draft: database layer refactor (#1054 )

* feat(sshid) - sshid.io equivalent for termix (#919) * feat(ssh-id): database schema, migrations and field encryption Adds ssh_identities, ssh_identity_keys and ssh_identity_ca tables (public keys stored plaintext for the unauthenticated resolver; CA private key registered for per-user field encryption), with UNIQUE(user_id), an index on ssh_identity_keys(identity_id), and idempotent CREATE TABLE migrations. * feat(ssh-id): backend API — resolver, key management, CA and certificates Mounts /sshid (nginx route added). Public text/plain authorized_keys resolver (+ exact /:algo filter, HTML viewer) and CA public-key endpoint; no-store + noindex headers on every resolver response including early 404s. Authenticated management: claim/rename/delete handle, add/import/generate/enable/delete keys, and a per-user CA (create/rotate/delete) with pure-Node OpenSSH certificate issuance. Audit logging on all mutations; UNIQUE races map to a precise 409. Unit tests for key parsing and certificate signing (ssh-keygen-validated). * feat(ssh-id): frontend panel, API client and i18n SSH ID panel wired into the app rail and AppShell: claim handle, resolver URL + curl one-liner, key list, generate, paste/import, CA enable/rotate/remove with server trust command, and per-key certificate issuance. API client re-exported through main-axios.ts; all strings i18n'd. * style(ssh-id): align panel and resolver page with Termix theme - Rebuild the SSH ID sidebar panel with the theme's square components (SectionCard / SettingRow / FakeSwitch) instead of rounded ad-hoc cards; use accent-brand and destructive tokens rather than raw red/green. - Fix panel scrolling: move overflow to a block scroll container so the cards keep their natural height instead of being clipped. - Restyle the public resolver HTML page (/sshid/u/:handle) to the Termix dark theme: square corners, #18181b/#303032 palette, #f59145 accent, uppercase section labels. - Tidy copy: 'Save To Credentials' label, drop the redundant generate intro, and correct the generate tooltip (the key is stored when saving to vault). * feat: rename to Termix ID, improve UI, backend inconsistencies, and general bug fixes --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> * ci(deps): bump actions/checkout from 6 to 7 in the github-actions group (#922) Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 11 updates (#923) Bumps the dev-patch-updates group with 11 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/search](https://github.com/codemirror/search) | `6.7.0` | `6.7.1` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.0` | `6.43.1` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.0` | `4.3.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.9` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.8` | `4.1.9` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.2` | `0.5.3` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.7` | `17.0.8` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` | | [sharp](https://github.com/lovell/sharp) | `0.35.1` | `0.35.2` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.0` | `4.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.9` | Updates `@codemirror/search` from 6.7.0 to 6.7.1 - [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/search/commits) Updates `@codemirror/view` from 6.43.0 to 6.43.1 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@tailwindcss/vite` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8) Updates `@vitest/ui` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/ui) Updates `eslint-plugin-react-refresh` from 0.5.2 to 0.5.3 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.2...v0.5.3) Updates `lint-staged` from 17.0.7 to 17.0.8 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](https://github.com/lint-staged/lint-staged/compare/v17.0.7...v17.0.8) Updates `prettier` from 3.8.3 to 3.8.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.8.4) Updates `sharp` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) Updates `tailwindcss` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) Updates `vitest` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: "@codemirror/search" dependency-version: 6.7.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/ui" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: lint-staged dependency-version: 17.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump nanoid in the prod-patch-updates group (#925) Bumps the prod-patch-updates group with 1 update: [nanoid](https://github.com/ai/nanoid). Updates `nanoid` from 5.1.11 to 5.1.15 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.11...5.1.15) --- updated-dependencies: - dependency-name: nanoid dependency-version: 5.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the major-updates group with 5 updates (#926) Bumps the major-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.0.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.0.0` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `10.0.3` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `10.5.0` | Updates `js-yaml` from 4.2.0 to 5.0.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...5.0.0) Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@types/node` from 25.9.2 to 26.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `concurrently` from 9.2.1 to 10.0.3 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](https://github.com/open-cli-tools/concurrently/compare/v9.2.1...v10.0.3) Updates `eslint` from 9.39.4 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v10.5.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: concurrently dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(ssh): add HashiCorp Vault SSH signer authentication * fix: small fixes to vault feature to align with Termix codebase * chore: add view docs links for vault/termix id * fix: file upload fails with 400 and missing schema migrations on upgrade (#929) Two bugs introduced in v2.4.1: 1. uploadFileStream uses fileManagerApi.post() which triggers axios's transformRequest to JSON-serialize the FormData because the instance default Content-Type is application/json. Change to postForm() which sets Content-Type: multipart/form-data so the browser XHR sends the correct multipart body with boundary. 2. Two schema items added to schema.ts were not included in migrateSchema() in db/index.ts, causing 500 errors on existing installations upgrading from v2.4.0: - user_preferences.status_color_scheme (no such column) - dashboard_service_links table (no such table) Fixes #928 Co-authored-by: sash <sash@fominykh.io> * fix: support PuTTY PPK ssh keys (#930) * fix: chunk large file manager uploads (#932) * fix: route dashboard hosts by protocol (#934) * fix: resolve tunnel endpoints reliably (#935) * Fix Electron OIDC browser auth failures (#936) * Allow RDP connections without stored credentials (#937) * Sync role credential shares for OIDC users (#938) * Fix terminal link dialog layering (#940) * Confirm large files before opening editor (#942) * Confirm closing active host connections (#943) * Preserve file path case in file manager UI (#941) * fix: preserve unicode guacamole tokens (#933) * Persist VNC authentication settings (#944) * Fix Guacamole websocket base path (#946) * Promote file manager terminals to tabs (#939) * Guard Guacamole disconnect during startup (#945) * chore: increment ver * feat: bitwarden ssh agent integration * feat: serial connections support * fix: various small bug fixes * feat: open all sessions in a folder and terminal custom theme color support * feat: cross host file manager clipboard and several small bug fixes * feat: tailscale/wireguard support and added a new status state for when backend is checking status * feat: grafana like server stats history, new alert system, ntfy/webhook support * feat: new grid and widget based homepage function * feat: new donate button in dashboard * fix: alert ui incorrectly using termix css and fixed issue with alert system not loading * chore: start database layer refactor * docs: plan database layer refactor * docs: audit database layer refactor phase zero * chore: add database runtime adapter skeleton * chore: add settings repository skeleton * chore: add user session repository skeleton * chore: add host credential repository skeleton * chore: add field encryption boundary * chore: migrate settings route slice * chore: migrate user settings routes * chore: migrate host metrics settings routes * chore: migrate acme settings route * chore: migrate terminal settings route * chore: migrate tailscale settings read * chore: migrate guacamole settings reads * chore: migrate session timeout settings reads * chore: migrate auth route settings reads * chore: migrate host metrics settings reads * chore: migrate startup settings reads * chore: migrate user settings cleanup * chore: migrate password reset settings * chore: migrate oidc legacy settings read * chore: migrate user route settings slice * chore: migrate oidc state settings * chore: migrate user login settings reads * chore: migrate user crypto settings * chore: consolidate startup settings defaults * chore: consolidate database settings import export * chore: migrate core session auth paths * chore: migrate remaining session auth paths * chore: migrate admin user routes * chore: migrate user route admin checks * chore: migrate user lifecycle routes * chore: migrate auth user lookups * chore: migrate oidc user routes * chore: migrate api key repository paths * docs: add database gray rollout guide * chore: migrate trusted device paths * chore: migrate user session route user lookups * chore: add database repository rollout guard * chore: expose repository rollout status * chore: warn on repository rollout misconfiguration * chore: migrate remaining user lookup helpers * chore: migrate ssh user lookups * chore: migrate user settings admin lookups * chore: migrate acme ssl user lookups * chore: migrate audit log admin checks * chore: migrate oidc account user updates * chore: migrate password reset user updates * chore: migrate user deletion core records * chore: migrate snippet audit user lookups * chore: migrate ldap user sync paths * chore: migrate totp user updates * chore: migrate rbac user checks * chore: migrate rbac role paths * chore: migrate permission role lookups * chore: migrate rbac access list reads * chore: migrate shared rbac reads * chore: migrate rbac access writes * chore: migrate permission host access * chore: migrate role host access lookup * chore: migrate snippet access lookup * chore: migrate shared credential access lookups * chore: migrate host access cleanup writes * chore: migrate host list access checks * chore: migrate host access cleanup routes * chore: migrate shared credential role lookups * chore: migrate user role cleanup * chore: migrate admin role sync * chore: migrate ldap role sync * chore: migrate user role assignment * chore: migrate sso provider access * chore: migrate audit log access * chore: migrate user preference access * chore: migrate open tab access * chore: migrate dismissed alert access * chore: migrate homepage layout access * chore: migrate network topology access * chore: migrate dashboard service link access * chore: migrate command history access * chore: migrate recent activity cleanup * chore: migrate ssh credential usage access * chore: migrate transfer recent access * chore: migrate file manager bookmark access * chore: migrate c2s tunnel preset access * chore: migrate homepage item access * chore: migrate session recording access * chore: migrate tmux session tag access * chore: migrate opkssh token access * chore: migrate vault token access * chore: migrate vault profile access * chore: migrate host metrics preference access * chore: migrate host health access * chore: migrate host metrics history access * chore: migrate alert persistence access * chore: route alert host lookup through repository * chore: migrate user data export reads * chore: route host metrics stats sync through repository * chore: migrate host folder persistence * chore: migrate host resolution reads * chore: route jump host resolution reads * chore: route docker console jump host reads * chore: route docker ssh resolution reads * chore: route proxmox discovery resolution reads * chore: route file manager activity host reads * chore: route host metrics resolution reads * chore: route ssh auth credential reads * chore: route tunnel endpoint credential reads * chore: route credential deployment resolution reads * chore: route command history host flag reads * chore: route snippet execution resolution reads * chore: route terminal host resolution reads * chore: route vault oidc host resolution reads * chore: route wake on lan host reads * chore: route internal host list reads * chore: route host key verification persistence * chore: route credential read paths * chore: route credential host usage reads * chore: route credential folder rename * chore: route host owner access checks * chore: route shared credential source reads * chore: route user host credential cleanup * chore: route credential delete reads * chore: route credential update reads * chore: route host credential reads * chore: route host read paths * chore: route host projection reads * chore: route host list reads * chore: route snippet read paths * chore: route snippet folder writes * chore: route snippet crud paths * chore: route snippet bulk import * chore: route rbac ownership reads * chore: route user count reads * chore: route cleanup snippets folders * chore: route shared credential persistence * chore: route dashboard activity * chore: route guacamole host reads * chore: route host bulk lookups * chore: remove unlock-only simple db ops * chore: route host autostart persistence * chore: route ldap provisioning through users * chore: route credential encrypted writes * chore: route host encrypted writes * chore: route bulk host encrypted writes * chore: route termix id credentials * chore: route termix id ca persistence * chore: route termix identity persistence * chore: route credential system migration * chore: isolate user encryption migration storage * chore: remove legacy simple db ops * chore: isolate legacy sqlite migration copy * chore: route database settings import export * chore: route database host credential export * chore: route database host credential import * chore: route database file-manager import export * chore: route database alert usage import export * chore: route database user checks * chore: isolate auth lazy migration storage * chore: route explicit database saves * chore: initialize database save boundary * chore: route migration snapshot saves * chore: isolate sqlite import constraints * chore: route import sqlite boundary * chore: route user encryption migration store * chore: centralize current repository runtime * chore: route more current repositories * chore: route activity repository runtimes * chore: route token repository runtimes * chore: route health repository runtimes * chore: route identity repository runtimes * chore: route rbac repository runtime * chore: centralize current sqlite runtime access * chore: route user deletion key cleanup * chore: route user deletion vault cleanup * chore: route user deletion homepage cleanup * chore: route user deletion health cleanup * chore: route user deletion alert cleanup * chore: route user deletion identity cleanup * chore: add database layer preupgrade backup * Fix database repository type errors * fix: complete post-merge compile fixes for database refactor Restore missing DatabaseSaveTrigger/getDb imports, session log format fallback, OIDC provider resolution, guacamole recording insert, and passwordFallbackOnly typing after merging current dev. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io>
Add Proxmox guest auto sync (#1053 )
2026-07-16 05:13:36 +00:00 · 2026-07-15 23:28:10 -05:00 · 2026-07-15 23:10:12 -05:00 · 2026-07-15 23:02:10 -05:00 · 2026-07-15 23:01:03 -05:00 · 2026-07-15 22:59:18 -05:00
603 changed files with 156424 additions and 85052 deletions
@@ -0,0 +1 @@
+custom: https://donate.termix.site/
@@ -14,7 +14,7 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -14,6 +14,10 @@ on:
        options:
          - Development
          - Production
+      source_ref:
+        description: "Git ref/SHA to build (defaults to the workflow ref)"
+        required: false
+        default: ""
  workflow_call:
    inputs:
      version:
@@ -29,16 +33,25 @@ on:
        required: false
        type: boolean
        default: false
+      source_ref:
+        description: "Git ref/SHA to build"
+        required: false
+        type: string
+        default: ""

 jobs:
  build:
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
+          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

+      - name: Resolve source revision
+        run: echo "SOURCE_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        with:
@@ -98,7 +111,7 @@ jobs:
            BUILDKIT_CONTEXT_KEEP_GIT_DIR=1
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.revision=${{ env.SOURCE_SHA }}
            org.opencontainers.image.created=${{ github.run_id }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
@@ -23,6 +23,10 @@ on:
          - file
          - release
          - submit
+      source_ref:
+        description: "Git ref/SHA to build (defaults to the workflow ref)"
+        required: false
+        default: ""
  workflow_call:
    inputs:
      build_type:
@@ -38,6 +42,11 @@ on:
        required: false
        type: string
        default: ""
+      source_ref:
+        description: "Git ref/SHA to build"
+        required: false
+        type: string
+        default: ""
    outputs:
      macos_universal_dmg_sha256:
        description: "SHA256 of the universal macOS DMG (for Homebrew cask)"
@@ -52,8 +61,9 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
+          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

      - name: Setup Node.js
@@ -142,8 +152,9 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
+          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

      - name: Setup Node.js
@@ -352,8 +363,9 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
+          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

      - name: Setup Node.js
@@ -578,8 +590,9 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
+          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

      - name: Get version from package.json
@@ -684,8 +697,9 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
+          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

      - name: Get version from package.json
@@ -821,8 +835,9 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
+          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

      - name: Get version from package.json
@@ -931,8 +946,9 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
+          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

      - name: Setup Node.js
@@ -10,7 +10,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
@@ -13,7 +13,7 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
@@ -39,7 +39,7 @@ jobs:
          exit 1

      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -85,7 +85,7 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout dev branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: ${{ needs.prep.outputs.dev_branch }}
          fetch-depth: 0
@@ -137,7 +137,7 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout dev branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: ${{ needs.prep.outputs.dev_branch }}
          fetch-depth: 0
@@ -220,7 +220,7 @@ jobs:
      build_ref: ${{ steps.merge.outputs.build_ref }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -278,7 +278,7 @@ jobs:

          MAIN_SHA=$(gh api repos/${{ github.repository }}/commits/main -q .sha)
          echo "main_sha=$MAIN_SHA" >> "$GITHUB_OUTPUT"
-          echo "build_ref=main" >> "$GITHUB_OUTPUT"
+          echo "build_ref=$MAIN_SHA" >> "$GITHUB_OUTPUT"

  docker:
    needs: [prep, merge-to-main]
@@ -287,15 +287,18 @@ jobs:
      version: ${{ needs.prep.outputs.version }}
      build_type: Production
      dry_run: ${{ inputs.mode == 'Dry run' }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref }}
    secrets: inherit

  create-release:
    needs: [prep, merge-to-main, docker]
    if: ${{ inputs.mode != 'Dry run' }}
    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      contents: write
    steps:
      - name: Checkout main
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 1
@@ -308,7 +311,7 @@ jobs:
      - name: Clear existing release artifacts (overwrite mode)
        if: ${{ inputs.mode == 'Overwrite release' }}
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
        run: |
          TAG="${{ needs.prep.outputs.release_tag }}"
          if ! gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
@@ -331,7 +334,7 @@ jobs:
      - name: Create or update GitHub release
        if: ${{ inputs.mode != 'Overwrite release' }}
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
        run: |
          TAG="${{ needs.prep.outputs.release_tag }}"
          TITLE="release-${{ needs.prep.outputs.version }}"
@@ -349,15 +352,17 @@ jobs:
      build_type: all
      artifact_destination: ${{ inputs.mode == 'Dry run' && 'file' || 'release' }}
      release_tag: ${{ needs.prep.outputs.release_tag }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref }}
    secrets: inherit

  electron-submit:
-    needs: [prep, electron-release]
+    needs: [prep, merge-to-main, electron-release]
    if: ${{ inputs.mode != 'Dry run' && inputs.mode != 'Skip submit' }}
    uses: ./.github/workflows/electron.yml
    with:
      build_type: all
      artifact_destination: submit
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref }}
    secrets: inherit

  cask-commit-back:
@@ -368,7 +373,7 @@ jobs:
      contents: write
    steps:
      - name: Checkout main
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 1
@@ -407,7 +412,7 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout Termix
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: ${{ needs.merge-to-main.outputs.build_ref }}
          fetch-depth: 1
@@ -427,7 +432,7 @@ jobs:
          npm run generate:openapi

      - name: Checkout Docs repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          repository: Termix-SSH/Docs
          ref: main
@@ -481,11 +486,16 @@ jobs:

          PR_NUMBER=$(gh pr list --repo Termix-SSH/Docs --head "$BRANCH" --base main --state open --json number -q '.[0].number' || true)
          if [ -z "$PR_NUMBER" ]; then
-            PR_NUMBER=$(gh pr create --repo Termix-SSH/Docs \
+            PR_URL=$(gh pr create --repo Termix-SSH/Docs \
              --base main --head "$BRANCH" \
              --title "release-${{ needs.prep.outputs.version }}" \
-              --body "API docs for ${{ needs.prep.outputs.version }}" \
-              | grep -oE '[0-9]+$')
+              --body "API docs for ${{ needs.prep.outputs.version }}")
+            PR_NUMBER=$(echo "$PR_URL" | grep -oE '[0-9]+$')
+          fi
+
+          if [ -z "$PR_NUMBER" ]; then
+            echo "Failed to find or create a PR for $BRANCH."
+            exit 1
          fi

          gh pr merge "$PR_NUMBER" --repo Termix-SSH/Docs --squash --admin
@@ -496,7 +506,7 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout main
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 1
@@ -1,6 +1,6 @@
 cask "termix" do
-  version "2.4.0"
-  sha256 "3cc1afc2c62ce9f40124561fb40374b34e41dcf8610b62f773a4661e9c83ca85"
+  version "2.5.0"
+  sha256 "0662380b3cc986e5ddab263122e87b03a581bc18dbff1ad13e11dc973c84984b"

  url "https://github.com/Termix-SSH/Termix/releases/download/release-#{version}-tag/termix_macos_universal_dmg.dmg"
  name "Termix"
@@ -28,8 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

+<p>
+  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
+</p>
+
+<br />
+
+Termix is free and open source. If you find it useful, consider [donating](https://donate.termix.site/) to help cover server costs and development time.
+
 <br />

 <img src="./repo-images/Termix Header.png" alt="Termix Banner" width="900" />
@@ -87,8 +96,8 @@ Manage files directly on remote servers with support for viewing and editing cod
 <tr>
 <td width="50%" valign="top">

-**Docker Management:**
-Start, stop, pause, remove containers. View container stats. Control container using docker exec terminal. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.
+**Docker and Podman Management:**
+Start, stop, pause, remove containers. View container stats. Control containers using a docker exec terminal. Supports both Docker and Podman as the container runtime. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.

 </td>
 <td width="50%" valign="top">
@@ -102,13 +111,13 @@ Save, organize, and manage your SSH connections with tags and folders (folder cu
 <td width="50%" valign="top">

 **Host Metrics:**
-View CPU, memory, disk usage, network, uptime, system information, firewall, port monitor, log viewer, users/permissions, certificates, and many more which work on most Linux based servers.
+View CPU, memory, disk usage, network, uptime, system information, firewall, port monitor, log viewer, users/permissions, certificates, and many more which work on most Linux based servers. Includes time-series history graphs and threshold-based alerts with ntfy and webhook support.

 </td>
 <td width="50%" valign="top">

 **User Authentication:**
-Secure user management with admin controls and OIDC/LDAP/SSO (with access control) and 2FA (TOTP) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together. View audit log of all users actions.
+Secure user management with admin controls and OIDC/LDAP/SSO (with access control), 2FA (TOTP), and passkey (WebAuthn) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together. View audit log of all users actions.

 </td>
 </tr>
@@ -129,32 +138,52 @@ Create roles and share hosts across users/roles.
 <tr>
 <td width="50%" valign="top">

+**Serial Connections:**
+Connect to serial devices (routers, switches, microcontrollers, etc.) directly from the browser or desktop app. Configure baud rate, data bits, stop bits, and parity. Uses the Web Serial API in supported browsers or a native backend in the Electron app.
+
+</td>
+<td width="50%" valign="top">
+
+**Alerts:**
+Set threshold-based alert rules on host metrics (CPU, memory, disk, etc.) and get notified via ntfy or webhooks when they fire. View firing and resolved alerts in a history log.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Homepage:**
+A fully customizable homepage with a drag-and-drop widget grid. Add widgets for host status, service links, clocks, notes, RSS feeds, weather, Docker containers, host metrics charts, embedded terminals, iframes, and more.
+
+</td>
+<td width="50%" valign="top">
+
 **Database Encryption:**
 Backend stored as encrypted SQLite database files. View [docs](https://docs.termix.site/security) for more.

 </td>
+</tr>
+<tr>
 <td width="50%" valign="top">

 **Network Graph:**
 Customize your Dashboard to visualize your homelab based off your SSH connections with status support.

 </td>
-</tr>
-<tr>
 <td width="50%" valign="top">

 **SSH Tools:**
 Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.

 </td>
+</tr>
+<tr>
 <td width="50%" valign="top">

 **Persistent Tabs:**
 SSH sessions and tabs stay open across devices/refreshes if enabled in user profile.

 </td>
-</tr>
-<tr>
 <td width="50%" valign="top">

 **Languages:**
@@ -179,7 +208,8 @@ Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/tr
 - **Quick Connect** - Connect to a server without having to save the connection data
 - **Command Palette** - Double tap left shift to quickly access SSH connections with your keyboard
 - **Proxmox Integration** - Auto-add hosts into Termix from your Proxmox instance
- **SSH Feature Rich** - Supports jump hosts, Warpgate, TOTP based connections, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, etc.
+- **SSH Feature Rich** - Supports jump hosts, Warpgate, TOTP based connections, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, SSH agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, and more.
+- **Termix ID** - A sshid.io equivalent built into Termix. Claim a handle, publish your public SSH keys at a resolver URL, and use a built-in CA to issue SSH certificates.

 </details>

@@ -263,6 +293,14 @@ networks:

 <br />

+## Donate
+
+Termix is free and open source with no subscriptions or paid plans. If you find it useful, consider donating to help cover server costs, domains, and development time.
+
+[Donate](https://donate.termix.site/)
+
+<br />
+
 ## Screenshots

 <div align="center">
@@ -305,6 +343,10 @@ networks:
 <td><img src="./repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="./repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="./repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="./repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Some videos and images may be out of date or may not perfectly showcase features.</sub>
@@ -352,6 +394,10 @@ See [Projects](https://github.com/orgs/Termix-SSH/projects/5) for all planned fe
 <a href="https://aws.amazon.com/">
  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://rackgenius.com/">
+  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="AWS" />
+</a>

 </div>

@@ -1,123 +1,81 @@
 <!-- SUMMARY -->

-Dozens of bug fixes and small new features, including VNC/RDP sharing, OIDC improvements, file manager fixes, SSH jump host fixes, terminal enhancements, RDP keyboard layout support, and much more.
+Major new features including serial connections, Tailscale/WireGuard support, HashiCorp Vault SSH auth, Bitwarden SSH agent, WebAuthn passkeys, Podman support, a new grid-based dashboard, host metrics history with alerting, and much more.

 <!-- /SUMMARY -->

 <!-- YOUTUBE -->

-https://youtu.be/ImwAbm4hW-k
+https://youtu.be/c3UD4q2jW_8

 <!-- /YOUTUBE -->

 <!-- UPDATE_LOG -->

- VNC, RDP, and Telnet credential sharing support
- Default host settings (SOCKS5, credentials, terminal settings, and more)
- Custom terminal background image per host
- Silent OIDC login configurable as default (no URL parameter required)
- Bulk open SSH sessions for multiple selected hosts at once
- Improved Nord theme contrast and accessibility
- Admin can manually create users while registration is disabled
- OIDC auto-provisioned users supported when registration and password login are disabled
- OIDC username usable as SSH username credential
- Custom labels and drag-to-reorder for sessions in the Connections panel
- Appearance and profile settings persisted to the database across devices
- Saved server URL dropdown in the app connection screen
- File manager text editor font size adjustment
- Tab key shortcut for entering your username in the terminal
- Shift+Tab hotkey support for mobile
- Terminal keyboard shortcuts support
- UTF-8 encoding support in the file manager
- Optional broadcast address for Wake-on-LAN packets
- SFTP legacy mode support
- Snippets JSON import and export with folder metadata
- Clickable links and service shortcuts on the dashboard
- Host status color indicators restored to sidebar
- Per-host configuration to set tab title to shell's window title instead of host name
- Split screen hotkeys
- Support for AZERTY and other non-QWERTY keyboard layouts in RDP
- RDP load balancing info and Connection Broker Cookie support
- Per-connection guacd proxy host and port configuration
- Deep link support for bookmarking direct SSH or file manager sessions
- ACME/Certbot SSL certificate support
- Import hosts from SSH config file
- OIDC with custom CA certificate support
- Open files directly in the file manager text editor
- File manager text editor Ctrl+W capture to prevent accidental tab close
- Option to collapse hosts to a single line in the sidebar
- Select a different backend Termix server from within the app
- Windows portable app now truly portable (no registry writes)
- Bundle fonts for offline environments
- Option to disable clickable links in the terminal
- Proxmox login options including OPKSSH
- UI suggestions and general interface improvements
- Per-protocol host metrics (online/offline detection) configuration
- Increase file manager max upload size by splicing files and reassembling them (~5GB)
+- Termix ID with a public handle, hosted public key resolver, and built-in CA for issuing SSH certificates
+- Serial connections support
+- Tailscale and WireGuard VPN host integration with status detection
+- HashiCorp Vault SSH signer authentication
+- Bitwarden SSH agent integration
+- WebAuthn passkey authentication
+- Podman container runtime support alongside Docker
+- SSH agent forwarding support across all SSH features
+- New grid and widget-based dashboard homepage
+- Grafana-style server stats history graphs
+- Alert system with ntfy and webhook notification support
+- Host temperature metrics card
+- App fullscreen mode
+- External editor support for file manager (desktop app)
+- Safe host sharing export
+- SSH credential password fallback for key-based auth
+- Open all sessions in a folder at once
+- Custom terminal theme color support
+- Custom tunnel endpoints configuration
+- GUACD_URL environment variable support
+- App rail hover expansion setting
+- Terminal font zoom with mouse wheel
+- File manager terminals promoted to full tabs
+- Donate button on dashboard
+- PuTTY PPK SSH key support
+- Confirmation dialog when closing active host connections
+- Confirmation prompt before opening large files in the editor
+- Cross-host file manager clipboard
+- Prioritize host results in command palette search
+- Retry autostart tunnel host fetches on failure
 <!-- /UPDATE_LOG -->

 <!-- BUG_FIXES -->

- File transfers over 100MB failing
- File transfers over 30 seconds aborted by axios timeout
- SSH terminal through jump host chain timing out with malformed SSH messages
- Cloning a host with SSH key auth not allowing auth method change on the clone
- File deletion in the file manager affecting selected files in inactive tabs
- File manager not connecting when cert passphrase is not saved
- File text editor cursor position lost on save
- macOS Option + Left/Right Arrow outputting raw ANSI sequences instead of moving cursor by word
- File manager tree view not sorted alphabetically
- SFTP failing with timeout when using a jump host chain
- SSH key auth with Duo not showing prompt and failing immediately
- Enabling 2FA with password login disabled causing a login deadlock
- Failed to disable 2FA even when providing correct TOTP or password
- Arrow buttons not working in Midnight Commander on the Android app
- Credential deploy command copy failing silently (clipboard API unavailable in some browsers)
- Disabling password login still showing the password login form
- Folder picker in the new host form not showing existing folders
- Command palette always opening hosts as SSH terminal regardless of protocol settings
- Saving SSH credentials failing on fresh installs
- Import hosts failing when hosts use SSH key credentials
- Warpgate authentication prompting for a password unnecessarily
- File manager folder icon not appearing under host name on hover
- File manager delete silently failing on Windows hosts (rm -f not supported by PowerShell)
- SSH terminal failing with keepalive timeout when server MOTD is slow to load
- SSH connection via SOCKS5 proxy failing after update
- Linking an OIDC account to a password account not working
- User password copy missing and RBAC issues in admin panel
- Debian and Android packages not opening the server on launch
- Username field in host edit and new host form having no effect
- Mobile terminal crashing on iOS with React error 130
- Network interface symbols incorrect in host metrics
- Sudo password auto-fill not working on Ubuntu Server 26.04
- get_cwd command injecting into live PTY and corrupting interactive programs
- Initial directory command failing on Windows PowerShell SSH targets
- 3-way split not working with layout issues
- Docker management not working for Windows hosts
- Docker management failing on Debian with exit code 1
- Docker logs not respecting the current theme
- API not responding correctly after update
- Caddy reverse proxy configuration not working
- Wrong keyboard layout in VNC sessions
- KDE scaling issues in the desktop app
- Linux app failing to start due to better-sqlite3 Node version mismatch
- Tab autocomplete not working in the macOS x86 app
- Cloudflare SSL tunnels with third-level subdomains blocking Termix web portal access
- Fzf completion not working in the Android app
- SSH terminal frame delivery jitter in Docker (ssh2 native crypto not compiled)
- OIDC login failing in Linux and Android apps when Authentik has a Captcha stage
- Android app crashing after entering password when auth is set to None
- Editing or saving a host clearing the password for RDP and VNC connections
- Hardcoded 30-minute open-tabs TTL defeating session persistence
- Keyboard mapping issues on Windows Server 2019 via RDP
- Shared server not appearing for other users
- RBAC role assignment failing for OIDC users
- SSO configuration broken when supplied via environment variables
- RDP requiring credentials even when none are needed
- Terminal outputting success right after folder path
- GitHub/Google SSO provider giving ERR_INVALID_URL
- Keyboard focus not on main screen when selecting tmux session
- Remove all references to SALT variable
- Syntax highlighter duplicating path, visual corruptions, cursor jumps, etc.
- RDP session screen clips/spills over on viewport resize
+- SSH port connection bug
+- VNC required argument handshake failure
+- Jump host SOCKS5 proxy selection using wrong proxy
+- Tunnel endpoint resolution failing in some configurations
+- Direct tunnel skipping endpoint credential validation incorrectly
+- Dashboard host routing ignoring protocol settings
+- Dashboard service link creation broken
+- File manager uploads failing with 400 error and missing schema migrations on upgrade
+- Large file manager uploads not chunked (chunked for files >=1.5GB)
+- File uploads over 100MB failing due to ArrayBuffer browser limit
+- File path case not preserved in file manager UI
+- File downloads unreliable in the desktop app
+- Tmux detection path handling incorrect
+- Host metrics startup polling incorrect
+- TUI terminal output highlighting incorrect
+- Runtime base path for auth callbacks incorrect
+- Windows app icon unstable
+- SSH heading syntax highlighting broken
+- Terminal link dialog layering issue
+- Electron OIDC browser authentication failures
+- Proxmox import auth fallback not working
+- OIDC role credential shares not synced for OIDC users
+- RDP connections requiring credentials when none are needed
+- VNC authentication settings not persisted
+- Guacamole unicode token corruption
+- Guacamole websocket base path incorrect
+- Guacamole disconnect during startup crash
+- Host metrics starting for non-SSH hosts
+- Sidebar host hover causing layout shift
+- Alert UI incorrectly applying Termix CSS and alert system failing to load
+- Translation key incorrect for nav close action
+- PUID HTML ownership in Docker entrypoint
 <!-- /BUG_FIXES -->
@@ -0,0 +1,58 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true,
+    "defaultBranch": "dev-2.5.0"
+  },
+  "files": {
+    "ignoreUnknown": true,
+    "includes": [
+      "**",
+      "!!build",
+      "!!coverage",
+      "!!dist",
+      "!!dist-ssr",
+      "!!release",
+      "!!node_modules",
+      "!!src/mcp-server/node_modules",
+      "!!db",
+      "!!.env",
+      "!!**/*.min.js",
+      "!!**/*.min.css",
+      "!!openapi.json"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 80,
+    "lineEnding": "lf"
+  },
+  "linter": {
+    "enabled": false
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "semicolons": "always",
+      "trailingCommas": "all",
+      "arrowParentheses": "always"
+    }
+  },
+  "json": {
+    "formatter": {
+      "trailingCommas": "none"
+    }
+  },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    }
+  },
+  "assist": {
+    "enabled": false
+  }
+}
@@ -78,7 +78,7 @@ COPY --chown=node:node package.json ./

 VOLUME ["/app/data"]

-EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006
+EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006 30007 30008 30009 30010 30011 30012

 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD wget -q -O /dev/null http://localhost:30001/health || exit 1
@@ -12,6 +12,8 @@ services:
    environment:
      PORT: "8080"
      NODE_ENV: development
+      GUACD_HOST: "guacd-dev"
+      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
    depends_on:
      - guacd-dev
    networks:
@@ -21,6 +23,8 @@ services:
    image: guacamole/guacd:1.6.0
    container_name: guacd-dev
    restart: unless-stopped
+    volumes:
+      - termix-dev-data:/termix-data
    networks:
      - termix-dev-net

@@ -10,6 +10,7 @@ services:
    environment:
      PORT: "8080"
      GUACD_HOST: "guacd"
+      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
    depends_on:
      - guacd
    networks:
@@ -19,6 +20,8 @@ services:
    image: guacamole/guacd:1.6.0
    container_name: guacd
    restart: unless-stopped
+    volumes:
+      - termix-data:/termix-data
    networks:
      - termix-net

@@ -14,7 +14,7 @@ if [ "$(id -u)" = "0" ]; then
        groupmod -o -g "$PGID" node 2>/dev/null || true
        usermod -o -u "$PUID" node 2>/dev/null || true

-        chown -R node:node /app/data /app/uploads /tmp/nginx 2>/dev/null || true
+        chown -R node:node /app/data /app/uploads /app/html /tmp/nginx 2>/dev/null || true

        echo "User node is now UID: $PUID, GID: $PGID"

@@ -167,4 +167,4 @@ node dist/backend/backend/starter.js

 echo "All services started"

-tail -f /dev/null
+tail -f /dev/null
@@ -159,6 +159,33 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/alert-rules(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/notification-channels(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/alert-firings(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
        location ~ ^/rbac(/.*)?$ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -190,6 +217,36 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/vault(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/termix-id(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/proxmox(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_connect_timeout 60s;
+            proxy_send_timeout 120s;
+            proxy_read_timeout 120s;
+        }
+
        location ~ ^/c2s-tunnel-presets(/.*)?$ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -388,8 +445,8 @@ http {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;

            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
@@ -610,6 +667,15 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/homepage(/.*)?$ {
+            proxy_pass http://127.0.0.1:30012;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
        location ^~ /docker/console/ {
            proxy_pass http://127.0.0.1:30009/;
            proxy_http_version 1.1;
@@ -622,8 +688,8 @@ http {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;

            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
@@ -663,6 +729,27 @@ http {
            proxy_read_timeout 300s;
        }

+        location ^~ /serial/websocket/ {
+            proxy_pass http://127.0.0.1:30011/;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+        }
+
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /app/html;
@@ -148,6 +148,33 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/alert-rules(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/notification-channels(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/alert-firings(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
        location ~ ^/rbac(/.*)?$ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -179,6 +206,24 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/vault(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/termix-id(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
        location ~ ^/proxmox(/.*)?$ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
@@ -389,8 +434,8 @@ http {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;

            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
@@ -611,6 +656,15 @@ http {
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

+        location ~ ^/homepage(/.*)?$ {
+            proxy_pass http://127.0.0.1:30012;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
        location ^~ /docker/console/ {
            proxy_pass http://127.0.0.1:30009/;
            proxy_http_version 1.1;
@@ -623,8 +677,8 @@ http {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-Host $http_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;

            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
@@ -664,6 +718,27 @@ http {
            proxy_read_timeout 300s;
        }

+        location ^~ /serial/websocket/ {
+            proxy_pass http://127.0.0.1:30011/;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+        }
+
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /app/html;
@@ -28,11 +28,8 @@
    "!dist/icon-mac.png",
    "!public/icon-mac.png",
    "!dist/icon.ico",
-    "!public/icon.ico",
    "!dist/icon.icns",
-    "!public/icon.icns",
-    "!dist/icons/**/*",
-    "!public/icons/**/*"
+    "!public/icon.icns"
  ],
  "extraMetadata": {
    "main": "electron/main.cjs",
@@ -61,6 +58,8 @@
    "artifactName": "termix_windows_${arch}_nsis.${ext}",
    "createDesktopShortcut": true,
    "createStartMenuShortcut": true,
+    "installerIcon": "public/icon.ico",
+    "uninstallerIcon": "public/icon.ico",
    "shortcutName": "Termix",
    "uninstallDisplayName": "Termix"
  },
@@ -9,6 +9,7 @@ const {
  safeStorage,
  Tray,
  clipboard,
+  nativeImage,
 } = require("electron");
 const path = require("path");
 const fs = require("fs");
@@ -17,7 +18,7 @@ const https = require("https");
 const http = require("http");
 const net = require("net");
 const { URL } = require("url");
-const { fork } = require("child_process");
+const { fork, spawn } = require("child_process");
 const WebSocket = require("ws");

 // Portable mode: if a `.portable` marker exists next to the executable,
@@ -528,15 +529,117 @@ let backendProcess = null;
 let backendStartFailed = false;
 let tray = null;
 let isQuitting = false;
+const tempFiles = new Map();
+const externalEditorSessions = new Map();

 const isDev = process.env.NODE_ENV === "development" || !app.isPackaged;
 const appRoot = isDev ? process.cwd() : path.join(__dirname, "..");
+const windowsAppUserModelId = "com.karmaa.termix";
 const electronCacheBuildPath = path.join(
  app.getPath("userData"),
  "client-cache-build.json",
 );
 const termixSessionPartition = "persist:termix";

