email"`
+	PasswordHash string `json:"password_hash"`
+	Name         string `json:"name"`
+	IsAdmin      bool   `json:"is_admin"`
+}
+
+type InsertUserAdminRow struct {
+	ID        uuid.UUID    `json:"id"`
+	Email     string       `json:"email"`
+	Name      string       `json:"name"`
+	AvatarUrl string       `json:"avatar_url"`
+	IsAdmin   bool         `json:"is_admin"`
+	CreatedAt sql.NullTime `json:"created_at"`
+}
+
+func (q *Queries) InsertUserAdmin(ctx context.Context, arg InsertUserAdminParams) (InsertUserAdminRow, error) {
+	row := q.db.QueryRowContext(ctx, insertUserAdmin,
+		arg.Email,
+		arg.PasswordHash,
+		arg.Name,
+		arg.IsAdmin,
+	)
+	var i InsertUserAdminRow
+	err := row.Scan(
+		&i.ID,
+		&i.Email,
+		&i.Name,
+		&i.AvatarUrl,
+		&i.IsAdmin,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const listAdminUsers = `-- name: ListAdminUsers :many
+SELECT id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin,
+       COALESCE(to_char(created_at, 'YYYY-MM-DD"T"HH24:MI:SS"Z"'), '')::text AS created_at
+FROM users
+ORDER BY created_at ASC
+`
+
+type ListAdminUsersRow struct {
+	ID        uuid.UUID `json:"id"`
+	Email     string    `json:"email"`
+	Name      string    `json:"name"`
+	AvatarUrl string    `json:"avatar_url"`
+	IsAdmin   bool      `json:"is_admin"`
+	CreatedAt string    `json:"created_at"`
+}
+
+func (q *Queries) ListAdminUsers(ctx context.Context) ([]ListAdminUsersRow, error) {
+	rows, err := q.db.QueryContext(ctx, listAdminUsers)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListAdminUsersRow{}
+	for rows.Next() {
+		var i ListAdminUsersRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Email,
+			&i.Name,
+			&i.AvatarUrl,
+			&i.IsAdmin,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const setUserAdmin = `-- name: SetUserAdmin :execrows
+UPDATE users SET is_admin = $1, updated_at = NOW() WHERE id = $2
+`
+
+type SetUserAdminParams struct {
+	IsAdmin bool      `json:"is_admin"`
+	ID      uuid.UUID `json:"id"`
+}
+
+func (q *Queries) SetUserAdmin(ctx context.Context, arg SetUserAdminParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, setUserAdmin, arg.IsAdmin, arg.ID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const updateUserProfile = `-- name: UpdateUserProfile :exec
+UPDATE users
+SET name = COALESCE($1::varchar, name), avatar_url = COALESCE($2::varchar, avatar_url)
+WHERE id = $3
+`
+
+type UpdateUserProfileParams struct {
+	Column1 string    `json:"column_1"`
+	Column2 string    `json:"column_2"`
+	ID      uuid.UUID `json:"id"`
+}
+
+func (q *Queries) UpdateUserProfile(ctx context.Context, arg UpdateUserProfileParams) error {
+	_, err := q.db.ExecContext(ctx, updateUserProfile, arg.Column1, arg.Column2, arg.ID)
+	return err
+}
+
+const upsertAdminUser = `-- name: UpsertAdminUser :one
+INSERT INTO users (email, password_hash, name, is_admin)
+VALUES ($1, $2, $3, true)
+ON CONFLICT (email) DO UPDATE
+SET is_admin = true, updated_at = NOW()
+RETURNING id
+`
+
+type UpsertAdminUserParams struct {
+	Email        string `json:"email"`
+	PasswordHash string `json:"password_hash"`
+	Name         string `json:"name"`
+}
+
+func (q *Queries) UpsertAdminUser(ctx context.Context, arg UpsertAdminUserParams) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, upsertAdminUser, arg.Email, arg.PasswordHash, arg.Name)
+	var id uuid.UUID
+	err := row.Scan(&id)
+	return id, err
+}
+
+const upsertLocalUser = `-- name: UpsertLocalUser :one
+INSERT INTO users (email, password_hash, name, avatar_url, is_admin)
+VALUES ($1, $2, $3, NULLIF($4::varchar, ''), $5)
+ON CONFLICT (email) DO UPDATE
+SET name = EXCLUDED.name,
+    avatar_url = COALESCE(EXCLUDED.avatar_url, users.avatar_url),
+    updated_at = NOW()
+RETURNING id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at
+`
+
+type UpsertLocalUserParams struct {
+	Email        string `json:"email"`
+	PasswordHash string `json:"password_hash"`
+	Name         string `json:"name"`
+	Column4      string `json:"column_4"`
+	IsAdmin      bool   `json:"is_admin"`
+}
+
+type UpsertLocalUserRow struct {
+	ID        uuid.UUID    `json:"id"`
+	Email     string       `json:"email"`
+	Name      string       `json:"name"`
+	AvatarUrl string       `json:"avatar_url"`
+	IsAdmin   bool         `json:"is_admin"`
+	CreatedAt sql.NullTime `json:"created_at"`
+}
+
+func (q *Queries) UpsertLocalUser(ctx context.Context, arg UpsertLocalUserParams) (UpsertLocalUserRow, error) {
+	row := q.db.QueryRowContext(ctx, upsertLocalUser,
+		arg.Email,
+		arg.PasswordHash,
+		arg.Name,
+		arg.Column4,
+		arg.IsAdmin,
+	)
+	var i UpsertLocalUserRow
+	err := row.Scan(
+		&i.ID,
+		&i.Email,
+		&i.Name,
+		&i.AvatarUrl,
+		&i.IsAdmin,
+		&i.CreatedAt,
+	)
+	return i, err
+}

app/backend/internal/database/sqlcdb/builds.sql.go

@@ -0,0 +1,138 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: builds.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+)
+
+const cancelBuild = `-- name: CancelBuild :execrows
+UPDATE builds
+SET status = 'cancelled',
+    progress = 100,
+    completed_at = $1,
+    log = COALESCE(log, '') || $2,
+    updated_at = $1
+WHERE id = $3
+  AND status NOT IN ('success', 'failed', 'cancelled')
+`
+
+type CancelBuildParams struct {
+	CompletedAt sql.NullTime `json:"completed_at"`
+	Log         string       `json:"log"`
+	ID          string       `json:"id"`
+}
+
+func (q *Queries) CancelBuild(ctx context.Context, arg CancelBuildParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, cancelBuild, arg.CompletedAt, arg.Log, arg.ID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const getBuild = `-- name: GetBuild :one
+SELECT id, project_id, service_id, status, progress, started_at, completed_at, image_name, image_tag, size, error, log, metadata
+FROM builds
+WHERE id = $1
+`
+
+type GetBuildRow struct {
+	ID          string          `json:"id"`
+	ProjectID   sql.NullString  `json:"project_id"`
+	ServiceID   sql.NullString  `json:"service_id"`
+	Status      string          `json:"status"`
+	Progress    int32           `json:"progress"`
+	StartedAt   time.Time       `json:"started_at"`
+	CompletedAt sql.NullTime    `json:"completed_at"`
+	ImageName   string          `json:"image_name"`
+	ImageTag    string          `json:"image_tag"`
+	Size        int64           `json:"size"`
+	Error       sql.NullString  `json:"error"`
+	Log         string          `json:"log"`
+	Metadata    json.RawMessage `json:"metadata"`
+}
+
+func (q *Queries) GetBuild(ctx context.Context, id string) (GetBuildRow, error) {
+	row := q.db.QueryRowContext(ctx, getBuild, id)
+	var i GetBuildRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.ServiceID,
+		&i.Status,
+		&i.Progress,
+		&i.StartedAt,
+		&i.CompletedAt,
+		&i.ImageName,
+		&i.ImageTag,
+		&i.Size,
+		&i.Error,
+		&i.Log,
+		&i.Metadata,
+	)
+	return i, err
+}
+
+const upsertBuild = `-- name: UpsertBuild :exec
+INSERT INTO builds
+ (id, project_id, service_id, status, progress, started_at, completed_at, image_name, image_tag, size, error, log, metadata, created_at, updated_at)
+ VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14, $14)
+ ON CONFLICT (id) DO UPDATE SET
+   project_id = EXCLUDED.project_id,
+   service_id = EXCLUDED.service_id,
+   status = EXCLUDED.status,
+   progress = EXCLUDED.progress,
+   started_at = EXCLUDED.started_at,
+   completed_at = EXCLUDED.completed_at,
+   image_name = EXCLUDED.image_name,
+   image_tag = EXCLUDED.image_tag,
+   size = EXCLUDED.size,
+   error = EXCLUDED.error,
+   log = EXCLUDED.log,
+   metadata = EXCLUDED.metadata,
+   updated_at = EXCLUDED.updated_at
+`
+
+type UpsertBuildParams struct {
+	ID          string          `json:"id"`
+	ProjectID   sql.NullString  `json:"project_id"`
+	ServiceID   sql.NullString  `json:"service_id"`
+	Status      string          `json:"status"`
+	Progress    int32           `json:"progress"`
+	StartedAt   time.Time       `json:"started_at"`
+	CompletedAt sql.NullTime    `json:"completed_at"`
+	ImageName   string          `json:"image_name"`
+	ImageTag    string          `json:"image_tag"`
+	Size        int64           `json:"size"`
+	Error       sql.NullString  `json:"error"`
+	Log         string          `json:"log"`
+	Column13    json.RawMessage `json:"column_13"`
+	CreatedAt   time.Time       `json:"created_at"`
+}
+
+func (q *Queries) UpsertBuild(ctx context.Context, arg UpsertBuildParams) error {
+	_, err := q.db.ExecContext(ctx, upsertBuild,
+		arg.ID,
+		arg.ProjectID,
+		arg.ServiceID,
+		arg.Status,
+		arg.Progress,
+		arg.StartedAt,
+		arg.CompletedAt,
+		arg.ImageName,
+		arg.ImageTag,
+		arg.Size,
+		arg.Error,
+		arg.Log,
+		arg.Column13,
+		arg.CreatedAt,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/cron.sql.go

@@ -0,0 +1,332 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: cron.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const deleteCronJob = `-- name: DeleteCronJob :exec
+DELETE FROM cron_jobs WHERE id = $1
+`
+
+func (q *Queries) DeleteCronJob(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deleteCronJob, id)
+	return err
+}
+
+const finishCronExecution = `-- name: FinishCronExecution :exec
+UPDATE cron_executions SET finished_at = $1, status = $2, output = $3, error = $4 WHERE id = $5
+`
+
+type FinishCronExecutionParams struct {
+	FinishedAt sql.NullTime   `json:"finished_at"`
+	Status     sql.NullString `json:"status"`
+	Output     sql.NullString `json:"output"`
+	Error      sql.NullString `json:"error"`
+	ID         uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) FinishCronExecution(ctx context.Context, arg FinishCronExecutionParams) error {
+	_, err := q.db.ExecContext(ctx, finishCronExecution,
+		arg.FinishedAt,
+		arg.Status,
+		arg.Output,
+		arg.Error,
+		arg.ID,
+	)
+	return err
+}
+
+const getCronJob = `-- name: GetCronJob :one
+SELECT id, project_id, service_id, name, schedule, command, timezone,
+       enabled, last_run_at, next_run_at, last_status, last_output,
+       retention, created_at, updated_at
+FROM cron_jobs WHERE id = $1
+`
+
+func (q *Queries) GetCronJob(ctx context.Context, id uuid.UUID) (CronJob, error) {
+	row := q.db.QueryRowContext(ctx, getCronJob, id)
+	var i CronJob
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.ServiceID,
+		&i.Name,
+		&i.Schedule,
+		&i.Command,
+		&i.Timezone,
+		&i.Enabled,
+		&i.LastRunAt,
+		&i.NextRunAt,
+		&i.LastStatus,
+		&i.LastOutput,
+		&i.Retention,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getCronJobForTrigger = `-- name: GetCronJobForTrigger :one
+SELECT cj.service_id, cj.command, cj.schedule, cj.timezone, cj.retention, p.owner_id
+FROM cron_jobs cj
+JOIN projects p ON cj.project_id = p.id
+WHERE cj.id = $1
+`
+
+type GetCronJobForTriggerRow struct {
+	ServiceID uuid.UUID      `json:"service_id"`
+	Command   string         `json:"command"`
+	Schedule  string         `json:"schedule"`
+	Timezone  sql.NullString `json:"timezone"`
+	Retention sql.NullInt32  `json:"retention"`
+	OwnerID   uuid.UUID      `json:"owner_id"`
+}
+
+func (q *Queries) GetCronJobForTrigger(ctx context.Context, id uuid.UUID) (GetCronJobForTriggerRow, error) {
+	row := q.db.QueryRowContext(ctx, getCronJobForTrigger, id)
+	var i GetCronJobForTriggerRow
+	err := row.Scan(
+		&i.ServiceID,
+		&i.Command,
+		&i.Schedule,
+		&i.Timezone,
+		&i.Retention,
+		&i.OwnerID,
+	)
+	return i, err
+}
+
+const getCronJobOwner = `-- name: GetCronJobOwner :one
+SELECT p.owner_id FROM cron_jobs cj
+JOIN projects p ON cj.project_id = p.id
+WHERE cj.id = $1
+`
+
+func (q *Queries) GetCronJobOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getCronJobOwner, id)
+	var owner_id uuid.UUID
+	err := row.Scan(&owner_id)
+	return owner_id, err
+}
+
+const getCronJobProjectID = `-- name: GetCronJobProjectID :one
+SELECT project_id FROM cron_jobs WHERE id = $1
+`
+
+func (q *Queries) GetCronJobProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getCronJobProjectID, id)
+	var project_id uuid.UUID
+	err := row.Scan(&project_id)
+	return project_id, err
+}
+
+const getCronOwnerViaService = `-- name: GetCronOwnerViaService :one
+SELECT p.owner_id FROM projects p
+JOIN services s ON s.project_id = p.id
+WHERE s.id = $1
+`
+
+func (q *Queries) GetCronOwnerViaService(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getCronOwnerViaService, id)
+	var owner_id uuid.UUID
+	err := row.Scan(&owner_id)
+	return owner_id, err
+}
+
+const insertCronExecution = `-- name: InsertCronExecution :exec
+INSERT INTO cron_executions (id, cron_job_id, started_at, status)
+VALUES ($1, $2, $3, $4)
+`
+
+type InsertCronExecutionParams struct {
+	ID        uuid.UUID      `json:"id"`
+	CronJobID uuid.UUID      `json:"cron_job_id"`
+	StartedAt time.Time      `json:"started_at"`
+	Status    sql.NullString `json:"status"`
+}
+
+func (q *Queries) InsertCronExecution(ctx context.Context, arg InsertCronExecutionParams) error {
+	_, err := q.db.ExecContext(ctx, insertCronExecution,
+		arg.ID,
+		arg.CronJobID,
+		arg.StartedAt,
+		arg.Status,
+	)
+	return err
+}
+
+const insertCronJob = `-- name: InsertCronJob :exec
+INSERT INTO cron_jobs (id, project_id, service_id, name, schedule, command, timezone, enabled, next_run_at, retention, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+`
+
+type InsertCronJobParams struct {
+	ID        uuid.UUID      `json:"id"`
+	ProjectID uuid.UUID      `json:"project_id"`
+	ServiceID uuid.UUID      `json:"service_id"`
+	Name      string         `json:"name"`
+	Schedule  string         `json:"schedule"`
+	Command   string         `json:"command"`
+	Timezone  sql.NullString `json:"timezone"`
+	Enabled   sql.NullBool   `json:"enabled"`
+	NextRunAt sql.NullTime   `json:"next_run_at"`
+	Retention sql.NullInt32  `json:"retention"`
+	CreatedAt sql.NullTime   `json:"created_at"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) InsertCronJob(ctx context.Context, arg InsertCronJobParams) error {
+	_, err := q.db.ExecContext(ctx, insertCronJob,
+		arg.ID,
+		arg.ProjectID,
+		arg.ServiceID,
+		arg.Name,
+		arg.Schedule,
+		arg.Command,
+		arg.Timezone,
+		arg.Enabled,
+		arg.NextRunAt,
+		arg.Retention,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const listCronExecutions = `-- name: ListCronExecutions :many
+SELECT id, cron_job_id, started_at, finished_at, status, output, error
+FROM cron_executions
+WHERE cron_job_id = $1
+ORDER BY started_at DESC
+LIMIT 100
+`
+
+func (q *Queries) ListCronExecutions(ctx context.Context, cronJobID uuid.UUID) ([]CronExecution, error) {
+	rows, err := q.db.QueryContext(ctx, listCronExecutions, cronJobID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []CronExecution{}
+	for rows.Next() {
+		var i CronExecution
+		if err := rows.Scan(
+			&i.ID,
+			&i.CronJobID,
+			&i.StartedAt,
+			&i.FinishedAt,
+			&i.Status,
+			&i.Output,
+			&i.Error,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listDueCronJobs = `-- name: ListDueCronJobs :many
+SELECT id, project_id, service_id, name, schedule, command, timezone, enabled, retention
+FROM cron_jobs
+WHERE enabled = TRUE AND next_run_at IS NOT NULL AND next_run_at <= NOW()
+`
+
+type ListDueCronJobsRow struct {
+	ID        uuid.UUID      `json:"id"`
+	ProjectID uuid.UUID      `json:"project_id"`
+	ServiceID uuid.UUID      `json:"service_id"`
+	Name      string         `json:"name"`
+	Schedule  string         `json:"schedule"`
+	Command   string         `json:"command"`
+	Timezone  sql.NullString `json:"timezone"`
+	Enabled   sql.NullBool   `json:"enabled"`
+	Retention sql.NullInt32  `json:"retention"`
+}
+
+func (q *Queries) ListDueCronJobs(ctx context.Context) ([]ListDueCronJobsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listDueCronJobs)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListDueCronJobsRow{}
+	for rows.Next() {
+		var i ListDueCronJobsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.ServiceID,
+			&i.Name,
+			&i.Schedule,
+			&i.Command,
+			&i.Timezone,
+			&i.Enabled,
+			&i.Retention,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const trimCronExecutions = `-- name: TrimCronExecutions :exec
+DELETE FROM cron_executions WHERE cron_executions.cron_job_id = $1 AND cron_executions.id NOT IN (
+    SELECT ce.id FROM cron_executions ce WHERE ce.cron_job_id = $1
+    ORDER BY ce.started_at DESC LIMIT $2)
+`
+
+type TrimCronExecutionsParams struct {
+	CronJobID uuid.UUID `json:"cron_job_id"`
+	Limit     int32     `json:"limit"`
+}
+
+func (q *Queries) TrimCronExecutions(ctx context.Context, arg TrimCronExecutionsParams) error {
+	_, err := q.db.ExecContext(ctx, trimCronExecutions, arg.CronJobID, arg.Limit)
+	return err
+}
+
+const updateCronJobRun = `-- name: UpdateCronJobRun :exec
+UPDATE cron_jobs SET last_run_at = $1, last_status = $2, last_output = $3, next_run_at = $4 WHERE id = $5
+`
+
+type UpdateCronJobRunParams struct {
+	LastRunAt  sql.NullTime   `json:"last_run_at"`
+	LastStatus sql.NullString `json:"last_status"`
+	LastOutput sql.NullString `json:"last_output"`
+	NextRunAt  sql.NullTime   `json:"next_run_at"`
+	ID         uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) UpdateCronJobRun(ctx context.Context, arg UpdateCronJobRunParams) error {
+	_, err := q.db.ExecContext(ctx, updateCronJobRun,
+		arg.LastRunAt,
+		arg.LastStatus,
+		arg.LastOutput,
+		arg.NextRunAt,
+		arg.ID,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/deployments.sql.go

@@ -0,0 +1,536 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: deployments.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const completeDeployment = `-- name: CompleteDeployment :exec
+UPDATE deployments
+SET status = $1, error = $2, completed_at = $3, updated_at = $3
+WHERE id = $4
+`
+
+type CompleteDeploymentParams struct {
+	Status      sql.NullString `json:"status"`
+	Error       sql.NullString `json:"error"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	ID          uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) CompleteDeployment(ctx context.Context, arg CompleteDeploymentParams) error {
+	_, err := q.db.ExecContext(ctx, completeDeployment,
+		arg.Status,
+		arg.Error,
+		arg.CompletedAt,
+		arg.ID,
+	)
+	return err
+}
+
+const countAccessibleDeployments = `-- name: CountAccessibleDeployments :one
+SELECT COUNT(*)
+FROM deployments d
+JOIN services s ON s.id = d.service_id
+JOIN projects p ON p.id = s.project_id
+WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
+   OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)
+`
+
+type CountAccessibleDeploymentsParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+}
+
+func (q *Queries) CountAccessibleDeployments(ctx context.Context, arg CountAccessibleDeploymentsParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countAccessibleDeployments, arg.OwnerID, arg.Column2)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const countDeploymentsForService = `-- name: CountDeploymentsForService :one
+SELECT COUNT(*) FROM deployments WHERE service_id = $1
+`
+
+func (q *Queries) CountDeploymentsForService(ctx context.Context, serviceID uuid.UUID) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countDeploymentsForService, serviceID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const failDeployment = `-- name: FailDeployment :exec
+UPDATE deployments
+SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+WHERE id = $3
+`
+
+type FailDeploymentParams struct {
+	Error       sql.NullString `json:"error"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	ID          uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) FailDeployment(ctx context.Context, arg FailDeploymentParams) error {
+	_, err := q.db.ExecContext(ctx, failDeployment, arg.Error, arg.CompletedAt, arg.ID)
+	return err
+}
+
+const getDeploymentAccess = `-- name: GetDeploymentAccess :one
+SELECT d.status, d.service_id, p.owner_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1
+`
+
+type GetDeploymentAccessRow struct {
+	Status    sql.NullString `json:"status"`
+	ServiceID uuid.UUID      `json:"service_id"`
+	OwnerID   uuid.UUID      `json:"owner_id"`
+}
+
+func (q *Queries) GetDeploymentAccess(ctx context.Context, id uuid.UUID) (GetDeploymentAccessRow, error) {
+	row := q.db.QueryRowContext(ctx, getDeploymentAccess, id)
+	var i GetDeploymentAccessRow
+	err := row.Scan(&i.Status, &i.ServiceID, &i.OwnerID)
+	return i, err
+}
+
+const getDeploymentForRollback = `-- name: GetDeploymentForRollback :one
+SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
+       d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
+       d.created_at, d.updated_at, p.owner_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1
+`
+
+type GetDeploymentForRollbackRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	CommitHash  sql.NullString `json:"commit_hash"`
+	Status      sql.NullString `json:"status"`
+	ImageName   sql.NullString `json:"image_name"`
+	ImageTag    sql.NullString `json:"image_tag"`
+	BuildLog    sql.NullString `json:"build_log"`
+	RuntimeLog  sql.NullString `json:"runtime_log"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+	OwnerID     uuid.UUID      `json:"owner_id"`
+}
+
+func (q *Queries) GetDeploymentForRollback(ctx context.Context, id uuid.UUID) (GetDeploymentForRollbackRow, error) {
+	row := q.db.QueryRowContext(ctx, getDeploymentForRollback, id)
+	var i GetDeploymentForRollbackRow
+	err := row.Scan(
+		&i.ID,
+		&i.ServiceID,
+		&i.CommitHash,
+		&i.Status,
+		&i.ImageName,
+		&i.ImageTag,
+		&i.BuildLog,
+		&i.RuntimeLog,
+		&i.Error,
+		&i.StartedAt,
+		&i.CompletedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OwnerID,
+	)
+	return i, err
+}
+
+const getDeploymentWithProject = `-- name: GetDeploymentWithProject :one
+SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
+       d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
+       d.created_at, d.updated_at, p.id AS project_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1
+`
+
+type GetDeploymentWithProjectRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	CommitHash  sql.NullString `json:"commit_hash"`
+	Status      sql.NullString `json:"status"`
+	ImageName   sql.NullString `json:"image_name"`
+	ImageTag    sql.NullString `json:"image_tag"`
+	BuildLog    sql.NullString `json:"build_log"`
+	RuntimeLog  sql.NullString `json:"runtime_log"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+	ProjectID   uuid.UUID      `json:"project_id"`
+}
+
+func (q *Queries) GetDeploymentWithProject(ctx context.Context, id uuid.UUID) (GetDeploymentWithProjectRow, error) {
+	row := q.db.QueryRowContext(ctx, getDeploymentWithProject, id)
+	var i GetDeploymentWithProjectRow
+	err := row.Scan(
+		&i.ID,
+		&i.ServiceID,
+		&i.CommitHash,
+		&i.Status,
+		&i.ImageName,
+		&i.ImageTag,
+		&i.BuildLog,
+		&i.RuntimeLog,
+		&i.Error,
+		&i.StartedAt,
+		&i.CompletedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.ProjectID,
+	)
+	return i, err
+}
+
+const getServiceForDeployWithOwner = `-- name: GetServiceForDeployWithOwner :one
+SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
+       s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at, p.owner_id
+FROM services s
+JOIN projects p ON s.project_id = p.id
+WHERE s.id = $1
+`
+
+type GetServiceForDeployWithOwnerRow struct {
+	ID              uuid.UUID      `json:"id"`
+	ProjectID       uuid.UUID      `json:"project_id"`
+	Name            string         `json:"name"`
+	Type            sql.NullString `json:"type"`
+	Status          sql.NullString `json:"status"`
+	Image           sql.NullString `json:"image"`
+	Command         sql.NullString `json:"command"`
+	Environment     sql.NullString `json:"environment"`
+	GitRepo         sql.NullString `json:"git_repo"`
+	GitBranch       sql.NullString `json:"git_branch"`
+	BuildPath       sql.NullString `json:"build_path"`
+	Cpu             sql.NullString `json:"cpu"`
+	Memory          sql.NullString `json:"memory"`
+	Replicas        int32          `json:"replicas"`
+	Port            int32          `json:"port"`
+	Domain          string         `json:"domain"`
+	HealthcheckPath string         `json:"healthcheck_path"`
+	RestartPolicy   string         `json:"restart_policy"`
+	Builder         string         `json:"builder"`
+	CpuReserve      string         `json:"cpu_reserve"`
+	MemoryReserve   string         `json:"memory_reserve"`
+	StaticBuildCmd  string         `json:"static_build_cmd"`
+	StaticDir       string         `json:"static_dir"`
+	CreatedAt       sql.NullTime   `json:"created_at"`
+	UpdatedAt       sql.NullTime   `json:"updated_at"`
+	OwnerID         uuid.UUID      `json:"owner_id"`
+}
+
+func (q *Queries) GetServiceForDeployWithOwner(ctx context.Context, id uuid.UUID) (GetServiceForDeployWithOwnerRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceForDeployWithOwner, id)
+	var i GetServiceForDeployWithOwnerRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Type,
+		&i.Status,
+		&i.Image,
+		&i.Command,
+		&i.Environment,
+		&i.GitRepo,
+		&i.GitBranch,
+		&i.BuildPath,
+		&i.Cpu,
+		&i.Memory,
+		&i.Replicas,
+		&i.Port,
+		&i.Domain,
+		&i.HealthcheckPath,
+		&i.RestartPolicy,
+		&i.Builder,
+		&i.CpuReserve,
+		&i.MemoryReserve,
+		&i.StaticBuildCmd,
+		&i.StaticDir,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OwnerID,
+	)
+	return i, err
+}
+
+const getServicePublishedPort = `-- name: GetServicePublishedPort :one
+SELECT published_port FROM services WHERE id = $1
+`
+
+func (q *Queries) GetServicePublishedPort(ctx context.Context, id uuid.UUID) (int32, error) {
+	row := q.db.QueryRowContext(ctx, getServicePublishedPort, id)
+	var published_port int32
+	err := row.Scan(&published_port)
+	return published_port, err
+}
+
+const insertDeployment = `-- name: InsertDeployment :exec
+INSERT INTO deployments
+    (id, service_id, version, commit_hash, status, image_name, image_tag, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+`
+
+type InsertDeploymentParams struct {
+	ID         uuid.UUID      `json:"id"`
+	ServiceID  uuid.UUID      `json:"service_id"`
+	Version    string         `json:"version"`
+	CommitHash sql.NullString `json:"commit_hash"`
+	Status     sql.NullString `json:"status"`
+	ImageName  sql.NullString `json:"image_name"`
+	ImageTag   sql.NullString `json:"image_tag"`
+	CreatedAt  sql.NullTime   `json:"created_at"`
+	UpdatedAt  sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) InsertDeployment(ctx context.Context, arg InsertDeploymentParams) error {
+	_, err := q.db.ExecContext(ctx, insertDeployment,
+		arg.ID,
+		arg.ServiceID,
+		arg.Version,
+		arg.CommitHash,
+		arg.Status,
+		arg.ImageName,
+		arg.ImageTag,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const listDeploymentsForService = `-- name: ListDeploymentsForService :many
+SELECT id, service_id, commit_hash, status, image_name, image_tag,
+       build_log, runtime_log, error, started_at, completed_at, created_at, updated_at
+FROM deployments
+WHERE service_id = $1
+ORDER BY created_at DESC
+LIMIT $2 OFFSET $3
+`
+
+type ListDeploymentsForServiceParams struct {
+	ServiceID uuid.UUID `json:"service_id"`
+	Limit     int32     `json:"limit"`
+	Offset    int32     `json:"offset"`
+}
+
+type ListDeploymentsForServiceRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	CommitHash  sql.NullString `json:"commit_hash"`
+	Status      sql.NullString `json:"status"`
+	ImageName   sql.NullString `json:"image_name"`
+	ImageTag    sql.NullString `json:"image_tag"`
+	BuildLog    sql.NullString `json:"build_log"`
+	RuntimeLog  sql.NullString `json:"runtime_log"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) ListDeploymentsForService(ctx context.Context, arg ListDeploymentsForServiceParams) ([]ListDeploymentsForServiceRow, error) {
+	rows, err := q.db.QueryContext(ctx, listDeploymentsForService, arg.ServiceID, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListDeploymentsForServiceRow{}
+	for rows.Next() {
+		var i ListDeploymentsForServiceRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ServiceID,
+			&i.CommitHash,
+			&i.Status,
+			&i.ImageName,
+			&i.ImageTag,
+			&i.BuildLog,
+			&i.RuntimeLog,
+			&i.Error,
+			&i.StartedAt,
+			&i.CompletedAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRecentAccessibleDeployments = `-- name: ListRecentAccessibleDeployments :many
+SELECT d.id, d.service_id, s.name AS service_name, p.name AS project_name, d.status,
+       COALESCE(d.image_name, '') AS image_name, d.started_at, d.completed_at, d.created_at
+FROM deployments d
+JOIN services s ON s.id = d.service_id
+JOIN projects p ON p.id = s.project_id
+WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
+   OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)
+ORDER BY d.created_at DESC
+LIMIT $3 OFFSET $4
+`
+
+type ListRecentAccessibleDeploymentsParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+	Limit   int32     `json:"limit"`
+	Offset  int32     `json:"offset"`
+}
+
+type ListRecentAccessibleDeploymentsRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	ServiceName string         `json:"service_name"`
+	ProjectName string         `json:"project_name"`
+	Status      sql.NullString `json:"status"`
+	ImageName   string         `json:"image_name"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+}
+
+func (q *Queries) ListRecentAccessibleDeployments(ctx context.Context, arg ListRecentAccessibleDeploymentsParams) ([]ListRecentAccessibleDeploymentsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRecentAccessibleDeployments,
+		arg.OwnerID,
+		arg.Column2,
+		arg.Limit,
+		arg.Offset,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRecentAccessibleDeploymentsRow{}
+	for rows.Next() {
+		var i ListRecentAccessibleDeploymentsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ServiceID,
+			&i.ServiceName,
+			&i.ProjectName,
+			&i.Status,
+			&i.ImageName,
+			&i.StartedAt,
+			&i.CompletedAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const setDeploymentStatus = `-- name: SetDeploymentStatus :exec
+UPDATE deployments SET status = $1, updated_at = $2 WHERE id = $3
+`
+
+type SetDeploymentStatusParams struct {
+	Status    sql.NullString `json:"status"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+	ID        uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) SetDeploymentStatus(ctx context.Context, arg SetDeploymentStatusParams) error {
+	_, err := q.db.ExecContext(ctx, setDeploymentStatus, arg.Status, arg.UpdatedAt, arg.ID)
+	return err
+}
+
+const setServiceStatus = `-- name: SetServiceStatus :exec
+UPDATE services SET status = $1, updated_at = $2 WHERE id = $3
+`
+
+type SetServiceStatusParams struct {
+	Status    sql.NullString `json:"status"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+	ID        uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) SetServiceStatus(ctx context.Context, arg SetServiceStatusParams) error {
+	_, err := q.db.ExecContext(ctx, setServiceStatus, arg.Status, arg.UpdatedAt, arg.ID)
+	return err
+}
+
+const syncDeploymentProgress = `-- name: SyncDeploymentProgress :exec
+UPDATE deployments
+SET status = $1,
+    image_name = $2,
+    image_tag = $3,
+    build_log = $4,
+    runtime_log = $5,
+    error = $6,
+    started_at = $7,
+    completed_at = $8,
+    updated_at = $9
+WHERE id = $10
+`
+
+type SyncDeploymentProgressParams struct {
+	Status      sql.NullString `json:"status"`
+	ImageName   sql.NullString `json:"image_name"`
+	ImageTag    sql.NullString `json:"image_tag"`
+	BuildLog    sql.NullString `json:"build_log"`
+	RuntimeLog  sql.NullString `json:"runtime_log"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+	ID          uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) SyncDeploymentProgress(ctx context.Context, arg SyncDeploymentProgressParams) error {
+	_, err := q.db.ExecContext(ctx, syncDeploymentProgress,
+		arg.Status,
+		arg.ImageName,
+		arg.ImageTag,
+		arg.BuildLog,
+		arg.RuntimeLog,
+		arg.Error,
+		arg.StartedAt,
+		arg.CompletedAt,
+		arg.UpdatedAt,
+		arg.ID,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/domains.sql.go

