style: prettify files touched by Last Known Status work

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.agents/skills/ss-shadcn-svelte/SKILL.md

@@ -0,0 +1,123 @@
+---
+name: ss-shadcn-svelte
+description: >
+  Use shadcn-svelte components in SvelteKit projects. Detects whether the current project is a SvelteKit
+  app with shadcn-svelte installed, lists available components, and provides access to full component
+  documentation via the official llms.txt. Helps choose the right UI components for the job — buttons,
+  forms, dialogs, tables, charts, and more — following shadcn-svelte best practices.
+  Use this skill whenever the user is working in a SvelteKit project and wants to: add UI components,
+  build forms, create dialogs or modals, add a data table, use a date picker, build a sidebar or
+  navigation, add charts, use a combobox or select, create an alert or toast notification, or generally
+  build UI with pre-built accessible components. Also trigger when the user mentions "shadcn", "shadcn-svelte",
+  "bits-ui", or asks about available components in their Svelte project.
+---
+
+# shadcn-svelte — Component-Aware Svelte UI Assistant
+
+Use the right shadcn-svelte components when building UI in SvelteKit projects. This skill detects your project setup, shows what's available, and gives you access to full component documentation.
+
+## Prerequisites
+
+The project must be a SvelteKit app with shadcn-svelte initialized:
+
+```bash
+# Initialize shadcn-svelte in an existing SvelteKit project
+npx shadcn-svelte@latest init
+```
+
+## How to use
+
+### Step 1: Detect project setup
+
+Run the detection script to verify this is a SvelteKit project with shadcn-svelte and see which components are already installed:
+
+```bash
+bash <skill-path>/scripts/detect.sh .
+```
+
+This will:
+- Confirm it's a SvelteKit project (checks for `svelte.config.js/ts` and `@sveltejs/kit` in package.json)
+- Confirm shadcn-svelte is installed (checks for `components.json`, `bits-ui`, or `shadcn-svelte` in package.json)
+- List all currently installed components in the project's UI directory
+- Provide the documentation URL
+
+If the script exits with code 1, the project either isn't SvelteKit or doesn't have shadcn-svelte — do not proceed with shadcn-svelte components in that case.
+
+### Step 2: Read the component documentation
+
+The full component documentation for LLMs is available at:
+
+```
+https://www.shadcn-svelte.com/llms.txt
+```
+
+Fetch this URL to get a structured index of all available components organized by category, with links to individual component documentation pages (in `.md` format).
+
+When you need to use a specific component, read its individual documentation page from the links provided in `llms.txt`. Each component doc includes:
+- Import statements and usage examples
+- Available props, events, and slots
+- Variants and configuration options
+- Accessibility information
+
+### Step 3: Use the right component for the job
+
+When building UI, follow this decision process:
+
+1. **Run detection** to confirm shadcn-svelte is available and see installed components
+2. **Fetch llms.txt** to see all available components
+3. **Read the specific component docs** for the components you plan to use
+4. **Check if the component is installed** — if not, add it:
+   ```bash
+   npx shadcn-svelte@latest add <component-name>
+   ```
+5. **Import and use the component** following the documentation patterns
+
+### Component categories
+
+shadcn-svelte components are organized into these categories:
+
+| Category | Components |
+|----------|-----------|
+| **Layout** | Aspect Ratio, Collapsible, Resizable, Scroll Area, Separator, Sidebar |
+| **Form & Input** | Button, Calendar, Checkbox, Combobox, Date Picker, Input, Input OTP, Label, Radio Group, Range Calendar, Select, Slider, Switch, Textarea, Toggle, Toggle Group |
+| **Data Display** | Accordion, Avatar, Badge, Card, Carousel, Chart, Table, Data Table |
+| **Feedback** | Alert, Alert Dialog, Progress, Skeleton, Sonner (Toast) |
+| **Overlay** | Context Menu, Dialog, Drawer, Dropdown Menu, Hover Card, Menubar, Popover, Sheet, Tooltip |
+| **Navigation** | Breadcrumb, Command, Pagination, Tabs |
+| **Typography** | Typography |
+
+### Adding new components
+
+```bash
+# Add a single component
+npx shadcn-svelte@latest add button
+
+# Add multiple components
+npx shadcn-svelte@latest add button card dialog
+
+# List all available components
+npx shadcn-svelte@latest add
+```
+
+### Import patterns
+
+Components are typically imported from the project's `$lib/components/ui` directory:
+
+```svelte
+<script lang="ts">
+  import { Button } from "$lib/components/ui/button";
+  import * as Card from "$lib/components/ui/card";
+  import * as Dialog from "$lib/components/ui/dialog";
+</script>
+```
+
+Some components use namespace imports (with `* as`) when they have multiple sub-components (Card, Dialog, Sheet, Table, etc.), while simpler components use named imports (Button, Input, Badge, etc.).
+
+## Important guidelines
+
+- **Always run detection first** before suggesting shadcn-svelte components
+- **Always read component docs** before using a component — don't guess at props or patterns
+- **Check installed components** and add missing ones before importing
+- **Use the project's configured path** — the components directory may vary based on `components.json` configuration
+- **Follow Svelte 5 patterns** — shadcn-svelte uses runes (`$state`, `$derived`, `$effect`) and snippet-based composition
+- **Prefer composition** — shadcn-svelte components are designed to be composed together, not used as monolithic blocks

.agents/skills/ss-shadcn-svelte/scripts/detect.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# detect.sh — Check if the current project is a SvelteKit project with shadcn-svelte installed.
+# Exits 0 and prints component info if detected, exits 1 otherwise.
+
+PROJECT_DIR="${1:-.}"
+
+# Resolve to absolute path
+PROJECT_DIR="$(cd "$PROJECT_DIR" && pwd)"
+
+# --- Step 1: Check for SvelteKit ---
+
+SVELTEKIT=false
+
+# Check for svelte.config.js or svelte.config.ts
+if [[ -f "$PROJECT_DIR/svelte.config.js" ]] || [[ -f "$PROJECT_DIR/svelte.config.ts" ]]; then
+    SVELTEKIT=true
+fi
+
+# Also verify package.json has @sveltejs/kit
+if [[ -f "$PROJECT_DIR/package.json" ]]; then
+    if grep -q '"@sveltejs/kit"' "$PROJECT_DIR/package.json" 2>/dev/null; then
+        SVELTEKIT=true
+    fi
+fi
+
+if [[ "$SVELTEKIT" != "true" ]]; then
+    echo "NOT_SVELTEKIT"
+    echo "This is not a SvelteKit project. No svelte.config.js/ts found and @sveltejs/kit is not in package.json."
+    exit 1
+fi
+
+# --- Step 2: Check for shadcn-svelte ---
+
+SHADCN=false
+
+# Check for components.json (shadcn-svelte config file)
+if [[ -f "$PROJECT_DIR/components.json" ]]; then
+    # Verify it's actually a shadcn config (has $schema or style field)
+    if grep -qE '"(\$schema|style)"' "$PROJECT_DIR/components.json" 2>/dev/null; then
+        SHADCN=true
+    fi
+fi
+
+# Check for bits-ui in package.json (core dependency of shadcn-svelte)
+if [[ -f "$PROJECT_DIR/package.json" ]]; then
+    if grep -q '"bits-ui"' "$PROJECT_DIR/package.json" 2>/dev/null; then
+        SHADCN=true
+    fi
+fi
+
+# Check for shadcn-svelte in package.json
+if [[ -f "$PROJECT_DIR/package.json" ]]; then
+    if grep -q '"shadcn-svelte"' "$PROJECT_DIR/package.json" 2>/dev/null; then
+        SHADCN=true
+    fi
+fi
+
+if [[ "$SHADCN" != "true" ]]; then
+    echo "NO_SHADCN_SVELTE"
+    echo "SvelteKit project detected, but shadcn-svelte is not installed."
+    echo "Install it with: npx shadcn-svelte@latest init"
+    exit 1
+fi
+
+# --- Step 3: Gather installed components ---
+
+echo "DETECTED"
+echo "SvelteKit project with shadcn-svelte detected."
+echo ""
+
+# Check which components are already installed by scanning the components directory
+COMPONENTS_DIR=""
+
+# Try to read the components alias from components.json
+if [[ -f "$PROJECT_DIR/components.json" ]]; then
+    # Extract the aliases.components path
+    ALIAS_PATH=$(grep -o '"components"[[:space:]]*:[[:space:]]*"[^"]*"' "$PROJECT_DIR/components.json" | head -1 | sed 's/.*"components"[[:space:]]*:[[:space:]]*"//' | sed 's/"//')
+
+    if [[ -n "$ALIAS_PATH" ]]; then
+        # Resolve $lib to src/lib
+        RESOLVED_PATH="${ALIAS_PATH//\$lib/src/lib}"
+        if [[ -d "$PROJECT_DIR/$RESOLVED_PATH/ui" ]]; then
+            COMPONENTS_DIR="$PROJECT_DIR/$RESOLVED_PATH/ui"
+        fi
+    fi
+fi
+
+# Fallback: check common locations
+if [[ -z "$COMPONENTS_DIR" ]]; then
+    for dir in "src/lib/components/ui" "src/lib/ui" "src/components/ui"; do
+        if [[ -d "$PROJECT_DIR/$dir" ]]; then
+            COMPONENTS_DIR="$PROJECT_DIR/$dir"
+            break
+        fi
+    done
+fi
+
+if [[ -n "$COMPONENTS_DIR" ]] && [[ -d "$COMPONENTS_DIR" ]]; then
+    echo "Installed components (in $COMPONENTS_DIR):"
+    for comp_dir in "$COMPONENTS_DIR"/*/; do
+        if [[ -d "$comp_dir" ]]; then
+            comp_name=$(basename "$comp_dir")
+            echo "  - $comp_name"
+        fi
+    done
+    echo ""
+fi
+
+echo "Documentation: https://www.shadcn-svelte.com/llms.txt"

.claude/settings.json

@@ -0,0 +1,5 @@
+{
+  "enabledPlugins": {
+    "frontend-design@claude-plugins-official": true
+  }
+}

.claude/skills/documentation-writer/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: documentation-writer
+description: Specialized skill for creating and editing high-quality Kener documentation. MUST be used whenever creating or editing documentation files in the src/routes/(docs)/docs/content/ directory or updating docs.json navigation.
+---
+
+# Documentation Writer
+
+Use this skill for all docs edits in `src/routes/(docs)/docs/content/` and when updating docs navigation in `src/routes/(docs)/docs.json`.
+
+## Non-negotiable rules
+
+1. **Be concise**: remove repetition and background that does not help the user complete a task.
+2. **Be actionable**: prioritize “what to do” over theory.
+3. **One source of truth**: if another page already has details, link to it instead of duplicating.
+4. **Preserve structure**: keep valid frontmatter and heading anchor IDs.
+5. **Keep examples copyable**: minimal, tested-looking, and directly relevant.
+6. **Search before writing**: always check if the content already exists in some form before adding new sections or pages.
+7. **Check Relevant Code**: Search the codebase inside `src/` for any relevant code, comments, or tests that can inform the documentation content and ensure accuracy.
+
+## Docs config model (current)
+
+`docs.json` is versioned. Sidebar lives inside tabs:
+
+- `versions[].content.navigation.tabs[].sidebar`
+- Sidebar groups contain `pages`
+- Page paths use `content` (legacy `slug` may still appear in older content)
+
+When adding a new doc page, add it to the appropriate tab sidebar path.
+
+## Versioned link policy (mandatory)
+
+- For v4 docs content, internal links MUST use explicit v4 paths: `/docs/v4/...`.
+- Do not use unversioned shortcuts like `/docs/alerting/...` in v4 pages.
+- Before finalizing, verify every internal link in edited files resolves to the intended version.
+
+## Required page format
+
+```markdown
+---
+title: Page Title
+description: One-line summary of user outcome
+---
+```
+
+- Use custom anchors for H2/H3 headings: `## Section {#section}`
+- Use GitHub admonitions only when needed: `[!NOTE]`, `[!IMPORTANT]`, `[!WARNING]`, `[!CAUTION]`, `[!TIP]`
+- Prefer short sections and short lists
+
+## Preferred structure (default)
+
+1. Short intro (1–2 sentences)
+2. Quick setup / minimum config
+3. Required variables/options table
+4. Verification step
+5. Top troubleshooting items
+
+Only add extra sections if they materially improve task completion.
+
+## Keep docs lean
+
+Remove or avoid:
+
+- Multiple near-identical examples
+- Long conceptual explainers
+- Platform-by-platform repetition unless behavior differs
+- Large checklists that restate earlier content
+
+## Editing workflow
+
+1. Read the whole target document.
+2. Compress verbose sections first.
+3. Keep critical caveats and breaking notes.
+4. Ensure internal links and anchors still work.
+5. If adding files, update `docs.json` navigation in the correct version/tab.
+
+## Review checklist
+
+- [ ] Title/description frontmatter exists
+- [ ] Key steps are clear and copyable
+- [ ] Content is concise and non-duplicative
+- [ ] Headings keep stable custom anchors
+- [ ] Navigation updated (if new page)
+- [ ] Internal links point to correct paths
+- [ ] v4 pages use `/docs/v4/...` internal links (no unversioned `/docs/...` shortcuts)
+- [ ] No outdated or irrelevant content remains
+- [ ] Admonitions used appropriately for important notes

.claude/skills/ss-shadcn-svelte

@@ -0,0 +1 @@
+../../.agents/skills/ss-shadcn-svelte

.claude/skills/svelte-code-writer/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: svelte-code-writer
+description: CLI tools for Svelte 5 documentation lookup and code analysis. MUST be used whenever creating or editing any Svelte component (.svelte) or Svelte module (.svelte.ts/.svelte.js). If possible, this skill should be executed within the svelte-file-editor agent for optimal results.
+---
+
+# Svelte 5 Code Writer
+
+## CLI Tools
+
+You have access to `@sveltejs/mcp` CLI for Svelte-specific assistance. Use these commands via `npx`:
+
+### List Documentation Sections
+
+```bash
+npx @sveltejs/mcp list-sections
+```
+
+Lists all available Svelte 5 and SvelteKit documentation sections with titles and paths.
+
+### Get Documentation
+
+```bash
+npx @sveltejs/mcp get-documentation "<section1>,<section2>,..."
+```
+
+Retrieves full documentation for specified sections. Use after `list-sections` to fetch relevant docs.
+
+**Example:**
+
+```bash
+npx @sveltejs/mcp get-documentation "$state,$derived,$effect"
+```
+
+### Svelte Autofixer
+
+```bash
+npx @sveltejs/mcp svelte-autofixer "<code_or_path>" [options]
+```
+
+Analyzes Svelte code and suggests fixes for common issues.
+
+**Options:**
+
+- `--async` - Enable async Svelte mode (default: false)
+- `--svelte-version` - Target version: 4 or 5 (default: 5)
+
+**Examples:**
+
+```bash
+# Analyze inline code (escape $ as \$)
+npx @sveltejs/mcp svelte-autofixer '<script>let count = \$state(0);</script>'
+
+# Analyze a file
+npx @sveltejs/mcp svelte-autofixer ./src/lib/Component.svelte
+
+# Target Svelte 4
+npx @sveltejs/mcp svelte-autofixer ./Component.svelte --svelte-version 4
+```
+
+**Important:** When passing code with runes (`$state`, `$derived`, etc.) via the terminal, escape the `$` character as `\$` to prevent shell variable substitution.
+
+## Workflow
+
+1. **Uncertain about syntax?** Run `list-sections` then `get-documentation` for relevant topics
+2. **Reviewing/debugging?** Run `svelte-autofixer` on the code to detect issues
+3. **Always validate** - Run `svelte-autofixer` before finalizing any Svelte component

.claude/skills/tailwindcss/SKILL.md

@@ -0,0 +1,361 @@
+---
+name: tailwindcss
+description: Tailwind CSS v4 utility-first styling patterns including responsive design, dark mode, and custom configuration. Use when styling with Tailwind, adding utility classes, configuring Tailwind, setting up dark mode, or customizing the theme.
+user-invokable: false
+metadata:
+    category: styling
+---
+
+# Tailwind CSS v4 Development Guidelines
+
+Best practices for using Tailwind CSS v4 utility classes effectively.
+
+**Note**: Tailwind CSS v4 (released January 2025) uses a CSS-first configuration approach. If you need v3 compatibility, tailwind.config.js is still supported.
+
+## Core Principles
+
+1. **Utility-First**: Use utility classes instead of custom CSS
+2. **Mobile-First**: Design for mobile, then scale up with responsive modifiers
+3. **Component Extraction**: Extract repeated patterns into components
+4. **Consistent Spacing**: Use Tailwind's spacing scale
+5. **Custom Configuration**: Extend the default theme for brand consistency
+
+## Basic Utilities
+
+### Layout
+
+```tsx
+// Flexbox
+<div className="flex items-center justify-between gap-4">
+  <div className="flex-1">Content</div>
+  <div className="flex-shrink-0">Sidebar</div>
+</div>
+
+// Grid
+<div className="grid grid-cols-3 gap-4">
+  <div>1</div>
+  <div>2</div>
+  <div>3</div>
+</div>
+
+// Positioning
+<div className="relative">
+  <div className="absolute top-0 right-0">Badge</div>
+</div>
+```
+
+### Spacing
+
+```tsx
+// Padding and Margin
+<div className="p-4 m-2">           {/* padding: 1rem, margin: 0.5rem */}
+<div className="px-6 py-4">        {/* padding-x: 1.5rem, padding-y: 1rem */}
+<div className="mt-8 mb-4">        {/* margin-top: 2rem, margin-bottom: 1rem */}
+
+// Space between children
+<div className="space-y-4">        {/* margin-bottom on all but last child */}
+  <div>Item 1</div>
+  <div>Item 2</div>
+</div>
+```
+
+### Typography
+
+```tsx
+<h1 className="text-4xl font-bold text-gray-900">Heading</h1>
+<p className="text-base font-normal text-gray-600 leading-relaxed">
+  Paragraph text with comfortable line height.
+</p>
+<span className="text-sm font-medium text-blue-600">Label</span>
+```
+
+### Colors
+
+```tsx
+// Text colors
+<p className="text-gray-900 dark:text-gray-100">Text</p>
+
+// Background colors
+<div className="bg-blue-500 hover:bg-blue-600">Button</div>
+
+// Border colors
+<div className="border border-gray-300">Box</div>
+```
+
+## Responsive Design
+
+### Breakpoints
+
+```tsx
+// Mobile-first responsive classes
+<div className="w-full md:w-1/2 lg:w-1/3">
+  {/* Full width on mobile, half on medium screens, third on large */}
+</div>
+
+<h1 className="text-2xl md:text-4xl lg:text-6xl">
+  {/* Responsive text sizes */}
+</h1>
+
+<div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-4">
+  {/* Responsive grid */}
+</div>
+```
+
+### Container
+
+```tsx
+<div className="container mx-auto px-4">
+  {/* Centered container with horizontal padding */}
+</div>
+
+<div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
+  {/* Responsive container padding */}
+</div>
+```
+
+## Component Patterns
+
+### Button
+
+```tsx
+<button className="px-4 py-2 bg-blue-600 text-white font-medium rounded-md hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors">
+  Click me
+</button>
+
+// Variants
+<button className="px-4 py-2 border border-gray-300 rounded-md hover:bg-gray-50">
+  Secondary
+</button>
+```
+
+### Card
+
+```tsx
+<div className="overflow-hidden rounded-lg bg-white shadow-md">
+    <img src="/image.jpg" alt="" className="h-48 w-full object-cover" />
+    <div className="p-6">
+        <h2 className="mb-2 text-xl font-semibold">Card Title</h2>
+        <p className="text-gray-600">Card content goes here.</p>
+    </div>
+</div>
+```
+
+### Form Input
+
+```tsx
+<div className="space-y-2">
+    <label htmlFor="email" className="block text-sm font-medium text-gray-700">
+        Email
+    </label>
+    <input
+        type="email"
+        id="email"
+        className="w-full rounded-md border border-gray-300 px-3 py-2 focus:border-transparent focus:ring-2 focus:ring-blue-500 focus:outline-none"
+        placeholder="you@example.com"
+    />
+    <p className="text-sm text-gray-500">We'll never share your email.</p>
+</div>
+```
+
+## State Variants
+
+### Hover, Focus, Active
+
+```tsx
+<button className="bg-blue-500 hover:bg-blue-600 active:bg-blue-700 focus:ring-2 focus:ring-blue-500">
+  Interactive Button
+</button>
+
+<a href="#" className="text-blue-600 hover:text-blue-800 hover:underline">
+  Link
+</a>
+```
+
+### Group Hover
+
+```tsx
+<div className="group">
+    <img src="/image.jpg" className="transition-opacity group-hover:opacity-75" />
+    <p className="group-hover:text-blue-600">Hover the container</p>
+</div>
+```
+
+### Disabled
+
+```tsx
+<button className="disabled:cursor-not-allowed disabled:opacity-50" disabled>
+    Disabled Button
+</button>
+```
+
+## Dark Mode
+
+```css
+/* Tailwind v4: Configure in app/globals.css */
+@import "tailwindcss";
+
+@media (prefers-color-scheme: dark) {
+    /* Or use class-based: .dark */
+}
+```
+
+```tsx
+// Usage (same as v3)
+<div className="bg-white text-gray-900 dark:bg-gray-900 dark:text-gray-100">
+    <h1 className="text-gray-900 dark:text-white">Title</h1>
+    <p className="text-gray-600 dark:text-gray-400">Description</p>
+</div>
+```
+
+## Custom Styles
+
+### Arbitrary Values
+
+```tsx
+<div className="top-[117px]">           {/* Custom top value */}
+<div className="bg-[#1da1f2]">          {/* Custom color */}
+<div className="grid-cols-[200px_1fr]"> {/* Custom grid template */}
+```
+
+### @apply Directive
+
+```css
+/* components/button.css */
+.btn-primary {
+    @apply rounded-md bg-blue-600 px-4 py-2 font-medium text-white;
+    @apply hover:bg-blue-700 focus:ring-2 focus:ring-blue-500 focus:outline-none;
+    @apply disabled:cursor-not-allowed disabled:opacity-50;
+}
+```
+
+## Configuration
+
+### Tailwind v4: CSS-First Configuration
+
+```css
+/* app/globals.css */
+@import "tailwindcss";
+
+@theme {
+    /* Custom colors */
+    --color-brand-50: #eff6ff;
+    --color-brand-100: #dbeafe;
+    --color-brand-900: #1e3a8a;
+
+    /* Custom spacing */
+    --spacing-128: 32rem;
+
+    /* Custom fonts */
+    --font-family-sans: "Inter", sans-serif;
+
+    /* Custom breakpoints */
+    --breakpoint-3xl: 1920px;
+}
+```
+
+### Tailwind v3 Config (Still Supported)
+
+```javascript
+// tailwind.config.js (optional in v4)
+module.exports = {
+    content: ["./app/**/*.{js,ts,jsx,tsx,mdx}", "./components/**/*.{js,ts,jsx,tsx,mdx}"],
+    theme: {
+        extend: {
+            colors: {
+                brand: {
+                    50: "#eff6ff",
+                    100: "#dbeafe",
+                    900: "#1e3a8a"
+                }
+            },
+            spacing: {
+                128: "32rem"
+            },
+            fontFamily: {
+                sans: ["Inter", "sans-serif"]
+            }
+        }
+    },
+    plugins: [require("@tailwindcss/forms"), require("@tailwindcss/typography")]
+}
+```
+
+## Plugins
+
+### Official Plugins
+
+```bash
+npm install @tailwindcss/forms
+npm install @tailwindcss/typography
+npm install @tailwindcss/aspect-ratio
+npm install @tailwindcss/container-queries
+```
+
+```tsx
+// @tailwindcss/forms
+<input type="text" className="form-input rounded-md" />
+
+// @tailwindcss/typography
+<article className="prose lg:prose-xl">
+  <h1>Article Title</h1>
+  <p>Content...</p>
+</article>
+```
+
+## Performance
+
+### Automatic Content Detection
+
+Tailwind v4 automatically detects and scans all template files - no `content` configuration needed.
+
+### Build Performance
+
+Tailwind v4 delivers 3.5x faster full builds (~100ms) compared to v3 using modern CSS features like `@property` and `color-mix()`.
+
+**Browser Requirements**: Safari 16.4+, Chrome 111+, Firefox 128+
+
+## Common Patterns
+
+### Centered Content
+
+```tsx
+<div className="flex min-h-screen items-center justify-center">
+    <div>Centered content</div>
+</div>
+```
+
+### Sticky Header
+
+```tsx
+<header className="sticky top-0 z-50 border-b bg-white">
+    <nav>Navigation</nav>
+</header>
+```
+
+### Grid Layout
+
+```tsx
+<div className="grid grid-cols-1 gap-6 md:grid-cols-2 lg:grid-cols-3">
+    {posts.map((post) => (
+        <PostCard key={post.id} post={post} />
+    ))}
+</div>
+```
+
+### Truncate Text
+
+```tsx
+<p className="truncate">This text will be truncated with ellipsis if too long</p>
+<p className="line-clamp-3">This text will show max 3 lines with ellipsis</p>
+```
+
+## Best Practices
+
+1. **Use Consistent Spacing**: Stick to Tailwind's spacing scale
+2. **Responsive by Default**: Always consider mobile-first design
+3. **Extract Components**: Avoid repeating long class lists
+4. **Use Theme Colors**: Define custom colors in config, not arbitrary values
+5. **Leverage @apply Sparingly**: Prefer utility classes in JSX
+6. **Enable Dark Mode**: Plan for dark mode from the start
+7. **Use Plugins**: Leverage official plugins for common needs
+8. **Optimize Production**: Ensure purge is configured correctly

.dockerignore

@@ -1,9 +1,51 @@
+# Dependencies
 node_modules
+
+# Version control
 .git
 .github
+
+# IDE and editor
 .vscode
-dist
+.idea
+*.swp
+*.swo
+
+# Build outputs (rebuilt inside Docker)
 build
+dist
+.svelte-kit
+.docs-excluded
+
+# Environment and secrets
 .env
+.env.*
+!.env.example
+
+# OS files
 .DS_Store
-*.log
+Thumbs.db
+
+# Logs
+*.log
+npm-debug.log*
+
+# Docker files (prevent recursive context)
+Dockerfile
+docker-compose*.yml
+.dockerignore
+
+# Documentation and meta
+README.md
+README.template.md
+AGENTS.md
+CHANGELOG.md
+LICENSE
+check-output.txt
+
+# AI / tooling config
+.claude
+
+# Test artifacts
+*.test.*
+*.spec.*

.editorconfig

@@ -43,6 +43,7 @@ indent_size = 2
 indent_style = space
 indent_size = 4
 trim_trailing_whitespace = false
+print_width = 180
 
 # Dockerfile
 [Dockerfile*]

.env-min.example

@@ -0,0 +1,3 @@
+KENER_SECRET_KEY=some_secret_key_for_kener
+REDIS_URL=redis://localhost:6379
+ORIGIN=http://localhost:3000

.env.example

@@ -1,26 +0,0 @@
-TZ=Etc/UTC
-KENER_SECRET_KEY=please_change_me_to_something_secure
-
-# For SQLite database...
-DATABASE_URL=sqlite://./database/kener.sqlite.db
-
-# For PostgreSQL database...
-# DATABASE_URL=postgresql://db_user:db_password@localhost:5432/kener_db
-# POSTGRES_PASSWORD=some_super_random_secure_password
-
-# For MySQL database...
-# DATABASE_URL=mysql://db_user:db_password@127.0.0.1:3306/kener_db
-# MYSQL_PASSWORD=some_super_random_secure_password
-
-KENER_BASE_PATH=""
-ORIGIN=http://localhost:3000
-
-RESEND_API_KEY=""
-RESEND_SENDER_EMAIL=Accounts <accounts@resend.dev>
-
-# Likely no need to change...
-# NODE_ENV=production   # already defined in container
-# PORT=3000   # default port Kener service is exposed upon
-
-# Add the below variable if you would like to ‘white-label’ the product (aka. remove some of the attributions scattered throughout the app)
-# WHITE_LABEL=true

.github/ISSUE_TEMPLATE/create-incident-template.md

@@ -1,13 +0,0 @@
----
-name: Create Incident Template
-about: Create Incident Template
-title: Title of Incident
-labels: incident
-assignees: ''
-
----
-
-Your Incident Description goes here. Markdown Supported
-
-[start_datetime:utcSeconds]
-[end_datetime:utcSeconds]

.github/ISSUE_TEMPLATE/kener-v4-items.md

@@ -0,0 +1,10 @@
+---
+name: Kener v4 items
+about: Kener v4 items
+title: ''
+labels: kener_v4
+assignees: rajnandan1
+
+---
+
+Kener v4 items

