diff --git a/CLAUDE.md b/CLAUDE.md
index 7b32ed1f8..3ae10d480 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -9,6 +9,7 @@ bun run setup              # One-time setup (deps, Docker, migrations, seed)
 bun run dev                # Dev server at localhost:3000 (login: demo@example.com / password)
 bun run build && bun run db:generate && bun run db:migrate
 bun run test && bun run test:e2e && bun run lint && bun run typecheck
+bun apps/web/scripts/backfill-ticket-contacts.ts [--dry-run]   # One-shot: link existing portal users to contacts and backfill tickets.requesterContactId
 ```
 
 ## Rules
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6280dc0dd..e3111fe1c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -87,6 +87,22 @@ const post = await db.query.posts.findFirst({
 
 - Single workspace, `DATABASE_URL` singleton
 
+### Authorization
+
+Quackback has two independent authorization systems serving different product domains:
+
+| System     | Import                       | Domain                                                          |
+| ---------- | ---------------------------- | --------------------------------------------------------------- |
+| **Policy** | `@/lib/server/policy`        | Feedback portal (boards, posts, comments, chat)                 |
+| **Authz**  | `@/lib/server/domains/authz` | Ticketing & workspace admin (tickets, teams, inboxes, SLA, CRM) |
+
+**Which one should I use?**
+
+- Adding a board/post/comment/chat feature → use `policy`
+- Adding a ticket/inbox/team/contact/SLA feature → use `authz`
+
+The two systems are independent and will be unified in a future iteration.
+
 ## Development Guidelines
 
 ### Code Style
diff --git a/apps/web/e2e/tests/admin/tickets.spec.ts b/apps/web/e2e/tests/admin/tickets.spec.ts
new file mode 100644
index 000000000..06b7794d6
--- /dev/null
+++ b/apps/web/e2e/tests/admin/tickets.spec.ts
@@ -0,0 +1,164 @@
+import { test, expect } from '@playwright/test'
+
+const uniqueId = Date.now()
+
+test.describe('Admin Tickets', () => {
+  test.describe.configure({ mode: 'serial' })
+
+  let ticketSubject: string
+
+  test('can navigate to tickets section', async ({ page }) => {
+    await page.goto('/admin')
+    await page.waitForLoadState('networkidle')
+
+    // Sidebar should have a Tickets link
+    const ticketsLink = page.getByRole('link', { name: /tickets/i })
+    await expect(ticketsLink).toBeVisible({ timeout: 10000 })
+
+    await ticketsLink.click()
+    await page.waitForURL('**/admin/tickets**')
+    await expect(page).toHaveURL(/\/admin\/tickets/)
+  })
+
+  test('can create a new ticket', async ({ page }) => {
+    await page.goto('/admin/tickets/new')
+    await page.waitForLoadState('networkidle')
+
+    ticketSubject = `E2E Ticket ${uniqueId}`
+
+    // Fill the subject field
+    const subjectInput = page.locator('#subject')
+    await expect(subjectInput).toBeVisible({ timeout: 10000 })
+    await subjectInput.fill(ticketSubject)
+
+    // Fill the description (TipTap rich text editor)
+    const editor = page.locator('.tiptap').first()
+    await editor.click()
+    await page.keyboard.type('This is an automated E2E test ticket description.')
+
+    // Submit the form
+    await page.getByRole('button', { name: /create/i }).click()
+
+    // Should navigate to the ticket detail page
+    await page.waitForURL('**/admin/tickets/ticket_**', { timeout: 15000 })
+    await expect(page).toHaveURL(/\/admin\/tickets\/ticket_/)
+  })
+
+  test('can view ticket detail', async ({ page }) => {
+    // Navigate to tickets list
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+
+    // Find and click our ticket in the queue
+    const ticketRow = page.getByText(ticketSubject)
+    await expect(ticketRow).toBeVisible({ timeout: 10000 })
+    await ticketRow.click()
+
+    // Should navigate to detail page
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Verify subject is visible in the properties panel
+    await expect(page.getByText(ticketSubject)).toBeVisible()
+
+    // Verify the properties panel renders key sections
+    await expect(page.getByText('Status')).toBeVisible()
+    await expect(page.getByText('Priority')).toBeVisible()
+  })
+
+  test('can add a public reply', async ({ page }) => {
+    // Navigate to tickets list then open our ticket
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+    await page.getByText(ticketSubject).click()
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Find the thread composer (placeholder "Reply to customer…")
+    const composer = page.locator('.tiptap').last()
+    await expect(composer).toBeVisible({ timeout: 10000 })
+    await composer.click()
+    await page.keyboard.type('This is a public reply from E2E test.')