@@ -0,0 +1,242 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: domains.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const clearServiceDomainDefault = `-- name: ClearServiceDomainDefault :exec
+UPDATE service_domains SET is_default = false WHERE service_id = $1
+`
+
+func (q *Queries) ClearServiceDomainDefault(ctx context.Context, serviceID uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, clearServiceDomainDefault, serviceID)
+	return err
+}
+
+const countServiceDomains = `-- name: CountServiceDomains :one
+SELECT COUNT(*) FROM service_domains WHERE service_id = $1
+`
+
+func (q *Queries) CountServiceDomains(ctx context.Context, serviceID uuid.UUID) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countServiceDomains, serviceID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createServiceDomain = `-- name: CreateServiceDomain :one
+INSERT INTO service_domains (service_id, domain, is_default)
+VALUES ($1, $2, $3)
+RETURNING id, service_id, domain, is_default, cert_type, cert_status, created_at
+`
+
+type CreateServiceDomainParams struct {
+	ServiceID uuid.UUID `json:"service_id"`
+	Domain    string    `json:"domain"`
+	IsDefault bool      `json:"is_default"`
+}
+
+type CreateServiceDomainRow struct {
+	ID         uuid.UUID `json:"id"`
+	ServiceID  uuid.UUID `json:"service_id"`
+	Domain     string    `json:"domain"`
+	IsDefault  bool      `json:"is_default"`
+	CertType   string    `json:"cert_type"`
+	CertStatus string    `json:"cert_status"`
+	CreatedAt  time.Time `json:"created_at"`
+}
+
+func (q *Queries) CreateServiceDomain(ctx context.Context, arg CreateServiceDomainParams) (CreateServiceDomainRow, error) {
+	row := q.db.QueryRowContext(ctx, createServiceDomain, arg.ServiceID, arg.Domain, arg.IsDefault)
+	var i CreateServiceDomainRow
+	err := row.Scan(
+		&i.ID,
+		&i.ServiceID,
+		&i.Domain,
+		&i.IsDefault,
+		&i.CertType,
+		&i.CertStatus,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const deleteServiceDomain = `-- name: DeleteServiceDomain :execrows
+DELETE FROM service_domains WHERE id = $1 AND service_id = $2
+`
+
+type DeleteServiceDomainParams struct {
+	ID        uuid.UUID `json:"id"`
+	ServiceID uuid.UUID `json:"service_id"`
+}
+
+func (q *Queries) DeleteServiceDomain(ctx context.Context, arg DeleteServiceDomainParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, deleteServiceDomain, arg.ID, arg.ServiceID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const getServiceAccess = `-- name: GetServiceAccess :one
+SELECT maintenance_mode, basic_auth_users FROM services WHERE id = $1
+`
+
+type GetServiceAccessRow struct {
+	MaintenanceMode bool   `json:"maintenance_mode"`
+	BasicAuthUsers  string `json:"basic_auth_users"`
+}
+
+func (q *Queries) GetServiceAccess(ctx context.Context, id uuid.UUID) (GetServiceAccessRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceAccess, id)
+	var i GetServiceAccessRow
+	err := row.Scan(&i.MaintenanceMode, &i.BasicAuthUsers)
+	return i, err
+}
+
+const getServiceDomainDefault = `-- name: GetServiceDomainDefault :one
+SELECT domain FROM service_domains WHERE service_id = $1 AND is_default
+`
+
+func (q *Queries) GetServiceDomainDefault(ctx context.Context, serviceID uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceDomainDefault, serviceID)
+	var domain string
+	err := row.Scan(&domain)
+	return domain, err
+}
+
+const getServiceDomainFirst = `-- name: GetServiceDomainFirst :one
+SELECT domain FROM service_domains WHERE service_id = $1 ORDER BY created_at ASC LIMIT 1
+`
+
+func (q *Queries) GetServiceDomainFirst(ctx context.Context, serviceID uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceDomainFirst, serviceID)
+	var domain string
+	err := row.Scan(&domain)
+	return domain, err
+}
+
+const getServicePlacementBrief = `-- name: GetServicePlacementBrief :one
+SELECT name, node_id, COALESCE(spread, false) AS spread FROM services WHERE id = $1
+`
+
+type GetServicePlacementBriefRow struct {
+	Name   string         `json:"name"`
+	NodeID sql.NullString `json:"node_id"`
+	Spread bool           `json:"spread"`
+}
+
+func (q *Queries) GetServicePlacementBrief(ctx context.Context, id uuid.UUID) (GetServicePlacementBriefRow, error) {
+	row := q.db.QueryRowContext(ctx, getServicePlacementBrief, id)
+	var i GetServicePlacementBriefRow
+	err := row.Scan(&i.Name, &i.NodeID, &i.Spread)
+	return i, err
+}
+
+const listServiceDomains = `-- name: ListServiceDomains :many
+SELECT id, service_id, domain, is_default, cert_type, cert_status, last_checked_at, created_at
+FROM service_domains
+WHERE service_id = $1
+ORDER BY is_default DESC, created_at ASC
+`
+
+func (q *Queries) ListServiceDomains(ctx context.Context, serviceID uuid.UUID) ([]ServiceDomain, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceDomains, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ServiceDomain{}
+	for rows.Next() {
+		var i ServiceDomain
+		if err := rows.Scan(
+			&i.ID,
+			&i.ServiceID,
+			&i.Domain,
+			&i.IsDefault,
+			&i.CertType,
+			&i.CertStatus,
+			&i.LastCheckedAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const serviceWriteAccess = `-- name: ServiceWriteAccess :one
+SELECT EXISTS(
+    SELECT 1 FROM services s JOIN projects p ON s.project_id = p.id
+    WHERE s.id = $1 AND (p.owner_id = $2 OR $3::bool)
+) AS allowed
+`
+
+type ServiceWriteAccessParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+func (q *Queries) ServiceWriteAccess(ctx context.Context, arg ServiceWriteAccessParams) (bool, error) {
+	row := q.db.QueryRowContext(ctx, serviceWriteAccess, arg.ID, arg.OwnerID, arg.Column3)
+	var allowed bool
+	err := row.Scan(&allowed)
+	return allowed, err
+}
+
+const setServiceDomainDefault = `-- name: SetServiceDomainDefault :execrows
+UPDATE service_domains SET is_default = (id = $1) WHERE service_id = $2
+`
+
+type SetServiceDomainDefaultParams struct {
+	ID        uuid.UUID `json:"id"`
+	ServiceID uuid.UUID `json:"service_id"`
+}
+
+func (q *Queries) SetServiceDomainDefault(ctx context.Context, arg SetServiceDomainDefaultParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, setServiceDomainDefault, arg.ID, arg.ServiceID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const setServiceLegacyDomain = `-- name: SetServiceLegacyDomain :exec
+UPDATE services SET domain = $1 WHERE id = $2
+`
+
+type SetServiceLegacyDomainParams struct {
+	Domain string    `json:"domain"`
+	ID     uuid.UUID `json:"id"`
+}
+
+func (q *Queries) SetServiceLegacyDomain(ctx context.Context, arg SetServiceLegacyDomainParams) error {
+	_, err := q.db.ExecContext(ctx, setServiceLegacyDomain, arg.Domain, arg.ID)
+	return err
+}
+
+const touchServiceDomainChecked = `-- name: TouchServiceDomainChecked :exec
+UPDATE service_domains SET last_checked_at = NOW() WHERE id = $1
+`
+
+func (q *Queries) TouchServiceDomainChecked(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, touchServiceDomainChecked, id)
+	return err
+}