+function getTempRoot() {
+  const tempRoot = path.join(app.getPath("temp"), "termix");
+  fs.mkdirSync(tempRoot, { recursive: true });
+  return tempRoot;
+}
+
+function sanitizeFileName(fileName) {
+  const baseName = path.basename(String(fileName || "file"));
+  return baseName.replace(/[<>:"/\\|?*\x00-\x1f]/g, "_") || "file";
+}
+
+function decodeFileContent(content, encoding) {
+  if (encoding === "base64") {
+    return Buffer.from(String(content || ""), "base64");
+  }
+  return Buffer.from(String(content || ""), "utf8");
+}
+
+function createManagedTempFile(fileName, content, encoding = "utf8") {
+  const tempId = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const tempDir = fs.mkdtempSync(path.join(getTempRoot(), `${tempId}-`));
+  const filePath = path.join(tempDir, sanitizeFileName(fileName));
+  fs.writeFileSync(filePath, decodeFileContent(content, encoding));
+  tempFiles.set(tempId, { path: filePath, dir: tempDir });
+  return { tempId, path: filePath };
+}
+
+function cleanupManagedTempFile(tempId) {
+  const temp = tempFiles.get(tempId);
+  if (!temp) return;
+  try {
+    fs.rmSync(temp.dir, { recursive: true, force: true });
+  } catch (error) {
+    logToFile("Failed to clean up temporary file:", error.message);
+  }
+  tempFiles.delete(tempId);
+}
+
+function closeExternalEditorSession(editId) {
+  const session = externalEditorSessions.get(editId);
+  if (!session) return;
+  if (session.timer) clearTimeout(session.timer);
+  try {
+    session.watcher.close();
+  } catch {
+    // watcher may already be closed
+  }
+  externalEditorSessions.delete(editId);
+  cleanupManagedTempFile(editId);
+}
+
+function notifyExternalEditorSaved(editId) {
+  const session = externalEditorSessions.get(editId);
+  if (!session || !mainWindow || mainWindow.isDestroyed()) return;
+
+  try {
+    const stat = fs.statSync(session.path);
+    if (stat.mtimeMs === session.lastMtimeMs) return;
+    session.lastMtimeMs = stat.mtimeMs;
+
+    const content = fs.readFileSync(session.path, "utf8");
+    mainWindow.webContents.send("external-editor-saved", {
+      editId,
+      content,
+      encoding: "utf8",
+      path: session.path,
+    });
+  } catch (error) {
+    logToFile("Failed to read external editor file:", error.message);
+  }
+}
+
+function openPathWithEditor(filePath, editorPath) {
+  if (!editorPath) {
+    return shell.openPath(filePath);
+  }
+
+  return new Promise((resolve) => {
+    let settled = false;
+    const child = spawn(editorPath, [filePath], {
+      detached: true,
+      stdio: "ignore",
+    });
+
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      resolve(error.message);
+    });
+
+    setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.unref();
+      resolve("");
+    }, 500);
+  });
+}
+
 app.on(
  "certificate-error",
  (event, _webContents, url, error, certificate, callback) => {
@@ -690,9 +793,11 @@ function getBackendPaths() {
      backendCwd: backendDir,
    };
  }
-  // fork() does not go through Electron's asar redirector — use the unpacked path
+  // fork() does not go through Electron's asar redirector — use the unpacked path.
+  // On macOS multi-arch builds (mergeASARs: false), electron-builder names the ASAR
+  // app-arm64.asar / app-x64.asar instead of app.asar, so match all variants.
  const unpackedRoot = appRoot.replace(
-    /app\.asar(?!\.unpacked)/,
+    /app(-[a-z0-9]+)?\.asar(?!\.unpacked)/,
    "app.asar.unpacked",
  );
  const backendDir = path.join(unpackedRoot, "dist", "backend", "backend");
@@ -850,7 +955,13 @@ function createTray() {
    // use the unpacked path so the OS sees a real file.
    const publicRoot = isDev
      ? path.join(appRoot, "public")
-      : path.join(appRoot.replace("app.asar", "app.asar.unpacked"), "public");
+      : path.join(
+          appRoot.replace(
+            /app(-[a-z0-9]+)?\.asar(?!\.unpacked)/,
+            "app.asar.unpacked",
+          ),
+          "public",
+        );

    let trayIcon;
    if (process.platform === "darwin") {
@@ -920,7 +1031,11 @@ function createWindow() {
    minWidth: 800,
    minHeight: 600,
    title: "Termix",
-    icon: path.join(appRoot, "public", "icon.png"),
+    icon: path.join(
+      appRoot,
+      "public",
+      process.platform === "win32" ? "icon.ico" : "icon.png",
+    ),
    webPreferences: {
      nodeIntegration: false,
      contextIsolation: true,
@@ -1231,9 +1346,11 @@ ipcMain.handle(
  async (_event, authUrl, callbackPort) => {
    const http = require("http");

-    return new Promise((resolve, reject) => {
+    return new Promise((resolve) => {
+      let timeout;
+      let settled = false;
      const server = http.createServer((req, res) => {
-        const url = new URL(req.url, `http://localhost:${callbackPort}`);
+        const url = new URL(req.url || "/", `http://localhost:${callbackPort}`);
        if (url.pathname === "/oidc-callback") {
          const success = url.searchParams.get("success");
          const error = url.searchParams.get("error");
@@ -1244,27 +1361,54 @@ ipcMain.handle(
            `<html><body><h2>${success === "true" ? "Authentication successful!" : "Authentication failed."}</h2><p>You can close this tab and return to Termix.</p><script>window.close()</script></body></html>`,
          );

-          server.close();
          if (success === "true") {
-            resolve({ success: true, token });
+            finish({ success: true, token });
          } else {
-            resolve({
+            finish({
              success: false,
              error: error || "Authentication failed",
            });
          }
+          return;
+        }
+
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not found");
+      });
+
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        if (timeout) clearTimeout(timeout);
+        try {
+          server.close();
+        } catch {
+          // Server may not have started yet.
+        }
+        resolve(result);
+      };
+
+      const fail = (error) => {
+        finish({
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      };
+
+      server.once("error", fail);
+
+      server.listen(callbackPort, "localhost", async () => {
+        try {
+          await shell.openExternal(authUrl);
+        } catch (error) {
+          fail(error);
        }
      });

-      server.listen(callbackPort, "127.0.0.1", () => {
-        shell.openExternal(authUrl);
-      });
-
      // Timeout after 5 minutes
-      setTimeout(
+      timeout = setTimeout(
        () => {
-          server.close();
-          reject(new Error("OIDC authentication timed out"));
+          fail(new Error("OIDC authentication timed out"));
        },
        5 * 60 * 1000,
      );
@@ -2500,6 +2644,131 @@ ipcMain.handle("clipboard-write-text", (_event, text) => {

 ipcMain.handle("clipboard-read-text", () => clipboard.readText());

+ipcMain.handle("show-save-dialog", async (_event, options) => {
+  return dialog.showSaveDialog(mainWindow, options || {});
+});
+
+ipcMain.handle("show-open-dialog", async (_event, options) => {
+  return dialog.showOpenDialog(mainWindow, options || {});
+});
+
+ipcMain.handle("create-temp-file", async (_event, fileData) => {
+  try {
+    const result = createManagedTempFile(
+      fileData?.fileName,
+      fileData?.content,
+      fileData?.encoding,
+    );
+    return { success: true, ...result };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("create-temp-folder", async (_event, folderData) => {
+  try {
+    const tempId = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const tempDir = fs.mkdtempSync(path.join(getTempRoot(), `${tempId}-`));
+    const folderPath = path.join(
+      tempDir,
+      sanitizeFileName(folderData?.folderName || "files"),
+    );
+    fs.mkdirSync(folderPath, { recursive: true });
+
+    for (const file of folderData?.files || []) {
+      const relativePath = String(file.relativePath || "")
+        .split(/[\\/]+/)
+        .map(sanitizeFileName)
+        .filter(Boolean)
+        .join(path.sep);
+      if (!relativePath) continue;
+      const targetPath = path.join(folderPath, relativePath);
+      fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+      fs.writeFileSync(
+        targetPath,
+        decodeFileContent(file.content, file.encoding),
+      );
+    }
+
+    tempFiles.set(tempId, { path: folderPath, dir: tempDir });
+    return { success: true, tempId, path: folderPath };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("start-drag-to-desktop", (event, dragData) => {
+  try {
+    const temp = tempFiles.get(dragData?.tempId);
+    if (!temp) return { success: false, error: "Temporary file not found" };
+
+    event.sender.startDrag({
+      file: temp.path,
+      icon: nativeImage.createEmpty(),
+    });
+    return { success: true };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("cleanup-temp-file", (_event, tempId) => {
+  try {
+    cleanupManagedTempFile(tempId);
+    return { success: true };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("open-external-editor", async (_event, fileData) => {
+  try {
+    const result = createManagedTempFile(
+      fileData?.fileName,
+      fileData?.content,
+      fileData?.encoding,
+    );
+    const editId = result.tempId;
+    const stat = fs.statSync(result.path);
+    const watcher = fs.watch(result.path, { persistent: false }, () => {
+      const session = externalEditorSessions.get(editId);
+      if (!session) return;
+      if (session.timer) clearTimeout(session.timer);
+      session.timer = setTimeout(() => notifyExternalEditorSaved(editId), 500);
+    });
+
+    externalEditorSessions.set(editId, {
+      path: result.path,
+      watcher,
+      timer: null,
+      lastMtimeMs: stat.mtimeMs,
+    });
+
+    const editorPath =
+      typeof fileData?.editorPath === "string" && fileData.editorPath.trim()
+        ? fileData.editorPath.trim()
+        : null;
+    const openError = await openPathWithEditor(result.path, editorPath);
+    if (openError) {
+      closeExternalEditorSession(editId);
+      return { success: false, error: openError };
+    }
+
+    return { success: true, editId, path: result.path };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("close-external-editor", (_event, editId) => {
+  try {
+    closeExternalEditorSession(editId);
+    return { success: true };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
 ipcMain.handle("test-server-connection", async (event, serverUrl) => {
  try {
    const normalizedServerUrl = serverUrl.replace(/\/$/, "");
@@ -2680,6 +2949,9 @@ app.whenReady().then(async () => {
    "arch:",
    process.arch,
  );
+  if (process.platform === "win32") {
+    app.setAppUserModelId(windowsAppUserModelId);
+  }
  createMenu();
  await clearElectronClientCacheIfBuildChanged();
  await clearElectronJwtCookiesAtStartup();
@@ -2719,6 +2991,12 @@ app.on("before-quit", () => {

 app.on("will-quit", () => {
  console.log("App will quit...");
+  for (const editId of externalEditorSessions.keys()) {
+    closeExternalEditorSession(editId);
+  }
+  for (const tempId of tempFiles.keys()) {
+    cleanupManagedTempFile(tempId);
+  }
  stopAllC2STunnels();
  stopBackendServer();
 });
@@ -46,6 +46,26 @@ contextBridge.exposeInMainWorld("electronAPI", {
  oidcSystemBrowserAuth: (authUrl, callbackPort) =>
    ipcRenderer.invoke("oidc-system-browser-auth", authUrl, callbackPort),

+  openExternalEditor: (fileData) =>
+    ipcRenderer.invoke("open-external-editor", fileData),
+  closeExternalEditor: (editId) =>
+    ipcRenderer.invoke("close-external-editor", editId),
+  onExternalEditorSaved: (callback) => {
+    const listener = (_event, payload) => callback(payload);
+    ipcRenderer.on("external-editor-saved", listener);
+    return () => ipcRenderer.removeListener("external-editor-saved", listener);
+  },
+
+  showSaveDialog: (options) => ipcRenderer.invoke("show-save-dialog", options),
+  showOpenDialog: (options) => ipcRenderer.invoke("show-open-dialog", options),
+  createTempFile: (fileData) =>
+    ipcRenderer.invoke("create-temp-file", fileData),
+  createTempFolder: (folderData) =>
+    ipcRenderer.invoke("create-temp-folder", folderData),
+  startDragToDesktop: (dragData) =>
+    ipcRenderer.invoke("start-drag-to-desktop", dragData),
+  cleanupTempFile: (tempId) => ipcRenderer.invoke("cleanup-temp-file", tempId),
+
  invoke: (channel, ...args) => ipcRenderer.invoke(channel, ...args),
 });

@@ -1,7 +1,7 @@
 {
  "name": "termix",
  "private": true,
-  "version": "2.4.1",
+  "version": "2.5.0",
  "description": "Self-hosted SSH and remote desktop management.",
  "author": "Karmaa",
  "main": "electron/main.cjs",
@@ -12,7 +12,9 @@
  "scripts": {
    "format": "prettier --write .",
    "format:check": "prettier --check .",
-    "postinstall": "node scripts/patch-app-builder-lib.cjs && node scripts/patch-guacamole-lite.cjs && node scripts/patch-better-sqlite3.cjs && node scripts/patch-nan.cjs",
+    "biome:check": "biome check biome.json package.json",
+    "biome:fix": "biome check --write biome.json package.json",
+    "postinstall": "node scripts/patch-app-builder-lib.cjs && node scripts/patch-guacamole-lite.cjs && node scripts/patch-better-sqlite3.cjs && node scripts/patch-nan.cjs && node scripts/patch-xterm-android-ime.cjs",
    "prebuild": "node scripts/write-electron-build-info.cjs",
    "lint": "eslint .",
    "lint:fix": "eslint --fix .",
@@ -31,7 +33,7 @@
    "preview": "vite preview",
    "electron:dev": "concurrently \"npm run dev\" \"powershell -c \\\"Start-Sleep -Seconds 5\\\" && electron .\"",
    "electron:patch-builder": "node scripts/patch-app-builder-lib.cjs",
-    "electron:rebuild": "electron-rebuild -f -w better-sqlite3",
+    "electron:rebuild": "electron-rebuild -f -w better-sqlite3 -w serialport",
    "build:win-portable": "npm run build && npm run electron:rebuild && npm run electron:patch-builder && electron-builder --win --dir",
    "build:win-installer": "npm run build && npm run electron:rebuild && npm run electron:patch-builder && electron-builder --win --publish=never",
    "build:linux-portable": "npm run build && npm run electron:rebuild && npm run electron:patch-builder && electron-builder --linux --dir",
@@ -41,8 +43,11 @@
    "build:mac-dev": "npm run build && npm run electron:rebuild && npm run electron:patch-builder && electron-builder --mac dir --publish=never"
  },
  "dependencies": {
+    "@simplewebauthn/browser": "^13.3.0",
+    "@simplewebauthn/server": "^13.3.2",
+    "@tanstack/react-virtual": "^3.14.6",
    "@types/ldapjs": "^3.0.6",
-    "axios": "^1.18.0",
+    "axios": "^1.18.1",
    "bcryptjs": "^3.0.3",
    "better-sqlite3": "^12.11.1",
    "body-parser": "^2.3.0",
@@ -54,54 +59,56 @@
    "express": "^5.2.1",
    "guacamole-lite": "^1.2.0",
    "jose": "^6.2.2",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^5.2.1",
    "jsonwebtoken": "^9.0.3",
    "jszip": "^3.10.1",
    "ldapjs": "^3.0.7",
-    "motion": "^12.38.0",
+    "motion": "^12.42.2",
    "multer": "^2.2.0",
-    "nanoid": "^5.1.9",
+    "nanoid": "^5.1.16",
    "qrcode": "^1.5.4",
+    "serialport": "^13.0.0",
    "socks": "^2.8.7",
    "speakeasy": "^2.0.0",
    "ssh2": "^1.17.0",
-    "undici": "^8.5.0",
+    "undici": "^8.7.0",
    "ws": "^8.20.0"
  },
  "devDependencies": {
+    "@biomejs/biome": "2.5.2",
    "@codemirror/autocomplete": "^6.20.3",
-    "@codemirror/commands": "^6.10.3",
-    "@codemirror/search": "^6.7.0",
+    "@codemirror/commands": "^6.10.4",
+    "@codemirror/search": "^6.7.1",
    "@codemirror/theme-one-dark": "^6.1.3",
-    "@codemirror/view": "^6.41.1",
+    "@codemirror/view": "^6.43.5",
    "@commitlint/cli": "^21.0.2",
    "@commitlint/config-conventional": "^21.0.2",
    "@deadendjs/swagger-jsdoc": "^8.1.2",
    "@electron/notarize": "^3.1.1",
    "@electron/rebuild": "^4.0.4",
-    "@eslint/js": "^9.0.0",
+    "@eslint/js": "^10.0.1",
    "@fontsource-variable/jetbrains-mono": "^5.2.8",
    "@fontsource/fira-code": "^5.2.7",
    "@fontsource/jetbrains-mono": "^5.2.8",
    "@fontsource/source-code-pro": "^5.2.7",
    "@monaco-editor/react": "^4.7.0",
-    "@radix-ui/react-accordion": "^1.2.13",
-    "@radix-ui/react-alert-dialog": "^1.1.16",
-    "@radix-ui/react-checkbox": "^1.3.4",
-    "@radix-ui/react-dialog": "^1.1.16",
-    "@radix-ui/react-dropdown-menu": "^2.1.17",
-    "@radix-ui/react-label": "^2.1.9",
-    "@radix-ui/react-popover": "^1.1.16",
-    "@radix-ui/react-progress": "^1.1.9",
-    "@radix-ui/react-scroll-area": "^1.2.11",
-    "@radix-ui/react-select": "^2.3.1",
-    "@radix-ui/react-separator": "^1.1.9",
-    "@radix-ui/react-slider": "^1.4.1",
+    "@radix-ui/react-accordion": "^1.2.15",
+    "@radix-ui/react-alert-dialog": "^1.1.18",
+    "@radix-ui/react-checkbox": "^1.3.6",
+    "@radix-ui/react-dialog": "^1.1.18",
+    "@radix-ui/react-dropdown-menu": "^2.1.19",
+    "@radix-ui/react-label": "^2.1.11",
+    "@radix-ui/react-popover": "^1.1.18",
+    "@radix-ui/react-progress": "^1.1.11",
+    "@radix-ui/react-scroll-area": "^1.2.13",
+    "@radix-ui/react-select": "^2.3.2",
+    "@radix-ui/react-separator": "^1.1.11",
+    "@radix-ui/react-slider": "^1.4.2",
    "@radix-ui/react-slot": "^1.3.0",
-    "@radix-ui/react-switch": "^1.3.1",
-    "@radix-ui/react-tabs": "^1.1.14",
-    "@radix-ui/react-tooltip": "^1.2.9",
-    "@tailwindcss/vite": "^4.2.4",
+    "@radix-ui/react-switch": "^1.3.2",
+    "@radix-ui/react-tabs": "^1.1.16",
+    "@radix-ui/react-tooltip": "^1.2.11",
+    "@tailwindcss/vite": "^4.3.2",
    "@testing-library/dom": "^10.4.1",
    "@testing-library/jest-dom": "^6.9.1",
    "@testing-library/react": "^16.3.2",
@@ -114,7 +121,7 @@
    "@types/js-yaml": "^4.0.9",
    "@types/jsonwebtoken": "^9.0.10",
    "@types/multer": "^2.1.0",
-    "@types/node": "^25.9.2",
+    "@types/node": "^26.0.0",
    "@types/qrcode": "^1.5.6",
    "@types/react": "^19.2.17",
    "@types/react-dom": "^19.2.3",
@@ -124,9 +131,9 @@
    "@uiw/codemirror-extensions-langs": "^4.25.9",
    "@uiw/codemirror-theme-github": "^4.25.9",
    "@uiw/react-codemirror": "^4.25.9",
-    "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/coverage-v8": "^4.1.8",
-    "@vitest/ui": "^4.1.8",
+    "@vitejs/plugin-react": "^6.0.3",
+    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/ui": "^4.1.9",
    "@xterm/addon-clipboard": "^0.2.0",
    "@xterm/addon-fit": "^0.11.0",
    "@xterm/addon-unicode11": "^0.9.0",
@@ -135,24 +142,24 @@
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "cmdk": "^1.1.1",
-    "concurrently": "^9.2.1",
+    "concurrently": "^10.0.3",
    "cytoscape": "^3.34.0",
-    "electron": "^42.4.1",
+    "electron": "^43.0.0",
    "electron-builder": "^26.15.3",
-    "eslint": "^9.0.0",
+    "eslint": "^10.5.0",
    "eslint-plugin-react-hooks": "^7.1.1",
-    "eslint-plugin-react-refresh": "^0.5.2",
+    "eslint-plugin-react-refresh": "^0.5.3",
    "eslint-plugin-unused-imports": "^4.4.1",
    "globals": "^17.5.0",
    "guacamole-common-js": "^1.5.0",
    "husky": "^9.1.7",
-    "i18next": "^26.3.1",
+    "i18next": "^26.3.4",
    "i18next-browser-languagedetector": "^8.2.1",
    "jsdom": "^29.1.1",
-    "lint-staged": "^17.0.7",
+    "lint-staged": "^17.0.8",
    "lucide-react": "^1.20.0",
-    "prettier": "3.8.3",
-    "radix-ui": "^1.6.0",
+    "prettier": "3.8.4",
+    "radix-ui": "^1.6.1",
    "react": "^19.2.7",
    "react-cytoscapejs": "^2.0.0",
    "react-dom": "^19.2.7",
@@ -166,7 +173,7 @@
    "react-syntax-highlighter": "^16.1.1",
    "react-xtermjs": "^1.0.10",
    "remark-gfm": "^4.0.1",
-    "sharp": "^0.35.1",
+    "sharp": "^0.35.3",
    "sonner": "^2.0.7",
    "tailwind-merge": "^3.5.0",
    "tailwindcss": "^4.2.4",
@@ -175,7 +182,7 @@
    "typescript-eslint": "^8.61.1",
    "vite": "^8.0.16",
    "vite-plugin-svgr": "^5.2.0",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
  },
  "lint-staged": {
    "*.{ts,tsx}": [
@@ -0,0 +1,548 @@
+# Database Layer Refactor Phase 0 Audit
+
+Status: Draft  
+Branch: `feature/database-layer-refactor`  
+Purpose: Establish the current database access inventory, domain map, sensitive field map, and first implementation boundaries before changing runtime persistence.
+
+## 1. Scope
+
+Phase 0 does not change runtime behavior.
+
+It produces the evidence needed for the next implementation phases:
+
+- where database access currently happens
+- which modules write directly to the database
+- which tables belong to which product domains
+- which fields are sensitive
+- which direct writes are risky under the current in-memory snapshot model
+- which domains should move first into repositories
+
+## 2. Current Evidence
+
+Commands used for the initial audit:
+
+```bash
+rg -n "getDb\\(|getSqlite\\(|DatabaseSaveTrigger|SimpleDBOps|db\\.\\$client|\\.prepare\\(" src/backend
+rg -n "getDb\\(\\)\\.(insert|update|delete)|await db\\.(insert|update|delete)|db\\.(insert|update|delete)|\\.\\$client\\.prepare\\(\\\"(INSERT|UPDATE|DELETE)|\\.prepare\\(\\\"(INSERT|UPDATE|DELETE)|DatabaseSaveTrigger\\.triggerSave|DatabaseSaveTrigger\\.forceSave" src/backend
+rg -n "export const .* = sqliteTable\\(" src/backend/database/db/schema.ts
+```
+
+High-level findings:
+
+- Database infrastructure is concentrated in `src/backend/database/db/index.ts`.
+- Business database access is spread across route modules, SSH modules, utilities, and auth helpers.
+- `SimpleDBOps` is not the only write path.
+- There are many direct Drizzle writes and raw SQLite writes.
+- Some direct writes manually trigger `DatabaseSaveTrigger`; many write paths do not.
+- Schema is SQLite-specific through `sqliteTable` and manual `CREATE TABLE IF NOT EXISTS` / `addColumnIfNotExists`.
+
+## 3. Database Access Hotspots
+
+The most database-heavy files by audit hits:
+
+| File                                                  | Approx. hits | Notes                                                           |
+| ----------------------------------------------------- | -----------: | --------------------------------------------------------------- |
+| `src/backend/database/db/index.ts`                    |           75 | database init, schema creation, ad-hoc migration, snapshot save |
+| `src/backend/database/routes/alert-rules-routes.ts`   |           64 | alert rules, channels, firings, raw SQL deletes                 |
+| `src/backend/database/routes/users.ts`                |           54 | users, settings, OIDC/GitHub settings, admin flows              |
+| `src/backend/database/database.ts`                    |           27 | import/export, legacy SQLite handling                           |
+| `src/backend/ssh/host-metrics.ts`                     |           26 | metrics connection and settings reads                           |
+| `src/backend/database/routes/user-settings-routes.ts` |           16 | user settings                                                   |
+| `src/backend/dashboard.ts`                            |           15 | dashboard aggregation reads                                     |
+| `src/backend/ssh/docker.ts`                           |           14 | host/credential reads for Docker SSH                            |
+| `src/backend/ssh/managers/health.ts`                  |           13 | host health checks                                              |
+| `src/backend/ssh/alert-engine.ts`                     |           13 | alert evaluation and firing state                               |
+| `src/backend/utils/user-crypto.ts`                    |           12 | settings writes for crypto metadata                             |
+| `src/backend/ssh/host-metrics-settings-routes.ts`     |           12 | metrics settings                                                |
+| `src/backend/ssh/tmux-monitor.ts`                     |           11 | tmux session tags                                               |
+| `src/backend/guacamole/routes.ts`                     |           11 | Guacamole config/routes                                         |
+| `src/backend/database/routes/host.ts`                 |           10 | host operations and related rows                                |
+
+This confirms the refactor must be domain-by-domain. A mechanical replacement of `getDb()` would be noisy and unsafe.
+
+## 4. Direct Write Risk Inventory
+
+Under the current architecture, a direct write is risky when it bypasses `SimpleDBOps` and does not trigger `DatabaseSaveTrigger`.
+
+### 4.1 Direct Writes That Need Repository Ownership
+
+These areas perform direct writes and should move behind repositories/services:
+
+| Area                  | Representative files                                               | Examples                                                        |
+| --------------------- | ------------------------------------------------------------------ | --------------------------------------------------------------- |
+| users/settings/auth   | `routes/users.ts`, `utils/auth-manager.ts`, `utils/user-crypto.ts` | sessions, trusted devices, OIDC settings, registration settings |
+| RBAC/sharing          | `routes/rbac.ts`, `utils/shared-credential-manager.ts`             | roles, host access, snippet access, shared credentials          |
+| hosts/credentials     | `routes/host.ts`, `routes/credentials.ts`, `host-resolver.ts`      | host access cleanup, credential usage                           |
+| file manager metadata | `host-file-manager-bookmark-routes.ts`                             | recent, pinned, shortcuts                                       |
+| alerts                | `alert-rules-routes.ts`, `ssh/alert-engine.ts`                     | channels, rules, firings                                        |
+| metrics               | `host-metrics-preferences-routes.ts`, `managers/health.ts`         | preferences, health checks, history                             |
+| terminal logs         | `terminal-session-manager.ts`                                      | session recording metadata                                      |
+| tmux                  | `tmux-monitor.ts`                                                  | tmux session tags                                               |
+| import/export         | `database/database.ts`                                             | SQLite import and forced save                                   |
+| open tabs             | `routes/open-tabs.ts`                                              | tab persistence and cleanup                                     |
+| API keys              | `user-api-key-routes.ts`, `utils/auth-manager.ts`                  | API key create/delete/last-used                                 |
+| SSO and identity      | `sso-provider-routes.ts`, `termix-id.ts`                           | providers, identity keys/CA                                     |
+
+### 4.2 Immediate Compatibility Rule
+
+Until a domain is migrated to repositories:
+
+- Every direct write must either be moved into a repository or explicitly trigger persistence in the old runtime.
+- New code should not add direct `getDb()` writes outside infrastructure or repositories.
+- The draft branch should add an enforcement check before Phase 8, not immediately, because the current codebase still violates the target rule widely.
+
+## 5. Table Domain Map
+
+### 5.1 Identity and Authentication
+
+| Tables                 | Notes                                        |
+| ---------------------- | -------------------------------------------- |
+| `users`                | local/OIDC users, TOTP fields, password hash |
+| `sessions`             | JWT sessions                                 |
+| `trusted_devices`      | remembered devices                           |
+| `api_keys`             | API token hashes/prefixes                    |
+| `sso_providers`        | configured SSO providers                     |
+| `termix_identities`    | Termix identity records                      |
+| `termix_identity_keys` | public/private identity key metadata         |
+| `termix_identity_ca`   | CA material, private key is sensitive        |
+
+Suggested repository:
+
+- `userRepository`
+- `sessionRepository`
+- `trustedDeviceRepository`
+- `apiKeyRepository`
+- `ssoProviderRepository`
+- `termixIdentityRepository`
+
+### 5.2 Hosts and Credentials
+
+| Tables                 | Notes                                            |
+| ---------------------- | ------------------------------------------------ |
+| `ssh_data`             | primary host table, many config JSON/text fields |
+| `ssh_credentials`      | reusable credentials                             |
+| `ssh_credential_usage` | usage history                                    |
+| `ssh_folders`          | folder metadata                                  |
+| `host_access`          | sharing/RBAC access rows                         |
+| `shared_credentials`   | encrypted shared credential material             |
+| `network_topology`     | topology graph/config                            |
+
+Suggested repository:
+
+- `hostRepository`
+- `credentialRepository`
+- `credentialUsageRepository`
+- `hostAccessRepository`
+- `sharedCredentialRepository`
+- `hostFolderRepository`
+- `networkTopologyRepository`
+
+### 5.3 RBAC
+
+| Tables           | Notes                    |
+| ---------------- | ------------------------ |
+| `roles`          | role definitions         |
+| `user_roles`     | user to role assignments |
+| `host_access`    | host-level grants        |
+| `snippet_access` | snippet-level grants     |
+
+Suggested repository:
+
+- `roleRepository`
+- `accessRepository`
+
+### 5.4 File Manager
+
+| Tables                   | Notes                              |
+| ------------------------ | ---------------------------------- |
+| `file_manager_recent`    | recently opened paths              |
+| `file_manager_pinned`    | pinned paths                       |
+| `file_manager_shortcuts` | saved shortcuts                    |
+| `transfer_recent`        | host-to-host transfer destinations |
+
+Suggested repository:
+
+- `fileManagerRepository`
+- `transferRecentRepository`
+
+### 5.5 Snippets
+
+| Tables            | Notes                   |
+| ----------------- | ----------------------- |
+| `snippets`        | command snippets        |
+| `snippet_folders` | snippet folder metadata |
+| `snippet_access`  | snippet sharing         |
+
+Suggested repository:
+
+- `snippetRepository`
+
+### 5.6 Runtime Metadata and Audit
+
+| Tables               | Notes                                                  |
+| -------------------- | ------------------------------------------------------ |
+| `audit_logs`         | append-only audit trail                                |
+| `session_recordings` | terminal recording metadata, log content is file-based |
+| `recent_activity`    | host activity feed                                     |
+| `command_history`    | terminal command history                               |
+| `user_open_tabs`     | UI restore state; currently cleared on startup         |
+| `user_preferences`   | per-user UI/preferences                                |
+| `settings`           | global settings                                        |
+
+Suggested repository:
+
+- `auditRepository`
+- `sessionRecordingRepository`
+- `activityRepository`
+- `commandHistoryRepository`
+- `openTabsRepository`
+- `userPreferencesRepository`
+- `settingsRepository`
+
+### 5.7 Metrics and Alerts
+
+| Tables                     | Notes                      |
+| -------------------------- | -------------------------- |
+| `host_metrics_preferences` | metrics layout/preferences |
+| `host_health_checks`       | health check definitions   |
+| `host_health_history`      | health check results       |
+| `host_metrics_history`     | metrics history            |
+| `alert_rules`              | alert definitions          |
+| `notification_channels`    | webhook/ntfy/etc config    |
+| `alert_rule_channels`      | rule/channel joins         |
+| `alert_firings`            | firing/ack state           |
+| `dismissed_alerts`         | dismissed system alerts    |
+
+Suggested repository:
+
+- `metricsRepository`
+- `healthCheckRepository`
+- `alertRepository`
+- `notificationRepository`
+
+### 5.8 Integrations and Feature Config
+
+| Tables                    | Notes                                   |
+| ------------------------- | --------------------------------------- |
+| `c2s_tunnel_presets`      | tunnel preset config                    |
+| `opkssh_tokens`           | OPKSSH cert/private key cache           |
+| `vault_profiles`          | Vault profile config, mostly non-secret |
+| `vault_tokens`            | Vault cert/private key cache            |
+| `dashboard_service_links` | dashboard links                         |
+| `homepage_items`          | homepage widgets/items                  |
+| `homepage_layouts`        | homepage layouts                        |
+| `tmux_session_tags`       | tmux tag metadata                       |
+
+Suggested repository:
+
+- `tunnelPresetRepository`
+- `opksshTokenRepository`
+- `vaultRepository`
+- `dashboardRepository`
+- `homepageRepository`
+- `tmuxRepository`
+
+## 6. Sensitive Field Map
+
+The current explicit `FieldCrypto` map encrypts:
+
+| Table                | Fields                                                                                                                                                                          |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `users`              | `passwordHash`, `clientSecret`, `totpSecret`, `totpBackupCodes`, `oidcIdentifier`                                                                                               |
+| `ssh_data`           | `password`, `key`, `keyPassword`, `sudoPassword`, `autostartPassword`, `autostartKey`, `autostartKeyPassword`, `socks5Password`, `rdpPassword`, `vncPassword`, `telnetPassword` |
+| `ssh_credentials`    | `password`, `privateKey`, `keyPassword`, `key`, `publicKey`                                                                                                                     |
+| `opkssh_tokens`      | `sshCert`, `privateKey`                                                                                                                                                         |
+| `termix_identity_ca` | `privateKey`                                                                                                                                                                    |
+| `vault_tokens`       | `sshCert`, `privateKey`                                                                                                                                                         |
+
+Additional sensitive fields by table semantics:
+
+| Table                   | Fields / reason                                                                                                                                                |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `ssh_credentials`       | `systemPassword`, `systemKey`, `systemKeyPassword` are system-key encrypted credential copies                                                                  |
+| `shared_credentials`    | `encryptedUsername`, `encryptedAuthType`, `encryptedPassword`, `encryptedKey`, `encryptedKeyPassword`, `encryptedKeyType` are already encrypted payload fields |
+| `api_keys`              | `tokenHash` is not plaintext but is authentication material; `tokenPrefix` may remain plaintext for display                                                    |
+| `settings`              | some keys may hold provider secrets or reset codes; repository must classify by key                                                                            |
+| `notification_channels` | config may include webhook URLs/tokens; treat config as sensitive unless split                                                                                 |
+| `alert_rules`           | rule definitions are usually not secret but can include host/resource metadata                                                                                 |
+| `homepage_items`        | widget config can include URLs/API config; classify per widget type                                                                                            |
+| `c2s_tunnel_presets`    | config can include connection details; review before plaintext external DB storage                                                                             |
+| `termix_identity_keys`  | inspect key material fields before migration; public keys are not secret but private material must never be plaintext                                          |
+| `vault_profiles`        | current comments say profile fields are non-secret; keep that invariant explicit                                                                               |
+
+Open privacy decision:
+
+- `ssh_data.ip`, domain fields, usernames, folders, and tags are queryable today.
+- Encrypting them improves confidentiality but breaks search/filter/sort unless blind indexes are added.
+- Recommended initial migration: keep them plaintext and document privacy implications; add optional privacy mode later.
+
+## 7. Repository Migration Order
+
+Use a vertical slice instead of broad replacement.
+
+### 7.1 First Slice
+
+1. `settingsRepository`
+2. `userRepository`
+3. `sessionRepository`
+4. `hostRepository`
+5. `credentialRepository`
+
+Reasons:
+
+- Covers the app's boot/login/core host management path.
+- Exercises field encryption.
+- Exercises per-user data unlock requirements.
+- Exercises transaction and migration behavior.
+- Builds reusable patterns for the rest of the backend.
+
+### 7.2 Second Slice
+
+1. `hostAccessRepository`
+2. `roleRepository`
+3. `sharedCredentialRepository`
+4. `auditRepository`
+5. `userPreferencesRepository`
+
+Reasons:
+
+- Completes permission and sharing boundaries.
+- Removes high-risk direct writes in admin/RBAC flows.
+- Moves audit to an append-only repository.
+
+### 7.3 Third Slice
+
+1. `snippetRepository`
+2. `fileManagerRepository`
+3. `metricsRepository`
+4. `alertRepository`
+5. `homepageRepository`
+
+Reasons:
+
+- These are broad feature domains with many routes.
+- They should reuse patterns from the core slices.
+
+### 7.4 Fourth Slice
+
+1. `vaultRepository`
+2. `opksshTokenRepository`
+3. `termixIdentityRepository`
+4. `tunnelPresetRepository`
+5. `tmuxRepository`
+
+Reasons:
+
+- Sensitive token/key cache domains need careful encryption tests.
+- Some data is transient and should have retention cleanup.
+
+## 8. Adapter Design Notes
+
+The adapter boundary should expose:
+
+```ts
+interface DatabaseAdapter {
+  dialect: "sqlite" | "postgres" | "mysql";
+  connect(): Promise<void>;
+  close(): Promise<void>;
+  migrate(): Promise<void>;
+  transaction<T>(fn: (tx: DatabaseTransaction) => Promise<T>): Promise<T>;
+}
+```
+
+The repository layer should not depend on `better-sqlite3`.
+
+For Drizzle, likely options:
+
+- keep dialect-specific Drizzle clients internally
+- expose repositories instead of exposing the raw Drizzle client
+- keep schema definitions close to migrations, not route handlers
+
+Important: do not make route modules import dialect-specific schema objects after migration.
+
+## 9. Compatibility Shims
+
+During the migration, avoid a flag day.
+
+Add a compatibility database module that lets old code continue to run while new repositories are introduced:
+
+```text
+legacy getDb() path
+new adapter/repository path
+```
+
+Rules:
+
+- New modules use repositories only.
+- Migrated modules must not fall back to `getDb()`.
+- Legacy path is removed only after all domains move.
+
+## 10. Phase 1 Entry Criteria
+
+Before implementing the adapter skeleton:
+
+- This audit document exists.
+- The sensitive field map is reviewed.
+- The first vertical slice is accepted.
+- The draft PR remains draft.
+- No runtime behavior has changed.
+
+## 11. Phase 1 Deliverables
+
+Recommended first implementation PR on this branch:
+
+- `src/backend/database/runtime/config.ts`
+- `src/backend/database/runtime/adapter.ts`
+- `src/backend/database/runtime/sqlite-adapter.ts`
+- `src/backend/database/repositories/settings-repository.ts`
+- `src/backend/database/repositories/user-repository.ts`
+- `src/backend/database/repositories/session-repository.ts`
+- `src/backend/database/repositories/host-repository.ts`
+- `src/backend/database/repositories/credential-repository.ts`
+- `src/backend/database/repositories/field-encryption-boundary.ts`
+- `src/backend/database/repositories/current-settings-repository.ts`
+- tests for config parsing and SQLite adapter boot
+
+Started:
+
+- runtime config parser
+- SQLite adapter skeleton
+- migration metadata table bootstrap
+- `SettingsRepository` skeleton and tests
+- `UserRepository` and `SessionRepository` skeletons and tests
+- `HostRepository` and `CredentialRepository` skeletons and tests
+- `FieldEncryptionBoundary` skeleton and tests
+- first settings route slice wired through `SettingsRepository`
+- user settings route direct `settings` table access moved behind
+  `SettingsRepository`
+- host metrics settings route direct `settings` table access moved behind
+  `SettingsRepository`
+- ACME SSL settings route direct `settings` table access moved behind
+  `SettingsRepository`
+- terminal route direct `settings` table access moved behind
+  `SettingsRepository`
+- tailscale route direct `settings` table access moved behind
+  `SettingsRepository`
+- Guacamole route and WebSocket server direct `settings` table access moved
+  behind the current settings repository boundary
+- auth token expiry and terminal session timeout settings reads moved behind the
+  current settings repository boundary
+- open tabs, TOTP, and LDAP auth route settings reads moved behind the current
+  settings repository boundary
+- host metrics polling settings reads moved behind the current settings
+  repository boundary
+- backend startup settings reads moved behind the current settings repository
+  boundary
+- user deletion cleanup now removes per-user settings through
+  `SettingsRepository.deleteLike`
+- password reset route reset code and temporary token settings access moved
+  behind `SettingsRepository`
+- OIDC utility legacy config fallback reads `oidc_config` through
+  `SettingsRepository`
+- user route registration/password flags and OIDC config administration moved
+  behind the current settings repository boundary
+- OIDC authorize/callback temporary state and auto-provision reads moved behind
+  the current settings repository boundary
+- user login settings reads moved behind the current settings repository
+  boundary, completing direct `settings` access cleanup in `routes/users.ts`
+- user encryption metadata in `utils/user-crypto.ts` moved behind the current
+  settings repository boundary
+- database startup and schema migration defaults in `database/db/index.ts`
+  moved to local raw settings helpers
+- database import/export settings handling in `database/database.ts` moved to
+  local helper boundaries
+- core `auth-manager.ts` session create/read/update/revoke/list paths started
+  using the current session repository boundary
+- remaining `auth-manager.ts` session cleanup/middleware/logout paths and
+  `user-session-routes.ts` single-session lookup moved behind the current
+  session repository boundary
+- current user repository factory/write-save hook added, and
+  `user-admin-routes.ts` list/admin promotion/admin removal/admin-create user
+  paths moved behind the current user repository boundary
+- low-risk `routes/users.ts` current-user lookup and admin gate checks moved
+  behind the current user repository boundary
+- user registration, self-delete, password change hash updates, and admin
+  delete-user lookup paths in `routes/users.ts` moved behind the current user
+  repository boundary, with first-user admin creation kept transactional inside
+  `UserRepository`
+- traditional login username lookup and `auth-manager.ts` admin user checks
+  moved behind the current user repository boundary
+- GitHub and standard OIDC callback user lookup/create/rollback/profile/admin
+  sync writes moved behind the current user repository boundary, removing direct
+  Drizzle `users` table access from `routes/users.ts`, `user-admin-routes.ts`,
+  and `auth-manager.ts`
+- API key create/list/delete and API key authentication last-used updates moved
+  behind the current API key repository boundary
+- trusted device check/add/remove and TOTP trusted-device cleanup moved behind
+  the current trusted device repository boundary
+- user session routes moved user/admin lookups and admin session username
+  enrichment behind the current user repository boundary
+- vault admin checks, Termix ID audit username lookup, permission manager admin
+  checks, and user data export user lookup moved behind the current user
+  repository boundary
+- SSH credential OIDC username expansion and tmux monitor audit actor username
+  lookup moved behind the current user repository boundary
+- user settings route admin checks and audit actor username lookups moved behind
+  the current user repository boundary
+- ACME SSL route admin checks and audit actor username lookups moved behind the
+  current user repository boundary
+- audit log route admin checks moved behind the current user repository boundary
+- OIDC account link/unlink route user lookups and OIDC field updates moved
+  behind the current user repository boundary
+- password reset route user lookups, password hash updates, and TOTP reset
+  fields moved behind the current user repository boundary
+- user deletion helper now removes sessions through the current session
+  repository and the final user record through the current user repository
+- snippet create/update/delete audit actor username lookups moved behind the
+  current user repository boundary
+- LDAP login existing-user lookup, encryption rollback delete, admin sync, and
+  display-name sync moved behind the current user repository boundary
+- TOTP setup/enable/disable/backup-code/login verification user updates and
+  session revocation moved behind the current user/session repository
+  boundaries
+- RBAC host sharing, role assignment, and snippet sharing target-user existence
+  checks moved behind the current user repository boundary, with existing
+  RBAC/snippet owner username joins retained
+- RBAC role list/create/update/delete, user-role assignment/removal/listing,
+  and shared host/snippet role-id lookups moved behind the current role
+  repository boundary, with existing RBAC/share credential joins retained
+- permission manager role permission aggregation, role-id lookups for shared
+  host access, and admin role checks moved behind the current role repository
+  boundary
+- RBAC host/snippet access-list read models moved behind the current RBAC access
+  repository boundary, and snippet route shared-access role-id lookups moved
+  behind the current role repository boundary
+- RBAC shared host/shared snippet read models and the main snippet
+  shared-snippet read model moved behind the current RBAC access repository
+  boundary
+- RBAC host/snippet access grant, revoke, and direct host-access credential
+  override writes moved behind the current RBAC access repository boundary,
+  with shared credential material creation retained in the existing manager
+- permission manager host-access expiration cleanup, shared host-access lookup,
+  and last-access timestamp updates moved behind the current RBAC access
+  repository boundary
+- repository rollout guard added through `DATABASE_LAYER_REPOSITORY_ROLLOUT`
+  for the migrated settings/users/sessions/API-key/trusted-device/role/RBAC-access
+  slice
+
+Keep it small. Do not wire host or credential routes into the new repositories in
+the same first implementation commit.
+
+## 12. Current Unknowns
+
+- Exact Drizzle multi-dialect strategy needs a spike.
+- The project may need a migration generator or a custom migration runner.
+- Some raw SQL in `routes/users.ts`, `alert-rules-routes.ts`, and `db/index.ts` must be rewritten or isolated.
+- `settings` contains mixed public and sensitive values; key-level classification is required.
+- `homepage_items.config`, `notification_channels.config`, and tunnel configs may contain embedded secrets.
+- Legacy encrypted snapshot fixtures need to be created before migration implementation.
+
+## 13. Decision Log
+
+- Default upgrade target should be persistent SQLite, not PostgreSQL/MySQL.
+- PostgreSQL/MySQL migration should be explicit and initially manual/experimental.
+- Runtime SSH/WebSocket/tunnel state remains memory-only.
+- Field-level encryption is mandatory for every database backend.
+- Field-level encryption must use a stable record id; temporary encryption
+  contexts are forbidden for newly written repository data.
+- Repository migration should start with settings/users/sessions/hosts/credentials.
@@ -1,185 +0,0 @@
-# Host-to-host file transfer
-
-This document describes the host-to-host copy/move feature. It is intended for operators and contributors. Direct host-to-host routing via SSH tunnels is **not implemented**; that is documented under [Future work](#future-work-direct-routing-via-tunnels).
-
-## Overview
-
-Host-to-host transfer copies or moves files from one SSH host to another through the **Termix server** as a relay. The UI lives in **File Manager**: right-click files or folders and choose **Copy to host…** or **Move to host…**.
-
-Compared to copying via your laptop (`scp -3` or `ssh one 'cat …' | ssh two 'cat …'`), Termix keeps the job on the server so transfers continue if you close the browser, and you get integrated progress, cancel, retry, and cleanup.
-
-```mermaid
-flowchart LR
-  Browser[Browser_UI]
-  Termix[Termix_server]
-  Src[Source_host]
-  Dst[Destination_host]
-
-  Browser -->|start_transfer_API| Termix
-  Termix -->|dedicated_SSH_xfer_src| Src
-  Termix -->|dedicated_SSH_xfer_dst| Dst
-  Termix -->|SFTP_read_then_write| Termix
-```
-
-Data for remote-to-remote paths **always passes through the Termix process** (pipelined SFTP buffers, or a tar archive stream). There is no source→destination SSH tunnel for file bytes today.
-
-## Prerequisites
-
-1. **Two hosts** with File Manager enabled, saved in Host Manager.
-2. **Both hosts reachable from the Termix server** on SSH (each host’s jump hosts and SOCKS5 proxy chain apply to the **Termix→host** connection, not host→host).
-3. **File Manager open** on the source host (browse session connected). The destination host should show **Ready** in the transfer dialog; if it shows authentication required, open File Manager on that host once first.
-4. For **multi-file or folder** transfers, pick a **destination directory** (not a file path).
-
-The dialog shows a reminder: _“Both hosts must be reachable from the Termix server. Direct host-to-host routing is not supported.”_
-
-## Using the UI
-
-### Start a transfer
-
-1. Open File Manager on the **source** host.
-2. Select one or more files or folders.
-3. Right-click → **Copy to host…** or **Move to host…** (sidebar tree supports the same context menu).
-4. In the dialog:
-   - Choose **destination host** (other connected file-manager hosts).
-   - Set **destination path** (type a path or use **Browse destination folders**).
-   - Optionally pick a **recent destination** (collapsed by default).
-   - For multi-item transfers, choose **transfer method** (Auto / Tar archive / Per-file SFTP); a preview explains what Auto will pick.
-   - Pin folders with **Add to shortcuts** (per-destination host; uses normal file-manager shortcuts, not a separate favourites list).
-5. Confirm **Copy** or **Move**.
-
-### During transfer
-
- A **progress toast** shows phase (compressing, transferring, extracting), bytes, speed, and **Cancel**.
- **Transfer monitor** (desktop, when authenticated) picks up active transfers started in another tab or window.
- Large **single files** use segmented SFTP (256 MiB segments) with **2 parallel lanes** by default (separate dedicated SSH session pairs per lane). The toast can show total speed and lane count when multiple lanes are active.
-
-### After completion or failure
-
-| Outcome       | What happens                                                                                                     |
-| ------------- | ---------------------------------------------------------------------------------------------------------------- |
-| **Success**   | Toast success; destination path saved to **recent destinations** for that source host; file manager can refresh. |
-| **Partial**   | Some paths failed; toast lists failed paths; source may be kept on move.                                         |
-| **Error**     | Toast with **Retry** when partial data on destination allows resume.                                             |
-| **Cancelled** | Toast with optional **Clean up destination** to remove partial files.                                            |
-
-**Move** deletes source files only after a successful full transfer (same as copy, then source delete). Cancelled or partial moves may leave files on both sides.
-
-### Metrics
-
-On success, expanded timing details can include: prepare destination, compress (tar), per-hop throughput (source→server, server→dest), extract, source delete, total duration.
-
-## Transfer methods
-
-| Method                   | When used                                                                           | Behavior                                                                                                     |
-| ------------------------ | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
-| **Stream (single file)** | Exactly one file, copy or move                                                      | Pipelined SFTP read on source → write on destination; segmented above 32 MiB; parallel lanes for throughput. |
-| **Tar archive**          | Multi-file/folder when Auto or user selects Tar, and both sides are Unix with `tar` | `tar -czf` on source → one archive streamed through Termix → `tar -xzf` on destination.                      |
-| **Per-file SFTP**        | Windows involved, tar unavailable, or Auto chooses it                               | Each file copied sequentially over SFTP through Termix.                                                      |
-
-**Auto** heuristics (see `src/backend/ssh/transfer-routing.ts`) consider file count, total size, largest file, and compressibility (e.g. many small files → tar; large incompressible sets → per-file SFTP).
-
-**Method preview** is locked for the current source path set until you change Auto/Tar/Per-file preference, so changing only the destination host does not re-scan the source.
-
-## Architecture (implementation)
-
-| Component                                                                                                                 | Role                                                                         |
-| ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
-| [`src/backend/ssh/host-transfer.ts`](../src/backend/ssh/host-transfer.ts)                                                 | Transfer engine: sessions, SFTP pipeline, tar path, retry, cancel, progress. |
-| [`src/backend/ssh/file-manager.ts`](../src/backend/ssh/file-manager.ts)                                                   | HTTP routes, `openDedicatedTransferSession`, jump/SOCKS connect.             |
-| [`src/backend/ssh/transfer-routing.ts`](../src/backend/ssh/transfer-routing.ts)                                           | Tar vs per-file SFTP selection.                                              |
-| [`src/backend/ssh/transfer-paths.ts`](../src/backend/ssh/transfer-paths.ts)                                               | Path normalization (Unix/Windows).                                           |
-| [`src/ui/.../TransferToHostDialog.tsx`](../src/ui/desktop/apps/features/file-manager/components/TransferToHostDialog.tsx) | Transfer dialog.                                                             |
-| [`src/ui/.../transferProgressMonitor.tsx`](../src/ui/desktop/apps/features/file-manager/transferProgressMonitor.tsx)      | Toasts, cancel, retry, cleanup.                                              |
-| [`src/ui/.../TransferMonitor.tsx`](../src/ui/desktop/apps/features/file-manager/TransferMonitor.tsx)                      | Global active-transfer polling.                                              |
-
-**Sessions:** Browse sessions identify hosts. Each transfer opens **dedicated** SSH sessions (`xfer:{transferId}:src` / `:dst`) so browsing and transfers do not share channels. Parallel lanes add `xfer:{transferId}:src:pN` / `:dst:pN`.
-
-**Special case:** If the destination host is the **same machine as Termix** (local SSH endpoint), writes use the local filesystem via `fastGet` instead of dest SFTP; data still originates from the remote source through Termix.
-
-**Persistence:** Recent destinations are stored in `transfer_recent` (per user, per source host). Folder shortcuts use `file_manager_shortcuts` on the destination host.
-
-## HTTP API (file manager service)
-
-| Endpoint                                                 | Purpose                                                                                                                                                                    |
-| -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `POST /ssh/file_manager/ssh/transferMethodPreview`       | Scan source; return resolved tar vs item_sftp and reason.                                                                                                                  |
-| `POST /ssh/file_manager/ssh/transferToHost`              | Start transfer; body includes `sourceSessionId`, `destSessionId`, `sourcePaths`, `destPath`, `move`, `methodPreference`, optional `parallelSegmentCount` (1–8, default 2). |
-| `GET /ssh/file_manager/ssh/transferStatus/:transferId`   | Poll progress.                                                                                                                                                             |
-| `GET /ssh/file_manager/ssh/activeTransfers`              | List running transfers for user.                                                                                                                                           |
-| `POST /ssh/file_manager/ssh/transferCancel/:transferId`  | Request cancel.                                                                                                                                                            |
-| `POST /ssh/file_manager/ssh/transferCleanup/:transferId` | Remove partial destination artifacts after cancel/failure.                                                                                                                 |
-| `POST /ssh/file_manager/ssh/transferRetry/:transferId`   | Retry with same snapshot (resume when possible).                                                                                                                           |
-
-Database (main API): `GET/POST /host/transfer/recent` for recent destinations.
-
-## Reliability features
-
- **Resume:** Destination file size is probed; SFTP write opens with resume when a partial file exists (per segment on large files).
- **Retry:** Reconnects dedicated sessions; segment-level and full-copy retries with backoff; fresh SSH pairs after repeated failures (lane reset).
- **Stall detection:** ~45 s without progress on a segment; hung transfer/reconnect probing on status polls.
- **Cancel:** Aborts in-flight SFTP; user can clean up destination paths that were created or partially written.
- **Overlap guard:** Refuses transfer when source and destination paths overlap in a destructive way.
-
-## Limitations
-
-1. **No direct host-to-host data path** — Termix must reach **both** hosts independently (with each host’s jump/proxy settings).
-2. **Not the same as S2S SSH tunnels** — Tunnels in Host Manager forward TCP ports; they do not carry file-manager transfers today.
-3. **Throughput** — Remote-to-remote speed is bounded by Termix CPU/RAM and min(Termix↔source, Termix↔dest) links; very large files on a small Termix box may be slower than `scp -3` from a powerful desktop.
-4. **Parallel lanes** — Writes are out of order on disk; fine for copy, not for playing media from a partially written file. Default is 2 lanes; UI may not expose lane count (API default applies).
-5. **Tar** — Requires `tar` on both Unix hosts; temporary archive under `/tmp` on source during transfer.
-6. **Windows** — Tar path disabled; per-file SFTP only for Windows endpoints.
-7. **Jump hosts on S2S tunnels** — Server-to-server **tunnel** connect does not use jump hosts; only transfer/browse SSH does. A host reachable only via jump may work for transfer but not as an S2S tunnel source until tunnel code is aligned.
-
-## Troubleshooting
-
-| Symptom                               | Things to check                                                                                            |
-| ------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
-| No destination hosts listed           | Open File Manager on another host; ensure host has File Manager enabled.                                   |
-| Destination “Authentication required” | Connect File Manager on that host once in this session.                                                    |
-| Transfer fails immediately            | SSH from Termix to both hosts (firewall, jump host, SOCKS5, credentials).                                  |
-| Slow speed                            | Termix link to slower side; try off-peak; for single huge files, parallel lanes help if CPU/network allow. |
-| Stuck progress                        | Wait for stall/reconnect; cancel and retry; check server logs for `host_transfer` / `transfer_ssh_*`.      |
-| Partial files after cancel            | Use **Clean up destination** in the toast.                                                                 |
-| 28 GB / 25 GB style progress          | Usually parallel progress accounting; status polls use destination size probes.                            |
-
-## Comparison to manual `scp` between remotes
-
-See [Unix & Linux: scp from one remote server to another](https://unix.stackexchange.com/questions/85292/scp-from-one-remote-server-to-another-remote-server). Naive `scp one:file two:file` runs **from the first host** and fails unless that host can SSH to the second. `scp -3` relays through your workstation. **Termix relay** is analogous to `scp -3` through the **Termix server**, with richer lifecycle management, not analogous to direct `ssh source 'scp … dest'`.
-
---
-
-## Future work: direct routing via tunnels
-
-The following are **planned / discussed** enhancements, not shipped in the current build. They build on existing **S2S SSH tunnels** (`src/backend/ssh/tunnel.ts`), which already connect **source → endpoint** using `forwardOut` from the source host to the endpoint’s SSH port.
-
-### Why tunnels matter
-
-Many homelabs have a destination that is **only reachable from another host** (e.g. NAS on LAN behind a Pi), while Termix runs elsewhere. Today that destination cannot receive a dedicated `xfer:dst` session from Termix even if an S2S tunnel from Pi → NAS is configured and working.
-
-### Possible routes (future)
-
-| Route                                   | Termix SSH legs | Data path                   | Benefit vs today                                                                         |
-| --------------------------------------- | --------------- | --------------------------- | ---------------------------------------------------------------------------------------- |
-| **Relay (current)**                     | 2               | Termix buffers SFTP         | Works when both hosts reachable from Termix.                                             |
-| **Tunnel-bridged SFTP**                 | 1 (+ bridge)    | Still through Termix memory | Dest reached via source `forwardOut`; fixes reachability; reuses most of current engine. |
-| **Direct remote (rsync/scp on source)** | 1 (control)     | **Source → dest** bytes     | Best throughput; Termix orchestrates `rsync`/`scp` on source when forward + tools allow. |
-
-### Integration ideas (not implemented)
-
-1. **`transfer-bridge` module** — Shared `forwardOut` probe and `connectDestThroughSource` (extracted from tunnel code); lookup matching `tunnel_connections` on the source host record.
-2. **Route resolver** — Auto-select relay vs bridged vs direct; expose route in method preview (“via Termix” vs “direct host-to-host”).
-3. **Reuse active S2S tunnel** — If Host Manager tunnel source→dest is already connected, reuse `endpointClient` instead of opening a second bridge.
-4. **Jump hosts on S2S tunnel source** — Align tunnel connect with file-manager jump chains so tunnel and transfer eligibility match.
-5. **Fallback** — Always fall back to current relay when probe or remote `rsync` fails (Windows, missing tools, forwarding denied).
-
-### What would be preserved
-
-Cancel, partial cleanup, retry/resume (rsync `--partial` on direct path; existing SFTP segment resume on relay/bridged), dedicated sessions, transfer monitor, recent destinations, folder shortcuts, and tar/per-file method selection (with direct-path variants for multi-file).
-
-### References
-
- Internal plan: `.cursor/plans/host-to-host_direct_transfer_*.plan.md` (if present in your checkout).
- Tunnel implementation: [`src/backend/ssh/tunnel.ts`](../src/backend/ssh/tunnel.ts) — `connectEndpointThroughSource`, `establishManagedS2STunnel`.
- Transfer engine: [`src/backend/ssh/host-transfer.ts`](../src/backend/ssh/host-transfer.ts).
-
---
@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix مجاني ومفتوح المصدر. إذا وجدته مفيدًا، فكّر في [التبرع](https://donate.termix.site/) للمساعدة في تغطية تكاليف الخادم ووقت التطوير.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix هي منصة مفتوحة المصدر ومجانية للأبد وذا
 <tr>
 <td width="50%" valign="top">