+
+    // Click Post button
+    await page.getByRole('button', { name: /post/i }).click()
+
+    // The reply should appear in the thread timeline
+    await expect(page.getByText('This is a public reply from E2E test.')).toBeVisible({
+      timeout: 10000,
+    })
+  })
+
+  test('can change ticket status', async ({ page }) => {
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+    await page.getByText(ticketSubject).click()
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Find Status section and its picker button
+    const statusSection = page.locator('text=Status').locator('..')
+    const statusButton = statusSection.locator('button').first()
+    await expect(statusButton).toBeVisible({ timeout: 10000 })
+    await statusButton.click()
+
+    // Select "Solved" from the dropdown
+    const solvedOption = page.getByRole('option', { name: /solved/i }).or(page.getByText('Solved'))
+    await solvedOption.first().click()
+
+    // Wait for the mutation to complete
+    await page.waitForLoadState('networkidle')
+
+    // Verify the status changed (status badge should show "Solved")
+    await expect(page.getByText('Solved').first()).toBeVisible({ timeout: 10000 })
+  })
+
+  test('can change ticket priority', async ({ page }) => {
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+    await page.getByText(ticketSubject).click()
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Find Priority section and its picker
+    const prioritySection = page.locator('text=Priority').locator('..')
+    const priorityButton = prioritySection.locator('button').first()
+    await expect(priorityButton).toBeVisible({ timeout: 10000 })
+    await priorityButton.click()
+
+    // Select "High" from the dropdown
+    const highOption = page.getByRole('option', { name: /high/i }).or(page.getByText('high'))
+    await highOption.first().click()
+
+    await page.waitForLoadState('networkidle')
+
+    // Verify priority changed
+    await expect(page.getByText(/high/i).first()).toBeVisible({ timeout: 10000 })
+  })
+
+  test('can edit ticket subject', async ({ page }) => {
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+    await page.getByText(ticketSubject).click()
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Find the Subject section in properties panel and click it to start editing
+    const subjectSection = page.locator('text=Subject').locator('..')
+    await subjectSection.click()
+
+    // The input should appear
+    const subjectInput = subjectSection.locator('input')
+    await expect(subjectInput).toBeVisible({ timeout: 5000 })
+
+    // Clear and type new subject
+    const newSubject = `Updated E2E Ticket ${uniqueId}`
+    await subjectInput.clear()
+    await subjectInput.fill(newSubject)
+    await subjectInput.press('Enter')
+
+    // Wait for save
+    await page.waitForLoadState('networkidle')
+
+    // Verify subject updated (it should appear in the header)
+    await expect(page.getByText(newSubject).first()).toBeVisible({ timeout: 10000 })
+
+    // Update for subsequent tests
+    ticketSubject = newSubject
+  })
+})
diff --git a/apps/web/package.json b/apps/web/package.json
index 86bc9fb31..5326ddd94 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -61,27 +61,28 @@
     "@tanstack/react-start": "^1.168.25",
     "@tanstack/react-table": "^8.21.3",