app/backend/internal/database/sqlcdb/git.sql.go

@@ -0,0 +1,776 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: git.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const countGitRepositories = `-- name: CountGitRepositories :one
+SELECT COUNT(*)
+FROM git_repositories
+WHERE provider_id = $1 AND user_id = $2
+  AND ($3::text IS NULL OR full_name ILIKE ('%' || $3::text || '%') OR name ILIKE ('%' || $3::text || '%'))
+`
+
+type CountGitRepositoriesParams struct {
+	ProviderID uuid.UUID `json:"provider_id"`
+	UserID     uuid.UUID `json:"user_id"`
+	Column3    string    `json:"column_3"`
+}
+
+func (q *Queries) CountGitRepositories(ctx context.Context, arg CountGitRepositoriesParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countGitRepositories, arg.ProviderID, arg.UserID, arg.Column3)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const countUserRepositories = `-- name: CountUserRepositories :one
+SELECT COUNT(*) FROM git_repositories WHERE user_id = $1
+`
+
+func (q *Queries) CountUserRepositories(ctx context.Context, userID uuid.UUID) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countUserRepositories, userID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const deleteGitProvider = `-- name: DeleteGitProvider :execrows
+DELETE FROM git_providers WHERE id = $1 AND user_id = $2
+`
+
+type DeleteGitProviderParams struct {
+	ID     uuid.UUID `json:"id"`
+	UserID uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) DeleteGitProvider(ctx context.Context, arg DeleteGitProviderParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, deleteGitProvider, arg.ID, arg.UserID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const getGitProviderForFetch = `-- name: GetGitProviderForFetch :one
+SELECT name, api_url, access_token
+FROM git_providers
+WHERE id = $1 AND user_id = $2
+`
+
+type GetGitProviderForFetchParams struct {
+	ID     uuid.UUID `json:"id"`
+	UserID uuid.UUID `json:"user_id"`
+}
+
+type GetGitProviderForFetchRow struct {
+	Name        string `json:"name"`
+	ApiUrl      string `json:"api_url"`
+	AccessToken string `json:"access_token"`
+}
+
+func (q *Queries) GetGitProviderForFetch(ctx context.Context, arg GetGitProviderForFetchParams) (GetGitProviderForFetchRow, error) {
+	row := q.db.QueryRowContext(ctx, getGitProviderForFetch, arg.ID, arg.UserID)
+	var i GetGitProviderForFetchRow
+	err := row.Scan(&i.Name, &i.ApiUrl, &i.AccessToken)
+	return i, err
+}
+
+const getGitProviderForRepos = `-- name: GetGitProviderForRepos :one
+SELECT name, display_name, access_token, api_url
+FROM git_providers
+WHERE id = $1 AND user_id = $2
+`
+
+type GetGitProviderForReposParams struct {
+	ID     uuid.UUID `json:"id"`
+	UserID uuid.UUID `json:"user_id"`
+}
+
+type GetGitProviderForReposRow struct {
+	Name        string `json:"name"`
+	DisplayName string `json:"display_name"`
+	AccessToken string `json:"access_token"`
+	ApiUrl      string `json:"api_url"`
+}
+
+func (q *Queries) GetGitProviderForRepos(ctx context.Context, arg GetGitProviderForReposParams) (GetGitProviderForReposRow, error) {
+	row := q.db.QueryRowContext(ctx, getGitProviderForRepos, arg.ID, arg.UserID)
+	var i GetGitProviderForReposRow
+	err := row.Scan(
+		&i.Name,
+		&i.DisplayName,
+		&i.AccessToken,
+		&i.ApiUrl,
+	)
+	return i, err
+}
+
+const getGitProviderName = `-- name: GetGitProviderName :one
+SELECT name FROM git_providers WHERE id = $1 AND user_id = $2
+`
+
+type GetGitProviderNameParams struct {
+	ID     uuid.UUID `json:"id"`
+	UserID uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) GetGitProviderName(ctx context.Context, arg GetGitProviderNameParams) (string, error) {
+	row := q.db.QueryRowContext(ctx, getGitProviderName, arg.ID, arg.UserID)
+	var name string
+	err := row.Scan(&name)
+	return name, err
+}
+
+const getGitProviderNameByID = `-- name: GetGitProviderNameByID :one
+SELECT name FROM git_providers WHERE id = $1
+`
+
+func (q *Queries) GetGitProviderNameByID(ctx context.Context, id uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getGitProviderNameByID, id)
+	var name string
+	err := row.Scan(&name)
+	return name, err
+}
+
+const getGitProviderTimestamps = `-- name: GetGitProviderTimestamps :one
+SELECT created_at, updated_at FROM git_providers WHERE id = $1
+`
+
+type GetGitProviderTimestampsRow struct {
+	CreatedAt sql.NullTime `json:"created_at"`
+	UpdatedAt sql.NullTime `json:"updated_at"`
+}
+
+func (q *Queries) GetGitProviderTimestamps(ctx context.Context, id uuid.UUID) (GetGitProviderTimestampsRow, error) {
+	row := q.db.QueryRowContext(ctx, getGitProviderTimestamps, id)
+	var i GetGitProviderTimestampsRow
+	err := row.Scan(&i.CreatedAt, &i.UpdatedAt)
+	return i, err
+}
+
+const getGitRepoCloneByFullName = `-- name: GetGitRepoCloneByFullName :one
+SELECT clone_url, provider_id FROM git_repositories
+WHERE full_name = $1 AND user_id = $2 LIMIT 1
+`
+
+type GetGitRepoCloneByFullNameParams struct {
+	FullName string    `json:"full_name"`
+	UserID   uuid.UUID `json:"user_id"`
+}
+
+type GetGitRepoCloneByFullNameRow struct {
+	CloneUrl   string    `json:"clone_url"`
+	ProviderID uuid.UUID `json:"provider_id"`
+}
+
+func (q *Queries) GetGitRepoCloneByFullName(ctx context.Context, arg GetGitRepoCloneByFullNameParams) (GetGitRepoCloneByFullNameRow, error) {
+	row := q.db.QueryRowContext(ctx, getGitRepoCloneByFullName, arg.FullName, arg.UserID)
+	var i GetGitRepoCloneByFullNameRow
+	err := row.Scan(&i.CloneUrl, &i.ProviderID)
+	return i, err
+}
+
+const getGitRepoForPush = `-- name: GetGitRepoForPush :one
+SELECT clone_url, full_name, user_id FROM git_repositories WHERE id = $1
+`
+
+type GetGitRepoForPushRow struct {
+	CloneUrl string    `json:"clone_url"`
+	FullName string    `json:"full_name"`
+	UserID   uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) GetGitRepoForPush(ctx context.Context, id uuid.UUID) (GetGitRepoForPushRow, error) {
+	row := q.db.QueryRowContext(ctx, getGitRepoForPush, id)
+	var i GetGitRepoForPushRow
+	err := row.Scan(&i.CloneUrl, &i.FullName, &i.UserID)
+	return i, err
+}
+
+const getGitRepoProviderByCloneURL = `-- name: GetGitRepoProviderByCloneURL :one
+SELECT provider_id FROM git_repositories
+WHERE clone_url = $1 AND user_id = $2 LIMIT 1
+`
+
+type GetGitRepoProviderByCloneURLParams struct {
+	CloneUrl string    `json:"clone_url"`
+	UserID   uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) GetGitRepoProviderByCloneURL(ctx context.Context, arg GetGitRepoProviderByCloneURLParams) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getGitRepoProviderByCloneURL, arg.CloneUrl, arg.UserID)
+	var provider_id uuid.UUID
+	err := row.Scan(&provider_id)
+	return provider_id, err
+}
+
+const getGitRepositoryByFullName = `-- name: GetGitRepositoryByFullName :one
+SELECT id, provider_id, name, full_name, COALESCE(description, '') AS description,
+       clone_url, COALESCE(webhook_url, '') AS webhook_url,
+       default_branch, is_private, user_id, created_at, updated_at
+FROM git_repositories
+WHERE provider_id = $1 AND full_name = $2 AND user_id = $3
+`
+
+type GetGitRepositoryByFullNameParams struct {
+	ProviderID uuid.UUID `json:"provider_id"`
+	FullName   string    `json:"full_name"`
+	UserID     uuid.UUID `json:"user_id"`
+}
+
+type GetGitRepositoryByFullNameRow struct {
+	ID            uuid.UUID      `json:"id"`
+	ProviderID    uuid.UUID      `json:"provider_id"`
+	Name          string         `json:"name"`
+	FullName      string         `json:"full_name"`
+	Description   string         `json:"description"`
+	CloneUrl      string         `json:"clone_url"`
+	WebhookUrl    string         `json:"webhook_url"`
+	DefaultBranch sql.NullString `json:"default_branch"`
+	IsPrivate     sql.NullBool   `json:"is_private"`
+	UserID        uuid.UUID      `json:"user_id"`
+	CreatedAt     sql.NullTime   `json:"created_at"`
+	UpdatedAt     sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) GetGitRepositoryByFullName(ctx context.Context, arg GetGitRepositoryByFullNameParams) (GetGitRepositoryByFullNameRow, error) {
+	row := q.db.QueryRowContext(ctx, getGitRepositoryByFullName, arg.ProviderID, arg.FullName, arg.UserID)
+	var i GetGitRepositoryByFullNameRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProviderID,
+		&i.Name,
+		&i.FullName,
+		&i.Description,
+		&i.CloneUrl,
+		&i.WebhookUrl,
+		&i.DefaultBranch,
+		&i.IsPrivate,
+		&i.UserID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getGitRepositoryProviderID = `-- name: GetGitRepositoryProviderID :one
+SELECT provider_id FROM git_repositories WHERE id = $1 AND user_id = $2
+`
+
+type GetGitRepositoryProviderIDParams struct {
+	ID     uuid.UUID `json:"id"`
+	UserID uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) GetGitRepositoryProviderID(ctx context.Context, arg GetGitRepositoryProviderIDParams) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getGitRepositoryProviderID, arg.ID, arg.UserID)
+	var provider_id uuid.UUID
+	err := row.Scan(&provider_id)
+	return provider_id, err
+}
+
+const getGitWebhookForPush = `-- name: GetGitWebhookForPush :one
+SELECT webhook_secret, repo_id, provider_id, COALESCE(branch_filter, '') AS branch_filter, active
+FROM git_webhooks WHERE id = $1
+`
+
+type GetGitWebhookForPushRow struct {
+	WebhookSecret string       `json:"webhook_secret"`
+	RepoID        uuid.UUID    `json:"repo_id"`
+	ProviderID    uuid.UUID    `json:"provider_id"`
+	BranchFilter  string       `json:"branch_filter"`
+	Active        sql.NullBool `json:"active"`
+}
+
+func (q *Queries) GetGitWebhookForPush(ctx context.Context, id uuid.UUID) (GetGitWebhookForPushRow, error) {
+	row := q.db.QueryRowContext(ctx, getGitWebhookForPush, id)
+	var i GetGitWebhookForPushRow
+	err := row.Scan(
+		&i.WebhookSecret,
+		&i.RepoID,
+		&i.ProviderID,
+		&i.BranchFilter,
+		&i.Active,
+	)
+	return i, err
+}
+
+const insertGitProvider = `-- name: InsertGitProvider :exec
+INSERT INTO git_providers (id, name, display_name, api_url, webhook_url, access_token, user_id, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, NOW(), NOW())
+`
+
+type InsertGitProviderParams struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	DisplayName string    `json:"display_name"`
+	ApiUrl      string    `json:"api_url"`
+	WebhookUrl  string    `json:"webhook_url"`
+	AccessToken string    `json:"access_token"`
+	UserID      uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) InsertGitProvider(ctx context.Context, arg InsertGitProviderParams) error {
+	_, err := q.db.ExecContext(ctx, insertGitProvider,
+		arg.ID,
+		arg.Name,
+		arg.DisplayName,
+		arg.ApiUrl,
+		arg.WebhookUrl,
+		arg.AccessToken,
+		arg.UserID,
+	)
+	return err
+}
+
+const insertGitRepository = `-- name: InsertGitRepository :one
+INSERT INTO git_repositories (id, provider_id, name, full_name, description, clone_url, default_branch, is_private, user_id, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, NOW(), NOW())
+RETURNING created_at, updated_at
+`
+
+type InsertGitRepositoryParams struct {
+	ID            uuid.UUID      `json:"id"`
+	ProviderID    uuid.UUID      `json:"provider_id"`
+	Name          string         `json:"name"`
+	FullName      string         `json:"full_name"`
+	Description   sql.NullString `json:"description"`
+	CloneUrl      string         `json:"clone_url"`
+	DefaultBranch sql.NullString `json:"default_branch"`
+	IsPrivate     sql.NullBool   `json:"is_private"`
+	UserID        uuid.UUID      `json:"user_id"`
+}
+
+type InsertGitRepositoryRow struct {
+	CreatedAt sql.NullTime `json:"created_at"`
+	UpdatedAt sql.NullTime `json:"updated_at"`
+}
+
+func (q *Queries) InsertGitRepository(ctx context.Context, arg InsertGitRepositoryParams) (InsertGitRepositoryRow, error) {
+	row := q.db.QueryRowContext(ctx, insertGitRepository,
+		arg.ID,
+		arg.ProviderID,
+		arg.Name,
+		arg.FullName,
+		arg.Description,
+		arg.CloneUrl,
+		arg.DefaultBranch,
+		arg.IsPrivate,
+		arg.UserID,
+	)
+	var i InsertGitRepositoryRow
+	err := row.Scan(&i.CreatedAt, &i.UpdatedAt)
+	return i, err
+}
+
+const listConnectedRepositories = `-- name: ListConnectedRepositories :many
+SELECT r.id, r.provider_id, r.name, r.full_name, COALESCE(r.description, '') AS description, r.clone_url,
+       r.default_branch, r.is_private, r.user_id, r.created_at, r.updated_at,
+       p.name AS provider_name, p.display_name
+FROM git_repositories r
+JOIN git_providers p ON r.provider_id = p.id
+WHERE r.user_id = $1
+ORDER BY r.updated_at DESC
+LIMIT $2 OFFSET $3
+`
+
+type ListConnectedRepositoriesParams struct {
+	UserID uuid.UUID `json:"user_id"`
+	Limit  int32     `json:"limit"`
+	Offset int32     `json:"offset"`
+}
+
+type ListConnectedRepositoriesRow struct {
+	ID            uuid.UUID      `json:"id"`
+	ProviderID    uuid.UUID      `json:"provider_id"`
+	Name          string         `json:"name"`
+	FullName      string         `json:"full_name"`
+	Description   string         `json:"description"`
+	CloneUrl      string         `json:"clone_url"`
+	DefaultBranch sql.NullString `json:"default_branch"`
+	IsPrivate     sql.NullBool   `json:"is_private"`
+	UserID        uuid.UUID      `json:"user_id"`
+	CreatedAt     sql.NullTime   `json:"created_at"`
+	UpdatedAt     sql.NullTime   `json:"updated_at"`
+	ProviderName  string         `json:"provider_name"`
+	DisplayName   string         `json:"display_name"`
+}
+
+func (q *Queries) ListConnectedRepositories(ctx context.Context, arg ListConnectedRepositoriesParams) ([]ListConnectedRepositoriesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listConnectedRepositories, arg.UserID, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListConnectedRepositoriesRow{}
+	for rows.Next() {
+		var i ListConnectedRepositoriesRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProviderID,
+			&i.Name,
+			&i.FullName,
+			&i.Description,
+			&i.CloneUrl,
+			&i.DefaultBranch,
+			&i.IsPrivate,
+			&i.UserID,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.ProviderName,
+			&i.DisplayName,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listGitProviders = `-- name: ListGitProviders :many
+SELECT id, name, display_name, api_url, webhook_url, user_id, created_at, updated_at
+FROM git_providers
+WHERE user_id = $1
+ORDER BY created_at DESC
+`
+
+type ListGitProvidersRow struct {
+	ID          uuid.UUID    `json:"id"`
+	Name        string       `json:"name"`
+	DisplayName string       `json:"display_name"`
+	ApiUrl      string       `json:"api_url"`
+	WebhookUrl  string       `json:"webhook_url"`
+	UserID      uuid.UUID    `json:"user_id"`
+	CreatedAt   sql.NullTime `json:"created_at"`
+	UpdatedAt   sql.NullTime `json:"updated_at"`
+}
+
+func (q *Queries) ListGitProviders(ctx context.Context, userID uuid.UUID) ([]ListGitProvidersRow, error) {
+	rows, err := q.db.QueryContext(ctx, listGitProviders, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListGitProvidersRow{}
+	for rows.Next() {
+		var i ListGitProvidersRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.DisplayName,
+			&i.ApiUrl,
+			&i.WebhookUrl,
+			&i.UserID,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listGitRepositories = `-- name: ListGitRepositories :many
+SELECT id, provider_id, name, full_name, COALESCE(description, '') AS description,
+       clone_url, COALESCE(webhook_url, '') AS webhook_url,
+       default_branch, is_private, user_id, created_at, updated_at
+FROM git_repositories
+WHERE provider_id = $1 AND user_id = $2
+  AND ($3::text IS NULL OR full_name ILIKE ('%' || $3::text || '%') OR name ILIKE ('%' || $3::text || '%'))
+ORDER BY updated_at DESC
+LIMIT $4 OFFSET $5
+`
+
+type ListGitRepositoriesParams struct {
+	ProviderID uuid.UUID `json:"provider_id"`
+	UserID     uuid.UUID `json:"user_id"`
+	Column3    string    `json:"column_3"`
+	Limit      int32     `json:"limit"`
+	Offset     int32     `json:"offset"`
+}
+
+type ListGitRepositoriesRow struct {
+	ID            uuid.UUID      `json:"id"`
+	ProviderID    uuid.UUID      `json:"provider_id"`
+	Name          string         `json:"name"`
+	FullName      string         `json:"full_name"`
+	Description   string         `json:"description"`
+	CloneUrl      string         `json:"clone_url"`
+	WebhookUrl    string         `json:"webhook_url"`
+	DefaultBranch sql.NullString `json:"default_branch"`
+	IsPrivate     sql.NullBool   `json:"is_private"`
+	UserID        uuid.UUID      `json:"user_id"`
+	CreatedAt     sql.NullTime   `json:"created_at"`
+	UpdatedAt     sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) ListGitRepositories(ctx context.Context, arg ListGitRepositoriesParams) ([]ListGitRepositoriesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listGitRepositories,
+		arg.ProviderID,
+		arg.UserID,
+		arg.Column3,
+		arg.Limit,
+		arg.Offset,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListGitRepositoriesRow{}
+	for rows.Next() {
+		var i ListGitRepositoriesRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProviderID,
+			&i.Name,
+			&i.FullName,
+			&i.Description,
+			&i.CloneUrl,
+			&i.WebhookUrl,
+			&i.DefaultBranch,
+			&i.IsPrivate,
+			&i.UserID,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServicesForPush = `-- name: ListServicesForPush :many
+SELECT s.id, s.project_id, s.name,
+       COALESCE(s.type, s.service_type, '') AS type, COALESCE(s.status, '') AS status,
+       COALESCE(s.image, s.image_name, '') AS image, COALESCE(s.command, s.start_command, '') AS command,
+       COALESCE(s.environment, '') AS environment, COALESCE(s.git_repo, s.source_url, '') AS git_repo,
+       COALESCE(s.git_branch, '') AS git_branch, COALESCE(s.build_path, '') AS build_path,
+       COALESCE(s.cpu, '') AS cpu, COALESCE(s.memory, '') AS memory,
+       s.created_at, s.updated_at
+FROM services s
+WHERE (s.git_branch = $1 OR $1 = '') AND (s.git_repo = $2 OR s.git_repo = $3)
+`
+
+type ListServicesForPushParams struct {
+	GitBranch sql.NullString `json:"git_branch"`
+	GitRepo   sql.NullString `json:"git_repo"`
+	GitRepo_2 sql.NullString `json:"git_repo_2"`
+}
+
+type ListServicesForPushRow struct {
+	ID          uuid.UUID    `json:"id"`
+	ProjectID   uuid.UUID    `json:"project_id"`
+	Name        string       `json:"name"`
+	Type        string       `json:"type"`
+	Status      string       `json:"status"`
+	Image       string       `json:"image"`
+	Command     string       `json:"command"`
+	Environment string       `json:"environment"`
+	GitRepo     string       `json:"git_repo"`
+	GitBranch   string       `json:"git_branch"`
+	BuildPath   string       `json:"build_path"`
+	Cpu         string       `json:"cpu"`
+	Memory      string       `json:"memory"`
+	CreatedAt   sql.NullTime `json:"created_at"`
+	UpdatedAt   sql.NullTime `json:"updated_at"`
+}
+
+func (q *Queries) ListServicesForPush(ctx context.Context, arg ListServicesForPushParams) ([]ListServicesForPushRow, error) {
+	rows, err := q.db.QueryContext(ctx, listServicesForPush, arg.GitBranch, arg.GitRepo, arg.GitRepo_2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListServicesForPushRow{}
+	for rows.Next() {
+		var i ListServicesForPushRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.Name,
+			&i.Type,
+			&i.Status,
+			&i.Image,
+			&i.Command,
+			&i.Environment,
+			&i.GitRepo,
+			&i.GitBranch,
+			&i.BuildPath,
+			&i.Cpu,
+			&i.Memory,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const upsertGitHubAppProvider = `-- name: UpsertGitHubAppProvider :one
+INSERT INTO git_providers (id, name, display_name, api_url, webhook_url, access_token, user_id, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, NOW(), NOW())
+ON CONFLICT (name, user_id)
+DO UPDATE SET
+    display_name = EXCLUDED.display_name,
+    api_url = EXCLUDED.api_url,
+    webhook_url = EXCLUDED.webhook_url,
+    access_token = EXCLUDED.access_token,
+    updated_at = NOW()
+RETURNING id, created_at, updated_at
+`
+
+type UpsertGitHubAppProviderParams struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	DisplayName string    `json:"display_name"`
+	ApiUrl      string    `json:"api_url"`
+	WebhookUrl  string    `json:"webhook_url"`
+	AccessToken string    `json:"access_token"`
+	UserID      uuid.UUID `json:"user_id"`
+}
+
+type UpsertGitHubAppProviderRow struct {
+	ID        uuid.UUID    `json:"id"`
+	CreatedAt sql.NullTime `json:"created_at"`
+	UpdatedAt sql.NullTime `json:"updated_at"`
+}
+
+func (q *Queries) UpsertGitHubAppProvider(ctx context.Context, arg UpsertGitHubAppProviderParams) (UpsertGitHubAppProviderRow, error) {
+	row := q.db.QueryRowContext(ctx, upsertGitHubAppProvider,
+		arg.ID,
+		arg.Name,
+		arg.DisplayName,
+		arg.ApiUrl,
+		arg.WebhookUrl,
+		arg.AccessToken,
+		arg.UserID,
+	)
+	var i UpsertGitHubAppProviderRow
+	err := row.Scan(&i.ID, &i.CreatedAt, &i.UpdatedAt)
+	return i, err
+}
+
+const upsertGitRepository = `-- name: UpsertGitRepository :exec
+INSERT INTO git_repositories (id, provider_id, name, full_name, description, clone_url, default_branch, is_private, user_id, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, NOW(), NOW())
+ON CONFLICT (provider_id, full_name)
+DO UPDATE SET
+    name = EXCLUDED.name,
+    description = EXCLUDED.description,
+    clone_url = EXCLUDED.clone_url,
+    default_branch = EXCLUDED.default_branch,
+    is_private = EXCLUDED.is_private,
+    updated_at = NOW()
+`
+
+type UpsertGitRepositoryParams struct {
+	ID            uuid.UUID      `json:"id"`
+	ProviderID    uuid.UUID      `json:"provider_id"`
+	Name          string         `json:"name"`
+	FullName      string         `json:"full_name"`
+	Description   sql.NullString `json:"description"`
+	CloneUrl      string         `json:"clone_url"`
+	DefaultBranch sql.NullString `json:"default_branch"`
+	IsPrivate     sql.NullBool   `json:"is_private"`
+	UserID        uuid.UUID      `json:"user_id"`
+}
+
+func (q *Queries) UpsertGitRepository(ctx context.Context, arg UpsertGitRepositoryParams) error {
+	_, err := q.db.ExecContext(ctx, upsertGitRepository,
+		arg.ID,
+		arg.ProviderID,
+		arg.Name,
+		arg.FullName,
+		arg.Description,
+		arg.CloneUrl,
+		arg.DefaultBranch,
+		arg.IsPrivate,
+		arg.UserID,
+	)
+	return err
+}
+
+const upsertGitWebhook = `-- name: UpsertGitWebhook :one
+INSERT INTO git_webhooks (id, repo_id, provider_id, events, webhook_secret, active, branch_filter, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, TRUE, $6, NOW(), NOW())
+ON CONFLICT (repo_id, provider_id)
+DO UPDATE SET
+    events = EXCLUDED.events,
+    webhook_secret = EXCLUDED.webhook_secret,
+    active = TRUE,
+    branch_filter = EXCLUDED.branch_filter,
+    updated_at = NOW()
+RETURNING id, active, created_at, updated_at
+`
+
+type UpsertGitWebhookParams struct {
+	ID            uuid.UUID      `json:"id"`
+	RepoID        uuid.UUID      `json:"repo_id"`
+	ProviderID    uuid.UUID      `json:"provider_id"`
+	Events        string         `json:"events"`
+	WebhookSecret string         `json:"webhook_secret"`
+	BranchFilter  sql.NullString `json:"branch_filter"`
+}
+
+type UpsertGitWebhookRow struct {
+	ID        uuid.UUID    `json:"id"`
+	Active    sql.NullBool `json:"active"`
+	CreatedAt sql.NullTime `json:"created_at"`
+	UpdatedAt sql.NullTime `json:"updated_at"`
+}
+
+func (q *Queries) UpsertGitWebhook(ctx context.Context, arg UpsertGitWebhookParams) (UpsertGitWebhookRow, error) {
+	row := q.db.QueryRowContext(ctx, upsertGitWebhook,
+		arg.ID,
+		arg.RepoID,
+		arg.ProviderID,
+		arg.Events,
+		arg.WebhookSecret,
+		arg.BranchFilter,
+	)
+	var i UpsertGitWebhookRow
+	err := row.Scan(
+		&i.ID,
+		&i.Active,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}

app/backend/internal/database/sqlcdb/metrics.sql.go

@@ -0,0 +1,623 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: metrics.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+)
+
+const aggregateNodeMetrics = `-- name: AggregateNodeMetrics :many
+SELECT date_bin($1::interval, timestamp, '2000-01-01'::timestamptz) AS bucket,
+       AVG(cpu_usage)::float8 AS avg_cpu,
+       AVG(memory_usage_percent)::float8 AS avg_memory,
+       AVG(storage_usage_percent)::float8 AS avg_storage
+FROM node_metrics
+WHERE node_id = $2 AND timestamp BETWEEN $3 AND $4
+GROUP BY bucket
+ORDER BY bucket ASC
+`
+
+type AggregateNodeMetricsParams struct {
+	Column1     int64     `json:"column_1"`
+	NodeID      string    `json:"node_id"`
+	Timestamp   time.Time `json:"timestamp"`
+	Timestamp_2 time.Time `json:"timestamp_2"`
+}
+
+type AggregateNodeMetricsRow struct {
+	Bucket     interface{} `json:"bucket"`
+	AvgCpu     float64     `json:"avg_cpu"`
+	AvgMemory  float64     `json:"avg_memory"`
+	AvgStorage float64     `json:"avg_storage"`
+}
+
+// Portable bucket bucketing (no TimescaleDB): floor epoch seconds into
+// bucket-sized buckets, then back to timestamptz.
+func (q *Queries) AggregateNodeMetrics(ctx context.Context, arg AggregateNodeMetricsParams) ([]AggregateNodeMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, aggregateNodeMetrics,
+		arg.Column1,
+		arg.NodeID,
+		arg.Timestamp,
+		arg.Timestamp_2,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []AggregateNodeMetricsRow{}
+	for rows.Next() {
+		var i AggregateNodeMetricsRow
+		if err := rows.Scan(
+			&i.Bucket,
+			&i.AvgCpu,
+			&i.AvgMemory,
+			&i.AvgStorage,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listInstanceMetrics = `-- name: ListInstanceMetrics :many
+SELECT instance_id, node_id, status, cpu, memory,
+       network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+       network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+       start_time, last_seen, health_status, health_last_check, health_check_count, health_failure_count
+FROM instance_metrics
+WHERE service_id = $1 AND timestamp = $2
+`
+
+type ListInstanceMetricsParams struct {
+	ServiceID string    `json:"service_id"`
+	Timestamp time.Time `json:"timestamp"`
+}
+
+type ListInstanceMetricsRow struct {
+	InstanceID            string         `json:"instance_id"`
+	NodeID                sql.NullString `json:"node_id"`
+	Status                sql.NullString `json:"status"`
+	Cpu                   sql.NullString `json:"cpu"`
+	Memory                sql.NullInt64  `json:"memory"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	StartTime             sql.NullTime   `json:"start_time"`
+	LastSeen              sql.NullTime   `json:"last_seen"`
+	HealthStatus          sql.NullString `json:"health_status"`
+	HealthLastCheck       sql.NullTime   `json:"health_last_check"`
+	HealthCheckCount      sql.NullInt32  `json:"health_check_count"`
+	HealthFailureCount    sql.NullInt32  `json:"health_failure_count"`
+}
+
+func (q *Queries) ListInstanceMetrics(ctx context.Context, arg ListInstanceMetricsParams) ([]ListInstanceMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listInstanceMetrics, arg.ServiceID, arg.Timestamp)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListInstanceMetricsRow{}
+	for rows.Next() {
+		var i ListInstanceMetricsRow
+		if err := rows.Scan(
+			&i.InstanceID,
+			&i.NodeID,
+			&i.Status,
+			&i.Cpu,
+			&i.Memory,
+			&i.NetworkBytesIn,
+			&i.NetworkBytesOut,
+			&i.NetworkPacketsIn,
+			&i.NetworkPacketsOut,
+			&i.NetworkConnectionsIn,
+			&i.NetworkConnectionsOut,
+			&i.NetworkErrorsIn,
+			&i.NetworkErrorsOut,
+			&i.StartTime,
+			&i.LastSeen,
+			&i.HealthStatus,
+			&i.HealthLastCheck,
+			&i.HealthCheckCount,
+			&i.HealthFailureCount,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listNodeMetrics = `-- name: ListNodeMetrics :many
+SELECT node_id, timestamp, cpu_usage, cpu_cores, load_avg_1, load_avg_5, load_avg_15,
+       memory_total, memory_used, memory_available, memory_usage_percent,
+       storage_total, storage_used, storage_available, storage_usage_percent,
+       network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+       network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+       coalesce(extract(epoch from uptime), 0)::bigint AS uptime_seconds,
+       processes, os, kernel, architecture
+FROM node_metrics
+WHERE node_id = $1 AND timestamp BETWEEN $2 AND $3
+ORDER BY timestamp ASC
+`
+
+type ListNodeMetricsParams struct {
+	NodeID      string    `json:"node_id"`
+	Timestamp   time.Time `json:"timestamp"`
+	Timestamp_2 time.Time `json:"timestamp_2"`
+}
+
+type ListNodeMetricsRow struct {
+	NodeID                string         `json:"node_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	CpuUsage              sql.NullString `json:"cpu_usage"`
+	CpuCores              sql.NullString `json:"cpu_cores"`
+	LoadAvg1              sql.NullString `json:"load_avg_1"`
+	LoadAvg5              sql.NullString `json:"load_avg_5"`
+	LoadAvg15             sql.NullString `json:"load_avg_15"`
+	MemoryTotal           sql.NullInt64  `json:"memory_total"`
+	MemoryUsed            sql.NullInt64  `json:"memory_used"`
+	MemoryAvailable       sql.NullInt64  `json:"memory_available"`
+	MemoryUsagePercent    sql.NullString `json:"memory_usage_percent"`
+	StorageTotal          sql.NullInt64  `json:"storage_total"`
+	StorageUsed           sql.NullInt64  `json:"storage_used"`
+	StorageAvailable      sql.NullInt64  `json:"storage_available"`
+	StorageUsagePercent   sql.NullString `json:"storage_usage_percent"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	UptimeSeconds         int64          `json:"uptime_seconds"`
+	Processes             sql.NullInt32  `json:"processes"`
+	Os                    sql.NullString `json:"os"`
+	Kernel                sql.NullString `json:"kernel"`
+	Architecture          sql.NullString `json:"architecture"`
+}
+
+func (q *Queries) ListNodeMetrics(ctx context.Context, arg ListNodeMetricsParams) ([]ListNodeMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listNodeMetrics, arg.NodeID, arg.Timestamp, arg.Timestamp_2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListNodeMetricsRow{}
+	for rows.Next() {
+		var i ListNodeMetricsRow
+		if err := rows.Scan(
+			&i.NodeID,
+			&i.Timestamp,
+			&i.CpuUsage,
+			&i.CpuCores,
+			&i.LoadAvg1,
+			&i.LoadAvg5,
+			&i.LoadAvg15,
+			&i.MemoryTotal,
+			&i.MemoryUsed,
+			&i.MemoryAvailable,
+			&i.MemoryUsagePercent,
+			&i.StorageTotal,
+			&i.StorageUsed,
+			&i.StorageAvailable,
+			&i.StorageUsagePercent,
+			&i.NetworkBytesIn,
+			&i.NetworkBytesOut,
+			&i.NetworkPacketsIn,
+			&i.NetworkPacketsOut,
+			&i.NetworkConnectionsIn,
+			&i.NetworkConnectionsOut,
+			&i.NetworkErrorsIn,
+			&i.NetworkErrorsOut,
+			&i.UptimeSeconds,
+			&i.Processes,
+			&i.Os,
+			&i.Kernel,
+			&i.Architecture,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceMetrics = `-- name: ListServiceMetrics :many
+SELECT service_id, service_name, project_id, timestamp,
+       requests_total, requests_success, requests_errors, requests_avg_latency,
+       requests_p95_latency, requests_p99_latency, requests_throughput,
+       errors_total, errors_rate, performance_response_time, performance_throughput,
+       performance_concurrency, performance_saturation, performance_utilization,
+       resource_cpu_usage, resource_memory_usage, resource_storage_usage,
+       resource_network_usage, resource_score
+FROM service_metrics
+WHERE service_id = $1 AND timestamp BETWEEN $2 AND $3
+ORDER BY timestamp ASC
+`
+
+type ListServiceMetricsParams struct {
+	ServiceID   string    `json:"service_id"`
+	Timestamp   time.Time `json:"timestamp"`
+	Timestamp_2 time.Time `json:"timestamp_2"`
+}
+
+type ListServiceMetricsRow struct {
+	ServiceID               string         `json:"service_id"`
+	ServiceName             string         `json:"service_name"`
+	ProjectID               string         `json:"project_id"`
+	Timestamp               time.Time      `json:"timestamp"`
+	RequestsTotal           sql.NullInt64  `json:"requests_total"`
+	RequestsSuccess         sql.NullInt64  `json:"requests_success"`
+	RequestsErrors          sql.NullInt64  `json:"requests_errors"`
+	RequestsAvgLatency      sql.NullString `json:"requests_avg_latency"`
+	RequestsP95Latency      sql.NullString `json:"requests_p95_latency"`
+	RequestsP99Latency      sql.NullString `json:"requests_p99_latency"`
+	RequestsThroughput      sql.NullString `json:"requests_throughput"`
+	ErrorsTotal             sql.NullInt64  `json:"errors_total"`
+	ErrorsRate              sql.NullString `json:"errors_rate"`
+	PerformanceResponseTime sql.NullString `json:"performance_response_time"`
+	PerformanceThroughput   sql.NullString `json:"performance_throughput"`
+	PerformanceConcurrency  sql.NullInt64  `json:"performance_concurrency"`
+	PerformanceSaturation   sql.NullString `json:"performance_saturation"`
+	PerformanceUtilization  sql.NullString `json:"performance_utilization"`
+	ResourceCpuUsage        sql.NullString `json:"resource_cpu_usage"`
+	ResourceMemoryUsage     sql.NullInt64  `json:"resource_memory_usage"`
+	ResourceStorageUsage    sql.NullInt64  `json:"resource_storage_usage"`
+	ResourceNetworkUsage    sql.NullInt64  `json:"resource_network_usage"`
+	ResourceScore           sql.NullString `json:"resource_score"`
+}
+
+func (q *Queries) ListServiceMetrics(ctx context.Context, arg ListServiceMetricsParams) ([]ListServiceMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceMetrics, arg.ServiceID, arg.Timestamp, arg.Timestamp_2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListServiceMetricsRow{}
+	for rows.Next() {
+		var i ListServiceMetricsRow
+		if err := rows.Scan(
+			&i.ServiceID,
+			&i.ServiceName,
+			&i.ProjectID,
+			&i.Timestamp,
+			&i.RequestsTotal,
+			&i.RequestsSuccess,
+			&i.RequestsErrors,
+			&i.RequestsAvgLatency,
+			&i.RequestsP95Latency,
+			&i.RequestsP99Latency,
+			&i.RequestsThroughput,
+			&i.ErrorsTotal,
+			&i.ErrorsRate,
+			&i.PerformanceResponseTime,
+			&i.PerformanceThroughput,
+			&i.PerformanceConcurrency,
+			&i.PerformanceSaturation,
+			&i.PerformanceUtilization,
+			&i.ResourceCpuUsage,
+			&i.ResourceMemoryUsage,
+			&i.ResourceStorageUsage,
+			&i.ResourceNetworkUsage,
+			&i.ResourceScore,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const upsertInstanceMetrics = `-- name: UpsertInstanceMetrics :exec
+INSERT INTO instance_metrics (
+    service_id, timestamp, instance_id, node_id, status, cpu, memory,
+    network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+    network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+    start_time, last_seen, health_status, health_last_check, health_check_count, health_failure_count
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21
+)
+ON CONFLICT (service_id, timestamp, instance_id) DO UPDATE SET
+    node_id = EXCLUDED.node_id,
+    status = EXCLUDED.status,
+    cpu = EXCLUDED.cpu,
+    memory = EXCLUDED.memory,
+    network_bytes_in = EXCLUDED.network_bytes_in,
+    network_bytes_out = EXCLUDED.network_bytes_out,
+    network_packets_in = EXCLUDED.network_packets_in,
+    network_packets_out = EXCLUDED.network_packets_out,
+    network_connections_in = EXCLUDED.network_connections_in,
+    network_connections_out = EXCLUDED.network_connections_out,
+    network_errors_in = EXCLUDED.network_errors_in,
+    network_errors_out = EXCLUDED.network_errors_out,
+    start_time = EXCLUDED.start_time,
+    last_seen = EXCLUDED.last_seen,
+    health_status = EXCLUDED.health_status,
+    health_last_check = EXCLUDED.health_last_check,
+    health_check_count = EXCLUDED.health_check_count,
+    health_failure_count = EXCLUDED.health_failure_count
+`
+
+type UpsertInstanceMetricsParams struct {
+	ServiceID             string         `json:"service_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	InstanceID            string         `json:"instance_id"`
+	NodeID                sql.NullString `json:"node_id"`
+	Status                sql.NullString `json:"status"`
+	Cpu                   sql.NullString `json:"cpu"`
+	Memory                sql.NullInt64  `json:"memory"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	StartTime             sql.NullTime   `json:"start_time"`
+	LastSeen              sql.NullTime   `json:"last_seen"`
+	HealthStatus          sql.NullString `json:"health_status"`
+	HealthLastCheck       sql.NullTime   `json:"health_last_check"`
+	HealthCheckCount      sql.NullInt32  `json:"health_check_count"`
+	HealthFailureCount    sql.NullInt32  `json:"health_failure_count"`
+}
+
+func (q *Queries) UpsertInstanceMetrics(ctx context.Context, arg UpsertInstanceMetricsParams) error {
+	_, err := q.db.ExecContext(ctx, upsertInstanceMetrics,
+		arg.ServiceID,
+		arg.Timestamp,
+		arg.InstanceID,
+		arg.NodeID,
+		arg.Status,
+		arg.Cpu,
+		arg.Memory,
+		arg.NetworkBytesIn,
+		arg.NetworkBytesOut,
+		arg.NetworkPacketsIn,
+		arg.NetworkPacketsOut,
+		arg.NetworkConnectionsIn,
+		arg.NetworkConnectionsOut,
+		arg.NetworkErrorsIn,
+		arg.NetworkErrorsOut,
+		arg.StartTime,
+		arg.LastSeen,
+		arg.HealthStatus,
+		arg.HealthLastCheck,
+		arg.HealthCheckCount,
+		arg.HealthFailureCount,
+	)
+	return err
+}
+
+const upsertNodeMetrics = `-- name: UpsertNodeMetrics :exec
+INSERT INTO node_metrics (
+    node_id, timestamp, cpu_usage, cpu_cores, load_avg_1, load_avg_5, load_avg_15,
+    memory_total, memory_used, memory_available, memory_usage_percent,
+    storage_total, storage_used, storage_available, storage_usage_percent,
+    network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+    network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+    uptime, processes, os, kernel, architecture
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28
+)
+ON CONFLICT (node_id, timestamp) DO UPDATE SET
+    cpu_usage = EXCLUDED.cpu_usage,
+    cpu_cores = EXCLUDED.cpu_cores,
+    load_avg_1 = EXCLUDED.load_avg_1,
+    load_avg_5 = EXCLUDED.load_avg_5,
+    load_avg_15 = EXCLUDED.load_avg_15,
+    memory_total = EXCLUDED.memory_total,
+    memory_used = EXCLUDED.memory_used,
+    memory_available = EXCLUDED.memory_available,
+    memory_usage_percent = EXCLUDED.memory_usage_percent,
+    storage_total = EXCLUDED.storage_total,
+    storage_used = EXCLUDED.storage_used,
+    storage_available = EXCLUDED.storage_available,
+    storage_usage_percent = EXCLUDED.storage_usage_percent,
+    network_bytes_in = EXCLUDED.network_bytes_in,
+    network_bytes_out = EXCLUDED.network_bytes_out,
+    network_packets_in = EXCLUDED.network_packets_in,
+    network_packets_out = EXCLUDED.network_packets_out,
+    network_connections_in = EXCLUDED.network_connections_in,
+    network_connections_out = EXCLUDED.network_connections_out,
+    network_errors_in = EXCLUDED.network_errors_in,
+    network_errors_out = EXCLUDED.network_errors_out,
+    uptime = EXCLUDED.uptime,
+    processes = EXCLUDED.processes,
+    os = EXCLUDED.os,
+    kernel = EXCLUDED.kernel,
+    architecture = EXCLUDED.architecture
+`
+
+type UpsertNodeMetricsParams struct {
+	NodeID                string         `json:"node_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	CpuUsage              sql.NullString `json:"cpu_usage"`
+	CpuCores              sql.NullString `json:"cpu_cores"`
+	LoadAvg1              sql.NullString `json:"load_avg_1"`
+	LoadAvg5              sql.NullString `json:"load_avg_5"`
+	LoadAvg15             sql.NullString `json:"load_avg_15"`
+	MemoryTotal           sql.NullInt64  `json:"memory_total"`
+	MemoryUsed            sql.NullInt64  `json:"memory_used"`
+	MemoryAvailable       sql.NullInt64  `json:"memory_available"`
+	MemoryUsagePercent    sql.NullString `json:"memory_usage_percent"`
+	StorageTotal          sql.NullInt64  `json:"storage_total"`
+	StorageUsed           sql.NullInt64  `json:"storage_used"`
+	StorageAvailable      sql.NullInt64  `json:"storage_available"`
+	StorageUsagePercent   sql.NullString `json:"storage_usage_percent"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	Uptime                sql.NullInt64  `json:"uptime"`
+	Processes             sql.NullInt32  `json:"processes"`
+	Os                    sql.NullString `json:"os"`
+	Kernel                sql.NullString `json:"kernel"`
+	Architecture          sql.NullString `json:"architecture"`
+}
+
+func (q *Queries) UpsertNodeMetrics(ctx context.Context, arg UpsertNodeMetricsParams) error {
+	_, err := q.db.ExecContext(ctx, upsertNodeMetrics,
+		arg.NodeID,
+		arg.Timestamp,
+		arg.CpuUsage,
+		arg.CpuCores,
+		arg.LoadAvg1,
+		arg.LoadAvg5,
+		arg.LoadAvg15,
+		arg.MemoryTotal,
+		arg.MemoryUsed,
+		arg.MemoryAvailable,
+		arg.MemoryUsagePercent,
+		arg.StorageTotal,
+		arg.StorageUsed,
+		arg.StorageAvailable,
+		arg.StorageUsagePercent,
+		arg.NetworkBytesIn,
+		arg.NetworkBytesOut,
+		arg.NetworkPacketsIn,
+		arg.NetworkPacketsOut,
+		arg.NetworkConnectionsIn,
+		arg.NetworkConnectionsOut,
+		arg.NetworkErrorsIn,
+		arg.NetworkErrorsOut,
+		arg.Uptime,
+		arg.Processes,
+		arg.Os,
+		arg.Kernel,
+		arg.Architecture,
+	)
+	return err
+}
+
+const upsertServiceMetrics = `-- name: UpsertServiceMetrics :exec
+INSERT INTO service_metrics (
+    service_id, service_name, project_id, timestamp,
+    requests_total, requests_success, requests_errors, requests_avg_latency,
+    requests_p95_latency, requests_p99_latency, requests_throughput,
+    errors_total, errors_rate, performance_response_time, performance_throughput,
+    performance_concurrency, performance_saturation, performance_utilization,
+    resource_cpu_usage, resource_memory_usage, resource_storage_usage,
+    resource_network_usage, resource_score
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21, $22, $23
+)
+ON CONFLICT (service_id, timestamp) DO UPDATE SET
+    requests_total = EXCLUDED.requests_total,
+    requests_success = EXCLUDED.requests_success,
+    requests_errors = EXCLUDED.requests_errors,
+    requests_avg_latency = EXCLUDED.requests_avg_latency,
+    requests_p95_latency = EXCLUDED.requests_p95_latency,
+    requests_p99_latency = EXCLUDED.requests_p99_latency,
+    requests_throughput = EXCLUDED.requests_throughput,
+    errors_total = EXCLUDED.errors_total,
+    errors_rate = EXCLUDED.errors_rate,
+    performance_response_time = EXCLUDED.performance_response_time,
+    performance_throughput = EXCLUDED.performance_throughput,
+    performance_concurrency = EXCLUDED.performance_concurrency,
+    performance_saturation = EXCLUDED.performance_saturation,
+    performance_utilization = EXCLUDED.performance_utilization,
+    resource_cpu_usage = EXCLUDED.resource_cpu_usage,
+    resource_memory_usage = EXCLUDED.resource_memory_usage,
+    resource_storage_usage = EXCLUDED.resource_storage_usage,
+    resource_network_usage = EXCLUDED.resource_network_usage,
+    resource_score = EXCLUDED.resource_score
+`
+
+type UpsertServiceMetricsParams struct {
+	ServiceID               string         `json:"service_id"`
+	ServiceName             string         `json:"service_name"`
+	ProjectID               string         `json:"project_id"`
+	Timestamp               time.Time      `json:"timestamp"`
+	RequestsTotal           sql.NullInt64  `json:"requests_total"`
+	RequestsSuccess         sql.NullInt64  `json:"requests_success"`
+	RequestsErrors          sql.NullInt64  `json:"requests_errors"`
+	RequestsAvgLatency      sql.NullString `json:"requests_avg_latency"`
+	RequestsP95Latency      sql.NullString `json:"requests_p95_latency"`
+	RequestsP99Latency      sql.NullString `json:"requests_p99_latency"`
+	RequestsThroughput      sql.NullString `json:"requests_throughput"`
+	ErrorsTotal             sql.NullInt64  `json:"errors_total"`
+	ErrorsRate              sql.NullString `json:"errors_rate"`
+	PerformanceResponseTime sql.NullString `json:"performance_response_time"`
+	PerformanceThroughput   sql.NullString `json:"performance_throughput"`
+	PerformanceConcurrency  sql.NullInt64  `json:"performance_concurrency"`
+	PerformanceSaturation   sql.NullString `json:"performance_saturation"`
+	PerformanceUtilization  sql.NullString `json:"performance_utilization"`
+	ResourceCpuUsage        sql.NullString `json:"resource_cpu_usage"`
+	ResourceMemoryUsage     sql.NullInt64  `json:"resource_memory_usage"`
+	ResourceStorageUsage    sql.NullInt64  `json:"resource_storage_usage"`
+	ResourceNetworkUsage    sql.NullInt64  `json:"resource_network_usage"`
+	ResourceScore           sql.NullString `json:"resource_score"`
+}
+
+func (q *Queries) UpsertServiceMetrics(ctx context.Context, arg UpsertServiceMetricsParams) error {
+	_, err := q.db.ExecContext(ctx, upsertServiceMetrics,
+		arg.ServiceID,
+		arg.ServiceName,
+		arg.ProjectID,
+		arg.Timestamp,
+		arg.RequestsTotal,
+		arg.RequestsSuccess,
+		arg.RequestsErrors,
+		arg.RequestsAvgLatency,
+		arg.RequestsP95Latency,
+		arg.RequestsP99Latency,
+		arg.RequestsThroughput,
+		arg.ErrorsTotal,
+		arg.ErrorsRate,
+		arg.PerformanceResponseTime,
+		arg.PerformanceThroughput,
+		arg.PerformanceConcurrency,
+		arg.PerformanceSaturation,
+		arg.PerformanceUtilization,
+		arg.ResourceCpuUsage,
+		arg.ResourceMemoryUsage,
+		arg.ResourceStorageUsage,
+		arg.ResourceNetworkUsage,
+		arg.ResourceScore,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/misc.sql.go