.github/copilot-api-instructions.md

@@ -0,0 +1,428 @@
+# Kener API Development Instructions
+
+This document provides guidelines for creating new API endpoints in Kener. Follow these patterns to maintain consistency across all APIs.
+
+## API Architecture Overview
+
+### Directory Structure
+```
+src/routes/(api)/api/
+├── {resource}/
+│   ├── +server.ts              # GET (list), POST (create)
+│   └── [{resource}_id]/
+│       ├── +server.ts          # GET, PATCH, DELETE (single resource)
+│       └── {sub-resource}/
+│           ├── +server.ts      # GET (list), POST (create)
+│           └── [{sub_id}]/
+│               └── +server.ts  # GET, PATCH, DELETE (single sub-resource)
+```
+
+### Key Files
+- **Types**: `src/lib/types/api.ts` - All API request/response types (snake_case)
+- **Middleware**: `src/hooks.server.ts` - Authentication and resource validation
+- **App Locals**: `src/app.d.ts` - TypeScript declarations for `event.locals`
+- **Repository**: `src/lib/server/db/repositories/*.ts` - Database operations
+- **DbImpl**: `src/lib/server/db/dbimpl.ts` - Bindings for repository methods
+
+### Current Locals (set by middleware in `hooks.server.ts`)
+```typescript
+interface Locals {
+  user?: SessionUser;                // Auth session
+  monitor?: MonitorRecordTyped;      // /api/monitors/:monitor_tag/*
+  incident?: IncidentRecord;         // /api/incidents/:incident_id/*
+  maintenance?: MaintenanceRecord;   // /api/maintenances/:maintenance_id/*
+  page?: PageRecord;                 // /api/pages/:page_path/*
+}
+```
+
+## Naming Conventions
+
+### Use snake_case for API payloads
+```typescript
+// Correct
+interface CreateMonitorRequest {
+  monitor_tag: string;
+  start_date_time: number;
+  duration_seconds: number;
+}
+
+// Wrong
+interface CreateMonitorRequest {
+  monitorTag: string;
+  startDateTime: number;
+  durationSeconds: number;
+}
+```
+
+### Type Naming Pattern
+```typescript
+// List response
+interface Get{Resource}sListResponse {
+  {resources}: {Resource}Response[];
+}
+
+// Single resource response
+interface Get{Resource}Response {
+  {resource}: {Resource}DetailResponse;
+}
+
+// Create request/response
+interface Create{Resource}Request { ... }
+interface Create{Resource}Response {
+  {resource}: {Resource}Response;
+}
+
+// Update request/response
+interface Update{Resource}Request { ... }
+interface Update{Resource}Response {
+  {resource}: {Resource}Response;
+}
+
+// Delete response
+interface Delete{Resource}Response {
+  message: string;
+}
+
+// Error responses (reuse existing)
+interface BadRequestResponse { error: { code: string; message: string; } }
+interface NotFoundResponse { error: { code: string; message: string; } }
+interface UnauthorizedResponse { error: { code: string; message: string; } }
+```
+
+## Middleware Pattern
+
+### 1. Add Route Regex Pattern in `hooks.server.ts`
+```typescript
+const RESOURCE_ID_ROUTE_REGEX = /^\/api\/resources\/(\d+)/;
+
+function extractResourceId(pathname: string): number | null {
+  const match = pathname.match(RESOURCE_ID_ROUTE_REGEX);
+  return match ? parseInt(match[1], 10) : null;
+}
+```
+
+### 2. Add Validation Block in `handle()` Function
+```typescript
+// Validate resource_id exists for /api/resources/:resource_id/* routes
+const resourceId = extractResourceId(pathname);
+if (resourceId) {
+  const resource = await db.getResourceById(resourceId);
+  if (!resource) {
+    const errorResponse: NotFoundResponse = {
+      error: {
+        code: "NOT_FOUND",
+        message: `Resource with id '${resourceId}' not found`,
+      },
+    };
+    return json(errorResponse, { status: 404 });
+  }
+  // Store resource in locals for use in endpoints
+  event.locals.resource = resource;
+}
+```
+
+### 3. Declare in `app.d.ts`
+```typescript
+interface Locals {
+  // Set by hooks.server.ts for /api/resources/:resource_id/* routes
+  resource?: import("$lib/server/types/db").ResourceRecord;
+}
+```
+
+## Endpoint Implementation Pattern
+
+### GET (List)
+```typescript
+import { json, type RequestHandler } from "@sveltejs/kit";
+import db from "$lib/server/db/db";
+import type { GetResourcesListResponse, ResourceResponse } from "$lib/types/api";
+
+function formatDateToISO(date: Date | string): string {
+  if (date instanceof Date) return date.toISOString();
+  const parsed = new Date(date.replace(" ", "T") + "Z");
+  return parsed.toISOString();
+}
+
+export const GET: RequestHandler = async ({ url }) => {
+  // Parse query params for filtering
+  const statusParam = url.searchParams.get("status");
+  const pageParam = url.searchParams.get("page");
+  const limitParam = url.searchParams.get("limit");
+
+  const page = pageParam ? Math.max(1, parseInt(pageParam, 10) || 1) : 1;
+  const limit = limitParam ? Math.min(100, Math.max(1, parseInt(limitParam, 10) || 20)) : 20;
+
+  // Build filter
+  const filter: { status?: string } = {};
+  if (statusParam) filter.status = statusParam;
+
+  // Query database
+  const rawResources = await db.getResourcesPaginated(page, limit, filter);
+
+  // Transform to response format
+  const resources: ResourceResponse[] = rawResources.map((r) => ({
+    id: r.id,
+    name: r.name,
+    created_at: formatDateToISO(r.created_at),
+    updated_at: formatDateToISO(r.updated_at),
+  }));
+
+  const response: GetResourcesListResponse = { resources };
+  return json(response);
+};
+```
+
+### POST (Create)
+```typescript
+export const POST: RequestHandler = async ({ request }) => {
+  let body: CreateResourceRequest;
+
+  try {
+    body = await request.json();
+  } catch {
+    const errorResponse: BadRequestResponse = {
+      error: { code: "BAD_REQUEST", message: "Invalid JSON body" },
+    };
+    return json(errorResponse, { status: 400 });
+  }
+
+  // Validate required fields
+  if (!body.name || typeof body.name !== "string" || body.name.trim().length === 0) {
+    const errorResponse: BadRequestResponse = {
+      error: { code: "BAD_REQUEST", message: "name is required and must be a non-empty string" },
+    };
+    return json(errorResponse, { status: 400 });
+  }
+
+  // Normalize timestamps using helper
+  const normalizedTimestamp = GetMinuteStartTimestampUTC(body.start_date_time);
+
+  // Create resource
+  const created = await db.createResource({
+    name: body.name.trim(),
+    start_date_time: normalizedTimestamp,
+  });
+
+  // Build response
+  const resourceResponse = await buildResourceResponse(created.id);
+  const response: CreateResourceResponse = { resource: resourceResponse };
+  return json(response, { status: 201 });
+};
+```
+
+### GET (Single) - Uses Middleware
+```typescript
+export const GET: RequestHandler = async ({ locals }) => {
+  // Resource is validated by middleware and available in locals
+  const resource = locals.resource!;
+
+  const resourceResponse = await buildResourceResponse(resource.id);
+  const response: GetResourceResponse = { resource: resourceResponse };
+  return json(response);
+};
+```
+
+### PATCH (Update) - Uses Middleware
+```typescript
+export const PATCH: RequestHandler = async ({ locals, request }) => {
+  const existingResource = locals.resource!;
+
+  let body: UpdateResourceRequest;
+  try {
+    body = await request.json();
+  } catch {
+    return json({ error: { code: "BAD_REQUEST", message: "Invalid JSON body" } }, { status: 400 });
+  }
+
+  // Validate fields if provided
+  if (body.status !== undefined && !["ACTIVE", "INACTIVE"].includes(body.status)) {
+    return json({ error: { code: "BAD_REQUEST", message: "status must be 'ACTIVE' or 'INACTIVE'" } }, { status: 400 });
+  }
+
+  // Build update data - only include fields present in request
+  const updateData: Record<string, unknown> = {};
+  if (body.name !== undefined) updateData.name = body.name.trim();
+  if (body.status !== undefined) updateData.status = body.status;
+
+  // Update if there's data to update
+  if (Object.keys(updateData).length > 0) {
+    await db.updateResource(existingResource.id, updateData);
+  }
+
+  const resourceResponse = await buildResourceResponse(existingResource.id);
+  const response: UpdateResourceResponse = { resource: resourceResponse };
+  return json(response);
+};
+```
+
+### DELETE - Uses Middleware
+```typescript
+export const DELETE: RequestHandler = async ({ locals }) => {
+  const resource = locals.resource!;
+
+  // Delete related records first (cascade)
+  await db.deleteResourceRelatedRecords(resource.id);
+
+  // Delete the resource itself
+  await db.deleteResource(resource.id);
+
+  const response: DeleteResourceResponse = {
+    message: `Resource with id '${resource.id}' deleted successfully`,
+  };
+  return json(response);
+};
+```
+
+## Timestamp Handling
+
+### Always normalize timestamps
+```typescript
+import { GetMinuteStartTimestampUTC, GetNowTimestampUTC } from "$lib/server/tool";
+
+// For user-provided timestamps - normalize to minute start
+const normalizedTs = GetMinuteStartTimestampUTC(body.start_date_time);
+
+// For current time (when timestamp is optional)
+const now = GetNowTimestampUTC();
+
+// For optional timestamp with fallback
+const timestamp = body.timestamp !== undefined
+  ? GetMinuteStartTimestampUTC(body.timestamp)
+  : GetMinuteStartNowTimestampUTC();
+```
+
+## Validation Patterns
+
+### Required Field Validation
+```typescript
+if (body.field === undefined || body.field === null) {
+  return json({ error: { code: "BAD_REQUEST", message: "field is required" } }, { status: 400 });
+}
+```
+
+### Type Validation
+```typescript
+if (typeof body.count !== "number" || isNaN(body.count) || body.count <= 0) {
+  return json({ error: { code: "BAD_REQUEST", message: "count must be a positive number" } }, { status: 400 });
+}
+```
+
+### Enum Validation
+```typescript
+const VALID_STATUSES = ["ACTIVE", "INACTIVE"];
+if (body.status && !VALID_STATUSES.includes(body.status)) {
+  return json({
+    error: { code: "BAD_REQUEST", message: `status must be one of: ${VALID_STATUSES.join(", ")}` }
+  }, { status: 400 });
+}
+```
+
+### Foreign Key Validation
+```typescript
+if (body.monitor_tag) {
+  const monitor = await db.getMonitorByTag(body.monitor_tag);
+  if (!monitor) {
+    return json({
+      error: { code: "BAD_REQUEST", message: `Monitor with tag '${body.monitor_tag}' not found` }
+    }, { status: 400 });
+  }
+}
+```
+
+### Array Validation
+```typescript
+if (body.items !== undefined) {
+  if (!Array.isArray(body.items)) {
+    return json({ error: { code: "BAD_REQUEST", message: "items must be an array" } }, { status: 400 });
+  }
+
+  for (const item of body.items) {
+    if (!item.tag || typeof item.tag !== "string") {
+      return json({ error: { code: "BAD_REQUEST", message: "Each item must have a valid tag" } }, { status: 400 });
+    }
+  }
+}
+```
+
+## Adding Repository Methods
+
+### 1. Add Method to Repository Class
+```typescript
+// In src/lib/server/db/repositories/{resource}.ts
+async getResourcesWithDetails(options: {
+  page: number;
+  limit: number;
+  filter?: { status?: string };
+}): Promise<{ resources: ResourceRecord[]; total: number }> {
+  // Implementation
+}
+```
+
+### 2. Declare Method Type in DbImpl
+```typescript
+// In src/lib/server/db/dbimpl.ts - declarations section
+getResourcesWithDetails!: ResourceRepository["getResourcesWithDetails"];
+```
+
+### 3. Bind Method in DbImpl Constructor
+```typescript
+// In src/lib/server/db/dbimpl.ts - bindResourceMethods()
+this.getResourcesWithDetails = this.resources.getResourcesWithDetails.bind(this.resources);
+```
+
+## Common Imports
+```typescript
+import { json, type RequestHandler } from "@sveltejs/kit";
+import db from "$lib/server/db/db";
+import type {
+  Get{Resource}Response,
+  Create{Resource}Request,
+  Create{Resource}Response,
+  Update{Resource}Request,
+  Update{Resource}Response,
+  Delete{Resource}Response,
+  BadRequestResponse,
+  NotFoundResponse,
+} from "$lib/types/api";
+import { GetMinuteStartTimestampUTC, GetNowTimestampUTC } from "$lib/server/tool";
+```
+
+## Response Status Codes
+- `200` - GET success, PATCH success, DELETE success
+- `201` - POST success (resource created)
+- `400` - Bad Request (validation errors)
+- `401` - Unauthorized (no/invalid token)
+- `404` - Not Found (resource doesn't exist)
+- `500` - Internal Server Error
+
+## Testing with cURL
+```bash
+# List
+curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/resources
+
+# Create
+curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  -d '{"name":"Test","start_date_time":1735689600}' \
+  http://localhost:3000/api/resources
+
+# Get single
+curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/resources/1
+
+# Update
+curl -X PATCH -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  -d '{"name":"Updated"}' \
+  http://localhost:3000/api/resources/1
+
+# Delete
+curl -X DELETE -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/resources/1
+```
+
+## Checklist for New API
+
+1. [ ] Define types in `src/lib/types/api.ts`
+2. [ ] Add middleware validation in `src/hooks.server.ts` (if resource has ID routes)
+3. [ ] Update `src/app.d.ts` with locals type
+4. [ ] Create endpoint files in `src/routes/(api)/api/{resource}/`
+5. [ ] Add repository methods if needed
+6. [ ] Bind repository methods in DbImpl
+7. [ ] Test all endpoints with cURL

.github/copilot-instructions.md

@@ -0,0 +1,144 @@
+# Kener - AI Coding Instructions
+
+## Project Overview
+
+Kener is an open-source status page application built with **SvelteKit 2.x** (**Svelte 5**) and **Node.js/Express**. It is a **TypeScript-first** codebase providing real-time monitoring, uptime tracking, incident management, and customizable dashboards.
+
+## Architecture
+
+### Dual Process Model
+
+In development, `npm run dev` runs two parallel processes:
+1. **SvelteKit dev server** (`vite dev`) - serves the frontend with HMR
+2. **Cron scheduler** (`vite-node src/lib/server/startup.ts`) - runs monitor checks, maintenance scheduling, daily cleanup
+
+In production, **`scripts/main.ts`** is the single entry point: Express server + SvelteKit handler + migrations + seeds + scheduler startup. Built output runs via `node build/main.js`.
+
+### Route Groups (SvelteKit)
+- **`(kener)/`** - Public status page routes
+- **`(manage)/`** - Admin dashboard (requires authentication)
+- **`(embed)/`** - Embeddable widgets
+- **`(docs)/`** - Documentation pages
+- **`(api)/`** - SvelteKit API routes
+- **`(account)/`** - Account/auth pages
+- **`(ext)/`** - External integrations
+- **`(assets)/`** - Asset serving
+
+### Core Server Components
+- **`src/lib/server/controllers/`** - Domain-split controllers (18 TypeScript files): `apiController.ts`, `incidentController.ts`, `monitorsController.ts`, `maintenanceController.ts`, `pagesController.ts`, `userController.ts`, `dashboardController.ts`, `emailController.ts`, `siteDataController.ts`, `validators.ts`, etc.
+- **`src/lib/server/db/dbimpl.ts`** - Database abstraction layer using Knex.js with repository composition pattern
+- **`src/lib/server/db/repositories/`** - Domain-driven repositories: `monitors.ts`, `incidents.ts`, `maintenances.ts`, `pages.ts`, `users.ts`, `alerts.ts`, `monitoring.ts`, `images.ts`, `subscriptionSystem.ts`, `emailTemplateConfig.ts`, `monitorAlertConfig.ts`, `site-data.ts`
+- **`src/lib/server/services/`** - Monitor type implementations (all TypeScript): `apiCall.ts`, `pingCall.ts`, `tcpCall.ts`, `dnsCall.ts`, `sslCall.ts`, `sqlCall.ts`, `heartbeatCall.ts`, `gamedigCall.ts`, `groupCall.ts`, `grpcCall.ts`, `noneCall.ts`
+- **`src/lib/server/schedulers/`** - Scheduling via `croner`: `appScheduler.ts`, `monitorSchedulers.ts`, `maintenanceScheduler.ts`, `dailyCleanup.ts`, `shutdown.ts`
+- **`src/lib/server/queues/`** - Job queues via **BullMQ** + **Redis**: `monitorExecuteQueue.ts`, `monitorResponseQueue.ts`, `alertingQueue.ts`, `emailQueue.ts`, `subscriberQueue.ts`
+- **`src/lib/server/api-server/`** - Express-side API handlers with file-based routing (directory/method pattern: e.g., `monitor-bar/get.ts`)
+- **`src/lib/server/cron-minute.ts`** - Per-monitor cron execution logic
+
+### Database
+- Supports SQLite (default), PostgreSQL, MySQL via **Knex.js**
+- Connection string format: `sqlite://./path` or `postgresql://...` or `mysql://...`
+- Migrations in `/migrations/`, seeds in `/seeds/`
+- Run migrations: `npm run migrate` or auto-runs on `npm start`
+
+### Build System
+`npm run build` is a two-step process:
+1. `scripts/build-sveltekit.js` - Vite build of SvelteKit app (optionally with `--with-docs`)
+2. `scripts/build-server.js` - esbuild bundles `scripts/main.ts` into `build/main.js`
+
+## Development Commands
+
+```bash
+npm run dev          # Start dev server (SvelteKit + cron scheduler in parallel)
+npm run build        # Production build (SvelteKit then esbuild server bundle)
+npm run start        # Run production build (node build/main.js)
+npm run check        # Svelte + TypeScript type checking
+npm run prettify     # Format all files with Prettier
+npm run migrate      # Run database migrations via Knex
+npm run seed         # Run database seeds
+```
+
+## Key Patterns
+
+### Svelte 5 + TypeScript conventions
+- Use **TypeScript** for all code (`.ts`, and `.svelte` with `lang="ts"`).
+- Use **Svelte 5 runes** (`$state`, `$derived`, `$effect`, `$props()`) in components.
+- For SvelteKit route typing, use generated `$types` (e.g. `import type { PageServerLoad } from './$types'`).
+- Avoid packages that hard-require Svelte 4.
+
+### Monitor Types
+Defined in `src/lib/server/services/service.ts`. Each type has its own implementation file:
+```typescript
+// Supported: API, PING, TCP, DNS, GROUP, SSL, SQL, HEARTBEAT, GAMEDIG, GRPC, NONE
+```
+
+### Status Constants
+Use constants from `src/lib/global-constants.ts`:
+```typescript
+// In Svelte/client code:
+import { UP, DOWN, DEGRADED, MAINTENANCE, NO_DATA } from "$lib/global-constants";
+
+// In server code (use relative path):
+import { UP, DOWN, DEGRADED, MAINTENANCE, NO_DATA } from "./global-constants";
+```
+
+### API Authentication
+APIs use Bearer token auth verified via `VerifyAPIKey()`:
+```typescript
+import { VerifyAPIKey } from "$lib/server/controllers/apiController";
+```
+
+### Database Queries
+Always use the db singleton, never instantiate Knex directly:
+```typescript
+import db from "$lib/server/db/db";
+const monitor = await db.getMonitorByTag(tag);
+```
+
+### Timestamps
+All timestamps are **UTC seconds** (not milliseconds). Use helpers from `src/lib/server/tool.ts`:
+```typescript
+import { GetMinuteStartTimestampUTC, GetNowTimestampUTC } from "$lib/server/tool";
+```
+
+### i18n
+21 locale files in `src/lib/locales/` (en, de, fr, es, hi, ja, ko, zh-CN, zh-TW, pt-BR, ru, etc.). Add new translations by creating `{code}.json` and updating `locales.json`.
+
+## UI Components
+
+Uses **shadcn-svelte** components in `src/lib/components/ui/` (40+ components). Import pattern:
+```typescript
+import { Button } from "$lib/components/ui/button";
+```
+
+Styling: **Tailwind CSS v4** with CSS-based configuration (no `tailwind.config.js`). Theme uses HSL CSS variables defined in `src/routes/layout.css`.
+
+## Environment Variables
+
+Required:
+- `KENER_SECRET_KEY` - Secret key for auth
+- `ORIGIN` - Site URL (e.g., `http://localhost:3000`)
+- `REDIS_URL` - Redis connection string (required for BullMQ job queues)
+
+Optional:
+- `DATABASE_URL` - Database connection string (defaults to SQLite)
+- `KENER_BASE_PATH` - Base path for reverse proxy
+- `PORT` - Server port (default 3000)
+- `RESEND_API_KEY` / `RESEND_SENDER_EMAIL` - Email notifications
+
+## File Conventions
+
+- Server-only code: `src/lib/server/`
+- Shared utilities: `src/lib/` (except `server/`)
+- Client utilities: `src/lib/client/`
+- Route data loading: `+page.server.ts` / `+layout.server.ts`
+- API endpoints: `+server.ts` files returning `json()`
+
+## Types & Interfaces
+
+Place types and interfaces in the appropriate folder based on where they are used:
+
+- **`src/lib/types/`** - Shared types (safe to import from both server and client code). Use for domain models, DTOs, API response types, and anything needed on both sides.
+- **`src/lib/server/types/`** - Server-only types (`db.ts`, `auth.ts`, `monitor.ts`, `api-server.ts`). Use for DB models, internal service types, auth/session types.
+- **`src/lib/client/types/`** - Client-only types (`ui.ts`). Use for UI-specific types, component prop types.
+
+Always use `import type { ... }` when importing types to avoid accidental runtime imports.

.github/dependabot.yml

@@ -0,0 +1,47 @@
+version: 2
+updates:
+  # Track base image versions via .env.build
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    file-patterns:
+      - ".env.build"
+      - "node:*"  # Ensures Node.js images are correctly detected
+
+  # Monitor OS package versions in Dockerfile (Debian/Alpine)
+  - package-ecosystem: "gitsubmodule"  # Alternative method to track OS packages in Dockerfile
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "os-packages"
+    commit-message:
+      prefix: "os"
+      include: "scope"
+
+  # Monitor Node.js dependencies from package.json
+  # TODO: Uncomment below if we want to begin letting Dependabot monitor & open PRs for Node.js project dependencies
+  # - package-ecosystem: "npm"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #   labels:
+  #     - "dependencies"
+  #     - "npm"
+  #   commit-message:
+  #     prefix: "npm"
+  #     include: "scope"
+
+  # Monitor GitHub Actions dependencies
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "actions"
+      include: "scope"

.github/workflows/create-release.yml

@@ -0,0 +1,98 @@
+name: Create Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version (for example: 4.0.0)"
+        required: true
+        type: string
+      make_latest:
+        description: "Mark this release as latest"
+        required: true
+        type: boolean
+        default: true
+      prerelease:
+        description: "Mark as pre-release"
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  create-release:
+    name: Bump version, tag, and create release
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out default branch
+        uses: actions/checkout@v4.2.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          fetch-depth: 0
+
+      - name: Validate version format
+        run: |
+          VERSION="${{ inputs.version }}"
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "Invalid version format: $VERSION"
+            echo "Use semver like 4.0.0 or 4.0.0-rc.1"
+            exit 1
+          fi
+
+      - name: Ensure release tag does not already exist
+        run: |
+          TAG="v${{ inputs.version }}"
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists"
+            exit 1
+          fi
+
+      - name: Bump package version
+        run: |
+          VERSION="${{ inputs.version }}"
+          CURRENT_VERSION=$(node -p 'require("./package.json").version')
+
+          if [ "$CURRENT_VERSION" != "$VERSION" ]; then
+            npm version "$VERSION" --no-git-tag-version --allow-same-version
+          else
+            echo "package.json already at version $VERSION"
+          fi
+
+      - name: Commit version bump
+        run: |
+          VERSION="${{ inputs.version }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git add package.json
+          if [ -f package-lock.json ]; then
+            git add package-lock.json
+          fi
+
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "chore(release): bump version to $VERSION"
+          fi
+
+      - name: Create and push git tag
+        run: |
+          VERSION="${{ inputs.version }}"
+          TAG="v$VERSION"
+
+          git tag -a "$TAG" -m "Release $TAG"
+          git push origin "HEAD:${{ github.event.repository.default_branch }}"
+          git push origin "$TAG"
+
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ inputs.version }}
+          target_commitish: ${{ github.event.repository.default_branch }}
+          generate_release_notes: true
+          make_latest: ${{ inputs.make_latest && 'true' || 'false' }}
+          prerelease: ${{ inputs.prerelease }}
+          token: ${{ secrets.RELEASE_TOKEN }}

.github/workflows/generate-readme.yml

@@ -1,83 +0,0 @@
-name: Generate README
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'README.template.md'
-  pull_request:
-    branches:
-      - main
-    paths:
-      - 'README.template.md'
-  workflow_dispatch:  # Allows for manual execution
-  workflow_run:  # Triggers this workflow to run when it recognizes 'publish-images' workflow has ran and successfully completed
-    workflows: ["Publish Docker Image to Registries"]
-    types:
-      - completed
-
-permissions:
-  contents: write  # Explicitly allow pushing changes
-
-jobs:
-  generate-readme:
-    name: Generate README from template
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4.2.2
-        with:
-          fetch-depth: 0  # Fetch full history, including tags
-          persist-credentials: false  # We'll manually authenticate
-
-      - name: Configure Git
-        run: |
-          git config --global user.name "github-actions"
-          git config --global user.email "github-actions@github.com"
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4.2.0
-        with:
-          node-version: "20"
-
-      - name: Install Dependencies
-        run: npm install mustache dotenv
-
-      - name: Extract Major and Major-Minor Versions
-        run: |
-          VERSION="${{ vars.BUILD_VERSION }}"
-
-          # Check if VERSION is empty and set a fallback value
-          if [ -z "$VERSION" ]; then
-            # Fetch the latest release using Git
-            VERSION=$(git tag -l --sort=-v:refname | grep -E '^v?[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1 || echo "3.1.0")
-          fi
-
-          MAJOR=$(echo "$VERSION" | cut -d. -f1)
-          MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
-
-          echo "Full version: $VERSION"
-          echo "Major version: $MAJOR"
-          echo "Major-Minor version: $MAJOR_MINOR"
-
-          # Export all as environment variables
-          echo "LATEST_VERSION=$VERSION" >> $GITHUB_ENV
-          echo "LATEST_MAJOR_VERSION=$MAJOR" >> $GITHUB_ENV
-          echo "LATEST_MAJOR_MINOR_VERSION=$MAJOR_MINOR" >> $GITHUB_ENV
-
-      - name: Generate README.md
-        env:
-          BUILD_FULL_VERSION: ${{ env.LATEST_VERSION }}  # e.g., 1.2.3
-          BUILD_MAJOR_VERSION: ${{ env.LATEST_MAJOR_VERSION}}  # e.g., 1
-          BUILD_MAJOR_MINOR_VERSION: ${{ env.LATEST_MAJOR_MINOR_VERSION }}  # e.g., 1.2
-        run: node scripts/generate-readme.js
-
-      - name: Commit and Push Changes
-        env:
-          GH_PAT: ${{ secrets.GH_PAT }}
-        run: |
-          git add README.md
-          git commit -m "Auto-generate README.md with release versions" || echo "No changes to commit"
-          git push https://x-access-token:${{ secrets.GH_PAT }}@github.com/${{ github.repository }}.git HEAD:main

.github/workflows/protect-readme.yml

@@ -1,21 +0,0 @@
-name: Prevent Direct README Changes
-
-on:
-  pull_request:
-    paths:
-      - "README.md"
-
-jobs:
-  check-readme:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4.2.2
-
-      - name: Detect direct README changes
-        run: |
-          if git diff --name-only origin/main | grep -q "README.md"; then
-            echo "❌ Direct modifications to README.md are not allowed!"
-            echo "Please update README.template.md instead."
-            exit 1
-          fi

.github/workflows/publish-images.yml

@@ -1,93 +1,58 @@
-name: Publish Docker Image to Registries
+name: Publish Nightly Docker Image
 
 on:
-  release:
-    types:
-      - published  # Runs only when a GitHub Release is published
-  workflow_dispatch:  # Allows for manual execution
+  push:
+    branches:
+      - next/**
+  workflow_dispatch:
 
 env:
-  ALPINE_VERSION: "23-alpine"
-  DEBIAN_VERSION: "23-slim"
-  # Registry URLs
   DOCKERHUB_REGISTRY: docker.io
   GITHUB_REGISTRY: ghcr.io
-  # Docker Hub image name (using Docker Hub username)
   DOCKERHUB_IMAGE_NAME: ${{ secrets.DOCKER_USERNAME }}/${{ github.event.repository.name }}
-  # GitHub image name (formatted as `account/repo`)
   GITHUB_IMAGE_NAME: ${{ github.repository }}
 
+concurrency:
+  group: nightly-docker-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  check-lockfile:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'  # Adjust as needed
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check for lock-file changes
-        run: |
-          git diff --exit-code package-lock.json || (
-            echo "🫥 package-lock.json is outdated or missing. Please run 'npm install' and commit the updated lockfile."
-            exit 1
-          )
-
-  build-and-push-to-registries:
-    needs: check-lockfile  # Runs only after `check-lockfile` completes successfully
-    name: Push Docker images to Docker Hub and GitHub Container Registry
+  build-and-push-nightly:
+    name: Build and push nightly Docker images
     strategy:
       matrix:
-        variant: [alpine, debian]
+        variant: [debian, alpine]
     runs-on: ubuntu-latest
     permissions:
-      actions: write
-      contents: write
+      contents: read
       packages: write
-      # This is used to complete the identity challenge with sigstore/fulcio when running outside of PRs.
       id-token: write
 
     steps:
       - name: Check out the repo
         uses: actions/checkout@v4.2.2
 
-      # Install the cosign tool (except on PR)
-      # https://github.com/sigstore/cosign-installer
       - name: Install cosign
-        if: github.event_name != 'pull_request'
         uses: sigstore/cosign-installer@v3.8.0
         with:
-          cosign-release: 'v2.2.4'
+          cosign-release: v2.2.4
 
-      # Set up BuildKit Docker container builder to be able to build multi-platform images and export cache
-      # https://github.com/docker/setup-buildx-action
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3.8.0
 
-      # Log in to Docker Hub (except on PR)
       - name: Log in to Docker Hub
-        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3.3.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      # Log in to GitHub Container Registry (except on PR)
       - name: Log in to GitHub Container Registry
-        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3.3.0
         with:
           registry: ${{ env.GITHUB_REGISTRY }}
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Combined metadata extraction for both registries
       - name: Extract Docker metadata
         id: meta
         uses: docker/metadata-action@v5.6.1
@@ -96,61 +61,31 @@ jobs:
             ${{ env.DOCKERHUB_IMAGE_NAME }}
             ${{ env.GITHUB_REGISTRY }}/${{ env.GITHUB_IMAGE_NAME }}
           tags: |
-            # Debian Variant Tags
-            type=semver,pattern={{version}},enable=${{ matrix.variant == 'debian' }}
-            type=semver,pattern={{major}}.{{minor}},enable=${{ matrix.variant == 'debian' }}
-            type=semver,pattern={{major}},enable=${{ matrix.variant == 'debian' }}
-            type=raw,value=latest,enable=${{ matrix.variant == 'debian' }}
-
-            # Alpine Variant Tags
-            type=semver,pattern={{version}},suffix=-alpine,enable=${{ matrix.variant == 'alpine' }}
-            type=semver,pattern={{major}}.{{minor}},suffix=-alpine,enable=${{ matrix.variant == 'alpine' }}
-            type=semver,pattern={{major}},suffix=-alpine,enable=${{ matrix.variant == 'alpine' }}
-            type=raw,value=alpine,enable=${{ matrix.variant == 'alpine' }}
+            type=raw,value=nightly,enable=${{ matrix.variant == 'debian' }}
+            type=raw,value=nightly-alpine,enable=${{ matrix.variant == 'alpine' }}
+            type=sha,format=short,prefix=nightly-,enable=${{ matrix.variant == 'debian' }}
+            type=sha,format=short,prefix=nightly-alpine-,enable=${{ matrix.variant == 'alpine' }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3.3.0
 
-      # Build and push Docker image with Buildx to both registries (don't push on PR)
       - name: Build and push Docker image
         id: build-and-push
         uses: docker/build-push-action@v6.13.0
         with:
           context: .
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             VARIANT=${{ matrix.variant }}
-            ALPINE_VERSION=${{ env.ALPINE_VERSION }}
-            DEBIAN_VERSION=${{ env.DEBIAN_VERSION }}
           platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      # Sign the resulting Docker image digests
       - name: Sign the published Docker images
-        if: ${{ github.event_name != 'pull_request' }}
         env:
           TAGS: ${{ steps.meta.outputs.tags }}
           DIGEST: ${{ steps.build-and-push.outputs.digest }}
         run: |
           echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
-
-      # For use in other workflows (e.g. 'generate-readme', etc.)
-      - name: Save Build Version to Repository Variable
-        if: matrix.variant == 'debian' && github.run_attempt == 1
-        run: |
-          # VERSION="${{ steps.meta.outputs.version }}"
-          VERSION=$(gh release view --json tagName -q .tagName 2>/dev/null || echo "")
-
-          # Check if VERSION is empty and set a fallback value
-          if [ -z "$VERSION" ]; then
-            VERSION=$(git tag -l --sort=-version:refname | grep -E '^(v)?[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1 || echo "3.1.0")
-          fi
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-
-          echo "Setting BUILD_VERSION to $VERSION"
-          gh variable set BUILD_VERSION --body "$VERSION"
-        env:
-          GH_TOKEN: ${{ secrets.GH_PAT }}  # Needs to be PAT w/ Read access to metadata and secrets & Read and Write access to actions, actions variables, and code

.github/workflows/publish-main.yml

@@ -0,0 +1,92 @@
+name: Publish Main Docker Image (with Docs)
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  DOCKERHUB_REGISTRY: docker.io
+  GITHUB_REGISTRY: ghcr.io
+  DOCKERHUB_IMAGE_NAME: ${{ secrets.DOCKER_USERNAME }}/${{ github.event.repository.name }}
+  GITHUB_IMAGE_NAME: ${{ github.repository }}
+
+concurrency:
+  group: main-docker-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-push-main:
+    name: Build and push main Docker images (with docs)
+    strategy:
+      matrix:
+        variant: [debian, alpine]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4.2.2
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3.8.0
+        with:
+          cosign-release: v2.2.4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.8.0
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3.3.0
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3.3.0
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5.6.1
+        with:
+          images: |
+            ${{ env.DOCKERHUB_IMAGE_NAME }}
+            ${{ env.GITHUB_REGISTRY }}/${{ env.GITHUB_IMAGE_NAME }}
+          tags: |
+            type=raw,value=main-with-docs,enable=${{ matrix.variant == 'debian' }}
+            type=raw,value=main-with-docs-alpine,enable=${{ matrix.variant == 'alpine' }}
+            type=sha,format=short,prefix=main-with-docs-,enable=${{ matrix.variant == 'debian' }}
+            type=sha,format=short,prefix=main-with-docs-alpine-,enable=${{ matrix.variant == 'alpine' }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.3.0
+
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v6.13.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VARIANT=${{ matrix.variant }}
+            WITH_DOCS=true
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Sign the published Docker images
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        run: |
+          echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