-**إدارة Docker:**
-تشغيل وإيقاف وتعليق وحذف الحاويات. عرض إحصائيات الحاويات. التحكم في الحاوية باستخدام طرفية docker exec. لم يُصمم ليحل محل Portainer أو Dockge بل لإدارة حاوياتك ببساطة مقارنة بإنشائها.
+**إدارة Docker و Podman:**
+تشغيل وإيقاف وتعليق وحذف الحاويات. عرض إحصائيات الحاويات. التحكم في الحاوية باستخدام طرفية docker exec. يدعم كلاً من Docker و Podman كبيئة تشغيل للحاويات. لم يُصمم ليحل محل Portainer أو Dockge بل لإدارة حاوياتك ببساطة مقارنة بإنشائها.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix هي منصة مفتوحة المصدر ومجانية للأبد وذا
 <tr>
 <td width="50%" valign="top">

+**تكامل Tailscale:**
+عرض أجهزة شبكتك من Tailscale لإضافتها بسرعة كمضيفات، والاتصال عبر Tailscale SSH كطريقة مصادقة، مما يتيح لقوائم تحكم الوصول في Tailscale التعامل مع التفويض دون الحاجة لتخزين بيانات اعتماد.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 إنشاء الأدوار ومشاركة المضيفات عبر المستخدمين/الأدوار.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**الاتصالات التسلسلية:**
+الاتصال بالأجهزة التسلسلية (أجهزة التوجيه والمفاتيح والمتحكمات الدقيقة وغيرها) مباشرة من المتصفح أو تطبيق سطح المكتب. ضبط معدل نقل البيانات وبتات البيانات وبتات التوقف والتكافؤ. يستخدم Web Serial API في المتصفحات المدعومة أو خلفية أصلية في تطبيق Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**التنبيهات:**
+ضبط قواعد تنبيه قائمة على الحدود لمقاييس المضيف (المعالج والذاكرة والقرص وغيرها) والحصول على إشعارات عبر ntfy أو webhooks عند إطلاقها. عرض التنبيهات النشطة والمحلولة في سجل التاريخ.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**الصفحة الرئيسية:**
+صفحة رئيسية قابلة للتخصيص بالكامل مع شبكة أدوات قابلة للسحب والإفلات. أضف أدوات لحالة المضيف وروابط الخدمات والساعات والملاحظات وخلاصات RSS والطقس وحاويات Docker ومخططات مقاييس المضيف والطرفيات المضمنة والإطارات المضمنة وأكثر.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## التبرع
+
+Termix مجاني ومفتوح المصدر. إذا وجدته مفيدًا، فكّر في [التبرع](https://donate.termix.site/) للمساعدة في تغطية تكاليف الخادم ووقت التطوير.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## لقطات الشاشة

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>قد تكون بعض مقاطع الفيديو والصور قديمة أو قد لا تعرض الميزات بشكل مثالي.</sub>
@@ -305,7 +352,7 @@ networks:

 ## الميزات المخططة

-راجع [المشاريع](https://github.com/orgs/Termix-SSH/projects/2) لعرض جميع الميزات المخططة. إذا كنت تتطلع للمساهمة، راجع [المساهمة](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+راجع [المشاريع](https://github.com/orgs/Termix-SSH/projects/5) لعرض جميع الميزات المخططة. إذا كنت تتطلع للمساهمة، راجع [المساهمة](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix 免费且开源。如果您觉得它有用，请考虑[捐赠](https://donate.termix.site/)以帮助支付服务器费用和开发时间。
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix 是一个开源、永久免费、自托管的一体化服务器管理平
 <tr>
 <td width="50%" valign="top">

-**Docker 管理:**
-启动、停止、暂停、移除容器。查看容器统计信息。通过 docker exec 终端控制容器。它的初衷不是取代 Portainer 或 Dockge，而是为了比直接创建容器更简单地管理它们。
+**Docker 和 Podman 管理:**
+启动、停止、暂停、移除容器。查看容器统计信息。通过 docker exec 终端控制容器。同时支持 Docker 和 Podman 作为容器运行时。它的初衷不是取代 Portainer 或 Dockge，而是为了比直接创建容器更简单地管理它们。

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix 是一个开源、永久免费、自托管的一体化服务器管理平
 <tr>
 <td width="50%" valign="top">

+**Tailscale 集成:**
+列出您 Tailscale 网络中的设备以快速添加为主机，并使用 Tailscale SSH 作为身份验证方式，让您的 Tailscale ACL 处理授权而无需存储凭据。
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 创建角色并在用户/角色之间共享主机。

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**串口连接:**
+直接从浏览器或桌面应用连接到串口设备（路由器、交换机、微控制器等）。配置波特率、数据位、停止位和奇偶校验。在支持的浏览器中使用 Web Serial API，或在 Electron 应用中使用原生后端。
+
+</td>
+<td width="50%" valign="top">
+
+**告警:**
+为主机指标（CPU、内存、磁盘等）设置基于阈值的告警规则，并通过 ntfy 或 webhook 接收触发通知。在历史日志中查看触发和已解决的告警。
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**主页:**
+具有拖放小组件网格的完全可定制主页。添加主机状态、服务链接、时钟、笔记、RSS 订阅、天气、Docker 容器、主机指标图表、嵌入式终端、iframe 等小组件。
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## 捐赠
+
+Termix 免费且开源。如果您觉得它有用，请考虑[捐赠](https://donate.termix.site/)以帮助支付服务器费用和开发时间。
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## 展示

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>某些视频和图像可能已过时，或者可能无法完美展示功能。</sub>
@@ -305,7 +352,7 @@ networks:

 ## 计划功能

-查看 [Projects](https://github.com/orgs/Termix-SSH/projects/2) 了解所有计划功能。如果您想贡献代码，请参阅 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)。
+查看 [Projects](https://github.com/orgs/Termix-SSH/projects/5) 了解所有计划功能。如果您想贡献代码，请参阅 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)。

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix ist kostenlos und Open Source. Wenn Sie es nützlich finden, erwägen Sie eine [Spende](https://donate.termix.site/), um Serverkosten und Entwicklungszeit zu decken.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Verwalten Sie Dateien direkt auf Remote-Servern mit Unterstutzung fur das Anzeig
 <tr>
 <td width="50%" valign="top">

-**Docker-Verwaltung:**
-Container starten, stoppen, pausieren, entfernen. Container-Statistiken anzeigen. Container uber Docker-Exec-Terminal steuern. Es wurde nicht entwickelt, um Portainer oder Dockge zu ersetzen, sondern um Ihre Container einfach zu verwalten, anstatt sie zu erstellen.
+**Docker- und Podman-Verwaltung:**
+Container starten, stoppen, pausieren, entfernen. Container-Statistiken anzeigen. Container uber Docker-Exec-Terminal steuern. Unterstutzt sowohl Docker als auch Podman als Container-Laufzeitumgebung. Es wurde nicht entwickelt, um Portainer oder Dockge zu ersetzen, sondern um Ihre Container einfach zu verwalten, anstatt sie zu erstellen.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Sichere Benutzerverwaltung mit Admin-Kontrollen und OIDC-/LDAP-/SSO-Unterstutzun
 <tr>
 <td width="50%" valign="top">

+**Tailscale-Integration:**
+Gerate aus Ihrem Tailnet auflisten, um sie schnell als Hosts hinzuzufugen, und mit Tailscale SSH als Authentifizierungsmethode verbinden, sodass Ihre Tailnet-ACLs die Autorisierung ubernehmen, ohne Anmeldedaten speichern zu mussen.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Rollen erstellen und Hosts uber Benutzer/Rollen teilen.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Serielle Verbindungen:**
+Verbinden Sie sich direkt vom Browser oder der Desktop-App aus mit seriellen Geraten (Router, Switches, Mikrocontroller usw.). Konfigurieren Sie Baudrate, Datenbits, Stoppbits und Paritat. Verwendet die Web Serial API in unterstutzten Browsern oder ein natives Backend in der Electron-App.
+
+</td>
+<td width="50%" valign="top">
+
+**Warnmeldungen:**
+Legen Sie schwellenwertbasierte Warnregeln fur Host-Metriken (CPU, Arbeitsspeicher, Festplatte usw.) fest und erhalten Sie Benachrichtigungen uber ntfy oder Webhooks, wenn diese ausgelost werden. Zeigen Sie ausgeloste und aufgeloste Warnmeldungen in einem Verlaufsprotokoll an.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Startseite:**
+Eine vollstandig anpassbare Startseite mit einem Drag-and-Drop-Widget-Raster. Fugen Sie Widgets fur Hoststatus, Service-Links, Uhren, Notizen, RSS-Feeds, Wetter, Docker-Container, Host-Metrik-Diagramme, eingebettete Terminals, iFrames und mehr hinzu.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Spenden
+
+Termix ist kostenlos und Open Source. Wenn Sie es nützlich finden, erwägen Sie eine [Spende](https://donate.termix.site/), um Serverkosten und Entwicklungszeit zu decken.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Screenshots

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Einige Videos und Bilder konnen veraltet sein oder Funktionen moglicherweise nicht perfekt darstellen.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Geplante Funktionen

-Siehe [Projekte](https://github.com/orgs/Termix-SSH/projects/2) fur alle geplanten Funktionen. Wenn Sie beitragen mochten, siehe [Mitwirken](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Siehe [Projekte](https://github.com/orgs/Termix-SSH/projects/5) fur alle geplanten Funktionen. Wenn Sie beitragen mochten, siehe [Mitwirken](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix es gratuito y de código abierto. Si lo encuentras útil, considera [donar](https://donate.termix.site/) para ayudar a cubrir los costos del servidor y el tiempo de desarrollo.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Gestione archivos directamente en servidores remotos con soporte para visualizar
 <tr>
 <td width="50%" valign="top">

-**Gestion de Docker:**
-Inicie, detenga, pause, elimine contenedores. Vea estadisticas de contenedores. Controle contenedores usando el terminal docker exec. No fue creado para reemplazar Portainer o Dockge, sino para simplemente gestionar sus contenedores en lugar de crearlos.
+**Gestion de Docker y Podman:**
+Inicie, detenga, pause, elimine contenedores. Vea estadisticas de contenedores. Controle contenedores usando el terminal docker exec. Compatible con Docker y Podman como entorno de ejecucion de contenedores. No fue creado para reemplazar Portainer o Dockge, sino para simplemente gestionar sus contenedores en lugar de crearlos.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Gestion segura de usuarios con controles de administrador y soporte para OIDC/LD
 <tr>
 <td width="50%" valign="top">

+**Integracion con Tailscale:**
+Liste dispositivos de su red Tailscale para agregarlos rapidamente como hosts y conectese usando Tailscale SSH como metodo de autenticacion, permitiendo que las ACL de Tailscale gestionen la autorizacion sin almacenar credenciales.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Cree roles y comparta hosts entre usuarios/roles.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Conexiones Serie:**
+Conectese a dispositivos serie (routers, switches, microcontroladores, etc.) directamente desde el navegador o la aplicacion de escritorio. Configure la tasa de baudios, bits de datos, bits de parada y paridad. Utiliza la Web Serial API en navegadores compatibles o un backend nativo en la aplicacion Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Alertas:**
+Configure reglas de alerta basadas en umbrales para metricas del host (CPU, memoria, disco, etc.) y reciba notificaciones a traves de ntfy o webhooks cuando se activen. Vea las alertas activas y resueltas en un historial de registros.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Pagina de Inicio:**
+Una pagina de inicio completamente personalizable con una cuadricula de widgets de arrastrar y soltar. Agregue widgets para estado del host, enlaces de servicios, relojes, notas, feeds RSS, clima, contenedores Docker, graficos de metricas del host, terminales integrados, iframes y mas.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Donar
+
+Termix es gratuito y de código abierto. Si lo encuentras útil, considera [donar](https://donate.termix.site/) para ayudar a cubrir los costos del servidor y el tiempo de desarrollo.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Capturas de Pantalla

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Algunos videos e imagenes pueden estar desactualizados o no mostrar perfectamente las caracteristicas.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Caracteristicas Planeadas

-Consulte [Proyectos](https://github.com/orgs/Termix-SSH/projects/2) para todas las caracteristicas planeadas. Si desea contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Consulte [Proyectos](https://github.com/orgs/Termix-SSH/projects/5) para todas las caracteristicas planeadas. Si desea contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix est gratuit et open source. Si vous le trouvez utile, pensez à [faire un don](https://donate.termix.site/) pour aider à couvrir les coûts de serveur et le temps de développement.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Gerez les fichiers directement sur les serveurs distants avec support de la visu
 <tr>
 <td width="50%" valign="top">

-**Gestion Docker:**
-Demarrez, arretez, mettez en pause, supprimez des conteneurs. Consultez les statistiques des conteneurs. Controlez les conteneurs via le terminal docker exec. Non concu pour remplacer Portainer ou Dockge, mais plutot pour gerer simplement vos conteneurs plutot que de les creer.
+**Gestion Docker et Podman:**
+Demarrez, arretez, mettez en pause, supprimez des conteneurs. Consultez les statistiques des conteneurs. Controlez les conteneurs via le terminal docker exec. Compatible avec Docker et Podman comme environnement d'execution de conteneurs. Non concu pour remplacer Portainer ou Dockge, mais plutot pour gerer simplement vos conteneurs plutot que de les creer.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Gestion securisee des utilisateurs avec controles administrateur et support OIDC
 <tr>
 <td width="50%" valign="top">

+**Integration Tailscale:**
+Listez les appareils de votre reseau Tailscale pour les ajouter rapidement comme hotes, et connectez-vous en utilisant Tailscale SSH comme methode d'authentification, laissant les ACL de votre reseau gerer l'autorisation sans stocker de credentials.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Creez des roles et partagez des hotes entre utilisateurs/roles.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Connexions Serie:**
+Connectez-vous a des appareils serie (routeurs, commutateurs, microcontroleurs, etc.) directement depuis le navigateur ou l'application bureau. Configurez le debit en bauds, les bits de donnees, les bits d'arret et la parite. Utilise l'API Web Serial dans les navigateurs compatibles ou un backend natif dans l'application Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Alertes:**
+Definissez des regles d'alerte basees sur des seuils pour les metriques d'hote (CPU, memoire, disque, etc.) et recevez des notifications via ntfy ou webhooks lorsqu'elles se declenchent. Consultez les alertes actives et resolues dans un journal d'historique.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Page d'accueil:**
+Une page d'accueil entierement personnalisable avec une grille de widgets glisser-deposer. Ajoutez des widgets pour l'etat des hotes, les liens de services, les horloges, les notes, les flux RSS, la meteo, les conteneurs Docker, les graphiques de metriques d'hote, les terminaux integres, les iframes et plus encore.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Faire un don
+
+Termix est gratuit et open source. Si vous le trouvez utile, pensez à [faire un don](https://donate.termix.site/) pour aider à couvrir les coûts de serveur et le temps de développement.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Captures d'ecran

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Certaines videos et images peuvent etre obsoletes ou ne pas presenter parfaitement les fonctionnalites.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Fonctionnalites prevues

-Consultez les [Projects](https://github.com/orgs/Termix-SSH/projects/2) pour toutes les fonctionnalites prevues. Si vous souhaitez contribuer, consultez [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Consultez les [Projects](https://github.com/orgs/Termix-SSH/projects/5) pour toutes les fonctionnalites prevues. Si vous souhaitez contribuer, consultez [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix मुफ़्त और ओपन सोर्स है। यदि आपको यह उपयोगी लगता है, तो सर्वर लागत और विकास समय में मदद के लिए [दान करें](https://donate.termix.site/)।
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix एक ओपन-सोर्स, हमेशा के लिए मु
 <tr>
 <td width="50%" valign="top">

-**Docker प्रबंधन:**
-कंटेनर शुरू, बंद, पॉज़, हटाएँ। कंटेनर स्टैट्स देखें। docker exec टर्मिनल का उपयोग करके कंटेनर को नियंत्रित करें। इसे Portainer या Dockge की जगह लेने के लिए नहीं बनाया गया बल्कि कंटेनर बनाने की तुलना में उन्हें सरलता से प्रबंधित करने के लिए बनाया गया है।
+**Docker और Podman प्रबंधन:**
+कंटेनर शुरू, बंद, पॉज़, हटाएँ। कंटेनर स्टैट्स देखें। docker exec टर्मिनल का उपयोग करके कंटेनर को नियंत्रित करें। Docker और Podman दोनों को कंटेनर रनटाइम के रूप में सपोर्ट करता है। इसे Portainer या Dockge की जगह लेने के लिए नहीं बनाया गया बल्कि कंटेनर बनाने की तुलना में उन्हें सरलता से प्रबंधित करने के लिए बनाया गया है।