@@ -0,0 +1,174 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: misc.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const countProjects = `-- name: CountProjects :one
+SELECT COUNT(*) FROM projects
+`
+
+func (q *Queries) CountProjects(ctx context.Context) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countProjects)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const deleteProjectVariables = `-- name: DeleteProjectVariables :exec
+DELETE FROM project_variables WHERE project_id = $1
+`
+
+func (q *Queries) DeleteProjectVariables(ctx context.Context, projectID uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deleteProjectVariables, projectID)
+	return err
+}
+
+const getProjectVariableValue = `-- name: GetProjectVariableValue :one
+SELECT value FROM project_variables WHERE project_id = $1 AND key = $2
+`
+
+type GetProjectVariableValueParams struct {
+	ProjectID uuid.UUID `json:"project_id"`
+	Key       string    `json:"key"`
+}
+
+func (q *Queries) GetProjectVariableValue(ctx context.Context, arg GetProjectVariableValueParams) (string, error) {
+	row := q.db.QueryRowContext(ctx, getProjectVariableValue, arg.ProjectID, arg.Key)
+	var value string
+	err := row.Scan(&value)
+	return value, err
+}
+
+const getRegistryAuth = `-- name: GetRegistryAuth :one
+SELECT username, password FROM registries
+WHERE owner_id::text = $1 AND host = $2
+`
+
+type GetRegistryAuthParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Host    string    `json:"host"`
+}
+
+type GetRegistryAuthRow struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+func (q *Queries) GetRegistryAuth(ctx context.Context, arg GetRegistryAuthParams) (GetRegistryAuthRow, error) {
+	row := q.db.QueryRowContext(ctx, getRegistryAuth, arg.OwnerID, arg.Host)
+	var i GetRegistryAuthRow
+	err := row.Scan(&i.Username, &i.Password)
+	return i, err
+}
+
+const insertEnvVar = `-- name: InsertEnvVar :exec
+INSERT INTO environment_variables (id, service_id, key, value, is_secret, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7)
+`
+
+type InsertEnvVarParams struct {
+	ID        uuid.UUID    `json:"id"`
+	ServiceID uuid.UUID    `json:"service_id"`
+	Key       string       `json:"key"`
+	Value     string       `json:"value"`
+	IsSecret  sql.NullBool `json:"is_secret"`
+	CreatedAt sql.NullTime `json:"created_at"`
+	UpdatedAt sql.NullTime `json:"updated_at"`
+}
+
+func (q *Queries) InsertEnvVar(ctx context.Context, arg InsertEnvVarParams) error {
+	_, err := q.db.ExecContext(ctx, insertEnvVar,
+		arg.ID,
+		arg.ServiceID,
+		arg.Key,
+		arg.Value,
+		arg.IsSecret,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const insertProjectVariable = `-- name: InsertProjectVariable :exec
+INSERT INTO project_variables (id, project_id, key, value, is_secret, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7)
+`
+
+type InsertProjectVariableParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+	Key       string    `json:"key"`
+	Value     string    `json:"value"`
+	IsSecret  bool      `json:"is_secret"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+func (q *Queries) InsertProjectVariable(ctx context.Context, arg InsertProjectVariableParams) error {
+	_, err := q.db.ExecContext(ctx, insertProjectVariable,
+		arg.ID,
+		arg.ProjectID,
+		arg.Key,
+		arg.Value,
+		arg.IsSecret,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const updateServiceDeployMeta = `-- name: UpdateServiceDeployMeta :exec
+UPDATE services SET port = $1, healthcheck_path = $2,
+       volumes = COALESCE($3::jsonb, '[]'::jsonb),
+       git_repo = NULLIF($4::text, ''), git_branch = NULLIF($5::text, ''), builder = $6
+WHERE id = $7
+`
+
+type UpdateServiceDeployMetaParams struct {
+	Port            int32           `json:"port"`
+	HealthcheckPath string          `json:"healthcheck_path"`
+	Column3         json.RawMessage `json:"column_3"`
+	Column4         string          `json:"column_4"`
+	Column5         string          `json:"column_5"`
+	Builder         string          `json:"builder"`
+	ID              uuid.UUID       `json:"id"`
+}
+
+func (q *Queries) UpdateServiceDeployMeta(ctx context.Context, arg UpdateServiceDeployMetaParams) error {
+	_, err := q.db.ExecContext(ctx, updateServiceDeployMeta,
+		arg.Port,
+		arg.HealthcheckPath,
+		arg.Column3,
+		arg.Column4,
+		arg.Column5,
+		arg.Builder,
+		arg.ID,
+	)
+	return err
+}
+
+const updateServiceRuntimeMeta = `-- name: UpdateServiceRuntimeMeta :exec
+UPDATE services SET port = $1, healthcheck_path = $2 WHERE id = $3
+`
+
+type UpdateServiceRuntimeMetaParams struct {
+	Port            int32     `json:"port"`
+	HealthcheckPath string    `json:"healthcheck_path"`
+	ID              uuid.UUID `json:"id"`
+}
+
+func (q *Queries) UpdateServiceRuntimeMeta(ctx context.Context, arg UpdateServiceRuntimeMetaParams) error {
+	_, err := q.db.ExecContext(ctx, updateServiceRuntimeMeta, arg.Port, arg.HealthcheckPath, arg.ID)
+	return err
+}

app/backend/internal/database/sqlcdb/models.go

@@ -49,6 +49,66 @@ type AgentHeartbeat struct {
 	CreatedAt      time.Time       `json:"created_at"`
 }
 
+type ApiKey struct {
+	ID                uuid.UUID     `json:"id"`
+	Name              string        `json:"name"`
+	KeyHash           string        `json:"key_hash"`
+	KeyPrefix         string        `json:"key_prefix"`
+	Plan              string        `json:"plan"`
+	AllowedServiceIds string        `json:"allowed_service_ids"`
+	Enabled           int32         `json:"enabled"`
+	RpmLimit          sql.NullInt32 `json:"rpm_limit"`
+	MonthlyQuota      sql.NullInt32 `json:"monthly_quota"`
+	CreatedAt         time.Time     `json:"created_at"`
+	UpdatedAt         time.Time     `json:"updated_at"`
+	LastUsedAt        sql.NullTime  `json:"last_used_at"`
+}
+
+type ApiService struct {
+	ID                    uuid.UUID      `json:"id"`
+	Name                  string         `json:"name"`
+	Slug                  string         `json:"slug"`
+	UpstreamUrl           string         `json:"upstream_url"`
+	RoutePrefix           string         `json:"route_prefix"`
+	HealthPath            string         `json:"health_path"`
+	UpstreamAuthHeader    sql.NullString `json:"upstream_auth_header"`
+	UpstreamAuthValue     sql.NullString `json:"upstream_auth_value"`
+	InternalToken         sql.NullString `json:"internal_token"`
+	Enabled               int32          `json:"enabled"`
+	RpmLimit              sql.NullInt32  `json:"rpm_limit"`
+	MonthlyQuota          sql.NullInt32  `json:"monthly_quota"`
+	RequestTimeoutMs      sql.NullInt32  `json:"request_timeout_ms"`
+	LastValidationAt      sql.NullTime   `json:"last_validation_at"`
+	LastValidationStatus  sql.NullString `json:"last_validation_status"`
+	LastValidationMessage sql.NullString `json:"last_validation_message"`
+	CreatedAt             time.Time      `json:"created_at"`
+	UpdatedAt             time.Time      `json:"updated_at"`
+}
+
+type AppSetting struct {
+	Key       string    `json:"key"`
+	Value     string    `json:"value"`
+	IsSecret  bool      `json:"is_secret"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+type AuditLog struct {
+	ID         uuid.UUID             `json:"id"`
+	Timestamp  time.Time             `json:"timestamp"`
+	UserID     uuid.NullUUID         `json:"user_id"`
+	Action     string                `json:"action"`
+	Resource   string                `json:"resource"`
+	ResourceID uuid.NullUUID         `json:"resource_id"`
+	Details    pqtype.NullRawMessage `json:"details"`
+	IpAddress  pqtype.Inet           `json:"ip_address"`
+	UserAgent  sql.NullString        `json:"user_agent"`
+	Success    bool                  `json:"success"`
+	CreatedAt  time.Time             `json:"created_at"`
+	Severity   string                `json:"severity"`
+	Category   string                `json:"category"`
+	Label      string                `json:"label"`
+}
+
 type BackupTarget struct {
 	ID        string       `json:"id"`
 	UserID    string       `json:"user_id"`
@@ -78,6 +138,46 @@ type Banner struct {
 	UpdatedAt   sql.NullTime  `json:"updated_at"`
 }
 
+type Build struct {
+	ID          string          `json:"id"`
+	ProjectID   sql.NullString  `json:"project_id"`
+	ServiceID   sql.NullString  `json:"service_id"`
+	Status      string          `json:"status"`
+	Progress    int32           `json:"progress"`
+	StartedAt   time.Time       `json:"started_at"`
+	CompletedAt sql.NullTime    `json:"completed_at"`
+	ImageName   string          `json:"image_name"`
+	ImageTag    string          `json:"image_tag"`
+	Size        int64           `json:"size"`
+	Error       sql.NullString  `json:"error"`
+	Log         string          `json:"log"`
+	Metadata    json.RawMessage `json:"metadata"`
+	CreatedAt   time.Time       `json:"created_at"`
+	UpdatedAt   time.Time       `json:"updated_at"`
+}
+
+type ComplianceFramework struct {
+	ID          uuid.UUID      `json:"id"`
+	Name        string         `json:"name"`
+	Description sql.NullString `json:"description"`
+	Version     string         `json:"version"`
+	Enabled     bool           `json:"enabled"`
+	CreatedAt   time.Time      `json:"created_at"`
+	UpdatedAt   time.Time      `json:"updated_at"`
+}
+
+type ComplianceReport struct {
+	ID             uuid.UUID      `json:"id"`
+	ProjectID      uuid.UUID      `json:"project_id"`
+	FrameworkID    uuid.UUID      `json:"framework_id"`
+	AssessmentDate time.Time      `json:"assessment_date"`
+	Assessor       sql.NullString `json:"assessor"`
+	OverallStatus  string         `json:"overall_status"`
+	Score          int32          `json:"score"`
+	CreatedAt      time.Time      `json:"created_at"`
+	UpdatedAt      time.Time      `json:"updated_at"`
+}
+
 type ContainerInstance struct {
 	ID            string                `json:"id"`
 	Name          string                `json:"name"`
@@ -98,6 +198,34 @@ type ContainerInstance struct {
 	UpdatedAt     sql.NullTime          `json:"updated_at"`
 }
 
+type CronExecution struct {
+	ID         uuid.UUID      `json:"id"`
+	CronJobID  uuid.UUID      `json:"cron_job_id"`
+	StartedAt  time.Time      `json:"started_at"`
+	FinishedAt sql.NullTime   `json:"finished_at"`
+	Status     sql.NullString `json:"status"`
+	Output     sql.NullString `json:"output"`
+	Error      sql.NullString `json:"error"`
+}
+
+type CronJob struct {
+	ID         uuid.UUID      `json:"id"`
+	ProjectID  uuid.UUID      `json:"project_id"`
+	ServiceID  uuid.UUID      `json:"service_id"`
+	Name       string         `json:"name"`
+	Schedule   string         `json:"schedule"`
+	Command    string         `json:"command"`
+	Timezone   sql.NullString `json:"timezone"`
+	Enabled    sql.NullBool   `json:"enabled"`
+	LastRunAt  sql.NullTime   `json:"last_run_at"`
+	NextRunAt  sql.NullTime   `json:"next_run_at"`
+	LastStatus sql.NullString `json:"last_status"`
+	LastOutput sql.NullString `json:"last_output"`
+	Retention  sql.NullInt32  `json:"retention"`
+	CreatedAt  sql.NullTime   `json:"created_at"`
+	UpdatedAt  sql.NullTime   `json:"updated_at"`
+}
+
 type DatabaseBackup struct {
 	ID          string         `json:"id"`
 	DatabaseID  string         `json:"database_id"`
@@ -136,11 +264,22 @@ type DatabaseService struct {
 }
 
 type Deployment struct {
-	ID        uuid.UUID      `json:"id"`
-	ServiceID uuid.UUID      `json:"service_id"`
-	Status    sql.NullString `json:"status"`
-	CreatedAt sql.NullTime   `json:"created_at"`
-	UpdatedAt sql.NullTime   `json:"updated_at"`
+	ID            uuid.UUID      `json:"id"`
+	ServiceID     uuid.UUID      `json:"service_id"`
+	Version       string         `json:"version"`
+	CommitHash    sql.NullString `json:"commit_hash"`
+	ImageDigest   sql.NullString `json:"image_digest"`
+	Status        sql.NullString `json:"status"`
+	BuildLog      sql.NullString `json:"build_log"`
+	DeploymentLog sql.NullString `json:"deployment_log"`
+	StartedAt     sql.NullTime   `json:"started_at"`
+	CompletedAt   sql.NullTime   `json:"completed_at"`
+	CreatedAt     sql.NullTime   `json:"created_at"`
+	UpdatedAt     sql.NullTime   `json:"updated_at"`
+	ImageName     sql.NullString `json:"image_name"`
+	ImageTag      sql.NullString `json:"image_tag"`
+	RuntimeLog    sql.NullString `json:"runtime_log"`
+	Error         sql.NullString `json:"error"`
 }
 
 type Environment struct {
@@ -161,6 +300,91 @@ type EnvironmentVariable struct {
 	UpdatedAt sql.NullTime `json:"updated_at"`
 }
 
+type GitProvider struct {
+	ID          uuid.UUID    `json:"id"`
+	Name        string       `json:"name"`
+	DisplayName string       `json:"display_name"`
+	ApiUrl      string       `json:"api_url"`
+	WebhookUrl  string       `json:"webhook_url"`
+	AccessToken string       `json:"access_token"`
+	UserID      uuid.UUID    `json:"user_id"`
+	CreatedAt   sql.NullTime `json:"created_at"`
+	UpdatedAt   sql.NullTime `json:"updated_at"`
+}
+
+type GitRepository struct {
+	ID            uuid.UUID      `json:"id"`
+	ProviderID    uuid.UUID      `json:"provider_id"`
+	Name          string         `json:"name"`
+	FullName      string         `json:"full_name"`
+	Description   sql.NullString `json:"description"`
+	CloneUrl      string         `json:"clone_url"`
+	WebhookUrl    sql.NullString `json:"webhook_url"`
+	DefaultBranch sql.NullString `json:"default_branch"`
+	IsPrivate     sql.NullBool   `json:"is_private"`
+	UserID        uuid.UUID      `json:"user_id"`
+	CreatedAt     sql.NullTime   `json:"created_at"`
+	UpdatedAt     sql.NullTime   `json:"updated_at"`
+}
+
+type GitWebhook struct {
+	ID              uuid.UUID      `json:"id"`
+	RepoID          uuid.UUID      `json:"repo_id"`
+	ProviderID      uuid.UUID      `json:"provider_id"`
+	Events          string         `json:"events"`
+	WebhookSecret   string         `json:"webhook_secret"`
+	RemoteWebhookID sql.NullString `json:"remote_webhook_id"`
+	Active          sql.NullBool   `json:"active"`
+	BranchFilter    sql.NullString `json:"branch_filter"`
+	CreatedAt       sql.NullTime   `json:"created_at"`
+	UpdatedAt       sql.NullTime   `json:"updated_at"`
+}
+
+type IncidentEvent struct {
+	ID         int32         `json:"id"`
+	ServiceID  uuid.NullUUID `json:"service_id"`
+	ApiKeyID   uuid.NullUUID `json:"api_key_id"`
+	Code       string        `json:"code"`
+	Message    string        `json:"message"`
+	Severity   string        `json:"severity"`
+	HttpStatus sql.NullInt32 `json:"http_status"`
+	Count      int32         `json:"count"`
+	OccurredAt time.Time     `json:"occurred_at"`
+}
+
+type InstanceMetric struct {
+	ServiceID             string         `json:"service_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	InstanceID            string         `json:"instance_id"`
+	NodeID                sql.NullString `json:"node_id"`
+	Status                sql.NullString `json:"status"`
+	Cpu                   sql.NullString `json:"cpu"`
+	Memory                sql.NullInt64  `json:"memory"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	StartTime             sql.NullTime   `json:"start_time"`
+	LastSeen              sql.NullTime   `json:"last_seen"`
+	HealthStatus          sql.NullString `json:"health_status"`
+	HealthLastCheck       sql.NullTime   `json:"health_last_check"`
+	HealthCheckCount      sql.NullInt32  `json:"health_check_count"`
+	HealthFailureCount    sql.NullInt32  `json:"health_failure_count"`
+	CreatedAt             sql.NullTime   `json:"created_at"`
+}
+
+type MetricsTimeseries struct {
+	ID         int32          `json:"id"`
+	Metric     string         `json:"metric"`
+	Value      float32        `json:"value"`
+	LabelsJson sql.NullString `json:"labels_json"`
+	OccurredAt time.Time      `json:"occurred_at"`
+}
+
 type NodeAgent struct {
 	ID            string                `json:"id"`
 	Name          string                `json:"name"`
@@ -175,6 +399,42 @@ type NodeAgent struct {
 	CreatedAt     sql.NullTime          `json:"created_at"`
 	UpdatedAt     sql.NullTime          `json:"updated_at"`
 	Metadata      pqtype.NullRawMessage `json:"metadata"`
+	AutoPrune     bool                  `json:"auto_prune"`
+	Schedulable   bool                  `json:"schedulable"`
+	Tags          json.RawMessage       `json:"tags"`
+	DefaultDomain string                `json:"default_domain"`
+}
+
+type NodeMetric struct {
+	NodeID                string         `json:"node_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	CpuUsage              sql.NullString `json:"cpu_usage"`
+	CpuCores              sql.NullString `json:"cpu_cores"`
+	LoadAvg1              sql.NullString `json:"load_avg_1"`
+	LoadAvg5              sql.NullString `json:"load_avg_5"`
+	LoadAvg15             sql.NullString `json:"load_avg_15"`
+	MemoryTotal           sql.NullInt64  `json:"memory_total"`
+	MemoryUsed            sql.NullInt64  `json:"memory_used"`
+	MemoryAvailable       sql.NullInt64  `json:"memory_available"`
+	MemoryUsagePercent    sql.NullString `json:"memory_usage_percent"`
+	StorageTotal          sql.NullInt64  `json:"storage_total"`
+	StorageUsed           sql.NullInt64  `json:"storage_used"`
+	StorageAvailable      sql.NullInt64  `json:"storage_available"`
+	StorageUsagePercent   sql.NullString `json:"storage_usage_percent"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	Uptime                sql.NullInt64  `json:"uptime"`
+	Processes             sql.NullInt32  `json:"processes"`
+	Os                    sql.NullString `json:"os"`
+	Kernel                sql.NullString `json:"kernel"`
+	Architecture          sql.NullString `json:"architecture"`
+	CreatedAt             sql.NullTime   `json:"created_at"`
 }
 
 type Notification struct {
@@ -189,6 +449,17 @@ type Notification struct {
 	CreatedAt    sql.NullTime   `json:"created_at"`
 }
 