.github/workflows/publish-release.yml

@@ -0,0 +1,146 @@
+name: Publish Release Docker Images
+
+on:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+env:
+  DOCKERHUB_REGISTRY: docker.io
+  GITHUB_REGISTRY: ghcr.io
+  DOCKERHUB_IMAGE_NAME: ${{ secrets.DOCKER_USERNAME }}/${{ github.event.repository.name }}
+  GITHUB_IMAGE_NAME: ${{ github.repository }}
+
+concurrency:
+  group: release-docker-${{ github.event.release.tag_name || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-push-release:
+    name: Build and push release Docker images
+    strategy:
+      matrix:
+        variant: [debian, alpine]
+        base_path: ["", "/status"]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Check out release tag
+        uses: actions/checkout@v4.2.2
+        with:
+          ref: refs/tags/${{ github.event.release.tag_name || github.ref_name }}
+          fetch-depth: 0
+
+      - name: Validate package version matches release tag
+        run: |
+          TAG="${{ github.event.release.tag_name || github.ref_name }}"
+          EXPECTED_VERSION="${TAG#v}"
+          PACKAGE_VERSION=$(node -p 'require("./package.json").version')
+
+          if [ "$PACKAGE_VERSION" != "$EXPECTED_VERSION" ]; then
+            echo "package.json version mismatch"
+            echo "release tag: $TAG"
+            echo "expected package.json version: $EXPECTED_VERSION"
+            echo "actual package.json version: $PACKAGE_VERSION"
+            exit 1
+          fi
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3.8.0
+        with:
+          cosign-release: v2.2.4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.8.0
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3.3.0
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3.3.0
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute release tags
+        id: vars
+        run: |
+          TAG="${{ github.event.release.tag_name || github.ref_name }}"
+          NORM_TAG="${TAG#v}"
+
+          if [ "${{ matrix.base_path }}" = "/status" ]; then
+            BASE_SUFFIX="-status"
+          else
+            BASE_SUFFIX=""
+          fi
+
+          WITH_DOCS="false"
+
+          if [ "${{ matrix.variant }}" = "alpine" ]; then
+            VARIANT_SUFFIX="-alpine"
+          else
+            VARIANT_SUFFIX=""
+          fi
+
+          FULL_SUFFIX="${BASE_SUFFIX}${VARIANT_SUFFIX}"
+
+          echo "release_tag=${TAG}${FULL_SUFFIX}" >> "$GITHUB_OUTPUT"
+          echo "release_norm_tag=${NORM_TAG}${FULL_SUFFIX}" >> "$GITHUB_OUTPUT"
+          echo "latest_tag=latest${FULL_SUFFIX}" >> "$GITHUB_OUTPUT"
+          echo "with_docs=${WITH_DOCS}" >> "$GITHUB_OUTPUT"
+
+          if [ "${{ matrix.variant }}" = "debian" ]; then
+            echo "release_tag_debian_alias=${TAG}${BASE_SUFFIX}-debian" >> "$GITHUB_OUTPUT"
+            echo "release_norm_tag_debian_alias=${NORM_TAG}${BASE_SUFFIX}-debian" >> "$GITHUB_OUTPUT"
+            echo "latest_tag_debian_alias=latest${BASE_SUFFIX}-debian" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5.6.1
+        with:
+          images: |
+            ${{ env.DOCKERHUB_IMAGE_NAME }}
+            ${{ env.GITHUB_REGISTRY }}/${{ env.GITHUB_IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ steps.vars.outputs.latest_tag }}
+            type=raw,value=${{ steps.vars.outputs.release_tag }}
+            type=raw,value=${{ steps.vars.outputs.release_norm_tag }},enable=${{ steps.vars.outputs.release_norm_tag != steps.vars.outputs.release_tag }}
+            type=raw,value=${{ steps.vars.outputs.latest_tag_debian_alias }},enable=${{ matrix.variant == 'debian' }}
+            type=raw,value=${{ steps.vars.outputs.release_tag_debian_alias }},enable=${{ matrix.variant == 'debian' }}
+            type=raw,value=${{ steps.vars.outputs.release_norm_tag_debian_alias }},enable=${{ matrix.variant == 'debian' && steps.vars.outputs.release_norm_tag_debian_alias != steps.vars.outputs.release_tag_debian_alias }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.3.0
+
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v6.13.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VARIANT=${{ matrix.variant }}
+            WITH_DOCS=${{ steps.vars.outputs.with_docs }}
+            KENER_BASE_PATH=${{ matrix.base_path }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Sign the published Docker images
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        run: |
+          echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

.gitignore

@@ -1,4 +1,6 @@
 .DS_Store
+.DS_STORE
+**/.DS_Store
 node_modules
 static/kener
 build
@@ -9,6 +11,7 @@ config/server.yaml
 /src/lib/.kener
 /package
 .env
+.vscode
 .env.*
 !.env.example
 vite.config.js.timestamp-*
@@ -27,4 +30,8 @@ uploads/*
 static/uploads/*
 !static/uploads/upload.dir
 temp.txt
-temp.js
+temp.js
+.DS_Store
+knip-output.txt
+check-output.txt
+translation-report.json

.npmrc

@@ -0,0 +1 @@
+engine-strict=true

.prettierignore

@@ -19,4 +19,5 @@ config/static/*
 !config/static/.kener
 **/*.yaml
 **/*.yml
-.github/
+.github/
+src/lib/components/ui

.prettierrc

@@ -54,7 +54,7 @@
         "semi": false,
         "tabWidth": 4,
         "trailingComma": "none",
-        "printWidth": 100
+        "printWidth": 180
       }
     },
     {

AGENTS.md

@@ -0,0 +1,40 @@
+You are able to use the Svelte MCP server, where you have access to comprehensive Svelte 5 and SvelteKit documentation. Here's how to use the available tools effectively:
+
+## Available MCP Tools:
+
+### 1. list-sections
+
+Use this FIRST to discover all available documentation sections. Returns a structured list with titles, use_cases, and paths.
+When asked about Svelte or SvelteKit topics, ALWAYS use this tool at the start of the chat to find relevant sections.
+
+### 2. get-documentation
+
+Retrieves full documentation content for specific sections. Accepts single or multiple sections.
+After calling the list-sections tool, you MUST analyze the returned documentation sections (especially the use_cases field) and then use the get-documentation tool to fetch ALL documentation sections that are relevant for the user's task.
+
+### 3. svelte-autofixer
+
+Analyzes Svelte code and returns issues and suggestions.
+You MUST use this tool whenever writing Svelte code before sending it to the user. Keep calling it until no issues or suggestions are returned.
+
+### 4. playground-link
+
+Generates a Svelte Playground link with the provided code.
+After completing the code, ask the user if they want a playground link. Only call this tool after user confirmation and NEVER if code was written to files in their project.
+
+## Database compatibility rule
+
+All database operations — migrations, queries, and repository functions — **MUST** work across all three supported databases: **SQLite**, **PostgreSQL**, and **MySQL**. Use Knex.js schema builder and query builder abstractions; avoid raw SQL unless wrapped in dialect-safe helpers or guarded with `try/catch`. When writing migrations:
+
+- Use `knex.schema.hasColumn` / `knex.schema.hasTable` guards for idempotency.
+- Use Knex column types (`.string()`, `.integer()`, `.text()`, etc.) — never raw `ALTER TABLE` unless necessary.
+- For data-seeding inside migrations, use standard Knex query builder (`.insert()`, `.update()`, `.orderBy()`, `.first()`).
+- Test that `defaultTo()` values and `notNullable()` constraints work on all three engines.
+
+## Documentation writing skill
+
+When the user asks to write or edit documentation, follow the skill file:
+
+- `.claude/skills/documentation-writer/SKILL.md`
+
+This is mandatory for docs-related tasks. Prioritize short, clear, action-oriented docs and avoid bloat.

CLAUDE.md

@@ -0,0 +1,137 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What is Kener?
+
+Kener is an open-source status page application built with **SvelteKit 2.x (Svelte 5)** and **Node.js/Express**. It is a **TypeScript-first** codebase providing real-time monitoring, uptime tracking, incident management, and customizable dashboards.
+
+## Development Commands
+
+```bash
+npm run dev          # Start dev server (SvelteKit + cron scheduler in parallel)
+npm run build        # Production build (SvelteKit then esbuild server bundle)
+npm run start        # Run production build (node build/main.js)
+npm run check        # Svelte + TypeScript type checking
+npm run prettify     # Format all files with Prettier
+npm run migrate      # Run database migrations via Knex
+npm run seed         # Run database seeds (migrations run automatically first)
+```
+
+## Architecture
+
+### Dual Process Model
+
+In development, `npm run dev` runs two parallel processes:
+
+1. **SvelteKit dev server** (`vite dev`) - serves the frontend
+2. **Cron scheduler** (`vite-node src/lib/server/startup.ts`) - runs monitor checks, maintenance scheduler, daily cleanup
+
+In production, `scripts/main.ts` is the single entry point: Express server + SvelteKit handler + migrations + seeds + scheduler startup.
+
+### SvelteKit Route Groups
+
+- **`(kener)/`** - Public status page
+- **`(manage)/`** - Admin dashboard (authenticated)
+- **`(embed)/`** - Embeddable widgets
+- **`(docs)/`** - Documentation pages
+- **`(api)/`** - SvelteKit API routes; also `src/lib/server/api-server/` for Express-side API handlers (file-based routing: `./action/method.ts`)
+- **`(account)/`** - Account/auth pages
+- **`(ext)/`** - External integrations
+- **`(assets)/`** - Asset serving
+
+### Database
+
+- **Knex.js** for query building and migrations. Supports SQLite (default), PostgreSQL, MySQL
+- Connection configured via `DATABASE_URL` env var: `sqlite://./path`, `postgresql://...`, `mysql://...`
+- Migrations in `/migrations/`, seeds in `/seeds/`
+- Always use the db singleton: `import db from "$lib/server/db/db"`
+
+### Monitor Services
+
+Each monitor type has a dedicated implementation in `src/lib/server/services/`:
+
+- Types: API, Ping, TCP, DNS, SSL, SQL, Heartbeat, GameDig, Group, gRPC, None
+- Scheduled via `src/lib/server/schedulers/` using `croner`
+- Job queues managed with **BullMQ** + **Redis** (`src/lib/server/queues/`)
+
+### Build System
+
+`npm run build` is a two-step process:
+
+1. `scripts/build-sveltekit.js` - Vite build of SvelteKit app (optionally with `--with-docs`)
+2. `scripts/build-server.js` - esbuild bundles `scripts/main.ts` into `build/main.js`
+
+## Key Conventions
+
+### Svelte 5 + TypeScript
+
+- Use **TypeScript** for new/modified code
+- Use **Svelte 5 runes** (`$state`, `$derived`, `$effect`, `$props()`) in new components
+- Use generated `$types` for SvelteKit route typing (`import type { PageServerLoad } from './$types'`)
+- Use `import type { ... }` for type imports
+
+### UI Components
+
+- **shadcn-svelte** components in `src/lib/components/ui/`
+- Import: `import { Button } from "$lib/components/ui/button"`
+- Styling: **Tailwind CSS v4** with HSL CSS variables for theming
+
+### Timestamps
+
+All timestamps are **UTC seconds** (not milliseconds). Use helpers from `src/lib/server/tool.ts`.
+
+### Status Constants
+
+Constants are exported as a **default export** from `src/lib/global-constants.ts`:
+
+```typescript
+// In Svelte/client code or SvelteKit routes:
+import GC from "$lib/global-constants"
+// Usage: GC.UP, GC.DOWN, GC.DEGRADED, GC.MAINTENANCE, GC.NO_DATA
+
+// In server code (use relative path):
+import GC from "../../global-constants.js"
+// Usage: GC.UP, GC.DOWN, etc.
+```
+
+### API Authentication
+
+APIs use Bearer token auth: `import { VerifyAPIKey } from "$lib/server/controllers/apiController"`
+
+### Types Location
+
+- `src/lib/types/` - Shared types (client + server)
+- `src/lib/server/types/` - Server-only types
+- `src/lib/client/types/` - Client-only types
+
+### i18n
+
+Locale files in `src/lib/locales/`. Add translations by creating `{code}.json` and updating `locales.json`.
+
+## Environment Variables
+
+Required: `KENER_SECRET_KEY`, `ORIGIN`, `REDIS_URL`
+Optional: `DATABASE_URL` (defaults to SQLite), `KENER_BASE_PATH`, `PORT` (default 3000), `RESEND_API_KEY`, `RESEND_SENDER_EMAIL`
+
+## Skills
+
+Read `.claude/skills/` for specialized instructions on:
+
+- **svelte-code-writer** - Svelte component creation/editing
+- **documentation-writer** - Editing docs in `src/routes/(docs)/docs/content/`
+- **tailwindcss** - Tailwind CSS v4 patterns
+
+## Agent skills
+
+### Issue tracker
+
+Issues and PRDs are tracked in GitHub Issues for `rajnandan1/kener`. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Triage uses the default mattpocock/skills label vocabulary. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+This repo uses a single-context domain-doc layout. See `docs/agents/domain.md`.

CONTEXT.md

@@ -0,0 +1,107 @@
+# Kener
+
+An open-source status page application providing real-time monitoring, uptime tracking, incident management, and customizable dashboards.
+
+## Language
+
+### Monitoring
+
+**Monitor**:
+A single check against a service, with a unique tag, a type (API, Ping, TCP, DNS, SSL, SQL, Heartbeat, GameDig, Group, gRPC, None), and a status (ACTIVE or otherwise).
+_Avoid_: Check, probe, service
+
+**Inactive Monitor**:
+A monitor that is not checked at all: the scheduler drops its job and no monitoring data is collected until it is made ACTIVE again. Independent of visibility (see Hidden Monitor).
+_Avoid_: Disabled monitor, paused monitor
+
+**Hidden Monitor**:
+A monitor excluded from all status pages while remaining fully checked and alerted. Independent of ACTIVE/INACTIVE.
+_Avoid_: Invisible monitor, private monitor
+
+**Group Monitor**:
+A monitor whose status is derived from other monitors via a weighted score (UP=1, DEGRADED=0.5, DOWN=0; maintenance counts as UP). A group cannot contain another group.
+_Avoid_: Monitor group, composite monitor
+
+**Member**:
+A monitor belonging to a Group Monitor, carrying a weight and a position in the execution order. Membership is an explicit stored list, never a dynamic rule (e.g. tag wildcards).
+_Avoid_: Child monitor, sub-monitor
+
+**Weight**:
+A member's share of the group score, between 0 and 1. Weights across a group's members must sum to 1. Any membership change (add or remove) redistributes all weights equally; manual tuning happens after membership is settled.
+
+**Execution Order**:
+The stored order in which a Group Monitor's members are checked before aggregation. Manually arranged, not derived.
+
+**Eligible Monitor**:
+A monitor that may become a Member: ACTIVE, not a Group Monitor, and not the group being edited itself.
+
+**Monitoring Sample**:
+One recorded data point for a monitor at a timestamp: a status, a latency, and a sample type describing how it was produced. Every sample is either Observed or Synthetic.
+_Avoid_: Data point, record, check result
+
+**Observed Sample**:
+A Monitoring Sample produced by a check that actually ran against the target, whatever the outcome: a clean evaluation (`REALTIME`), a timed-out check (`TIMEOUT`), or a check that errored (`ERROR`). A check failing to reach the target is itself an observation — for most monitor types that is exactly what "down" looks like.
+
+**Synthetic Sample**:
+A Monitoring Sample written by the system or an admin rather than by a check: a raw heartbeat receipt (`SIGNAL`), a status pushed through the data API (`MANUAL`), a default-status fill (`DEFAULT_STATUS`), a last-known-status fill (`CARRIED`), or an incident/maintenance overlay (`INCIDENT`, `MAINTENANCE`).
+
+**Default Status**:
+A monitor's answer to what a minute without a Monitoring Sample means. Exactly one choice from a closed set: nothing (`NONE` — the minute shows no data), a fixed status (`UP`, `DOWN`, `DEGRADED`) written as default-status fill, or Last Known Status. `MAINTENANCE` is not a Default Status (a maintenance overlay is an event, not a fill).
+_Avoid_: Fallback status, fill status
+
+**Last Known Status**:
+A Default Status choice where a minute without a sample repeats the most recent Alert-Visible Sample — status and latency alike — written as a Carried Sample (`CARRIED`). Carried Samples are themselves alert-visible, so the chain continues from the last live statement: overlays and heartbeat receipts never become sticky, backdated corrections do not change the present, and alerts trigger and resolve on carried minutes like any other. Carry never expires and never backfills: it starts at the tick after the choice is made, and Carried Samples persist as history if the choice is later changed. A monitor with no Alert-Visible Sample yet has nothing to carry — its minutes show no data. Only None-type monitors may choose it; changing the monitor's type away from None resets the Default Status to UP.
+_Avoid_: Sticky status, carry-forward mode
+
+**Stale Member**:
+A Member whose monitor is no longer an Eligible Monitor (paused or deleted after being added). It remains a Member until explicitly removed, but is excluded from the group score.
+
+### Alerting
+
+**Alert Configuration**:
+A per-monitor alerting rule: a condition (status, latency, or uptime against a value), a Failure Threshold, a Success Threshold, whether triggering creates an incident, and the Triggers to notify.
+_Avoid_: Alert rule, alarm
+
+**Alert**:
+A fired instance of an Alert Configuration for a monitor. TRIGGERED when the condition holds, RESOLVED when the resolve condition later holds. May own the incident it created.
+_Avoid_: Alarm, notification (that's what Triggers send)
+
+**Trigger**:
+A notification channel (email, webhook, Discord, Slack) that Alert Configurations notify on trigger and on resolve.
+_Avoid_: Notifier, channel
+
+**Alert-Visible Sample**:
+A Monitoring Sample that alert evaluation can see: every Observed Sample, plus data-API pushes (`MANUAL`), default-status fill (`DEFAULT_STATUS`), and last-known-status fill (`CARRIED`). Raw heartbeat receipts (`SIGNAL`) and incident/maintenance overlays are never alert-visible — while an overlay is active the alert window freezes (alerts neither trigger nor resolve). All alert conditions (status and latency alike) evaluate the same alert-visible timeline.
+
+**Failure Threshold**:
+The number of consecutive Alert-Visible Samples matching the condition required to trigger an Alert.
+
+**Success Threshold**:
+The number of consecutive Alert-Visible Samples meeting the resolve condition required to resolve an Alert.
+
+### Pages
+
+**Page**:
+A public status page with its own path, title, monitors, and display settings. Served at `/<page_path>`.
+
+**Home Page**:
+The Page served at the site root. Its stored path is empty, it always exists (it can not be deleted), and its path can not be changed. Addressed in the API by the `~home` token.
+_Avoid_: Default page, base page, root page
+
+**Status History Window**:
+The number of days of per-day status shown for a monitor, per device class (desktop/mobile). Configurable at two levels with the same defaults and bounds: per Page (applies to all its monitors) and per Monitor (overrides the page level).
+_Avoid_: History days, bar count
+
+**Page Settings**:
+A Page's display configuration: status-history window per device class, monitor layout style, per-page meta/social overrides, and event display preferences. The admin UI and the API expose the same settings, though each surface may name fields differently; a writer must never drop fields it does not understand.
+_Avoid_: Display settings (ambiguous with site-wide event display settings)
+
+### Maintenance
+
+**Maintenance**:
+A recurring maintenance definition: title, description, an RRULE schedule, a duration, and affected monitors. Identified by its own id.
+_Avoid_: Maintenance window, maintenance event (that's an occurrence, see below)
+
+**Maintenance Event**:
+A single occurrence of a Maintenance, generated from its RRULE: a concrete start/end time with a lifecycle status (SCHEDULED → READY → ONGOING → COMPLETED). Has its own id, independent of the Maintenance id. The public maintenance page is keyed by Maintenance Event id.
+_Avoid_: Occurrence, maintenance instance

Dockerfile

@@ -1,148 +1,194 @@
 # syntax=docker/dockerfile:1
 
-# Global build arguments
-ARG ALPINE_VERSION=23.7.0-alpine3.21
-ARG DEBIAN_VERSION=23.7.0-bookworm-slim
-ARG VARIANT=debian
+# =============================================================================
+# Kener v4 — Status Page Application
+# Multi-stage, multi-variant (Alpine / Debian) Dockerfile
+#
+# Build:
+#   docker build -t kener .                          # Alpine (default)
+#   docker build -t kener --build-arg VARIANT=debian . # Debian Slim
+#   docker build -t kener --build-arg WITH_DOCS=true .  # Include docs
+#
+# Run:
+#   docker run -d -p 3000:3000 \
+#     -e KENER_SECRET_KEY=<secret> \
+#     -e ORIGIN=http://localhost:3000 \
+#     -e REDIS_URL=redis://<host>:6379 \
+#     -v kener_db:/app/database \
+#     kener
+# =============================================================================
 
-#==========================================================#
-#                   STAGE 1: BUILD STAGE                    #
-#==========================================================#
+ARG NODE_VERSION=24
+ARG VARIANT=alpine
+ARG WITH_DOCS=false
+ARG KENER_BASE_PATH=
 
-FROM node:${DEBIAN_VERSION} AS builder-debian
-RUN apt-get update && apt-get install -y \
-        build-essential=12.9 \
-        python3=3.11.2-1+b1 \
-        sqlite3=3.40.1-2+deb12u1 \
-        libsqlite3-dev=3.40.1-2+deb12u1 \
-        make=4.3-4.1 \
-        node-gyp=9.3.0-2 \
-        g++=4:12.2.0-3 \
-        tzdata=2024b-0+deb12u1 \
-        iputils-ping=3:20221126-1+deb12u1 && \
+# =============================================================================
+#  STAGE 1 — BUILDER  (installs deps, compiles native modules, builds app)
+# =============================================================================
+
+# ---------- Alpine builder ----------
+FROM node:${NODE_VERSION}-alpine AS builder-alpine
+RUN apk add --no-cache \
+    build-base \
+    python3 \
+    sqlite \
+    sqlite-dev \
+    tzdata
+
+# ---------- Debian builder ----------
+FROM node:${NODE_VERSION}-slim AS builder-debian
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    python3 \
+    sqlite3 \
+    libsqlite3-dev \
+    tzdata && \
     rm -rf /var/lib/apt/lists/*
 
-FROM node:${ALPINE_VERSION} AS builder-alpine
-RUN apk add --no-cache --update \
-        build-base=0.5-r3 \
-        python3=3.12.9-r0 \
-        py3-pip=24.3.1-r0 \
-        make=4.4.1-r2 \
-        g++=14.2.0-r4 \
-        sqlite=3.48.0-r0 \
-        sqlite-dev=3.48.0-r0 \
-        tzdata \
-        iputils=20240905-r0
-
+# ---------- Selected variant ----------
 FROM builder-${VARIANT} AS builder
 
-# Set environment variables
-ENV NPM_CONFIG_LOGLEVEL=error \
-    VITE_BUILD_ENV=production
+ENV NPM_CONFIG_LOGLEVEL=error
 
-# Set the working directory
 WORKDIR /app
 
-# Copy package files for dependency installation
+ARG KENER_BASE_PATH
+ENV KENER_BASE_PATH=${KENER_BASE_PATH}
+
+# 1. Copy package manifests first (maximises layer cache hits)
 COPY package*.json ./
 
-# Install all dependencies, including `devDependencies` (cache enabled for faster builds)
-# TODO: Possibly add `--no-audit` flag to `npm ci` to prevent `npm` from running a security audit on installed packages. (By default, `npm install` performs an audit to check for vulnerabilities in dependencies, which can slow down installation. Adding this flag would skip the audit, thus making `npm install` significantly faster for the CI/CD pipeline.)
-RUN --mount=type=cache,target=/root/.npm \
-    npm ci --no-fund && \
+# 2. Install ALL dependencies (devDependencies needed for the build step)
+RUN npm ci --no-fund && \
     npm cache clean --force
 
-# Copy application source code
+# 3. Copy the rest of the source tree
 COPY . .
 
-# TODO: Reevaluate permissions (possibly reduce?)...
-# Remove docs directory and ensure required directories exist
-RUN rm -rf src/routes/\(docs\) \
-		static/documentation \
-		static/fonts/lato/full && \
-	mkdir -p uploads database && \
-	# TODO: Consider changing below to `chmod -R u-rwX,g=rX,o= uploads database`
-    chmod -R 750 uploads database
+# 4. Create directories that the app expects
+RUN mkdir -p database
 
-# Build the application and remove `devDependencies`
-RUN npm run build && \
-    npm prune --omit=dev
+# 5. Conditionally remove docs routes before build
+#    (avoids EXDEV rename error in overlayfs; clean .svelte-kit so stale
+#    route types don't persist)
+ARG WITH_DOCS
+RUN if [ "$WITH_DOCS" != "true" ]; then \
+      rm -rf src/routes/\(docs\) .svelte-kit; \
+    fi
 
-#==========================================================#
-#             STAGE 2: PRODUCTION/FINAL STAGE              #
-#==========================================================#
+# 6. Build: SvelteKit (vite) + server bundle (esbuild)
+#    Use build-with-docs when docs are enabled
+RUN if [ "$WITH_DOCS" = "true" ]; then \
+      npm run build-with-docs; \
+    else \
+      npm run build; \
+    fi
 
-FROM node:${DEBIAN_VERSION} AS final-debian
-# TODO: Consider adding `--no-install-recommends`, but will need testing (may further help reduce final build size)
-RUN apt-get update && apt-get install -y \
-        iputils-ping=3:20221126-1+deb12u1 \
-        sqlite3=3.40.1-2+deb12u1 \
-        tzdata=2024b-0+deb12u1 \
-		# TODO: Is it ok to change to `curl` here so that we don't have to maintain `wget` version mismatch between Debian architectures? (`curl` is only used for the container healthcheck and because there is an Alpine variant (best!) we probably don't care if the Debian image ends up building bigger due to `curl`.)
-		curl=7.88.1-10+deb12u8 && \
+# 7. Stage docs runtime files for index-docs (empty dir when docs disabled)
+RUN mkdir -p /docs-runtime && \
+    if [ "$WITH_DOCS" = "true" ]; then \
+      mkdir -p /docs-runtime/scripts && \
+      mkdir -p /docs-runtime/src/lib && \
+      mkdir -p "/docs-runtime/src/routes/(docs)/docs" && \
+      cp scripts/index-docs.ts /docs-runtime/scripts/ && \
+      cp src/lib/marked.ts /docs-runtime/src/lib/ && \
+      cp "src/routes/(docs)/docs.json" "/docs-runtime/src/routes/(docs)/" && \
+      cp -r "src/routes/(docs)/docs/content" "/docs-runtime/src/routes/(docs)/docs/"; \
+    fi
+
+# 8. Remove devDependencies from node_modules
+RUN npm prune --omit=dev
+
+# =============================================================================
+#  STAGE 2 — PRODUCTION  (minimal runtime image)
+# =============================================================================
+
+# ---------- Alpine runtime ----------
+FROM node:${NODE_VERSION}-alpine AS final-alpine
+RUN apk add --no-cache \
+    sqlite \
+    tzdata \
+    iputils \
+    curl \
+    libcap && \
+    # Grant ping the NET_RAW capability so non-root users can send ICMP packets
+    setcap cap_net_raw+ep /bin/ping || true
+
+# ---------- Debian runtime ----------
+FROM node:${NODE_VERSION}-slim AS final-debian
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    sqlite3 \
+    tzdata \
+    iputils-ping \
+    curl \
+    libcap2-bin && \
+    setcap cap_net_raw+ep /usr/bin/ping || true && \
     rm -rf /var/lib/apt/lists/*
 
-FROM node:${ALPINE_VERSION} AS final-alpine
-RUN apk add --no-cache --update \
-	iputils=20240905-r0 \
-	sqlite=3.48.0-r0 \
-	tzdata
-
+# ---------- Selected variant ----------
 FROM final-${VARIANT} AS final
 
-ARG PORT=3000 \
-    USERNAME=node
+ARG PORT=3000
+ARG KENER_BASE_PATH=
 
-# Set environment variables
-ENV HEALTHCHECK_PORT=$PORT \
-    HEALTHCHECK_PATH= \
-    NODE_ENV=production \
-    NPM_CONFIG_LOGLEVEL=error \
-    PORT=$PORT \
-    TZ=Etc/UTC
+ENV NODE_ENV=production \
+    PORT=${PORT} \
+    KENER_BASE_PATH=${KENER_BASE_PATH} \
+    BODY_SIZE_LIMIT=3M \
+    TZ=UTC \
+    # Required so Node can import .ts migration/seed files at runtime
+    NODE_OPTIONS="--experimental-strip-types"
 
-# Set the working directory
 WORKDIR /app
 
-# Copy package files build artifacts, and necessary files from builder stage
-COPY --chown=node:node --from=builder /app/src/lib/ ./src/lib/
-COPY --chown=node:node --from=builder /app/build ./build
-COPY --chown=node:node --from=builder /app/uploads ./uploads
-COPY --chown=node:node --from=builder /app/database ./database
-# TODO: Consider changing from copying `node_modules` to instead letting `npm ci --omit=dev` handle production dependencies. Right now, copying `node_modules` is leading to a smaller image, whereas letting `npm ci` handle the install in final image is slightly faster, but leads to larger image size. IMO, having a slightly longer build time (e.g. ~10 sec.) is better in the end to have a smaller image.
+# Create writable directories owned by the non-root "node" user
+# (node:node is provided by the official Node.js images)
+RUN mkdir -p database && \
+    chown -R node:node /app
+
+# ---- Copy artifacts from builder (order: least → most likely to change) ----
+
+# Production node_modules (largest layer, changes least often)
 COPY --chown=node:node --from=builder /app/node_modules ./node_modules
+
+# Package manifest (needed for ESM "type":"module" resolution)
+COPY --chown=node:node --from=builder /app/package.json ./package.json
+
+# Knex migrations & seeds (run at startup by build/main.js)
 COPY --chown=node:node --from=builder /app/migrations ./migrations
 COPY --chown=node:node --from=builder /app/seeds ./seeds
-COPY --chown=node:node --from=builder /app/static ./static
-COPY --chown=node:node --from=builder /app/entrypoint.sh ./entrypoint.sh
-COPY --chown=node:node --from=builder /app/knexfile.js ./knexfile.js
-COPY --chown=node:node --from=builder /app/main.js ./main.js
-COPY --chown=node:node --from=builder /app/openapi.json ./openapi.json
-COPY --chown=node:node --from=builder /app/openapi.yaml ./openapi.yaml
 
-# Ensure necessary directories are writable
-VOLUME ["/uploads", "/database"]
+# Seed data files imported by seeds at runtime (all are leaf modules)
+COPY --chown=node:node --from=builder /app/src/lib/server/db/seedSiteData.ts      ./src/lib/server/db/seedSiteData.ts
+COPY --chown=node:node --from=builder /app/src/lib/server/db/seedMonitorData.ts   ./src/lib/server/db/seedMonitorData.ts
+COPY --chown=node:node --from=builder /app/src/lib/server/db/seedPagesData.ts     ./src/lib/server/db/seedPagesData.ts
+COPY --chown=node:node --from=builder /app/src/lib/allPerms.ts                   ./src/lib/allPerms.ts
+COPY --chown=node:node --from=builder /app/src/lib/server/templates/general       ./src/lib/server/templates/general
 
-# Set container timezone and make entrypoint script executable
-RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone && \
-    chmod +x ./entrypoint.sh
-	# TODO: To improve security, consider dropping unnecessary capabilities instead of granting image all network capabilities of host. (Maybe `setcap cap_net_raw+p /usr/bin/ping`, etc.) Could also drop all and then grant only the capabilities that are explicitly needed. Some examples are commented out below...
-	# setcap cap_net_bind_service=+ep /usr/local/bin/node
-	# setcap cap_net_bind_service=+ep /usr/bin/ping
-	# setcap cap_net_bind_service=+ep /usr/bin/ping6
-	# setcap cap_net_bind_service=+ep /usr/bin/tracepath
-	# setcap cap_net_bind_service=+ep /usr/bin/clockdiff
+# Locale JSON files (read at runtime by server-side i18n)
+COPY --chown=node:node --from=builder /app/src/lib/locales ./src/lib/locales
 