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix एक ओपन-सोर्स, हमेशा के लिए मु
 <tr>
 <td width="50%" valign="top">

+**Tailscale एकीकरण:**
+अपने Tailscale नेटवर्क के डिवाइस सूचीबद्ध करें ताकि उन्हें जल्दी से होस्ट के रूप में जोड़ा जा सके, और Tailscale SSH को प्रमाणीकरण विधि के रूप में उपयोग करके कनेक्ट करें, जिससे आपके Tailscale ACL क्रेडेंशियल संग्रहीत किए बिना प्राधिकरण संभाल सकें।
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 भूमिकाएँ बनाएँ और उपयोगकर्ताओं/भूमिकाओं में होस्ट साझा करें।

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**सीरियल कनेक्शन:**
+सीरियल डिवाइस (राउटर, स्विच, माइक्रोकंट्रोलर आदि) से सीधे ब्राउज़र या डेस्कटॉप ऐप से कनेक्ट करें। बॉड रेट, डेटा बिट्स, स्टॉप बिट्स और पैरिटी कॉन्फ़िगर करें। समर्थित ब्राउज़र में Web Serial API या Electron ऐप में नेटिव बैकएंड का उपयोग करता है।
+
+</td>
+<td width="50%" valign="top">
+
+**अलर्ट:**
+होस्ट मेट्रिक्स (CPU, मेमोरी, डिस्क आदि) पर थ्रेशोल्ड-आधारित अलर्ट नियम सेट करें और जब वे ट्रिगर हों तो ntfy या webhooks के माध्यम से सूचना पाएँ। इतिहास लॉग में सक्रिय और हल किए गए अलर्ट देखें।
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**होमपेज:**
+ड्रैग-एंड-ड्रॉप विजेट ग्रिड के साथ पूरी तरह से कस्टमाइज़ करने योग्य होमपेज। होस्ट स्टेटस, सर्विस लिंक, घड़ियाँ, नोट्स, RSS फ़ीड, मौसम, Docker कंटेनर, होस्ट मेट्रिक्स चार्ट, एम्बेडेड टर्मिनल, iframes और अन्य के लिए विजेट जोड़ें।
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## दान करें
+
+Termix मुफ़्त और ओपन सोर्स है। यदि आपको यह उपयोगी लगता है, तो सर्वर लागत और विकास समय में मदद के लिए [दान करें](https://donate.termix.site/)।
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## स्क्रीनशॉट

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>कुछ वीडियो और छवियाँ पुरानी हो सकती हैं या विशेषताओं को पूरी तरह से प्रदर्शित नहीं कर सकती हैं।</sub>
@@ -305,7 +352,7 @@ networks:

 ## नियोजित विशेषताएँ

-सभी नियोजित विशेषताओं के लिए [प्रोजेक्ट्स](https://github.com/orgs/Termix-SSH/projects/2) देखें। यदि आप योगदान देना चाहते हैं, तो [योगदान](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) देखें।
+सभी नियोजित विशेषताओं के लिए [प्रोजेक्ट्स](https://github.com/orgs/Termix-SSH/projects/5) देखें। यदि आप योगदान देना चाहते हैं, तो [योगदान](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) देखें।

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix è gratuito e open source. Se lo trovi utile, considera di [donare](https://donate.termix.site/) per aiutare a coprire i costi del server e il tempo di sviluppo.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Gestisci i file direttamente sui server remoti con supporto per la visualizzazio
 <tr>
 <td width="50%" valign="top">

-**Gestione Docker:**
-Avvia, ferma, metti in pausa, rimuovi container. Visualizza le statistiche dei container. Controlla i container tramite terminale docker exec. Non e stato creato per sostituire Portainer o Dockge, ma piuttosto per gestire semplicemente i tuoi container rispetto alla loro creazione.
+**Gestione Docker e Podman:**
+Avvia, ferma, metti in pausa, rimuovi container. Visualizza le statistiche dei container. Controlla i container tramite terminale docker exec. Supporta sia Docker che Podman come runtime dei container. Non e stato creato per sostituire Portainer o Dockge, ma piuttosto per gestire semplicemente i tuoi container rispetto alla loro creazione.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Gestione utenti sicura con controlli amministrativi e supporto OIDC/LDAP/SSO (co
 <tr>
 <td width="50%" valign="top">

+**Integrazione Tailscale:**
+Elenca i dispositivi della tua rete Tailscale per aggiungerli rapidamente come host, e connettiti utilizzando Tailscale SSH come metodo di autenticazione, lasciando che le ACL della tua rete gestiscano l'autorizzazione senza memorizzare credenziali.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Crea ruoli e condividi host tra utenti/ruoli.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Connessioni Seriali:**
+Connettiti a dispositivi seriali (router, switch, microcontrollori, ecc.) direttamente dal browser o dall'app desktop. Configura baud rate, bit di dati, bit di stop e parita. Utilizza la Web Serial API nei browser supportati o un backend nativo nell'app Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Avvisi:**
+Imposta regole di avviso basate su soglie per le metriche dell'host (CPU, memoria, disco, ecc.) e ricevi notifiche tramite ntfy o webhook quando si attivano. Visualizza gli avvisi attivi e risolti in un registro storico.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Homepage:**
+Una homepage completamente personalizzabile con una griglia di widget drag-and-drop. Aggiungi widget per lo stato dell'host, link ai servizi, orologi, note, feed RSS, meteo, container Docker, grafici delle metriche dell'host, terminali incorporati, iframe e altro ancora.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Dona
+
+Termix è gratuito e open source. Se lo trovi utile, considera di [donare](https://donate.termix.site/) per aiutare a coprire i costi del server e il tempo di sviluppo.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Screenshot

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Alcuni video e immagini potrebbero non essere aggiornati o potrebbero non mostrare perfettamente le funzionalita.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Funzionalita Pianificate

-Consulta [Progetti](https://github.com/orgs/Termix-SSH/projects/2) per tutte le funzionalita pianificate. Se desideri contribuire, consulta [Contribuire](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Consulta [Progetti](https://github.com/orgs/Termix-SSH/projects/5) per tutte le funzionalita pianificate. Se desideri contribuire, consulta [Contribuire](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix は無料のオープンソースプロジェクトです。便利だと感じた場合は、サーバーコストと開発時間のために[寄付](https://donate.termix.site/)をご検討ください。
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termixは、オープンソースで永久無料のセルフホスト型オー
 <tr>
 <td width="50%" valign="top">

-**Docker管理:**
-コンテナの起動、停止、一時停止、削除。コンテナの統計情報を表示。docker execターミナルでコンテナを操作。PortainerやDockgeの代替ではなく、コンテナの作成よりも簡易的な管理を目的としています。
+**DockerおよびPodman管理:**
+コンテナの起動、停止、一時停止、削除。コンテナの統計情報を表示。docker execターミナルでコンテナを操作。DockerとPodmanの両方をコンテナランタイムとしてサポートしています。PortainerやDockgeの代替ではなく、コンテナの作成よりも簡易的な管理を目的としています。

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termixは、オープンソースで永久無料のセルフホスト型オー
 <tr>
 <td width="50%" valign="top">

+**Tailscaleインテグレーション:**
+TailnetのデバイスをリストしてホストとしてすばやくH追加し、Tailscale SSHを認証方法として使用して接続します。これにより、TailnetのACLが認証情報を保存せずに認可を処理します。
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 ロールを作成し、ユーザー/ロール間でホストを共有できます。

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**シリアル接続:**
+ブラウザまたはデスクトップアプリからシリアルデバイス（ルーター、スイッチ、マイクロコントローラーなど）に直接接続できます。ボーレート、データビット、ストップビット、パリティを設定できます。対応ブラウザではWeb Serial APIを使用し、Electronアプリではネイティブバックエンドを使用します。
+
+</td>
+<td width="50%" valign="top">
+
+**アラート:**
+ホストメトリクス（CPU、メモリ、ディスクなど）に対してしきい値ベースのアラートルールを設定し、発動時にntfyまたはwebhookで通知を受け取れます。発動中および解決済みのアラートを履歴ログで確認できます。
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**ホームページ:**
+ドラッグ＆ドロップのウィジェットグリッドを備えた完全カスタマイズ可能なホームページ。ホストステータス、サービスリンク、時計、メモ、RSSフィード、天気、Dockerコンテナ、ホストメトリクスグラフ、埋め込みターミナル、iframeなどのウィジェットを追加できます。
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## 寄付
+
+Termix は無料のオープンソースプロジェクトです。便利だと感じた場合は、サーバーコストと開発時間のために[寄付](https://donate.termix.site/)をご検討ください。
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## スクリーンショット

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>動画や画像の一部は最新ではない場合や、機能を完全に紹介できていない場合があります。</sub>
@@ -305,7 +352,7 @@ networks:

 ## 予定されている機能

-すべての予定機能については[Projects](https://github.com/orgs/Termix-SSH/projects/2)をご覧ください。コントリビュートをご希望の方は[Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)をご覧ください。
+すべての予定機能については[Projects](https://github.com/orgs/Termix-SSH/projects/5)をご覧ください。コントリビュートをご希望の方は[Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)をご覧ください。

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix는 무료 오픈소스 프로젝트입니다. 유용하게 사용하고 있다면 서버 비용과 개발 시간을 위해 [후원](https://donate.termix.site/)을 고려해 주세요.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix는 오픈 소스이며 영구 무료인 셀프 호스팅 올인원 서버
 <tr>
 <td width="50%" valign="top">

-**Docker 관리:**
-컨테이너 시작, 중지, 일시 정지, 제거. 컨테이너 통계 보기. docker exec 터미널로 컨테이너 제어. Portainer나 Dockge를 대체하기 위한 것이 아니라 컨테이너 생성보다는 간편한 관리를 목적으로 합니다.
+**Docker 및 Podman 관리:**
+컨테이너 시작, 중지, 일시 정지, 제거. 컨테이너 통계 보기. docker exec 터미널로 컨테이너 제어. Docker와 Podman을 모두 컨테이너 런타임으로 지원. Portainer나 Dockge를 대체하기 위한 것이 아니라 컨테이너 생성보다는 간편한 관리를 목적으로 합니다.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix는 오픈 소스이며 영구 무료인 셀프 호스팅 올인원 서버
 <tr>
 <td width="50%" valign="top">

+**Tailscale 통합:**
+Tailscale 네트워크의 기기를 나열하여 호스트로 빠르게 추가하고, Tailscale SSH를 인증 방법으로 사용하여 연결함으로써 자격 증명을 저장하지 않고도 네트워크 ACL이 권한 부여를 처리하도록 합니다.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 역할을 생성하고 사용자/역할 간에 호스트 공유.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**시리얼 연결:**
+브라우저 또는 데스크톱 앱에서 직접 시리얼 장치(라우터, 스위치, 마이크로컨트롤러 등)에 연결. 보드레이트, 데이터 비트, 스톱 비트, 패리티 구성. 지원 브라우저에서는 Web Serial API를, Electron 앱에서는 네이티브 백엔드를 사용합니다.
+
+</td>
+<td width="50%" valign="top">
+
+**알림:**
+호스트 메트릭(CPU, 메모리, 디스크 등)에 대한 임계값 기반 알림 규칙을 설정하고 트리거될 때 ntfy 또는 웹훅을 통해 알림 수신. 기록 로그에서 발생 중인 알림과 해결된 알림 확인.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**홈페이지:**
+드래그 앤 드롭 위젯 그리드를 갖춘 완전 맞춤형 홈페이지. 호스트 상태, 서비스 링크, 시계, 메모, RSS 피드, 날씨, Docker 컨테이너, 호스트 메트릭 차트, 임베디드 터미널, iframe 등의 위젯 추가 가능.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## 후원
+
+Termix는 무료 오픈소스 프로젝트입니다. 유용하게 사용하고 있다면 서버 비용과 개발 시간을 위해 [후원](https://donate.termix.site/)을 고려해 주세요.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## 스크린샷

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>일부 비디오 및 이미지는 최신이 아니거나 기능을 완벽하게 보여주지 않을 수 있습니다.</sub>
@@ -305,7 +352,7 @@ networks:

 ## 계획된 기능

-모든 계획된 기능은 [Projects](https://github.com/orgs/Termix-SSH/projects/2)를 참조하세요. 기여를 원하시면 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)을 참조하세요.
+모든 계획된 기능은 [Projects](https://github.com/orgs/Termix-SSH/projects/5)를 참조하세요. 기여를 원하시면 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)을 참조하세요.

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix é gratuito e de código aberto. Se o achar útil, considere [doar](https://donate.termix.site/) para ajudar a cobrir os custos de servidor e o tempo de desenvolvimento.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Gerencie arquivos diretamente em servidores remotos com suporte para visualizar
 <tr>
 <td width="50%" valign="top">

-**Gerenciamento de Docker:**
-Inicie, pare, pause, remova conteineres. Visualize estatisticas de conteineres. Controle conteineres usando o terminal Docker Exec. Nao foi feito para substituir Portainer ou Dockge, mas sim para simplesmente gerenciar seus conteineres em vez de cria-los.
+**Gerenciamento de Docker e Podman:**
+Inicie, pare, pause, remova conteineres. Visualize estatisticas de conteineres. Controle conteineres usando o terminal Docker Exec. Suporta Docker e Podman como ambiente de execucao de conteineres. Nao foi feito para substituir Portainer ou Dockge, mas sim para simplesmente gerenciar seus conteineres em vez de cria-los.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Gerenciamento seguro de usuarios com controles de administrador e suporte para O
 <tr>
 <td width="50%" valign="top">

+**Integracao com Tailscale:**
+Liste dispositivos da sua rede Tailscale para adicioná-los rapidamente como hosts, e conecte-se usando Tailscale SSH como metodo de autenticacao, deixando as ACLs da sua rede gerenciar a autorizacao sem armazenar credenciais.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Crie funcoes e compartilhe hosts entre usuarios/funcoes.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Conexoes Seriais:**
+Conecte-se a dispositivos seriais (roteadores, switches, microcontroladores, etc.) diretamente do navegador ou do aplicativo desktop. Configure taxa de baud, bits de dados, bits de parada e paridade. Usa a Web Serial API em navegadores suportados ou um backend nativo no aplicativo Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Alertas:**
+Defina regras de alerta baseadas em limites para metricas do host (CPU, memoria, disco, etc.) e receba notificacoes via ntfy ou webhooks quando forem ativadas. Visualize alertas ativos e resolvidos em um historico de registros.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Pagina Inicial:**
+Uma pagina inicial totalmente personalizavel com uma grade de widgets de arrastar e soltar. Adicione widgets para status do host, links de servicos, relogios, notas, feeds RSS, clima, conteineres Docker, graficos de metricas do host, terminais incorporados, iframes e mais.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Doar
+
+Termix é gratuito e de código aberto. Se o achar útil, considere [doar](https://donate.termix.site/) para ajudar a cobrir os custos de servidor e o tempo de desenvolvimento.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Capturas de Tela

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Alguns videos e imagens podem estar desatualizados ou podem nao mostrar perfeitamente as funcionalidades.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Funcionalidades Planejadas

-Consulte [Projetos](https://github.com/orgs/Termix-SSH/projects/2) para todas as funcionalidades planejadas. Se voce deseja contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Consulte [Projetos](https://github.com/orgs/Termix-SSH/projects/5) para todas as funcionalidades planejadas. Se voce deseja contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix — бесплатный проект с открытым исходным кодом. Если он вам полезен, рассмотрите возможность [пожертвования](https://donate.termix.site/) для покрытия расходов на серверы и время разработки.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix - это платформа для управления серверам
 <tr>
 <td width="50%" valign="top">

-**Управление Docker:**
-Запуск, остановка, приостановка, удаление контейнеров. Просмотр статистики контейнеров. Управление контейнером через терминал docker exec. Не предназначен для замены Portainer или Dockge, а скорее для простого управления контейнерами по сравнению с их созданием.
+**Управление Docker и Podman:**
+Запуск, остановка, приостановка, удаление контейнеров. Просмотр статистики контейнеров. Управление контейнером через терминал docker exec. Поддерживает как Docker, так и Podman в качестве среды выполнения контейнеров. Не предназначен для замены Portainer или Dockge, а скорее для простого управления контейнерами по сравнению с их созданием.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix - это платформа для управления серверам
 <tr>
 <td width="50%" valign="top">

+**Интеграция с Tailscale:**
+Список устройств вашей сети Tailscale для быстрого добавления их в качестве хостов и подключение через Tailscale SSH в качестве метода аутентификации, позволяя ACL вашей сети управлять авторизацией без хранения учётных данных.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Создание ролей и предоставление общего доступа к хостам для пользователей/ролей.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Последовательные подключения:**
+Подключение к последовательным устройствам (маршрутизаторы, коммутаторы, микроконтроллеры и т. д.) напрямую из браузера или приложения для рабочего стола. Настройка скорости передачи данных, битов данных, стоп-битов и чётности. Использует Web Serial API в поддерживаемых браузерах или нативный бэкенд в приложении Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Оповещения:**
+Настройте правила оповещений на основе пороговых значений для метрик хоста (CPU, память, диск и т. д.) и получайте уведомления через ntfy или вебхуки при их срабатывании. Просматривайте активные и разрешённые оповещения в журнале истории.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Домашняя страница:**
+Полностью настраиваемая домашняя страница с сеткой виджетов с перетаскиванием. Добавляйте виджеты для статуса хоста, ссылок на сервисы, часов, заметок, RSS-лент, погоды, контейнеров Docker, графиков метрик хоста, встроенных терминалов, iframe и многого другого.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Пожертвование
+
+Termix — бесплатный проект с открытым исходным кодом. Если он вам полезен, рассмотрите возможность [пожертвования](https://donate.termix.site/) для покрытия расходов на серверы и время разработки.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Скриншоты

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Некоторые видео и изображения могут быть устаревшими или не полностью отражать функциональность.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Запланированные функции

-Смотрите [Проекты](https://github.com/orgs/Termix-SSH/projects/2) для просмотра всех запланированных функций. Если вы хотите внести вклад, смотрите [Участие в разработке](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Смотрите [Проекты](https://github.com/orgs/Termix-SSH/projects/5) для просмотра всех запланированных функций. Если вы хотите внести вклад, смотрите [Участие в разработке](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix ücretsiz ve açık kaynaklıdır. Faydalı buluyorsanız, sunucu maliyetleri ve geliştirme süresine katkıda bulunmak için [bağış yapmayı](https://donate.termix.site/) düşünebilirsiniz.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Uzak sunuculardaki dosyalari dogrudan yonetin; kod, goruntu, ses ve video gorunt
 <tr>
 <td width="50%" valign="top">

-**Docker Yonetimi:**
-Konteynerleri baslatın, durdurun, duraklatın, kaldirin. Konteyner istatistiklerini goruntuleyin. Docker exec terminali kullanarak konteyneri kontrol edin. Portainer veya Dockge'nin yerini almak icin degil, konteynerlerinizi olusturmak yerine basitce yonetmek icin tasarlanmistir.
+**Docker ve Podman Yonetimi:**
+Konteynerleri baslatın, durdurun, duraklatın, kaldirin. Konteyner istatistiklerini goruntuleyin. Docker exec terminali kullanarak konteyneri kontrol edin. Docker ve Podman'i konteyner calisma ortami olarak destekler. Portainer veya Dockge'nin yerini almak icin degil, konteynerlerinizi olusturmak yerine basitce yonetmek icin tasarlanmistir.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Yonetici kontrolleri, OIDC/LDAP/SSO (erisim kontrollu) ve 2FA (TOTP) destegi ile
 <tr>
 <td width="50%" valign="top">

+**Tailscale Entegrasyonu:**
+Tailscale aginizdaki cihazlari listeleyerek hizlica ana bilgisayar olarak ekleyin ve kimlik dogrulama yontemi olarak Tailscale SSH kullanarak baglanin; bu sayede ag ACL'leriniz kimlik bilgileri depolamadan yetkilendirmeyi yonetir.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Roller olusturun ve ana bilgisayarlari kullanicilar/roller arasinda paylasin.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Seri Baglantilar:**
+Seri cihazlara (router, switch, mikrodenetleyici vb.) dogrudan tarayici veya masaustu uygulamasindan baglanin. Baud hizi, veri bitleri, durdurma bitleri ve parite yapilandirin. Desteklenen tarayicilarda Web Serial API, Electron uygulamasinda yerel arka ucu kullanir.
+
+</td>
+<td width="50%" valign="top">
+
+**Uyarilar:**
+Ana bilgisayar metrikleri (CPU, bellek, disk vb.) icin esik tabanli uyari kurallari belirleyin ve tetiklendiklerinde ntfy veya webhook araciligiyla bildirim alin. Gecmis gunlugunde tetiklenen ve cozulen uyarilari goruntuleyin.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Ana Sayfa:**
+Surukleme ve birakma widget izgarasina sahip tamamen ozerlestirilebilir bir ana sayfa. Ana bilgisayar durumu, hizmet baglantilari, saatler, notlar, RSS besleme, hava durumu, Docker konteynerleri, ana bilgisayar metrik grafikleri, gomulu terminaller, iframe ve daha fazlasi icin widget ekleyin.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Bağış Yapın
+
+Termix ücretsiz ve açık kaynaklıdır. Faydalı buluyorsanız, sunucu maliyetleri ve geliştirme süresine katkıda bulunmak için [bağış yapmayı](https://donate.termix.site/) düşünebilirsiniz.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Ekran Goruntuleri

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Bazi videolar ve gorseller guncel olmayabilir veya ozellikleri tam olarak yansitmayabilir.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Planlanan Ozellikler

-Tum planlanan ozellikler icin [Projeler](https://github.com/orgs/Termix-SSH/projects/2) sayfasina bakin. Katkida bulunmak istiyorsaniz, [Katkida Bulunma](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) sayfasina bakin.
+Tum planlanan ozellikler icin [Projeler](https://github.com/orgs/Termix-SSH/projects/5) sayfasina bakin. Katkida bulunmak istiyorsaniz, [Katkida Bulunma](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) sayfasina bakin.

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix là dự án miễn phí và mã nguồn mở. Nếu bạn thấy hữu ích, hãy cân nhắc [quyên góp](https://donate.termix.site/) để giúp trang trải chi phí máy chủ và thời gian phát triển.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Quan ly tep truc tiep tren may chu tu xa voi ho tro xem va chinh sua ma, hinh an
 <tr>
 <td width="50%" valign="top">

-**Quan Ly Docker:**
-Khoi dong, dung, tam dung, xoa container. Xem thong ke container. Dieu khien container bang terminal docker exec. Khong duoc tao ra de thay the Portainer hay Dockge ma don gian la de quan ly container cua ban thay vi tao moi chung.
+**Quan Ly Docker va Podman:**
+Khoi dong, dung, tam dung, xoa container. Xem thong ke container. Dieu khien container bang terminal docker exec. Ho tro ca Docker va Podman lam moi truong chay container. Khong duoc tao ra de thay the Portainer hay Dockge ma don gian la de quan ly container cua ban thay vi tao moi chung.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Quan ly nguoi dung an toan voi quyen quan tri va ho tro OIDC/LDAP/SSO (co kiem s
 <tr>
 <td width="50%" valign="top">

+**Tich Hop Tailscale:**
+Liet ke cac thiet bi trong mang Tailscale de nhanh chong them vao lam may chu, va ket noi bang Tailscale SSH lam phuong thuc xac thuc, de cac ACL mang xu ly uy quyen ma khong can luu tru thong tin xac thuc.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Tao vai tro va chia se may chu giua nguoi dung/vai tro.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Ket Noi Noi Tiep:**
+Ket noi voi cac thiet bi noi tiep (router, switch, vi dieu khien, v.v.) truc tiep tu trinh duyet hoac ung dung may tinh. Cau hinh toc do baud, bit du lieu, bit dung va chan le. Su dung Web Serial API tren trinh duyet duoc ho tro hoac backend ban dia trong ung dung Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Canh Bao:**
+Dat cac quy tac canh bao dua tren nguong cho chi so may chu (CPU, bo nho, o dia, v.v.) va nhan thong bao qua ntfy hoac webhook khi chung khi toa. Xem canh bao dang kich hoat va da giai quyet trong nhat ky lich su.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Trang Chu:**
+Trang chu co the tuy chinh hoan toan voi luoi widget keo va tha. Them widget cho trang thai may chu, lien ket dich vu, dong ho, ghi chu, feed RSS, thoi tiet, container Docker, bieu do chi so may chu, terminal nhung, iframe va nhieu hon nua.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Quyên góp
+
+Termix là dự án miễn phí và mã nguồn mở. Nếu bạn thấy hữu ích, hãy cân nhắc [quyên góp](https://donate.termix.site/) để giúp trang trải chi phí máy chủ và thời gian phát triển.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Anh Chup Man Hinh

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Mot so video va hinh anh co the da loi thoi hoac khong the hien chinh xac hoan toan cac tinh nang.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Tinh Nang Du Kien

-Xem [Du An](https://github.com/orgs/Termix-SSH/projects/2) de biet tat ca cac tinh nang du kien. Neu ban muon dong gop, xem [Dong Gop](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Xem [Du An](https://github.com/orgs/Termix-SSH/projects/5) de biet tat ca cac tinh nang du kien. Neu ban muon dong gop, xem [Dong Gop](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -63,7 +63,7 @@ async function resolveFileId(projectId) {
 }

 async function pollPreTranslation(projectId, preTranslationId) {
-  for (let i = 0; i < 120; i++) {
+  for (;;) {
    const { data } = await request(
      "GET",
      `/projects/${projectId}/pre-translations/${preTranslationId}`,
@@ -76,7 +76,6 @@ async function pollPreTranslation(projectId, preTranslationId) {
    }
    await new Promise((r) => setTimeout(r, 5000));
  }
-  throw new Error("pre-translation timed out after 10 minutes");
 }

 async function main() {
@@ -1,7 +1,7 @@
 const fs = require("fs");
 const path = require("path");

-const filePath = path.join(
+const guacdClientPath = path.join(
  __dirname,
  "..",
  "node_modules",
@@ -9,18 +9,48 @@ const filePath = path.join(
  "lib",
  "GuacdClient.js",
 );
+const cryptPath = path.join(
+  __dirname,
+  "..",
+  "node_modules",
+  "guacamole-lite",
+  "lib",
+  "Crypt.js",
+);

-if (!fs.existsSync(filePath)) {
+if (!fs.existsSync(guacdClientPath) || !fs.existsSync(cryptPath)) {
  console.log("[patch-guacamole-lite] File not found, skipping");
  process.exit(0);
 }

-let content = fs.readFileSync(filePath, "utf8");
+let guacdClientContent = fs.readFileSync(guacdClientPath, "utf8");
+let cryptContent = fs.readFileSync(cryptPath, "utf8");

-// Patch 1: version acceptance list
-const oldVersionCheck = "if (version === '1_0_0' || version === '1_1_0') {";
-const newVersionCheck =
-  "if (version === '1_0_0' || version === '1_1_0' || version === '1_3_0' || version === '1_5_0') {";
+// Patch 1: protocol version negotiation.
+// guacamole-lite originally only accepted 1.0.0/1.1.0. Support the protocol
+// versions Termix can handle, and conservatively answer future 1.x versions as
+// VERSION_1_5_0 so guacd still sees support for `require`/`name` without us
+// claiming support for unknown instructions.
+const oldVersionBlock =
+  "                if (version === '1_0_0' || version === '1_1_0') {\n" +
+  "                    protocolVersion = version;\n" +
+  "                } else {\n" +
+  "                    protocolVersion = '1_1_0';\n" +
+  "                }";
+const oldPatchedVersionBlock =
+  "                if (version === '1_0_0' || version === '1_1_0' || version === '1_3_0' || version === '1_5_0') {\n" +
+  "                    protocolVersion = version;\n" +
+  "                } else {\n" +
+  "                    protocolVersion = '1_1_0';\n" +
+  "                }";
+const newVersionBlock =
+  "                if (version === '1_0_0' || version === '1_1_0' || version === '1_3_0' || version === '1_5_0') {\n" +
+  "                    protocolVersion = version;\n" +
+  "                } else if (/^1_\\d+_0$/.test(version)) {\n" +
+  "                    protocolVersion = '1_5_0';\n" +
+  "                } else {\n" +
+  "                    protocolVersion = '1_1_0';\n" +
+  "                }";

 // Patch 2: timezone instruction must be sent for all protocols >= 1.1.0, not just 1.1.0
 const oldTimezone = "if (protocolVersion === '1_1_0') {";
@@ -41,36 +71,191 @@ const newConnect =
  "\n" +
  "        this.sendInstruction(['connect'].concat(connectArgs));";

+// Patch 4: answer guacd's dynamic argument requests locally.
+// macOS Screen Sharing can request VNC username/password through the
+// post-handshake `required`/`require` flow. guacamole-lite forwards those
+// instructions to the browser, but Termix already keeps the credentials in the
+// server-side token and the browser does not provide an onrequired handler.
+const oldSendBuffer =
+  "        this.lastActivity = Date.now();\n" + "        this.sendBuffer = '';";
+const newSendBuffer =
+  "        this.lastActivity = Date.now();\n" +
+  "        this.sendBuffer = '';\n" +
+  "        this.nextArgumentStreamIndex = 0;";
+
+const oldSendInstructionBlock =
+  "    sendInstruction(instruction) {\n" +
+  "        // convert every element in the instruction array to a string. convert null to an empty string\n" +
+  "        instruction = instruction.map((element) => {\n" +
+  "            if (element === null || element === undefined) {\n" +
+  "                return '';\n" +
+  "            }\n" +
+  "            return String(element);\n" +
+  "        });\n" +
+  "\n" +
+  "        const instructionString = GuacamoleParser.toInstruction(instruction);\n" +
+  "        this.send(instructionString);\n" +
+  "    }\n";
+const newSendInstructionBlock =
+  oldSendInstructionBlock +
+  "\n" +
+  "    sendArgumentValue(name, value) {\n" +
+  "        const stream = this.nextArgumentStreamIndex++;\n" +
+  "        this.sendInstruction(['argv', stream, 'text/plain', name]);\n" +
+  "        this.sendInstruction(['blob', stream, Buffer.from(String(value ?? ''), 'utf8').toString('base64')]);\n" +
+  "        this.sendInstruction(['end', stream]);\n" +
+  "    }\n" +
+  "\n" +
+  "    sendRequiredArguments(params) {\n" +
+  "        params.forEach((name) => {\n" +
+  "            this.sendArgumentValue(name, this.connectionSettings[name]);\n" +
+  "        });\n" +
+  "    }\n";
+
+const oldReadyHandler =
+  '        // Handle "ready" instruction\n' +
+  "        if (opcode === 'ready') {";
+const newReadyHandler =
+  "        // Handle dynamic argument requests from guacd\n" +
+  "        if (opcode === 'required' || opcode === 'require') {\n" +
+  "            this.sendRequiredArguments(params);\n" +
+  "            return;\n" +
+  "        }\n" +
+  "\n" +
+  oldReadyHandler;
+
 let patched = false;

-if (!content.includes(newVersionCheck)) {
-  if (!content.includes(oldVersionCheck)) {
+if (!guacdClientContent.includes("} else if (/^1_\\d+_0$/.test(version)) {")) {
+  if (guacdClientContent.includes(oldPatchedVersionBlock)) {
+    guacdClientContent = guacdClientContent.replace(
+      oldPatchedVersionBlock,
+      newVersionBlock,
+    );
+  } else if (guacdClientContent.includes(oldVersionBlock)) {
+    guacdClientContent = guacdClientContent.replace(
+      oldVersionBlock,
+      newVersionBlock,
+    );
+  } else {
    console.log(
      "[patch-guacamole-lite] Version check target not found, skipping",
    );
    process.exit(0);
  }
-  content = content.replace(oldVersionCheck, newVersionCheck);
  patched = true;
 }

-if (!content.includes(newTimezone)) {
-  if (!content.includes(oldTimezone)) {
+if (!guacdClientContent.includes(newTimezone)) {
+  if (!guacdClientContent.includes(oldTimezone)) {
    console.log("[patch-guacamole-lite] Timezone target not found, skipping");
    process.exit(0);
  }
-  content = content.replace(oldTimezone, newTimezone);
+  guacdClientContent = guacdClientContent.replace(oldTimezone, newTimezone);
  patched = true;
 }

-if (!content.includes(newConnect)) {
-  if (!content.includes(oldConnect)) {
+if (!guacdClientContent.includes(newConnect)) {
+  if (!guacdClientContent.includes(oldConnect)) {
    console.log(
      "[patch-guacamole-lite] Connect target not found, skipping name patch",
    );
    process.exit(0);
  }
-  content = content.replace(oldConnect, newConnect);
+  guacdClientContent = guacdClientContent.replace(oldConnect, newConnect);
+  patched = true;
+}
+
+if (!guacdClientContent.includes("this.nextArgumentStreamIndex = 0;")) {
+  if (!guacdClientContent.includes(oldSendBuffer)) {
+    console.log(
+      "[patch-guacamole-lite] Argument stream index target not found, skipping",
+    );
+    process.exit(0);
+  }
+  guacdClientContent = guacdClientContent.replace(oldSendBuffer, newSendBuffer);
+  patched = true;
+}
+
+if (!guacdClientContent.includes("sendRequiredArguments(params) {")) {
+  if (!guacdClientContent.includes(oldSendInstructionBlock)) {
+    console.log(
+      "[patch-guacamole-lite] Required argument helper target not found, skipping",
+    );
+    process.exit(0);
+  }
+  guacdClientContent = guacdClientContent.replace(
+    oldSendInstructionBlock,
+    newSendInstructionBlock,
+  );
+  patched = true;
+}
+
+if (
+  !guacdClientContent.includes("opcode === 'required' || opcode === 'require'")
+) {
+  if (!guacdClientContent.includes(oldReadyHandler)) {
+    console.log(
+      "[patch-guacamole-lite] Required opcode target not found, skipping",
+    );
+    process.exit(0);
+  }
+  guacdClientContent = guacdClientContent.replace(
+    oldReadyHandler,
+    newReadyHandler,
+  );
+  patched = true;
+}
+
+// Patch 5: guacamole-lite decrypts token JSON through ASCII/binary strings,
+// which corrupts IV/ciphertext bytes and non-ASCII connection settings such as
+// RDP/VNC passwords with umlauts. Keep the encrypted fields as Buffers and
+// decode the plaintext JSON as UTF-8.
+const oldDecryptBlock =
+  "        let encoded = JSON.parse(this.constructor.base64decode(encodedString));\n" +
+  "\n" +
+  "        encoded.iv = this.constructor.base64decode(encoded.iv);\n" +
+  "        encoded.value = this.constructor.base64decode(encoded.value, 'binary');\n" +
+  "\n" +
+  "        const decipher = Crypto.createDecipheriv(this.cypher, this.key, encoded.iv);\n" +
+  "\n" +
+  "        let decrypted = decipher.update(encoded.value, 'binary', 'ascii');\n" +
+  "        decrypted += decipher.final('ascii');";
+const oldPartiallyPatchedDecryptBlock =
+  "        let encoded = JSON.parse(this.constructor.base64decode(encodedString));\n" +
+  "\n" +
+  "        encoded.iv = this.constructor.base64decode(encoded.iv);\n" +
+  "        encoded.value = this.constructor.base64decode(encoded.value, 'binary');\n" +
+  "\n" +
+  "        const decipher = Crypto.createDecipheriv(this.cypher, this.key, encoded.iv);\n" +
+  "\n" +
+  "        let decrypted = decipher.update(encoded.value, 'binary', 'utf8');\n" +
+  "        decrypted += decipher.final('utf8');";
+const newDecryptBlock =
+  "        const encoded = JSON.parse(Buffer.from(encodedString, 'base64').toString('utf8'));\n" +
+  "\n" +
+  "        const iv = Buffer.from(encoded.iv, 'base64');\n" +
+  "        const value = Buffer.from(encoded.value, 'base64');\n" +
+  "\n" +
+  "        const decipher = Crypto.createDecipheriv(this.cypher, this.key, iv);\n" +
+  "\n" +
+  "        let decrypted = decipher.update(value, undefined, 'utf8');\n" +
+  "        decrypted += decipher.final('utf8');";
+
+if (!cryptContent.includes(newDecryptBlock)) {
+  if (cryptContent.includes(oldDecryptBlock)) {
+    cryptContent = cryptContent.replace(oldDecryptBlock, newDecryptBlock);
+  } else if (cryptContent.includes(oldPartiallyPatchedDecryptBlock)) {
+    cryptContent = cryptContent.replace(
+      oldPartiallyPatchedDecryptBlock,
+      newDecryptBlock,
+    );
+  } else {
+    console.log(
+      "[patch-guacamole-lite] UTF-8 token decrypt target not found, skipping",
+    );
+    process.exit(0);
+  }
  patched = true;
 }