+type NotificationChannel struct {
+	ID        uuid.UUID      `json:"id"`
+	UserID    uuid.UUID      `json:"user_id"`
+	Kind      string         `json:"kind"`
+	Endpoint  string         `json:"endpoint"`
+	Token     sql.NullString `json:"token"`
+	Enabled   bool           `json:"enabled"`
+	CreatedAt sql.NullTime   `json:"created_at"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+}
+
 type OutboundWebhook struct {
 	ID        uuid.UUID             `json:"id"`
 	UserID    uuid.UUID             `json:"user_id"`
@@ -202,6 +473,21 @@ type OutboundWebhook struct {
 	UpdatedAt sql.NullTime          `json:"updated_at"`
 }
 
+type PreviewEnvironment struct {
+	ID               uuid.UUID      `json:"id"`
+	ProjectID        uuid.UUID      `json:"project_id"`
+	ServiceID        uuid.UUID      `json:"service_id"`
+	BranchName       string         `json:"branch_name"`
+	PrNumber         sql.NullInt32  `json:"pr_number"`
+	Environment      string         `json:"environment"`
+	Status           string         `json:"status"`
+	Url              sql.NullString `json:"url"`
+	ExpiresAt        time.Time      `json:"expires_at"`
+	CreatedAt        sql.NullTime   `json:"created_at"`
+	UpdatedAt        sql.NullTime   `json:"updated_at"`
+	PreviewServiceID uuid.NullUUID  `json:"preview_service_id"`
+}
+
 type Project struct {
 	ID          uuid.UUID      `json:"id"`
 	Name        string         `json:"name"`
@@ -220,6 +506,16 @@ type ProjectMember struct {
 	CreatedAt sql.NullTime `json:"created_at"`
 }
 
+type ProjectVariable struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+	Key       string    `json:"key"`
+	Value     string    `json:"value"`
+	IsSecret  bool      `json:"is_secret"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
 type Registry struct {
 	ID        uuid.UUID `json:"id"`
 	OwnerID   uuid.UUID `json:"owner_id"`
@@ -231,48 +527,67 @@ type Registry struct {
 	UpdatedAt time.Time `json:"updated_at"`
 }
 
+type SecurityScan struct {
+	ID          uuid.UUID             `json:"id"`
+	ProjectID   uuid.UUID             `json:"project_id"`
+	ServiceID   uuid.NullUUID         `json:"service_id"`
+	ScanType    string                `json:"scan_type"`
+	Status      string                `json:"status"`
+	StartedAt   time.Time             `json:"started_at"`
+	CompletedAt sql.NullTime          `json:"completed_at"`
+	Summary     pqtype.NullRawMessage `json:"summary"`
+	CreatedAt   time.Time             `json:"created_at"`
+	UpdatedAt   time.Time             `json:"updated_at"`
+}
+
 type Service struct {
-	ID              uuid.UUID       `json:"id"`
-	Name            string          `json:"name"`
-	Description     sql.NullString  `json:"description"`
-	ProjectID       uuid.UUID       `json:"project_id"`
-	EnvironmentID   uuid.UUID       `json:"environment_id"`
-	ServiceType     string          `json:"service_type"`
-	SourceType      string          `json:"source_type"`
-	SourceUrl       sql.NullString  `json:"source_url"`
-	ImageName       sql.NullString  `json:"image_name"`
-	BuildCommand    sql.NullString  `json:"build_command"`
-	StartCommand    sql.NullString  `json:"start_command"`
-	CpuLimit        sql.NullInt32   `json:"cpu_limit"`
-	MemoryLimit     sql.NullInt32   `json:"memory_limit"`
-	PublicUrl       sql.NullString  `json:"public_url"`
-	HealthCheckUrl  sql.NullString  `json:"health_check_url"`
-	Status          sql.NullString  `json:"status"`
-	CreatedAt       sql.NullTime    `json:"created_at"`
-	UpdatedAt       sql.NullTime    `json:"updated_at"`
-	Type            sql.NullString  `json:"type"`
-	Image           sql.NullString  `json:"image"`
-	Command         sql.NullString  `json:"command"`
-	Environment     sql.NullString  `json:"environment"`
-	GitRepo         sql.NullString  `json:"git_repo"`
-	GitBranch       sql.NullString  `json:"git_branch"`
-	BuildPath       sql.NullString  `json:"build_path"`
-	Cpu             sql.NullString  `json:"cpu"`
-	Memory          sql.NullString  `json:"memory"`
-	Replicas        int32           `json:"replicas"`
-	Port            int32           `json:"port"`
-	Domain          string          `json:"domain"`
-	HealthcheckPath string          `json:"healthcheck_path"`
-	RestartPolicy   string          `json:"restart_policy"`
-	PublishedPort   int32           `json:"published_port"`
-	Volumes         json.RawMessage `json:"volumes"`
-	MaintenanceMode bool            `json:"maintenance_mode"`
-	BasicAuthUsers  string          `json:"basic_auth_users"`
-	Builder         string          `json:"builder"`
-	CpuReserve      string          `json:"cpu_reserve"`
-	MemoryReserve   string          `json:"memory_reserve"`
-	StaticBuildCmd  string          `json:"static_build_cmd"`
-	StaticDir       string          `json:"static_dir"`
+	ID               uuid.UUID       `json:"id"`
+	Name             string          `json:"name"`
+	Description      sql.NullString  `json:"description"`
+	ProjectID        uuid.UUID       `json:"project_id"`
+	EnvironmentID    uuid.UUID       `json:"environment_id"`
+	ServiceType      string          `json:"service_type"`
+	SourceType       string          `json:"source_type"`
+	SourceUrl        sql.NullString  `json:"source_url"`
+	ImageName        sql.NullString  `json:"image_name"`
+	BuildCommand     sql.NullString  `json:"build_command"`
+	StartCommand     sql.NullString  `json:"start_command"`
+	CpuLimit         sql.NullInt32   `json:"cpu_limit"`
+	MemoryLimit      sql.NullInt32   `json:"memory_limit"`
+	PublicUrl        sql.NullString  `json:"public_url"`
+	HealthCheckUrl   sql.NullString  `json:"health_check_url"`
+	Status           sql.NullString  `json:"status"`
+	CreatedAt        sql.NullTime    `json:"created_at"`
+	UpdatedAt        sql.NullTime    `json:"updated_at"`
+	Type             sql.NullString  `json:"type"`
+	Image            sql.NullString  `json:"image"`
+	Command          sql.NullString  `json:"command"`
+	Environment      sql.NullString  `json:"environment"`
+	GitRepo          sql.NullString  `json:"git_repo"`
+	GitBranch        sql.NullString  `json:"git_branch"`
+	BuildPath        sql.NullString  `json:"build_path"`
+	Cpu              sql.NullString  `json:"cpu"`
+	Memory           sql.NullString  `json:"memory"`
+	Replicas         int32           `json:"replicas"`
+	Port             int32           `json:"port"`
+	Domain           string          `json:"domain"`
+	HealthcheckPath  string          `json:"healthcheck_path"`
+	RestartPolicy    string          `json:"restart_policy"`
+	PublishedPort    int32           `json:"published_port"`
+	Volumes          json.RawMessage `json:"volumes"`
+	MaintenanceMode  bool            `json:"maintenance_mode"`
+	BasicAuthUsers   string          `json:"basic_auth_users"`
+	Builder          string          `json:"builder"`
+	CpuReserve       string          `json:"cpu_reserve"`
+	MemoryReserve    string          `json:"memory_reserve"`
+	StaticBuildCmd   string          `json:"static_build_cmd"`
+	StaticDir        string          `json:"static_dir"`
+	NodeID           sql.NullString  `json:"node_id"`
+	Spread           bool            `json:"spread"`
+	SleepEnabled     bool            `json:"sleep_enabled"`
+	SleepIdleMinutes int32           `json:"sleep_idle_minutes"`
+	PlacementTags    json.RawMessage `json:"placement_tags"`
+	TraefikLabels    json.RawMessage `json:"traefik_labels"`
 }
 
 type ServiceDomain struct {
@@ -286,6 +601,33 @@ type ServiceDomain struct {
 	CreatedAt     time.Time    `json:"created_at"`
 }
 
+type ServiceMetric struct {
+	ServiceID               string         `json:"service_id"`
+	ServiceName             string         `json:"service_name"`
+	ProjectID               string         `json:"project_id"`
+	Timestamp               time.Time      `json:"timestamp"`
+	RequestsTotal           sql.NullInt64  `json:"requests_total"`
+	RequestsSuccess         sql.NullInt64  `json:"requests_success"`
+	RequestsErrors          sql.NullInt64  `json:"requests_errors"`
+	RequestsAvgLatency      sql.NullString `json:"requests_avg_latency"`
+	RequestsP95Latency      sql.NullString `json:"requests_p95_latency"`
+	RequestsP99Latency      sql.NullString `json:"requests_p99_latency"`
+	RequestsThroughput      sql.NullString `json:"requests_throughput"`
+	ErrorsTotal             sql.NullInt64  `json:"errors_total"`
+	ErrorsRate              sql.NullString `json:"errors_rate"`
+	PerformanceResponseTime sql.NullString `json:"performance_response_time"`
+	PerformanceThroughput   sql.NullString `json:"performance_throughput"`
+	PerformanceConcurrency  sql.NullInt64  `json:"performance_concurrency"`
+	PerformanceSaturation   sql.NullString `json:"performance_saturation"`
+	PerformanceUtilization  sql.NullString `json:"performance_utilization"`
+	ResourceCpuUsage        sql.NullString `json:"resource_cpu_usage"`
+	ResourceMemoryUsage     sql.NullInt64  `json:"resource_memory_usage"`
+	ResourceStorageUsage    sql.NullInt64  `json:"resource_storage_usage"`
+	ResourceNetworkUsage    sql.NullInt64  `json:"resource_network_usage"`
+	ResourceScore           sql.NullString `json:"resource_score"`
+	CreatedAt               sql.NullTime   `json:"created_at"`
+}
+
 type ServiceTemplate struct {
 	ID          string                `json:"id"`
 	Name        string                `json:"name"`
@@ -301,6 +643,26 @@ type ServiceTemplate struct {
 	UpdatedAt   sql.NullTime          `json:"updated_at"`
 }
 
+type UsageCounter struct {
+	ID           int32     `json:"id"`
+	ApiKeyID     uuid.UUID `json:"api_key_id"`
+	ServiceID    uuid.UUID `json:"service_id"`
+	PeriodMonth  string    `json:"period_month"`
+	RequestCount int32     `json:"request_count"`
+	UpdatedAt    time.Time `json:"updated_at"`
+}
+
+type User struct {
+	ID           uuid.UUID      `json:"id"`
+	Email        string         `json:"email"`
+	PasswordHash string         `json:"password_hash"`
+	Name         string         `json:"name"`
+	AvatarUrl    sql.NullString `json:"avatar_url"`
+	CreatedAt    sql.NullTime   `json:"created_at"`
+	UpdatedAt    sql.NullTime   `json:"updated_at"`
+	IsAdmin      bool           `json:"is_admin"`
+}
+
 type UserInvite struct {
 	ID        uuid.UUID      `json:"id"`
 	TokenHash string         `json:"token_hash"`
@@ -325,6 +687,21 @@ type UserToken struct {
 	CreatedAt  sql.NullTime `json:"created_at"`
 }
 
+type Vulnerability struct {
+	ID          uuid.UUID      `json:"id"`
+	Type        string         `json:"type"`
+	Severity    string         `json:"severity"`
+	Title       string         `json:"title"`
+	Description sql.NullString `json:"description"`
+	ServiceID   uuid.NullUUID  `json:"service_id"`
+	ProjectID   uuid.UUID      `json:"project_id"`
+	Status      string         `json:"status"`
+	FoundAt     time.Time      `json:"found_at"`
+	ResolvedAt  sql.NullTime   `json:"resolved_at"`
+	CreatedAt   time.Time      `json:"created_at"`
+	UpdatedAt   time.Time      `json:"updated_at"`
+}
+
 type WebhookDelivery struct {
 	ID             uuid.UUID             `json:"id"`
 	WebhookID      uuid.UUID             `json:"webhook_id"`

app/backend/internal/database/sqlcdb/notifications.sql.go

@@ -53,6 +53,135 @@ func (q *Queries) CreateNotification(ctx context.Context, arg CreateNotification
 	return err
 }
 
+const deleteNotificationChannel = `-- name: DeleteNotificationChannel :execrows
+DELETE FROM notification_channels WHERE id = $1 AND user_id = $2
+`
+
+type DeleteNotificationChannelParams struct {
+	ID     uuid.UUID `json:"id"`
+	UserID uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) DeleteNotificationChannel(ctx context.Context, arg DeleteNotificationChannelParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, deleteNotificationChannel, arg.ID, arg.UserID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const insertNotificationChannel = `-- name: InsertNotificationChannel :one
+INSERT INTO notification_channels (user_id, kind, endpoint, token)
+VALUES ($1, $2, $3, $4)
+RETURNING id, user_id, kind, endpoint, token, enabled, created_at, updated_at
+`
+
+type InsertNotificationChannelParams struct {
+	UserID   uuid.UUID      `json:"user_id"`
+	Kind     string         `json:"kind"`
+	Endpoint string         `json:"endpoint"`
+	Token    sql.NullString `json:"token"`
+}
+
+func (q *Queries) InsertNotificationChannel(ctx context.Context, arg InsertNotificationChannelParams) (NotificationChannel, error) {
+	row := q.db.QueryRowContext(ctx, insertNotificationChannel,
+		arg.UserID,
+		arg.Kind,
+		arg.Endpoint,
+		arg.Token,
+	)
+	var i NotificationChannel
+	err := row.Scan(
+		&i.ID,
+		&i.UserID,
+		&i.Kind,
+		&i.Endpoint,
+		&i.Token,
+		&i.Enabled,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const listAllNotificationChannelsByUser = `-- name: ListAllNotificationChannelsByUser :many
+SELECT id, user_id, kind, endpoint, token, enabled, created_at, updated_at
+FROM notification_channels
+WHERE user_id = $1
+ORDER BY created_at
+`
+
+func (q *Queries) ListAllNotificationChannelsByUser(ctx context.Context, userID uuid.UUID) ([]NotificationChannel, error) {
+	rows, err := q.db.QueryContext(ctx, listAllNotificationChannelsByUser, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []NotificationChannel{}
+	for rows.Next() {
+		var i NotificationChannel
+		if err := rows.Scan(
+			&i.ID,
+			&i.UserID,
+			&i.Kind,
+			&i.Endpoint,
+			&i.Token,
+			&i.Enabled,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listNotificationChannelsByUser = `-- name: ListNotificationChannelsByUser :many
+SELECT id, user_id, kind, endpoint, token, enabled, created_at, updated_at
+FROM notification_channels
+WHERE user_id = $1 AND enabled
+ORDER BY created_at
+`
+
+func (q *Queries) ListNotificationChannelsByUser(ctx context.Context, userID uuid.UUID) ([]NotificationChannel, error) {
+	rows, err := q.db.QueryContext(ctx, listNotificationChannelsByUser, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []NotificationChannel{}
+	for rows.Next() {
+		var i NotificationChannel
+		if err := rows.Scan(
+			&i.ID,
+			&i.UserID,
+			&i.Kind,
+			&i.Endpoint,
+			&i.Token,
+			&i.Enabled,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listNotificationsByUser = `-- name: ListNotificationsByUser :many
 SELECT id, user_id, kind, title, body, resource_type, resource_id, read_at, created_at
 FROM notifications

app/backend/internal/database/sqlcdb/operations.sql.go

@@ -0,0 +1,258 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: operations.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const listActiveOperationDeployments = `-- name: ListActiveOperationDeployments :many
+SELECT d.id, d.service_id, s.name AS service_name, p.name AS project_name, d.status,
+       COALESCE(d.image_name, '') AS image, d.error, d.started_at, d.completed_at, d.created_at
+FROM deployments d
+JOIN services s ON s.id = d.service_id
+JOIN projects p ON p.id = s.project_id
+WHERE d.status IN ('queued','pending','building','deploying','rolling_back')
+  AND (p.is_approved OR p.owner_id = $1 OR $2::bool
+    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1))
+ORDER BY d.created_at ASC
+`
+
+type ListActiveOperationDeploymentsParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+}
+
+type ListActiveOperationDeploymentsRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	ServiceName string         `json:"service_name"`
+	ProjectName string         `json:"project_name"`
+	Status      sql.NullString `json:"status"`
+	Image       string         `json:"image"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+}
+
+func (q *Queries) ListActiveOperationDeployments(ctx context.Context, arg ListActiveOperationDeploymentsParams) ([]ListActiveOperationDeploymentsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listActiveOperationDeployments, arg.OwnerID, arg.Column2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListActiveOperationDeploymentsRow{}
+	for rows.Next() {
+		var i ListActiveOperationDeploymentsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ServiceID,
+			&i.ServiceName,
+			&i.ProjectName,
+			&i.Status,
+			&i.Image,
+			&i.Error,
+			&i.StartedAt,
+			&i.CompletedAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRecentCronRuns = `-- name: ListRecentCronRuns :many
+SELECT e.id, j.name AS job_name, j.schedule, e.status, e.started_at, e.finished_at, e.error
+FROM cron_executions e
+JOIN cron_jobs j ON j.id = e.cron_job_id
+JOIN projects p ON p.id = j.project_id
+WHERE e.started_at > NOW() - INTERVAL '24 hours'
+  AND (p.is_approved OR p.owner_id = $1 OR $2::bool
+    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1))
+ORDER BY e.started_at DESC
+LIMIT 30
+`
+
+type ListRecentCronRunsParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+}
+
+type ListRecentCronRunsRow struct {
+	ID         uuid.UUID      `json:"id"`
+	JobName    string         `json:"job_name"`
+	Schedule   string         `json:"schedule"`
+	Status     sql.NullString `json:"status"`
+	StartedAt  time.Time      `json:"started_at"`
+	FinishedAt sql.NullTime   `json:"finished_at"`
+	Error      sql.NullString `json:"error"`
+}
+
+func (q *Queries) ListRecentCronRuns(ctx context.Context, arg ListRecentCronRunsParams) ([]ListRecentCronRunsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRecentCronRuns, arg.OwnerID, arg.Column2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRecentCronRunsRow{}
+	for rows.Next() {
+		var i ListRecentCronRunsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.JobName,
+			&i.Schedule,
+			&i.Status,
+			&i.StartedAt,
+			&i.FinishedAt,
+			&i.Error,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRecentFailedDeployments = `-- name: ListRecentFailedDeployments :many
+SELECT d.id, d.service_id, s.name AS service_name, p.name AS project_name, d.status,
+       COALESCE(d.image_name, '') AS image, d.error, d.started_at, d.completed_at, d.created_at
+FROM deployments d
+JOIN services s ON s.id = d.service_id
+JOIN projects p ON p.id = s.project_id
+WHERE d.status IN ('failed','cancelled','rolled_back')
+  AND d.updated_at > NOW() - INTERVAL '24 hours'
+  AND (p.is_approved OR p.owner_id = $1 OR $2::bool
+    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1))
+ORDER BY d.updated_at DESC
+LIMIT 20
+`
+
+type ListRecentFailedDeploymentsParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+}
+
+type ListRecentFailedDeploymentsRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	ServiceName string         `json:"service_name"`
+	ProjectName string         `json:"project_name"`
+	Status      sql.NullString `json:"status"`
+	Image       string         `json:"image"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+}
+
+func (q *Queries) ListRecentFailedDeployments(ctx context.Context, arg ListRecentFailedDeploymentsParams) ([]ListRecentFailedDeploymentsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRecentFailedDeployments, arg.OwnerID, arg.Column2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRecentFailedDeploymentsRow{}
+	for rows.Next() {
+		var i ListRecentFailedDeploymentsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ServiceID,
+			&i.ServiceName,
+			&i.ProjectName,
+			&i.Status,
+			&i.Image,
+			&i.Error,
+			&i.StartedAt,
+			&i.CompletedAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRecentOperationBackups = `-- name: ListRecentOperationBackups :many
+SELECT b.id, b.database_id, ds.name AS db_name, b.status, b.size, b.created_at, b.completed_at
+FROM database_backups b
+JOIN database_services ds ON ds.id = b.database_id
+WHERE b.created_at > NOW() - INTERVAL '24 hours'
+  AND (ds.user_id = $1 OR $2::bool)
+ORDER BY b.created_at DESC
+LIMIT 20
+`
+
+type ListRecentOperationBackupsParams struct {
+	UserID  string `json:"user_id"`
+	Column2 bool   `json:"column_2"`
+}
+
+type ListRecentOperationBackupsRow struct {
+	ID          string       `json:"id"`
+	DatabaseID  string       `json:"database_id"`
+	DbName      string       `json:"db_name"`
+	Status      string       `json:"status"`
+	Size        string       `json:"size"`
+	CreatedAt   sql.NullTime `json:"created_at"`
+	CompletedAt sql.NullTime `json:"completed_at"`
+}
+
+func (q *Queries) ListRecentOperationBackups(ctx context.Context, arg ListRecentOperationBackupsParams) ([]ListRecentOperationBackupsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRecentOperationBackups, arg.UserID, arg.Column2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRecentOperationBackupsRow{}
+	for rows.Next() {
+		var i ListRecentOperationBackupsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.DatabaseID,
+			&i.DbName,
+			&i.Status,
+			&i.Size,
+			&i.CreatedAt,
+			&i.CompletedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}