-# Expose the application port
-EXPOSE $PORT
+# Build output (SvelteKit client/server + esbuild main.js) — changes most often
+COPY --chown=node:node --from=builder /app/build ./build
 
-# Add a healthcheck to the container; `wget` vs. `curl` depending on base image. Using this approach because `wget` does not actually maintain versioning across architectures, so we cannot pin a `wget` version (in above `final-debian` base, `apt-get install`) between differing architectures (e.g. arm64, amd64)
-HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
-	CMD sh -c 'if [ -f "/etc/alpine-release" ]; then wget --quiet --spider http://localhost:$HEALTHCHECK_PORT$HEALTHCHECK_PATH || exit 1; else curl --silent --head --fail http://localhost:$HEALTHCHECK_PORT$HEALTHCHECK_PATH || exit 1; fi'
+# Docs runtime files (index-docs script + markdown sources; empty when WITH_DOCS=false)
+COPY --chown=node:node --from=builder /docs-runtime/ ./
 
-# TODO: Revisit letting user define $PUID & $PGID overrides (e.g. `addgroup -g $PGID newgroup && adduser -D -G newgroup -u $PUID node`) as well as potentially ensure no root user exists. (Make sure no processes are running as root, first!)
-# Use a non-root user (recommended for security)
-USER $USERNAME
+# Entrypoint script (runs index-docs on startup when docs are bundled)
+COPY --chown=node:node docker-entrypoint.sh ./docker-entrypoint.sh
+RUN chmod +x docker-entrypoint.sh
 
-ENTRYPOINT ["/app/entrypoint.sh"]
-CMD ["node", "main"]
+# ---- Runtime configuration ----
+
+# Switch to non-root user
+USER node
+
+EXPOSE ${PORT}
+
+# Healthcheck: hit the /healthcheck endpoint exposed by Express in main.ts
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD sh -c 'curl -sf http://localhost:${PORT}${KENER_BASE_PATH}/healthcheck || exit 1'
+
+ENTRYPOINT ["./docker-entrypoint.sh"]
+CMD ["node", "build/main.js"]

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023 Raj Nandan Sharma
+Copyright (c) 2026 Raj Nandan Sharma
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,7 +1,7 @@
 # Kener - Stunning Status Pages
 
 <p align="center">
-	<img src="https://kener.ing/newbg.png?v=1" width="100%" height="auto" class="rounded-lg shadow-lg" alt="kener example illustration">
+	<img src="https://kener.ing/og.jpg?v=1" width="100%" height="auto" class="rounded-lg shadow-lg" alt="kener example illustration">
 </p>
 
 <p align="center">
@@ -20,6 +20,7 @@
   <a href="https://github.com/rajnandan1/kener/actions/workflows/publish-images.yml"><img alt="GitHub Workflow Status" src="https://img.shields.io/github/actions/workflow/status/rajnandan1/kener/publish-images.yml" /></a>
   <a href="https://github.com/rajnandan1/kener/commit/HEAD"><img src="https://img.shields.io/github/last-commit/rajnandan1/kener/main" alt="" /></a>
   <a href="https://github.com/rajnandan1/kener/issues"><img alt="GitHub issues" src="https://img.shields.io/github/issues/rajnandan1/kener.svg" /></a>
+  <a href="https://deepwiki.com/rajnandan1/kener"><img alt="Ask DeepWiki" src="https://deepwiki.com/badge.svg" /></a>
 </p>
 
 <p align="center">
@@ -43,8 +44,16 @@
 	</picture>
 </p>
 
-| [🌍 Live Server](https://kener.ing) | [🎉 Quick Start](https://kener.ing/docs/quick-start) | [🗄 Documentation](https://kener.ing/docs/home) |
-| ----------------------------------- | ---------------------------------------------------- | ----------------------------------------------- |
+| [🌍 Live Server](https://kener.ing) | [🎉 Quick Start](https://kener.ing/docs/v4/getting-started/quick-start) | [🗄 Documentation](https://kener.ing/docs/v4/getting-started/introduction) |
+| ----------------------------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+
+<p align="center">
+
+[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/deploy/spSvic?referralCode=1Pn7vs&utm_medium=integration&utm_source=template&utm_campaign=generic)
+[![Deploy on Zeabur](https://zeabur.com/button.svg)](https://zeabur.com/templates/1YRTMI?referralCode=rajnandan1)
+[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https%3A%2F%2Fgithub.com%2Frajnandan1%2Fkener)
+
+</p>
 
 ## What is Kener?
 
@@ -62,151 +71,154 @@ Designed with **ease of use** and **customization in mind**, Kener provides all
 
 “Kener” is inspired by the Assamese word _“Kene”_, meaning _“how’s it going?”_. The _‘.ing’_ was added because, well… that domain was available. 😄
 
-## Installation
+## Quick Start
 
-### Manual
+Get Kener running in minutes.
 
-```shell
-# Clone the repository
+### Docker (recommended)
+
+```bash
+git clone https://github.com/rajnandan1/kener.git
+cd kener
+
+# Uses docker-compose.yml (includes Redis + Kener)
+# Set a strong KENER_SECRET_KEY and ORIGIN in docker-compose.yml before first run
+docker compose up -d
+```
+
+Open `http://localhost:3000`.
+
+> [!IMPORTANT]
+> Set a strong `KENER_SECRET_KEY` and set `ORIGIN` to your public URL before starting for the first time.
+
+Use `docker-compose.dev.yml` when you want to build from local source instead of pulling the published image:
+
+```bash
+docker compose -f docker-compose.dev.yml up -d --build
+```
+
+Or combine both files to keep base production config while overriding Kener with a local build:
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build
+```
+
+### Run pre-built image
+
+You can use either image:
+
+- `docker.io/rajnandan1/kener:latest`
+- `ghcr.io/rajnandan1/kener:latest`
+
+For subpath deployments (`/status`), use:
+
+- `docker.io/rajnandan1/kener:latest-status`
+- `docker.io/rajnandan1/kener:latest-status-alpine`
+- `ghcr.io/rajnandan1/kener:latest-status`
+- `ghcr.io/rajnandan1/kener:latest-status-alpine`
+
+```bash
+mkdir -p database
+docker run -d \
+	--name kener \
+	-p 3000:3000 \
+	-v "$(pwd)/database:/app/database" \
+	-e "KENER_SECRET_KEY=replace_with_a_random_string" \
+	-e "ORIGIN=http://localhost:3000" \
+	-e "REDIS_URL=redis://host.docker.internal:6379" \
+	docker.io/rajnandan1/kener:latest
+```
+
+### Run pre-built subpath image (`/status`)
+
+```bash
+mkdir -p database
+docker run -d \
+	--name kener-status \
+	-p 3000:3000 \
+	-v "$(pwd)/database:/app/database" \
+	-e "KENER_SECRET_KEY=replace_with_a_random_string" \
+	-e "ORIGIN=http://localhost:3000" \
+	-e "KENER_BASE_PATH=/status" \
+	-e "REDIS_URL=redis://host.docker.internal:6379" \
+	docker.io/rajnandan1/kener:latest-status
+```
+
+> [!NOTE]
+> For subpath mode, keep `ORIGIN` as the site origin (`http://localhost:3000`), not `http://localhost:3000/status`.
+
+### Run without Docker
+
+Requirements:
+
+- Node.js `>= 20`
+- Redis
+
+```bash
 git clone https://github.com/rajnandan1/kener.git
 cd kener
 npm install
-cp .env.example .env
-npm run dev
+
+# Start Redis (example)
+docker run -d --name kener-redis -p 6379:6379 redis:7-alpine
+
+npm run build
+npm run start
 ```
 
-### Docker
+Create a `.env` with at least:
 
-Official Docker images for **Kener** are available on [Docker Hub](https://hub.docker.com/r/rajnandan1/kener). Multiple versions are maintained to support different use cases.
-
-<a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=3.1.8"><img src="https://img.shields.io/badge/Latest_Stable_Release-3.1.8-blue" alt="Kener latest stable version: 3.1.8" /></a>
-
-#### Available Tags
-
-<table>
-	<tr>
-		<th>Image Tag</th>
-		<th>Description</th>
-	</tr>
-	<tr>
-		<td align="left" colspan="2" style="color:#A81D33;text-align:left;">Debian 12 <small>(Bookwork Slim)</small> w/ Node.js v23.7.0 &nbsp;<strong><em>(default)</em></strong></td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=latest" target="_blank"><code>latest</code></td>
-		<td>Latest stable release (aka 3.1.8)</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=3.1.8" target="_blank"><code>3.1.8</code></a></td>
-		<td>Specific release version</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=3.1" target="_blank"><code>3.1</code></a></td>
-		<td>Major-minor version tag pointing to the latest patch (3.1.8) release within that minor version (3.1.x)</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=3" target="_blank"><code>3</code></a></td>
-		<td>Major version tag pointing to the latest stable (3.1.8) release within that major version (3.x.x)</td>
-	</tr>
-	<tr>
-		<td align="left" colspan="2" style="color:#0D597F;text-align:left;">Alpine Linux 3.21 w/ Node.js v23.7.0 &nbsp;<strong><em>(smallest image size)</em></strong></td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=alpine" target="_blank"><code>alpine</code></td>
-		<td>Latest stable release (aka 3.1.8)</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=3.1.8-alpine" target="_blank"><code>3.1.8-alpine</code></a></td>
-		<td>Specific release version</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=3.1-alpine" target="_blank"><code>3.1-alpine</code></a></td>
-		<td>Major-minor version tag pointing to the latest patch (3.1.8) release within that minor version (3.1.x)</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=3-alpine" target="_blank"><code>3-alpine</code></a></td>
-		<td>Major version tag pointing to the latest stable (3.1.8) release within that major version (3.x.x)</td>
-	</tr>
-</table>
-
-#### Usage
-
-Pull the latest stable version:
-
-```sh
-docker pull rajnandan1/kener:latest
+```dotenv
+KENER_SECRET_KEY=replace_with_a_random_string
+ORIGIN=http://localhost:3000
+REDIS_URL=redis://localhost:6379
+PORT=3000
 ```
 
-Or use the smaller, Alpine-based variant:
+For the full quick start (including local Docker builds and dev mode), see the docs:
 
-```sh
-docker pull rajnandan1/kener:alpine
-```
-
-For a production setup, refer to the sample [docker-compose.yml](https://github.com/rajnandan1/kener/blob/main/docker-compose.yml).
-This keeps things clean, structured, and easy to read while preserving all the details.
-
-### One Click
-
-[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/template/spSvic?referralCode=1Pn7vs)
+- https://kener.ing/docs/v4/getting-started/quick-start
 
 ## Features
 
-Here are some of the features that you get out of the box. Please read the documentation to know how to use them.
+Kener combines public status page essentials with advanced admin workflows.
 
-### 📊 &nbsp;Monitoring and Tracking
+### 📊 &nbsp;Monitoring, Reliability, and Communication
 
-- Advanced **application performance monitoring** tools
-- **Real-time network monitoring** capabilities
-- Supports **polling HTTP endpoints** or **pushing data** via REST APIs
-- **Timezone auto-adjustment** for visitors
-- Organize monitors into **custom sections**
-- **Cron-based scheduling** (minimum: **every minute**)
-- **Create complex API polls** (chaining, secrets, etc.)
-- Set a **default status** for monitors
-- Supports **base path hosting in Kubernetes (k8s)**
-- **Pre-built Docker images** for easy deployment
+- Monitor **API, Ping, TCP, DNS, SSL, SQL, Heartbeat, and GameDig** checks
+- Manage incidents with clear timelines, updates, and acknowledgements
+- Schedule maintenance windows and keep users informed throughout
+- Send notifications via **Email, Webhook, Slack, and Discord**
+- Explore historical monitoring data and uptime trends
 
-### 🎨 &nbsp;Customization and Branding
+### 🎨 &nbsp;Status Page Experience and Branding
 
-- Fully **customizable status page**
-- **Badge generation** for status and uptime tracking
-- Support for **custom domains**
-- Embed monitors as **iframes or widgets**
-- **Light & Dark Mode**
-- **Internationalization (i18n) support**
-- **Sleek, beautifully crafted UI**
+- Build branded, customizable status pages (logo, colors, CSS, themes)
+- Support **light/dark mode**, localization, and timezone-aware display
+- Embed status widgets and badges into external sites and portals
+- Provide SEO-friendly public pages for global audiences
 
-### 🚨 &nbsp;Incident Management
+### 🛠️ &nbsp;Operations, Collaboration, and Automation
 
-- **Incident tracking & communication** tools
-- **Comprehensive APIs** for incident management
-
-### 🧑‍💻 &nbsp;User Experience and Design
-
-- **Accessible & user-friendly interface**
-- **Quick & easy installation**
-- **Responsive design** for all devices
-- **Auto SEO & Social Media ready**
-- **Server-Side Rendering (SSR) for better performance**
-
-<div align="left">
-    <img alt="Visitor Stats" src="https://widgetbite.com/stats/rajnandan"/>
-</div>
+- Invite teams with role-based collaboration across workflows
+- Manage multiple status pages from one Kener instance
+- Use trigger-based workflows and template-driven messaging
+- Manage API keys for secure integrations and automations
+- Integrate analytics providers like GA, Plausible, Mixpanel, Umami, and Clarity
+- Access the full REST API for incidents, monitors, and reporting
 
 ## Technologies Used
 
--   [SvelteKit](https://kit.svelte.dev/)
--   [shadcn-svelte](https://www.shadcn-svelte.com/)
+- [SvelteKit](https://kit.svelte.dev/)
+- [shadcn-svelte](https://www.shadcn-svelte.com/)
 
 ## Support Me
 
 If you’re enjoying Kener and want to support its development, consider sponsoring me on GitHub or treating me to a coffee. Your support helps keep the project growing! 🚀
 
-[Sponsor Me Using Github](https://github.com/sponsors/rajnandan1)
+- [Sponsor Me Using GitHub](https://github.com/sponsors/rajnandan1)
 
-☕ &nbsp;[Buy Me a Coffee](https://www.buymeacoffee.com/rajnandan1)
-
-![image](https://badges.pufler.dev/visits/rajnandan1/kener)
+- [Buy Me a Coffee](https://www.buymeacoffee.com/rajnandan1)
 
 ## Contributing
 

README.template.md

@@ -1,217 +0,0 @@
-# Kener - Stunning Status Pages
-
-<p align="center">
-	<img src="https://kener.ing/newbg.png?v=1" width="100%" height="auto" class="rounded-lg shadow-lg" alt="kener example illustration">
-</p>
-
-<p align="center">
-	<img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/rajnandan1/kener?label=Star%20Repo&style=social">
-	<a href="https://github.com/ivbeg/awesome-status-pages"><img src="https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg" alt="Awesome status page" /></a>
-    <a href="https://awesome-selfhosted.net/tags/status--uptime-pages.html#kener"><img src="https://awesome.re/mentioned-badge.svg" alt="Awesome self hosted" /></a>
-</p>
-
-<p align="center">
-  <a href="https://hub.docker.com/r/rajnandan1/kener"><img src="https://img.shields.io/docker/pulls/rajnandan1/kener" alt="Docker Kener" /></a>
-  <a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=latest"><img alt="Docker Image Size" src="https://img.shields.io/docker/image-size/rajnandan1/kener/latest?logo=docker&logoColor=white&label=debian" /></a>
-  <a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=alpine"><img alt="Docker Image Size" src="https://img.shields.io/docker/image-size/rajnandan1/kener/alpine?logo=docker&logoColor=white&label=alpine" /></a>
-</p>
-
-<p align="center">
-  <a href="https://github.com/rajnandan1/kener/actions/workflows/publish-images.yml"><img alt="GitHub Workflow Status" src="https://img.shields.io/github/actions/workflow/status/rajnandan1/kener/publish-images.yml" /></a>
-  <a href="https://github.com/rajnandan1/kener/commit/HEAD"><img src="https://img.shields.io/github/last-commit/rajnandan1/kener/main" alt="" /></a>
-  <a href="https://github.com/rajnandan1/kener/issues"><img alt="GitHub issues" src="https://img.shields.io/github/issues/rajnandan1/kener.svg" /></a>
-</p>
-
-<p align="center">
-	<a href="https://www.producthunt.com/posts/kener-2" target="_blank">
-		<img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=kener-2&theme=light" alt="Kener on Product Hunt">
-	</a>
-</p>
-
-<p align="center">
-	<picture>
-  		<source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f514/512.webp" type="image/webp">
-  		<img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f514/512.gif" alt="🔔" width="32" height="32">
-	</picture>
-	<picture>
-  		<source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.webp" type="image/webp">
-  		<img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.gif" alt="🚀" width="32" height="32">
-	</picture>
-	<picture>
-  		<source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f6a7/512.webp" type="image/webp">
- 		<img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f6a7/512.gif" alt="🚧" width="32" height="32">
-	</picture>
-</p>
-
-| [🌍 Live Server](https://kener.ing) | [🎉 Quick Start](https://kener.ing/docs/quick-start) | [🗄 Documentation](https://kener.ing/docs/home) |
-| ----------------------------------- | ---------------------------------------------------- | ----------------------------------------------- |
-
-## What is Kener?
-
-**Kener** is a sleek and lightweight status page system built with **SvelteKit** and **NodeJS**. It’s not here to replace heavyweights like Datadog or Atlassian but rather to offer a simple, modern, and hassle-free way to set up a great-looking status page with minimal effort.
-
-Designed with **ease of use** and **customization in mind**, Kener provides all the essential features you’d expect from a status page—without unnecessary complexity.
-
-### Why Kener?
-
-✅ &nbsp;Minimal overhead &ndash; Set up quickly with a clean, modern UI<br>
-✅ &nbsp;Customizable &ndash; Easily tailor it to match your brand<br>
-✅ &nbsp;Open-source & free &ndash; Because great tools should be accessible to everyone
-
-### What's in a Name?
-
-“Kener” is inspired by the Assamese word _“Kene”_, meaning _“how’s it going?”_. The _‘.ing’_ was added because, well… that domain was available. 😄
-
-## Installation
-
-### Manual
-
-```shell
-# Clone the repository
-git clone https://github.com/rajnandan1/kener.git
-cd kener
-npm install
-cp .env.example .env
-npm run dev
-```
-
-### Docker
-
-Official Docker images for **Kener** are available on [Docker Hub](https://hub.docker.com/r/rajnandan1/kener). Multiple versions are maintained to support different use cases.
-
-<a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name={{kener_full_version}}"><img src="https://img.shields.io/badge/Latest_Stable_Release-{{kener_full_version}}-blue" alt="Kener latest stable version: {{kener_full_version}}" /></a>
-
-#### Available Tags
-
-<table>
-	<tr>
-		<th>Image Tag</th>
-		<th>Description</th>
-	</tr>
-	<tr>
-		<td align="left" colspan="2" style="color:#A81D33;text-align:left;">Debian 12 <small>(Bookwork Slim)</small> w/ Node.js v23.7.0 &nbsp;<strong><em>(default)</em></strong></td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=latest" target="_blank"><code>latest</code></td>
-		<td>Latest stable release (aka {{kener_full_version}})</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name={{kener_full_version}}" target="_blank"><code>{{kener_full_version}}</code></a></td>
-		<td>Specific release version</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name={{kener_major_minor_version}}" target="_blank"><code>{{kener_major_minor_version}}</code></a></td>
-		<td>Major-minor version tag pointing to the latest patch ({{kener_full_version}}) release within that minor version ({{kener_major_minor_version}}.x)</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name={{kener_major_version}}" target="_blank"><code>{{kener_major_version}}</code></a></td>
-		<td>Major version tag pointing to the latest stable ({{kener_full_version}}) release within that major version ({{kener_major_version}}.x.x)</td>
-	</tr>
-	<tr>
-		<td align="left" colspan="2" style="color:#0D597F;text-align:left;">Alpine Linux 3.21 w/ Node.js v23.7.0 &nbsp;<strong><em>(smallest image size)</em></strong></td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name=alpine" target="_blank"><code>alpine</code></td>
-		<td>Latest stable release (aka {{kener_full_version}})</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name={{kener_full_version}}-alpine" target="_blank"><code>{{kener_full_version}}-alpine</code></a></td>
-		<td>Specific release version</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name={{kener_major_minor_version}}-alpine" target="_blank"><code>{{kener_major_minor_version}}-alpine</code></a></td>
-		<td>Major-minor version tag pointing to the latest patch ({{kener_full_version}}) release within that minor version ({{kener_major_minor_version}}.x)</td>
-	</tr>
-	<tr>
-		<td><a href="https://hub.docker.com/r/rajnandan1/kener/tags?page=1&ordering=last_updated&name={{kener_major_version}}-alpine" target="_blank"><code>{{kener_major_version}}-alpine</code></a></td>
-		<td>Major version tag pointing to the latest stable ({{kener_full_version}}) release within that major version ({{kener_major_version}}.x.x)</td>
-	</tr>
-</table>
-
-#### Usage
-
-Pull the latest stable version:
-
-```sh
-docker pull rajnandan1/kener:latest
-```
-
-Or use the smaller, Alpine-based variant:
-
-```sh
-docker pull rajnandan1/kener:alpine
-```
-
-For a production setup, refer to the sample [docker-compose.yml](https://github.com/rajnandan1/kener/blob/main/docker-compose.yml).
-This keeps things clean, structured, and easy to read while preserving all the details.
-
-### One Click
-
-[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/template/spSvic?referralCode=1Pn7vs)
-
-## Features
-
-Here are some of the features that you get out of the box. Please read the documentation to know how to use them.
-
-### 📊 &nbsp;Monitoring and Tracking
-
-- Advanced **application performance monitoring** tools
-- **Real-time network monitoring** capabilities
-- Supports **polling HTTP endpoints** or **pushing data** via REST APIs
-- **Timezone auto-adjustment** for visitors
-- Organize monitors into **custom sections**
-- **Cron-based scheduling** (minimum: **every minute**)
-- **Create complex API polls** (chaining, secrets, etc.)
-- Set a **default status** for monitors
-- Supports **base path hosting in Kubernetes (k8s)**
-- **Pre-built Docker images** for easy deployment
-
-### 🎨 &nbsp;Customization and Branding
-
-- Fully **customizable status page**
-- **Badge generation** for status and uptime tracking
-- Support for **custom domains**
-- Embed monitors as **iframes or widgets**
-- **Light & Dark Mode**
-- **Internationalization (i18n) support**
-- **Sleek, beautifully crafted UI**
-
-### 🚨 &nbsp;Incident Management
-
-- **Incident tracking & communication** tools
-- **Comprehensive APIs** for incident management
-
-### 🧑‍💻 &nbsp;User Experience and Design
-
-- **Accessible & user-friendly interface**
-- **Quick & easy installation**
-- **Responsive design** for all devices
-- **Auto SEO & Social Media ready**
-- **Server-Side Rendering (SSR) for better performance**
-
-<div align="left">
-    <img alt="Visitor Stats" src="https://widgetbite.com/stats/rajnandan"/>
-</div>
-
-## Technologies Used
-
--   [SvelteKit](https://kit.svelte.dev/)
--   [shadcn-svelte](https://www.shadcn-svelte.com/)
-
-## Support Me
-
-If you’re enjoying Kener and want to support its development, consider sponsoring me on GitHub or treating me to a coffee. Your support helps keep the project growing! 🚀
-
-[Sponsor Me Using Github](https://github.com/sponsors/rajnandan1)
-
-☕ &nbsp;[Buy Me a Coffee](https://www.buymeacoffee.com/rajnandan1)
-
-![image](https://badges.pufler.dev/visits/rajnandan1/kener)
-
-## Contributing
-
-If you want to contribute to Kener, please read the [Contribution Guide](https://github.com/rajnandan1/kener/blob/main/.github/CONTRIBUTING.md).
-
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=rajnandan1/kener&type=Date)](https://star-history.com/#rajnandan1/kener&Date)

components.json

@@ -1,13 +1,16 @@
 {
-	"$schema": "https://shadcn-svelte.com/schema.json",
-	"style": "default",
-	"tailwind": {
-		"config": "tailwind.config.js",
-		"css": "src/app.postcss",
-		"baseColor": "slate"
-	},
-	"aliases": {
-		"components": "$lib/components",
-		"utils": "$lib/utils"
-	}
+  "$schema": "https://shadcn-svelte.com/schema.json",
+  "tailwind": {
+    "css": "src/routes/layout.css",
+    "baseColor": "zinc"
+  },
+  "aliases": {
+    "components": "$lib/components",
+    "utils": "$lib/utils",
+    "ui": "$lib/components/ui",
+    "hooks": "$lib/hooks",
+    "lib": "$lib"
+  },
+  "typescript": true,
+  "registry": "https://shadcn-svelte.com/registry"
 }

docker-compose.dev.yml

@@ -0,0 +1,56 @@
+# =============================================================================
+# Kener v4 — Development Docker Compose (local build testing)
+#
+# Builds the image from the local Dockerfile instead of pulling from a registry.
+#
+# Usage:
+#   docker compose -f docker-compose.dev.yml up -d --build
+#
+# Build a specific variant:
+#   docker compose -f docker-compose.dev.yml build --build-arg VARIANT=debian
+#   docker compose -f docker-compose.dev.yml up -d
+# =============================================================================
+
+services:
+  # ---------------------------------------------------------------------------
+  # Redis
+  # ---------------------------------------------------------------------------
+  redis:
+    image: redis:7-alpine
+    container_name: kener-redis-dev
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # ---------------------------------------------------------------------------
+  # Kener — built from local Dockerfile
+  # ---------------------------------------------------------------------------
+  kener:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        VARIANT: alpine # or "debian"
+        NODE_VERSION: 24
+        WITH_DOCS: "true"
+        KENER_BASE_PATH: ""
+    container_name: kener-dev
+    environment:
+      KENER_SECRET_KEY: dev-secret-key-for-local-testing-only
+      ORIGIN: http://localhost:3000
+      REDIS_URL: redis://redis:6379
+      # DATABASE_URL: sqlite://./database/kener.sqlite.db
+    ports:
+      - "3000:3000"
+    volumes:
+      - dev_data:/app/database
+    depends_on:
+      redis:
+        condition: service_healthy
+
+volumes:
+  dev_data:

docker-compose.status.yml

@@ -0,0 +1,47 @@
+# =============================================================================
+# Kener v4 — Production Docker Compose for /status base path
+#
+# Usage:
+#   docker compose -f docker-compose.status.yml up -d
+# =============================================================================
+
+services:
+  redis:
+    image: redis:7-alpine
+    container_name: kener-redis-status
+    restart: unless-stopped
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  kener:
+    image: rajnandan1/kener:latest-status
+    # For Alpine variant use: rajnandan1/kener:latest-status-alpine
+    container_name: kener-status
+    environment:
+      KENER_SECRET_KEY: replace_me_with_a_random_string # generate: openssl rand -base64 32
+      ORIGIN: http://localhost:3000/status
+      REDIS_URL: redis://redis:6379
+      KENER_BASE_PATH: /status
+
+      # DATABASE_URL: sqlite://./database/kener.sqlite.db
+      # DATABASE_URL: postgresql://user:password@postgres:5432/kener
+      # DATABASE_URL: mysql://user:password@mysql:3306/kener
+    ports:
+      - "3000:3000"
+    volumes:
+      - data:/app/database
+    depends_on:
+      redis:
+        condition: service_healthy
+    restart: unless-stopped
+
+volumes:
+  data:
+    name: kener_db_status
+  redis_data:
+    name: kener_redis_status

docker-compose.yml

@@ -1,61 +1,115 @@
-# Docker Compose Configuration
-# Description: This file sets up a multi-container environment for Kener (https://github.com/rajnandan1/kener).
-# Last Updated: 2025-02-08
-# Docker Compose Version: 3.8
-# Notes: Ensure that you specify a random value for the `KENER_SECRET_KEY` environment variable before running `docker-compose up -d`.
-
-version: '3.8'
+# =============================================================================
+# Kener v4 — Production Docker Compose
+#
+# Usage:
+#   docker compose up -d
+#
+# Defaults to the published image. To use a local build instead:
+#   docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
+# =============================================================================
 
 services:
-  kener:
-    image: rajnandan1/kener:latest      # Change to 'rajnandan1/kener:alpine' for an even smaller image! 😁🚀
-    container_name: kener
-    # env_file: custom.env              # Uncomment this if you are needing to export environment variables from a custom environment file. By default, Docker will import any variables that exist in `.env`
-    environment:
-      TZ: Etc/UTC
-      KENER_SECRET_KEY: replace_me_with_a_random_string   # Keep private!! - best to define in `.env` file or through Docker Secret
-      # DATABASE_URL: custom_db_url     # By default, a SQLite database is used - you may override the database url/type here
-      # RESEND_API_KEY: 
-      # RESEND_SENDER_EMAIL: 
-
-      ### You most likely will NOT need to change anything below this line. Be sure you know what you're doing!! (https://kener.ing/docs/deployment/#docker-environment-variables)
-
-      # PORT: 3000                      # Port that app listens on in the container
-      # KENER_BASE_PATH:                # By default, Kener runs at `/`. You may change this to be, e.g. `/status`, etc. Do NOT add a trailing slash!! (more info here: https://kener.ing/docs/deployment/#docker-environment-variables)
-      # ORIGIN: http://localhost:3000
-      # NODE_ENV: production            # This is already set to "production" by default within the container
-    ports:
-      - '3000:3000/tcp'
+  # ---------------------------------------------------------------------------
+  # Redis — required for BullMQ queues, caching, and scheduler
+  # ---------------------------------------------------------------------------
+  redis:
+    image: redis:7-alpine
+    container_name: kener-redis
+    restart: unless-stopped
     volumes:
-      - data:/app/database              # We suggest using a Docker named volume, which is more performant for databases
-      - $(pwd)/uploads:/app/uploads
-    # read_only: true                   # Uncommenting this fortifies security by marking the container's filesystem as read-only (aka no data can be written to the container's filesystem except for explicitly defined writable volumes and bind mounts, an exception has already been defined for `/database` and `/uploads`)
-    restart: unless-stopped
-    # depends_on:                       #  <-- Uncomment if you would like to use PostgreSQL or MySQL
-    #   - postgres                      #       ...instead of SQLite
-    #   - mysql                         #
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
-  # Only use below section if you would like to utilize PostgreSQL instead of Kener's default SQLite database. (Don't forget to set `DATABASE_URL` in `kener` service to be: `DATABASE_URL=postgresql://db_user:db_password@localhost:5432/kener_db`)
-  postgres:
-    image: postgres:alpine
-    name: kener_db
+  # ---------------------------------------------------------------------------
+  # Kener — Status Page Application
+  # ---------------------------------------------------------------------------
+  kener:
+    image: rajnandan1/kener:latest
+    # For Alpine variant use: rajnandan1/kener:alpine
+    container_name: kener
     environment:
-      POSTGRES_USER: user
-      POSTGRES_PASSWORD: some_super_random_secure_password   # Best to define this in `.env` or via Docker Secret!!
-      POSTGRES_DB: kener_db
+      # ── Required ──
+      KENER_SECRET_KEY: replace_me_with_a_random_string # generate: openssl rand -base64 32
+      ORIGIN: http://localhost:3000 # public URL of your Kener instance (required for CSRF protection)
+      REDIS_URL: redis://redis:6379
+
+      # ── Database (default: SQLite) ──
+      # DATABASE_URL: sqlite://./database/kener.sqlite.db
+      # DATABASE_URL: postgresql://user:password@postgres:5432/kener
+      # DATABASE_URL: mysql://user:password@mysql:3306/kener
+
+      # ── Email (optional) ──
+      # RESEND_API_KEY:
+      # RESEND_SENDER_EMAIL:
+      # SMTP_HOST:
+      # SMTP_PORT:
+      # SMTP_USER:
+      # SMTP_PASSWORD:
+      # SMTP_SENDER:
+      # SMTP_SECURE: 0
+
+      # ── Advanced (you likely don't need to change these) ──
+      # PORT: 3000
+      # KENER_BASE_PATH:
+      # NODE_ENV: production          # already set in the image
+    ports:
+      - "3000:3000"
+    volumes:
+      - data:/app/database
+    depends_on:
+      redis:
+        condition: service_healthy
     restart: unless-stopped
 