@@ -79,7 +264,8 @@ if (!patched) {
  process.exit(0);
 }

-fs.writeFileSync(filePath, content);
+fs.writeFileSync(guacdClientPath, guacdClientContent);
+fs.writeFileSync(cryptPath, cryptContent);
 console.log(
-  "[patch-guacamole-lite] Patched to support protocol VERSION_1_3_0 and VERSION_1_5_0 with name handshake instruction",
+  "[patch-guacamole-lite] Patched protocol VERSION_1_3_0/1_5_0 support, name handshake, required arguments, and UTF-8 token decrypt",
 );
@@ -0,0 +1,91 @@
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { describe, expect, it, vi } from "vitest";
+
+const require = createRequire(import.meta.url);
+const GuacdClient = require("../node_modules/guacamole-lite/lib/GuacdClient.js");
+
+type PatchedGuacdClient = {
+  connectionSettings: Record<string, unknown>;
+  nextArgumentStreamIndex: number;
+  sendInstruction: ReturnType<typeof vi.fn>;
+  sendHandshakeReply: (serverHandshake: string[]) => void;
+  sendRequiredArguments: (params: string[]) => void;
+};
+
+function createPatchedClient(
+  connectionSettings: Record<string, unknown>,
+): PatchedGuacdClient {
+  return Object.assign(Object.create(GuacdClient.prototype), {
+    connectionSettings,
+    logger: { log: vi.fn() },
+    nextArgumentStreamIndex: 0,
+    sendInstruction: vi.fn(),
+  });
+}
+
+describe("patch-guacamole-lite", () => {
+  it("handles guacd dynamic argument requests", () => {
+    const guacdClientPath = path.join(
+      process.cwd(),
+      "node_modules",
+      "guacamole-lite",
+      "lib",
+      "GuacdClient.js",
+    );
+
+    const content = fs.readFileSync(guacdClientPath, "utf8");
+
+    expect(content).toContain("sendRequiredArguments(params)");
+    expect(content).toContain("opcode === 'required' || opcode === 'require'");
+    expect(content).toContain("this.sendInstruction(['argv'");
+    expect(content).toContain("this.sendInstruction(['blob'");
+    expect(content).toContain("this.sendInstruction(['end'");
+  });
+
+  it("keeps required-argument support when guacd offers a future 1.x protocol", () => {
+    const client = createPatchedClient({
+      hostname: "192.0.2.10",
+      port: 5900,
+      password: "secret",
+      width: 1280,
+      height: 720,
+      dpi: 96,
+    });
+
+    client.sendHandshakeReply(["VERSION_1_6_0", "hostname", "port"]);
+
+    expect(client.sendInstruction).toHaveBeenCalledWith(["timezone"]);
+    expect(client.sendInstruction).toHaveBeenCalledWith([
+      "name",
+      "guacamole-lite",
+    ]);
+    expect(client.sendInstruction).toHaveBeenCalledWith([
+      "connect",
+      "VERSION_1_5_0",
+      "192.0.2.10",
+      5900,
+    ]);
+  });
+
+  it("answers required credentials through argument value streams", () => {
+    const client = createPatchedClient({
+      username: "",
+      password: "secret",
+    });
+
+    client.sendRequiredArguments(["username", "password"]);
+
+    expect(
+      client.sendInstruction.mock.calls.map(([instruction]) => instruction),
+    ).toEqual([
+      ["argv", 0, "text/plain", "username"],
+      ["blob", 0, ""],
+      ["end", 0],
+      ["argv", 1, "text/plain", "password"],
+      ["blob", 1, Buffer.from("secret", "utf8").toString("base64")],
+      ["end", 1],
+    ]);
+  });
+});
@@ -0,0 +1,85 @@
+const fs = require("node:fs");
+const path = require("node:path");
+
+const xtermDir = path.join(
+  __dirname,
+  "..",
+  "node_modules",
+  "@xterm",
+  "xterm",
+  "lib",
+);
+
+// Backport the textarea-shrink fix from gmuxapp/xterm.js@6a011cf while
+// xtermjs/xterm.js#3600 remains unresolved upstream. Android IMEs can restart
+// composition on the previous word and replace it with a shorter value (for
+// example, Vietnamese "Hoar" -> "Hỏa"). xterm 6.0 otherwise emits nothing.
+const patches = [
+  {
+    file: "xterm.mjs",
+    replacements: [
+      [
+        'this._compositionPosition={start:0,end:0},this._dataAlreadySent=""',
+        'this._compositionPosition={start:0,end:0},this._preCompositionValue="",this._dataAlreadySent=""',
+      ],
+      [
+        'this._compositionPosition.start=this._textarea.value.length,this._compositionView.textContent=""',
+        'this._compositionPosition.start=this._textarea.value.length,this._preCompositionValue=this._textarea.value,this._compositionView.textContent=""',
+      ],
+      [
+        "let e={start:this._compositionPosition.start,end:this._compositionPosition.end};this._isSendingComposition=!0",
+        "let e={start:this._compositionPosition.start,end:this._compositionPosition.end};const s=this._preCompositionValue;this._isSendingComposition=!0",
+      ],
+      [
+        "e.start+=this._dataAlreadySent.length,this._isComposing?i=this._textarea.value.substring(e.start,this._compositionPosition.start):i=this._textarea.value.substring(e.start),i.length>0&&",
+        "e.start+=this._dataAlreadySent.length;if(this._isComposing)i=this._textarea.value.substring(e.start,this._compositionPosition.start);else{const t=this._textarea.value;if(t.length<s.length){let e=0;const r=Math.min(t.length,s.length);for(;e<r&&t.charCodeAt(e)===s.charCodeAt(e);)e++;i=b.DEL.repeat(s.length-e)+t.substring(e)}else i=t.substring(e.start)}i.length>0&&",
+      ],
+    ],
+  },
+  {
+    file: "xterm.js",
+    replacements: [
+      [
+        'this._compositionPosition={start:0,end:0},this._dataAlreadySent=""',
+        'this._compositionPosition={start:0,end:0},this._preCompositionValue="",this._dataAlreadySent=""',
+      ],
+      [
+        'this._compositionPosition.start=this._textarea.value.length,this._compositionView.textContent=""',
+        'this._compositionPosition.start=this._textarea.value.length,this._preCompositionValue=this._textarea.value,this._compositionView.textContent=""',
+      ],
+      [
+        "const e={start:this._compositionPosition.start,end:this._compositionPosition.end};this._isSendingComposition=!0",
+        "const e={start:this._compositionPosition.start,end:this._compositionPosition.end},i=this._preCompositionValue;this._isSendingComposition=!0",
+      ],
+      [
+        "e.start+=this._dataAlreadySent.length,t=this._isComposing?this._textarea.value.substring(e.start,this._compositionPosition.start):this._textarea.value.substring(e.start),t.length>0&&",
+        "e.start+=this._dataAlreadySent.length;this._isComposing?t=this._textarea.value.substring(e.start,this._compositionPosition.start):(()=>{const s=this._textarea.value;if(s.length<i.length){let e=0;const r=Math.min(s.length,i.length);for(;e<r&&s.charCodeAt(e)===i.charCodeAt(e);)e++;t=a.C0.DEL.repeat(i.length-e)+s.substring(e)}else t=s.substring(e.start)})(),t.length>0&&",
+      ],
+    ],
+  },
+];
+
+for (const { file, replacements } of patches) {
+  const filePath = path.join(xtermDir, file);
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`[patch-xterm-android-ime] Missing ${filePath}`);
+  }
+
+  let source = fs.readFileSync(filePath, "utf8");
+  if (source.includes("_preCompositionValue")) {
+    console.log(`[patch-xterm-android-ime] ${file} already patched`);
+    continue;
+  }
+
+  for (const [original, patched] of replacements) {
+    if (!source.includes(original)) {
+      throw new Error(
+        `[patch-xterm-android-ime] Expected source not found in ${file}`,
+      );
+    }
+    source = source.replace(original, patched);
+  }
+
+  fs.writeFileSync(filePath, source);
+  console.log(`[patch-xterm-android-ime] Patched ${file}`);
+}
@@ -45,7 +45,23 @@ async function getAccessToken({ clientId, clientSecret, refreshToken }) {
  return json.access_token;
 }

+async function getVideoStatus(accessToken, videoId) {
+  const res = await fetch(
+    `https://www.googleapis.com/youtube/v3/videos?part=status&id=${videoId}`,
+    { headers: { Authorization: `Bearer ${accessToken}` } },
+  );
+  if (!res.ok)
+    throw new Error(`videos.list failed (${res.status}): ${await res.text()}`);
+  const json = await res.json();
+  return json.items?.[0]?.status?.privacyStatus ?? null;
+}
+
 async function setVideoPublic(accessToken, videoId) {
+  const status = await getVideoStatus(accessToken, videoId);
+  if (status === "public") {
+    console.log(`Video ${videoId} is already public, skipping.`);
+    return;
+  }
  const res = await fetch(
    "https://www.googleapis.com/youtube/v3/videos?part=status",
    {
@@ -1,19 +1,15 @@
 import express from "express";
 import cookieParser from "cookie-parser";
 import { createCorsMiddleware } from "./utils/cors-config.js";
-import { getDb } from "./database/db/index.js";
-import {
-  recentActivity,
-  hosts,
-  hostAccess,
-  userRoles,
-} from "./database/db/schema.js";
-import { eq, and, desc, inArray, or, isNull, gte, sql } from "drizzle-orm";
 import { dashboardLogger } from "./utils/logger.js";
-import { SimpleDBOps } from "./utils/simple-db-ops.js";
 import { AuthManager } from "./utils/auth-manager.js";
 import type { AuthenticatedRequest } from "../types/index.js";
 import { dashboardServiceLinksRouter } from "./database/routes/dashboard-service-links-routes.js";
+import { createCurrentHostResolutionRepository } from "./database/repositories/current-host-resolution-repository.js";
+import { createCurrentRbacAccessRepository } from "./database/repositories/current-rbac-access-repository.js";
+import { createCurrentRecentActivityRepository } from "./database/repositories/current-recent-activity-repository.js";
+import { createCurrentRoleRepository } from "./database/repositories/current-role-repository.js";
+import { DataCrypto } from "./utils/data-crypto.js";

 const app = express();
 const authManager = AuthManager.getInstance();
@@ -23,6 +19,10 @@ const serverStartTime = Date.now();
 const activityRateLimiter = new Map<string, number>();
 const RATE_LIMIT_MS = 1000;

+function isUserDataUnlocked(userId: string): boolean {
+  return DataCrypto.getUserDataKey(userId) !== null;
+}
+
 app.use(createCorsMiddleware());
 app.use(cookieParser());
 app.use(express.json({ limit: "1mb" }));
@@ -103,7 +103,7 @@ app.get("/activity/recent", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;

-    if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+    if (!isUserDataUnlocked(userId)) {
      return res.status(401).json({
        error: "Session expired - please log in again",
        code: "SESSION_EXPIRED",
@@ -112,16 +112,8 @@ app.get("/activity/recent", async (req, res) => {

    const limit = Number(req.query.limit) || 20;

-    const activities = await SimpleDBOps.select(
-      getDb()
-        .select()
-        .from(recentActivity)
-        .where(eq(recentActivity.userId, userId))
-        .orderBy(desc(recentActivity.timestamp))
-        .limit(limit),
-      "recent_activity",
-      userId,
-    );
+    const activities =
+      await createCurrentRecentActivityRepository().listByUserId(userId, limit);

    res.json(activities);
  } catch (err) {
@@ -168,7 +160,7 @@ app.post("/activity/log", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;

-    if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+    if (!isUserDataUnlocked(userId)) {
      return res.status(401).json({
        error: "Session expired - please log in again",
        code: "SESSION_EXPIRED",
@@ -223,97 +215,45 @@ app.post("/activity/log", async (req, res) => {
      entriesToDelete.forEach((key) => activityRateLimiter.delete(key));
    }

-    const ownedHosts = await SimpleDBOps.select(
-      getDb()
-        .select()
-        .from(hosts)
-        .where(and(eq(hosts.id, hostId), eq(hosts.userId, userId))),
-      "ssh_data",
-      userId,
-    );
+    const isOwnedHost =
+      await createCurrentHostResolutionRepository().isHostOwnedByUser(
+        hostId,
+        userId,
+      );

-    if (ownedHosts.length === 0) {
-      const userRoleIds = await getDb()
-        .select({ roleId: userRoles.roleId })
-        .from(userRoles)
-        .where(eq(userRoles.userId, userId));
-      const roleIds = userRoleIds.map((r) => r.roleId);
-
-      const now = new Date().toISOString();
-      const sharedHosts = await getDb()
-        .select()
-        .from(hostAccess)
-        .where(
-          and(
-            eq(hostAccess.hostId, hostId),
-            or(
-              eq(hostAccess.userId, userId),
-              roleIds.length > 0
-                ? sql`${hostAccess.roleId} IN (${sql.join(
-                    roleIds.map((id) => sql`${id}`),
-                    sql`, `,
-                  )})`
-                : sql`false`,
-            ),
-            or(isNull(hostAccess.expiresAt), gte(hostAccess.expiresAt, now)),
-          ),
+    if (!isOwnedHost) {
+      const roleIds =
+        await createCurrentRoleRepository().listUserRoleIds(userId);
+      const sharedHosts =
+        await createCurrentRbacAccessRepository().listVisibleHostAccessEntries(
+          userId,
+          roleIds,
        );
+      const hasSharedAccess = sharedHosts.some(
+        (access) => access.hostId === hostId,
+      );

-      if (sharedHosts.length === 0) {
+      if (!hasSharedAccess) {
        return res
          .status(404)
          .json({ error: "Host not found or access denied" });
      }
    }

-    const result = (await SimpleDBOps.insert(
-      recentActivity,
-      "recent_activity",
-      {
-        userId,
-        type,
-        hostId,
-        hostName,
-      },
+    const result = await createCurrentRecentActivityRepository().create({
      userId,
-    )) as unknown as { id: number };
+      type,
+      hostId,
+      hostName,
+    });

    // Best-effort trim of old activity entries; failures here should not
    // cause the primary /activity/log request to 500.
    try {
-      const allActivities = await SimpleDBOps.select<{
-        id: number;
-        timestamp: string;
-      }>(
-        getDb()
-          .select({
-            id: recentActivity.id,
-            timestamp: recentActivity.timestamp,
-          })
-          .from(recentActivity)
-          .where(eq(recentActivity.userId, userId))
-          .orderBy(desc(recentActivity.timestamp)),
-        "recent_activity",
+      await createCurrentRecentActivityRepository().trimUserActivity(
        userId,
+        100,
      );
-
-      if (allActivities.length > 100) {
-        const idsToDelete = allActivities
-          .slice(100)
-          .map((a) => a.id)
-          .filter((id) => typeof id === "number");
-
-        if (idsToDelete.length > 0) {
-          await SimpleDBOps.delete(
-            recentActivity,
-            "recent_activity",
-            and(
-              eq(recentActivity.userId, userId),
-              inArray(recentActivity.id, idsToDelete),
-            ),
-          );
-        }
-      }
    } catch (trimErr) {
      dashboardLogger.warn("Failed to trim recent_activity (non-fatal)", {
        operation: "trim_recent_activity",
@@ -349,18 +289,14 @@ app.delete("/activity/reset", async (req, res) => {
  try {
    const userId = (req as AuthenticatedRequest).userId;

-    if (!SimpleDBOps.isUserDataUnlocked(userId)) {
+    if (!isUserDataUnlocked(userId)) {
      return res.status(401).json({
        error: "Session expired - please log in again",
        code: "SESSION_EXPIRED",
      });
    }

-    await SimpleDBOps.delete(
-      recentActivity,
-      "recent_activity",
-      eq(recentActivity.userId, userId),
-    );
+    await createCurrentRecentActivityRepository().deleteByUserId(userId);

    dashboardLogger.success("Recent activity cleared", {
      operation: "reset_recent_activity",
@@ -17,8 +17,11 @@ import rbacRoutes from "./routes/rbac.js";
 import openTabsRoutes from "./routes/open-tabs.js";
 import userPreferencesRoutes from "./routes/user-preferences.js";
 import proxmoxRoutes from "./routes/proxmox.js";
+import termixIdRoutes from "./routes/termix-id.js";
 import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
 import { registerTailscaleRoutes } from "./routes/tailscale-routes.js";
+import vaultRoutes from "./routes/vault.js";
+import alertRulesRoutes from "./routes/alert-rules-routes.js";
 import { createCorsMiddleware } from "../utils/cors-config.js";
 import fs from "fs";
 import path from "path";
@@ -31,27 +34,24 @@ import { DatabaseFileEncryption } from "../utils/database-file-encryption.js";
 import { DatabaseMigration } from "../utils/database-migration.js";
 import { UserDataExport } from "../utils/user-data-export.js";
 import { AutoSSLSetup } from "../utils/auto-ssl-setup.js";
-import { eq, and } from "drizzle-orm";
+import { createCurrentCredentialRepository } from "./repositories/current-credential-repository.js";
+import { createCurrentDismissedAlertRepository } from "./repositories/current-dismissed-alert-repository.js";
+import { createCurrentFileManagerBookmarkRepository } from "./repositories/current-file-manager-bookmark-repository.js";
+import { createCurrentHostRepository } from "./repositories/current-host-repository.js";
+import { createCurrentSettingsRepository } from "./repositories/current-settings-repository.js";
+import { createCurrentSshCredentialUsageRepository } from "./repositories/current-ssh-credential-usage-repository.js";
+import { createCurrentUserRepository } from "./repositories/current-user-repository.js";
+import { getRepositoryRolloutStatus } from "./repositories/repository-rollout.js";
+import { withCurrentSqliteForeignKeysDisabled } from "./runtime/sqlite-foreign-key-boundary.js";
 import { parseUserAgent } from "../utils/user-agent-parser.js";
 import { getProxyAgent } from "../utils/proxy-agent.js";
-import {
-  users,
-  hosts,
-  sshCredentials,
-  fileManagerRecent,
-  fileManagerPinned,
-  fileManagerShortcuts,
-  dismissedAlerts,
-  sshCredentialUsage,
-  settings,
-} from "./db/schema.js";
 import type {
  CacheEntry,
  GitHubRelease,
  GitHubAPIResponse,
  AuthenticatedRequest,
 } from "../../types/index.js";
-import { getDb, DatabaseSaveTrigger } from "./db/index.js";
+import { DatabaseSaveTrigger } from "./db/index.js";
 import Database from "better-sqlite3";
 import { fileURLToPath } from "url";

@@ -67,6 +67,45 @@ const authenticateJWT = authManager.createAuthMiddleware();
 const requireAdmin = authManager.createAdminMiddleware();
 app.use(createCorsMiddleware());

+type SettingData = {
+  key: string;
+  value: string;
+};
+
+function shouldExportSetting(key: string): boolean {
+  return !key.startsWith("reset_code_") && !key.startsWith("temp_reset_token_");
+}
+
+async function getExportableSettings(): Promise<SettingData[]> {
+  const settingsRows = await createCurrentSettingsRepository().listAll();
+
+  return settingsRows.filter((setting) => shouldExportSetting(setting.key));
+}
+
+function writeSettingsToExportDatabase(
+  exportDb: Database.Database,
+  settingsRows: SettingData[],
+): void {
+  const insertSetting = exportDb.prepare(`
+    INSERT INTO settings (key, value)
+    VALUES (?, ?)
+  `);
+
+  for (const setting of settingsRows) {
+    insertSetting.run(setting.key, setting.value);
+  }
+}
+
+function readImportedSettings(importDb: Database.Database): SettingData[] {
+  return importDb
+    .prepare("SELECT key, value FROM settings")
+    .all() as SettingData[];
+}
+
+async function upsertImportedSetting(setting: SettingData): Promise<void> {
+  await createCurrentSettingsRepository().upsert(setting.key, setting.value);
+}
+
 const uploadsDir = path.join(process.env.DATA_DIR || "./db/data", "uploads");

 const storage = multer.diskStorage({
@@ -618,12 +657,13 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
    const userId = (req as AuthenticatedRequest).userId;
    const deviceInfo = parseUserAgent(req);

-    const user = await getDb().select().from(users).where(eq(users.id, userId));
-    if (!user || user.length === 0) {
+    const userRepository = createCurrentUserRepository();
+    const user = await userRepository.findById(userId);
+    if (!user) {
      return res.status(404).json({ error: "User not found" });
    }

-    const isOidcUser = !!user[0].isOidc;
+    const isOidcUser = !!user.isOidc;

    if (!DataCrypto.getUserDataKey(userId)) {
      if (isOidcUser) {
@@ -864,22 +904,14 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
        userRecord.totpBackupCodes || null,
      );

-      const sshHosts = await getDb()
-        .select()
-        .from(hosts)
-        .where(eq(hosts.userId, userId));
+      const sshHosts =
+        await createCurrentHostRepository().listDecryptedByUserId(userId);
      const insertHost = exportDb.prepare(`
        INSERT INTO ssh_data (id, user_id, connection_type, name, ip, port, username, folder, tags, pin, auth_type, force_keyboard_interactive, password, key, key_password, key_type, sudo_password, autostart_password, autostart_key, autostart_key_password, credential_id, override_credential_username, enable_terminal, enable_tunnel, tunnel_connections, jump_hosts, enable_file_manager, enable_docker, show_terminal_in_sidebar, show_file_manager_in_sidebar, show_tunnel_in_sidebar, show_docker_in_sidebar, show_server_stats_in_sidebar, default_path, stats_config, docker_config, terminal_config, quick_actions, notes, use_socks5, socks5_host, socks5_port, socks5_username, socks5_password, socks5_proxy_chain, domain, security, ignore_cert, guacamole_config, mac_address, port_knock_sequence, created_at, updated_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
      `);

-      for (const host of sshHosts) {
-        const decrypted = DataCrypto.decryptRecord(
-          "ssh_data",
-          host,
-          userId,
-          userDataKey,
-        );
+      for (const decrypted of sshHosts) {
        insertHost.run(
          decrypted.id,
          decrypted.userId,
@@ -937,22 +969,14 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
        );
      }

-      const credentials = await getDb()
-        .select()
-        .from(sshCredentials)
-        .where(eq(sshCredentials.userId, userId));
+      const credentials =
+        await createCurrentCredentialRepository().listDecryptedByUserId(userId);
      const insertCred = exportDb.prepare(`
        INSERT INTO ssh_credentials (id, user_id, name, description, folder, tags, auth_type, username, password, key, private_key, public_key, key_password, key_type, detected_key_type, usage_count, last_used, created_at, updated_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
      `);

-      for (const cred of credentials) {
-        const decrypted = DataCrypto.decryptRecord(
-          "ssh_credentials",
-          cred,
-          userId,
-          userDataKey,
-        );
+      for (const decrypted of credentials) {
        insertCred.run(
          decrypted.id,
          decrypted.userId,
@@ -976,19 +1000,12 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
        );
      }

+      const fileManagerRepository =
+        createCurrentFileManagerBookmarkRepository();
      const [recentFiles, pinnedFiles, shortcuts] = await Promise.all([
-        getDb()
-          .select()
-          .from(fileManagerRecent)
-          .where(eq(fileManagerRecent.userId, userId)),
-        getDb()
-          .select()
-          .from(fileManagerPinned)
-          .where(eq(fileManagerPinned.userId, userId)),
-        getDb()
-          .select()
-          .from(fileManagerShortcuts)
-          .where(eq(fileManagerShortcuts.userId, userId)),
+        fileManagerRepository.listRecentByUserId(userId),
+        fileManagerRepository.listPinnedByUserId(userId),
+        fileManagerRepository.listShortcutsByUserId(userId),
      ]);

      const insertRecent = exportDb.prepare(`
@@ -1036,10 +1053,8 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
        );
      }

-      const alerts = await getDb()
-        .select()
-        .from(dismissedAlerts)
-        .where(eq(dismissedAlerts.userId, userId));
+      const dismissedAlertRepository = createCurrentDismissedAlertRepository();
+      const alerts = await dismissedAlertRepository.listByUserId(userId);
      const insertAlert = exportDb.prepare(`
        INSERT INTO dismissed_alerts (id, user_id, alert_id, dismissed_at)
        VALUES (?, ?, ?, ?)
@@ -1053,10 +1068,9 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
        );
      }

-      const usage = await getDb()
-        .select()
-        .from(sshCredentialUsage)
-        .where(eq(sshCredentialUsage.userId, userId));
+      const sshCredentialUsageRepository =
+        createCurrentSshCredentialUsageRepository();
+      const usage = await sshCredentialUsageRepository.listByUserId(userId);
      const insertUsage = exportDb.prepare(`
        INSERT INTO ssh_credential_usage (id, credential_id, host_id, user_id, used_at)
        VALUES (?, ?, ?, ?, ?)
@@ -1071,20 +1085,7 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
        );
      }

-      const settingsData = await getDb().select().from(settings);
-      const insertSetting = exportDb.prepare(`
-        INSERT INTO settings (key, value)
-        VALUES (?, ?)
-      `);
-      for (const setting of settingsData) {
-        if (
-          setting.key.startsWith("reset_code_") ||
-          setting.key.startsWith("temp_reset_token_")
-        ) {
-          continue;
-        }
-        insertSetting.run(setting.key, setting.value);
-      }
+      writeSettingsToExportDatabase(exportDb, await getExportableSettings());
    } finally {
      exportDb.close();
    }
@@ -1179,19 +1180,16 @@ app.post(
      }

      const userId = (req as AuthenticatedRequest).userId;
-      const mainDb = getDb();
      const deviceInfo = parseUserAgent(req);

-      const userRecords = await mainDb
-        .select()
-        .from(users)
-        .where(eq(users.id, userId));
+      const userRepository = createCurrentUserRepository();
+      const userRecord = await userRepository.findById(userId);

-      if (!userRecords || userRecords.length === 0) {
+      if (!userRecord) {
        return res.status(404).json({ error: "User not found" });
      }

-      const isOidcUser = !!userRecords[0].isOidc;
+      const isOidcUser = !!userRecord.isOidc;

      if (!DataCrypto.getUserDataKey(userId)) {
        if (isOidcUser) {
@@ -1273,332 +1271,287 @@ app.post(
      };

      try {
-        mainDb.$client.exec("PRAGMA foreign_keys = OFF");
-        try {
-          const importedHosts = importDb
-            .prepare("SELECT * FROM ssh_data")
-            .all();
-          for (const host of importedHosts) {
-            try {
-              const existing = await mainDb
-                .select()
-                .from(hosts)
-                .where(
-                  and(
-                    eq(hosts.userId, userId),
-                    eq(hosts.ip, host.ip),
-                    eq(hosts.port, host.port),
-                    eq(hosts.username, host.username),
-                  ),
-                );
-
-              if (existing.length > 0) {
-                result.summary.skippedItems++;
-                continue;
-              }
-
-              const hostData = {
-                userId: userId,
-                name: host.name,
-                ip: host.ip,
-                port: host.port,
-                username: host.username,
-                folder: host.folder,
-                tags: host.tags,
-                pin: Boolean(host.pin),
-                authType: host.auth_type,
-                forceKeyboardInteractive: host.force_keyboard_interactive,
-                password: host.password,
-                key: host.key,
-                keyPassword: host.key_password,
-                keyType: host.key_type,
-                sudoPassword: host.sudo_password,
-                autostartPassword: host.autostart_password,
-                autostartKey: host.autostart_key,
-                autostartKeyPassword: host.autostart_key_password,
-                credentialId: host.credential_id || null,
-                overrideCredentialUsername: Boolean(
-                  host.override_credential_username,
-                ),
-                enableTerminal: Boolean(host.enable_terminal),
-                enableTunnel: Boolean(host.enable_tunnel),
-                tunnelConnections: host.tunnel_connections,
-                jumpHosts: host.jump_hosts,
-                enableFileManager: Boolean(host.enable_file_manager),
-                enableDocker: Boolean(host.enable_docker),
-                showTerminalInSidebar: Boolean(host.show_terminal_in_sidebar),
-                showFileManagerInSidebar: Boolean(
-                  host.show_file_manager_in_sidebar,
-                ),
-                showTunnelInSidebar: Boolean(host.show_tunnel_in_sidebar),
-                showDockerInSidebar: Boolean(host.show_docker_in_sidebar),
-                showServerStatsInSidebar: Boolean(
-                  host.show_server_stats_in_sidebar,
-                ),
-                defaultPath: host.default_path,
-                statsConfig: host.stats_config,
-                terminalConfig: host.terminal_config,
-                quickActions: host.quick_actions,
-                notes: host.notes,
-                useSocks5: Boolean(host.use_socks5),
-                socks5Host: host.socks5_host,
-                socks5Port: host.socks5_port,
-                socks5Username: host.socks5_username,
-                socks5Password: host.socks5_password,
-                socks5ProxyChain: host.socks5_proxy_chain,
-                createdAt: host.created_at || new Date().toISOString(),
-                updatedAt: new Date().toISOString(),
-              };
-
-              const encrypted = DataCrypto.encryptRecord(
-                "ssh_data",
-                hostData,
-                userId,
-                userDataKey,
-              );
-              await mainDb.insert(hosts).values(encrypted);
-              result.summary.sshHostsImported++;
-            } catch (hostError) {
-              result.summary.errors.push(
-                `SSH host import error: ${hostError.message}`,
-              );
-            }
-          }
-        } catch {
-          apiLogger.info("ssh_data table not found in import file, skipping");
-        }
-
-        try {
-          const importedCreds = importDb
-            .prepare("SELECT * FROM ssh_credentials")
-            .all();
-          for (const cred of importedCreds) {
-            try {
-              const existing = await mainDb
-                .select()
-                .from(sshCredentials)
-                .where(
-                  and(
-                    eq(sshCredentials.userId, userId),
-                    eq(sshCredentials.name, cred.name),
-                    eq(sshCredentials.username, cred.username),
-                  ),
-                );
-
-              if (existing.length > 0) {
-                result.summary.skippedItems++;
-                continue;
-              }
-
-              const credData = {
-                userId: userId,
-                name: cred.name,
-                description: cred.description,
-                folder: cred.folder,
-                tags: cred.tags,
-                authType: cred.auth_type,
-                username: cred.username,
-                password: cred.password,
-                key: cred.key,
-                privateKey: cred.private_key,
-                publicKey: cred.public_key,
-                keyPassword: cred.key_password,
-                keyType: cred.key_type,
-                detectedKeyType: cred.detected_key_type,
-                usageCount: cred.usage_count || 0,
-                lastUsed: cred.last_used,
-                createdAt: cred.created_at || new Date().toISOString(),
-                updatedAt: new Date().toISOString(),
-              };
-
-              const encrypted = DataCrypto.encryptRecord(
-                "ssh_credentials",
-                credData,
-                userId,
-                userDataKey,
-              );
-              await mainDb.insert(sshCredentials).values(encrypted);
-              result.summary.sshCredentialsImported++;
-            } catch (credError) {
-              result.summary.errors.push(
-                `SSH credential import error: ${credError.message}`,
-              );
-            }
-          }
-        } catch {
-          apiLogger.info(
-            "ssh_credentials table not found in import file, skipping",
-          );
-        }
-
-        const fileManagerTables = [
-          {
-            table: "file_manager_recent",
-            schema: fileManagerRecent,
-            key: "fileManagerItemsImported",
-          },
-          {
-            table: "file_manager_pinned",
-            schema: fileManagerPinned,
-            key: "fileManagerItemsImported",
-          },
-          {
-            table: "file_manager_shortcuts",
-            schema: fileManagerShortcuts,
-            key: "fileManagerItemsImported",
-          },
-        ];
-
-        for (const { table, schema, key } of fileManagerTables) {
+        await withCurrentSqliteForeignKeysDisabled(async () => {
          try {
-            const importedItems = importDb
-              .prepare(`SELECT * FROM ${table}`)
+            const importedHosts = importDb
+              .prepare("SELECT * FROM ssh_data")
              .all();
-            for (const item of importedItems) {
+            for (const host of importedHosts) {
              try {
-                const existing = await mainDb
-                  .select()
-                  .from(schema)
-                  .where(
-                    and(
-                      eq(schema.userId, userId),
-                      eq(schema.path, item.path),
-                      eq(schema.name, item.name),
-                    ),
-                  );
+                const hostRepository = createCurrentHostRepository();
+                const exists = await hostRepository.existsForImportIdentity(
+                  userId,
+                  host.ip,
+                  host.port,
+                  host.username,
+                );

-                if (existing.length > 0) {
+                if (exists) {
                  result.summary.skippedItems++;
                  continue;
                }

-                const itemData = {
+                const hostData = {
                  userId: userId,
-                  hostId: item.host_id,
-                  name: item.name,
-                  path: item.path,
-                  ...(table === "file_manager_recent" && {
-                    lastOpened: item.last_opened,
-                  }),
-                  ...(table === "file_manager_pinned" && {
-                    pinnedAt: item.pinned_at,
-                  }),
-                  ...(table === "file_manager_shortcuts" && {
-                    createdAt: item.created_at,
-                  }),
+                  name: host.name,
+                  ip: host.ip,
+                  port: host.port,
+                  username: host.username,
+                  folder: host.folder,
+                  tags: host.tags,
+                  pin: Boolean(host.pin),
+                  authType: host.auth_type,
+                  forceKeyboardInteractive: host.force_keyboard_interactive,
+                  password: host.password,
+                  key: host.key,
+                  keyPassword: host.key_password,
+                  keyType: host.key_type,
+                  sudoPassword: host.sudo_password,
+                  autostartPassword: host.autostart_password,
+                  autostartKey: host.autostart_key,
+                  autostartKeyPassword: host.autostart_key_password,
+                  credentialId: host.credential_id || null,
+                  overrideCredentialUsername: Boolean(
+                    host.override_credential_username,
+                  ),
+                  enableTerminal: Boolean(host.enable_terminal),
+                  enableTunnel: Boolean(host.enable_tunnel),
+                  tunnelConnections: host.tunnel_connections,
+                  jumpHosts: host.jump_hosts,
+                  enableFileManager: Boolean(host.enable_file_manager),
+                  enableDocker: Boolean(host.enable_docker),
+                  showTerminalInSidebar: Boolean(host.show_terminal_in_sidebar),
+                  showFileManagerInSidebar: Boolean(
+                    host.show_file_manager_in_sidebar,
+                  ),
+                  showTunnelInSidebar: Boolean(host.show_tunnel_in_sidebar),
+                  showDockerInSidebar: Boolean(host.show_docker_in_sidebar),
+                  showServerStatsInSidebar: Boolean(
+                    host.show_server_stats_in_sidebar,
+                  ),
+                  defaultPath: host.default_path,
+                  statsConfig: host.stats_config,
+                  terminalConfig: host.terminal_config,
+                  quickActions: host.quick_actions,
+                  notes: host.notes,
+                  useSocks5: Boolean(host.use_socks5),
+                  socks5Host: host.socks5_host,
+                  socks5Port: host.socks5_port,
+                  socks5Username: host.socks5_username,
+                  socks5Password: host.socks5_password,
+                  socks5ProxyChain: host.socks5_proxy_chain,
+                  createdAt: host.created_at || new Date().toISOString(),
+                  updatedAt: new Date().toISOString(),
                };

-                await mainDb.insert(schema).values(itemData);
-                result.summary[key]++;
-              } catch (itemError) {
+                await hostRepository.createEncryptedForUser(userId, hostData);
+                result.summary.sshHostsImported++;
+              } catch (hostError) {
                result.summary.errors.push(
-                  `${table} import error: ${itemError.message}`,
+                  `SSH host import error: ${hostError.message}`,
                );
              }
            }
          } catch {
-            apiLogger.info(`${table} table not found in import file, skipping`);
+            apiLogger.info("ssh_data table not found in import file, skipping");
          }
-        }

-        try {
-          const importedAlerts = importDb
-            .prepare("SELECT * FROM dismissed_alerts")
-            .all();
-          for (const alert of importedAlerts) {
-            try {
-              const existing = await mainDb
-                .select()
-                .from(dismissedAlerts)
-                .where(
-                  and(
-                    eq(dismissedAlerts.userId, userId),
-                    eq(dismissedAlerts.alertId, alert.alert_id),
-                  ),
+          try {
+            const importedCreds = importDb
+              .prepare("SELECT * FROM ssh_credentials")
+              .all();
+            for (const cred of importedCreds) {
+              try {
+                const credentialRepository =
+                  createCurrentCredentialRepository();
+                const exists =
+                  await credentialRepository.existsForImportIdentity(
+                    userId,
+                    cred.name,
+                    cred.username,
+                  );
+
+                if (exists) {
+                  result.summary.skippedItems++;
+                  continue;
+                }
+
+                const credData = {
+                  userId: userId,
+                  name: cred.name,
+                  description: cred.description,
+                  folder: cred.folder,
+                  tags: cred.tags,
+                  authType: cred.auth_type,
+                  username: cred.username,
+                  password: cred.password,
+                  key: cred.key,
+                  privateKey: cred.private_key,
+                  publicKey: cred.public_key,
+                  keyPassword: cred.key_password,
+                  keyType: cred.key_type,
+                  detectedKeyType: cred.detected_key_type,
+                  usageCount: cred.usage_count || 0,
+                  lastUsed: cred.last_used,
+                  createdAt: cred.created_at || new Date().toISOString(),
+                  updatedAt: new Date().toISOString(),
+                };
+
+                await credentialRepository.createEncryptedForUser(
+                  userId,
+                  credData,
+                );
+                result.summary.sshCredentialsImported++;
+              } catch (credError) {
+                result.summary.errors.push(
+                  `SSH credential import error: ${credError.message}`,
                );
-
-              if (existing.length > 0) {
-                result.summary.skippedItems++;
-                continue;
              }
+            }
+          } catch {
+            apiLogger.info(
+              "ssh_credentials table not found in import file, skipping",
+            );
+          }

-              await mainDb.insert(dismissedAlerts).values({
-                userId: userId,
-                alertId: alert.alert_id,
-                dismissedAt: alert.dismissed_at || new Date().toISOString(),
-              });
-              result.summary.dismissedAlertsImported++;
-            } catch (alertError) {
-              result.summary.errors.push(
-                `Dismissed alert import error: ${alertError.message}`,
+          const fileManagerTables = [
+            {
+              table: "file_manager_recent",
+              key: "fileManagerItemsImported",
+            },
+            {
+              table: "file_manager_pinned",
+              key: "fileManagerItemsImported",
+            },
+            {
+              table: "file_manager_shortcuts",
+              key: "fileManagerItemsImported",
+            },
+          ];
+
+          const fileManagerRepository =
+            createCurrentFileManagerBookmarkRepository();
+
+          for (const { table, key } of fileManagerTables) {
+            try {
+              const importedItems = importDb
+                .prepare(`SELECT * FROM ${table}`)
+                .all();
+              for (const item of importedItems) {
+                try {
+                  const bookmark = {
+                    hostId: item.host_id,
+                    name: item.name,
+                    path: item.path,
+                  };
+                  const created =
+                    table === "file_manager_recent"
+                      ? await fileManagerRepository.createRecentForImport(
+                          userId,
+                          bookmark,
+                          item.last_opened,
+                        )
+                      : table === "file_manager_pinned"
+                        ? await fileManagerRepository.createPinnedForImport(
+                            userId,
+                            bookmark,
+                            item.pinned_at,
+                          )
+                        : await fileManagerRepository.createShortcutForImport(
+                            userId,
+                            bookmark,
+                            item.created_at,
+                          );
+
+                  if (created) {
+                    result.summary[key]++;
+                  } else {
+                    result.summary.skippedItems++;
+                  }
+                } catch (itemError) {
+                  result.summary.errors.push(
+                    `${table} import error: ${itemError.message}`,
+                  );
+                }
+              }
+            } catch {
+              apiLogger.info(
+                `${table} table not found in import file, skipping`,
              );
            }
          }
-        } catch {
-          apiLogger.info(
-            "dismissed_alerts table not found in import file, skipping",
-          );
-        }