app/backend/internal/database/sqlcdb/preview_environments.sql.go

@@ -0,0 +1,635 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: preview_environments.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const countActivePreviewsForBranch = `-- name: CountActivePreviewsForBranch :one
+SELECT COUNT(*) FROM preview_environments
+WHERE service_id = $1 AND branch_name = $2 AND status NOT IN ('expired', 'stopped')
+`
+
+type CountActivePreviewsForBranchParams struct {
+	ServiceID  uuid.UUID `json:"service_id"`
+	BranchName string    `json:"branch_name"`
+}
+
+func (q *Queries) CountActivePreviewsForBranch(ctx context.Context, arg CountActivePreviewsForBranchParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countActivePreviewsForBranch, arg.ServiceID, arg.BranchName)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createPreviewDomain = `-- name: CreatePreviewDomain :exec
+INSERT INTO service_domains (service_id, domain, is_default, cert_type) VALUES ($1, $2, true, 'tls')
+`
+
+type CreatePreviewDomainParams struct {
+	ServiceID uuid.UUID `json:"service_id"`
+	Domain    string    `json:"domain"`
+}
+
+func (q *Queries) CreatePreviewDomain(ctx context.Context, arg CreatePreviewDomainParams) error {
+	_, err := q.db.ExecContext(ctx, createPreviewDomain, arg.ServiceID, arg.Domain)
+	return err
+}
+
+const createPreviewEnvironment = `-- name: CreatePreviewEnvironment :exec
+INSERT INTO preview_environments
+    (id, project_id, service_id, preview_service_id, branch_name, pr_number, environment,
+     status, url, expires_at, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+`
+
+type CreatePreviewEnvironmentParams struct {
+	ID               uuid.UUID      `json:"id"`
+	ProjectID        uuid.UUID      `json:"project_id"`
+	ServiceID        uuid.UUID      `json:"service_id"`
+	PreviewServiceID uuid.NullUUID  `json:"preview_service_id"`
+	BranchName       string         `json:"branch_name"`
+	PrNumber         sql.NullInt32  `json:"pr_number"`
+	Environment      string         `json:"environment"`
+	Status           string         `json:"status"`
+	Url              sql.NullString `json:"url"`
+	ExpiresAt        time.Time      `json:"expires_at"`
+	CreatedAt        sql.NullTime   `json:"created_at"`
+	UpdatedAt        sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) CreatePreviewEnvironment(ctx context.Context, arg CreatePreviewEnvironmentParams) error {
+	_, err := q.db.ExecContext(ctx, createPreviewEnvironment,
+		arg.ID,
+		arg.ProjectID,
+		arg.ServiceID,
+		arg.PreviewServiceID,
+		arg.BranchName,
+		arg.PrNumber,
+		arg.Environment,
+		arg.Status,
+		arg.Url,
+		arg.ExpiresAt,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const deleteAllServiceDomains = `-- name: DeleteAllServiceDomains :exec
+DELETE FROM service_domains WHERE service_id = $1
+`
+
+func (q *Queries) DeleteAllServiceDomains(ctx context.Context, serviceID uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deleteAllServiceDomains, serviceID)
+	return err
+}
+
+const deletePreviewEnvironment = `-- name: DeletePreviewEnvironment :exec
+DELETE FROM preview_environments WHERE id = $1
+`
+
+func (q *Queries) DeletePreviewEnvironment(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deletePreviewEnvironment, id)
+	return err
+}
+
+const getPreviewEnvironment = `-- name: GetPreviewEnvironment :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
+       s.id AS svc_id, s.name AS service_name, s.type AS service_type
+FROM preview_environments pe
+LEFT JOIN services s ON pe.service_id = s.id
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.is_approved OR p.owner_id = $2 OR $3::bool
+    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $2))
+`
+
+type GetPreviewEnvironmentParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+type GetPreviewEnvironmentRow struct {
+	ID               uuid.UUID      `json:"id"`
+	ProjectID        uuid.UUID      `json:"project_id"`
+	ServiceID        uuid.UUID      `json:"service_id"`
+	PreviewServiceID uuid.NullUUID  `json:"preview_service_id"`
+	BranchName       string         `json:"branch_name"`
+	PrNumber         sql.NullInt32  `json:"pr_number"`
+	Environment      string         `json:"environment"`
+	Status           string         `json:"status"`
+	Url              sql.NullString `json:"url"`
+	ExpiresAt        time.Time      `json:"expires_at"`
+	CreatedAt        sql.NullTime   `json:"created_at"`
+	UpdatedAt        sql.NullTime   `json:"updated_at"`
+	SvcID            uuid.NullUUID  `json:"svc_id"`
+	ServiceName      sql.NullString `json:"service_name"`
+	ServiceType      sql.NullString `json:"service_type"`
+}
+
+func (q *Queries) GetPreviewEnvironment(ctx context.Context, arg GetPreviewEnvironmentParams) (GetPreviewEnvironmentRow, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewEnvironment, arg.ID, arg.OwnerID, arg.Column3)
+	var i GetPreviewEnvironmentRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.ServiceID,
+		&i.PreviewServiceID,
+		&i.BranchName,
+		&i.PrNumber,
+		&i.Environment,
+		&i.Status,
+		&i.Url,
+		&i.ExpiresAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.SvcID,
+		&i.ServiceName,
+		&i.ServiceType,
+	)
+	return i, err
+}
+
+const getPreviewEnvironmentForPromote = `-- name: GetPreviewEnvironmentForPromote :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.environment, pe.status
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)
+`
+
+type GetPreviewEnvironmentForPromoteParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+type GetPreviewEnvironmentForPromoteRow struct {
+	ID               uuid.UUID     `json:"id"`
+	ProjectID        uuid.UUID     `json:"project_id"`
+	ServiceID        uuid.UUID     `json:"service_id"`
+	PreviewServiceID uuid.NullUUID `json:"preview_service_id"`
+	BranchName       string        `json:"branch_name"`
+	Environment      string        `json:"environment"`
+	Status           string        `json:"status"`
+}
+
+func (q *Queries) GetPreviewEnvironmentForPromote(ctx context.Context, arg GetPreviewEnvironmentForPromoteParams) (GetPreviewEnvironmentForPromoteRow, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewEnvironmentForPromote, arg.ID, arg.OwnerID, arg.Column3)
+	var i GetPreviewEnvironmentForPromoteRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.ServiceID,
+		&i.PreviewServiceID,
+		&i.BranchName,
+		&i.Environment,
+		&i.Status,
+	)
+	return i, err
+}
+
+const getPreviewEnvironmentForWrite = `-- name: GetPreviewEnvironmentForWrite :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)
+`
+
+type GetPreviewEnvironmentForWriteParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+type GetPreviewEnvironmentForWriteRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ProjectID   uuid.UUID      `json:"project_id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	BranchName  string         `json:"branch_name"`
+	PrNumber    sql.NullInt32  `json:"pr_number"`
+	Environment string         `json:"environment"`
+	Status      string         `json:"status"`
+	Url         sql.NullString `json:"url"`
+	ExpiresAt   time.Time      `json:"expires_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) GetPreviewEnvironmentForWrite(ctx context.Context, arg GetPreviewEnvironmentForWriteParams) (GetPreviewEnvironmentForWriteRow, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewEnvironmentForWrite, arg.ID, arg.OwnerID, arg.Column3)
+	var i GetPreviewEnvironmentForWriteRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.ServiceID,
+		&i.BranchName,
+		&i.PrNumber,
+		&i.Environment,
+		&i.Status,
+		&i.Url,
+		&i.ExpiresAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getPreviewEnvironmentOwner = `-- name: GetPreviewEnvironmentOwner :one
+SELECT p.owner_id
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1
+`
+
+func (q *Queries) GetPreviewEnvironmentOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewEnvironmentOwner, id)
+	var owner_id uuid.UUID
+	err := row.Scan(&owner_id)
+	return owner_id, err
+}
+
+const getPreviewServiceID = `-- name: GetPreviewServiceID :one
+SELECT preview_service_id FROM preview_environments WHERE id = $1
+`
+
+func (q *Queries) GetPreviewServiceID(ctx context.Context, id uuid.UUID) (uuid.NullUUID, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewServiceID, id)
+	var preview_service_id uuid.NullUUID
+	err := row.Scan(&preview_service_id)
+	return preview_service_id, err
+}
+
+const getProjectBrief = `-- name: GetProjectBrief :one
+SELECT id, name, owner_id FROM projects WHERE id = $1
+`
+
+type GetProjectBriefRow struct {
+	ID      uuid.UUID `json:"id"`
+	Name    string    `json:"name"`
+	OwnerID uuid.UUID `json:"owner_id"`
+}
+
+func (q *Queries) GetProjectBrief(ctx context.Context, id uuid.UUID) (GetProjectBriefRow, error) {
+	row := q.db.QueryRowContext(ctx, getProjectBrief, id)
+	var i GetProjectBriefRow
+	err := row.Scan(&i.ID, &i.Name, &i.OwnerID)
+	return i, err
+}
+
+const getServiceForDeploy = `-- name: GetServiceForDeploy :one
+SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
+       s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at
+FROM services s
+WHERE s.id = $1
+`
+
+type GetServiceForDeployRow struct {
+	ID              uuid.UUID      `json:"id"`
+	ProjectID       uuid.UUID      `json:"project_id"`
+	Name            string         `json:"name"`
+	Type            sql.NullString `json:"type"`
+	Status          sql.NullString `json:"status"`
+	Image           sql.NullString `json:"image"`
+	Command         sql.NullString `json:"command"`
+	Environment     sql.NullString `json:"environment"`
+	GitRepo         sql.NullString `json:"git_repo"`
+	GitBranch       sql.NullString `json:"git_branch"`
+	BuildPath       sql.NullString `json:"build_path"`
+	Cpu             sql.NullString `json:"cpu"`
+	Memory          sql.NullString `json:"memory"`
+	Replicas        int32          `json:"replicas"`
+	Port            int32          `json:"port"`
+	Domain          string         `json:"domain"`
+	HealthcheckPath string         `json:"healthcheck_path"`
+	RestartPolicy   string         `json:"restart_policy"`
+	Builder         string         `json:"builder"`
+	CpuReserve      string         `json:"cpu_reserve"`
+	MemoryReserve   string         `json:"memory_reserve"`
+	StaticBuildCmd  string         `json:"static_build_cmd"`
+	StaticDir       string         `json:"static_dir"`
+	CreatedAt       sql.NullTime   `json:"created_at"`
+	UpdatedAt       sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) GetServiceForDeploy(ctx context.Context, id uuid.UUID) (GetServiceForDeployRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceForDeploy, id)
+	var i GetServiceForDeployRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Type,
+		&i.Status,
+		&i.Image,
+		&i.Command,
+		&i.Environment,
+		&i.GitRepo,
+		&i.GitBranch,
+		&i.BuildPath,
+		&i.Cpu,
+		&i.Memory,
+		&i.Replicas,
+		&i.Port,
+		&i.Domain,
+		&i.HealthcheckPath,
+		&i.RestartPolicy,
+		&i.Builder,
+		&i.CpuReserve,
+		&i.MemoryReserve,
+		&i.StaticBuildCmd,
+		&i.StaticDir,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getServiceTypeBrief = `-- name: GetServiceTypeBrief :one
+SELECT id, name, COALESCE(type, service_type, '') AS service_type FROM services WHERE id = $1 AND project_id = $2
+`
+
+type GetServiceTypeBriefParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+type GetServiceTypeBriefRow struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	ServiceType string    `json:"service_type"`
+}
+
+func (q *Queries) GetServiceTypeBrief(ctx context.Context, arg GetServiceTypeBriefParams) (GetServiceTypeBriefRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceTypeBrief, arg.ID, arg.ProjectID)
+	var i GetServiceTypeBriefRow
+	err := row.Scan(&i.ID, &i.Name, &i.ServiceType)
+	return i, err
+}
+
+const insertPendingDeployment = `-- name: InsertPendingDeployment :exec
+INSERT INTO deployments (id, service_id, version, commit_hash, status, created_at, updated_at)
+VALUES ($1, $2, $3, $4, 'pending', NOW(), NOW())
+`
+
+type InsertPendingDeploymentParams struct {
+	ID         uuid.UUID      `json:"id"`
+	ServiceID  uuid.UUID      `json:"service_id"`
+	Version    string         `json:"version"`
+	CommitHash sql.NullString `json:"commit_hash"`
+}
+
+func (q *Queries) InsertPendingDeployment(ctx context.Context, arg InsertPendingDeploymentParams) error {
+	_, err := q.db.ExecContext(ctx, insertPendingDeployment,
+		arg.ID,
+		arg.ServiceID,
+		arg.Version,
+		arg.CommitHash,
+	)
+	return err
+}
+
+const listExpiredPreviewsForUser = `-- name: ListExpiredPreviewsForUser :many
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.environment
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE (p.owner_id = $1 OR $2::bool) AND pe.expires_at < NOW() AND pe.status != 'expired'
+`
+
+type ListExpiredPreviewsForUserParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+}
+
+type ListExpiredPreviewsForUserRow struct {
+	ID               uuid.UUID     `json:"id"`
+	ProjectID        uuid.UUID     `json:"project_id"`
+	ServiceID        uuid.UUID     `json:"service_id"`
+	PreviewServiceID uuid.NullUUID `json:"preview_service_id"`
+	BranchName       string        `json:"branch_name"`
+	Environment      string        `json:"environment"`
+}
+
+func (q *Queries) ListExpiredPreviewsForUser(ctx context.Context, arg ListExpiredPreviewsForUserParams) ([]ListExpiredPreviewsForUserRow, error) {
+	rows, err := q.db.QueryContext(ctx, listExpiredPreviewsForUser, arg.OwnerID, arg.Column2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListExpiredPreviewsForUserRow{}
+	for rows.Next() {
+		var i ListExpiredPreviewsForUserRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.ServiceID,
+			&i.PreviewServiceID,
+			&i.BranchName,
+			&i.Environment,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listPreviewEnvironmentsForProject = `-- name: ListPreviewEnvironmentsForProject :many
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
+       s.id AS svc_id, s.name AS service_name, s.type AS service_type
+FROM preview_environments pe
+LEFT JOIN services s ON pe.service_id = s.id
+WHERE pe.project_id = $1
+ORDER BY pe.created_at DESC
+`
+
+type ListPreviewEnvironmentsForProjectRow struct {
+	ID               uuid.UUID      `json:"id"`
+	ProjectID        uuid.UUID      `json:"project_id"`
+	ServiceID        uuid.UUID      `json:"service_id"`
+	PreviewServiceID uuid.NullUUID  `json:"preview_service_id"`
+	BranchName       string         `json:"branch_name"`
+	PrNumber         sql.NullInt32  `json:"pr_number"`
+	Environment      string         `json:"environment"`
+	Status           string         `json:"status"`
+	Url              sql.NullString `json:"url"`
+	ExpiresAt        time.Time      `json:"expires_at"`
+	CreatedAt        sql.NullTime   `json:"created_at"`
+	UpdatedAt        sql.NullTime   `json:"updated_at"`
+	SvcID            uuid.NullUUID  `json:"svc_id"`
+	ServiceName      sql.NullString `json:"service_name"`
+	ServiceType      sql.NullString `json:"service_type"`
+}
+
+func (q *Queries) ListPreviewEnvironmentsForProject(ctx context.Context, projectID uuid.UUID) ([]ListPreviewEnvironmentsForProjectRow, error) {
+	rows, err := q.db.QueryContext(ctx, listPreviewEnvironmentsForProject, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListPreviewEnvironmentsForProjectRow{}
+	for rows.Next() {
+		var i ListPreviewEnvironmentsForProjectRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.ServiceID,
+			&i.PreviewServiceID,
+			&i.BranchName,
+			&i.PrNumber,
+			&i.Environment,
+			&i.Status,
+			&i.Url,
+			&i.ExpiresAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.SvcID,
+			&i.ServiceName,
+			&i.ServiceType,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listSweepablePreviews = `-- name: ListSweepablePreviews :many
+SELECT id, preview_service_id FROM preview_environments
+WHERE expires_at < NOW() AND status NOT IN ('expired', 'stopped')
+`
+
+type ListSweepablePreviewsRow struct {
+	ID               uuid.UUID     `json:"id"`
+	PreviewServiceID uuid.NullUUID `json:"preview_service_id"`
+}
+
+func (q *Queries) ListSweepablePreviews(ctx context.Context) ([]ListSweepablePreviewsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listSweepablePreviews)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListSweepablePreviewsRow{}
+	for rows.Next() {
+		var i ListSweepablePreviewsRow
+		if err := rows.Scan(&i.ID, &i.PreviewServiceID); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const markPreviewEnvironmentStatus = `-- name: MarkPreviewEnvironmentStatus :exec
+UPDATE preview_environments SET status = $1, updated_at = NOW() WHERE id = $2
+`
+
+type MarkPreviewEnvironmentStatusParams struct {
+	Status string    `json:"status"`
+	ID     uuid.UUID `json:"id"`
+}
+
+func (q *Queries) MarkPreviewEnvironmentStatus(ctx context.Context, arg MarkPreviewEnvironmentStatusParams) error {
+	_, err := q.db.ExecContext(ctx, markPreviewEnvironmentStatus, arg.Status, arg.ID)
+	return err
+}
+
+const syncPreviewStatuses = `-- name: SyncPreviewStatuses :exec
+UPDATE preview_environments pe
+SET status = derived.st, updated_at = NOW()
+FROM (
+    SELECT pe2.id,
+        CASE
+            WHEN s.status IN ('running', 'deployed') THEN 'running'
+            WHEN s.status IN ('failed', 'error') THEN 'failed'
+            WHEN s.status IN ('building', 'deploying', 'queued', 'pending', 'cloning') THEN 'building'
+            ELSE pe2.status
+        END AS st
+    FROM preview_environments pe2
+    JOIN services s ON pe2.preview_service_id = s.id
+) derived
+WHERE pe.id = derived.id
+  AND pe.status IN ('building', 'running', 'failed')
+  AND pe.status <> derived.st
+`
+
+func (q *Queries) SyncPreviewStatuses(ctx context.Context) error {
+	_, err := q.db.ExecContext(ctx, syncPreviewStatuses)
+	return err
+}
+
+const updatePreviewEnvironment = `-- name: UpdatePreviewEnvironment :exec
+UPDATE preview_environments
+SET status = $1, url = $2, expires_at = $3, updated_at = $4
+WHERE id = $5
+`
+
+type UpdatePreviewEnvironmentParams struct {
+	Status    string         `json:"status"`
+	Url       sql.NullString `json:"url"`
+	ExpiresAt time.Time      `json:"expires_at"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+	ID        uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) UpdatePreviewEnvironment(ctx context.Context, arg UpdatePreviewEnvironmentParams) error {
+	_, err := q.db.ExecContext(ctx, updatePreviewEnvironment,
+		arg.Status,
+		arg.Url,
+		arg.ExpiresAt,
+		arg.UpdatedAt,
+		arg.ID,
+	)
+	return err
+}
+
+const updateServicePreviewBranch = `-- name: UpdateServicePreviewBranch :exec
+UPDATE services SET git_branch = $1, domain = '', updated_at = NOW() WHERE id = $2
+`
+
+type UpdateServicePreviewBranchParams struct {
+	GitBranch sql.NullString `json:"git_branch"`
+	ID        uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) UpdateServicePreviewBranch(ctx context.Context, arg UpdateServicePreviewBranchParams) error {
+	_, err := q.db.ExecContext(ctx, updateServicePreviewBranch, arg.GitBranch, arg.ID)
+	return err
+}

app/backend/internal/database/sqlcdb/projects.sql.go

@@ -12,6 +12,17 @@ import (
 	"github.com/google/uuid"
 )
 
+const countEnvironmentServices = `-- name: CountEnvironmentServices :one
+SELECT COUNT(*) FROM services WHERE environment_id = $1
+`
+
+func (q *Queries) CountEnvironmentServices(ctx context.Context, environmentID uuid.UUID) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countEnvironmentServices, environmentID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
 const countProjectsByUser = `-- name: CountProjectsByUser :one
 SELECT COUNT(*)::bigint AS total
 FROM projects p
@@ -86,6 +97,20 @@ func (q *Queries) DeleteProjectByID(ctx context.Context, projectID uuid.UUID) (i
 	return result.RowsAffected()
 }
 
+const deleteProjectEnvironment = `-- name: DeleteProjectEnvironment :exec
+DELETE FROM environments WHERE id = $1 AND project_id = $2
+`
+
+type DeleteProjectEnvironmentParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) DeleteProjectEnvironment(ctx context.Context, arg DeleteProjectEnvironmentParams) error {
+	_, err := q.db.ExecContext(ctx, deleteProjectEnvironment, arg.ID, arg.ProjectID)
+	return err
+}
+
 const getProjectByIDForUser = `-- name: GetProjectByIDForUser :one
 SELECT p.id, p.name, p.description, p.owner_id, p.is_approved, p.created_at, p.updated_at
 FROM projects p
@@ -123,6 +148,30 @@ func (q *Queries) GetProjectByIDForUser(ctx context.Context, arg GetProjectByIDF
 	return i, err
 }
 
+const getProjectEnvironmentByName = `-- name: GetProjectEnvironmentByName :one
+SELECT id, name, project_id, created_at, updated_at
+FROM environments
+WHERE project_id = $1 AND name = $2
+`
+
+type GetProjectEnvironmentByNameParams struct {
+	ProjectID uuid.UUID `json:"project_id"`
+	Name      string    `json:"name"`
+}
+
+func (q *Queries) GetProjectEnvironmentByName(ctx context.Context, arg GetProjectEnvironmentByNameParams) (Environment, error) {
+	row := q.db.QueryRowContext(ctx, getProjectEnvironmentByName, arg.ProjectID, arg.Name)
+	var i Environment
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.ProjectID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
 const getProjectOwnerByID = `-- name: GetProjectOwnerByID :one
 SELECT owner_id
 FROM projects
@@ -212,6 +261,53 @@ func (q *Queries) ListPendingProjects(ctx context.Context) ([]Project, error) {
 	return items, nil
 }
 
+const listProjectEnvironments = `-- name: ListProjectEnvironments :many
+SELECT e.id, e.name, e.project_id, e.created_at, e.updated_at,
+       (SELECT COUNT(*) FROM services s WHERE s.environment_id = e.id) AS service_count
+FROM environments e
+WHERE e.project_id = $1
+ORDER BY e.created_at
+`
+
+type ListProjectEnvironmentsRow struct {
+	ID           uuid.UUID    `json:"id"`
+	Name         string       `json:"name"`
+	ProjectID    uuid.UUID    `json:"project_id"`
+	CreatedAt    sql.NullTime `json:"created_at"`
+	UpdatedAt    sql.NullTime `json:"updated_at"`
+	ServiceCount int64        `json:"service_count"`
+}
+
+func (q *Queries) ListProjectEnvironments(ctx context.Context, projectID uuid.UUID) ([]ListProjectEnvironmentsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listProjectEnvironments, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListProjectEnvironmentsRow{}
+	for rows.Next() {
+		var i ListProjectEnvironmentsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.ProjectID,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.ServiceCount,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listProjectsWithStatsByUser = `-- name: ListProjectsWithStatsByUser :many
 
 SELECT

app/backend/internal/database/sqlcdb/querier.go

@@ -7,17 +7,43 @@ package sqlcdb
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 
 	"github.com/google/uuid"
 )
 