-  # Only use below section if you would like to utilize MySQL instead of Kener's default SQLite database. (Don't forget to set `DATABASE_URL` in `kener` service to be: `DATABASE_URL=mysql://db_user:db_password@localhost:3306/kener_db`)
-  mysql:
-    image: mariadb:11
-    name: kener_db
-    environment:
-      MYSQL_USER: user
-      MYSQL_PASSWORD: some_super_random_secure_password   # Best to define this in `.env` or via Docker Secret!!
-      MYSQL_DATABASE: kener_db
-      MYSQL_RANDOM_ROOT_PASSWORD: true
-    restart: unless-stopped
+  # ---------------------------------------------------------------------------
+  # Optional: PostgreSQL (uncomment and set DATABASE_URL above)
+  # ---------------------------------------------------------------------------
+  # postgres:
+  #   image: postgres:16-alpine
+  #   container_name: kener-postgres
+  #   environment:
+  #     POSTGRES_USER: kener
+  #     POSTGRES_PASSWORD: change_me        # use a strong password
+  #     POSTGRES_DB: kener
+  #   volumes:
+  #     - postgres_data:/var/lib/postgresql/data
+  #   restart: unless-stopped
+  #   healthcheck:
+  #     test: ["CMD-SHELL", "pg_isready -U kener"]
+  #     interval: 10s
+  #     timeout: 5s
+  #     retries: 5
+
+  # ---------------------------------------------------------------------------
+  # Optional: MySQL / MariaDB (uncomment and set DATABASE_URL above)
+  # ---------------------------------------------------------------------------
+  # mysql:
+  #   image: mariadb:11
+  #   container_name: kener-mysql
+  #   environment:
+  #     MYSQL_USER: kener
+  #     MYSQL_PASSWORD: change_me            # use a strong password
+  #     MYSQL_DATABASE: kener
+  #     MYSQL_RANDOM_ROOT_PASSWORD: "true"
+  #   volumes:
+  #     - mysql_data:/var/lib/mysql
+  #   restart: unless-stopped
+  #   healthcheck:
+  #     test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+  #     interval: 10s
+  #     timeout: 5s
+  #     retries: 5
 
 volumes:
   data:
-    name: kener_db
+    name: kener_db
+  redis_data:
+    name: kener_redis
+  # postgres_data:
+  #   name: kener_postgres
+  # mysql_data:
+  #   name: kener_mysql

docker-entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+# Default body size limit for SvelteKit adapter-node (512K default is too small for image uploads)
+export BODY_SIZE_LIMIT="${BODY_SIZE_LIMIT:-3M}"
+
+# Index documentation into Redis when docs are bundled in the image
+if [ -f /app/scripts/index-docs.ts ]; then
+  echo "[kener] Indexing documentation into Redis..."
+  node --experimental-strip-types /app/scripts/index-docs.ts || \
+    echo "[kener] Warning: docs indexing failed (is REDIS_URL set?). Continuing..."
+fi
+
+exec "$@"

docker/root/etc/s6-overlay/s6-rc.d/init-app-config/run

@@ -1,36 +0,0 @@
-#!/usr/bin/with-contenv bash
-
-# used https://github.com/linuxserver/docker-plex as a template
-
-POPULATE_EXAMPLES=false
-
-echo "-------------------------------------"
-echo -e "Setting up app config directory based on CONFIG_DIR env: ${CONFIG_DIR}\n"
-
-# make config folder if it does not exist
-if [ ! -d "${CONFIG_DIR}" ]; then
-  echo "Directory does not exist! Creating..."
-  POPULATE_EXAMPLES=true
-  mkdir -p "${CONFIG_DIR}"
-else
-  if [ "$(ls -A ${CONFIG_DIR})" ]; then
-       echo "Directory is not empty, not populating with defaults."
-    else
-      POPULATE_EXAMPLES=true
-    fi
-fi
-
-# add example configs
-if [ "$POPULATE_EXAMPLES" = true ]; then
-  echo "Directory is empty, adding defaults..."
-  mkdir -p "${CONFIG_DIR}"/static
-  cp -r /app/static/. "${CONFIG_DIR}"/static
-  cp /app/config/monitors.example.yaml "${CONFIG_DIR}"/monitors.yaml
-  cp /app/config/site.example.yaml "${CONFIG_DIR}"/site.yaml
-fi
-
-# permissions
-echo "chown'ing directory to ensure correct permissions."
-chown -R abc:abc "${CONFIG_DIR}"
-echo "Done!"
-echo -e "-------------------------------------\n"

docker/root/etc/s6-overlay/s6-rc.d/init-app-config/type

@@ -1 +0,0 @@
-oneshot

docker/root/etc/s6-overlay/s6-rc.d/init-app-config/up

@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-app-config/run

docker/root/etc/s6-overlay/s6-rc.d/svc-app/run

@@ -1,9 +0,0 @@
-#!/usr/bin/with-contenv bash
-
-echo -e "\nApp is starting!"
-export NODE_ENV=production
-cd /app || exit
-
-# Run build first
-exec \
-	  s6-setuidgid abc /usr/bin/node $NODE_ARGS /app/main.js

docker/root/etc/s6-overlay/s6-rc.d/svc-app/type

@@ -1 +0,0 @@
-longrun

docs/adr/0001-explicit-group-membership.md

@@ -0,0 +1,5 @@
+# Group membership is an explicit stored list, not a rule
+
+When making group-monitor member selection searchable (#694), the requester also proposed dynamic membership by tag pattern (e.g. `site1-*` auto-adds matching monitors). We decided group membership stays an explicit, stored list of members. Dynamic membership contradicts the group model: each member carries an explicit weight (weights must sum to 1) and a manual execution order — a rule that adds/removes members over time would need an auto-weighting policy, silent weight redistribution when monitors are created or deleted, and an undefined execution order for matched members. Bulk needs are served in the editor instead: search plus "Add all N matching" makes large explicit groups cheap to build.
+
+If wildcard groups are requested again, the answer is here: it's a different feature (a rule-based aggregate without weights or order), not an extension of Group Monitors.

docs/adr/0002-maintenance-page-keyed-by-event-id.md

@@ -0,0 +1,5 @@
+# Public maintenance page is keyed by Maintenance Event id
+
+The public route `/maintenances/<id>` interprets `<id>` as a Maintenance Event id by default (with `?type=maintenance` to address a Maintenance definition instead), even though the route param is named `maintenance_id`. Issue #723 showed this misleads API consumers: `/api/v4/maintenances` returns Maintenance ids, and linking those to `/maintenances/<id>` lands on whatever Event happens to carry that id — an apparent "off-by-one title mismatch" with no actual data corruption.
+
+We considered flipping the route default to Maintenance ids but rejected it: every internal status-page link, subscriber email, and externally bookmarked URL is keyed by Event id, and all of those would break. Instead, v4 API responses carry an absolute `url` field (built from the configured Site URL) that resolves correctly — `?type=maintenance` for Maintenance objects, the plain Event-id path for Maintenance Events. Consumers should link via `url`, never by concatenating ids onto paths.

docs/adr/0003-fail-fast-self-healing-db-pool.md

@@ -0,0 +1,9 @@
+# Fail-fast, self-healing database pool defaults
+
+`knexfile.ts` overrides knex's pool defaults for network databases (Postgres, MySQL): `pool.min` is 0 instead of 2, acquire/create timeouts are 15s instead of 60s/30s, and TCP keepalive is enabled on connections. All knobs are overridable via `DATABASE_*` env vars.
+
+Two production incidents drove this. On Railway, a Postgres outage caused every request to hang for knex's default 60s `acquireConnectionTimeout` before failing with `KnexTimeoutError`, and after the database recovered the app stayed broken until a manual restart. In Docker Swarm (#692), the overlay network's conntrack silently dropped idle TCP connections after ~20 minutes, so the first request after an idle period drew a dead socket from the pool and returned a 500; the reporter worked around it with server-side Postgres `tcp_keepalives_*` settings and asked for an application-level fix.
+
+Both share one root cause: knex keeps `pool.min` connections forever and never validates them. Those permanently-idle sockets are exactly the ones cloud networks (Railway proxies, Swarm overlays, k8s) silently kill, and after any database blip they wedge the pool with corpses. `min: 0` lets the reaper retire every idle connection (`idleTimeoutMillis` 30s, well under typical conntrack windows), keepalive lets the OS detect silently-dropped sockets, and the 15s timeouts turn a minute-long hang into a fast failure during an outage.
+
+The trade-off: a quiet instance pays connection setup on the first query after idle (tens of milliseconds), and a database that takes longer than 15s to accept connections will see failures where the old defaults would have waited a minute. Deployments with such databases can raise `DATABASE_ACQUIRE_TIMEOUT_MS` / `DATABASE_CREATE_TIMEOUT_MS` rather than the project reverting to defaults that wedge everyone else.

docs/adr/0004-home-page-api-token.md

@@ -0,0 +1,9 @@
+# Home page is addressed as `~home` in the v4 API
+
+The Home Page is stored with an empty `page_path`, which can not appear as a URL segment, so `/api/v4/pages/{page_path}` could not address it at all (#737). The v4 API now accepts the special segment `~home` for it: the request middleware maps `~home` to a lookup of the empty path before handlers run.
+
+We considered the reporter's suggestion of a `default` keyword, and `home`, but both are valid page paths under the sanitizer (`[a-z0-9_-]`), so a real page could shadow the keyword or force reservation rules and migration edge cases. We also considered addressing pages by id, which either breaks the existing path-based contract or is ambiguous with numeric page paths. `~home` can never collide because the sanitizer strips `~`, and tilde is an RFC 3986 unreserved character, so clients never need to encode it (percent-encoded `%7Ehome` works too, since the middleware decodes segments).
+
+Semantics follow the server-side invariants the manage UI relies on: `PATCH` via `~home` accepts every field except `page_path`, which is fixed for the home page (the UI disables the field), and `DELETE` is rejected — `DeletePage` in `pagesController` throws "Cannot delete the home page" and the rest of the app assumes the home page exists.
+
+API responses also render the home page's `page_path` as `~home` (list, single, and write responses), so what a consumer reads is exactly what it can address — list → pick → `PATCH` round-trips cleanly, including read-modify-write bodies that send `~home` back (treated as "no path change"). The stored path remains empty and the public URL remains the site root; consumers must not build public URLs by concatenating `page_path`.

docs/adr/0005-alerts-evaluate-alert-visible-samples.md

@@ -0,0 +1,9 @@
+# Alerts evaluate alert-visible samples, not just REALTIME ones
+
+The consecutive-sample checks behind alert evaluation (`consecutivelyStatusFor`, `consecutivelyLatencyGreaterThan`, `consecutivelyLatencyLessThan` in `src/lib/server/db/repositories/monitoring.ts`) consider samples whose type is `REALTIME`, `ERROR`, `TIMEOUT`, `MANUAL`, or `DEFAULT_STATUS` — the "alert-visible" set — instead of `REALTIME` only. Both data-API PATCH endpoints (single timestamp and range) enqueue one alert evaluation after writing `MANUAL` rows. `SIGNAL` rows and `INCIDENT`/`MAINTENANCE` overlay rows remain invisible to alerting. Amended by ADR 0006: last-known-status fill (`CARRIED`) later joined the alert-visible set under the same invariant.
+
+Two issues drove this. In #633, a GameDig monitor showed DOWN on the status page but never alerted: a down game server makes `GameDig.query` throw, so every down-sample is recorded as `ERROR`, which the old `type = REALTIME` filter excluded — the "N consecutive DOWN" condition could never become true. The same failure mode silently broke gRPC, SQL, and SSL monitors (hard-down records `ERROR`) and API monitors whose outage manifests as timeouts (`TIMEOUT`). In #720, a NONE monitor driven by the data API never alerted for two stacked reasons: PATCH writes `MANUAL` rows the filter excluded, and the endpoint never enqueued evaluation at all. The status page and UPTIME alerts have no type filter, which is why users saw DOWN while alerts stayed silent.
+
+The whitelist is exactly the set of types written by flows that trigger alert evaluation — scheduler checks (`REALTIME`/`ERROR`/`TIMEOUT`), default-status fill (`DEFAULT_STATUS`), and data-API pushes (`MANUAL`). That invariant ("every enqueuer of evaluation contributes a row the evaluator can see") is what keeps the un-time-bounded last-N query self-healing: without `DEFAULT_STATUS` in the set, a NONE monitor with a default status evaluates every minute against rows it cannot see, so stale backfilled `MANUAL` rows would rank as "the last N" and fire alerts weeks after the fact. The rejected alternatives: fixing only `gamedigCall` to emit `REALTIME` on query failure (fixes one monitor type out of five, loses the stored down-vs-errored diagnostic, and does nothing for existing data), and time-bounding the query (the cutoff must scale with each monitor's cron, which means parsing cron expressions in the alert path for marginal benefit).
+
+The trade-offs, accepted deliberately for one uniform rule across status and latency alerts: a service that degrades from slow to hard-down resolves an active latency alert (error samples carry latency 0, satisfying "consecutively below threshold") — the status alert is the one that covers outages; a NONE monitor with a default status auto-resolves MANUAL-pushed alerts once default fill resumes, because a default status is an explicit statement that absence of pushes means that status; and the fix is retroactive, so monitors that were already down at upgrade time alert shortly after — which is the bug report, inverted.

docs/adr/0006-last-known-status-fill.md

@@ -0,0 +1,7 @@
+# Last Known Status is a Default Status choice that repeats the latest alert-visible sample
+
+Issue #721: push-driven NONE monitors lost their status between pushes in v4 — one red minute, then gray forever — because the per-minute sample model only fills gaps with a static `default_status`. We added a fifth Default Status choice, `LAST_KNOWN`, where each tick with no observed sample writes a `CARRIED` row repeating the most recent alert-visible sample — status and latency alike. It is modeled as a dropdown value rather than a separate "sticky" checkbox so that "what does a minute without a sample mean" stays a single dimension with no conflicting combinations; the same cleanup removed the `MAINTENANCE` option, which the UI offered but the fill engine had always silently ignored (stored `MAINTENANCE`/unknown values migrate to `NONE`, preserving behavior).
+
+The carry source is the most recent **Alert-Visible Sample** by timestamp, and `CARRIED` itself joins the alert-visible set. That one rule does three jobs: incident/maintenance overlays and raw heartbeat `SIGNAL` receipts can never become sticky; backdated data-API corrections cannot rewrite the present (newer carried rows outrank them); and ADR 0005's invariant — every flow that enqueues alert evaluation contributes a row the evaluator can see — keeps holding. The consequences were accepted deliberately: a single DOWN push triggers status alerts once carried minutes meet the failure threshold, alerts never auto-resolve (recovery must be pushed — unlike a fixed default, nothing "resumes"), and enabling the option on a monitor whose last push was DOWN fires the alert shortly after — the bug report, inverted, same as ADR 0005.
+
+Rejected alternatives: a staleness cap ("carry for at most X, then gray") re-introduces "absence means unknown" — the opposite of what the admin just selected — and dead-integration detection is what Heartbeat monitors are for; reusing the `DEFAULT` sample type for carried rows loses the stored distinction between "admin declared absence means X" and "system repeated the last live statement"; backfilling the gap on enable would mutate historical uptime, so carry is tick-forward only and `CARRIED` rows persist as history if the setting is later changed. `LAST_KNOWN` is selectable only on NONE-type monitors — for polled types an observed sample wins the merge every tick, so offering it would be a dormant knob; changing a monitor's type away from NONE auto-resets the Default Status to UP so the invalid combination never persists.

docs/agents/domain.md

@@ -0,0 +1,37 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+This repo is configured as a **single-context** repo.
+
+## Before exploring, read these
+
+- **`CONTEXT.md`** at the repo root.
+- **`docs/adr/`** — read ADRs that touch the area you're about to work in.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The producer skill (`/grill-with-docs`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+Single-context repo:
+
+```text
+/
+├── CONTEXT.md
+├── docs/adr/
+│   ├── 0001-event-sourced-orders.md
+│   └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/grill-with-docs`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_

docs/agents/issue-tracker.md

@@ -0,0 +1,22 @@
+# Issue tracker: GitHub
+
+Issues and PRDs for this repo live as GitHub issues. Use the `gh` CLI for all operations.
+
+## Conventions
+
+- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.
+- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.
+- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.
+- **Comment on an issue**: `gh issue comment <number> --body "..."`
+- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`
+- **Close**: `gh issue close <number> --comment "..."`
+
+Infer the repo from `git remote -v` — `gh` does this automatically when run inside a clone.
+
+## When a skill says "publish to the issue tracker"
+
+Create a GitHub issue.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `gh issue view <number> --comments`.

docs/agents/triage-labels.md

@@ -0,0 +1,15 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
+
+Edit the right-hand column to match whatever vocabulary you actually use.

docs/alerts.md

@@ -1,36 +0,0 @@
----
-title: View Alerts | Kener
-description: Learn how to view alerts in kener.
----
-
-# View Alerts
-
-Alerts are used to notify you when a monitor goes down or up. You can view alerts in the Kener dashboard.
-
-## ID
-
-The unique ID of the alert.
-
-## Type
-
-The type of status that the alert is for. Example DOWN, DEGRADED
-
-## Monitor
-
-The monitor for which the alert is triggered.
-
-## Status
-
-The status of the alert. TRIGGERED, RESOLVED
-
-## Checks
-
-The number of checks that have been done.
-
-## Incident
-
-The incident that the alert is part of.
-
-## Created At
-
-The time when the alert was created.

docs/categorize-guide.md

@@ -1,45 +0,0 @@
----
-title: Categorize Monitors Guide | Kener
-description: Categorize Monitors in Kener
----
-
-# Categorize Monitors
-
-Let us add a category to our monitors.
-
-## Sample monitors.yaml
-
-```yaml
-- name: OkBookmarks
-  description: A free bookmark manager that lets you save and search your bookmarks in the cloud.
-  tag: "okbookmarks"
-  image: "https://okbookmarks.com/assets/img/extension_icon128.png"
-  api:
-      method: GET
-      url: https://okbookmarks.com
-- name: Earth
-  description: Our blue planet
-  tag: "earth"
-  default_status: "UP"
-  image: "/earth.png"
-  category: "Hello"
-- name: Frogment
-  description: A free openAPI spec editor and linter that breaks down your spec into fragments to make editing easier and more intuitive. Visit https://www.frogment.com
-  tag: "frogment"
-  image: "/frogment.png"
-  api:
-      method: GET
-      url: https://www.frogment.com
-```
-
-## Sample site.yaml
-
-```yaml
-#...
-categories:
-  - name: Hello
-	description: Say Hello to the world
-#...
-```
-
-The above will have OkBookmarks and Frogment under home. Earth will be under Hello category.

docs/changelogs.md

@@ -1,180 +0,0 @@
----
-title: Changelogs | Kener
-description: Changelogs for Kener
----
-
-# Changelogs
-
-Here are the changelogs for Kener. Changelogs are only published when there are new features or breaking changes.
-
-## v3.1.8
-
-<picture>
-  <source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.webp" type="image/webp">
-  <img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.gif" alt="🚀" width="32" height="32">
-</picture>
-
-### Features
-
-- **Timezone Support & UI Toggle**
-
-    - Added timezone support using `date-fns-tz` for improved date formatting.
-    - Introduced a UI toggle in settings to switch between different timezones.
-
-- **Enhanced Incident Management**
-
-    - Improved incident filtering to prevent duplicate auto incidents when creating manual incidents.
-    - Added support for incident sources to refine incident handling.
-
-- **Dynamic Cron Job Scheduling**
-
-    - Cron jobs are now dynamically added and removed based on active monitors.
-    - Ensures jobs are triggered in the correct order and prevents duplicate incidents.
-
-- **Monitor Component Improvements**
-    - Refactored monitor component for better data display and interaction.
-    - Improved uptime calculations.
-    - Added a dropdown to select time ranges for better visibility.
-
-### Fixes & Improvements
-
-- **Refactored Incident Handling & Scheduling** for better reliability and performance.
-- **UI Responsiveness Fixes** to improve the experience on smaller screens.
-- **Dependency Updates** to support new timezone functionality and ensure stability.
-
-## v3.0.10
-
-<picture>
-  <source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.webp" type="image/webp">
-  <img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.gif" alt="🚀" width="32" height="32">
-</picture>
-
-### Features
-
-- Added TCP monitors
-
-### Breaking Changes
-
-- Ping monitors will break.
-
-### Fixes
-
-- Bug fixes in the UI
-
-## v3.0.9
-
-<picture>
-  <source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.webp" type="image/webp">
-  <img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.gif" alt="🚀" width="32" height="32">
-</picture>
-
-### Features
-
-- Support of SMTP for email notifications. Read more [here](/docs/triggers/#email-smtp)
-- Introduction of event type `MAINTENANCE` for incidents.
-- You can write eval function for ping now in monitors. Read more [here](/docs/monitors-ping/#eval)
-- Added category filter for monitor management.
-
-### Fixes
-
-- Support longer TLD in `siteURL` example `https://example.network`
-- Remove googleapis preconnect and preload
-- Fixed wrong action url in webhook.
-
-## v3.0.1
-
-<picture>
-  <source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.webp" type="image/webp">
-  <img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.gif" alt="🚀" width="32" height="32">
-</picture>
-
-Here are the changes in this release
-
-### Features
-
-- Support for i18n in dates.
-- Support of i18n in monitor embeds. Read more [here](/docs/embed#javascript-parameters)
-
-## v3.0.0
-
-<picture>
-  <source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.webp" type="image/webp">
-  <img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.gif" alt="🚀" width="32" height="32">
-</picture>
-
-Here are the changes in this release
-
-### Features
-
-- New APIs for creating incidents and pushing updates. Read more [here](/docs/kener-apis)
-- Incident management is now part of the admin UI and removed from the config file.
-- The UI colors have been updated to be more muted.
-- Email Notifications for incidents using [resend](https://resend.com).
-- New Kener management portal. No monitors.yaml or site.yaml needed anymore
-- Login Page and Setup Page
-- Remove Github dependency
-- Options to disable square or dot pattern
-- Support for new languages
-- Multiple DB support (mysql, postgres, sqlite3)
-- New API reference
-- New documentation site
-
-## v2.0.0
-
-<picture>
-  <source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.webp" type="image/webp">
-  <img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.gif" alt="🚀" width="32" height="32">
-</picture>
-
-Here are the changes in this release
-
-### Features
-
-- Added support for sqlite3 and removed dependency on file system
-- Added support for postgres database. Read more [here](/docs/database)
-- Added support for alerting. Read more [here](/docs/alerting)
-- Added color customization. Read more [here](/docs/customize-site#color)
-- Added three new customizations for home page. Read more [here](/docs/customize-site#barstyle)
-    - `barStyle`
-    - `barRoundness`
-    - `summaryStyle`
-
-### Migration
-
-Kener will automatically migrate your data from file system to sqlite3. If you are using a custom domain, you need to update the `site.yaml` file with the new `siteURL` field. Read more [here](/docs/customize-site#siteURL)
-
-## v0.0.16
-
-<picture>
-  <source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.webp" type="image/webp">
-  <img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f680/512.gif" alt="🚀" width="32" height="32">
-</picture>
-
-Here are the changes in this release
-
-### Features
-
-- Added support for `hideURLForGet` in monitors. Read more [here](/docs/monitors)
-- New SVG badges for LIVE status. Read more [here](/docs/status-badges#live)
-- `[Breaking Change]` Removed dependency on Environment variable `PUBLIC_KENER_FOLDER`. Read more [here](#v0-0-16-migration)
-- Simplified build and deploy process
-- Added support for fonts. Read more [here](/docs/customize-site#font)
-- Added support for home page pattern. Read more [here](/docs/customize-site#pattern)
-- Added support for adding your analytics provider. Read more [here](/docs/site-analytics)
-- New Documentation Site
-- Addes support for `sqaures` pattern in home page. Read more [here](/docs/customize-site#pattern)
-- Redesigned the UI for better consistency
-- Embed now supports background color using a parameter `bgc`. Read more [here](/docs/embed#javascript-parameters)
-- Now title in `site.yaml` is `<title>` and `siteName` is actually the name of the site. Read more [here](/docs/customize-site#siteName)
-
-### Migration
-
-#### Source
-
-- Move data from `PUBLIC_KENER_FOLDER` to `/database` file.
-- Move `site.yaml` to `/config` folder
-- Move `monitors.yaml` to `/config` folder
-
-#### Docker
-
-- Use `-v $(pwd)/database:/app/database` and `-v $(pwd)/config:/app/config` in your docker run command

docs/custom-js-css-guide.md

@@ -1,42 +0,0 @@
----
-title: Custom JS and CSS Guide | Kener
-description: Custom JS and CSS Guide for Kener
----
-
-Here is a guide to add custom JS and CSS to your Kener instance.
-
-## Adding Custom JS
-
-Add your custom JS to `static/` file. And in the `src/app.html` file, add the following line:
-
-```html
-<script src="/your-custom-js-file.js"></script>
-```
-
-## Adding Custom CSS
-
-Three are two ways you can add custom CSS to your Kener instance.
-
-### CSS file
-
-Add your custom CSS to `static/` file. And in the `src/app.html` file, add the following line:
-
-```html
-<link rel="stylesheet" href="/your-custom-css-file.css" />
-```
-
-Do not forget to add the base path if you are using a subpath. For example, if you are using a subpath `/kener`, then the path should be `/kener/your-custom-js-file.js`.
-
-### Inline CSS
-
-To add inline css go to Manage kener -> Theme -> Custom CSS and add your CSS there.
-
-```css
-.my-class {
-	color: red;
-}
-```
-
-<div class="note danger">
-	Do not include &#x3C;style&#x3E; tags.
-</div>

docs/embed.md

@@ -1,89 +0,0 @@
----
-title: Embed Monitor | Kener
-description: Embed your monitor in your website
----
-
-# Embed Monitor
-
-There are two ways to embed your monitor in your website
-
-## Javascript
-
-You can embed your monitor in your website using javascript. We recommend using this method as it takes care of the height of the embedded monitor.
-
-```html
-<script
-	async
-	src="http://[hostname]/embed/monitor-[tag]/js?theme=light&monitor=http://[hostname]/embed/monitor-[tag]"
-></script>
-```
-
-Here is an example
-
-```html
-<script
-	async
-	src="https://kener.ing/embed/monitor-earth/js?theme=light&monitor=https://kener.ing/embed/monitor-earth"
-></script>
-```
-
-### Parameters
-
-You can pass the following parameters to the embed code
-
--   `theme`: You can pass `light` or `dark` theme
--   `monitor`: The monitor url
--   `bgc`: Background color of the monitor. Only supports hex color codes. DO NOT include the `#` symbol. Example: `ff0000`
--   `locale`: The locale of the monitor. You can pass the code of the locale you have enabled in your kener settings. Example: `en`, `fr` etc
-
-Replace `[hostname]` with your kener hostname and `[tag]` with your monitor tag.
-
-### Demo
-
-<div class="border mx-auto rounded-sm w-585px">
-	<script async src="/embed/monitor-earth/js?theme=dark&monitor=/embed/monitor-earth"></script>
-</div>
-
-## Iframe
-
-This is the simplest way to embed your monitor in your website. You can use the following code to embed your monitor in your website.
-
-```html
-<iframe
-	src="http://[hostname]/embed/monitor-[tag]?theme=light"
-	width="100%"
-	height="200"
-	allowfullscreen="allowfullscreen"
-	allowpaymentrequest
-	frameborder="0"
-></iframe>
-```
-
-Here is an example
-
-```html
-<iframe
-	src="https://kener.ing/embed/monitor-earth?theme=light"
-	width="100%"
-	height="100"
-	allowfullscreen="allowfullscreen"
-	allowpaymentrequest
-	frameborder="0"
-></iframe>
-```
-
-Replace `[hostname]` with your kener hostname and `[tag]` with your monitor tag.
-
-### Parameters
-
-You can pass the following parameters to the embed code
-
--   `theme`: You can pass `light` or `dark` theme
--   `bgc`: Background color of the monitor. Only supports hex color codes. DO NOT include the `#` symbol. Example: `ff0000`
--   `locale`: The locale of the monitor. You can pass the code of the locale you have enabled in your kener settings. Example: `en`, `fr` etc
-
-### Demo
-
-<div class="border mx-auto rounded-sm w-585px">
-	<iframe src="/embed/monitor-earth?theme=dark" width="100%" height="100" allowfullscreen="allowfullscreen" allowpaymentrequest frameborder="0"></iframe>
-</div>

docs/gh-setup.md

@@ -1,62 +0,0 @@
----
-title: Github Setup | Kener
-description: Kener uses github for incident management. Issues created in github using certain tags go to kener as incidents.
----
-
-# Github Setup
-
-Kener uses github for incident management. Issues created in github using certain tags go to kener as incidents.
-
-## Step 1: Create Github Repository
-
-Create a [Github Repository](https://github.com/new). It can be either public or private.
-
-## Step 2: Create Github Token
-
-You can create either a classic token or personal access token
-
-### Creating Classic Token
-
--   Go to [Tokens](https://github.com/settings/tokens/new)
--   Note: kener
--   Expiration: No Expiration
--   Scopes: write:packages
--   Click on generate Token
-
-### Creating Personal Access Token
-
--   Go to [Personal Access Token](https://github.com/settings/personal-access-tokens/new)
--   Token Name: kener
--   Expiration: Use custom to select a calendar date
--   Description: My Kener
--   Repository access: Check Only Selected Repositories. Select your github repository
--   Repository Permission: Select Issues Read Write
--   Click on generate token
-
-## Step 3: Set environment
-
-```bash
-export GH_TOKEN=github_pat_11AD3ZA3Y0
-```
-
-## Step 4: Add to Kener
-
-Add your repository details to kener.
-
-![Monitors API](/gh_s.png)
-
-### Github API URL
-
-If you are on github enterprise you can set the github api url. For most users, it will be `https://api.github.com`
-
-### Github Repo
-
-The repository name you created in step 1
-
-### Github Username
-
-Your github username
-
-### Incident History
-
-It is in hours. It means if an issue is created before X hours then kener would not honor it. What it means, is that kener would not show it under active incidents nor it will update the uptime. Default is 30\*24 hours = 720 hours.