-        const targetUser = await mainDb
-          .select()
-          .from(users)
-          .where(eq(users.id, userId));
-        if (targetUser.length > 0 && targetUser[0].isAdmin) {
+          const dismissedAlertRepository =
+            createCurrentDismissedAlertRepository();
+
          try {
-            const importedSettings = importDb
-              .prepare("SELECT * FROM settings")
+            const importedAlerts = importDb
+              .prepare("SELECT * FROM dismissed_alerts")
              .all();
-            for (const setting of importedSettings) {
+            for (const alert of importedAlerts) {
              try {
-                const existing = await mainDb
-                  .select()
-                  .from(settings)
-                  .where(eq(settings.key, setting.key));
-
-                if (existing.length > 0) {
-                  await mainDb
-                    .update(settings)
-                    .set({ value: setting.value })
-                    .where(eq(settings.key, setting.key));
-                  result.summary.settingsImported++;
+                const created = await dismissedAlertRepository.createForImport(
+                  userId,
+                  alert.alert_id,
+                  alert.dismissed_at,
+                );
+                if (created) {
+                  result.summary.dismissedAlertsImported++;
                } else {
-                  await mainDb.insert(settings).values({
-                    key: setting.key,
-                    value: setting.value,
-                  });
-                  result.summary.settingsImported++;
+                  result.summary.skippedItems++;
                }
-              } catch (settingError) {
+              } catch (alertError) {
                result.summary.errors.push(
-                  `Setting import error (${setting.key}): ${settingError.message}`,
+                  `Dismissed alert import error: ${alertError.message}`,
                );
              }
            }
          } catch {
-            apiLogger.info("settings table not found in import file, skipping");
+            apiLogger.info(
+              "dismissed_alerts table not found in import file, skipping",
+            );
          }
-        } else {
-          apiLogger.info(
-            "Settings import skipped - only admin users can import settings",
-          );
-        }

-        mainDb.$client.exec("PRAGMA foreign_keys = ON");
-        result.success = true;
+          const targetUser = await userRepository.findById(userId);
+          if (targetUser?.isAdmin) {
+            try {
+              const importedSettings = readImportedSettings(importDb);
+              for (const setting of importedSettings) {
+                try {
+                  await upsertImportedSetting(setting);
+                  result.summary.settingsImported++;
+                } catch (settingError) {
+                  result.summary.errors.push(
+                    `Setting import error (${setting.key}): ${settingError.message}`,
+                  );
+                }
+              }
+            } catch {
+              apiLogger.info(
+                "settings table not found in import file, skipping",
+              );
+            }
+          } else {
+            apiLogger.info(
+              "Settings import skipped - only admin users can import settings",
+            );
+          }

-        try {
-          await DatabaseSaveTrigger.forceSave("database_import");
-        } catch (saveError) {
-          apiLogger.error(
-            "Failed to persist imported data to disk",
-            saveError,
-            {
-              operation: "import_force_save_failed",
-              userId,
-            },
-          );
-        }
+          result.success = true;
+
+          try {
+            await DatabaseSaveTrigger.forceSave("database_import");
+          } catch (saveError) {
+            apiLogger.error(
+              "Failed to persist imported data to disk",
+              saveError,
+              {
+                operation: "import_force_save_failed",
+                userId,
+              },
+            );
+          }
+        });
      } finally {
        if (importDb) {
          importDb.close();
@@ -1788,8 +1741,11 @@ app.use("/rbac", rbacRoutes);
 app.use("/open-tabs", openTabsRoutes);
 app.use("/user-preferences", userPreferencesRoutes);
 app.use("/proxmox", proxmoxRoutes);
+app.use("/termix-id", termixIdRoutes);
 registerAuditLogRoutes(app, authenticateJWT);
 registerTailscaleRoutes(app, authenticateJWT);
+app.use("/vault", vaultRoutes);
+app.use("/", alertRulesRoutes);

 const frontendDistPaths = [
  path.join(__dirname, "../../../dist"),
@@ -1939,6 +1895,7 @@ app.get(

      res.json({
        migrationStatus: status,
+        repositoryRollout: getRepositoryRolloutStatus(),
        files: {
          unencryptedDbSize: unencryptedSize,
          encryptedDbSize: encryptedSize,
@@ -8,6 +8,7 @@ import { DatabaseFileEncryption } from "../../utils/database-file-encryption.js"
 import { SystemCrypto } from "../../utils/system-crypto.js";
 import { DatabaseMigration } from "../../utils/database-migration.js";
 import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
+import { getDefaultGuacdUrl } from "../../utils/guacd-config.js";

 const dataDir = process.env.DATA_DIR || "./db/data";
 const dbDir = path.resolve(dataDir);
@@ -24,6 +25,28 @@ let memoryDatabase: Database.Database;
 let isNewDatabase = false;
 let sqlite: Database.Database;

+function getRawSettingValue(key: string): string | null {
+  const row = sqlite
+    .prepare("SELECT value FROM settings WHERE key = ?")
+    .get(key) as { value?: string } | undefined;
+
+  return row?.value ?? null;
+}
+
+function setRawSettingValue(key: string, value: string): void {
+  sqlite
+    .prepare("INSERT OR REPLACE INTO settings (key, value) VALUES (?, ?)")
+    .run(key, value);
+}
+
+function ensureRawSettingDefault(key: string, value: string): void {
+  if (getRawSettingValue(key) === null) {
+    sqlite
+      .prepare("INSERT INTO settings (key, value) VALUES (?, ?)")
+      .run(key, value);
+  }
+}
+
 async function initializeDatabaseAsync(): Promise<void> {
  const systemCrypto = SystemCrypto.getInstance();

@@ -196,6 +219,22 @@ async function initializeCompleteDatabase(): Promise<void> {
        FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
    );

+    CREATE TABLE IF NOT EXISTS webauthn_credentials (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        credential_id TEXT NOT NULL UNIQUE,
+        public_key TEXT NOT NULL,
+        counter INTEGER NOT NULL DEFAULT 0,
+        device_type TEXT,
+        backed_up INTEGER NOT NULL DEFAULT 0,
+        transports TEXT,
+        user_verification TEXT NOT NULL DEFAULT 'preferred',
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        last_used_at TEXT,
+        FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+    );
+
    CREATE TABLE IF NOT EXISTS ssh_data (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id TEXT NOT NULL,
@@ -443,6 +482,8 @@ async function initializeCompleteDatabase(): Promise<void> {
        commands TEXT,
        dangerous_actions TEXT,
        recording_path TEXT,
+        protocol TEXT NOT NULL DEFAULT 'ssh',
+        format TEXT NOT NULL DEFAULT 'text',
        terminated_by_owner INTEGER DEFAULT 0,
        termination_reason TEXT,
        FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE,
@@ -547,12 +588,30 @@ async function initializeCompleteDatabase(): Promise<void> {
 `);

  try {
-    sqlite.prepare("DELETE FROM user_open_tabs").run();
-    databaseLogger.info("Open tabs cleared on startup", {
-      operation: "db_init_open_tabs_cleanup",
-    });
+    const timeoutRow = sqlite
+      .prepare(
+        "SELECT value FROM settings WHERE key = 'terminal_session_timeout_minutes'",
+      )
+      .get() as { value: string } | undefined;
+    const timeoutMinutes = timeoutRow
+      ? parseInt(timeoutRow.value, 10)
+      : 30;
+    const ttlMs =
+      !isNaN(timeoutMinutes) && timeoutMinutes > 0
+        ? timeoutMinutes * 60_000
+        : 30 * 60_000;
+    const cutoff = new Date(Date.now() - ttlMs).toISOString();
+    const result = sqlite
+      .prepare("DELETE FROM user_open_tabs WHERE updated_at <= ?")
+      .run(cutoff);
+    if (result.changes > 0) {
+      databaseLogger.info("Expired open tabs cleared on startup", {
+        operation: "db_init_open_tabs_cleanup",
+        count: result.changes,
+      });
+    }
  } catch (e) {
-    databaseLogger.warn("Could not clear open tabs on startup", {
+    databaseLogger.warn("Could not clear expired open tabs on startup", {
      operation: "db_init_open_tabs_cleanup_failed",
      error: e,
    });
@@ -578,16 +637,7 @@ async function initializeCompleteDatabase(): Promise<void> {
  migrateSchema();

  try {
-    const row = sqlite
-      .prepare("SELECT value FROM settings WHERE key = 'allow_registration'")
-      .get();
-    if (!row) {
-      sqlite
-        .prepare(
-          "INSERT INTO settings (key, value) VALUES ('allow_registration', 'true')",
-        )
-        .run();
-    }
+    ensureRawSettingDefault("allow_registration", "true");
  } catch (e) {
    databaseLogger.warn("Could not initialize default settings", {
      operation: "db_init",
@@ -596,16 +646,7 @@ async function initializeCompleteDatabase(): Promise<void> {
  }

  try {
-    const row = sqlite
-      .prepare("SELECT value FROM settings WHERE key = 'allow_password_login'")
-      .get();
-    if (!row) {
-      sqlite
-        .prepare(
-          "INSERT INTO settings (key, value) VALUES ('allow_password_login', 'true')",
-        )
-        .run();
-    }
+    ensureRawSettingDefault("allow_password_login", "true");
  } catch (e) {
    databaseLogger.warn("Could not initialize allow_password_login setting", {
      operation: "db_init",
@@ -614,16 +655,7 @@ async function initializeCompleteDatabase(): Promise<void> {
  }

  try {
-    const row = sqlite
-      .prepare("SELECT value FROM settings WHERE key = 'guac_enabled'")
-      .get();
-    if (!row) {
-      sqlite
-        .prepare(
-          "INSERT INTO settings (key, value) VALUES ('guac_enabled', 'true')",
-        )
-        .run();
-    }
+    ensureRawSettingDefault("guac_enabled", "true");
  } catch (e) {
    databaseLogger.warn("Could not initialize guac_enabled setting", {
      operation: "db_init",
@@ -632,17 +664,7 @@ async function initializeCompleteDatabase(): Promise<void> {
  }

  try {
-    const row = sqlite
-      .prepare("SELECT value FROM settings WHERE key = 'guac_url'")
-      .get();
-    if (!row) {
-      const defaultGuacUrl = `${process.env.GUACD_HOST || "localhost"}:${process.env.GUACD_PORT || "4822"}`;
-      sqlite
-        .prepare(
-          "INSERT INTO settings (key, value) VALUES ('guac_url', ?)",
-        )
-        .run(defaultGuacUrl);
-    }
+    ensureRawSettingDefault("guac_url", getDefaultGuacdUrl());
  } catch (e) {
    databaseLogger.warn("Could not initialize guac_url setting", {
      operation: "db_init",
@@ -679,6 +701,17 @@ const addColumnIfNotExists = (
 };

 const migrateSchema = () => {
+  addColumnIfNotExists(
+    "session_recordings",
+    "protocol",
+    "TEXT NOT NULL DEFAULT 'ssh'",
+  );
+  addColumnIfNotExists(
+    "session_recordings",
+    "format",
+    "TEXT NOT NULL DEFAULT 'text'",
+  );
+
  addColumnIfNotExists("user_preferences", "theme", "TEXT");
  addColumnIfNotExists("user_preferences", "font_size", "TEXT");
  addColumnIfNotExists("user_preferences", "accent_color", "TEXT");
@@ -689,12 +722,29 @@ const migrateSchema = () => {
  addColumnIfNotExists("user_preferences", "show_host_tags", "INTEGER");
  addColumnIfNotExists("user_preferences", "host_tray_on_click", "INTEGER");
  addColumnIfNotExists("user_preferences", "pin_app_rail", "INTEGER");
+  addColumnIfNotExists(
+    "user_preferences",
+    "expand_app_rail_on_hover",
+    "INTEGER",
+  );
  addColumnIfNotExists("user_preferences", "folders_collapsed", "INTEGER");
  addColumnIfNotExists("user_preferences", "confirm_snippet_execution", "INTEGER");
  addColumnIfNotExists("user_preferences", "disable_update_check", "INTEGER");
  addColumnIfNotExists("user_preferences", "confirm_tab_close", "INTEGER");
  addColumnIfNotExists("user_preferences", "hidden_rail_tabs", "TEXT");
  addColumnIfNotExists("user_preferences", "compact_host_view", "INTEGER");
+  addColumnIfNotExists("user_preferences", "status_color_scheme", "TEXT");
+
+  sqlite.exec(`
+    CREATE TABLE IF NOT EXISTS dashboard_service_links (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      label TEXT NOT NULL,
+      url TEXT NOT NULL,
+      "order" INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )
+  `);

  addColumnIfNotExists("users", "is_admin", "INTEGER NOT NULL DEFAULT 0");

@@ -714,6 +764,28 @@ const migrateSchema = () => {
  addColumnIfNotExists("users", "totp_enabled", "INTEGER NOT NULL DEFAULT 0");
  addColumnIfNotExists("users", "totp_backup_codes", "TEXT");

+  addColumnIfNotExists("sessions", "oidc_sub", "TEXT");
+  addColumnIfNotExists("sessions", "oidc_sid", "TEXT");
+  addColumnIfNotExists("sessions", "sso_provider_id", "INTEGER");
+
+  sqlite.exec(`
+    CREATE TABLE IF NOT EXISTS webauthn_credentials (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      name TEXT NOT NULL,
+      credential_id TEXT NOT NULL UNIQUE,
+      public_key TEXT NOT NULL,
+      counter INTEGER NOT NULL DEFAULT 0,
+      device_type TEXT,
+      backed_up INTEGER NOT NULL DEFAULT 0,
+      transports TEXT,
+      user_verification TEXT NOT NULL DEFAULT 'preferred',
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      last_used_at TEXT,
+      FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+    )
+  `);
+
  addColumnIfNotExists("ssh_data", "name", "TEXT");
  addColumnIfNotExists("ssh_data", "folder", "TEXT");
  addColumnIfNotExists("ssh_data", "tags", "TEXT");
@@ -784,6 +856,11 @@ const migrateSchema = () => {
    "override_credential_username",
    "INTEGER",
  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "vault_profile_id",
+    "INTEGER REFERENCES vault_profiles(id) ON DELETE SET NULL",
+  );

  addColumnIfNotExists("ssh_data", "autostart_password", "TEXT");
  addColumnIfNotExists("ssh_data", "autostart_key", "TEXT");
@@ -990,6 +1067,111 @@ const migrateSchema = () => {
    }
  }

+  try {
+    sqlite.prepare("SELECT id FROM termix_identities LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS termix_identities (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL UNIQUE,
+          handle TEXT NOT NULL UNIQUE,
+          description TEXT,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create termix_identities table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  // Enforce one-Termix-ID-per-user on databases where the table predates the
+  // UNIQUE(user_id) constraint above.
+  try {
+    sqlite.exec(
+      "CREATE UNIQUE INDEX IF NOT EXISTS idx_termix_identities_user ON termix_identities(user_id)",
+    );
+  } catch (indexError) {
+    databaseLogger.warn("Failed to create termix_identities user_id unique index", {
+      operation: "schema_migration",
+      error: indexError,
+    });
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM termix_identity_keys LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS termix_identity_keys (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          identity_id INTEGER NOT NULL,
+          user_id TEXT NOT NULL,
+          public_key TEXT NOT NULL,
+          key_type TEXT NOT NULL,
+          algorithm TEXT NOT NULL,
+          label TEXT,
+          comment TEXT,
+          source TEXT NOT NULL DEFAULT 'manual',
+          credential_id INTEGER,
+          enabled INTEGER NOT NULL DEFAULT 1,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (identity_id) REFERENCES termix_identities (id) ON DELETE CASCADE,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+          FOREIGN KEY (credential_id) REFERENCES ssh_credentials (id) ON DELETE SET NULL
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create termix_identity_keys table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  // The public resolver fetches keys by identity_id on every request; index it.
+  try {
+    sqlite.exec(
+      "CREATE INDEX IF NOT EXISTS idx_termix_identity_keys_identity ON termix_identity_keys(identity_id)",
+    );
+  } catch (indexError) {
+    databaseLogger.warn("Failed to create termix_identity_keys identity index", {
+      operation: "schema_migration",
+      error: indexError,
+    });
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM termix_identity_ca LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS termix_identity_ca (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          identity_id INTEGER NOT NULL UNIQUE,
+          user_id TEXT NOT NULL,
+          public_key TEXT NOT NULL,
+          private_key TEXT NOT NULL,
+          validity_days INTEGER NOT NULL DEFAULT 90,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (identity_id) REFERENCES termix_identities (id) ON DELETE CASCADE,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create termix_identity_ca table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
  try {
    sqlite.prepare("SELECT id FROM c2s_tunnel_presets LIMIT 1").get();
  } catch {
@@ -1392,6 +1574,8 @@ const migrateSchema = () => {
          commands TEXT,
          dangerous_actions TEXT,
          recording_path TEXT,
+          protocol TEXT NOT NULL DEFAULT 'ssh',
+          format TEXT NOT NULL DEFAULT 'text',
          terminated_by_owner INTEGER DEFAULT 0,
          termination_reason TEXT,
          FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE,
@@ -1470,6 +1654,67 @@ const migrateSchema = () => {
    }
  }

+  try {
+    sqlite.prepare("SELECT id FROM vault_profiles LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS vault_profiles (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          name TEXT NOT NULL,
+          description TEXT,
+          folder TEXT,
+          tags TEXT,
+          vault_addr TEXT NOT NULL,
+          vault_namespace TEXT,
+          oidc_mount TEXT,
+          oidc_role TEXT,
+          ssh_mount TEXT,
+          ssh_role TEXT NOT NULL,
+          valid_principals TEXT,
+          key_type TEXT,
+          shared INTEGER NOT NULL DEFAULT 0,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create vault_profiles table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM vault_tokens LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS vault_tokens (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          profile_id INTEGER NOT NULL,
+          ssh_cert TEXT NOT NULL,
+          private_key TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          expires_at TEXT NOT NULL,
+          last_used TEXT,
+          UNIQUE(user_id, profile_id),
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+          FOREIGN KEY (profile_id) REFERENCES vault_profiles (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create vault_tokens table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
  try {
    sqlite.prepare("SELECT id FROM api_keys LIMIT 1").get();
  } catch {
@@ -1678,31 +1923,30 @@ const migrateSchema = () => {

  // Migrate legacy single oidc_config settings blob into sso_providers table
  try {
-    const migrationDone = sqlite
-      .prepare("SELECT value FROM settings WHERE key = 'sso_migration_v1'")
-      .get();
+    const migrationDone = getRawSettingValue("sso_migration_v1");
    if (!migrationDone) {
      const providerCount = (
-        sqlite.prepare("SELECT COUNT(*) as c FROM sso_providers").get() as { c: number }
+        sqlite.prepare("SELECT COUNT(*) as c FROM sso_providers").get() as {
+          c: number;
+        }
      ).c;
      if (providerCount === 0) {
-        const legacyRow = sqlite
-          .prepare("SELECT value FROM settings WHERE key = 'oidc_config'")
-          .get() as { value: string } | undefined;
-        if (legacyRow) {
+        const legacyConfig = getRawSettingValue("oidc_config");
+        if (legacyConfig) {
          sqlite
            .prepare(
              "INSERT INTO sso_providers (name, type, enabled, display_order, config) VALUES (?, 'oidc', 1, 0, ?)",
            )
-            .run("OIDC", legacyRow.value);
-          databaseLogger.info("Migrated legacy oidc_config into sso_providers table", {
-            operation: "sso_migration_v1",
-          });
+            .run("OIDC", legacyConfig);
+          databaseLogger.info(
+            "Migrated legacy oidc_config into sso_providers table",
+            {
+              operation: "sso_migration_v1",
+            },
+          );
        }
      }
-      sqlite
-        .prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('sso_migration_v1', 'true')")
-        .run();
+      setRawSettingValue("sso_migration_v1", "true");
    }
  } catch (e) {
    databaseLogger.warn("Failed to run SSO migration v1", {
@@ -1711,6 +1955,193 @@ const migrateSchema = () => {
    });
  }

+  // --- metrics-history begin ---
+  try {
+    sqlite.prepare("SELECT id FROM host_metrics_history LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS host_metrics_history (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          host_id INTEGER NOT NULL REFERENCES ssh_data(id) ON DELETE CASCADE,
+          ts TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          cpu_percent REAL,
+          mem_percent REAL,
+          disk_percent REAL,
+          net_rx_bytes INTEGER,
+          net_tx_bytes INTEGER
+        );
+        CREATE INDEX IF NOT EXISTS idx_host_metrics_history_host_ts
+          ON host_metrics_history (host_id, ts DESC);
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create host_metrics_history table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+  // --- metrics-history end ---
+
+  // --- alerts begin ---
+  try {
+    sqlite.prepare("SELECT id FROM alert_rules LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS alert_rules (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          host_id INTEGER REFERENCES ssh_data(id) ON DELETE CASCADE,
+          name TEXT NOT NULL,
+          enabled INTEGER NOT NULL DEFAULT 1,
+          trigger_type TEXT NOT NULL,
+          threshold_value REAL,
+          threshold_duration_seconds INTEGER,
+          cooldown_minutes INTEGER NOT NULL DEFAULT 15,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create alert_rules table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM notification_channels LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS notification_channels (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          name TEXT NOT NULL,
+          type TEXT NOT NULL,
+          config TEXT NOT NULL,
+          enabled INTEGER NOT NULL DEFAULT 1,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create notification_channels table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM alert_rule_channels LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS alert_rule_channels (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          rule_id INTEGER NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+          channel_id INTEGER NOT NULL REFERENCES notification_channels(id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create alert_rule_channels table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM alert_firings LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS alert_firings (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          rule_id INTEGER NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+          host_id INTEGER NOT NULL,
+          host_name TEXT NOT NULL,
+          fired_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          resolved_at TEXT,
+          value REAL,
+          message TEXT NOT NULL,
+          severity TEXT NOT NULL DEFAULT 'warning',
+          acknowledged INTEGER NOT NULL DEFAULT 0
+        );
+        CREATE INDEX IF NOT EXISTS idx_alert_firings_user_fired
+          ON alert_firings (user_id, fired_at DESC);
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create alert_firings table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+  // --- alerts end ---
+
+  // Seed default metrics history retention setting
+  try {
+    ensureRawSettingDefault("metrics_history_retention_days", "7");
+  } catch (e) {
+    databaseLogger.warn(
+      "Could not initialize metrics_history_retention_days setting",
+      {
+        operation: "schema_migration",
+        error: e,
+      },
+    );
+  }
+
+  // --- homepage begin ---
+  try {
+    sqlite.prepare("SELECT id FROM homepage_items LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS homepage_items (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          type_id TEXT NOT NULL,
+          title TEXT,
+          config TEXT NOT NULL DEFAULT '{}',
+          folder_id INTEGER,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create homepage_items table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM homepage_layouts LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS homepage_layouts (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL UNIQUE REFERENCES users(id) ON DELETE CASCADE,
+          layout TEXT NOT NULL DEFAULT '{}',
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create homepage_layouts table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+  // --- homepage end ---
+
  databaseLogger.success("Schema migration completed", {
    operation: "schema_migration",
  });
@@ -1753,21 +2184,23 @@ async function saveMemoryDatabaseToFile(): Promise<void> {
 }

 async function handlePostInitFileEncryption() {
-  if (!enableFileEncryption) return;
-
  try {
    if (memoryDatabase) {
-      await saveMemoryDatabaseToFile();
+      DatabaseSaveTrigger.initialize(saveMemoryDatabaseToFile);
+
+      if (enableFileEncryption) {
+        await saveMemoryDatabaseToFile();
+      }

      setInterval(() => {
        if (DatabaseSaveTrigger.isDirty) {
          saveMemoryDatabaseToFile();
        }
      }, 5 * 60 * 1000);
-
-      DatabaseSaveTrigger.initialize(saveMemoryDatabaseToFile);
    }

+    if (!enableFileEncryption) return;
+
    try {
      const migration = new DatabaseMigration(dataDir);
      migration.cleanupOldBackups();
@@ -1,4 +1,4 @@
-import { sqliteTable, text, integer } from "drizzle-orm/sqlite-core";
+import { sqliteTable, text, integer, real } from "drizzle-orm/sqlite-core";
 import { sql } from "drizzle-orm";

 export const users = sqliteTable("users", {
@@ -54,6 +54,9 @@ export const sessions = sqliteTable("sessions", {
  jwtToken: text("jwt_token").notNull(),
  deviceType: text("device_type").notNull(),
  deviceInfo: text("device_info").notNull(),
+  oidcSub: text("oidc_sub"),
+  oidcSid: text("oidc_sid"),
+  ssoProviderId: integer("sso_provider_id"),
  createdAt: text("created_at")
    .notNull()
    .default(sql`CURRENT_TIMESTAMP`),
@@ -80,6 +83,25 @@ export const trustedDevices = sqliteTable("trusted_devices", {
    .default(sql`CURRENT_TIMESTAMP`),
 });

+export const webauthnCredentials = sqliteTable("webauthn_credentials", {
+  id: text("id").primaryKey(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  credentialId: text("credential_id").notNull(),
+  publicKey: text("public_key").notNull(),
+  counter: integer("counter").notNull().default(0),
+  deviceType: text("device_type"),
+  backedUp: integer("backed_up", { mode: "boolean" }).notNull().default(false),
+  transports: text("transports"),
+  userVerification: text("user_verification").notNull().default("preferred"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  lastUsedAt: text("last_used_at"),
+});
+
 export const hosts = sqliteTable("ssh_data", {
  id: integer("id").primaryKey({ autoIncrement: true }),
  userId: text("user_id")
@@ -111,6 +133,13 @@ export const hosts = sqliteTable("ssh_data", {
  overrideCredentialUsername: integer("override_credential_username", {
    mode: "boolean",
  }),
+  // When authType is "vault", the host authenticates via a Vault SSH signer
+  // profile (shared settings, no secrets). The signing certificate is obtained
+  // per-user at connect time via an interactive Vault OIDC flow.
+  vaultProfileId: integer("vault_profile_id").references(
+    () => vaultProfiles.id,
+    { onDelete: "set null" },
+  ),
  enableTerminal: integer("enable_terminal", { mode: "boolean" })
    .notNull()
    .default(true),
@@ -631,6 +660,8 @@ export const sessionRecordings = sqliteTable("session_recordings", {
  dangerousActions: text("dangerous_actions"),

  recordingPath: text("recording_path"),
+  protocol: text("protocol").notNull().default("ssh"),
+  format: text("format").notNull().default("text"),

  terminatedByOwner: integer("terminated_by_owner", { mode: "boolean" })
    .default(false),
@@ -661,6 +692,63 @@ export const opksshTokens = sqliteTable("opkssh_tokens", {
  lastUsed: text("last_used"),
 });

+// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
+// are intended to be shared across users (shared === true makes a profile
+// visible to every user on the server). Each user authenticates to Vault via an
+// interactive OIDC flow at connect time; no tokens or keys are stored here.
+export const vaultProfiles = sqliteTable("vault_profiles", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  description: text("description"),
+  folder: text("folder"),
+  tags: text("tags"),
+  // Vault server connection (non-secret)
+  vaultAddr: text("vault_addr").notNull(),
+  vaultNamespace: text("vault_namespace"),
+  // OIDC auth method mount + role used to obtain a Vault token interactively
+  oidcMount: text("oidc_mount"),
+  oidcRole: text("oidc_role"),
+  // SSH secrets engine mount + signer role used to sign the ephemeral key
+  sshMount: text("ssh_mount"),
+  sshRole: text("ssh_role").notNull(),
+  validPrincipals: text("valid_principals"),
+  // Ephemeral keypair algorithm to generate per connection
+  keyType: text("key_type"),
+  // When true the profile is visible/usable by all users on the server
+  shared: integer("shared", { mode: "boolean" }).notNull().default(false),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
+// Transient: rows live only until the certificate expires. Secret fields are
+// encrypted under the user's data-encryption key (see field-crypto.ts).
+export const vaultTokens = sqliteTable("vault_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  profileId: integer("profile_id")
+    .notNull()
+    .references(() => vaultProfiles.id, { onDelete: "cascade" }),
+
+  sshCert: text("ssh_cert", { length: 8192 }).notNull(),
+  privateKey: text("private_key", { length: 8192 }).notNull(),
+
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  expiresAt: text("expires_at").notNull(),
+  lastUsed: text("last_used"),
+});
+
 export const apiKeys = sqliteTable("api_keys", {
  id: text("id").primaryKey(),
  userId: text("user_id")
@@ -710,6 +798,9 @@ export const userPreferences = sqliteTable("user_preferences", {
  showHostTags: integer("show_host_tags", { mode: "boolean" }),
  hostTrayOnClick: integer("host_tray_on_click", { mode: "boolean" }),
  pinAppRail: integer("pin_app_rail", { mode: "boolean" }),
+  expandAppRailOnHover: integer("expand_app_rail_on_hover", {
+    mode: "boolean",
+  }),
  foldersCollapsed: integer("folders_collapsed", { mode: "boolean" }),
  confirmSnippetExecution: integer("confirm_snippet_execution", { mode: "boolean" }),
  disableUpdateCheck: integer("disable_update_check", { mode: "boolean" }),
@@ -788,6 +879,79 @@ export const dashboardServiceLinks = sqliteTable("dashboard_service_links", {
    .default(sql`CURRENT_TIMESTAMP`),
 });