 type Querier interface {
+	// Portable bucket bucketing (no TimescaleDB): floor epoch seconds into
+	// bucket-sized buckets, then back to timestamptz.
+	AggregateNodeMetrics(ctx context.Context, arg AggregateNodeMetricsParams) ([]AggregateNodeMetricsRow, error)
+	CancelBuild(ctx context.Context, arg CancelBuildParams) (int64, error)
+	CheckSecurityProjectAccess(ctx context.Context, arg CheckSecurityProjectAccessParams) (bool, error)
+	ClearServiceDomainDefault(ctx context.Context, serviceID uuid.UUID) error
+	ClearServiceNodePins(ctx context.Context, nodeID sql.NullString) (int64, error)
+	CloneServiceDomains(ctx context.Context, arg CloneServiceDomainsParams) error
+	CloneServiceRow(ctx context.Context, arg CloneServiceRowParams) error
+	CloneServiceVariables(ctx context.Context, arg CloneServiceVariablesParams) error
 	CompleteCommand(ctx context.Context, arg CompleteCommandParams) (AgentCommand, error)
+	CompleteDeployment(ctx context.Context, arg CompleteDeploymentParams) error
+	ComplianceFrameworkExists(ctx context.Context, id uuid.UUID) (bool, error)
+	CountAPKeys(ctx context.Context) (int64, error)
+	CountAPServices(ctx context.Context) (int64, error)
+	CountAccessibleDeployments(ctx context.Context, arg CountAccessibleDeploymentsParams) (int64, error)
+	CountActivePreviewsForBranch(ctx context.Context, arg CountActivePreviewsForBranchParams) (int64, error)
 	CountDatabaseServicesByUserAndName(ctx context.Context, arg CountDatabaseServicesByUserAndNameParams) (int64, error)
 	CountDatabasesUsingBackupTarget(ctx context.Context, targetID sql.NullString) (int64, error)
+	CountDeploymentsForService(ctx context.Context, serviceID uuid.UUID) (int64, error)
+	CountEnvironmentServices(ctx context.Context, environmentID uuid.UUID) (int64, error)
+	CountGitRepositories(ctx context.Context, arg CountGitRepositoriesParams) (int64, error)
+	CountProjects(ctx context.Context) (int64, error)
 	CountProjectsByUser(ctx context.Context, arg CountProjectsByUserParams) (int64, error)
+	CountServiceDomains(ctx context.Context, serviceID uuid.UUID) (int64, error)
+	CountServicesByName(ctx context.Context, arg CountServicesByNameParams) (int64, error)
 	CountServicesByProjectAndName(ctx context.Context, arg CountServicesByProjectAndNameParams) (int64, error)
 	CountUnreadNotificationsByUser(ctx context.Context, userID uuid.UUID) (int64, error)
+	CountUserRepositories(ctx context.Context, userID uuid.UUID) (int64, error)
+	CountUsers(ctx context.Context) (int64, error)
+	CountUsersByEmail(ctx context.Context, email string) (int64, error)
 	CreateAgent(ctx context.Context, arg CreateAgentParams) (NodeAgent, error)
 	CreateAgentAuthToken(ctx context.Context, arg CreateAgentAuthTokenParams) (AgentAuthToken, error)
 	CreateBackupTarget(ctx context.Context, arg CreateBackupTargetParams) error
@@ -29,7 +55,10 @@ type Querier interface {
 	CreateExternalDatabaseService(ctx context.Context, arg CreateExternalDatabaseServiceParams) error
 	CreateNotification(ctx context.Context, arg CreateNotificationParams) error
 	CreateOutboundWebhook(ctx context.Context, arg CreateOutboundWebhookParams) error
+	CreatePreviewDomain(ctx context.Context, arg CreatePreviewDomainParams) error
+	CreatePreviewEnvironment(ctx context.Context, arg CreatePreviewEnvironmentParams) error
 	CreateProject(ctx context.Context, arg CreateProjectParams) (Project, error)
+	CreateServiceDomain(ctx context.Context, arg CreateServiceDomainParams) (CreateServiceDomainRow, error)
 	CreateServiceFromTemplate(ctx context.Context, arg CreateServiceFromTemplateParams) error
 	CreateUserInvite(ctx context.Context, arg CreateUserInviteParams) (UserInvite, error)
 	CreateUserTemplate(ctx context.Context, arg CreateUserTemplateParams) error
@@ -37,70 +66,247 @@ type Querier interface {
 	CreateWebhookDelivery(ctx context.Context, arg CreateWebhookDeliveryParams) error
 	DatabaseServiceExistsByIDAndUser(ctx context.Context, arg DatabaseServiceExistsByIDAndUserParams) (bool, error)
 	DeleteAgent(ctx context.Context, id string) error
+	DeleteAllServiceDomains(ctx context.Context, serviceID uuid.UUID) error
+	DeleteAppSetting(ctx context.Context, key string) error
 	DeleteBackupTargetByIDAndUser(ctx context.Context, arg DeleteBackupTargetByIDAndUserParams) error
 	DeleteBanner(ctx context.Context, id uuid.UUID) error
+	DeleteCronJob(ctx context.Context, id uuid.UUID) error
 	DeleteDatabaseServiceByID(ctx context.Context, id string) error
 	DeleteDatabaseServiceByIDAndUser(ctx context.Context, arg DeleteDatabaseServiceByIDAndUserParams) error
+	DeleteEnvVarsForService(ctx context.Context, serviceID uuid.UUID) error
+	DeleteGitProvider(ctx context.Context, arg DeleteGitProviderParams) (int64, error)
+	DeleteNotificationChannel(ctx context.Context, arg DeleteNotificationChannelParams) (int64, error)
 	DeleteOutboundWebhookByIDAndUser(ctx context.Context, arg DeleteOutboundWebhookByIDAndUserParams) error
+	DeletePreviewEnvironment(ctx context.Context, id uuid.UUID) error
 	DeleteProjectByID(ctx context.Context, projectID uuid.UUID) (int64, error)
+	DeleteProjectEnvironment(ctx context.Context, arg DeleteProjectEnvironmentParams) error
+	DeleteProjectVariables(ctx context.Context, projectID uuid.UUID) error
+	DeleteServiceByID(ctx context.Context, id uuid.UUID) error
+	DeleteServiceContainersOnAgent(ctx context.Context, arg DeleteServiceContainersOnAgentParams) error
+	DeleteServiceDomain(ctx context.Context, arg DeleteServiceDomainParams) (int64, error)
 	DeleteUserInvite(ctx context.Context, id uuid.UUID) error
 	DeleteUserTemplate(ctx context.Context, arg DeleteUserTemplateParams) (int64, error)
+	FailDeployment(ctx context.Context, arg FailDeploymentParams) error
+	FailInterruptedDeployments(ctx context.Context) error
+	FinishCronExecution(ctx context.Context, arg FinishCronExecutionParams) error
+	GetAPServiceBySlug(ctx context.Context, slug string) (GetAPServiceBySlugRow, error)
+	GetAPServiceForValidate(ctx context.Context, id uuid.UUID) (GetAPServiceForValidateRow, error)
 	GetActiveAgentAuthTokenByHash(ctx context.Context, tokenHash string) (AgentAuthToken, error)
+	GetAdminUserInfo(ctx context.Context, id uuid.UUID) (GetAdminUserInfoRow, error)
 	GetAgent(ctx context.Context, id string) (NodeAgent, error)
 	GetAgentByHostAndIP(ctx context.Context, arg GetAgentByHostAndIPParams) (NodeAgent, error)
+	GetAppSetting(ctx context.Context, key string) (string, error)
 	GetBackupTargetByID(ctx context.Context, id string) (BackupTarget, error)
 	GetBackupTargetByIDAndUser(ctx context.Context, arg GetBackupTargetByIDAndUserParams) (BackupTarget, error)
 	GetBannerByID(ctx context.Context, id uuid.UUID) (Banner, error)
+	GetBuild(ctx context.Context, id string) (GetBuildRow, error)
 	GetCommandForAgent(ctx context.Context, arg GetCommandForAgentParams) (AgentCommand, error)
+	GetComplianceReportProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
 	GetContainer(ctx context.Context, id string) (ContainerInstance, error)
 	GetContainerForAgent(ctx context.Context, arg GetContainerForAgentParams) (ContainerInstance, error)
+	GetCronJob(ctx context.Context, id uuid.UUID) (CronJob, error)
+	GetCronJobForTrigger(ctx context.Context, id uuid.UUID) (GetCronJobForTriggerRow, error)
+	GetCronJobOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	GetCronJobProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	GetCronOwnerViaService(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
 	GetDatabaseBackupByIDAndDatabaseAndUser(ctx context.Context, arg GetDatabaseBackupByIDAndDatabaseAndUserParams) (DatabaseBackup, error)
 	GetDatabaseServiceByID(ctx context.Context, id string) (DatabaseService, error)
 	GetDatabaseServiceByIDAndUser(ctx context.Context, arg GetDatabaseServiceByIDAndUserParams) (DatabaseService, error)
 	GetDatabaseServiceOwnerID(ctx context.Context, id string) (string, error)
+	GetDeploymentAccess(ctx context.Context, id uuid.UUID) (GetDeploymentAccessRow, error)
+	GetDeploymentForRollback(ctx context.Context, id uuid.UUID) (GetDeploymentForRollbackRow, error)
+	GetDeploymentWithProject(ctx context.Context, id uuid.UUID) (GetDeploymentWithProjectRow, error)
+	GetEnvironmentProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	GetGitProviderForFetch(ctx context.Context, arg GetGitProviderForFetchParams) (GetGitProviderForFetchRow, error)
+	GetGitProviderForRepos(ctx context.Context, arg GetGitProviderForReposParams) (GetGitProviderForReposRow, error)
+	GetGitProviderName(ctx context.Context, arg GetGitProviderNameParams) (string, error)
+	GetGitProviderNameByID(ctx context.Context, id uuid.UUID) (string, error)
+	GetGitProviderTimestamps(ctx context.Context, id uuid.UUID) (GetGitProviderTimestampsRow, error)
+	GetGitRepoCloneByFullName(ctx context.Context, arg GetGitRepoCloneByFullNameParams) (GetGitRepoCloneByFullNameRow, error)
+	GetGitRepoForPush(ctx context.Context, id uuid.UUID) (GetGitRepoForPushRow, error)
+	GetGitRepoProviderByCloneURL(ctx context.Context, arg GetGitRepoProviderByCloneURLParams) (uuid.UUID, error)
+	GetGitRepositoryByFullName(ctx context.Context, arg GetGitRepositoryByFullNameParams) (GetGitRepositoryByFullNameRow, error)
+	GetGitRepositoryProviderID(ctx context.Context, arg GetGitRepositoryProviderIDParams) (uuid.UUID, error)
+	GetGitWebhookForPush(ctx context.Context, id uuid.UUID) (GetGitWebhookForPushRow, error)
+	GetLastAgentCommandByType(ctx context.Context, arg GetLastAgentCommandByTypeParams) (AgentCommand, error)
+	GetLastDeployedImage(ctx context.Context, serviceID uuid.UUID) (string, error)
+	GetLatestComplianceReport(ctx context.Context, projectID uuid.UUID) (GetLatestComplianceReportRow, error)
+	GetLatestSecurityScan(ctx context.Context, projectID uuid.UUID) (GetLatestSecurityScanRow, error)
+	GetNodeAgentName(ctx context.Context, id string) (string, error)
 	GetOutboundWebhookByID(ctx context.Context, id uuid.UUID) (OutboundWebhook, error)
 	GetOutboundWebhookByIDAndUser(ctx context.Context, arg GetOutboundWebhookByIDAndUserParams) (OutboundWebhook, error)
+	GetPreviewEnvironment(ctx context.Context, arg GetPreviewEnvironmentParams) (GetPreviewEnvironmentRow, error)
+	GetPreviewEnvironmentForPromote(ctx context.Context, arg GetPreviewEnvironmentForPromoteParams) (GetPreviewEnvironmentForPromoteRow, error)
+	GetPreviewEnvironmentForWrite(ctx context.Context, arg GetPreviewEnvironmentForWriteParams) (GetPreviewEnvironmentForWriteRow, error)
+	GetPreviewEnvironmentOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	GetPreviewServiceID(ctx context.Context, id uuid.UUID) (uuid.NullUUID, error)
+	GetProjectBrief(ctx context.Context, id uuid.UUID) (GetProjectBriefRow, error)
 	GetProjectByIDForUser(ctx context.Context, arg GetProjectByIDForUserParams) (Project, error)
+	GetProjectEnvironmentByName(ctx context.Context, arg GetProjectEnvironmentByNameParams) (Environment, error)
+	GetProjectOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
 	GetProjectOwnerByID(ctx context.Context, projectID uuid.UUID) (uuid.UUID, error)
 	GetProjectOwnerID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	GetProjectOwnerText(ctx context.Context, id uuid.UUID) (string, error)
+	GetProjectReadAccess(ctx context.Context, id uuid.UUID) (GetProjectReadAccessRow, error)
 	GetProjectRoleForUser(ctx context.Context, arg GetProjectRoleForUserParams) (string, error)
+	GetProjectVariableValue(ctx context.Context, arg GetProjectVariableValueParams) (string, error)
+	GetRegistryAuth(ctx context.Context, arg GetRegistryAuthParams) (GetRegistryAuthRow, error)
+	GetSecurityScanProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	GetServiceAccess(ctx context.Context, id uuid.UUID) (GetServiceAccessRow, error)
+	GetServiceDomainDefault(ctx context.Context, serviceID uuid.UUID) (string, error)
+	GetServiceDomainFirst(ctx context.Context, serviceID uuid.UUID) (string, error)
+	GetServiceDomainText(ctx context.Context, id uuid.UUID) (string, error)
+	GetServiceEnvironment(ctx context.Context, id uuid.UUID) (string, error)
+	GetServiceForDeploy(ctx context.Context, id uuid.UUID) (GetServiceForDeployRow, error)
+	GetServiceForDeployWithOwner(ctx context.Context, id uuid.UUID) (GetServiceForDeployWithOwnerRow, error)
+	GetServiceNameProjectPort(ctx context.Context, id uuid.UUID) (GetServiceNameProjectPortRow, error)
+	GetServiceNodeID(ctx context.Context, id uuid.UUID) (sql.NullString, error)
+	GetServicePlacementBrief(ctx context.Context, id uuid.UUID) (GetServicePlacementBriefRow, error)
+	GetServicePlacementTags(ctx context.Context, id uuid.UUID) (json.RawMessage, error)
+	GetServicePort(ctx context.Context, id uuid.UUID) (int32, error)
+	GetServiceProjectAndStatus(ctx context.Context, id uuid.UUID) (GetServiceProjectAndStatusRow, error)
+	GetServiceProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	GetServicePublishedPort(ctx context.Context, id uuid.UUID) (int32, error)
+	GetServiceRuntimeWithOwner(ctx context.Context, id uuid.UUID) (GetServiceRuntimeWithOwnerRow, error)
+	GetServiceSleep(ctx context.Context, id uuid.UUID) (GetServiceSleepRow, error)
+	GetServiceSpread(ctx context.Context, id uuid.UUID) (bool, error)
+	GetServiceStatusText(ctx context.Context, id uuid.UUID) (string, error)
 	GetServiceTemplateByID(ctx context.Context, id string) (ServiceTemplate, error)
+	GetServiceTraefikLabels(ctx context.Context, id uuid.UUID) (json.RawMessage, error)
+	GetServiceTypeBrief(ctx context.Context, arg GetServiceTypeBriefParams) (GetServiceTypeBriefRow, error)
+	GetServiceVariableValue(ctx context.Context, arg GetServiceVariableValueParams) (string, error)
+	GetServiceVolumes(ctx context.Context, id uuid.UUID) (json.RawMessage, error)
+	GetUserByEmailForAuth(ctx context.Context, email string) (GetUserByEmailForAuthRow, error)
+	GetUserByID(ctx context.Context, id uuid.UUID) (GetUserByIDRow, error)
 	GetUserInviteByTokenHash(ctx context.Context, tokenHash string) (UserInvite, error)
+	GetUserIsAdmin(ctx context.Context, id uuid.UUID) (bool, error)
 	GetUserTokenByHash(ctx context.Context, tokenHash string) (UserToken, error)
+	GetVulnerabilityMetrics(ctx context.Context, projectID uuid.UUID) (GetVulnerabilityMetricsRow, error)
+	GetVulnerabilityProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	InsertAPKey(ctx context.Context, arg InsertAPKeyParams) (uuid.UUID, error)
+	InsertAPService(ctx context.Context, arg InsertAPServiceParams) (uuid.UUID, error)
 	InsertAgentHeartbeat(ctx context.Context, arg InsertAgentHeartbeatParams) error
+	InsertAuditLog(ctx context.Context, arg InsertAuditLogParams) error
+	InsertAuditLogWithRequest(ctx context.Context, arg InsertAuditLogWithRequestParams) error
+	InsertCronExecution(ctx context.Context, arg InsertCronExecutionParams) error
+	InsertCronJob(ctx context.Context, arg InsertCronJobParams) error
+	InsertDeployment(ctx context.Context, arg InsertDeploymentParams) error
+	InsertEnvVar(ctx context.Context, arg InsertEnvVarParams) error
+	InsertGatewayIncident(ctx context.Context, arg InsertGatewayIncidentParams) error
+	InsertGitProvider(ctx context.Context, arg InsertGitProviderParams) error
+	InsertGitRepository(ctx context.Context, arg InsertGitRepositoryParams) (InsertGitRepositoryRow, error)
+	InsertMetricPoint(ctx context.Context, labelsJson sql.NullString) error
+	InsertNotificationChannel(ctx context.Context, arg InsertNotificationChannelParams) (NotificationChannel, error)
+	InsertPendingDeployment(ctx context.Context, arg InsertPendingDeploymentParams) error
 	InsertProjectEnvironment(ctx context.Context, arg InsertProjectEnvironmentParams) error
+	InsertProjectVariable(ctx context.Context, arg InsertProjectVariableParams) error
+	InsertServiceIncident(ctx context.Context, arg InsertServiceIncidentParams) error
+	InsertUser(ctx context.Context, arg InsertUserParams) (InsertUserRow, error)
+	InsertUserAdmin(ctx context.Context, arg InsertUserAdminParams) (InsertUserAdminRow, error)
+	ListAPKeys(ctx context.Context) ([]ListAPKeysRow, error)
+	ListAPKeysByPrefix(ctx context.Context, keyPrefix string) ([]ListAPKeysByPrefixRow, error)
+	ListAPServices(ctx context.Context) ([]ListAPServicesRow, error)
 	ListActiveBanners(ctx context.Context) ([]Banner, error)
+	ListActiveOperationDeployments(ctx context.Context, arg ListActiveOperationDeploymentsParams) ([]ListActiveOperationDeploymentsRow, error)
+	ListAdminUserIDs(ctx context.Context) ([]uuid.UUID, error)
+	ListAdminUsers(ctx context.Context) ([]ListAdminUsersRow, error)
 	ListAgentAuthTokens(ctx context.Context) ([]AgentAuthToken, error)
+	ListAgentHealthRows(ctx context.Context, lastHeartbeat sql.NullTime) ([]ListAgentHealthRowsRow, error)
 	ListAgentHeartbeatsSince(ctx context.Context, arg ListAgentHeartbeatsSinceParams) ([]AgentHeartbeat, error)
 	ListAgents(ctx context.Context) ([]NodeAgent, error)
 	ListAllDatabaseServices(ctx context.Context) ([]DatabaseService, error)
+	ListAllNotificationChannelsByUser(ctx context.Context, userID uuid.UUID) ([]NotificationChannel, error)
+	ListAuditBackfillBatch(ctx context.Context, dollar_1 uuid.UUID) ([]ListAuditBackfillBatchRow, error)
 	ListBackupTargetsByUser(ctx context.Context, userID string) ([]BackupTarget, error)
 	ListBanners(ctx context.Context) ([]Banner, error)
+	ListClientEventPaths(ctx context.Context) ([]ListClientEventPathsRow, error)
 	ListCommandsForAgent(ctx context.Context, nodeAgentID string) ([]AgentCommand, error)
+	ListComplianceFrameworks(ctx context.Context) ([]ListComplianceFrameworksRow, error)
+	ListConnectedRepositories(ctx context.Context, arg ListConnectedRepositoriesParams) ([]ListConnectedRepositoriesRow, error)
 	ListContainersForAgent(ctx context.Context, nodeAgentID string) ([]ContainerInstance, error)
+	ListCronExecutions(ctx context.Context, cronJobID uuid.UUID) ([]CronExecution, error)
 	ListDatabaseBackupsByDatabaseAndUser(ctx context.Context, arg ListDatabaseBackupsByDatabaseAndUserParams) ([]DatabaseBackup, error)
 	ListDatabaseServicesByProject(ctx context.Context, projectID uuid.NullUUID) ([]DatabaseService, error)
 	ListDatabaseServicesByUser(ctx context.Context, userID string) ([]DatabaseService, error)
+	ListDeploymentsForService(ctx context.Context, arg ListDeploymentsForServiceParams) ([]ListDeploymentsForServiceRow, error)
+	ListDueCronJobs(ctx context.Context) ([]ListDueCronJobsRow, error)
 	ListDueDatabaseBackups(ctx context.Context) ([]ListDueDatabaseBackupsRow, error)
 	ListEnabledOutboundWebhooks(ctx context.Context) ([]OutboundWebhook, error)
+	ListExpiredPreviewsForUser(ctx context.Context, arg ListExpiredPreviewsForUserParams) ([]ListExpiredPreviewsForUserRow, error)
+	ListGitProviders(ctx context.Context, userID uuid.UUID) ([]ListGitProvidersRow, error)
+	ListGitRepositories(ctx context.Context, arg ListGitRepositoriesParams) ([]ListGitRepositoriesRow, error)
+	ListIncidentStatusCodes(ctx context.Context) ([]ListIncidentStatusCodesRow, error)
+	ListInstanceMetrics(ctx context.Context, arg ListInstanceMetricsParams) ([]ListInstanceMetricsRow, error)
+	ListNodeAgentsForService(ctx context.Context, serviceID string) ([]string, error)
+	ListNodeMetrics(ctx context.Context, arg ListNodeMetricsParams) ([]ListNodeMetricsRow, error)
+	ListNotificationChannelsByUser(ctx context.Context, userID uuid.UUID) ([]NotificationChannel, error)
 	ListNotificationsByUser(ctx context.Context, arg ListNotificationsByUserParams) ([]Notification, error)
 	ListOutboundWebhooksByUser(ctx context.Context, userID uuid.UUID) ([]OutboundWebhook, error)
 	ListPendingCommands(ctx context.Context, nodeAgentID string) ([]AgentCommand, error)
 	ListPendingProjects(ctx context.Context) ([]Project, error)
+	ListPreviewEnvironmentsForProject(ctx context.Context, projectID uuid.UUID) ([]ListPreviewEnvironmentsForProjectRow, error)
+	ListProjectEnvironments(ctx context.Context, projectID uuid.UUID) ([]ListProjectEnvironmentsRow, error)
+	ListProjectServiceRefs(ctx context.Context, projectID uuid.UUID) ([]ListProjectServiceRefsRow, error)
 	// Visibility model: a project is readable when it is approved for public
 	// display, when the caller owns or is a member of it, or when the caller is a
 	// platform admin. Anonymous callers pass user_id = uuid.Nil, is_admin = false.
 	ListProjectsWithStatsByUser(ctx context.Context, arg ListProjectsWithStatsByUserParams) ([]ListProjectsWithStatsByUserRow, error)
+	ListRecentAccessibleDeployments(ctx context.Context, arg ListRecentAccessibleDeploymentsParams) ([]ListRecentAccessibleDeploymentsRow, error)
+	ListRecentCronRuns(ctx context.Context, arg ListRecentCronRunsParams) ([]ListRecentCronRunsRow, error)
+	ListRecentFailedDeployments(ctx context.Context, arg ListRecentFailedDeploymentsParams) ([]ListRecentFailedDeploymentsRow, error)
+	ListRecentOperationBackups(ctx context.Context, arg ListRecentOperationBackupsParams) ([]ListRecentOperationBackupsRow, error)
+	ListRequestsByDay(ctx context.Context) ([]ListRequestsByDayRow, error)
+	ListResourceAuditLogs(ctx context.Context, arg ListResourceAuditLogsParams) ([]ListResourceAuditLogsRow, error)
+	// Base domains of every online, schedulable agent carrying the required
+	// placement tags — auto-domain candidates for spread services.
+	ListSchedulableAgentDomains(ctx context.Context, dollar_1 json.RawMessage) ([]string, error)
+	ListSchedulableAgents(ctx context.Context) ([]ListSchedulableAgentsRow, error)
+	// Only agents carrying every required placement tag (jsonb array containment).
+	ListSchedulableAgentsMatching(ctx context.Context, dollar_1 json.RawMessage) ([]ListSchedulableAgentsMatchingRow, error)
+	ListSecretEnvVars(ctx context.Context) ([]ListSecretEnvVarsRow, error)
+	// Distinct agents holding inventory rows for a service.
+	ListServiceAgents(ctx context.Context, serviceID string) ([]string, error)
+	ListServiceContainers(ctx context.Context, serviceID string) ([]ListServiceContainersRow, error)
+	ListServiceDomains(ctx context.Context, serviceID uuid.UUID) ([]ServiceDomain, error)
+	ListServiceMetrics(ctx context.Context, arg ListServiceMetricsParams) ([]ListServiceMetricsRow, error)
 	ListServiceTemplatesByCategoryForUser(ctx context.Context, arg ListServiceTemplatesByCategoryForUserParams) ([]ServiceTemplate, error)
 	ListServiceTemplatesForUser(ctx context.Context, ownerID uuid.NullUUID) ([]ServiceTemplate, error)
+	ListServiceVariableValues(ctx context.Context, serviceID uuid.UUID) ([]ListServiceVariableValuesRow, error)
+	ListServiceVariablesWithSecret(ctx context.Context, serviceID uuid.UUID) ([]ListServiceVariablesWithSecretRow, error)
+	ListServicesForPush(ctx context.Context, arg ListServicesForPushParams) ([]ListServicesForPushRow, error)
+	ListSleepCandidates(ctx context.Context) ([]ListSleepCandidatesRow, error)
+	ListSweepablePreviews(ctx context.Context) ([]ListSweepablePreviewsRow, error)
+	ListTopAPServices(ctx context.Context) ([]ListTopAPServicesRow, error)
 	ListUserInvites(ctx context.Context) ([]UserInvite, error)
 	ListUserTokens(ctx context.Context, userID uuid.UUID) ([]UserToken, error)
+	ListVulnerabilities(ctx context.Context, projectID uuid.UUID) ([]ListVulnerabilitiesRow, error)
 	ListWebhookDeliveriesByWebhook(ctx context.Context, webhookID uuid.UUID) ([]WebhookDelivery, error)
 	MarkAllNotificationsReadByUser(ctx context.Context, arg MarkAllNotificationsReadByUserParams) error
 	MarkNotificationReadByIDAndUser(ctx context.Context, arg MarkNotificationReadByIDAndUserParams) error
+	MarkPreviewEnvironmentStatus(ctx context.Context, arg MarkPreviewEnvironmentStatusParams) error
 	MarkUserInviteUsed(ctx context.Context, arg MarkUserInviteUsedParams) error
+	MoveServiceProject(ctx context.Context, arg MoveServiceProjectParams) (int64, error)
+	// Resource-aware: lowest memory utilisation first, then cpu, then container
+	// count. Agents without telemetry sort last (NULL → worst score).
+	PickLeastLoadedAgent(ctx context.Context) (string, error)
+	// Same resource-aware ordering as PickLeastLoadedAgent, restricted to agents
+	// carrying every required placement tag.
+	PickLeastLoadedAgentMatching(ctx context.Context, dollar_1 json.RawMessage) (string, error)
+	ProjectMemberExists(ctx context.Context, arg ProjectMemberExistsParams) (bool, error)
+	PruneAuditLogs(ctx context.Context, dollar_1 int32) (int64, error)
 	RevokeAgentAuthToken(ctx context.Context, id uuid.UUID) (AgentAuthToken, error)
 	RevokeUserToken(ctx context.Context, arg RevokeUserTokenParams) (int64, error)
+	ScrubCommandPayload(ctx context.Context, arg ScrubCommandPayloadParams) error
+	ServiceExistsInProject(ctx context.Context, arg ServiceExistsInProjectParams) (bool, error)
+	ServiceWriteAccess(ctx context.Context, arg ServiceWriteAccessParams) (bool, error)
+	SetAPKeyEnabled(ctx context.Context, arg SetAPKeyEnabledParams) error
+	SetAPServiceEnabled(ctx context.Context, arg SetAPServiceEnabledParams) error
+	SetAPServiceValidation(ctx context.Context, arg SetAPServiceValidationParams) error
+	SetAgentDefaultDomain(ctx context.Context, arg SetAgentDefaultDomainParams) error
+	SetAgentSchedulable(ctx context.Context, arg SetAgentSchedulableParams) error
+	SetAgentStatus(ctx context.Context, arg SetAgentStatusParams) error
+	SetAgentTags(ctx context.Context, arg SetAgentTagsParams) error
+	SetAuditLogMetadata(ctx context.Context, arg SetAuditLogMetadataParams) error
 	SetDatabaseBackupRemoteKeyByID(ctx context.Context, arg SetDatabaseBackupRemoteKeyByIDParams) error
 	SetDatabaseBackupScheduleByIDAndUser(ctx context.Context, arg SetDatabaseBackupScheduleByIDAndUserParams) error
 	SetDatabaseBackupStatusByID(ctx context.Context, arg SetDatabaseBackupStatusByIDParams) error
@@ -110,23 +316,67 @@ type Querier interface {
 	SetDatabaseServiceStatusAndConnectionByID(ctx context.Context, arg SetDatabaseServiceStatusAndConnectionByIDParams) error
 	SetDatabaseServiceStatusByID(ctx context.Context, arg SetDatabaseServiceStatusByIDParams) error
 	SetDatabaseServiceStatusByIDAndUser(ctx context.Context, arg SetDatabaseServiceStatusByIDAndUserParams) error
+	SetDeploymentStatus(ctx context.Context, arg SetDeploymentStatusParams) error
 	SetProjectApproved(ctx context.Context, arg SetProjectApprovedParams) (int64, error)
+	SetServiceDomainDefault(ctx context.Context, arg SetServiceDomainDefaultParams) (int64, error)
+	SetServiceLegacyDomain(ctx context.Context, arg SetServiceLegacyDomainParams) error
+	SetServicePublishedPort(ctx context.Context, arg SetServicePublishedPortParams) error
+	SetServiceReplicas(ctx context.Context, arg SetServiceReplicasParams) error
+	SetServiceStatus(ctx context.Context, arg SetServiceStatusParams) error
+	SetUserAdmin(ctx context.Context, arg SetUserAdminParams) (int64, error)
+	SumRequestMetricSince(ctx context.Context, dollar_1 string) (int32, error)
+	SumUsageByKey(ctx context.Context, arg SumUsageByKeyParams) (int64, error)
+	SumUsageByService(ctx context.Context, arg SumUsageByServiceParams) (int64, error)
+	SumUsageCounters(ctx context.Context) (interface{}, error)
+	SyncDeploymentProgress(ctx context.Context, arg SyncDeploymentProgressParams) error
+	SyncPreviewStatuses(ctx context.Context) error
+	TouchAPKeyLastUsed(ctx context.Context, id uuid.UUID) error
 	TouchAgentAuthToken(ctx context.Context, tokenHash string) error
+	TouchServiceDomainChecked(ctx context.Context, id uuid.UUID) error
 	TouchUserToken(ctx context.Context, id uuid.UUID) error
+	TrimCronExecutions(ctx context.Context, arg TrimCronExecutionsParams) error
 	UpdateAgent(ctx context.Context, arg UpdateAgentParams) (NodeAgent, error)
 	UpdateAgentHeartbeat(ctx context.Context, arg UpdateAgentHeartbeatParams) error
 	UpdateBackupTargetByIDAndUser(ctx context.Context, arg UpdateBackupTargetByIDAndUserParams) error
 	UpdateBanner(ctx context.Context, arg UpdateBannerParams) (Banner, error)
+	// Agent reports the real host bindings after create — persist them with
+	// the status flip so ingress can route to the assigned port.
+	UpdateContainerPorts(ctx context.Context, arg UpdateContainerPortsParams) error
+	// Agent heartbeat reports real docker state + net counters; reconcile
+	// inventory for rows this node owns. Tombstones win — never resurrect a
+	// removed replica. $4 is the cumulative rx+tx byte counter.
+	UpdateContainerStateByName(ctx context.Context, arg UpdateContainerStateByNameParams) error
 	UpdateContainerStatus(ctx context.Context, arg UpdateContainerStatusParams) error
+	UpdateCronJobRun(ctx context.Context, arg UpdateCronJobRunParams) error
 	UpdateDatabaseServiceNameAndPlanByIDAndUser(ctx context.Context, arg UpdateDatabaseServiceNameAndPlanByIDAndUserParams) error
 	UpdateDatabaseServiceNameByIDAndUser(ctx context.Context, arg UpdateDatabaseServiceNameByIDAndUserParams) error
 	UpdateDatabaseServicePlanByIDAndUser(ctx context.Context, arg UpdateDatabaseServicePlanByIDAndUserParams) error
+	UpdateEnvVarValue(ctx context.Context, arg UpdateEnvVarValueParams) error
 	UpdateOutboundWebhook(ctx context.Context, arg UpdateOutboundWebhookParams) error
+	UpdatePreviewEnvironment(ctx context.Context, arg UpdatePreviewEnvironmentParams) error
 	UpdateProjectByID(ctx context.Context, arg UpdateProjectByIDParams) (int64, error)
+	UpdateServiceDeployMeta(ctx context.Context, arg UpdateServiceDeployMetaParams) error
+	UpdateServicePreviewBranch(ctx context.Context, arg UpdateServicePreviewBranchParams) error
+	UpdateServiceRuntimeMeta(ctx context.Context, arg UpdateServiceRuntimeMetaParams) error
+	UpdateUserProfile(ctx context.Context, arg UpdateUserProfileParams) error
 	UpdateUserTemplate(ctx context.Context, arg UpdateUserTemplateParams) (int64, error)
+	UpdateVulnerabilityStatus(ctx context.Context, arg UpdateVulnerabilityStatusParams) error
 	UpdateWebhookDeliveryResult(ctx context.Context, arg UpdateWebhookDeliveryResultParams) error
+	UpsertAdminUser(ctx context.Context, arg UpsertAdminUserParams) (uuid.UUID, error)
+	UpsertAppSetting(ctx context.Context, arg UpsertAppSettingParams) error
+	UpsertAppSettingValue(ctx context.Context, arg UpsertAppSettingValueParams) error
+	UpsertBuild(ctx context.Context, arg UpsertBuildParams) error
 	UpsertEnvironmentVariable(ctx context.Context, arg UpsertEnvironmentVariableParams) error
+	UpsertGitHubAppProvider(ctx context.Context, arg UpsertGitHubAppProviderParams) (UpsertGitHubAppProviderRow, error)
+	UpsertGitRepository(ctx context.Context, arg UpsertGitRepositoryParams) error
+	UpsertGitWebhook(ctx context.Context, arg UpsertGitWebhookParams) (UpsertGitWebhookRow, error)
+	UpsertInstanceMetrics(ctx context.Context, arg UpsertInstanceMetricsParams) error
+	UpsertLocalUser(ctx context.Context, arg UpsertLocalUserParams) (UpsertLocalUserRow, error)
+	UpsertNodeMetrics(ctx context.Context, arg UpsertNodeMetricsParams) error
+	UpsertServiceContainer(ctx context.Context, arg UpsertServiceContainerParams) error
+	UpsertServiceMetrics(ctx context.Context, arg UpsertServiceMetricsParams) error
 	UpsertServiceTemplate(ctx context.Context, arg UpsertServiceTemplateParams) error
+	UpsertUsageCounter(ctx context.Context, arg UpsertUsageCounterParams) error
 }
 