docs/home.md

@@ -1,121 +0,0 @@
----
-title: Kener Documentation
-description: Kener is a feature-rich and modern status page system built with SvelteKit and NodeJS. It is open-source and free to use.
----
-
-# Kener - A Feature Rich & Modern Status Page
-
-<p align="center">
-	<img src="/newbg.png" width="100%" height="auto" class="rounded-lg shadow-lg" alt="kener example illustration">
-</p>
-
-<p class="flex space-x-2 justify-center">
-	<a href="https://github.com/rajnandan1/kener/stargazers"  >
-		<img alt="GitHub Repo stars"   src="https://img.shields.io/github/stars/rajnandan1/kener?label=Star%20Repo&
-		style=social">
-	</a>
-	<a href="https://github.com/ivbeg/awesome-status-pages"  >
-		<img src="https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg" alt="Awesome status page" />
-	</a>
-	<a href="https://hub.docker.com/r/rajnandan1/kener"  >
-		<img src="https://img.shields.io/docker/pulls/rajnandan1/kener" alt="Docker Kener" />
-	</a>
-</p>
-<div class="flex gap-4 justify-center">
-	<picture>
-		<source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f38a/512.webp" type="image/webp">
-		<img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f38a/512.gif" alt="🎊" width="32" height="32">
-	</picture>
-	<picture>
-		<source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/1f514/512.webp" type="image/webp">
-		<img src="https://fonts.gstatic.com/s/e/notoemoji/latest/1f514/512.gif" alt="🔔" width="32" height="32">
-	</picture>
-	<picture>
-  		<source srcset="https://fonts.gstatic.com/s/e/notoemoji/latest/2049_fe0f/512.webp" type="image/webp">
-  		<img src="https://fonts.gstatic.com/s/e/notoemoji/latest/2049_fe0f/512.gif" alt="⁉" width="32" height="32">
-	</picture>
-</div>
-<div class="flex gap-2 kener-home-links">
-	<div class="flex-1 border rounded-md py-4 px-2 text-center">
-		<a href="https://kener.ing">Live Demo</a>
-	</div>
-	<div class="flex-1 border rounded-md  py-4 px-2 text-center">
-		<a href="https://kener.ing/docs/quick-start">Quick Start</a>
-	</div>
-	<div class="flex-1 border rounded-md  py-4 px-2 text-center">
-		<a href="https://github.com/rajnandan1/kener">Clone</a>
-	</div>
-	<div class="flex-1 border rounded-md  py-4 px-2 text-center">
-		<a href="https://kener.ing/docs/deployment">Deploy</a>
-	</div>
-	<div class="flex-1 border rounded-md  py-4 px-2 text-center">
-		<a href="https://kener.ing/docs/kener-apis">APIs</a>
-	</div>
-</div>
-
-## What is Kener?
-
-Kener is status page system built with Sveltekit and NodeJS. It does not try to replace the Datadogs and Atlassian of the world. It tries to help some who wants to come up with a status page that looks nice and minimum overhead, in a modern way.
-
-It comes with all the basic asks for a status page. It is open-source and free to use.
-
-Kener name is derived from the word "Kene" which means "how is it going" in Assamese, then .ing because it was a
-cheaply available domain.
-
-## Quick Deployment
-
-[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/template/spSvic?referralCode=1Pn7vs)
-
-## Features
-
-### Monitoring and Tracking
-
--   Advanced application performance monitoring tools
--   Types of Monitors: HTTP, TCP, DNS, ICMP etc
--   Real-time network monitor software capabilities
--   Polls HTTP endpoint or Push data to monitor using Rest APIs
--   Handles Timezones for visitors
--   Categorize Monitors into different Sections
--   Cron-based scheduling for monitors. Minimum per minute
--   Construct complex API Polls - Chain, Secrets etc
--   Supports a Default Status for Monitors
--   Supports base path for hosting in k8s
--   Pre-built docker image for easy deployment
-
-### Customization and Branding
-
--   Customizable status page
--   Badge generation for status and uptime of Monitors
--   Support for custom domains
--   Embed Monitor as an iframe or widget
--   Light + Dark Theme
--   Internationalization support
--   Beautifully Crafted Status Page
-
-### Incident Management
-
--   Incident Management
--   Incident Communication
--   Comprehensive APIs for Incident Management
-
-### User Experience and Design
-
--   100% Accessibility Score
--   Easy installation and setup
--   User-friendly interface
--   Responsive design for various devices
--   Auto SEO and Social Media ready
--   Server Side Rendering
-
-## Technologies used
-
--   [SvelteKit](https://kit.svelte.dev/)
--   [shadcn-svelte](https://www.shadcn-svelte.com/)
-
-## Support Me
-
-If you are using Kener and want to support me, you can do so by sponsoring me on GitHub or buying me a coffee.
-
-[Sponsor Me Using Github](https://github.com/sponsors/rajnandan1)
-
-[Buy Me a Coffee](https://www.buymeacoffee.com/rajnandan1)

docs/showcase.md

@@ -1,22 +0,0 @@
-# Kener Showcase
-
-This page is a showcase of how kener is getting used in the wild. If you want to add your site here, please raise a PR and modify this [file](https://github.com/rajnandan1/kener-docs/blob/main/docs/md/docs/showcase.md)
-
-#### [Kener](https://kener.ing)
-#### [Cashfree Payments India](https://statuspage.cashfree.com/)
-#### [status.orhun.dev](https://status.orhun.dev/)
-#### [status.ordinalsbot.com](https://status.ordinalsbot.com/)
-#### [status.britsov.com](https://status.britsov.net/)
-#### [status.gosu.bar](https://status.gosu.bar/)
-#### [stat.imsun.org](https://stat.imsun.org/)
-#### [Goomer](https://status.goomer.com.br/)
-#### [kennek.io](https://status.kennek.io/)
-#### [evelan.io](https://status.evelan.io/)
-#### [evelan.io](https://status.evelan.io/)
-#### [sveir.xyz](https://status.sveir.xyz/)
-#### [cellcast.com](https://status.cellcast.com/)
-#### [flytbase.com](https://status.flytbase.com/)
-#### [scriptor-artis.fr](https://status.scriptor-artis.fr/)
-#### [jiance.f.ozizio.com](http://jiance.f.ozizio.com/)
-#### [sshaw.cn](https://s.sshaw.cn/)
-#### [donotes.app](https://status.donotes.app)

docs/structure.json

@@ -1,176 +0,0 @@
-{
-  "sidebar": [
-    {
-      "sectionTitle": "Getting Started",
-      "children": [
-        {
-          "title": "Introduction",
-          "link": "/docs/home",
-          "file": "/home.md"
-        },
-        {
-          "title": "Get Started",
-          "link": "/docs/quick-start",
-          "file": "/quick-start.md"
-        },
-        {
-          "title": "Concepts",
-          "link": "/docs/concepts",
-          "file": "/concepts.md"
-        },
-
-        {
-          "title": "Deployment",
-          "link": "/docs/deployment",
-          "file": "/deployment.md"
-        },
-        {
-          "title": "Databases",
-          "link": "/docs/database",
-          "file": "/database.md"
-        }
-      ]
-    },
-    {
-      "sectionTitle": "Guides",
-      "children": [
-        {
-          "title": "Setup Environment",
-          "link": "/docs/environment-vars",
-          "file": "/environment-vars.md"
-        },
-        {
-          "title": "Use Badges",
-          "link": "/docs/status-badges",
-          "file": "/status-badges.md"
-        },
-        {
-          "title": "Setup Monitors",
-          "link": "/docs/monitors",
-          "file": "/monitors.md"
-        },
-        {
-          "title": "API/Website Monitor",
-          "link": "/docs/monitors-api",
-          "file": "/monitors-api.md"
-        },
-        {
-          "title": "Ping Monitor",
-          "link": "/docs/monitors-ping",
-          "file": "/monitors-ping.md"
-        },
-        {
-          "title": "TCP Monitor",
-          "link": "/docs/monitors-tcp",
-          "file": "/monitors-tcp.md"
-        },
-        {
-          "title": "DNS Monitor",
-          "link": "/docs/monitors-dns",
-          "file": "/monitors-dns.md"
-        },
-        {
-          "title": "Group Monitor",
-          "link": "/docs/monitors-group",
-          "file": "/monitors-group.md"
-        },
-        {
-          "title": "SSL Monitor",
-          "link": "/docs/monitors-ssl",
-          "file": "/monitors-ssl.md"
-        },
-        {
-          "title": "SQL Monitor",
-          "link": "/docs/monitors-sql",
-          "file": "/monitors-sql.md"
-        },
-        {
-          "title": "Setup Triggers",
-          "link": "/docs/triggers",
-          "file": "/triggers.md"
-        },
-        {
-          "title": "Setup Site",
-          "link": "/docs/site",
-          "file": "/site.md"
-        },
-        {
-          "title": "Setup SEO",
-          "link": "/docs/seo",
-          "file": "/seo.md"
-        },
-        {
-          "title": "Setup Home",
-          "link": "/docs/home-page",
-          "file": "/home-page.md"
-        },
-        {
-          "title": "Setup Theme",
-          "link": "/docs/theme",
-          "file": "/theme.md"
-        },
-        {
-          "title": "View Alerts",
-          "link": "/docs/alerts",
-          "file": "/alerts.md"
-        },
-        {
-          "title": "API Keys",
-          "link": "/docs/apikeys",
-          "file": "/apikeys.md"
-        },
-
-        {
-          "title": "Incident Management",
-          "link": "/docs/incident-management",
-          "file": "/incident-management.md"
-        },
-        {
-          "title": "Embed",
-          "link": "/docs/embed",
-          "file": "/embed.md"
-        },
-        {
-          "title": "Custom JS/CSS",
-          "link": "/docs/custom-js-css-guide",
-          "file": "/custom-js-css-guide.md"
-        },
-        {
-          "title": "Internationalization",
-          "link": "/docs/i18n",
-          "file": "/i18n.md"
-        }
-      ]
-    },
-    {
-      "sectionTitle": "API Reference",
-      "children": [
-        {
-          "title": "Kener APIs",
-          "link": "/docs/kener-apis",
-          "file": "/kener-apis.md"
-        }
-      ]
-    },
-    {
-      "sectionTitle": "Help",
-      "children": [
-        {
-          "title": "Fonts",
-          "link": "/docs/custom-fonts",
-          "file": "/custom-fonts.md"
-        },
-        {
-          "title": "Changelogs",
-          "link": "/docs/changelogs",
-          "file": "/changelogs.md"
-        },
-        {
-          "title": "Roadmap",
-          "link": "/docs/roadmap",
-          "file": "/roadmap.md"
-        }
-      ]
-    }
-  ]
-}

docs/superpowers/plans/2026-06-07-last-known-status.md

@@ -0,0 +1,794 @@
+# Last Known Status (fix #721) Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a `LAST_KNOWN` Default Status choice for NONE-type (Manual) monitors: each scheduler tick without new data writes a `CARRIED` sample repeating the most recent alert-visible sample (status + latency), so push-driven monitors keep their status between pushes.
+
+**Architecture:** The carry fill slots into the existing `defaultData` branch of the monitor-execute worker (`monitorExecuteQueue.ts`), sourcing from a new repository query for the latest alert-visible sample. A single normalization helper in `monitorsController.ts` enforces the closed `default_status` value set (`NONE|UP|DOWN|DEGRADED|LAST_KNOWN`) and the "LAST_KNOWN only on NONE-type, auto-reset to UP otherwise" rule across all three monitor write paths (manage UI action, v4 POST, v4 PATCH). A migration normalizes legacy values (`MAINTENANCE`/unknown/NULL → `NONE`).
+
+**Tech Stack:** SvelteKit 2 (Svelte 5 runes), Knex migrations, BullMQ workers, shadcn-svelte UI.
+
+**Design authority:** `docs/adr/0006-last-known-status-fill.md` and the `Default Status` / `Last Known Status` / `Alert-Visible Sample` entries in `CONTEXT.md`. If a step seems to contradict those, the docs win.
+
+**Verification approach:** This repo has NO test infrastructure (no test script, no tests/ dir). Backend logic is verified with throwaway `vite-node` scripts driving repository classes against in-memory better-sqlite3 (delete the scripts before committing), plus a live end-to-end pass against the dev server. `npm run check` gates every commit.
+
+---
+
+### Task 1: Constants + alert-visible whitelist
+
+**Files:**
+
+- Modify: `src/lib/global-constants.ts:43`
+- Modify: `src/lib/server/db/repositories/monitoring.ts:13-20`
+
+- [ ] **Step 1: Add the two constants**
+
+In `src/lib/global-constants.ts`, the default export object currently has (line 43):
+
+```typescript
+  DEFAULT_STATUS: "DEFAULT",
+```
+
+Add two lines directly after it:
+
+```typescript
+  DEFAULT_STATUS: "DEFAULT",
+  CARRIED: "CARRIED",
+  LAST_KNOWN: "LAST_KNOWN",
+```
+
+(`CARRIED` is a **sample type** written by last-known-status fill; `LAST_KNOWN` is a **default_status value** stored on the monitor. They are different namespaces that happen to live in the same constants object — keep both names exactly as above.)
+
+- [ ] **Step 2: Add CARRIED to the alert-visible whitelist**
+
+In `src/lib/server/db/repositories/monitoring.ts`, replace lines 13-20:
+
+```typescript
+/**
+ * Sample types alert evaluation can see (see docs/adr/0005-alerts-evaluate-alert-visible-samples.md).
+ * Exactly the types written by flows that enqueue alert evaluation: scheduler checks
+ * (REALTIME/ERROR/TIMEOUT), default-status fill (DEFAULT_STATUS), and data-API pushes (MANUAL).
+ * SIGNAL rows (raw heartbeat receipts) and INCIDENT/MAINTENANCE overlays stay invisible, so the
+ * alert window freezes during manual overlays instead of triggering or resolving on them.
+ */
+const ALERT_VISIBLE_TYPES = [GC.REALTIME, GC.ERROR, GC.TIMEOUT, GC.MANUAL, GC.DEFAULT_STATUS]
+```
+
+with:
+
+```typescript
+/**
+ * Sample types alert evaluation can see (see docs/adr/0005-alerts-evaluate-alert-visible-samples.md
+ * and docs/adr/0006-last-known-status-fill.md).
+ * Exactly the types written by flows that enqueue alert evaluation: scheduler checks
+ * (REALTIME/ERROR/TIMEOUT), default-status fill (DEFAULT_STATUS), last-known-status fill (CARRIED),
+ * and data-API pushes (MANUAL).
+ * SIGNAL rows (raw heartbeat receipts) and INCIDENT/MAINTENANCE overlays stay invisible, so the
+ * alert window freezes during manual overlays instead of triggering or resolving on them.
+ */
+const ALERT_VISIBLE_TYPES = [GC.REALTIME, GC.ERROR, GC.TIMEOUT, GC.MANUAL, GC.DEFAULT_STATUS, GC.CARRIED]
+```
+
+- [ ] **Step 3: Type-check**
+
+Run: `npm run check`
+Expected: 0 errors (same error/warning count as before the change — run it on a clean tree first if unsure).
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/lib/global-constants.ts src/lib/server/db/repositories/monitoring.ts
+git commit -m "feat(constants): add CARRIED sample type and LAST_KNOWN default status"
+```
+
+---
+
+### Task 2: Repository — latest alert-visible sample query
+
+**Files:**
+
+- Modify: `src/lib/server/db/repositories/monitoring.ts` (after `getLatestMonitoringData`, line 79)
+- Modify: `src/lib/server/db/dbimpl.ts:52-53` (declaration) and `:412` (binding)
+
+- [ ] **Step 1: Add the repository method**
+
+In `src/lib/server/db/repositories/monitoring.ts`, directly after the `getLatestMonitoringData` method (ends line 79), add:
+
+```typescript
+  /**
+   * Latest sample the alert evaluator (and last-known-status fill) can see.
+   * Carry source for Default Status = LAST_KNOWN (docs/adr/0006): overlays
+   * (INCIDENT/MAINTENANCE) and raw heartbeat receipts (SIGNAL) are excluded,
+   * so they can never become sticky.
+   */
+  async getLatestAlertVisibleData(monitor_tag: string): Promise<MonitoringData | undefined> {
+    return await this.knex("monitoring_data")
+      .where("monitor_tag", monitor_tag)
+      .whereIn("type", ALERT_VISIBLE_TYPES)
+      .orderBy("timestamp", "desc")
+      .limit(1)
+      .first();
+  }
+```
+
+- [ ] **Step 2: Expose it on the db singleton**
+
+In `src/lib/server/db/dbimpl.ts`, after line 52 (`getLatestMonitoringData!: ...`), add the declaration:
+
+```typescript
+  getLatestAlertVisibleData!: MonitoringRepository["getLatestAlertVisibleData"];
+```
+
+and after line 412 (`this.getLatestMonitoringData = ...bind(this.monitoring);`), add the binding:
+
+```typescript
+this.getLatestAlertVisibleData = this.monitoring.getLatestAlertVisibleData.bind(this.monitoring)
+```
+
+- [ ] **Step 3: Write the throwaway verification script**
+
+Create `scripts/tmp-verify-carry-source.ts` (will be deleted, never committed):
+
+```typescript
+import Knex from "knex"
+import { MonitoringRepository } from "../src/lib/server/db/repositories/monitoring"
+
+const knex = Knex({ client: "better-sqlite3", connection: { filename: ":memory:" }, useNullAsDefault: true })
+
+await knex.schema.createTable("monitoring_data", (t) => {
+    t.string("monitor_tag")
+    t.integer("timestamp")
+    t.string("status")
+    t.float("latency")
+    t.string("type")
+    t.text("error_message")
+    t.primary(["monitor_tag", "timestamp"])
+})
+
+const repo = new MonitoringRepository(knex)
+
+// Timeline: MANUAL DOWN, then a CARRIED copy, then an INCIDENT overlay, then a SIGNAL receipt.
+await knex("monitoring_data").insert([
+    { monitor_tag: "t", timestamp: 100, status: "DOWN", latency: 42, type: "MANUAL" },
+    { monitor_tag: "t", timestamp: 160, status: "DOWN", latency: 42, type: "CARRIED" },
+    { monitor_tag: "t", timestamp: 220, status: "UP", latency: 0, type: "INCIDENT" },
+    { monitor_tag: "t", timestamp: 280, status: "UP", latency: 0, type: "SIGNAL" }
+])
+
+const latest = await repo.getLatestAlertVisibleData("t")
+console.log("latest:", latest)
+if (!latest || latest.timestamp !== 160 || latest.type !== "CARRIED" || latest.status !== "DOWN") {
+    throw new Error("FAIL: expected the CARRIED row at ts=160 (INCIDENT/SIGNAL must be skipped)")
+}
+
+const none = await repo.getLatestAlertVisibleData("missing")
+if (none !== undefined) throw new Error("FAIL: expected undefined for unknown tag")
+
+console.log("PASS")
+await knex.destroy()
+```
+
+- [ ] **Step 4: Run it**
+
+Run: `npx vite-node scripts/tmp-verify-carry-source.ts`
+Expected: prints the ts=160 CARRIED row, then `PASS`.
+
+- [ ] **Step 5: Delete the script, type-check, commit**
+
+```bash
+rm scripts/tmp-verify-carry-source.ts
+npm run check
+git add src/lib/server/db/repositories/monitoring.ts src/lib/server/db/dbimpl.ts
+git commit -m "feat(db): add getLatestAlertVisibleData query for last-known-status carry source"
+```
+
+---
+
+### Task 3: Engine — carry fill in the execute worker
+
+**Files:**
+
+- Modify: `src/lib/server/queues/monitorExecuteQueue.ts:125-156`
+
+- [ ] **Step 1: Extend the defaultData branch**
+
+In `src/lib/server/queues/monitorExecuteQueue.ts`, replace lines 125-139:
+
+```typescript
+let defaultData: MonitoringResultTS = {}
+let mergedData: MonitoringResultTS = {}
+
+if (monitor.default_status !== undefined && monitor.default_status !== null) {
+    if (([GC.UP, GC.DOWN, GC.DEGRADED] as string[]).indexOf(monitor.default_status) !== -1) {
+        defaultData[ts] = {
+            status: monitor.default_status,
+            latency: 0,
+            type: GC.DEFAULT_STATUS
+        }
+        if (monitor.default_status !== GC.UP) {
+            defaultData[ts].error_message = "Default status applied"
+        }
+    }
+}
+```
+
+with:
+
+```typescript
+let defaultData: MonitoringResultTS = {}
+let mergedData: MonitoringResultTS = {}
+
+if (monitor.default_status !== undefined && monitor.default_status !== null) {
+    if (([GC.UP, GC.DOWN, GC.DEGRADED] as string[]).indexOf(monitor.default_status) !== -1) {
+        defaultData[ts] = {
+            status: monitor.default_status,
+            latency: 0,
+            type: GC.DEFAULT_STATUS
+        }
+        if (monitor.default_status !== GC.UP) {
+            defaultData[ts].error_message = "Default status applied"
+        }
+    } else if (monitor.default_status === GC.LAST_KNOWN) {
+        // Last Known Status fill (docs/adr/0006): repeat the most recent alert-visible
+        // sample — status and latency alike. No sample yet → nothing to carry → no fill.
+        const lastKnown = await db.getLatestAlertVisibleData(monitor.tag)
+        if (lastKnown && lastKnown.status) {
+            defaultData[ts] = {
+                status: lastKnown.status,
+                latency: lastKnown.latency ?? 0,
+                type: GC.CARRIED
+            }
+            if (lastKnown.status !== GC.UP) {
+                defaultData[ts].error_message = "Last known status applied"
+            }
+        }
+    }
+}
+```
+
+- [ ] **Step 2: Fix the NO_DATA-preference block to preserve the fill's type**
+
+Still in the same file, the block at (previously) lines 141-156 hardcodes `type: GC.DEFAULT_STATUS` when realtime returns NO_DATA but a fill exists. A heartbeat monitor with `LAST_KNOWN` would mislabel its carried rows. Replace:
+
+```typescript
+const defaultStatus = defaultData[ts]?.status
+const realtimeStatus = realtimeData[ts]?.status
+let realtimeDataForMerge = realtimeData
+if (defaultStatus && realtimeStatus === GC.NO_DATA) {
+    // Apply the preference *before* merging so incident/maintenance can still override later.
+    // Also avoid carrying over realtime NO_DATA error_message.
+    realtimeDataForMerge = { ...realtimeData }
+    realtimeDataForMerge[ts] = {
+        ...realtimeDataForMerge[ts],
+        status: defaultStatus,
+        type: GC.DEFAULT_STATUS
+    }
+    delete realtimeDataForMerge[ts].error_message
+}
+```
+
+with:
+
+```typescript
+const defaultStatus = defaultData[ts]?.status
+const realtimeStatus = realtimeData[ts]?.status
+let realtimeDataForMerge = realtimeData
+if (defaultStatus && realtimeStatus === GC.NO_DATA) {
+    // Apply the preference *before* merging so incident/maintenance can still override later.
+    // Also avoid carrying over realtime NO_DATA error_message.
+    // Keep the fill's own type: DEFAULT for fixed fill, CARRIED for last-known fill.
+    realtimeDataForMerge = { ...realtimeData }
+    realtimeDataForMerge[ts] = {
+        ...realtimeDataForMerge[ts],
+        status: defaultStatus,
+        type: defaultData[ts].type
+    }
+    delete realtimeDataForMerge[ts].error_message
+}
+```
+
+Note: `latency` in this branch intentionally stays whatever realtime reported — unchanged from today for fixed fill; for LAST_KNOWN-on-heartbeat the carried latency was already placed in `defaultData[ts]` and `mergedData` spread order (`{ ...defaultData, ...realtimeDataForMerge, ... }`) means the realtime object wins the spread; this matches existing fixed-fill behavior, do not "improve" it here.
+
+- [ ] **Step 3: Type-check**
+
+Run: `npm run check`
+Expected: 0 new errors.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/lib/server/queues/monitorExecuteQueue.ts
+git commit -m "feat(scheduler): write CARRIED samples for LAST_KNOWN default status fixes #721"
+```
+
+(Live behavior is verified end-to-end in Task 8 — the worker needs Redis + the cron loop, so there is no isolated script for this task.)
+
+---
+
+### Task 4: Normalization chokepoint for all monitor writes
+
+**Files:**
+
+- Modify: `src/lib/server/controllers/monitorsController.ts` (near `CreateUpdateMonitor`, line 193)
+- Modify: `src/routes/(api)/api/v4/monitors/+server.ts:104-121`
+- Modify: `src/routes/(api)/api/v4/monitors/[monitor_tag]/+server.ts:72-78`
+
+- [ ] **Step 1: Add the helper to monitorsController.ts**
+
+Directly above `CreateUpdateMonitor` (line 193), add:
+
+```typescript
+const VALID_DEFAULT_STATUSES = ["NONE", GC.UP, GC.DOWN, GC.DEGRADED, GC.LAST_KNOWN] as const
+
+/**
+ * Enforce the closed default_status value set and the LAST_KNOWN scope rule
+ * (docs/adr/0006): LAST_KNOWN is only meaningful on NONE-type (Manual) monitors;
+ * on any other type it silently resets to UP so the invalid combination never persists.
+ * Throws on values outside the closed set.
+ */
+export const NormalizeDefaultStatus = (monitorType: string | null | undefined, defaultStatus: string | null | undefined): string => {
+    const value = defaultStatus ?? "NONE"
+    if (!(VALID_DEFAULT_STATUSES as readonly string[]).includes(value)) {
+        throw new Error(`default_status must be one of: ${VALID_DEFAULT_STATUSES.join(", ")}`)
+    }
+    if (value === GC.LAST_KNOWN && monitorType !== "NONE") {
+        return GC.UP
+    }
+    return value
+}
+```
+
+(`monitorsController.ts` already imports `GC` at line 25 — no import change needed.)
+
+- [ ] **Step 2: Apply it in the manage-UI path**
+
+Replace `CreateUpdateMonitor` (lines 193-201):
+
+```typescript
+export const CreateUpdateMonitor = async (monitor: MonitorInput): Promise<number | number[]> => {
+    let monitorData = { ...monitor }
+    if (monitorData.id) {
+        return await db.updateMonitor(monitorData as MonitorRecord)
+    } else {
+        validateMonitorTag(monitorData.tag)
+        return await db.insertMonitor(monitorData)
+    }
+}
+```
+
+with:
+
+```typescript
+export const CreateUpdateMonitor = async (monitor: MonitorInput): Promise<number | number[]> => {
+    let monitorData = { ...monitor }
+    monitorData.default_status = NormalizeDefaultStatus(monitorData.monitor_type, monitorData.default_status)
+    if (monitorData.id) {
+        return await db.updateMonitor(monitorData as MonitorRecord)
+    } else {
+        validateMonitorTag(monitorData.tag)
+        return await db.insertMonitor(monitorData)
+    }
+}
+```
+
+(The manage API route at `src/routes/(manage)/manage/api/+server.ts` wraps the action switch in try/catch (line 660) and surfaces thrown `Error.message` — no route change needed.)
+
+- [ ] **Step 3: Apply it in v4 POST**
+
+In `src/routes/(api)/api/v4/monitors/+server.ts`, add to the imports from the monitors controller (`GetMonitorsParsed` is already imported — extend that import):
+
+```typescript
+import { GetMonitorsParsed, NormalizeDefaultStatus } from "$lib/server/controllers/monitorsController"
+```
+
+(match the existing import line's exact shape — if `GetMonitorsParsed` is imported from a different specifier, add `NormalizeDefaultStatus` to that same line).
+
+Then replace line 111:
+
+```typescript
+    default_status: body.default_status ?? "UP",
+```
+
+with a pre-validated variable. Above the `const monitorData = {` block (line 104), insert:
+
+```typescript
+let defaultStatus: string
+try {
+    defaultStatus = NormalizeDefaultStatus(body.monitor_type ?? "API", body.default_status ?? "UP")
+} catch (e) {
+    const errorResponse: BadRequestResponse = {
+        error: {
+            code: "BAD_REQUEST",
+            message: e instanceof Error ? e.message : "Invalid default_status"
+        }
+    }
+    return json(errorResponse, { status: 400 })
+}
+```
+
+and in `monitorData` use:
+
+```typescript
+    default_status: defaultStatus,
+```
+
+- [ ] **Step 4: Apply it in v4 PATCH**
+
+In `src/routes/(api)/api/v4/monitors/[monitor_tag]/+server.ts`, the handler resolves `updateData.monitor_type` at line 78 _after_ `updateData.default_status` at line 75 — the normalization must run after BOTH are resolved. Replace line 75:
+
+```typescript
+updateData.default_status = body.default_status !== undefined ? body.default_status : existingMonitor.default_status
+```
+
+with (keep it in place so field ordering stays readable, but move the value through the helper after line 78):
+
+```typescript
+updateData.default_status = body.default_status !== undefined ? body.default_status : existingMonitor.default_status
+```
+
+…and after line 78 (`updateData.monitor_type = ...`), insert:
+
+```typescript
+// Closed-set validation + LAST_KNOWN scope rule (docs/adr/0006). Runs after monitor_type
+// is resolved so a type change away from NONE auto-resets LAST_KNOWN to UP.
+try {
+    updateData.default_status = NormalizeDefaultStatus(updateData.monitor_type as string, updateData.default_status as string | null)
+} catch (e) {
+    const errorResponse: BadRequestResponse = {
+        error: {
+            code: "BAD_REQUEST",
+            message: e instanceof Error ? e.message : "Invalid default_status"
+        }
+    }
+    return json(errorResponse, { status: 400 })
+}
+```
+
+Add `NormalizeDefaultStatus` to this file's monitors-controller import the same way as in Step 3.
+
+- [ ] **Step 5: Verify with a throwaway script**
+
+Create `scripts/tmp-verify-normalize.ts`:
+
+```typescript
+import { NormalizeDefaultStatus } from "../src/lib/server/controllers/monitorsController"
+
+const cases: Array<[string, string | null, string]> = [
+    ["NONE", "LAST_KNOWN", "LAST_KNOWN"], // allowed on Manual monitors
+    ["API", "LAST_KNOWN", "UP"], // auto-reset on any other type
+    ["NONE", null, "NONE"], // null → NONE
+    ["API", "DOWN", "DOWN"] // fixed values pass through
+]
+for (const [type, input, expected] of cases) {
+    const got = NormalizeDefaultStatus(type, input)
+    if (got !== expected) throw new Error(`FAIL: (${type}, ${input}) → ${got}, expected ${expected}`)
+}
+let threw = false
+try {
+    NormalizeDefaultStatus("API", "MAINTENANCE")
+} catch {
+    threw = true
+}
+if (!threw) throw new Error("FAIL: MAINTENANCE must be rejected")
+console.log("PASS")
+```
+
+Run: `npx vite-node scripts/tmp-verify-normalize.ts`
+Expected: `PASS`. (Importing monitorsController transitively pulls in the db singleton; vite-node loads the repo `.env` automatically, so the configured `DATABASE_URL`/`REDIS_URL` satisfy it. If module side-effects still fail outside the dev process, inline the `NormalizeDefaultStatus` cases into a temporary copy instead — the function is pure.)
+
+- [ ] **Step 6: Delete script, type-check, commit**
+
+```bash
+rm scripts/tmp-verify-normalize.ts
+npm run check
+git add src/lib/server/controllers/monitorsController.ts "src/routes/(api)/api/v4/monitors/+server.ts" "src/routes/(api)/api/v4/monitors/[monitor_tag]/+server.ts"
+git commit -m "feat(api): enforce closed default_status set with LAST_KNOWN scope rule"
+```
+
+---
+
+### Task 5: Migration — normalize legacy default_status values
+
+**Files:**
+
+- Create: `migrations/20260607150000_normalize_default_status.ts`
+
+- [ ] **Step 1: Write the migration**
+
+```typescript
+import type { Knex } from "knex"
+
+// Closed default_status set as of docs/adr/0006. MAINTENANCE was offered by the old
+// UI but never honored by the fill engine — it behaved exactly like "no fill", so it
+// (and any other unknown value, and NULL) normalizes to NONE, preserving behavior.
+const VALID = ["NONE", "UP", "DOWN", "DEGRADED", "LAST_KNOWN"]
+
+export async function up(knex: Knex): Promise<void> {
+    await knex("monitors").whereNull("default_status").update({ default_status: "NONE" })
+    await knex("monitors").whereNotIn("default_status", VALID).update({ default_status: "NONE" })
+}
+
+export async function down(): Promise<void> {
+    // Irreversible by design: the values rewritten to NONE were dead (never honored
+    // by the fill engine), so there is nothing meaningful to restore.
+}
+```
+
+- [ ] **Step 2: Run it against the dev database**
+
+Run: `npm run migrate`
+Expected: `Batch N run: 1 migrations` with no errors.
+
+- [ ] **Step 3: Spot-check via the dev API**
+
+With the dev server running (`npm run dev` if not already):
+
+```bash
+curl -s 'http://localhost:3000/api/v4/monitors' -H 'Authorization: Bearer <API_KEY>' | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const r=JSON.parse(s);const bad=(r.monitors||r.data||[]).filter(m=>!['NONE','UP','DOWN','DEGRADED','LAST_KNOWN'].includes(m.default_status));console.log('invalid default_status rows:',bad.length)})"
+```
+
+Expected: `invalid default_status rows: 0`.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add migrations/20260607150000_normalize_default_status.ts
+git commit -m "feat(db): migrate default_status to closed value set"
+```
+
+---
+
+### Task 6: Manage UI — dropdown options + callout + auto-reset
+
+**Files:**
+
+- Modify: `src/routes/(manage)/manage/app/monitors/[tag]/components/GeneralSettingsCard.svelte:230-247`
+
+**REQUIRED SUB-SKILL for this task: `svelte-code-writer` (per CLAUDE.md, mandatory for all .svelte edits).**
+
+- [ ] **Step 1: Add imports and labels**
+
+In the `<script lang="ts">` block (GC is already imported at line 20), add to the imports:
+
+```typescript
+import * as Alert from "$lib/components/ui/alert/index.js"
+import TriangleAlertIcon from "@lucide/svelte/icons/triangle-alert"
+```
+
+and below the props destructuring add:
+
+```typescript
+const defaultStatusLabels: Record<string, string> = {
+    NONE: "None (show gaps as no data)",
+    UP: "UP",
+    DOWN: "DOWN",
+    DEGRADED: "DEGRADED",
+    LAST_KNOWN: "Last known status"
+}
+
+// LAST_KNOWN is only valid on Manual (NONE-type) monitors; the server enforces the
+// same rule (NormalizeDefaultStatus), this effect just keeps the UI honest live.
+$effect(() => {
+    if (monitor.monitor_type !== "NONE" && monitor.default_status === GC.LAST_KNOWN) {
+        monitor.default_status = GC.UP
+        toast.info("Default status was reset to UP — Last known status is only available for Manual monitors.")
+    }
+})
+```
+
+(`toast` is already imported from `svelte-sonner` at line 16.)
+
+- [ ] **Step 2: Replace the Default Status select**
+
+Replace lines 230-247:
+
+```svelte
+<Label for="monitor-default-status">Default Status</Label>
+<Select.Root
+    type="single"
+    value={monitor.default_status}
+    onValueChange={(v) => {
+        if (v) monitor.default_status = v
+    }}
+>
+    <Select.Trigger id="monitor-default-status" class="w-full">
+        {monitor.default_status}
+    </Select.Trigger>
+    <Select.Content>
+        <Select.Item value="UP">UP</Select.Item>
+        <Select.Item value="DOWN">DOWN</Select.Item>
+        <Select.Item value="DEGRADED">DEGRADED</Select.Item>
+        <Select.Item value="MAINTENANCE">MAINTENANCE</Select.Item>
+    </Select.Content>
+</Select.Root>
+```
+
+with:
+
+```svelte
+<Label for="monitor-default-status">Default Status</Label>
+<Select.Root
+    type="single"
+    value={monitor.default_status ?? "NONE"}
+    onValueChange={(v) => {
+        if (v) monitor.default_status = v
+    }}
+>
+    <Select.Trigger id="monitor-default-status" class="w-full">
+        {defaultStatusLabels[monitor.default_status ?? "NONE"] ?? monitor.default_status}
+    </Select.Trigger>
+    <Select.Content>
+        <Select.Item value="NONE">None (show gaps as no data)</Select.Item>
+        <Select.Item value="UP">UP</Select.Item>
+        <Select.Item value="DOWN">DOWN</Select.Item>
+        <Select.Item value="DEGRADED">DEGRADED</Select.Item>
+        {#if monitor.monitor_type === "NONE"}
+            <Select.Item value="LAST_KNOWN">Last known status</Select.Item>
+        {/if}
+    </Select.Content>
+</Select.Root>
+{#if monitor.default_status === GC.LAST_KNOWN}
+    <Alert.Root>
+        <TriangleAlertIcon />
+        <Alert.Title>Last known status</Alert.Title>
+        <Alert.Description>
+            <p>Kener will repeat the most recent status and latency every minute until your integration sends new data.</p>
+            <ul class="list-disc pl-4">
+                <li>
+                    If your integration stops sending, the page keeps showing the last status indefinitely — Kener cannot tell "still up" from "stopped reporting". Use a Heartbeat
+                    monitor to catch a silent integration.
+                </li>
+                <li>
+                    Carried minutes count toward alert thresholds: a single DOWN push will trigger alerts after your failure threshold, and they stay triggered until you push a
+                    recovery.
+                </li>
+            </ul>
+        </Alert.Description>
+    </Alert.Root>
+{/if}
+```
+
+- [ ] **Step 3: Run the svelte autofixer / check**
+
+Run: `npm run check`
+Expected: 0 new errors or warnings for `GeneralSettingsCard.svelte`. Also run the svelte MCP autofixer on the component if the svelte-code-writer skill instructs it.
+
+- [ ] **Step 4: Visual verification**
+
+With `npm run dev` running, screenshot the editor for the seeded NONE-type monitor (`earth`):
+
+```bash
+npx playwright screenshot --channel chrome --color-scheme light --viewport-size "1440,900" --full-page --wait-for-timeout 3000 http://localhost:3000/manage/app/monitors/earth /tmp/lk-ui.png
+```
+
+(Authed page — if it renders the login screen, follow the storage-state cookie recipe in the project memory `kener-ui-verification-recipe`, or verify manually in the browser.)
+Expected: dropdown shows the five options ("Last known status" present because earth is Manual/NONE type, "MAINTENANCE" gone); selecting "Last known status" reveals the callout.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add "src/routes/(manage)/manage/app/monitors/[tag]/components/GeneralSettingsCard.svelte"
+git commit -m "feat(manage): Last known status option with callout in Default Status dropdown"
+```
+
+---
+
+### Task 7: Docs — ADR cross-link + user documentation
+
+**Files:**
+
+- Modify: `docs/adr/0005-alerts-evaluate-alert-visible-samples.md` (append one sentence)
+- Modify: `src/routes/(docs)/docs/content/v4/monitors/overview.md` (Default Status section)
+
+**REQUIRED SUB-SKILL for the `src/routes/(docs)/docs/content/` edit: `documentation-writer` (per CLAUDE.md, mandatory for docs content).**
+
+- [ ] **Step 1: Amend ADR 0005**
+
+Append this sentence to the end of the first paragraph of `docs/adr/0005-alerts-evaluate-alert-visible-samples.md` (after "...remain invisible to alerting."):
+
+```
+Amended by ADR 0006: last-known-status fill (`CARRIED`) later joined the alert-visible set under the same invariant.
+```
+
+- [ ] **Step 2: Document Last Known Status in the monitor docs**
+
+`src/routes/(docs)/docs/content/v4/monitors/overview.md` does not mention `default_status` today (verified) — add a new "Default Status" section to it. Following the documentation-writer skill's conventions, document:
+
+- The five values: `NONE`, `UP`, `DOWN`, `DEGRADED`, `LAST_KNOWN`.
+- `LAST_KNOWN` is only accepted for Manual (`NONE`-type) monitors; on any other type the API resets it to `UP`.
+- Behavior: every minute without new data, Kener writes a `CARRIED` sample repeating the most recent alert-visible sample (status and latency). Carry never expires and starts at the next tick after the setting is saved (no backfill).
+- The two warnings from the UI callout (stale-forever if the integration goes silent → use a Heartbeat monitor; carried minutes count toward alert thresholds and alerts only resolve on a pushed recovery).
+- A curl example mirroring #721's flow:
+
+```bash
+curl -X PATCH 'https://status.example.com/api/v4/monitors/my-service/data/{current_unix_minute}' \
+  -H 'Authorization: Bearer <api-key>' \
+  -H 'Content-Type: application/json' \
+  --data '{"status": "DOWN", "latency": 100}'
+# With Default Status = Last known status, the monitor stays DOWN until you push UP.
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add docs/adr/0005-alerts-evaluate-alert-visible-samples.md "src/routes/(docs)/docs/content/v4/monitors/overview.md"
+git commit -m "docs: document Last known status default and amend ADR 0005"
+```
+
+---
+
+### Task 8: End-to-end verification against the dev server
+
+**Files:** none (verification only; uses the running `npm run dev` with Redis + Postgres up)
+
+- [ ] **Step 1: Create a throwaway NONE monitor with LAST_KNOWN**
+
+```bash
+curl -s -X POST 'http://localhost:3000/api/v4/monitors' \
+  -H 'Authorization: Bearer <API_KEY>' -H 'Content-Type: application/json' \
+  --data '{"tag":"lk-e2e","name":"LK E2E","monitor_type":"NONE","default_status":"LAST_KNOWN","cron":"* * * * *"}'
+```
+
+Expected: 201, monitor JSON with `"default_status":"LAST_KNOWN"`.
+
+- [ ] **Step 2: Confirm no fill before any push**
+
+Wait ~70 seconds (one scheduler tick), then:
+
+```bash
+NOW=$(date -u +%s); curl -s "http://localhost:3000/api/v4/monitors/lk-e2e/data?start_ts=$((NOW-300))&end_ts=$NOW" -H 'Authorization: Bearer <API_KEY>'
+```
+
+Expected: `{"data":[]}` — nothing to carry yet (never-pushed monitors stay no-data).
+
+- [ ] **Step 3: Push DOWN once, watch CARRIED rows appear**
+
+```bash
+NOW=$(date -u +%s)
+curl -s -X PATCH "http://localhost:3000/api/v4/monitors/lk-e2e/data/$NOW" \
+  -H 'Authorization: Bearer <API_KEY>' -H 'Content-Type: application/json' \
+  --data '{"status":"DOWN","latency":2201}'
+```
+
+Wait ~130 seconds (two ticks), then re-run the Step 2 range query.
+Expected: one `"type":"MANUAL"` DOWN row at the pushed minute, followed by `"type":"CARRIED"` rows with `"status":"DOWN","latency":2201` for each subsequent minute.
+
+- [ ] **Step 4: Push recovery, confirm carry follows**
+
+Repeat Step 3's PATCH with `{"status":"UP","latency":5}`. Wait ~70s.
+Expected: subsequent CARRIED rows are `UP` with latency 5. The status page (`http://localhost:3000`) shows the monitor UP with the red DOWN window in today's bar.
+
+- [ ] **Step 5: Verify the type-change auto-reset**
+
+```bash
+curl -s -X PATCH 'http://localhost:3000/api/v4/monitors/lk-e2e' \
+  -H 'Authorization: Bearer <API_KEY>' -H 'Content-Type: application/json' \
+  --data '{"monitor_type":"API","type_data":{"url":"https://example.com","timeout":5000}}'
+```
+
+Expected: 200 with `"default_status":"UP"` in the response (LAST_KNOWN auto-reset because the type left NONE). Then verify rejection:
+
+```bash
+curl -s -X PATCH 'http://localhost:3000/api/v4/monitors/lk-e2e' \
+  -H 'Authorization: Bearer <API_KEY>' -H 'Content-Type: application/json' \
+  --data '{"default_status":"MAINTENANCE"}'
+```
+
+Expected: 400 with `default_status must be one of: NONE, UP, DOWN, DEGRADED, LAST_KNOWN`.
+
+- [ ] **Step 6: Clean up the test monitor**
+
+The v4 monitor route has no DELETE handler (only GET/PATCH), so delete via the manage API action the dashboard uses, or from the UI at `http://localhost:3000/manage/app/monitors/lk-e2e` (Danger Zone → Delete). Verify it is gone from `http://localhost:3000/`.
+
+- [ ] **Step 7: Final gate**
+
+Run: `npm run check && npm run prettify`
+Expected: clean check; prettify produces no diff beyond the files already touched (re-commit formatting if it does).
+
+---
+
+## Self-review notes
+
+- **Spec coverage:** Q1 dropdown (Task 6), Q2 MAINTENANCE migration + closed set (Tasks 4, 5, 6), Q3 carry source (Task 2), Q4 CARRIED type + whitelist (Task 1), Q5 status+latency payload (Task 3), Q6/Q7 NONE-only + auto-reset (Tasks 4, 6), Q8 no expiry (no code — absence is the feature; documented in Task 7), Q9 tick-forward/no-backfill (no code — the engine only writes at `ts`; verified in Task 8 Step 2-3), Q10 alert consequences (Task 1 whitelist + existing evaluator, no further code), Q11 callout copy (Task 6).
+- **Known non-goals:** no staleness cap, no backfill, no purge on disable, no change to `CloneMonitor` (it copies `monitor_type` + `default_status` together from an already-normalized source, so the pair stays valid).
+- **Pre-existing race left untouched (deliberate):** a same-minute tick can overwrite a just-pushed MANUAL row's type via the response-queue upsert; this exists today for DEFAULT fill and is orthogonal to this change.