+// --- termix-id begin ---
+// A user claims a unique public handle. Their published SSH public keys are
+// served at an unauthenticated resolver endpoint in authorized_keys format,
+// so any server can be provisioned with `curl <host>/termix-id/u/<handle> >> ~/.ssh/authorized_keys`.
+export const termixIdentities = sqliteTable("termix_identities", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  // One Termix ID per user — enforced in schema, not just in code.
+  userId: text("user_id")
+    .notNull()
+    .unique()
+    .references(() => users.id, { onDelete: "cascade" }),
+  handle: text("handle").notNull().unique(),
+  description: text("description"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const termixIdentityKeys = sqliteTable("termix_identity_keys", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  identityId: integer("identity_id")
+    .notNull()
+    .references(() => termixIdentities.id, { onDelete: "cascade" }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  // Public keys are non-secret, so they are stored in plaintext (no field-level
+  // encryption). This is what lets the unauthenticated resolver serve them.
+  publicKey: text("public_key", { length: 8192 }).notNull(),
+  // Raw algorithm token (e.g. "ssh-ed25519"), and a normalized group used for
+  // the /<ALGO> resolver filter (RSA / ED25519 / ECDSA / ...).
+  keyType: text("key_type").notNull(),
+  algorithm: text("algorithm").notNull(),
+  label: text("label"),
+  comment: text("comment"),
+  // "manual" (pasted) or "credential" (imported from an ssh_credentials entry).
+  source: text("source").notNull().default("manual"),
+  credentialId: integer("credential_id").references(() => sshCredentials.id, {
+    onDelete: "set null",
+  }),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+// Per-identity certificate authority. Servers that trust this CA (via
+// TrustedUserCAKeys / @cert-authority) accept any user certificate it signs,
+// giving central revocation (rotate the CA) and expiry (cert validity).
+export const termixIdentityCa = sqliteTable("termix_identity_ca", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  identityId: integer("identity_id")
+    .notNull()
+    .unique()
+    .references(() => termixIdentities.id, { onDelete: "cascade" }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  // CA public key (plaintext — it is published); CA private key is field-encrypted.
+  publicKey: text("public_key", { length: 4096 }).notNull(),
+  privateKey: text("private_key", { length: 8192 }).notNull(),
+  validityDays: integer("validity_days").notNull().default(90),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- termix-id end ---
+
 // --- tmux-monitor begin ---
 export const tmuxSessionTags = sqliteTable("tmux_session_tags", {
  id: integer("id").primaryKey({ autoIncrement: true }),
@@ -804,3 +968,118 @@ export const tmuxSessionTags = sqliteTable("tmux_session_tags", {
    .default(sql`CURRENT_TIMESTAMP`),
 });
 // --- tmux-monitor end ---
+
+// --- metrics-history begin ---
+export const hostMetricsHistory = sqliteTable("host_metrics_history", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  hostId: integer("host_id")
+    .notNull()
+    .references(() => hosts.id, { onDelete: "cascade" }),
+  ts: text("ts")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  cpuPercent: real("cpu_percent"),
+  memPercent: real("mem_percent"),
+  diskPercent: real("disk_percent"),
+  netRxBytes: integer("net_rx_bytes"),
+  netTxBytes: integer("net_tx_bytes"),
+});
+// --- metrics-history end ---
+
+// --- alerts begin ---
+export const alertRules = sqliteTable("alert_rules", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  hostId: integer("host_id").references(() => hosts.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  triggerType: text("trigger_type").notNull(),
+  thresholdValue: real("threshold_value"),
+  thresholdDurationSeconds: integer("threshold_duration_seconds"),
+  cooldownMinutes: integer("cooldown_minutes").notNull().default(15),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const notificationChannels = sqliteTable("notification_channels", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  type: text("type").notNull(),
+  config: text("config").notNull(),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const alertRuleChannels = sqliteTable("alert_rule_channels", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  ruleId: integer("rule_id")
+    .notNull()
+    .references(() => alertRules.id, { onDelete: "cascade" }),
+  channelId: integer("channel_id")
+    .notNull()
+    .references(() => notificationChannels.id, { onDelete: "cascade" }),
+});
+
+export const alertFirings = sqliteTable("alert_firings", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  ruleId: integer("rule_id")
+    .notNull()
+    .references(() => alertRules.id, { onDelete: "cascade" }),
+  hostId: integer("host_id").notNull(),
+  hostName: text("host_name").notNull(),
+  firedAt: text("fired_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  resolvedAt: text("resolved_at"),
+  value: real("value"),
+  message: text("message").notNull(),
+  severity: text("severity").notNull().default("warning"),
+  acknowledged: integer("acknowledged", { mode: "boolean" }).notNull().default(false),
+});
+// --- alerts end ---
+
+// --- homepage begin ---
+export const homepageItems = sqliteTable("homepage_items", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  typeId: text("type_id").notNull(),
+  title: text("title"),
+  config: text("config").notNull().default("{}"),
+  folderId: integer("folder_id"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const homepageLayouts = sqliteTable("homepage_layouts", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .unique()
+    .references(() => users.id, { onDelete: "cascade" }),
+  // JSON: { entries: HomepageLayoutEntry[], pan: {x,y}, zoom: number }
+  layout: text("layout").notNull().default("{}"),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- homepage end ---
@@ -0,0 +1,383 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { SqliteDatabaseAdapter } from "../runtime/sqlite-adapter.js";
+import { AlertRepository } from "./alert-repository.js";
+
+describe("AlertRepository", () => {
+  let adapter: SqliteDatabaseAdapter | null = null;
+
+  afterEach(async () => {
+    if (adapter) {
+      await adapter.close();
+      adapter = null;
+    }
+  });
+
+  async function createRepository(
+    onWrite?: () => void | Promise<void>,
+  ): Promise<AlertRepository> {
+    adapter = new SqliteDatabaseAdapter({
+      dialect: "sqlite",
+      url: ":memory:",
+      sqlitePath: ":memory:",
+    });
+    const context = await adapter.connect();
+    context.sqlite?.exec(`
+      CREATE TABLE users (
+        id TEXT PRIMARY KEY,
+        username TEXT NOT NULL,
+        password_hash TEXT NOT NULL
+      );
+
+      CREATE TABLE ssh_data (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id TEXT NOT NULL,
+        name TEXT,
+        ip TEXT NOT NULL
+      );
+
+      CREATE TABLE alert_rules (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id TEXT NOT NULL,
+        host_id INTEGER,
+        name TEXT NOT NULL,
+        enabled INTEGER NOT NULL DEFAULT 1,
+        trigger_type TEXT NOT NULL,
+        threshold_value REAL,
+        threshold_duration_seconds INTEGER,
+        cooldown_minutes INTEGER NOT NULL DEFAULT 15,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE notification_channels (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        type TEXT NOT NULL,
+        config TEXT NOT NULL,
+        enabled INTEGER NOT NULL DEFAULT 1,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE alert_rule_channels (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        rule_id INTEGER NOT NULL,
+        channel_id INTEGER NOT NULL
+      );
+
+      CREATE TABLE alert_firings (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id TEXT NOT NULL,
+        rule_id INTEGER NOT NULL,
+        host_id INTEGER NOT NULL,
+        host_name TEXT NOT NULL,
+        fired_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        resolved_at TEXT,
+        value REAL,
+        message TEXT NOT NULL,
+        severity TEXT NOT NULL DEFAULT 'warning',
+        acknowledged INTEGER NOT NULL DEFAULT 0
+      );
+
+      INSERT INTO users (id, username, password_hash)
+      VALUES ('user-1', 'alice', 'hash'), ('user-2', 'bob', 'hash');
+      INSERT INTO ssh_data (id, user_id, name, ip)
+      VALUES (1, 'user-1', 'alpha', '127.0.0.1');
+    `);
+
+    return new AlertRepository(context, onWrite);
+  }
+
+  it("manages notification channels", async () => {
+    let writes = 0;
+    const repo = await createRepository(() => {
+      writes += 1;
+    });
+
+    const created = await repo.createNotificationChannel({
+      userId: "user-1",
+      name: "Ops",
+      type: "webhook",
+      config: '{"url":"https://example.test"}',
+      enabled: true,
+    });
+
+    expect(created).toMatchObject({
+      user_id: "user-1",
+      name: "Ops",
+      type: "webhook",
+      enabled: 1,
+    });
+
+    const updated = await repo.updateNotificationChannel(created.id, "user-1", {
+      name: "Ops disabled",
+      enabled: false,
+    });
+    expect(updated).toMatchObject({ name: "Ops disabled", enabled: 0 });
+
+    expect(await repo.listNotificationChannels("user-1")).toHaveLength(1);
+    expect(await repo.deleteNotificationChannel(created.id, "user-2")).toBe(
+      false,
+    );
+    expect(await repo.deleteNotificationChannel(created.id, "user-1")).toBe(
+      true,
+    );
+    expect(await repo.listNotificationChannels("user-1")).toHaveLength(0);
+    expect(writes).toBe(3);
+  });
+
+  it("manages alert rules and linked channels", async () => {
+    const repo = await createRepository();
+    const ownedChannel = await repo.createNotificationChannel({
+      userId: "user-1",
+      name: "Owned",
+      type: "ntfy",
+      config: '{"url":"https://ntfy.test","topic":"termix"}',
+      enabled: true,
+    });
+    const foreignChannel = await repo.createNotificationChannel({
+      userId: "user-2",
+      name: "Foreign",
+      type: "webhook",
+      config: '{"url":"https://example.test"}',
+      enabled: true,
+    });
+
+    const created = await repo.createAlertRule({
+      userId: "user-1",
+      hostId: null,
+      name: "CPU high",
+      enabled: true,
+      triggerType: "cpu_threshold",
+      thresholdValue: 80,
+      thresholdDurationSeconds: 30,
+      cooldownMinutes: 5,
+      channels: [ownedChannel.id, foreignChannel.id],
+      now: "2026-01-01T00:00:00.000Z",
+    });
+
+    expect(created).toMatchObject({
+      user_id: "user-1",
+      host_id: null,
+      name: "CPU high",
+      trigger_type: "cpu_threshold",
+      threshold_value: 80,
+      channels: [ownedChannel.id],
+    });
+
+    const updated = await repo.updateAlertRule(created.id, "user-1", {
+      name: "CPU very high",
+      hostId: 1,
+      channels: [],
+      now: "2026-01-02T00:00:00.000Z",
+    });
+    expect(updated).toMatchObject({
+      name: "CPU very high",
+      host_id: 1,
+      channels: [],
+      updated_at: "2026-01-02T00:00:00.000Z",
+    });
+
+    const rules = await repo.listAlertRules("user-1");
+    expect(rules).toHaveLength(1);
+    expect(rules[0].channels).toEqual([]);
+    expect(await repo.deleteAlertRule(created.id, "user-2")).toBe(false);
+    expect(await repo.deleteAlertRule(created.id, "user-1")).toBe(true);
+  });
+
+  it("lists, acknowledges, and prunes firings", async () => {
+    const repo = await createRepository();
+    const rule = await repo.createAlertRule({
+      userId: "user-1",
+      hostId: 1,
+      name: "Host offline",
+      enabled: true,
+      triggerType: "host_offline",
+      thresholdValue: null,
+      thresholdDurationSeconds: null,
+      cooldownMinutes: 15,
+      channels: [],
+      now: "2026-01-01T00:00:00.000Z",
+    });
+
+    await repo.createFiring({
+      userId: "user-1",
+      ruleId: rule.id,
+      hostId: 1,
+      hostName: "alpha",
+      value: null,
+      message: "down",
+      severity: "critical",
+    });
+
+    const listed = await repo.listAlertFirings({
+      userId: "user-1",
+      limit: 10,
+      offset: 0,
+    });
+    expect(listed.total).toBe(1);
+    expect(listed.firings[0]).toMatchObject({
+      rule_id: rule.id,
+      host_name: "alpha",
+      acknowledged: 0,
+      rule_name: "Host offline",
+    });
+
+    await repo.acknowledgeFiring(listed.firings[0].id, "user-1");
+    const unacknowledged = await repo.listAlertFirings({
+      userId: "user-1",
+      acknowledged: false,
+      limit: 10,
+      offset: 0,
+    });
+    expect(unacknowledged.total).toBe(0);
+
+    await repo.acknowledgeAllFirings("user-1");
+    repo.pruneFiringsOlderThan("user-1", 0);
+  });
+
+  it("loads enabled rules and notification channels for the alert engine", async () => {
+    const repo = await createRepository();
+    const channel = await repo.createNotificationChannel({
+      userId: "user-1",
+      name: "Ops",
+      type: "webhook",
+      config: '{"url":"https://example.test"}',
+      enabled: true,
+    });
+    const disabledChannel = await repo.createNotificationChannel({
+      userId: "user-1",
+      name: "Disabled",
+      type: "webhook",
+      config: '{"url":"https://disabled.test"}',
+      enabled: false,
+    });
+    const rule = await repo.createAlertRule({
+      userId: "user-1",
+      hostId: null,
+      name: "CPU high",
+      enabled: true,
+      triggerType: "cpu_threshold",
+      thresholdValue: 90,
+      thresholdDurationSeconds: 0,
+      cooldownMinutes: 15,
+      channels: [channel.id, disabledChannel.id],
+      now: "2026-01-01T00:00:00.000Z",
+    });
+
+    expect(await repo.listEnabledRulesForHost(1)).toMatchObject([
+      {
+        id: rule.id,
+        userId: "user-1",
+        triggerType: "cpu_threshold",
+        enabled: true,
+      },
+    ]);
+    expect(await repo.findRuleById(rule.id)).toMatchObject({
+      id: rule.id,
+      cooldownMinutes: 15,
+    });
+    expect(await repo.listEnabledChannelsForRule(rule.id)).toEqual([
+      {
+        id: channel.id,
+        type: "webhook",
+        config: '{"url":"https://example.test"}',
+        enabled: true,
+      },
+    ]);
+  });
+
+  it("loads host display names for alert payloads", async () => {
+    const repo = await createRepository();
+
+    expect(await repo.getHostDisplayName(1)).toBe("alpha");
+    expect(await repo.getHostDisplayName(999)).toBeNull();
+  });
+
+  it("deletes all alert data for a user", async () => {
+    let writes = 0;
+    const repo = await createRepository(() => {
+      writes += 1;
+    });
+
+    const userChannel = await repo.createNotificationChannel({
+      userId: "user-1",
+      name: "Ops",
+      type: "webhook",
+      config: '{"url":"https://example.test"}',
+      enabled: true,
+    });
+    const otherChannel = await repo.createNotificationChannel({
+      userId: "user-2",
+      name: "Other",
+      type: "webhook",
+      config: '{"url":"https://other.test"}',
+      enabled: true,
+    });
+    const userRule = await repo.createAlertRule({
+      userId: "user-1",
+      hostId: 1,
+      name: "CPU high",
+      enabled: true,
+      triggerType: "cpu_threshold",
+      thresholdValue: 80,
+      thresholdDurationSeconds: 30,
+      cooldownMinutes: 5,
+      channels: [userChannel.id],
+      now: "2026-01-01T00:00:00.000Z",
+    });
+    const otherRule = await repo.createAlertRule({
+      userId: "user-2",
+      hostId: null,
+      name: "Memory high",
+      enabled: true,
+      triggerType: "memory_threshold",
+      thresholdValue: 90,
+      thresholdDurationSeconds: 60,
+      cooldownMinutes: 10,
+      channels: [otherChannel.id],
+      now: "2026-01-01T00:00:00.000Z",
+    });
+    await repo.createFiring({
+      userId: "user-1",
+      ruleId: userRule.id,
+      hostId: 1,
+      hostName: "alpha",
+      value: 95,
+      message: "high",
+      severity: "warning",
+    });
+    await repo.createFiring({
+      userId: "user-2",
+      ruleId: otherRule.id,
+      hostId: 1,
+      hostName: "alpha",
+      value: 91,
+      message: "other",
+      severity: "warning",
+    });
+
+    await expect(repo.deleteByUserId("user-1")).resolves.toEqual({
+      firingsDeleted: 1,
+      ruleLinksDeleted: 1,
+      rulesDeleted: 1,
+      channelsDeleted: 1,
+    });
+    await expect(repo.deleteByUserId("missing")).resolves.toEqual({
+      firingsDeleted: 0,
+      ruleLinksDeleted: 0,
+      rulesDeleted: 0,
+      channelsDeleted: 0,
+    });
+
+    expect(await repo.listNotificationChannels("user-1")).toEqual([]);
+    expect(await repo.listAlertRules("user-1")).toEqual([]);
+    expect(
+      await repo.listAlertFirings({ userId: "user-1", limit: 10, offset: 0 }),
+    ).toEqual({ firings: [], total: 0 });
+    expect(await repo.listNotificationChannels("user-2")).toHaveLength(1);
+    expect(await repo.listAlertRules("user-2")).toHaveLength(1);
+    expect(await repo.listEnabledChannelsForRule(otherRule.id)).toHaveLength(1);
+    expect(writes).toBe(7);
+  });
+});
@@ -0,0 +1,622 @@
+import { and, count, desc, eq, inArray, isNull, or } from "drizzle-orm";
+import {
+  alertFirings,
+  alertRuleChannels,
+  alertRules,
+  hosts,
+  notificationChannels,
+} from "../db/schema.js";
+import type { DatabaseContext } from "../runtime/adapter.js";
+
+type AlertRuleRecord = typeof alertRules.$inferSelect;
+type NotificationChannelRecord = typeof notificationChannels.$inferSelect;
+type AlertFiringRecord = typeof alertFirings.$inferSelect;
+
+export interface NotificationChannelRow {
+  id: number;
+  user_id: string;
+  name: string;
+  type: string;
+  config: string;
+  enabled: number;
+  created_at: string;
+}
+
+export interface AlertRuleRow {
+  id: number;
+  user_id: string;
+  host_id: number | null;
+  name: string;
+  enabled: number;
+  trigger_type: string;
+  threshold_value: number | null;
+  threshold_duration_seconds: number | null;
+  cooldown_minutes: number;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface AlertRuleWithChannelsRow extends AlertRuleRow {
+  channels: number[];
+}
+
+export interface AlertFiringRow {
+  id: number;
+  user_id: string;
+  rule_id: number;
+  host_id: number;
+  host_name: string;
+  fired_at: string;
+  resolved_at: string | null;
+  value: number | null;
+  message: string;
+  severity: string;
+  acknowledged: number;
+  rule_name: string | null;
+}
+
+export interface AlertEngineRule {
+  id: number;
+  userId: string;
+  hostId: number | null;
+  name: string;
+  enabled: boolean;
+  triggerType: string;
+  thresholdValue: number | null;
+  thresholdDurationSeconds: number | null;
+  cooldownMinutes: number;
+}
+
+export interface AlertEngineChannel {
+  id: number;
+  type: string;
+  config: string;
+  enabled: boolean;
+}
+
+export class AlertRepository {
+  constructor(
+    private readonly context: DatabaseContext,
+    private readonly onWrite?: () => void | Promise<void>,
+  ) {}
+
+  async listNotificationChannels(
+    userId: string,
+  ): Promise<NotificationChannelRow[]> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(notificationChannels)
+      .where(eq(notificationChannels.userId, userId))
+      .orderBy(notificationChannels.id);
+
+    return rows.map(mapChannelRow);
+  }
+
+  async findNotificationChannelForUser(
+    id: number,
+    userId: string,
+  ): Promise<NotificationChannelRow | null> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(notificationChannels)
+      .where(
+        and(
+          eq(notificationChannels.id, id),
+          eq(notificationChannels.userId, userId),
+        ),
+      )
+      .limit(1);
+
+    return rows[0] ? mapChannelRow(rows[0]) : null;
+  }
+
+  async createNotificationChannel(input: {
+    userId: string;
+    name: string;
+    type: string;
+    config: string;
+    enabled: boolean;
+  }): Promise<NotificationChannelRow> {
+    const [created] = await this.context.drizzle
+      .insert(notificationChannels)
+      .values({
+        userId: input.userId,
+        name: input.name,
+        type: input.type,
+        config: input.config,
+        enabled: input.enabled,
+      })
+      .returning();
+
+    await this.afterWrite();
+    return mapChannelRow(created);
+  }
+
+  async updateNotificationChannel(
+    id: number,
+    userId: string,
+    input: {
+      name?: string;
+      type?: string;
+      config?: string;
+      enabled?: boolean;
+    },
+  ): Promise<NotificationChannelRow | null> {
+    if (Object.keys(input).length === 0) {
+      return this.findNotificationChannelForUser(id, userId);
+    }
+
+    const [updated] = await this.context.drizzle
+      .update(notificationChannels)
+      .set(input)
+      .where(
+        and(
+          eq(notificationChannels.id, id),
+          eq(notificationChannels.userId, userId),
+        ),
+      )
+      .returning();
+
+    if (!updated) return null;
+    await this.afterWrite();
+    return mapChannelRow(updated);
+  }
+
+  async deleteNotificationChannel(
+    id: number,
+    userId: string,
+  ): Promise<boolean> {
+    const deleted = await this.context.drizzle
+      .delete(notificationChannels)
+      .where(
+        and(
+          eq(notificationChannels.id, id),
+          eq(notificationChannels.userId, userId),
+        ),
+      )
+      .returning({ id: notificationChannels.id });
+
+    if (deleted.length === 0) return false;
+    await this.afterWrite();
+    return true;
+  }
+
+  async listAlertRules(userId: string): Promise<AlertRuleWithChannelsRow[]> {
+    const rules = await this.context.drizzle
+      .select()
+      .from(alertRules)
+      .where(eq(alertRules.userId, userId))
+      .orderBy(alertRules.id);
+
+    const result: AlertRuleWithChannelsRow[] = [];
+    for (const rule of rules) {
+      result.push({
+        ...mapRuleRow(rule),
+        channels: await this.listChannelIdsForRule(rule.id),
+      });
+    }
+    return result;
+  }
+
+  async createAlertRule(input: {
+    userId: string;
+    hostId: number | null;
+    name: string;
+    enabled: boolean;
+    triggerType: string;
+    thresholdValue: number | null;
+    thresholdDurationSeconds: number | null;
+    cooldownMinutes: number;
+    channels: number[];
+    now: string;
+  }): Promise<AlertRuleWithChannelsRow> {
+    const [created] = await this.context.drizzle
+      .insert(alertRules)
+      .values({
+        userId: input.userId,
+        hostId: input.hostId,
+        name: input.name,
+        enabled: input.enabled,
+        triggerType: input.triggerType,
+        thresholdValue: input.thresholdValue,
+        thresholdDurationSeconds: input.thresholdDurationSeconds,
+        cooldownMinutes: input.cooldownMinutes,
+        createdAt: input.now,
+        updatedAt: input.now,
+      })
+      .returning();
+
+    const channels = await this.replaceRuleChannels(
+      created.id,
+      input.userId,
+      input.channels,
+    );
+    await this.afterWrite();
+    return { ...mapRuleRow(created), channels };
+  }
+
+  async findAlertRuleForUser(
+    id: number,
+    userId: string,
+  ): Promise<AlertRuleRow | null> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(alertRules)
+      .where(and(eq(alertRules.id, id), eq(alertRules.userId, userId)))
+      .limit(1);
+
+    return rows[0] ? mapRuleRow(rows[0]) : null;
+  }
+
+  async updateAlertRule(
+    id: number,
+    userId: string,
+    input: {
+      name?: string;
+      hostId?: number | null;
+      enabled?: boolean;
+      triggerType?: string;
+      thresholdValue?: number | null;
+      thresholdDurationSeconds?: number | null;
+      cooldownMinutes?: number;
+      channels?: number[];
+      now: string;
+    },
+  ): Promise<AlertRuleWithChannelsRow | null> {
+    const [updated] = await this.context.drizzle
+      .update(alertRules)
+      .set({
+        ...(input.name !== undefined ? { name: input.name } : {}),
+        ...(input.hostId !== undefined ? { hostId: input.hostId } : {}),
+        ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
+        ...(input.triggerType !== undefined
+          ? { triggerType: input.triggerType }
+          : {}),
+        ...(input.thresholdValue !== undefined
+          ? { thresholdValue: input.thresholdValue }
+          : {}),
+        ...(input.thresholdDurationSeconds !== undefined
+          ? { thresholdDurationSeconds: input.thresholdDurationSeconds }
+          : {}),
+        ...(input.cooldownMinutes !== undefined
+          ? { cooldownMinutes: input.cooldownMinutes }
+          : {}),
+        updatedAt: input.now,
+      })
+      .where(and(eq(alertRules.id, id), eq(alertRules.userId, userId)))
+      .returning();
+
+    if (!updated) return null;
+
+    const channels =
+      input.channels === undefined
+        ? await this.listChannelIdsForRule(id)
+        : await this.replaceRuleChannels(id, userId, input.channels);
+
+    await this.afterWrite();
+    return { ...mapRuleRow(updated), channels };
+  }
+
+  async deleteAlertRule(id: number, userId: string): Promise<boolean> {
+    const deleted = await this.context.drizzle
+      .delete(alertRules)
+      .where(and(eq(alertRules.id, id), eq(alertRules.userId, userId)))
+      .returning({ id: alertRules.id });
+
+    if (deleted.length === 0) return false;
+    await this.afterWrite();
+    return true;
+  }
+
+  async listAlertFirings(input: {
+    userId: string;
+    acknowledged?: boolean;
+    limit: number;
+    offset: number;
+  }): Promise<{ firings: AlertFiringRow[]; total: number }> {
+    const filters = [eq(alertFirings.userId, input.userId)];
+    if (input.acknowledged !== undefined) {
+      filters.push(eq(alertFirings.acknowledged, input.acknowledged));
+    }
+
+    const where = and(...filters);
+    const rows = await this.context.drizzle
+      .select({
+        firing: alertFirings,
+        ruleName: alertRules.name,
+      })
+      .from(alertFirings)
+      .leftJoin(alertRules, eq(alertRules.id, alertFirings.ruleId))
+      .where(where)
+      .orderBy(desc(alertFirings.firedAt))
+      .limit(input.limit)
+      .offset(input.offset);
+
+    const totalRows = await this.context.drizzle
+      .select({ total: count() })
+      .from(alertFirings)
+      .where(where);
+
+    return {
+      firings: rows.map((row) => mapFiringRow(row.firing, row.ruleName)),
+      total: totalRows[0]?.total ?? 0,
+    };
+  }
+
+  async acknowledgeFiring(id: number, userId: string): Promise<void> {
+    await this.context.drizzle
+      .update(alertFirings)
+      .set({ acknowledged: true })
+      .where(and(eq(alertFirings.id, id), eq(alertFirings.userId, userId)));
+    await this.afterWrite();
+  }
+
+  async acknowledgeAllFirings(userId: string): Promise<void> {
+    await this.context.drizzle
+      .update(alertFirings)
+      .set({ acknowledged: true })
+      .where(eq(alertFirings.userId, userId));
+    await this.afterWrite();
+  }
+
+  async listEnabledRulesForHost(hostId: number): Promise<AlertEngineRule[]> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(alertRules)
+      .where(
+        and(
+          eq(alertRules.enabled, true),
+          or(eq(alertRules.hostId, hostId), isNull(alertRules.hostId)),
+        ),
+      );
+    return rows.map(mapEngineRule);
+  }
+
+  async listEnabledRulesForHostUser(
+    hostId: number,
+    userId: string,
+  ): Promise<AlertEngineRule[]> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(alertRules)
+      .where(
+        and(
+          eq(alertRules.enabled, true),
+          eq(alertRules.userId, userId),
+          or(eq(alertRules.hostId, hostId), isNull(alertRules.hostId)),
+        ),
+      );
+    return rows.map(mapEngineRule);
+  }
+
+  async findRuleById(id: number): Promise<AlertEngineRule | null> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(alertRules)
+      .where(eq(alertRules.id, id))
+      .limit(1);
+    return rows[0] ? mapEngineRule(rows[0]) : null;
+  }
+
+  async createFiring(input: {
+    userId: string;
+    ruleId: number;
+    hostId: number;
+    hostName: string;
+    value: number | null;
+    message: string;
+    severity: string;
+  }): Promise<void> {
+    await this.context.drizzle.insert(alertFirings).values(input);
+    await this.afterWrite();
+  }
+
+  pruneFiringsOlderThan(userId: string, days: number): void {
+    this.context.sqlite
+      ?.prepare(
+        "DELETE FROM alert_firings WHERE user_id = ? AND fired_at < datetime('now', ?)",
+      )
+      .run(userId, `-${days} days`);
+  }
+
+  async deleteByUserId(userId: string): Promise<{
+    firingsDeleted: number;
+    ruleLinksDeleted: number;
+    rulesDeleted: number;
+    channelsDeleted: number;
+  }> {
+    const ruleIds = (
+      await this.context.drizzle
+        .select({ id: alertRules.id })
+        .from(alertRules)
+        .where(eq(alertRules.userId, userId))
+    ).map((row) => row.id);
+    const channelIds = (
+      await this.context.drizzle
+        .select({ id: notificationChannels.id })
+        .from(notificationChannels)
+        .where(eq(notificationChannels.userId, userId))
+    ).map((row) => row.id);
+
+    const firingRows = await this.context.drizzle
+      .delete(alertFirings)
+      .where(eq(alertFirings.userId, userId))
+      .returning({ id: alertFirings.id });
+
+    const linkFilters = [
+      ...(ruleIds.length > 0
+        ? [inArray(alertRuleChannels.ruleId, ruleIds)]
+        : []),
+      ...(channelIds.length > 0
+        ? [inArray(alertRuleChannels.channelId, channelIds)]
+        : []),
+    ];
+    const linkRows =
+      linkFilters.length === 0
+        ? []
+        : await this.context.drizzle
+            .delete(alertRuleChannels)
+            .where(or(...linkFilters))
+            .returning({ id: alertRuleChannels.id });
+
+    const ruleRows = await this.context.drizzle
+      .delete(alertRules)
+      .where(eq(alertRules.userId, userId))
+      .returning({ id: alertRules.id });
+    const channelRows = await this.context.drizzle
+      .delete(notificationChannels)
+      .where(eq(notificationChannels.userId, userId))
+      .returning({ id: notificationChannels.id });
+
+    if (
+      firingRows.length > 0 ||
+      linkRows.length > 0 ||
+      ruleRows.length > 0 ||
+      channelRows.length > 0
+    ) {
+      await this.afterWrite();
+    }
+
+    return {
+      firingsDeleted: firingRows.length,
+      ruleLinksDeleted: linkRows.length,
+      rulesDeleted: ruleRows.length,
+      channelsDeleted: channelRows.length,
+    };
+  }
+
+  async listEnabledChannelsForRule(
+    ruleId: number,
+  ): Promise<AlertEngineChannel[]> {
+    const rows = await this.context.drizzle
+      .select({
+        id: notificationChannels.id,
+        type: notificationChannels.type,
+        config: notificationChannels.config,
+        enabled: notificationChannels.enabled,
+      })
+      .from(notificationChannels)
+      .innerJoin(
+        alertRuleChannels,
+        eq(alertRuleChannels.channelId, notificationChannels.id),
+      )
+      .where(
+        and(
+          eq(alertRuleChannels.ruleId, ruleId),
+          eq(notificationChannels.enabled, true),
+        ),
+      );
+
+    return rows;
+  }
+
+  async getHostDisplayName(hostId: number): Promise<string | null> {
+    const rows = await this.context.drizzle
+      .select({ name: hosts.name, ip: hosts.ip })
+      .from(hosts)
+      .where(eq(hosts.id, hostId))
+      .limit(1);
+
+    const row = rows[0];
+    return row ? row.name || row.ip : null;
+  }
+
+  private async replaceRuleChannels(
+    ruleId: number,
+    userId: string,
+    channelIds: number[],
+  ): Promise<number[]> {
+    await this.context.drizzle
+      .delete(alertRuleChannels)
+      .where(eq(alertRuleChannels.ruleId, ruleId));
+
+    const linked: number[] = [];
+    for (const channelId of channelIds) {
+      const channel = await this.findNotificationChannelForUser(
+        channelId,
+        userId,
+      );
+      if (!channel) continue;
+      await this.context.drizzle
+        .insert(alertRuleChannels)
+        .values({ ruleId, channelId });
+      linked.push(channelId);
+    }
+    return linked;
+  }
+
+  private async listChannelIdsForRule(ruleId: number): Promise<number[]> {
+    const rows = await this.context.drizzle
+      .select({ channelId: alertRuleChannels.channelId })
+      .from(alertRuleChannels)
+      .where(eq(alertRuleChannels.ruleId, ruleId));
+
+    return rows.map((row) => row.channelId);
+  }
+
+  private async afterWrite(): Promise<void> {
+    await this.onWrite?.();
+  }
+}
+
+function mapChannelRow(row: NotificationChannelRecord): NotificationChannelRow {
+  return {
+    id: row.id,
+    user_id: row.userId,
+    name: row.name,
+    type: row.type,
+    config: row.config,
+    enabled: row.enabled ? 1 : 0,
+    created_at: row.createdAt,
+  };
+}
+
+function mapRuleRow(row: AlertRuleRecord): AlertRuleRow {
+  return {
+    id: row.id,
+    user_id: row.userId,
+    host_id: row.hostId,
+    name: row.name,
+    enabled: row.enabled ? 1 : 0,
+    trigger_type: row.triggerType,
+    threshold_value: row.thresholdValue,
+    threshold_duration_seconds: row.thresholdDurationSeconds,
+    cooldown_minutes: row.cooldownMinutes,
+    created_at: row.createdAt,
+    updated_at: row.updatedAt,
+  };
+}
+
+function mapFiringRow(
+  row: AlertFiringRecord,
+  ruleName: string | null,
+): AlertFiringRow {
+  return {
+    id: row.id,
+    user_id: row.userId,
+    rule_id: row.ruleId,
+    host_id: row.hostId,
+    host_name: row.hostName,
+    fired_at: row.firedAt,
+    resolved_at: row.resolvedAt,
+    value: row.value,
+    message: row.message,
+    severity: row.severity,
+    acknowledged: row.acknowledged ? 1 : 0,
+    rule_name: ruleName,
+  };
+}
+
+function mapEngineRule(row: AlertRuleRecord): AlertEngineRule {
+  return {
+    id: row.id,
+    userId: row.userId,
+    hostId: row.hostId,
+    name: row.name,
+    enabled: row.enabled,
+    triggerType: row.triggerType,
+    thresholdValue: row.thresholdValue,
+    thresholdDurationSeconds: row.thresholdDurationSeconds,
+    cooldownMinutes: row.cooldownMinutes,
+  };
+}
@@ -0,0 +1,149 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { SqliteDatabaseAdapter } from "../runtime/sqlite-adapter.js";
+import { ApiKeyRepository } from "./api-key-repository.js";
+
+describe("ApiKeyRepository", () => {
+  let adapter: SqliteDatabaseAdapter | null = null;
+
+  afterEach(async () => {
+    if (adapter) {
+      await adapter.close();
+      adapter = null;
+    }
+  });
+
+  async function createRepository(onWrite?: () => void): Promise<{
+    apiKeys: ApiKeyRepository;
+  }> {
+    adapter = new SqliteDatabaseAdapter({
+      dialect: "sqlite",
+      url: ":memory:",
+      sqlitePath: ":memory:",
+    });
+    const context = await adapter.connect();
+    context.sqlite?.exec(`
+      CREATE TABLE users (
+        id TEXT PRIMARY KEY,
+        username TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        is_admin INTEGER NOT NULL DEFAULT 0,
+        is_oidc INTEGER NOT NULL DEFAULT 0
+      );
+
+      CREATE TABLE api_keys (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        token_hash TEXT NOT NULL,
+        token_prefix TEXT NOT NULL,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        expires_at TEXT,
+        last_used_at TEXT,
+        is_active INTEGER NOT NULL DEFAULT 1,
+        FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+      );
+
+      INSERT INTO users (id, username, password_hash) VALUES
+        ('user-1', 'admin', 'hash'),
+        ('user-2', 'target', 'hash');
+    `);
+
+    return {
+      apiKeys: new ApiKeyRepository(context, onWrite),
+    };
+  }
+
+  it("creates, lists, finds, updates last used time, and deletes keys", async () => {
+    const repo = await createRepository();
+
+    await repo.apiKeys.create({
+      id: "key-1",
+      userId: "user-2",
+      name: "deploy",
+      tokenHash: "hash",
+      tokenPrefix: "tmx_12345678",
+      createdAt: "2026-06-26T00:00:00.000Z",
+      expiresAt: null,
+      lastUsedAt: null,
+      isActive: true,
+    });
+
+    expect((await repo.apiKeys.findById("key-1"))?.name).toBe("deploy");
+    expect(
+      (await repo.apiKeys.listActiveByTokenPrefix("tmx_12345678")).map(
+        (key) => key.id,
+      ),
+    ).toEqual(["key-1"]);
+    expect(await repo.apiKeys.listAllWithUsers()).toMatchObject([
+      {
+        id: "key-1",
+        userId: "user-2",
+        username: "target",
+        tokenPrefix: "tmx_12345678",
+      },
+    ]);
+
+    await repo.apiKeys.updateLastUsedAt("key-1", "2026-06-26T01:00:00.000Z");
+    expect((await repo.apiKeys.findById("key-1"))?.lastUsedAt).toBe(
+      "2026-06-26T01:00:00.000Z",
+    );
+
+    expect((await repo.apiKeys.delete("key-1"))?.name).toBe("deploy");
+    expect(await repo.apiKeys.findById("key-1")).toBeNull();
+  });
+
+  it("runs the write hook after key writes", async () => {
+    let writeCount = 0;
+    const repo = await createRepository(() => {
+      writeCount += 1;
+    });
+
+    await repo.apiKeys.create({
+      id: "key-1",
+      userId: "user-1",
+      name: "ops",
+      tokenHash: "hash",
+      tokenPrefix: "tmx_87654321",
+      isActive: true,
+    });
+    await repo.apiKeys.updateLastUsedAt("key-1", "2026-06-26T01:00:00.000Z");
+    await repo.apiKeys.delete("key-1");
+
+    expect(writeCount).toBe(3);
+  });
+
+  it("deletes all API keys for a user", async () => {
+    const repo = await createRepository();
+
+    await repo.apiKeys.create({
+      id: "key-1",
+      userId: "user-2",
+      name: "deploy",
+      tokenHash: "hash-1",
+      tokenPrefix: "tmx_11111111",
+      isActive: true,
+    });
+    await repo.apiKeys.create({
+      id: "key-2",
+      userId: "user-2",
+      name: "ops",
+      tokenHash: "hash-2",
+      tokenPrefix: "tmx_22222222",
+      isActive: true,
+    });
+    await repo.apiKeys.create({
+      id: "key-3",
+      userId: "user-1",
+      name: "admin",
+      tokenHash: "hash-3",
+      tokenPrefix: "tmx_33333333",
+      isActive: true,
+    });
+
+    await expect(repo.apiKeys.deleteByUserId("user-2")).resolves.toBe(2);
+
+    expect(await repo.apiKeys.findById("key-1")).toBeNull();
+    expect(await repo.apiKeys.findById("key-2")).toBeNull();
+    expect((await repo.apiKeys.findById("key-3"))?.userId).toBe("user-1");
+  });
+});
@@ -0,0 +1,103 @@
+import { eq, and } from "drizzle-orm";
+import { apiKeys, users } from "../db/schema.js";
+import type { DatabaseContext } from "../runtime/adapter.js";
+
+export type ApiKeyRecord = typeof apiKeys.$inferSelect;
+export type NewApiKeyRecord = typeof apiKeys.$inferInsert;
+
+export interface ApiKeyListRecord {
+  id: string;
+  name: string;
+  userId: string;
+  username: string | null;
+  tokenPrefix: string;
+  createdAt: string;
+  expiresAt: string | null;
+  lastUsedAt: string | null;
+  isActive: boolean;
+}
+
+export class ApiKeyRepository {
+  constructor(
+    private readonly context: DatabaseContext,
+    private readonly onWrite?: () => void | Promise<void>,
+  ) {}
+
+  async create(apiKey: NewApiKeyRecord): Promise<ApiKeyRecord> {
+    const rows = await this.context.drizzle
+      .insert(apiKeys)
+      .values(apiKey)
+      .returning();
+    await this.afterWrite();
+    return rows[0];
+  }
+
+  async listAllWithUsers(): Promise<ApiKeyListRecord[]> {
+    return this.context.drizzle
+      .select({
+        id: apiKeys.id,
+        name: apiKeys.name,
+        userId: apiKeys.userId,
+        username: users.username,
+        tokenPrefix: apiKeys.tokenPrefix,
+        createdAt: apiKeys.createdAt,
+        expiresAt: apiKeys.expiresAt,
+        lastUsedAt: apiKeys.lastUsedAt,
+        isActive: apiKeys.isActive,
+      })
+      .from(apiKeys)
+      .leftJoin(users, eq(apiKeys.userId, users.id))
+      .orderBy(apiKeys.createdAt);
+  }
+
+  async findById(id: string): Promise<ApiKeyRecord | null> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(apiKeys)
+      .where(eq(apiKeys.id, id))
+      .limit(1);
+
+    return rows[0] ?? null;
+  }
+
+  async listActiveByTokenPrefix(tokenPrefix: string): Promise<ApiKeyRecord[]> {
+    return this.context.drizzle
+      .select()
+      .from(apiKeys)
+      .where(
+        and(eq(apiKeys.tokenPrefix, tokenPrefix), eq(apiKeys.isActive, true)),
+      );
+  }
+
+  async updateLastUsedAt(id: string, lastUsedAt: string): Promise<void> {
+    await this.context.drizzle
+      .update(apiKeys)
+      .set({ lastUsedAt })
+      .where(eq(apiKeys.id, id));
+    await this.afterWrite();
+  }
+
+  async delete(id: string): Promise<ApiKeyRecord | null> {
+    const rows = await this.context.drizzle
+      .delete(apiKeys)
+      .where(eq(apiKeys.id, id))
+      .returning();
+
+    await this.afterWrite();
+    return rows[0] ?? null;
+  }
+
+  async deleteByUserId(userId: string): Promise<number> {
+    const rows = await this.context.drizzle
+      .delete(apiKeys)
+      .where(eq(apiKeys.userId, userId))
+      .returning({ id: apiKeys.id });
+
+    await this.afterWrite();
+    return rows.length;
+  }
+
+  private async afterWrite(): Promise<void> {
+    await this.onWrite?.();
+  }
+}
@@ -0,0 +1,136 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { SqliteDatabaseAdapter } from "../runtime/sqlite-adapter.js";
+import { AuditLogRepository } from "./audit-log-repository.js";
+
+describe("AuditLogRepository", () => {
+  let adapter: SqliteDatabaseAdapter | null = null;
+
+  afterEach(async () => {
+    if (adapter) {
+      await adapter.close();
+      adapter = null;
+    }
+  });
+
+  async function createRepository(
+    onWrite?: () => void | Promise<void>,
+  ): Promise<AuditLogRepository> {
+    adapter = new SqliteDatabaseAdapter({
+      dialect: "sqlite",
+      url: ":memory:",
+      sqlitePath: ":memory:",
+    });
+    const context = await adapter.connect();
+    context.sqlite?.exec(`
+      CREATE TABLE users (
+        id TEXT PRIMARY KEY,
+        username TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        is_admin INTEGER NOT NULL DEFAULT 0,
+        is_oidc INTEGER NOT NULL DEFAULT 0
+      );
+
+      CREATE TABLE audit_logs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id TEXT NOT NULL,
+        username TEXT NOT NULL,
+        action TEXT NOT NULL,
+        resource_type TEXT NOT NULL,
+        resource_id TEXT,
+        resource_name TEXT,
+        details TEXT,
+        ip_address TEXT,
+        user_agent TEXT,
+        success INTEGER NOT NULL,
+        error_message TEXT,
+        timestamp TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      INSERT INTO users (id, username, password_hash)
+      VALUES ('user-1', 'alice', 'hash'), ('user-2', 'bob', 'hash');
+    `);
+
+    return new AuditLogRepository(context, onWrite);
+  }
+
+  it("creates, filters, pages, and lists actions", async () => {
+    const repo = await createRepository();
+
+    await repo.create({
+      userId: "user-1",
+      username: "alice",
+      action: "create_host",
+      resourceType: "host",
+      resourceId: "1",
+      success: true,
+      timestamp: "2026-06-27T00:00:00.000Z",
+    });
+    await repo.create({
+      userId: "user-2",
+      username: "bob",
+      action: "delete_host",
+      resourceType: "host",
+      resourceId: "2",
+      success: false,
+      timestamp: "2026-06-27T01:00:00.000Z",
+    });
+
+    const page = await repo.listPage({
+      filters: {
+        resourceType: "host",
+        success: false,
+        startDate: "2026-06-27T00:30:00.000Z",
+      },
+      limit: 10,
+      offset: 0,
+    });
+
+    expect(page.total).toBe(1);
+    expect(page.logs[0]).toMatchObject({
+      userId: "user-2",
+      action: "delete_host",
+      success: false,
+    });
+    expect(await repo.listDistinctActions()).toEqual([