 var _ Querier = (*Queries)(nil)

app/backend/internal/database/sqlcdb/runtime.sql.go

@@ -0,0 +1,355 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: runtime.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const getLastDeployedImage = `-- name: GetLastDeployedImage :one
+SELECT (image_name || ':' || image_tag)::text AS image FROM deployments
+WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
+ORDER BY created_at DESC LIMIT 1
+`
+
+func (q *Queries) GetLastDeployedImage(ctx context.Context, serviceID uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getLastDeployedImage, serviceID)
+	var image string
+	err := row.Scan(&image)
+	return image, err
+}
+
+const getServiceDomainText = `-- name: GetServiceDomainText :one
+SELECT COALESCE(domain,'') AS domain FROM services WHERE id = $1
+`
+
+func (q *Queries) GetServiceDomainText(ctx context.Context, id uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceDomainText, id)
+	var domain string
+	err := row.Scan(&domain)
+	return domain, err
+}
+
+const getServicePort = `-- name: GetServicePort :one
+SELECT COALESCE(port, 0) AS port FROM services WHERE id = $1
+`
+
+func (q *Queries) GetServicePort(ctx context.Context, id uuid.UUID) (int32, error) {
+	row := q.db.QueryRowContext(ctx, getServicePort, id)
+	var port int32
+	err := row.Scan(&port)
+	return port, err
+}
+
+const getServiceRuntimeWithOwner = `-- name: GetServiceRuntimeWithOwner :one
+SELECT s.id, s.project_id, s.name,
+       COALESCE(s.type, s.service_type, '') AS type, COALESCE(s.status, '') AS status,
+       COALESCE(s.image, s.image_name, '') AS image, COALESCE(s.command, s.start_command, '') AS command,
+       COALESCE(s.environment, '') AS environment, COALESCE(s.git_repo, s.source_url, '') AS git_repo,
+       COALESCE(s.git_branch, '') AS git_branch, COALESCE(s.build_path, '') AS build_path,
+       COALESCE(s.cpu, '') AS cpu, COALESCE(s.memory, '') AS memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at, p.owner_id
+FROM services s
+JOIN projects p ON s.project_id = p.id
+WHERE s.id = $1
+`
+
+type GetServiceRuntimeWithOwnerRow struct {
+	ID              uuid.UUID    `json:"id"`
+	ProjectID       uuid.UUID    `json:"project_id"`
+	Name            string       `json:"name"`
+	Type            string       `json:"type"`
+	Status          string       `json:"status"`
+	Image           string       `json:"image"`
+	Command         string       `json:"command"`
+	Environment     string       `json:"environment"`
+	GitRepo         string       `json:"git_repo"`
+	GitBranch       string       `json:"git_branch"`
+	BuildPath       string       `json:"build_path"`
+	Cpu             string       `json:"cpu"`
+	Memory          string       `json:"memory"`
+	Replicas        int32        `json:"replicas"`
+	Port            int32        `json:"port"`
+	Domain          string       `json:"domain"`
+	HealthcheckPath string       `json:"healthcheck_path"`
+	RestartPolicy   string       `json:"restart_policy"`
+	Builder         string       `json:"builder"`
+	CpuReserve      string       `json:"cpu_reserve"`
+	MemoryReserve   string       `json:"memory_reserve"`
+	StaticBuildCmd  string       `json:"static_build_cmd"`
+	StaticDir       string       `json:"static_dir"`
+	CreatedAt       sql.NullTime `json:"created_at"`
+	UpdatedAt       sql.NullTime `json:"updated_at"`
+	OwnerID         uuid.UUID    `json:"owner_id"`
+}
+
+func (q *Queries) GetServiceRuntimeWithOwner(ctx context.Context, id uuid.UUID) (GetServiceRuntimeWithOwnerRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceRuntimeWithOwner, id)
+	var i GetServiceRuntimeWithOwnerRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Type,
+		&i.Status,
+		&i.Image,
+		&i.Command,
+		&i.Environment,
+		&i.GitRepo,
+		&i.GitBranch,
+		&i.BuildPath,
+		&i.Cpu,
+		&i.Memory,
+		&i.Replicas,
+		&i.Port,
+		&i.Domain,
+		&i.HealthcheckPath,
+		&i.RestartPolicy,
+		&i.Builder,
+		&i.CpuReserve,
+		&i.MemoryReserve,
+		&i.StaticBuildCmd,
+		&i.StaticDir,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OwnerID,
+	)
+	return i, err
+}
+
+const getServiceStatusText = `-- name: GetServiceStatusText :one
+SELECT COALESCE(status,'') AS status FROM services WHERE id = $1
+`
+
+func (q *Queries) GetServiceStatusText(ctx context.Context, id uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceStatusText, id)
+	var status string
+	err := row.Scan(&status)
+	return status, err
+}
+
+const getServiceVariableValue = `-- name: GetServiceVariableValue :one
+SELECT value FROM environment_variables WHERE service_id = $1 AND key = $2
+`
+
+type GetServiceVariableValueParams struct {
+	ServiceID uuid.UUID `json:"service_id"`
+	Key       string    `json:"key"`
+}
+
+func (q *Queries) GetServiceVariableValue(ctx context.Context, arg GetServiceVariableValueParams) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceVariableValue, arg.ServiceID, arg.Key)
+	var value string
+	err := row.Scan(&value)
+	return value, err
+}
+
+const listNodeAgentsForService = `-- name: ListNodeAgentsForService :many
+SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1
+`
+
+func (q *Queries) ListNodeAgentsForService(ctx context.Context, serviceID string) ([]string, error) {
+	rows, err := q.db.QueryContext(ctx, listNodeAgentsForService, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []string{}
+	for rows.Next() {
+		var node_agent_id string
+		if err := rows.Scan(&node_agent_id); err != nil {
+			return nil, err
+		}
+		items = append(items, node_agent_id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listProjectServiceRefs = `-- name: ListProjectServiceRefs :many
+SELECT id, name FROM services WHERE project_id = $1
+`
+
+type ListProjectServiceRefsRow struct {
+	ID   uuid.UUID `json:"id"`
+	Name string    `json:"name"`
+}
+
+func (q *Queries) ListProjectServiceRefs(ctx context.Context, projectID uuid.UUID) ([]ListProjectServiceRefsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listProjectServiceRefs, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListProjectServiceRefsRow{}
+	for rows.Next() {
+		var i ListProjectServiceRefsRow
+		if err := rows.Scan(&i.ID, &i.Name); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceVariableValues = `-- name: ListServiceVariableValues :many
+SELECT key, value FROM environment_variables WHERE service_id = $1
+`
+
+type ListServiceVariableValuesRow struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+func (q *Queries) ListServiceVariableValues(ctx context.Context, serviceID uuid.UUID) ([]ListServiceVariableValuesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceVariableValues, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListServiceVariableValuesRow{}
+	for rows.Next() {
+		var i ListServiceVariableValuesRow
+		if err := rows.Scan(&i.Key, &i.Value); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceVariablesWithSecret = `-- name: ListServiceVariablesWithSecret :many
+SELECT key, value, COALESCE(is_secret, false) AS is_secret
+FROM environment_variables WHERE service_id = $1
+`
+
+type ListServiceVariablesWithSecretRow struct {
+	Key      string `json:"key"`
+	Value    string `json:"value"`
+	IsSecret bool   `json:"is_secret"`
+}
+
+func (q *Queries) ListServiceVariablesWithSecret(ctx context.Context, serviceID uuid.UUID) ([]ListServiceVariablesWithSecretRow, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceVariablesWithSecret, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListServiceVariablesWithSecretRow{}
+	for rows.Next() {
+		var i ListServiceVariablesWithSecretRow
+		if err := rows.Scan(&i.Key, &i.Value, &i.IsSecret); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listSleepCandidates = `-- name: ListSleepCandidates :many
+SELECT id, project_id, name, COALESCE(status,'') AS status,
+       COALESCE(sleep_idle_minutes, 15) AS sleep_idle_minutes
+FROM services
+WHERE sleep_enabled AND COALESCE(status,'') IN ('running','deployed','degraded','starting')
+`
+
+type ListSleepCandidatesRow struct {
+	ID               uuid.UUID `json:"id"`
+	ProjectID        uuid.UUID `json:"project_id"`
+	Name             string    `json:"name"`
+	Status           string    `json:"status"`
+	SleepIdleMinutes int32     `json:"sleep_idle_minutes"`
+}
+
+func (q *Queries) ListSleepCandidates(ctx context.Context) ([]ListSleepCandidatesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listSleepCandidates)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListSleepCandidatesRow{}
+	for rows.Next() {
+		var i ListSleepCandidatesRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.Name,
+			&i.Status,
+			&i.SleepIdleMinutes,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const setServicePublishedPort = `-- name: SetServicePublishedPort :exec
+UPDATE services SET published_port = $1 WHERE id = $2 AND published_port <> $1
+`
+
+type SetServicePublishedPortParams struct {
+	PublishedPort int32     `json:"published_port"`
+	ID            uuid.UUID `json:"id"`
+}
+
+func (q *Queries) SetServicePublishedPort(ctx context.Context, arg SetServicePublishedPortParams) error {
+	_, err := q.db.ExecContext(ctx, setServicePublishedPort, arg.PublishedPort, arg.ID)
+	return err
+}
+
+const setServiceReplicas = `-- name: SetServiceReplicas :exec
+UPDATE services SET replicas = $1, updated_at = $2 WHERE id = $3
+`
+
+type SetServiceReplicasParams struct {
+	Replicas  int32        `json:"replicas"`
+	UpdatedAt sql.NullTime `json:"updated_at"`
+	ID        uuid.UUID    `json:"id"`
+}
+
+func (q *Queries) SetServiceReplicas(ctx context.Context, arg SetServiceReplicasParams) error {
+	_, err := q.db.ExecContext(ctx, setServiceReplicas, arg.Replicas, arg.UpdatedAt, arg.ID)
+	return err
+}

app/backend/internal/database/sqlcdb/security.sql.go

@@ -0,0 +1,318 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: security.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const checkSecurityProjectAccess = `-- name: CheckSecurityProjectAccess :one
+SELECT EXISTS (
+    SELECT 1
+    FROM projects p
+    WHERE p.id = $1
+      AND (p.is_approved
+           OR $3::bool
+           OR p.owner_id = $2 OR EXISTS (
+            SELECT 1 FROM project_members pm
+            WHERE pm.project_id = p.id AND pm.user_id = $2
+      ))
+)
+`
+
+type CheckSecurityProjectAccessParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+func (q *Queries) CheckSecurityProjectAccess(ctx context.Context, arg CheckSecurityProjectAccessParams) (bool, error) {
+	row := q.db.QueryRowContext(ctx, checkSecurityProjectAccess, arg.ID, arg.OwnerID, arg.Column3)
+	var exists bool
+	err := row.Scan(&exists)
+	return exists, err
+}
+
+const complianceFrameworkExists = `-- name: ComplianceFrameworkExists :one
+SELECT EXISTS(SELECT 1 FROM compliance_frameworks WHERE id = $1)
+`
+
+func (q *Queries) ComplianceFrameworkExists(ctx context.Context, id uuid.UUID) (bool, error) {
+	row := q.db.QueryRowContext(ctx, complianceFrameworkExists, id)
+	var exists bool
+	err := row.Scan(&exists)
+	return exists, err
+}
+
+const getComplianceReportProjectID = `-- name: GetComplianceReportProjectID :one
+SELECT project_id FROM compliance_reports WHERE id = $1
+`
+
+func (q *Queries) GetComplianceReportProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getComplianceReportProjectID, id)
+	var project_id uuid.UUID
+	err := row.Scan(&project_id)
+	return project_id, err
+}
+
+const getLatestComplianceReport = `-- name: GetLatestComplianceReport :one
+SELECT overall_status, score, assessment_date
+FROM compliance_reports
+WHERE project_id = $1
+ORDER BY assessment_date DESC
+LIMIT 1
+`
+
+type GetLatestComplianceReportRow struct {
+	OverallStatus  string    `json:"overall_status"`
+	Score          int32     `json:"score"`
+	AssessmentDate time.Time `json:"assessment_date"`
+}
+
+func (q *Queries) GetLatestComplianceReport(ctx context.Context, projectID uuid.UUID) (GetLatestComplianceReportRow, error) {
+	row := q.db.QueryRowContext(ctx, getLatestComplianceReport, projectID)
+	var i GetLatestComplianceReportRow
+	err := row.Scan(&i.OverallStatus, &i.Score, &i.AssessmentDate)
+	return i, err
+}
+
+const getLatestSecurityScan = `-- name: GetLatestSecurityScan :one
+SELECT id, COALESCE((summary->>'score')::int, 0)::int AS score, started_at AS scanned_at, status
+FROM security_scans
+WHERE project_id = $1
+ORDER BY started_at DESC
+LIMIT 1
+`
+
+type GetLatestSecurityScanRow struct {
+	ID        uuid.UUID `json:"id"`
+	Score     int32     `json:"score"`
+	ScannedAt time.Time `json:"scanned_at"`
+	Status    string    `json:"status"`
+}
+
+func (q *Queries) GetLatestSecurityScan(ctx context.Context, projectID uuid.UUID) (GetLatestSecurityScanRow, error) {
+	row := q.db.QueryRowContext(ctx, getLatestSecurityScan, projectID)
+	var i GetLatestSecurityScanRow
+	err := row.Scan(
+		&i.ID,
+		&i.Score,
+		&i.ScannedAt,
+		&i.Status,
+	)
+	return i, err
+}
+
+const getProjectOwnerText = `-- name: GetProjectOwnerText :one
+SELECT owner_id::text FROM projects WHERE id = $1
+`
+
+func (q *Queries) GetProjectOwnerText(ctx context.Context, id uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getProjectOwnerText, id)
+	var owner_id string
+	err := row.Scan(&owner_id)
+	return owner_id, err
+}
+
+const getSecurityScanProjectID = `-- name: GetSecurityScanProjectID :one
+SELECT project_id FROM security_scans WHERE id = $1
+`
+
+func (q *Queries) GetSecurityScanProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getSecurityScanProjectID, id)
+	var project_id uuid.UUID
+	err := row.Scan(&project_id)
+	return project_id, err
+}
+
+const getVulnerabilityMetrics = `-- name: GetVulnerabilityMetrics :one
+SELECT
+    COUNT(*) AS total,
+    COUNT(*) FILTER (WHERE severity = 'critical') AS critical,
+    COUNT(*) FILTER (WHERE severity = 'high') AS high,
+    COUNT(*) FILTER (WHERE severity = 'medium') AS medium,
+    COUNT(*) FILTER (WHERE severity = 'low') AS low,
+    COUNT(*) FILTER (WHERE status = 'open') AS open,
+    COUNT(*) FILTER (WHERE status = 'resolved') AS resolved
+FROM vulnerabilities
+WHERE project_id = $1
+`
+
+type GetVulnerabilityMetricsRow struct {
+	Total    int64 `json:"total"`
+	Critical int64 `json:"critical"`
+	High     int64 `json:"high"`
+	Medium   int64 `json:"medium"`
+	Low      int64 `json:"low"`
+	Open     int64 `json:"open"`
+	Resolved int64 `json:"resolved"`
+}
+
+func (q *Queries) GetVulnerabilityMetrics(ctx context.Context, projectID uuid.UUID) (GetVulnerabilityMetricsRow, error) {
+	row := q.db.QueryRowContext(ctx, getVulnerabilityMetrics, projectID)
+	var i GetVulnerabilityMetricsRow
+	err := row.Scan(
+		&i.Total,
+		&i.Critical,
+		&i.High,
+		&i.Medium,
+		&i.Low,
+		&i.Open,
+		&i.Resolved,
+	)
+	return i, err
+}
+
+const getVulnerabilityProjectID = `-- name: GetVulnerabilityProjectID :one
+SELECT project_id FROM vulnerabilities WHERE id = $1
+`
+
+func (q *Queries) GetVulnerabilityProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getVulnerabilityProjectID, id)
+	var project_id uuid.UUID
+	err := row.Scan(&project_id)
+	return project_id, err
+}
+
+const listComplianceFrameworks = `-- name: ListComplianceFrameworks :many
+SELECT id, name, description, version, enabled, created_at
+FROM compliance_frameworks
+WHERE enabled = true
+ORDER BY name
+`
+
+type ListComplianceFrameworksRow struct {
+	ID          uuid.UUID      `json:"id"`
+	Name        string         `json:"name"`
+	Description sql.NullString `json:"description"`
+	Version     string         `json:"version"`
+	Enabled     bool           `json:"enabled"`
+	CreatedAt   time.Time      `json:"created_at"`
+}
+
+func (q *Queries) ListComplianceFrameworks(ctx context.Context) ([]ListComplianceFrameworksRow, error) {
+	rows, err := q.db.QueryContext(ctx, listComplianceFrameworks)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListComplianceFrameworksRow{}
+	for rows.Next() {
+		var i ListComplianceFrameworksRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Description,
+			&i.Version,
+			&i.Enabled,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listVulnerabilities = `-- name: ListVulnerabilities :many
+SELECT id, type, severity, title, description, service_id, status, found_at, resolved_at
+FROM vulnerabilities
+WHERE project_id = $1
+ORDER BY
+    CASE severity
+        WHEN 'critical' THEN 1
+        WHEN 'high' THEN 2
+        WHEN 'medium' THEN 3
+        WHEN 'low' THEN 4
+    END,
+    found_at DESC
+`
+
+type ListVulnerabilitiesRow struct {
+	ID          uuid.UUID      `json:"id"`
+	Type        string         `json:"type"`
+	Severity    string         `json:"severity"`
+	Title       string         `json:"title"`
+	Description sql.NullString `json:"description"`
+	ServiceID   uuid.NullUUID  `json:"service_id"`
+	Status      string         `json:"status"`
+	FoundAt     time.Time      `json:"found_at"`
+	ResolvedAt  sql.NullTime   `json:"resolved_at"`
+}
+
+func (q *Queries) ListVulnerabilities(ctx context.Context, projectID uuid.UUID) ([]ListVulnerabilitiesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listVulnerabilities, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListVulnerabilitiesRow{}
+	for rows.Next() {
+		var i ListVulnerabilitiesRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Type,
+			&i.Severity,
+			&i.Title,
+			&i.Description,
+			&i.ServiceID,
+			&i.Status,
+			&i.FoundAt,
+			&i.ResolvedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const serviceExistsInProject = `-- name: ServiceExistsInProject :one
+SELECT EXISTS(SELECT 1 FROM services WHERE id = $1 AND project_id = $2)
+`
+
+type ServiceExistsInProjectParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) ServiceExistsInProject(ctx context.Context, arg ServiceExistsInProjectParams) (bool, error) {
+	row := q.db.QueryRowContext(ctx, serviceExistsInProject, arg.ID, arg.ProjectID)
+	var exists bool
+	err := row.Scan(&exists)
+	return exists, err
+}
+
+const updateVulnerabilityStatus = `-- name: UpdateVulnerabilityStatus :exec
+UPDATE vulnerabilities SET status = $1, resolved_at = $2 WHERE id = $3
+`
+
+type UpdateVulnerabilityStatusParams struct {
+	Status     string       `json:"status"`
+	ResolvedAt sql.NullTime `json:"resolved_at"`
+	ID         uuid.UUID    `json:"id"`
+}
+
+func (q *Queries) UpdateVulnerabilityStatus(ctx context.Context, arg UpdateVulnerabilityStatusParams) error {
+	_, err := q.db.ExecContext(ctx, updateVulnerabilityStatus, arg.Status, arg.ResolvedAt, arg.ID)
+	return err
+}

app/backend/internal/database/sqlcdb/service_ops.sql.go

@@ -0,0 +1,158 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: service_ops.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const cloneServiceDomains = `-- name: CloneServiceDomains :exec
+INSERT INTO service_domains (service_id, domain, is_default, cert_type)
+SELECT $1, domain, is_default, cert_type FROM service_domains sd WHERE sd.service_id = $2
+`
+
+type CloneServiceDomainsParams struct {
+	ServiceID   uuid.UUID `json:"service_id"`
+	ServiceID_2 uuid.UUID `json:"service_id_2"`
+}
+
+func (q *Queries) CloneServiceDomains(ctx context.Context, arg CloneServiceDomainsParams) error {
+	_, err := q.db.ExecContext(ctx, cloneServiceDomains, arg.ServiceID, arg.ServiceID_2)
+	return err
+}
+
+const cloneServiceRow = `-- name: CloneServiceRow :exec
+INSERT INTO services
+    (id, project_id, name, environment_id, service_type, source_type, source_url, image_name,
+     build_command, start_command, type, status, image, command, environment,
+     git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
+     healthcheck_path, restart_policy, volumes, maintenance_mode, basic_auth_users,
+     builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
+     traefik_labels, created_at, updated_at)
+SELECT $1, $2, $3, $4, service_type, source_type, source_url, image_name,
+     build_command, start_command, type, 'stopped', image, command, $5,
+     git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
+     healthcheck_path, restart_policy, volumes, $6, $7,
+     builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
+     traefik_labels, $8, $8
+FROM services s WHERE s.id = $9
+`
+
+type CloneServiceRowParams struct {
+	ID              uuid.UUID      `json:"id"`
+	ProjectID       uuid.UUID      `json:"project_id"`
+	Name            string         `json:"name"`
+	EnvironmentID   uuid.UUID      `json:"environment_id"`
+	Environment     sql.NullString `json:"environment"`
+	MaintenanceMode bool           `json:"maintenance_mode"`
+	BasicAuthUsers  string         `json:"basic_auth_users"`
+	CreatedAt       sql.NullTime   `json:"created_at"`
+	ID_2            uuid.UUID      `json:"id_2"`
+}
+
+func (q *Queries) CloneServiceRow(ctx context.Context, arg CloneServiceRowParams) error {
+	_, err := q.db.ExecContext(ctx, cloneServiceRow,
+		arg.ID,
+		arg.ProjectID,
+		arg.Name,
+		arg.EnvironmentID,
+		arg.Environment,
+		arg.MaintenanceMode,
+		arg.BasicAuthUsers,
+		arg.CreatedAt,
+		arg.ID_2,
+	)
+	return err
+}
+
+const cloneServiceVariables = `-- name: CloneServiceVariables :exec
+INSERT INTO environment_variables (id, service_id, key, value, is_secret)
+SELECT gen_random_uuid(), $1, key, value, is_secret FROM environment_variables ev WHERE ev.service_id = $2
+`
+
+type CloneServiceVariablesParams struct {
+	ServiceID   uuid.UUID `json:"service_id"`
+	ServiceID_2 uuid.UUID `json:"service_id_2"`
+}
+
+func (q *Queries) CloneServiceVariables(ctx context.Context, arg CloneServiceVariablesParams) error {
+	_, err := q.db.ExecContext(ctx, cloneServiceVariables, arg.ServiceID, arg.ServiceID_2)
+	return err
+}
+
+const countServicesByName = `-- name: CountServicesByName :one
+SELECT COUNT(*) FROM services WHERE project_id = $1 AND name = $2
+`
+
+type CountServicesByNameParams struct {
+	ProjectID uuid.UUID `json:"project_id"`
+	Name      string    `json:"name"`
+}
+
+func (q *Queries) CountServicesByName(ctx context.Context, arg CountServicesByNameParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countServicesByName, arg.ProjectID, arg.Name)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const deleteServiceByID = `-- name: DeleteServiceByID :exec
+DELETE FROM services WHERE id = $1
+`
+
+func (q *Queries) DeleteServiceByID(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deleteServiceByID, id)
+	return err
+}
+
+const getProjectOwner = `-- name: GetProjectOwner :one
+SELECT owner_id FROM projects WHERE id = $1
+`
+
+func (q *Queries) GetProjectOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getProjectOwner, id)
+	var owner_id uuid.UUID
+	err := row.Scan(&owner_id)
+	return owner_id, err
+}
+
+const getServiceEnvironment = `-- name: GetServiceEnvironment :one
+SELECT COALESCE(environment, '') FROM services WHERE id = $1
+`
+
+func (q *Queries) GetServiceEnvironment(ctx context.Context, id uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceEnvironment, id)
+	var environment string
+	err := row.Scan(&environment)
+	return environment, err
+}
+
+const moveServiceProject = `-- name: MoveServiceProject :execrows
+UPDATE services SET project_id = $1, environment_id = $2, updated_at = $3 WHERE id = $4
+`
+
+type MoveServiceProjectParams struct {
+	ProjectID     uuid.UUID    `json:"project_id"`
+	EnvironmentID uuid.UUID    `json:"environment_id"`
+	UpdatedAt     sql.NullTime `json:"updated_at"`
+	ID            uuid.UUID    `json:"id"`
+}
+
+func (q *Queries) MoveServiceProject(ctx context.Context, arg MoveServiceProjectParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, moveServiceProject,
+		arg.ProjectID,
+		arg.EnvironmentID,
+		arg.UpdatedAt,
+		arg.ID,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}