docs/triggers.md

@@ -1,295 +0,0 @@
----
-title: Triggers | Kener
-description: Learn how to set up and work with triggers in kener.
----
-
-# Triggers
-
-Triggers are used to trigger actions based on the status of your monitors. You can use triggers to send notifications, or call webhooks when a monitor goes down or up.
-
-<div class="border rounded-md">
-
-![Trigger API](/documentation/trig_1.png)
-
-</div>
-
-### Name
-
-<span class="text-red-500 text-xs font-semibold">
-	REQUIRED
-</span>
-
-The name is used to define the name of the webhook. It is required and has to be a string.
-
-### Description
-
-The description is used to define the description of the webhook. It is optional and has to be a string.
-
-Kener supports the following triggers:
-
--   [Webhook](#webhook)
--   [Discord](#discord)
--   [Slack](#slack)
--   [Email](#email)
-
-## Webhook
-
-Webhook triggers are used to send a HTTP POST request to a URL when a monitor goes down or up.
-
-<div class="border rounded-md">
-
-![Trigger API](/documentation/trig_web.png)
-
-</div>
-
-### URL
-
-<span class="text-red-500 text-xs font-semibold">
-	REQUIRED
-</span>
-
-The URL is used to define the URL of the webhook. It is required and has to be a valid URL.
-
-You can also pass secrets that are set in the environment variables.
-
-Example: `https://example.com/webhook?secret=$SECRET_X`. Make sure `$SECRET_X` is set in the environment variables.
-
-### Method
-
-Method will always be `POST`
-
-### Headers
-
-The headers are used to define the headers that should be sent with the request. It is optional and has to be a valid JSON object. You can add secrets that are set in the environment variables.
-
-Example: `Authorization: Bearer $SECRET_Y`. Make sure `$SECRET_Y` is set in the environment variables.
-
-While sending webhook kener will add two more headers: `Content-Type: application/json` and `User-Agent: Kener/3.0.0`.
-
-### Body
-
-Body of the webhook will be sent as below:
-
-```json
-{
-    "id": "mockoon-9",
-    "alert_name": "Mockoon DOWN",
-    "severity": "critical",
-    "status": "TRIGGERED",
-    "source": "Kener",
-    "timestamp": "2024-11-27T04:55:00.369Z",
-    "description": "🚨 **Service Alert**: Check the details below",
-    "details": {
-        "metric": "Mockoon",
-        "current_value": 1,
-        "threshold": 1
-    },
-    "actions": [
-        {
-            "text": "View Monitor",
-            "url": "https://kener.ing/monitor-mockoon"
-        }
-    ]
-}
-```
-
-| Key                   | Description                                                 | Variable                      |
-| --------------------- | ----------------------------------------------------------- | ----------------------------- |
-| id                    | Unique ID of the alert                                      | ${id}                         |
-| alert_name            | Name of the alert                                           | ${alert_name}                 |
-| severity              | Severity of the alert. Can be `critical`, `warn`            | ${severity}                   |
-| status                | Status of the alert. Can be `TRIGGERED`, `RESOLVED`         | ${status}                     |
-| source                | Source of the alert. Can be `Kener`                         | ${source}                     |
-| timestamp             | Timestamp of the alert                                      | ${timestamp}                  |
-| description           | Description of the alert. This you can customize. See below | ${description}                |
-| details               | Details of the alert.                                       | -                             |
-| details.metric        | Name of the monitor                                         | ${metric}                     |
-| details.current_value | Current value of the monitor                                | ${current_value}              |
-| details.threshold     | Alert trigger threshold of the monitor                      | ${threshold}                  |
-| actions               | Actions to be taken. Link to view the monitor.              | ${action_text}, ${action_url} |
-
-### Custom Body
-
-You can customize the body of the webhook. You can use the variables mentioned above. If you are not using a json body then please make sure you are using the right content-type by setting custom headers. See examples below.
-
-## Discord
-
-Discord triggers are used to send a message to a discord channel when a monitor goes down or up.
-
-<div class="border rounded-md">
-
-![Trigger API](/documentation/trig_2.png)
-
-</div>
-
-### Discord URL
-
-<span class="text-red-500 text-xs font-semibold">
-	REQUIRED
-</span>
-
-The Discord URL is used to define the URL of the discord webhook. It is required and has to be a valid URL.
-
-#### How to get the Discord URL?
-
-1.  Go to your discord server
-2.  Right-click on the channel you want to send the messages
-3.  Click on `Edit Channel`
-4.  Go to `Integrations`
-5.  Click on `Create Webhook`
-6.  Copy the URL
-
-#### Discord Message
-
-The discord message when alert is `TRIGGERED` will look like this
-
-![Discord](/discord.png)
-
-The discord message when alert is `RESOLVED` will look like this
-
-![Discord](/documentation/discord_resolved.png)
-
-## Slack
-
-Slack triggers are used to send a message to a slack channel when a monitor goes down or up.
-
-<div class="border rounded-md">
-
-![Trigger API](/documentation/trig_3.png)
-
-</div>
-
-### Slack URL
-
-<span class="text-red-500 text-xs font-semibold">
-	REQUIRED
-</span>
-
-The Slack URL is used to define the URL of the slack webhook. It is required and has to be a valid URL.
-
-#### How to get the Slack URL?
-
-1.  Go to your slack workspace
-2.  Click on `Apps` on the left sidebar
-3.  Search for `Incoming Webhooks`
-4.  Click on `Add to Slack`
-5.  Select the channel you want to send the messages
-6.  Click on `Add Incoming Webhook Integration`
-7.  Copy the URL
-
-#### Slack Message
-
-The slack message when alert is `TRIGGERED` will look like this
-
-![Slack](/slack.png)
-
-The slack message when alert is `RESOLVED` will look like this
-
-![Slack](/documentation/slack_resolved.png)
-
-## Email
-
-Email triggers are used to send an email when a monitor goes down or up. Kener supports sending emails via [resend](https://resend.com) or over SMTP.
-
-<div class="border rounded-md">
-
-![Trigger API](/documentation/trig_4.png)
-
-</div>
-
-### Resend
-
-To send emails using Resend you just need to set `RESEND_API_KEY` in the environment variables.
-
-### SMTP
-
-To send emails using SMTP, please enter
-
--   Host: SMTP server host
--   Port: SMTP server port
--   User: SMTP server username
--   Password: SMTP server password
-
-<div class="note danger">
-
-Since the password will be stored as plain text we encourage to use environment variables for the password. Let us say if you have an environment variable `SMTP_PASSWORD` then you can use it as `$SMTP_PASSWORD`.
-
-</div>
-
-<div class="  note info ">
-
-If your SMTP provider does require username and password, you can set `SMTP_USER` and `SMTP_PASS` to `-`.
-
-</div>
-
-### To
-
-<span class="text-red-500 text-xs font-semibold">
-	REQUIRED
-</span>
-
-The email addresses to which the email should be sent. It is required and has to be a valid email addresses. You can pass multiple email addresses separated by a comma.
-
-### Sender
-
-The email address from which the email should be sent.
-
-It should be in the format `Name <email@address.com>`
-
-If you have not connected your domain with resend, then use `Some Name <onboarding@resend.dev>`
-
-### Subject
-
-Subject of the email when `TRIGGERED`
-
-```text
-[TRIGGERED] Mockoon DOWN at 2024-12-27T04:42:01.430Z
-```
-
-Subject of the email when `RESOLVED`
-
-```text
-[RESOLVED] Mockoon DOWN at 2024-12-27T04:42:01.430Z
-```
-
-### Body
-
-The emaik message when alert is `TRIGGERED` will look like this
-
-![Slack](/documentation/em_t.png)
-
-The emaik message when alert is `RESOLVED` will look like this
-
-![Slack](/documentation/em_r.png)
-
----
-
-## Edit Triggers
-
-Click on the ⚙️ to edit the trigger.
-
-### Deactivate Trigger
-
-You can deactivate the trigger by switching the toggle to off. You cannot send message to a deactivated trigger. Any monitor with this trigger will not send any notifications.
-
----
-
-## Examples
-
-### Telegram
-
-You can use the webhook trigger to send a message to a telegram channel. Enable `Use a custom webhook body`.
-
-Set the URL to `https://api.telegram.org/bot[BOT_TOKEN]/sendMessage`. Replace [BOT_TOKEN] with your bot token.
-
-```json
-{
-    "chat_id": "[CHAT_ID]", // Replace [CHAT_ID] with your chat id
-    "text": "<b>${alert_name}</b>\n\n<b>Severity:</b> <code>${severity}</code>\n<b>Status:</b> ${status}\n<b>Source:</b> Kener\n<b>Time:</b> ${timestamp}\n\n📌 <b>Details:</b>\n- <b>Metric:</b>${metric}\n- <b>Current Value:</b> <code>${current_value}</code>\n- <b>Threshold:</b> <code>${threshold}</code>\n\n🔍 <a href=\"${action_url}\">${action_text}</a>",
-    "parse_mode": "HTML"
-}
-```
-
-If you want to send a message to a group, then replace `[CHAT_ID]` with the group id.
-
-You can also use environment variables to store the bot token and chat id. In that case the URL will be `https://api.telegram.org/bot$BOT_TOKEN/sendMessage`. In the body you can use `"chat_id": "$CHAT_ID"`. Make sure you have set the `BOT_TOKEN` and `CHAT_ID` in the <a href="/docs/environment-vars#secrets">environment variables</a>.

embed.html

@@ -1,20 +0,0 @@
-<!doctype html>
-<html lang="en">
-	<head>
-		<meta charset="UTF-8" />
-		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
-		<title>Document</title>
-		<style>
-			body {
-				background-color: #111;
-			}
-		</style>
-	</head>
-	<body>
-		Hello world
-		<script
-			async
-			src="http://localhost:3000/embed/monitor-earth/js?theme=dark&bgc=111&locale=hi&monitor=http://localhost:3000/embed/monitor-earth"
-		></script>
-	</body>
-</html>

entrypoint.sh

@@ -1,8 +0,0 @@
-#!/bin/sh
-set -e
-
-# Automatically set PUBLIC_WHITE_LABEL based on WHITE_LABEL
-export PUBLIC_WHITE_LABEL="${WHITE_LABEL}"
-
-# Replace shell with the given command (from CMD or runtime args)
-exec "$@"

jsconfig.json

@@ -1,18 +0,0 @@
-{
-	"extends": "./.svelte-kit/tsconfig.json",
-	"compilerOptions": {
-		"allowJs": true,
-		"checkJs": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"resolveJsonModule": true,
-		"skipLibCheck": true,
-		"sourceMap": true,
-		"strict": true,
-		"moduleResolution": "bundler"
-	}
-	// Path aliases are handled by https://kit.svelte.dev/docs/configuration#alias and https://kit.svelte.dev/docs/configuration#files
-	//
-	// If you want to overwrite includes/excludes, make sure to copy over the relevant includes/excludes
-	// from the referenced tsconfig.json - TypeScript does not merge them in
-}

knexfile.js

@@ -1,36 +0,0 @@
-// @ts-nocheck
-import dotenv from "dotenv";
-dotenv.config();
-
-const databaseURL = process.env.DATABASE_URL || "sqlite://./database/kener.sqlite.db";
-
-const databaseURLParts = databaseURL.split("://");
-const databaseType = databaseURLParts[0];
-const databasePath = databaseURLParts[1];
-
-const knexOb = {
-	migrations: {
-		directory: "./migrations"
-	},
-	seeds: {
-		directory: "./seeds"
-	}
-};
-if (databaseType === "sqlite") {
-	knexOb.client = "better-sqlite3";
-	knexOb.connection = {
-		filename: databasePath
-	};
-	knexOb.useNullAsDefault = true;
-} else if (databaseType === "postgresql") {
-	knexOb.client = "pg";
-	knexOb.connection = databaseURL;
-} else if (databaseType === "mysql") {
-	knexOb.client = "mysql2";
-	knexOb.connection = databaseURL;
-} else {
-	console.error("Invalid database type");
-	process.exit(1);
-}
-
-export default knexOb;

knexfile.ts

@@ -0,0 +1,89 @@
+import dotenv from "dotenv";
+dotenv.config();
+
+const databaseURL = process.env.DATABASE_URL || "sqlite://./database/kener.sqlite.db";
+
+const databaseURLParts = databaseURL.split("://");
+const databaseType = databaseURLParts[0];
+const databasePath = databaseURLParts[1];
+
+const intFromEnv = (name: string, fallback: number): number => {
+  const raw = process.env[name];
+  if (raw === undefined) return fallback;
+  const parsed = parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallback;
+};
+
+// TCP keepalive on pooled connections, on by default. Cloud networks (Railway,
+// Docker Swarm overlays, k8s) silently drop idle TCP connections; without
+// keepalive the pool keeps handing out dead sockets after an idle period or a
+// database restart. See docs/adr/0003-fail-fast-self-healing-db-pool.md.
+const keepAliveEnabled = process.env.DATABASE_KEEPALIVE !== "false";
+
+// Pool defaults deviate from knex's on purpose:
+// - min 0: knex's min 2 connections are never reaped, so they are exactly the
+//   ones that go stale and wedge the app until a manual restart
+// - 15s acquire/create timeouts: fail fast instead of hanging requests for
+//   knex's default 60s during a database outage
+// Tarn requires max >= 1 and min <= max; clamp so a bad env value can not
+// produce a pool that fails every acquire
+const poolMax = Math.max(1, intFromEnv("DATABASE_POOL_MAX", 10));
+const poolMin = Math.min(intFromEnv("DATABASE_POOL_MIN", 0), poolMax);
+const pool = {
+  min: poolMin,
+  max: poolMax,
+  idleTimeoutMillis: intFromEnv("DATABASE_IDLE_TIMEOUT_MS", 30000),
+  createTimeoutMillis: intFromEnv("DATABASE_CREATE_TIMEOUT_MS", 15000),
+};
+const acquireConnectionTimeout = intFromEnv("DATABASE_ACQUIRE_TIMEOUT_MS", 15000);
+
+interface KnexConfig {
+  migrations: { directory: string };
+  seeds: { directory: string };
+  databaseType: string;
+  client?: string;
+  connection?: string | { filename: string } | Record<string, unknown>;
+  useNullAsDefault?: boolean;
+  pool?: typeof pool;
+  acquireConnectionTimeout?: number;
+}
+
+const knexOb: KnexConfig = {
+  migrations: {
+    directory: "./migrations",
+  },
+  seeds: {
+    directory: "./seeds",
+  },
+  databaseType,
+};
+console.log(`Configuring database with type ${databaseType}`);
+if (databaseType === "sqlite") {
+  knexOb.client = "better-sqlite3";
+  knexOb.connection = {
+    filename: databasePath,
+  };
+  knexOb.useNullAsDefault = true;
+} else if (databaseType === "postgresql") {
+  knexOb.client = "pg";
+  knexOb.connection = {
+    connectionString: databaseURL,
+    keepAlive: keepAliveEnabled,
+  };
+  knexOb.pool = pool;
+  knexOb.acquireConnectionTimeout = acquireConnectionTimeout;
+} else if (databaseType === "mysql") {
+  knexOb.client = "mysql2";
+  knexOb.connection = {
+    uri: databaseURL,
+    enableKeepAlive: keepAliveEnabled,
+    keepAliveInitialDelay: 10000,
+  };
+  knexOb.pool = pool;
+  knexOb.acquireConnectionTimeout = acquireConnectionTimeout;
+} else {
+  console.error("Invalid database type");
+  process.exit(1);
+}
+
+export default knexOb;

main.js

@@ -1,99 +0,0 @@
-import { handler } from "./build/handler.js";
-import { apiReference } from "@scalar/express-api-reference";
-import dotenv from "dotenv";
-dotenv.config();
-import express from "express";
-import Startup from "./src/lib/server/startup.js";
-import { GetSiteMap } from "./src/lib/server/controllers/controller.js";
-import fs from "fs-extra";
-import knex from "knex";
-import knexOb from "./knexfile.js";
-
-const PORT = process.env.PORT || 3000;
-const base = process.env.KENER_BASE_PATH || "";
-
-const app = express();
-const db = knex(knexOb);
-
-app.use((req, res, next) => {
-	if (req.path.startsWith("/embed")) {
-		res.setHeader("Content-Security-Policy", "frame-ancestors *");
-	}
-	res.setHeader("X-Powered-By", "Kener");
-	next();
-});
-app.get(base + "/healthcheck", (req, res) => {
-	res.end("ok");
-});
-app.get(base + "/sitemap.xml", async (req, res) => {
-	res.header("Content-Type", "application/xml");
-	res.send(await GetSiteMap());
-});
-//part /uploads server static files from static/uploads
-
-//set env variable for upload path
-process.env.UPLOAD_PATH = "./uploads";
-
-app.use(base + "/uploads", express.static("uploads"));
-
-try {
-	const openapiJSON = fs.readFileSync("./openapi.json", "utf-8");
-	app.use(
-		"/api-reference",
-		apiReference({
-			spec: {
-				content: openapiJSON
-			},
-			theme: "alternate",
-			hideModels: true,
-			hideTestRequestButton: true,
-			darkMode: true,
-			metaData: {
-				title: "Kener API Reference",
-				description: "Kener free open source status page API Reference",
-				ogDescription: "Kener free open source status page API Reference",
-				ogTitle: "Kener API Reference",
-				ogImage: "https://kener.ing/newbg.png",
-				twitterCard: "summary_large_image",
-				twitterTitle: "Kener API Reference",
-				twitterDescription: "Kener free open source status page API Reference",
-				twitterImage: "https://kener.ing/newbg.png"
-			},
-			favicon: "https://kener.ing/logo96.png"
-		})
-	);
-} catch (e) {
-	console.warn("Error loading openapi.json, but that is okay.");
-}
-
-app.use(handler);
-
-//migrations
-async function runMigrations() {
-	try {
-		console.log("Running migrations...");
-		await db.migrate.latest(); // Runs migrations to the latest state
-		console.log("Migrations completed successfully!");
-	} catch (err) {
-		console.error("Error running migrations:", err);
-	}
-}
-
-//seed
-async function runSeed() {
-	try {
-		console.log("Running seed...");
-		await db.seed.run(); // Runs seed to the latest state
-		console.log("Seed completed successfully!");
-	} catch (err) {
-		console.error("Error running seed:", err);
-	}
-}
-
-app.listen(PORT, async () => {
-	await runMigrations();
-	await runSeed();
-	await db.destroy();
-	Startup();
-	console.log("Kener is running on port " + PORT + "!");
-});