+      "create_host",
+      "delete_host",
+    ]);
+  });
+
+  it("deletes logs by user id and only runs write hook for deleted rows", async () => {
+    let writeCount = 0;
+    const repo = await createRepository(() => {
+      writeCount += 1;
+    });
+
+    await repo.create({
+      userId: "user-1",
+      username: "alice",
+      action: "login",
+      resourceType: "auth",
+      success: true,
+    });
+    await repo.create({
+      userId: "user-2",
+      username: "bob",
+      action: "login",
+      resourceType: "auth",
+      success: true,
+    });
+
+    expect(await repo.deleteByUserId("missing")).toBe(0);
+    expect(writeCount).toBe(2);
+
+    expect(await repo.deleteByUserId("user-1")).toBe(1);
+    expect(writeCount).toBe(3);
+    expect(
+      (
+        await repo.listPage({
+          filters: {},
+          limit: 10,
+          offset: 0,
+        })
+      ).logs.map((log) => log.userId),
+    ).toEqual(["user-2"]);
+  });
+});
@@ -0,0 +1,135 @@
+import { and, asc, desc, eq, gte, inArray, lte, sql } from "drizzle-orm";
+import { auditLogs } from "../db/schema.js";
+import type { DatabaseContext } from "../runtime/adapter.js";
+
+export type AuditLogRecord = typeof auditLogs.$inferSelect;
+export type NewAuditLogRecord = typeof auditLogs.$inferInsert;
+
+export type AuditLogFilters = {
+  userId?: string;
+  action?: string;
+  resourceType?: string;
+  success?: boolean;
+  startDate?: string;
+  endDate?: string;
+};
+
+export type AuditLogPage = {
+  logs: AuditLogRecord[];
+  total: number;
+};
+
+const PRUNE_MAX = 10000;
+const PRUNE_TARGET = 9000;
+
+export class AuditLogRepository {
+  constructor(
+    private readonly context: DatabaseContext,
+    private readonly onWrite?: () => void | Promise<void>,
+  ) {}
+
+  async create(entry: NewAuditLogRecord): Promise<void> {
+    await this.context.drizzle.insert(auditLogs).values(entry);
+    await this.pruneIfNeeded();
+    await this.afterWrite();
+  }
+
+  async listPage(input: {
+    filters: AuditLogFilters;
+    limit: number;
+    offset: number;
+  }): Promise<AuditLogPage> {
+    const whereClause = this.buildWhere(input.filters);
+
+    const [logs, totalResult] = await Promise.all([
+      this.context.drizzle
+        .select()
+        .from(auditLogs)
+        .where(whereClause)
+        .orderBy(desc(auditLogs.timestamp))
+        .limit(input.limit)
+        .offset(input.offset),
+      this.context.drizzle
+        .select({ count: sql<number>`COUNT(*)` })
+        .from(auditLogs)
+        .where(whereClause),
+    ]);
+
+    return {
+      logs,
+      total: totalResult[0]?.count ?? 0,
+    };
+  }
+
+  async listDistinctActions(): Promise<string[]> {
+    const rows = await this.context.drizzle
+      .selectDistinct({ action: auditLogs.action })
+      .from(auditLogs)
+      .orderBy(asc(auditLogs.action));
+
+    return rows.map((row) => row.action);
+  }
+
+  async deleteByUserId(userId: string): Promise<number> {
+    const rows = await this.context.drizzle
+      .delete(auditLogs)
+      .where(eq(auditLogs.userId, userId))
+      .returning({ id: auditLogs.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  private buildWhere(filters: AuditLogFilters) {
+    const conditions = [];
+
+    if (filters.userId) conditions.push(eq(auditLogs.userId, filters.userId));
+    if (filters.action) conditions.push(eq(auditLogs.action, filters.action));
+    if (filters.resourceType) {
+      conditions.push(eq(auditLogs.resourceType, filters.resourceType));
+    }
+    if (filters.success !== undefined) {
+      conditions.push(eq(auditLogs.success, filters.success));
+    }
+    if (filters.startDate) {
+      conditions.push(gte(auditLogs.timestamp, filters.startDate));
+    }
+    if (filters.endDate) {
+      conditions.push(lte(auditLogs.timestamp, filters.endDate));
+    }
+
+    return conditions.length > 0 ? and(...conditions) : undefined;
+  }
+
+  private async pruneIfNeeded(): Promise<void> {
+    const countResult = await this.context.drizzle
+      .select({ count: sql<number>`COUNT(*)` })
+      .from(auditLogs);
+    const count = countResult[0]?.count ?? 0;
+
+    if (count < PRUNE_MAX) {
+      return;
+    }
+
+    const deleteCount = count - PRUNE_TARGET;
+    const rows = await this.context.drizzle
+      .select({ id: auditLogs.id })
+      .from(auditLogs)
+      .orderBy(asc(auditLogs.timestamp))
+      .limit(deleteCount);
+    const ids = rows.map((row) => row.id);
+
+    if (ids.length > 0) {
+      await this.context.drizzle
+        .delete(auditLogs)
+        .where(inArray(auditLogs.id, ids));
+    }
+  }
+
+  private async afterWrite(): Promise<void> {
+    await this.onWrite?.();
+  }
+}
@@ -0,0 +1,126 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { SqliteDatabaseAdapter } from "../runtime/sqlite-adapter.js";
+import { C2sTunnelPresetRepository } from "./c2s-tunnel-preset-repository.js";
+
+describe("C2sTunnelPresetRepository", () => {
+  let adapter: SqliteDatabaseAdapter | null = null;
+
+  afterEach(async () => {
+    if (adapter) {
+      await adapter.close();
+      adapter = null;
+    }
+  });
+
+  async function createRepository(
+    onWrite?: () => void | Promise<void>,
+  ): Promise<C2sTunnelPresetRepository> {
+    adapter = new SqliteDatabaseAdapter({
+      dialect: "sqlite",
+      url: ":memory:",
+      sqlitePath: ":memory:",
+    });
+    const context = await adapter.connect();
+    context.sqlite?.exec(`
+      CREATE TABLE users (
+        id TEXT PRIMARY KEY,
+        username TEXT NOT NULL,
+        password_hash TEXT NOT NULL
+      );
+
+      CREATE TABLE c2s_tunnel_presets (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        config TEXT NOT NULL,
+        platform TEXT,
+        computer_name TEXT,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      INSERT INTO users (id, username, password_hash)
+      VALUES ('user-1', 'alice', 'hash'), ('user-2', 'bob', 'hash');
+    `);
+
+    return new C2sTunnelPresetRepository(context, onWrite);
+  }
+
+  it("creates and lists presets ordered by name", async () => {
+    const repo = await createRepository();
+
+    await repo.createForUser("user-1", {
+      name: "Zulu",
+      config: "[]",
+      platform: "linux",
+      computerName: "workstation",
+    });
+    await repo.createForUser("user-1", { name: "Alpha", config: "[]" });
+    await repo.createForUser("user-2", { name: "Other", config: "[]" });
+
+    const presets = await repo.listByUserId("user-1");
+
+    expect(presets.map((preset) => preset.name)).toEqual(["Alpha", "Zulu"]);
+    expect(presets[1]).toMatchObject({
+      platform: "linux",
+      computerName: "workstation",
+    });
+  });
+
+  it("finds, updates, and deletes user-owned presets", async () => {
+    let writeCount = 0;
+    const repo = await createRepository(() => {
+      writeCount += 1;
+    });
+
+    const preset = await repo.createForUser("user-1", {
+      name: "Home",
+      config: "[]",
+    });
+    expect(writeCount).toBe(1);
+
+    expect(await repo.findByIdForUser("user-2", preset.id)).toBeNull();
+    expect(await repo.hasNameForUser("user-1", "Home")).toBe(true);
+    expect(await repo.hasNameForUser("user-1", "Home", preset.id)).toBe(false);
+
+    const updated = await repo.updateForUser("user-1", preset.id, {
+      name: "Renamed",
+      platform: "darwin",
+    });
+    expect(updated).toMatchObject({
+      id: preset.id,
+      name: "Renamed",
+      platform: "darwin",
+    });
+    expect(writeCount).toBe(2);
+
+    expect(
+      await repo.updateForUser("user-2", preset.id, { name: "Nope" }),
+    ).toBeNull();
+    expect(writeCount).toBe(2);
+
+    expect(await repo.deleteForUser("user-2", preset.id)).toBe(false);
+    expect(await repo.deleteForUser("user-1", preset.id)).toBe(true);
+    expect(writeCount).toBe(3);
+  });
+
+  it("deletes all presets for a user", async () => {
+    let writeCount = 0;
+    const repo = await createRepository(() => {
+      writeCount += 1;
+    });
+
+    await repo.createForUser("user-1", { name: "One", config: "[]" });
+    await repo.createForUser("user-1", { name: "Two", config: "[]" });
+    await repo.createForUser("user-2", { name: "Other", config: "[]" });
+
+    await expect(repo.deleteByUserId("user-1")).resolves.toBe(2);
+    await expect(repo.deleteByUserId("missing")).resolves.toBe(0);
+
+    expect(await repo.listByUserId("user-1")).toEqual([]);
+    expect(
+      (await repo.listByUserId("user-2")).map((preset) => preset.name),
+    ).toEqual(["Other"]);
+    expect(writeCount).toBe(4);
+  });
+});
@@ -0,0 +1,136 @@
+import { and, asc, eq, sql } from "drizzle-orm";
+import { c2sTunnelPresets } from "../db/schema.js";
+import type { DatabaseContext } from "../runtime/adapter.js";
+
+export type C2sTunnelPresetRecord = typeof c2sTunnelPresets.$inferSelect;
+
+export interface C2sTunnelPresetCreateInput {
+  name: string;
+  config: string;
+  platform?: string | null;
+  computerName?: string | null;
+}
+
+export type C2sTunnelPresetUpdateInput = Partial<C2sTunnelPresetCreateInput>;
+
+export class C2sTunnelPresetRepository {
+  constructor(
+    private readonly context: DatabaseContext,
+    private readonly onWrite?: () => void | Promise<void>,
+  ) {}
+
+  async listByUserId(userId: string): Promise<C2sTunnelPresetRecord[]> {
+    return this.context.drizzle
+      .select()
+      .from(c2sTunnelPresets)
+      .where(eq(c2sTunnelPresets.userId, userId))
+      .orderBy(asc(c2sTunnelPresets.name));
+  }
+
+  async findByIdForUser(
+    userId: string,
+    id: number,
+  ): Promise<C2sTunnelPresetRecord | null> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(c2sTunnelPresets)
+      .where(
+        and(eq(c2sTunnelPresets.id, id), eq(c2sTunnelPresets.userId, userId)),
+      )
+      .limit(1);
+
+    return rows[0] ?? null;
+  }
+
+  async hasNameForUser(
+    userId: string,
+    name: string,
+    excludingId?: number,
+  ): Promise<boolean> {
+    const rows = await this.context.drizzle
+      .select({ id: c2sTunnelPresets.id })
+      .from(c2sTunnelPresets)
+      .where(
+        and(
+          eq(c2sTunnelPresets.userId, userId),
+          eq(c2sTunnelPresets.name, name),
+        ),
+      );
+
+    return rows.some((row) => row.id !== excludingId);
+  }
+
+  async createForUser(
+    userId: string,
+    input: C2sTunnelPresetCreateInput,
+  ): Promise<C2sTunnelPresetRecord> {
+    const [created] = await this.context.drizzle
+      .insert(c2sTunnelPresets)
+      .values({
+        userId,
+        name: input.name,
+        config: input.config,
+        platform: input.platform ?? null,
+        computerName: input.computerName ?? null,
+      })
+      .returning();
+
+    await this.afterWrite();
+    return created;
+  }
+
+  async updateForUser(
+    userId: string,
+    id: number,
+    updates: C2sTunnelPresetUpdateInput,
+  ): Promise<C2sTunnelPresetRecord | null> {
+    const [updated] = await this.context.drizzle
+      .update(c2sTunnelPresets)
+      .set({
+        ...updates,
+        updatedAt: sql`CURRENT_TIMESTAMP`,
+      })
+      .where(
+        and(eq(c2sTunnelPresets.id, id), eq(c2sTunnelPresets.userId, userId)),
+      )
+      .returning();
+
+    if (updated) {
+      await this.afterWrite();
+    }
+
+    return updated ?? null;
+  }
+
+  async deleteForUser(userId: string, id: number): Promise<boolean> {
+    const rows = await this.context.drizzle
+      .delete(c2sTunnelPresets)
+      .where(
+        and(eq(c2sTunnelPresets.id, id), eq(c2sTunnelPresets.userId, userId)),
+      )
+      .returning({ id: c2sTunnelPresets.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length > 0;
+  }
+
+  async deleteByUserId(userId: string): Promise<number> {
+    const rows = await this.context.drizzle
+      .delete(c2sTunnelPresets)
+      .where(eq(c2sTunnelPresets.userId, userId))
+      .returning({ id: c2sTunnelPresets.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  private async afterWrite(): Promise<void> {
+    await this.onWrite?.();
+  }
+}
@@ -0,0 +1,102 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { SqliteDatabaseAdapter } from "../runtime/sqlite-adapter.js";
+import { CommandHistoryRepository } from "./command-history-repository.js";
+
+describe("CommandHistoryRepository", () => {
+  let adapter: SqliteDatabaseAdapter | null = null;
+
+  afterEach(async () => {
+    if (adapter) {
+      await adapter.close();
+      adapter = null;
+    }
+  });
+
+  async function createRepository(
+    onWrite?: () => void | Promise<void>,
+  ): Promise<CommandHistoryRepository> {
+    adapter = new SqliteDatabaseAdapter({
+      dialect: "sqlite",
+      url: ":memory:",
+      sqlitePath: ":memory:",
+    });
+    const context = await adapter.connect();
+    context.sqlite?.exec(`
+      CREATE TABLE users (
+        id TEXT PRIMARY KEY,
+        username TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        is_admin INTEGER NOT NULL DEFAULT 0,
+        is_oidc INTEGER NOT NULL DEFAULT 0
+      );
+
+      CREATE TABLE hosts (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id TEXT NOT NULL,
+        name TEXT NOT NULL
+      );
+
+      CREATE TABLE command_history (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id TEXT NOT NULL,
+        host_id INTEGER NOT NULL,
+        command TEXT NOT NULL,
+        executed_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      INSERT INTO users (id, username, password_hash)
+      VALUES ('user-1', 'alice', 'hash'), ('user-2', 'bob', 'hash');
+      INSERT INTO hosts (id, user_id, name)
+      VALUES (1, 'user-1', 'one'), (2, 'user-1', 'two'), (3, 'user-2', 'other');
+    `);
+
+    return new CommandHistoryRepository(context, onWrite);
+  }
+
+  it("creates and lists unique commands by latest execution", async () => {
+    const repo = await createRepository();
+
+    await repo.create("user-1", 1, "ls", "2026-06-27T00:00:00.000Z");
+    await repo.create("user-1", 1, "pwd", "2026-06-27T01:00:00.000Z");
+    await repo.create("user-1", 1, "ls", "2026-06-27T02:00:00.000Z");
+    await repo.create("user-2", 3, "whoami", "2026-06-27T03:00:00.000Z");
+
+    expect(await repo.listUniqueCommandsForHost("user-1", 1)).toEqual([
+      "ls",
+      "pwd",
+    ]);
+    expect(await repo.listCommandsForHost("user-1", 1)).toEqual([
+      "ls",
+      "pwd",
+      "ls",
+    ]);
+  });
+
+  it("deletes commands by command, host, host list, and user", async () => {
+    let writeCount = 0;
+    const repo = await createRepository(() => {
+      writeCount += 1;
+    });
+
+    await repo.create("user-1", 1, "ls");
+    await repo.create("user-1", 1, "ls");
+    await repo.create("user-1", 2, "pwd");
+    await repo.create("user-2", 3, "whoami");
+    expect(writeCount).toBe(4);
+
+    expect(await repo.deleteCommandForHost("user-1", 1, "missing")).toBe(0);
+    expect(writeCount).toBe(4);
+
+    expect(await repo.deleteCommandForHost("user-1", 1, "ls")).toBe(2);
+    expect(writeCount).toBe(5);
+
+    expect(await repo.deleteByUserAndHost("user-1", 2)).toBe(1);
+    expect(await repo.deleteByHostIds([])).toBe(0);
+    expect(await repo.deleteByHostIds([3])).toBe(1);
+    expect(writeCount).toBe(7);
+
+    await repo.create("user-1", 1, "date");
+    expect(await repo.deleteByUserId("user-1")).toBe(1);
+    expect(writeCount).toBe(9);
+  });
+});
@@ -0,0 +1,161 @@
+import { and, desc, eq, inArray, sql } from "drizzle-orm";
+import { commandHistory } from "../db/schema.js";
+import type { DatabaseContext } from "../runtime/adapter.js";
+
+export type CommandHistoryRecord = typeof commandHistory.$inferSelect;
+
+export class CommandHistoryRepository {
+  constructor(
+    private readonly context: DatabaseContext,
+    private readonly onWrite?: () => void | Promise<void>,
+  ) {}
+
+  async create(
+    userId: string,
+    hostId: number,
+    command: string,
+    executedAt = new Date().toISOString(),
+  ): Promise<CommandHistoryRecord> {
+    const [created] = await this.context.drizzle
+      .insert(commandHistory)
+      .values({ userId, hostId, command, executedAt })
+      .returning();
+    await this.afterWrite();
+    return created;
+  }
+
+  async listUniqueCommandsForHost(
+    userId: string,
+    hostId: number,
+    limit = 500,
+  ): Promise<string[]> {
+    const rows = await this.context.drizzle
+      .select({
+        command: commandHistory.command,
+        maxExecutedAt: sql<number>`MAX(${commandHistory.executedAt})`,
+      })
+      .from(commandHistory)
+      .where(
+        and(
+          eq(commandHistory.userId, userId),
+          eq(commandHistory.hostId, hostId),
+        ),
+      )
+      .groupBy(commandHistory.command)
+      .orderBy(desc(sql`MAX(${commandHistory.executedAt})`))
+      .limit(limit);
+
+    return rows.map((row) => row.command);
+  }
+
+  async listCommandsForHost(
+    userId: string,
+    hostId: number,
+    limit = 200,
+  ): Promise<string[]> {
+    const rows = await this.context.drizzle
+      .select({
+        id: commandHistory.id,
+        command: commandHistory.command,
+      })
+      .from(commandHistory)
+      .where(
+        and(
+          eq(commandHistory.userId, userId),
+          eq(commandHistory.hostId, hostId),
+        ),
+      )
+      .orderBy(desc(commandHistory.executedAt))
+      .limit(limit);
+
+    return rows.map((row) => row.command);
+  }
+
+  async deleteCommandForHost(
+    userId: string,
+    hostId: number,
+    command: string,
+  ): Promise<number> {
+    const rows = await this.context.drizzle
+      .delete(commandHistory)
+      .where(
+        and(
+          eq(commandHistory.userId, userId),
+          eq(commandHistory.hostId, hostId),
+          eq(commandHistory.command, command),
+        ),
+      )
+      .returning({ id: commandHistory.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  async deleteByUserAndHost(userId: string, hostId: number): Promise<number> {
+    const rows = await this.context.drizzle
+      .delete(commandHistory)
+      .where(
+        and(
+          eq(commandHistory.userId, userId),
+          eq(commandHistory.hostId, hostId),
+        ),
+      )
+      .returning({ id: commandHistory.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  async deleteByHostId(hostId: number): Promise<number> {
+    const rows = await this.context.drizzle
+      .delete(commandHistory)
+      .where(eq(commandHistory.hostId, hostId))
+      .returning({ id: commandHistory.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  async deleteByHostIds(hostIds: number[]): Promise<number> {
+    if (hostIds.length === 0) {
+      return 0;
+    }
+
+    const rows = await this.context.drizzle
+      .delete(commandHistory)
+      .where(inArray(commandHistory.hostId, hostIds))
+      .returning({ id: commandHistory.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  async deleteByUserId(userId: string): Promise<number> {
+    const rows = await this.context.drizzle
+      .delete(commandHistory)
+      .where(eq(commandHistory.userId, userId))
+      .returning({ id: commandHistory.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  private async afterWrite(): Promise<void> {
+    await this.onWrite?.();
+  }
+}
@@ -0,0 +1,360 @@
+import { and, desc, eq, isNull, or, sql } from "drizzle-orm";
+import { sshCredentials, sshCredentialUsage } from "../db/schema.js";
+import type { DatabaseContext } from "../runtime/adapter.js";
+import { DataCrypto } from "../../utils/data-crypto.js";
+import { SystemCrypto } from "../../utils/system-crypto.js";
+
+export type CredentialRecord = typeof sshCredentials.$inferSelect;
+export type NewCredentialRecord = typeof sshCredentials.$inferInsert;
+export type CredentialUpdate = Partial<
+  Omit<NewCredentialRecord, "id" | "userId">
+>;
+export type CredentialSystemEncryptionUpdate = Pick<
+  CredentialUpdate,
+  "systemPassword" | "systemKey" | "systemKeyPassword" | "updatedAt"
+>;
+
+export class CredentialRepository {
+  constructor(
+    private readonly context: DatabaseContext,
+    private readonly onWrite?: () => void | Promise<void>,
+  ) {}
+
+  async create(credential: NewCredentialRecord): Promise<CredentialRecord> {
+    const rows = await this.context.drizzle
+      .insert(sshCredentials)
+      .values(credential)
+      .returning();
+    await this.afterWrite();
+    return rows[0];
+  }
+
+  async createEncryptedForUser(
+    userId: string,
+    credential: NewCredentialRecord | Record<string, unknown>,
+  ): Promise<CredentialRecord> {
+    const userDataKey = DataCrypto.validateUserAccess(userId);
+    const tempId = credential.id ?? Date.now();
+    const dataWithTempId = { ...credential, id: tempId };
+    const encryptedCredential = await this.encryptCredentialRecordForWrite(
+      dataWithTempId,
+      userId,
+      userDataKey,
+    );
+
+    if (!credential.id) {
+      delete (encryptedCredential as Partial<NewCredentialRecord>).id;
+    }
+
+    const rows = await this.context.drizzle
+      .insert(sshCredentials)
+      .values(encryptedCredential as NewCredentialRecord)
+      .returning();
+
+    await this.afterWrite();
+    return DataCrypto.decryptRecord(
+      "ssh_credentials",
+      rows[0],
+      userId,
+      userDataKey,
+    );
+  }
+
+  async findByIdForUser(
+    userId: string,
+    credentialId: number,
+  ): Promise<CredentialRecord | null> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(sshCredentials)
+      .where(
+        and(
+          eq(sshCredentials.id, credentialId),
+          eq(sshCredentials.userId, userId),
+        ),
+      )
+      .limit(1);
+
+    return rows[0] ?? null;
+  }
+
+  async findById(credentialId: number): Promise<CredentialRecord | null> {
+    const rows = await this.context.drizzle
+      .select()
+      .from(sshCredentials)
+      .where(eq(sshCredentials.id, credentialId))
+      .limit(1);
+
+    return rows[0] ?? null;
+  }
+
+  async listByUserId(userId: string): Promise<CredentialRecord[]> {
+    return this.context.drizzle
+      .select()
+      .from(sshCredentials)
+      .where(eq(sshCredentials.userId, userId))
+      .orderBy(desc(sshCredentials.updatedAt));
+  }
+
+  async listMissingSystemEncryptionByUserId(
+    userId: string,
+  ): Promise<CredentialRecord[]> {
+    return this.context.drizzle
+      .select()
+      .from(sshCredentials)
+      .where(
+        and(
+          eq(sshCredentials.userId, userId),
+          or(
+            isNull(sshCredentials.systemPassword),
+            isNull(sshCredentials.systemKey),
+            isNull(sshCredentials.systemKeyPassword),
+          ),
+        ),
+      );
+  }
+
+  async existsForImportIdentity(
+    userId: string,
+    name: string,
+    username: string | null,
+  ): Promise<boolean> {
+    const rows = await this.context.drizzle
+      .select({ id: sshCredentials.id })
+      .from(sshCredentials)
+      .where(
+        and(
+          eq(sshCredentials.userId, userId),
+          eq(sshCredentials.name, name),
+          eq(sshCredentials.username, username),
+        ),
+      )
+      .limit(1);
+
+    return rows.length > 0;
+  }
+
+  async findDecryptedByIdForUser(
+    userId: string,
+    credentialId: number,
+  ): Promise<CredentialRecord | null> {
+    const row = await this.findByIdForUser(userId, credentialId);
+    return this.decryptOne(row, userId);
+  }
+
+  async listDecryptedByUserId(userId: string): Promise<CredentialRecord[]> {
+    const rows = await this.listByUserId(userId);
+    return this.decryptMany(rows, userId);
+  }
+
+  async listFolders(userId: string): Promise<string[]> {
+    const rows = await this.context.drizzle
+      .select({ folder: sshCredentials.folder })
+      .from(sshCredentials)
+      .where(eq(sshCredentials.userId, userId));
+
+    return [...new Set(rows.map((row) => row.folder).filter(Boolean))].sort();
+  }
+
+  async renameFolder(
+    userId: string,
+    oldName: string,
+    newName: string,
+  ): Promise<number> {
+    const rows = await this.context.drizzle
+      .update(sshCredentials)
+      .set({ folder: newName })
+      .where(
+        and(
+          eq(sshCredentials.userId, userId),
+          eq(sshCredentials.folder, oldName),
+        ),
+      )
+      .returning({ id: sshCredentials.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  async updateForUser(
+    userId: string,
+    credentialId: number,
+    update: CredentialUpdate,
+  ): Promise<CredentialRecord | null> {
+    const rows = await this.context.drizzle
+      .update(sshCredentials)
+      .set(update)
+      .where(
+        and(
+          eq(sshCredentials.id, credentialId),
+          eq(sshCredentials.userId, userId),
+        ),
+      )
+      .returning();
+
+    await this.afterWrite();
+    return rows[0] ?? null;
+  }
+
+  async updateEncryptedForUser(
+    userId: string,
+    credentialId: number,
+    update: CredentialUpdate,
+  ): Promise<CredentialRecord | null> {
+    const userDataKey = DataCrypto.validateUserAccess(userId);
+    const encryptedUpdate = await this.encryptCredentialRecordForWrite(
+      update,
+      userId,
+      userDataKey,
+    );
+
+    const rows = await this.context.drizzle
+      .update(sshCredentials)
+      .set(encryptedUpdate)
+      .where(
+        and(
+          eq(sshCredentials.id, credentialId),
+          eq(sshCredentials.userId, userId),
+        ),
+      )
+      .returning();
+
+    await this.afterWrite();
+    return this.decryptOne(rows[0] ?? null, userId);
+  }
+
+  async updateSystemEncryptionForUser(
+    userId: string,
+    credentialId: number,
+    update: CredentialSystemEncryptionUpdate,
+  ): Promise<CredentialRecord | null> {
+    const rows = await this.context.drizzle
+      .update(sshCredentials)
+      .set(update)
+      .where(
+        and(
+          eq(sshCredentials.id, credentialId),
+          eq(sshCredentials.userId, userId),
+        ),
+      )
+      .returning();
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows[0] ?? null;
+  }
+
+  async deleteForUser(userId: string, credentialId: number): Promise<boolean> {
+    const rows = await this.context.drizzle
+      .delete(sshCredentials)
+      .where(
+        and(
+          eq(sshCredentials.id, credentialId),
+          eq(sshCredentials.userId, userId),
+        ),
+      )
+      .returning({ id: sshCredentials.id });
+
+    await this.afterWrite();
+    return rows.length > 0;
+  }
+
+  async deleteByUserId(userId: string): Promise<number> {
+    const rows = await this.context.drizzle
+      .delete(sshCredentials)
+      .where(eq(sshCredentials.userId, userId))
+      .returning({ id: sshCredentials.id });
+
+    if (rows.length > 0) {
+      await this.afterWrite();
+    }
+
+    return rows.length;
+  }
+
+  async recordUsage(
+    userId: string,
+    credentialId: number,
+    hostId: number,
+    usedAt = new Date().toISOString(),
+  ): Promise<void> {
+    await this.context.drizzle.insert(sshCredentialUsage).values({
+      credentialId,
+      hostId,
+      userId,
+      usedAt,
+    });
+
+    await this.context.drizzle
+      .update(sshCredentials)
+      .set({
+        lastUsed: usedAt,
+        usageCount: sql`${sshCredentials.usageCount} + 1`,
+      })
+      .where(
+        and(
+          eq(sshCredentials.id, credentialId),
+          eq(sshCredentials.userId, userId),
+        ),
+      );
+    await this.afterWrite();
+  }
+
+  private decryptOne<T extends Record<string, unknown>>(
+    record: T | null,
+    userId: string,
+  ): T | null {
+    if (!record) return null;
+    const userDataKey = DataCrypto.getUserDataKey(userId);
+    if (!userDataKey) return null;
+    return DataCrypto.decryptRecord(
+      "ssh_credentials",
+      record,
+      userId,
+      userDataKey,
+    );
+  }
+
+  private decryptMany<T extends Record<string, unknown>>(
+    records: T[],
+    userId: string,
+  ): T[] {
+    const userDataKey = DataCrypto.getUserDataKey(userId);
+    if (!userDataKey) return [];
+    return DataCrypto.decryptRecords(
+      "ssh_credentials",
+      records,
+      userId,
+      userDataKey,
+    );
+  }
+
+  private async encryptCredentialRecordForWrite<
+    T extends Record<string, unknown>,
+  >(record: T, userId: string, userDataKey: Buffer): Promise<T> {
+    const encryptedRecord = DataCrypto.encryptRecord(
+      "ssh_credentials",
+      record,
+      userId,
+      userDataKey,
+    );
+    const systemKey =
+      await SystemCrypto.getInstance().getCredentialSharingKey();
+    const systemEncrypted = await DataCrypto.encryptRecordWithSystemKey(
+      "ssh_credentials",
+      record,
+      systemKey,
+    );
+
+    return { ...encryptedRecord, ...systemEncrypted };
+  }
+
+  private async afterWrite(): Promise<void> {
+    await this.onWrite?.();
+  }
+}
@@ -0,0 +1,15 @@
+import { AlertRepository } from "./alert-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentAlertRepository(): AlertRepository {
+  assertRepositoryRolloutDomainEnabled("alerts");
+
+  return new AlertRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("alert_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { ApiKeyRepository } from "./api-key-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentApiKeyRepository(): ApiKeyRepository {
+  assertRepositoryRolloutDomainEnabled("api_keys");
+
+  return new ApiKeyRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("api_key_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { AuditLogRepository } from "./audit-log-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentAuditLogRepository(): AuditLogRepository {
+  assertRepositoryRolloutDomainEnabled("audit_logs");
+
+  return new AuditLogRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("audit_log_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { C2sTunnelPresetRepository } from "./c2s-tunnel-preset-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentC2sTunnelPresetRepository(): C2sTunnelPresetRepository {
+  assertRepositoryRolloutDomainEnabled("c2s_tunnel_presets");
+
+  return new C2sTunnelPresetRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("c2s_tunnel_preset_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { CommandHistoryRepository } from "./command-history-repository.js";
+
+export function createCurrentCommandHistoryRepository(): CommandHistoryRepository {
+  assertRepositoryRolloutDomainEnabled("command_history");
+
+  return new CommandHistoryRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("command_history_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { CredentialRepository } from "./credential-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentCredentialRepository(): CredentialRepository {
+  assertRepositoryRolloutDomainEnabled("credentials");
+
+  return new CredentialRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("credential_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { DashboardServiceLinkRepository } from "./dashboard-service-link-repository.js";
+
+export function createCurrentDashboardServiceLinkRepository(): DashboardServiceLinkRepository {
+  assertRepositoryRolloutDomainEnabled("dashboard_service_links");
+
+  return new DashboardServiceLinkRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("dashboard_service_link_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { DismissedAlertRepository } from "./dismissed-alert-repository.js";
+
+export function createCurrentDismissedAlertRepository(): DismissedAlertRepository {
+  assertRepositoryRolloutDomainEnabled("dismissed_alerts");
+
+  return new DismissedAlertRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("dismissed_alert_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { FileManagerBookmarkRepository } from "./file-manager-bookmark-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentFileManagerBookmarkRepository(): FileManagerBookmarkRepository {
+  assertRepositoryRolloutDomainEnabled("file_manager_bookmarks");
+
+  return new FileManagerBookmarkRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("file_manager_bookmarks_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { HomepageItemRepository } from "./homepage-item-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentHomepageItemRepository(): HomepageItemRepository {
+  assertRepositoryRolloutDomainEnabled("homepage_items");
+
+  return new HomepageItemRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("homepage_item_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { HomepageLayoutRepository } from "./homepage-layout-repository.js";
+
+export function createCurrentHomepageLayoutRepository(): HomepageLayoutRepository {
+  assertRepositoryRolloutDomainEnabled("homepage_layouts");
+
+  return new HomepageLayoutRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("homepage_layout_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { HostFolderRepository } from "./host-folder-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentHostFolderRepository(): HostFolderRepository {
+  assertRepositoryRolloutDomainEnabled("host_folders");
+
+  return new HostFolderRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("host_folder_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { HostHealthRepository } from "./host-health-repository.js";
+
+export function createCurrentHostHealthRepository(): HostHealthRepository {
+  assertRepositoryRolloutDomainEnabled("host_health");
+
+  return new HostHealthRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("host_health_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { HostMetricsHistoryRepository } from "./host-metrics-history-repository.js";
+
+export function createCurrentHostMetricsHistoryRepository(): HostMetricsHistoryRepository {
+  assertRepositoryRolloutDomainEnabled("host_metrics_history");
+
+  return new HostMetricsHistoryRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("host_metrics_history_repository_write"),
+  );
+}
@@ -0,0 +1,17 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { HostMetricsPreferenceRepository } from "./host-metrics-preference-repository.js";
+
+export function createCurrentHostMetricsPreferenceRepository(): HostMetricsPreferenceRepository {
+  assertRepositoryRolloutDomainEnabled("host_metrics_preferences");
+
+  return new HostMetricsPreferenceRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook(
+      "host_metrics_preference_repository_write",
+    ),
+  );
+}
@@ -0,0 +1,15 @@
+import { HostRepository } from "./host-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentHostRepository(): HostRepository {
+  assertRepositoryRolloutDomainEnabled("hosts");
+
+  return new HostRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("host_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { HostResolutionRepository } from "./host-resolution-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentHostResolutionRepository(): HostResolutionRepository {
+  assertRepositoryRolloutDomainEnabled("host_resolution");
+
+  return new HostResolutionRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("host_resolution_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { NetworkTopologyRepository } from "./network-topology-repository.js";
+
+export function createCurrentNetworkTopologyRepository(): NetworkTopologyRepository {
+  assertRepositoryRolloutDomainEnabled("network_topology");
+
+  return new NetworkTopologyRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("network_topology_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { OpenTabRepository } from "./open-tab-repository.js";
+
+export function createCurrentOpenTabRepository(): OpenTabRepository {
+  assertRepositoryRolloutDomainEnabled("open_tabs");
+
+  return new OpenTabRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("open_tab_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { OpksshTokenRepository } from "./opkssh-token-repository.js";
+
+export function createCurrentOpksshTokenRepository(): OpksshTokenRepository {
+  assertRepositoryRolloutDomainEnabled("opkssh_tokens");
+
+  return new OpksshTokenRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("opkssh_token_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import { RbacAccessRepository } from "./rbac-access-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+
+export function createCurrentRbacAccessRepository(): RbacAccessRepository {
+  assertRepositoryRolloutDomainEnabled("rbac_access");
+
+  return new RbacAccessRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("rbac_access_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { RecentActivityRepository } from "./recent-activity-repository.js";
+
+export function createCurrentRecentActivityRepository(): RecentActivityRepository {
+  assertRepositoryRolloutDomainEnabled("recent_activity");
+
+  return new RecentActivityRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("recent_activity_repository_write"),
+  );
+}
@@ -0,0 +1,21 @@
+import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
+import { getDb, getSqlite } from "../db/index.js";
+import type { DatabaseContext } from "../runtime/adapter.js";
+
+export function createCurrentRepositoryContext(): DatabaseContext {
+  return {
+    dialect: "sqlite",
+    drizzle: getDb(),
+    sqlite: getSqlite(),
+  };
+}
+
+export function createCurrentRepositoryWriteHook(
+  reason: string,
+): () => Promise<void> {
+  return () => DatabaseSaveTrigger.forceSave(reason);
+}
+
+export function getCurrentRepositorySqlite() {
+  return getSqlite();
+}
@@ -0,0 +1,15 @@
+import { RoleRepository } from "./role-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentRoleRepository(): RoleRepository {
+  assertRepositoryRolloutDomainEnabled("roles");
+
+  return new RoleRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("role_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { SessionRecordingRepository } from "./session-recording-repository.js";
+
+export function createCurrentSessionRecordingRepository(): SessionRecordingRepository {
+  assertRepositoryRolloutDomainEnabled("session_recordings");
+
+  return new SessionRecordingRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("session_recording_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { SessionRepository } from "./session-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentSessionRepository(): SessionRepository {
+  assertRepositoryRolloutDomainEnabled("sessions");
+
+  return new SessionRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("session_repository_write"),
+  );
+}
@@ -0,0 +1,26 @@
+import { SettingsRepository } from "./settings-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+  getCurrentRepositorySqlite,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentSettingsRepository(): SettingsRepository {
+  assertRepositoryRolloutDomainEnabled("settings");
+
+  return new SettingsRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("settings_repository_write"),
+  );
+}
+
+export function getCurrentSettingValue(key: string): string | null {
+  assertRepositoryRolloutDomainEnabled("settings");
+
+  const row = getCurrentRepositorySqlite()
+    .prepare("SELECT value FROM settings WHERE key = ?")
+    .get(key) as { value?: string } | undefined;
+
+  return row?.value ?? null;
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { SharedCredentialRepository } from "./shared-credential-repository.js";
+
+export function createCurrentSharedCredentialRepository(): SharedCredentialRepository {
+  assertRepositoryRolloutDomainEnabled("shared_credentials");
+
+  return new SharedCredentialRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("shared_credential_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { SnippetRepository } from "./snippet-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentSnippetRepository(): SnippetRepository {
+  assertRepositoryRolloutDomainEnabled("snippets");
+
+  return new SnippetRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("snippet_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { SshCredentialUsageRepository } from "./ssh-credential-usage-repository.js";
+
+export function createCurrentSshCredentialUsageRepository(): SshCredentialUsageRepository {
+  assertRepositoryRolloutDomainEnabled("ssh_credential_usage");
+
+  return new SshCredentialUsageRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("ssh_credential_usage_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { SsoProviderRepository } from "./sso-provider-repository.js";
+
+export function createCurrentSsoProviderRepository(): SsoProviderRepository {
+  assertRepositoryRolloutDomainEnabled("sso_providers");
+
+  return new SsoProviderRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("sso_provider_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { TermixIdentityCaRepository } from "./termix-identity-ca-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentTermixIdentityCaRepository(): TermixIdentityCaRepository {
+  assertRepositoryRolloutDomainEnabled("termix_identity_ca");
+
+  return new TermixIdentityCaRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("termix_identity_ca_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { TermixIdentityRepository } from "./termix-identity-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentTermixIdentityRepository(): TermixIdentityRepository {
+  assertRepositoryRolloutDomainEnabled("termix_identity");
+
+  return new TermixIdentityRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("termix_identity_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { TmuxSessionTagRepository } from "./tmux-session-tag-repository.js";
+
+export function createCurrentTmuxSessionTagRepository(): TmuxSessionTagRepository {
+  assertRepositoryRolloutDomainEnabled("tmux_session_tags");
+
+  return new TmuxSessionTagRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("tmux_session_tag_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { TransferRecentRepository } from "./transfer-recent-repository.js";
+
+export function createCurrentTransferRecentRepository(): TransferRecentRepository {
+  assertRepositoryRolloutDomainEnabled("transfer_recent");
+
+  return new TransferRecentRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("transfer_recent_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { TrustedDeviceRepository } from "./trusted-device-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentTrustedDeviceRepository(): TrustedDeviceRepository {
+  assertRepositoryRolloutDomainEnabled("trusted_devices");
+
+  return new TrustedDeviceRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("trusted_device_repository_write"),
+  );
+}
@@ -0,0 +1,9 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import { createCurrentRepositoryContext } from "./current-repository-runtime.js";
+import { UserDataExportRepository } from "./user-data-export-repository.js";
+
+export function createCurrentUserDataExportRepository(): UserDataExportRepository {
+  assertRepositoryRolloutDomainEnabled("user_data_exports");
+
+  return new UserDataExportRepository(createCurrentRepositoryContext());
+}
@@ -0,0 +1,15 @@
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { UserPreferenceRepository } from "./user-preference-repository.js";
+
+export function createCurrentUserPreferenceRepository(): UserPreferenceRepository {
+  assertRepositoryRolloutDomainEnabled("user_preferences");
+
+  return new UserPreferenceRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("user_preference_repository_write"),
+  );
+}
@@ -0,0 +1,15 @@
+import { UserRepository } from "./user-repository.js";
+import {
+  createCurrentRepositoryContext,
+  createCurrentRepositoryWriteHook,
+} from "./current-repository-runtime.js";
+import { assertRepositoryRolloutDomainEnabled } from "./repository-rollout.js";
+
+export function createCurrentUserRepository(): UserRepository {
+  assertRepositoryRolloutDomainEnabled("users");
+
+  return new UserRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("user_repository_write"),
+  );
+}
--- a/Show More
+++ b/Show More