migrations/20250111153517_init.js

@@ -1,135 +0,0 @@
-// migrations/YYYYMMDDHHMMSS_create_monitoring_tables.js
-
-export function up(knex) {
-	return (
-		knex.schema
-			// Create monitoring_data table
-			.createTable("monitoring_data", (table) => {
-				table.string("monitor_tag", 255).notNullable();
-				table.integer("timestamp").notNullable();
-				table.text("status");
-				table.float("latency", 8, 2);
-				table.text("type");
-				table.primary(["monitor_tag", "timestamp"]);
-			})
-			// Create monitor_alerts table
-			.createTable("monitor_alerts", (table) => {
-				table.increments("id").primary();
-				table.string("monitor_tag", 255).notNullable();
-				table.string("monitor_status", 255).notNullable();
-				table.string("alert_status", 255).notNullable();
-				table.integer("health_checks").notNullable();
-				table.integer("incident_number").defaultTo(0);
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-			})
-			// Add index to monitor_alerts table
-			.raw(
-				"CREATE INDEX idx_monitor_tag_created_at ON monitor_alerts (monitor_tag, created_at)"
-			)
-			.createTable("site_data", (table) => {
-				table.increments("id").primary();
-				table.string("key", 255).notNullable().unique();
-				table.text("value").notNullable();
-				table.string("data_type", 255).notNullable();
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-			})
-			.createTable("monitors", (table) => {
-				table.increments("id").primary();
-				table.string("tag", 255).notNullable().unique();
-				table.string("name", 255).notNullable().unique();
-				table.text("description");
-				table.text("image");
-				table.string("cron", 255);
-				table.string("default_status", 255);
-				table.string("status", 255);
-				table.string("category_name", 255);
-				table.string("monitor_type", 255);
-				table.string("down_trigger", 255);
-				table.string("degraded_trigger", 255);
-				table.text("type_data");
-				table.integer("day_degraded_minimum_count");
-				table.integer("day_down_minimum_count");
-				table.string("include_degraded_in_downtime", 255).defaultTo("NO");
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-			})
-			.createTable("triggers", (table) => {
-				table.increments("id").primary();
-				table.string("name", 255).notNullable().unique();
-				table.string("trigger_type", 255);
-				table.text("trigger_desc");
-				table.string("trigger_status", 255);
-				table.text("trigger_meta");
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-			})
-			.createTable("users", (table) => {
-				table.increments("id").primary();
-				table.string("email", 255).notNullable().unique();
-				table.string("name", 255).notNullable();
-				table.string("password_hash", 255).notNullable();
-				table.integer("is_active").defaultTo(1);
-				table.integer("is_verified").defaultTo(0);
-				table.string("role", 255).defaultTo("user");
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-			})
-			.createTable("api_keys", (table) => {
-				table.increments("id").primary();
-				table.string("name", 255).notNullable().unique();
-				table.string("hashed_key", 255).notNullable().unique();
-				table.string("masked_key", 255).notNullable();
-				table.string("status", 255).defaultTo("ACTIVE");
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-			})
-			.createTable("incidents", (table) => {
-				table.increments("id").primary();
-				table.string("title", 255).notNullable();
-				table.integer("start_date_time").notNullable();
-				table.integer("end_date_time");
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-				table.string("status", 255).defaultTo("ACTIVE");
-				table.string("state", 255).defaultTo("INVESTIGATING");
-			})
-			.createTable("incident_monitors", (table) => {
-				table.increments("id").primary();
-				table.string("monitor_tag", 255).notNullable();
-				table.string("monitor_impact", 255);
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-				table.integer("incident_id").notNullable();
-				table.unique(["monitor_tag", "incident_id"]);
-			})
-			.createTable("incident_comments", (table) => {
-				table.increments("id").primary();
-				table.text("comment").notNullable();
-				table.integer("incident_id").notNullable();
-				table.integer("commented_at").notNullable();
-				table.timestamp("created_at").defaultTo(knex.fn.now());
-				table.timestamp("updated_at").defaultTo(knex.fn.now());
-				table.string("status", 255).defaultTo("ACTIVE");
-				table.string("state", 255).defaultTo("INVESTIGATING");
-			})
-	);
-}
-
-export function down(knex) {
-	return (
-		knex.schema
-			// Drop tables in reverse order
-			.dropTableIfExists("monitor_alerts")
-			.dropTableIfExists("monitoring_data")
-			.dropTableIfExists("site_data")
-			.dropTableIfExists("monitors")
-			.dropTableIfExists("triggers")
-			.dropTableIfExists("users")
-			.dropTableIfExists("api_keys")
-			.dropTableIfExists("incidents")
-			.dropTableIfExists("incident_monitors")
-			.dropTableIfExists("incident_comments")
-	);
-}

migrations/20250111153517_init.ts

@@ -0,0 +1,159 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable("monitoring_data"))) {
+    await knex.schema.createTable("monitoring_data", (table) => {
+      table.string("monitor_tag", 255).notNullable();
+      table.integer("timestamp").notNullable();
+      table.text("status");
+      table.float("latency", 8, 2);
+      table.text("type");
+      table.primary(["monitor_tag", "timestamp"]);
+    });
+  }
+
+  if (!(await knex.schema.hasTable("monitor_alerts"))) {
+    await knex.schema.createTable("monitor_alerts", (table) => {
+      table.increments("id").primary();
+      table.string("monitor_tag", 255).notNullable();
+      table.string("monitor_status", 255).notNullable();
+      table.string("alert_status", 255).notNullable();
+      table.integer("health_checks").notNullable();
+      table.integer("incident_number").defaultTo(0);
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  // Add index (IF NOT EXISTS not supported by all DBs, so use try/catch)
+  try {
+    await knex.schema.raw("CREATE INDEX idx_monitor_tag_created_at ON monitor_alerts (monitor_tag, created_at)");
+  } catch (_e) {
+    // Index already exists
+  }
+
+  if (!(await knex.schema.hasTable("site_data"))) {
+    await knex.schema.createTable("site_data", (table) => {
+      table.increments("id").primary();
+      table.string("key", 255).notNullable().unique();
+      table.text("value").notNullable();
+      table.string("data_type", 255).notNullable();
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  if (!(await knex.schema.hasTable("monitors"))) {
+    await knex.schema.createTable("monitors", (table) => {
+      table.increments("id").primary();
+      table.string("tag", 255).notNullable().unique();
+      table.string("name", 255).notNullable().unique();
+      table.text("description");
+      table.text("image");
+      table.string("cron", 255);
+      table.string("default_status", 255);
+      table.string("status", 255);
+      table.string("category_name", 255);
+      table.string("monitor_type", 255);
+      table.string("down_trigger", 255);
+      table.string("degraded_trigger", 255);
+      table.text("type_data");
+      table.integer("day_degraded_minimum_count");
+      table.integer("day_down_minimum_count");
+      table.string("include_degraded_in_downtime", 255).defaultTo("NO");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  if (!(await knex.schema.hasTable("triggers"))) {
+    await knex.schema.createTable("triggers", (table) => {
+      table.increments("id").primary();
+      table.string("name", 255).notNullable().unique();
+      table.string("trigger_type", 255);
+      table.text("trigger_desc");
+      table.string("trigger_status", 255);
+      table.text("trigger_meta");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  if (!(await knex.schema.hasTable("users"))) {
+    await knex.schema.createTable("users", (table) => {
+      table.increments("id").primary();
+      table.string("email", 255).notNullable().unique();
+      table.string("name", 255).notNullable();
+      table.string("password_hash", 255).notNullable();
+      table.integer("is_active").defaultTo(1);
+      table.integer("is_verified").defaultTo(0);
+      table.string("role", 255).defaultTo("user");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  if (!(await knex.schema.hasTable("api_keys"))) {
+    await knex.schema.createTable("api_keys", (table) => {
+      table.increments("id").primary();
+      table.string("name", 255).notNullable().unique();
+      table.string("hashed_key", 255).notNullable().unique();
+      table.string("masked_key", 255).notNullable();
+      table.string("status", 255).defaultTo("ACTIVE");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  if (!(await knex.schema.hasTable("incidents"))) {
+    await knex.schema.createTable("incidents", (table) => {
+      table.increments("id").primary();
+      table.string("title", 255).notNullable();
+      table.integer("start_date_time").notNullable();
+      table.integer("end_date_time");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+      table.string("status", 255).defaultTo("ACTIVE");
+      table.string("state", 255).defaultTo("INVESTIGATING");
+    });
+  }
+
+  if (!(await knex.schema.hasTable("incident_monitors"))) {
+    await knex.schema.createTable("incident_monitors", (table) => {
+      table.increments("id").primary();
+      table.string("monitor_tag", 255).notNullable();
+      table.string("monitor_impact", 255);
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+      table.integer("incident_id").notNullable();
+      table.unique(["monitor_tag", "incident_id"]);
+    });
+  }
+
+  if (!(await knex.schema.hasTable("incident_comments"))) {
+    await knex.schema.createTable("incident_comments", (table) => {
+      table.increments("id").primary();
+      table.text("comment").notNullable();
+      table.integer("incident_id").notNullable();
+      table.integer("commented_at").notNullable();
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+      table.string("status", 255).defaultTo("ACTIVE");
+      table.string("state", 255).defaultTo("INVESTIGATING");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema
+    .dropTableIfExists("monitor_alerts")
+    .dropTableIfExists("monitoring_data")
+    .dropTableIfExists("site_data")
+    .dropTableIfExists("monitors")
+    .dropTableIfExists("triggers")
+    .dropTableIfExists("users")
+    .dropTableIfExists("api_keys")
+    .dropTableIfExists("incidents")
+    .dropTableIfExists("incident_monitors")
+    .dropTableIfExists("incident_comments");
+}

migrations/20250201152526_add_new_column_to_incidents.js

@@ -1,11 +0,0 @@
-export function up(knex) {
-	return knex.schema.alterTable("incidents", function (table) {
-		table.text("incident_type").defaultTo("INCIDENT");
-	});
-}
-
-export function down(knex) {
-	return knex.schema.alterTable("incidents", function (table) {
-		table.dropColumn("incident_type");
-	});
-}

migrations/20250201152526_add_new_column_to_incidents.ts

@@ -0,0 +1,16 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasCol = await knex.schema.hasColumn("incidents", "incident_type");
+  if (!hasCol) {
+    await knex.schema.alterTable("incidents", function (table) {
+      table.text("incident_type").defaultTo("INCIDENT");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("incidents", function (table) {
+    table.dropColumn("incident_type");
+  });
+}

migrations/20250222153624_add_incident_source_column.js

@@ -1,11 +0,0 @@
-export function up(knex) {
-  return knex.schema.alterTable("incidents", function (table) {
-    table.text("incident_source").defaultTo("DASHBOARD");
-  });
-}
-
-export function down(knex) {
-  return knex.schema.alterTable("incidents", function (table) {
-    table.dropColumn("incident_source");
-  });
-}

migrations/20250222153624_add_incident_source_column.ts

@@ -0,0 +1,16 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasCol = await knex.schema.hasColumn("incidents", "incident_source");
+  if (!hasCol) {
+    await knex.schema.alterTable("incidents", function (table) {
+      table.text("incident_source").defaultTo("DASHBOARD");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("incidents", function (table) {
+    table.dropColumn("incident_source");
+  });
+}

migrations/20250315091330_add_table_invitations.ts

@@ -0,0 +1,34 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable("invitations")) return;
+
+  await knex.schema.createTable("invitations", (table) => {
+    // Primary key
+    table.increments("id").primary();
+
+    // Core invitation fields
+    table.string("invitation_token").unique().notNullable();
+    table.string("invitation_type").notNullable();
+    table.integer("invited_user_id").nullable();
+    table.integer("invited_by_user_id").notNullable();
+
+    // Additional data fields
+    table.text("invitation_meta").nullable(); // For storing JSON or other metadata
+    table.timestamp("invitation_expiry").notNullable();
+    table.string("invitation_status").notNullable().defaultTo("PENDING");
+
+    // Timestamps
+    table.timestamp("created_at").defaultTo(knex.fn.now());
+    table.timestamp("updated_at").defaultTo(knex.fn.now());
+
+    // Indexes
+    table.index("invitation_status");
+    table.index("invitation_expiry");
+    table.index(["invited_by_user_id", "invitation_status"]);
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists("invitations");
+}

migrations/20250417144954_add_subscription_tables.ts

@@ -0,0 +1,57 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable("subscribers"))) {
+    await knex.schema.createTable("subscribers", (table) => {
+      table.increments("id").primary();
+      table.string("subscriber_send").notNullable();
+      table.text("subscriber_meta").nullable();
+      table.string("subscriber_type").notNullable();
+      table.string("subscriber_status").notNullable();
+      table.datetime("created_at").defaultTo(knex.fn.now());
+      table.datetime("updated_at").defaultTo(knex.fn.now());
+
+      // Add unique constraint on subscriber_send and subscriber_type
+      table.unique(["subscriber_send", "subscriber_type"]);
+
+      // Add index on subscriber_send for better query performance
+      table.index(["subscriber_send"]);
+    });
+  }
+
+  if (!(await knex.schema.hasTable("subscriptions"))) {
+    await knex.schema.createTable("subscriptions", (table) => {
+      table.increments("id").primary();
+      table.integer("subscriber_id").unsigned().notNullable();
+      table.string("subscriptions_status").notNullable();
+      table.string("subscriptions_monitors").notNullable();
+      table.text("subscriptions_meta").nullable();
+      table.datetime("created_at").defaultTo(knex.fn.now());
+      table.datetime("updated_at").defaultTo(knex.fn.now());
+
+      // Add unique constraint on subscriber_id and subscriptions_monitors
+      // This constraint also creates an index that will be used for queries
+      table.unique(["subscriber_id", "subscriptions_monitors"]);
+
+      // Add index to optimize queries filtering by status and monitors
+      table.index(["subscriptions_status", "subscriptions_monitors"]);
+    });
+  }
+
+  if (!(await knex.schema.hasTable("subscription_triggers"))) {
+    await knex.schema.createTable("subscription_triggers", (table) => {
+      table.increments("id").primary();
+      table.string("subscription_trigger_type").notNullable().unique();
+      table.string("subscription_trigger_status").notNullable();
+      table.text("config").nullable();
+      table.datetime("created_at").defaultTo(knex.fn.now());
+      table.datetime("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+}
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema
+    .dropTableIfExists("subscription_triggers")
+    .dropTableIfExists("subscriptions")
+    .dropTableIfExists("subscribers");
+}

migrations/20260106120000_add_images_table.ts

@@ -0,0 +1,21 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable("images")) return;
+
+  await knex.schema.createTable("images", (table) => {
+    table.string("id", 32).primary(); // nanoid generated ID with prefix
+    table.text("data").notNullable(); // base64 encoded image data
+    table.string("mime_type", 50).notNullable(); // image/png, image/jpeg, image/svg+xml
+    table.string("original_name", 255); // original filename
+    table.integer("width"); // image width after resize
+    table.integer("height"); // image height after resize
+    table.integer("size"); // size in bytes
+    table.timestamp("created_at").defaultTo(knex.fn.now());
+    table.timestamp("updated_at").defaultTo(knex.fn.now());
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists("images");
+}

migrations/20260107120000_add_pages_tables.ts

@@ -0,0 +1,53 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  // Create pages table
+  if (!(await knex.schema.hasTable("pages"))) {
+    await knex.schema.createTable("pages", (table) => {
+      table.increments("id").primary();
+      table.string("page_path", 255).notNullable().unique(); // e.g., "/", "/api", "/infrastructure"
+      table.string("page_title", 255).notNullable();
+      table.string("page_header", 255);
+      table.string("page_subheader", 255);
+      table.string("page_logo", 255);
+      table.text("page_settings_json"); // JSON settings for the page
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  // Create pages_monitors junction table
+  if (!(await knex.schema.hasTable("pages_monitors"))) {
+    await knex.schema.createTable("pages_monitors", (table) => {
+      table.integer("page_id").unsigned().notNullable();
+      table.string("monitor_tag", 255).notNullable();
+      table.text("monitor_settings_json"); // JSON settings for monitor on this page (e.g., order, visibility)
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+
+      // Composite primary key
+      table.primary(["page_id", "monitor_tag"]);
+
+      // Foreign key constraints
+      table.foreign("page_id").references("id").inTable("pages").onDelete("CASCADE");
+      table.foreign("monitor_tag").references("tag").inTable("monitors").onDelete("CASCADE");
+    });
+  }
+
+  // Add indexes (safe to fail if they already exist)
+  try {
+    await knex.schema.raw("CREATE INDEX idx_pages_monitors_page_id ON pages_monitors (page_id)");
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.raw("CREATE INDEX idx_pages_monitors_monitor_tag ON pages_monitors (monitor_tag)");
+  } catch (_e) {
+    /* index already exists */
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists("pages_monitors");
+  await knex.schema.dropTableIfExists("pages");
+}

migrations/20260109120000_add_maintenances_tables.ts

@@ -0,0 +1,73 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable("maintenances"))) {
+    await knex.schema.createTable("maintenances", (table) => {
+      table.increments("id").primary();
+      table.string("title", 255).notNullable();
+      table.text("description").nullable();
+      table.integer("start_date_time").notNullable();
+      table.string("rrule", 500).notNullable();
+      table.integer("duration_seconds").notNullable();
+      table.string("status", 50).notNullable().defaultTo("ACTIVE");
+      table.string("is_global", 15).notNullable().defaultTo("YES");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  if (!(await knex.schema.hasTable("maintenance_monitors"))) {
+    await knex.schema.createTable("maintenance_monitors", (table) => {
+      table.increments("id").primary();
+      table.integer("maintenance_id").unsigned().notNullable();
+      table.string("monitor_tag", 255).notNullable();
+      table.string("monitor_impact").defaultTo("MAINTENANCE").notNullable();
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+
+      table.foreign("maintenance_id").references("id").inTable("maintenances").onDelete("CASCADE");
+      table.foreign("monitor_tag").references("tag").inTable("monitors").onDelete("CASCADE");
+
+      table.unique(["maintenance_id", "monitor_tag"]);
+    });
+  }
+
+  if (!(await knex.schema.hasTable("maintenances_events"))) {
+    await knex.schema.createTable("maintenances_events", (table) => {
+      table.increments("id").primary();
+      table.integer("maintenance_id").unsigned().notNullable();
+      table.integer("start_date_time").notNullable();
+      table.integer("end_date_time").notNullable();
+      table.string("status", 50).notNullable().defaultTo("SCHEDULED");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+
+      table.foreign("maintenance_id").references("id").inTable("maintenances").onDelete("CASCADE");
+    });
+  }
+
+  // Add indexes (safe to fail if they already exist)
+  const indexes = [
+    "CREATE INDEX idx_maintenances_status ON maintenances (status)",
+    "CREATE INDEX idx_maintenances_start_time ON maintenances (start_date_time)",
+    "CREATE INDEX idx_maintenance_monitors_maintenance_id ON maintenance_monitors (maintenance_id)",
+    "CREATE INDEX idx_maintenance_monitors_monitor_tag ON maintenance_monitors (monitor_tag)",
+    "CREATE INDEX idx_maintenances_events_maintenance_id ON maintenances_events (maintenance_id)",
+    "CREATE INDEX idx_maintenances_events_status ON maintenances_events (status)",
+    "CREATE INDEX idx_maintenances_events_start_time ON maintenances_events (start_date_time)",
+    "CREATE INDEX idx_maintenances_events_end_time ON maintenances_events (end_date_time)",
+  ];
+  for (const sql of indexes) {
+    try {
+      await knex.schema.raw(sql);
+    } catch (_e) {
+      /* index already exists */
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists("maintenances_events");
+  await knex.schema.dropTableIfExists("maintenance_monitors");
+  await knex.schema.dropTableIfExists("maintenances");
+}

migrations/20260114120000_remove_monitors_name_unique.ts

@@ -0,0 +1,19 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  // Remove unique constraint from monitors.name (safe to fail if already dropped)
+  try {
+    await knex.schema.alterTable("monitors", (table) => {
+      table.dropUnique(["name"]);
+    });
+  } catch (_e) {
+    // Constraint already removed
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  // Re-add unique constraint to monitors.name
+  await knex.schema.alterTable("monitors", (table) => {
+    table.unique(["name"]);
+  });
+}

migrations/20260117120000_add_is_hidden_to_monitors.ts

@@ -0,0 +1,16 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasCol = await knex.schema.hasColumn("monitors", "is_hidden");
+  if (!hasCol) {
+    await knex.schema.alterTable("monitors", (table) => {
+      table.string("is_hidden").defaultTo("NO").notNullable();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("monitors", (table) => {
+    table.dropColumn("is_hidden");
+  });
+}

migrations/20260120120000_add_monitor_settings_json.ts

@@ -0,0 +1,16 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasCol = await knex.schema.hasColumn("monitors", "monitor_settings_json");
+  if (!hasCol) {
+    await knex.schema.alterTable("monitors", (table) => {
+      table.text("monitor_settings_json").nullable();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("monitors", (table) => {
+    table.dropColumn("monitor_settings_json");
+  });
+}

migrations/20260123110239_maintenace_monitor_status.ts

@@ -0,0 +1,18 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable("maintenance_monitors"))) return;
+  const hasCol = await knex.schema.hasColumn("maintenance_monitors", "monitor_impact");
+  if (!hasCol) {
+    await knex.schema.alterTable("maintenance_monitors", (table) => {
+      table.string("monitor_impact").defaultTo("MAINTENANCE").notNullable();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable("maintenance_monitors"))) return;
+  await knex.schema.alterTable("maintenance_monitors", (table) => {
+    table.dropColumn("monitor_impact");
+  });
+}

migrations/20260124120000_add_monitor_alerts_config_tables.ts

@@ -0,0 +1,59 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  // Create monitor_alerts_config table
+  if (!(await knex.schema.hasTable("monitor_alerts_config"))) {
+    await knex.schema.createTable("monitor_alerts_config", (table) => {
+      table.increments("id").primary();
+      table.string("monitor_tag", 255).notNullable();
+      table.string("alert_for", 50).notNullable(); // STATUS, LATENCY, UPTIME
+      table.string("alert_value", 255).notNullable(); // DOWN, DEGRADED, or numeric value like "1000" or "99"
+      table.integer("failure_threshold").notNullable().defaultTo(1);
+      table.integer("success_threshold").notNullable().defaultTo(1);
+      table.text("alert_description");
+      table.string("create_incident", 10).notNullable().defaultTo("NO"); // YES or NO
+      table.string("is_active", 10).notNullable().defaultTo("YES"); // YES or NO
+      table.string("severity", 50).notNullable().defaultTo("WARNING"); // CRITICAL or WARNING
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+
+      // Foreign key to monitors table
+      table.foreign("monitor_tag").references("tag").inTable("monitors").onDelete("CASCADE");
+    });
+  }
+
+  // Create indexes (safe to fail if they already exist)
+  try {
+    await knex.raw("CREATE INDEX idx_monitor_alerts_config_monitor_tag ON monitor_alerts_config (monitor_tag)");
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.raw("CREATE INDEX idx_monitor_alerts_config_is_active ON monitor_alerts_config (is_active)");
+  } catch (_e) {
+    /* index already exists */
+  }
+
+  // Create monitor_alerts_config_triggers junction table
+  if (!(await knex.schema.hasTable("monitor_alerts_config_triggers"))) {
+    await knex.schema.createTable("monitor_alerts_config_triggers", (table) => {
+      table.integer("monitor_alerts_id").unsigned().notNullable();
+      table.integer("trigger_id").unsigned().notNullable();
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+
+      // Composite primary key
+      table.primary(["monitor_alerts_id", "trigger_id"]);
+
+      // Foreign keys
+      table.foreign("monitor_alerts_id").references("id").inTable("monitor_alerts_config").onDelete("CASCADE");
+      table.foreign("trigger_id").references("id").inTable("triggers").onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  // Drop junction table first due to foreign key constraints
+  await knex.schema.dropTableIfExists("monitor_alerts_config_triggers");
+  await knex.schema.dropTableIfExists("monitor_alerts_config");
+}

migrations/20260124120001_monitor_alert_config_id.ts

@@ -0,0 +1,56 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable("monitor_alerts_v2"))) {
+    await knex.schema.createTable("monitor_alerts_v2", (table) => {
+      table.increments("id").primary();
+      table.integer("config_id").unsigned().notNullable();
+      table.integer("incident_id").unsigned().nullable();
+      table.string("alert_status", 255).notNullable();
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+
+      // Add index for faster queries on config_id and alert_status
+      table.index(["config_id", "alert_status"]);
+    });
+  }
+
+  // Ensure config_id is unsigned (fix for MySQL users who had signed int from a prior failed run)
+  try {
+    await knex.schema.alterTable("monitor_alerts_v2", (table) => {
+      table.integer("config_id").unsigned().notNullable().alter();
+    });
+  } catch (_e) {
+    /* column may already be correct */
+  }
+
+  // Ensure incident_id is unsigned
+  try {
+    await knex.schema.alterTable("monitor_alerts_v2", (table) => {
+      table.integer("incident_id").unsigned().nullable().alter();
+    });
+  } catch (_e) {
+    /* column may already be correct */
+  }
+
+  // Add foreign key constraints (skip if they already exist)
+  try {
+    await knex.schema.alterTable("monitor_alerts_v2", (table) => {
+      table.foreign("config_id").references("id").inTable("monitor_alerts_config").onDelete("CASCADE");
+    });
+  } catch (_e) {
+    /* foreign key may already exist */
+  }
+
+  try {
+    await knex.schema.alterTable("monitor_alerts_v2", (table) => {
+      table.foreign("incident_id").references("id").inTable("incidents").onDelete("SET NULL");
+    });
+  } catch (_e) {
+    /* foreign key may already exist */
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists("monitor_alerts_v2");
+}

migrations/20260128120000_redesign_subscription_system.ts

@@ -0,0 +1,143 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  // 1. Create subscriber_users table - the actual user identity
+  if (!(await knex.schema.hasTable("subscriber_users"))) {
+    await knex.schema.createTable("subscriber_users", (table) => {
+      table.increments("id").primary();
+      table.string("email", 255).notNullable().unique();
+      table.string("status", 20).notNullable().defaultTo("PENDING");
+      table.string("verification_code", 10).nullable();
+      table.timestamp("verification_expires_at").nullable();
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+      table.index(["status"]);
+      table.index(["email"]);
+    });
+  }
+
+  // 2. Create subscriber_methods table
+  if (!(await knex.schema.hasTable("subscriber_methods"))) {
+    await knex.schema.createTable("subscriber_methods", (table) => {
+      table.increments("id").primary();
+      table.integer("subscriber_user_id").unsigned().notNullable();
+      table.string("method_type", 50).notNullable();
+      table.string("method_value", 500).notNullable();
+      table.string("status", 20).notNullable().defaultTo("ACTIVE");
+      table.text("meta").nullable();
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  // Add indexes, unique constraints, and foreign keys for subscriber_methods (idempotent)
+  try {
+    await knex.schema.alterTable("subscriber_methods", (table) => {
+      table.index(["subscriber_user_id"]);
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.alterTable("subscriber_methods", (table) => {
+      table.index(["method_type"]);
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.alterTable("subscriber_methods", (table) => {
+      table.index(["status"]);
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.alterTable("subscriber_methods", (table) => {
+      table.unique(["subscriber_user_id", "method_type", "method_value"], {
+        indexName: "sub_methods_user_type_value_unique",
+      });
+    });
+  } catch (_e) {
+    /* unique constraint already exists */
+  }
+  try {
+    await knex.schema.alterTable("subscriber_methods", (table) => {
+      table.foreign("subscriber_user_id").references("id").inTable("subscriber_users").onDelete("CASCADE");
+    });
+  } catch (_e) {
+    /* foreign key already exists */
+  }
+
+  // 3. Create user_subscriptions_v2 table
+  if (!(await knex.schema.hasTable("user_subscriptions_v2"))) {
+    await knex.schema.createTable("user_subscriptions_v2", (table) => {
+      table.increments("id").primary();
+      table.integer("subscriber_user_id").unsigned().notNullable();
+      table.integer("subscriber_method_id").unsigned().notNullable();
+      table.string("event_type", 50).notNullable();
+      table.string("status", 20).notNullable().defaultTo("ACTIVE");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  // Add indexes, unique constraints, and foreign keys for user_subscriptions_v2 (idempotent)
+  try {
+    await knex.schema.alterTable("user_subscriptions_v2", (table) => {
+      table.index(["subscriber_user_id"]);
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.alterTable("user_subscriptions_v2", (table) => {
+      table.index(["subscriber_method_id"]);
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.alterTable("user_subscriptions_v2", (table) => {
+      table.index(["event_type"]);
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.alterTable("user_subscriptions_v2", (table) => {
+      table.index(["status"]);
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.alterTable("user_subscriptions_v2", (table) => {
+      table.unique(["subscriber_user_id", "subscriber_method_id", "event_type"], {
+        indexName: "sub_v2_user_method_event_unique",
+      });
+    });
+  } catch (_e) {
+    /* unique constraint already exists */
+  }
+  try {
+    await knex.schema.alterTable("user_subscriptions_v2", (table) => {
+      table.foreign("subscriber_user_id").references("id").inTable("subscriber_users").onDelete("CASCADE");
+    });
+  } catch (_e) {
+    /* foreign key already exists */
+  }
+  try {
+    await knex.schema.alterTable("user_subscriptions_v2", (table) => {
+      table.foreign("subscriber_method_id").references("id").inTable("subscriber_methods").onDelete("CASCADE");
+    });
+  } catch (_e) {
+    /* foreign key already exists */
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists("user_subscriptions_v2");
+  await knex.schema.dropTableIfExists("subscriber_methods");
+  await knex.schema.dropTableIfExists("subscriber_users");
+}

migrations/20260128145145_add_general_email_templates.ts

@@ -0,0 +1,16 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable("general_email_templates")) return;
+
+  await knex.schema.createTable("general_email_templates", (table) => {
+    table.string("template_id").primary();
+    table.string("template_subject");
+    table.text("template_html_body");
+    table.text("template_text_body");
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists("general_email_templates");
+}

migrations/20260202090915_add_new_columns_data_monitors.ts

@@ -0,0 +1,23 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasColumn("monitors", "external_url"))) {
+    await knex.schema.alterTable("monitors", (table) => {
+      table.text("external_url").nullable();
+    });
+  }
+  if (!(await knex.schema.hasColumn("monitoring_data", "error_message"))) {
+    await knex.schema.alterTable("monitoring_data", (table) => {
+      table.text("error_message").nullable();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("monitors", (table) => {
+    table.dropColumn("external_url");
+  });
+  await knex.schema.alterTable("monitoring_data", (table) => {
+    table.dropColumn("error_message");
+  });
+}

migrations/20260216095021_index_monitoring_data.ts

@@ -0,0 +1,25 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  try {
+    await knex.schema.alterTable("monitoring_data", (table) => {
+      table.index(["timestamp"], "idx_monitoring_data_timestamp");
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+  try {
+    await knex.schema.alterTable("monitoring_data", (table) => {
+      table.index(["monitor_tag", "type", "timestamp"], "idx_monitoring_data_monitor_tag_type_timestamp");
+    });
+  } catch (_e) {
+    /* index already exists */
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("monitoring_data", (table) => {
+    table.dropIndex(["timestamp"], "idx_monitoring_data_timestamp");
+    table.dropIndex(["monitor_tag", "type", "timestamp"], "idx_monitoring_data_monitor_tag_type_timestamp");
+  });
+}

migrations/20260219165446_add_global_colum_incidents.ts

@@ -0,0 +1,27 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasColumn("incidents", "is_global"))) {
+    await knex.schema.table("incidents", (table) => {
+      table.string("is_global", 15).notNullable().defaultTo("YES");
+    });
+  }
+  if ((await knex.schema.hasTable("maintenances")) && !(await knex.schema.hasColumn("maintenances", "is_global"))) {
+    await knex.schema.table("maintenances", (table) => {
+      table.string("is_global", 15).notNullable().defaultTo("YES");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn("incidents", "is_global")) {
+    await knex.schema.table("incidents", (table) => {
+      table.dropColumn("is_global");
+    });
+  }
+  if ((await knex.schema.hasTable("maintenances")) && (await knex.schema.hasColumn("maintenances", "is_global"))) {
+    await knex.schema.table("maintenances", (table) => {
+      table.dropColumn("is_global");
+    });
+  }
+}

migrations/20260226120000_add_is_owner_to_users.ts

@@ -0,0 +1,27 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasCol = await knex.schema.hasColumn("users", "is_owner");
+  if (!hasCol) {
+    await knex.schema.alterTable("users", (table) => {
+      table.string("is_owner").defaultTo("NO").notNullable();
+    });
+
+    // Set the first user (by id) as owner, if any users exist.
+    // This only runs when the column has just been added to avoid
+    // overwriting an existing owner on migration re-run.
+    const firstUser = await knex("users").orderBy("id", "asc").first();
+    if (firstUser) {
+      await knex("users").where("id", firstUser.id).update({ is_owner: "YES" });
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasCol = await knex.schema.hasColumn("users", "is_owner");
+  if (hasCol) {
+    await knex.schema.alterTable("users", (table) => {
+      table.dropColumn("is_owner");
+    });
+  }
+}

migrations/20260310120000_alter_page_subheader_to_text.ts

@@ -0,0 +1,13 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("pages", (table) => {
+    table.text("page_subheader").alter();
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.alterTable("pages", (table) => {
+    table.string("page_subheader", 255).alter();
+  });
+}

migrations/20260313030304_add_position_page_monitors.ts

@@ -0,0 +1,19 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasColumn = await knex.schema.hasColumn("pages_monitors", "position");
+  if (!hasColumn) {
+    await knex.schema.alterTable("pages_monitors", (table) => {
+      table.integer("position").unsigned().notNullable().defaultTo(0);
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasColumn = await knex.schema.hasColumn("pages_monitors", "position");
+  if (hasColumn) {
+    await knex.schema.alterTable("pages_monitors", (table) => {
+      table.dropColumn("position");
+    });
+  }
+}