     "@tanstack/react-virtual": "^3.13.26",
-    "@tiptap/core": "^3.22.3",
-    "@tiptap/extension-bubble-menu": "^3.22.3",
-    "@tiptap/extension-code-block-lowlight": "^3.22.3",
-    "@tiptap/extension-emoji": "3.22.3",
-    "@tiptap/extension-image": "^3.22.3",
-    "@tiptap/extension-link": "^3.22.3",
-    "@tiptap/extension-mention": "3.22.3",
-    "@tiptap/extension-placeholder": "^3.22.3",
-    "@tiptap/extension-table": "^3.22.3",
-    "@tiptap/extension-table-cell": "^3.22.3",
-    "@tiptap/extension-table-header": "^3.22.3",
-    "@tiptap/extension-table-row": "^3.22.3",
-    "@tiptap/extension-task-item": "^3.22.3",
-    "@tiptap/extension-task-list": "^3.22.3",
-    "@tiptap/extension-underline": "^3.22.3",
-    "@tiptap/extension-youtube": "^3.22.3",
-    "@tiptap/markdown": "^3.22.3",
-    "@tiptap/pm": "^3.22.3",
-    "@tiptap/react": "^3.22.3",
-    "@tiptap/starter-kit": "^3.22.3",
-    "@tiptap/suggestion": "^3.22.3",
+    "@tanstack/start": "^1.120.20",
+    "@tiptap/core": "3.23.4",
+    "@tiptap/extension-bubble-menu": "3.23.4",
+    "@tiptap/extension-code-block-lowlight": "3.23.4",
+    "@tiptap/extension-emoji": "3.23.4",
+    "@tiptap/extension-image": "3.23.4",
+    "@tiptap/extension-link": "3.23.4",
+    "@tiptap/extension-mention": "3.23.4",
+    "@tiptap/extension-placeholder": "3.23.4",
+    "@tiptap/extension-table": "3.23.4",
+    "@tiptap/extension-table-cell": "3.23.4",
+    "@tiptap/extension-table-header": "3.23.4",
+    "@tiptap/extension-table-row": "3.23.4",
+    "@tiptap/extension-task-item": "3.23.4",
+    "@tiptap/extension-task-list": "3.23.4",
+    "@tiptap/extension-underline": "3.23.4",
+    "@tiptap/extension-youtube": "3.23.4",
+    "@tiptap/markdown": "3.23.4",
+    "@tiptap/pm": "3.23.4",
+    "@tiptap/react": "3.23.4",
+    "@tiptap/starter-kit": "3.23.4",
+    "@tiptap/suggestion": "3.23.4",
     "bcryptjs": "^3.0.3",
     "better-auth": "^1.6.16",
     "bullmq": "^5.74.1",
diff --git a/apps/web/scripts/backfill-github-ticket-comments.ts b/apps/web/scripts/backfill-github-ticket-comments.ts
new file mode 100644
index 000000000..35fe872c2
--- /dev/null
+++ b/apps/web/scripts/backfill-github-ticket-comments.ts
@@ -0,0 +1,580 @@
+#!/usr/bin/env bun
+/**
+ * Backfill two-way GitHub issue comment sync for linked tickets.
+ *
+ * Usage:
+ *   bun apps/web/scripts/backfill-github-ticket-comments.ts --dry-run
+ *   bun apps/web/scripts/backfill-github-ticket-comments.ts --integration-id=integration_...
+ *   bun apps/web/scripts/backfill-github-ticket-comments.ts --ticket-id=ticket_...
+ *   bun apps/web/scripts/backfill-github-ticket-comments.ts --direction=github-to-quackback
+ *   bun apps/web/scripts/backfill-github-ticket-comments.ts --direction=quackback-to-github
+ *   bun apps/web/scripts/backfill-github-ticket-comments.ts --since=2026-06-01T00:00:00Z
+ *
+ * Environment:
+ *   DATABASE_URL — Required. PostgreSQL connection string.
+ */
+
+try {
+  const { config } = await import('dotenv')
+  config({ path: '.env', quiet: true })
+} catch {
+  // dotenv not available; rely on environment variables.
+}
+
+import {
+  db,
+  eq,
+  and,
+  integrations,
+  ticketExternalLinks,
+  ticketThreadExternalLinks,
+  ticketThreads,
+} from '@/lib/server/db'
+import type { IntegrationId, PrincipalId, TicketId, TicketThreadId } from '@quackback/ids'
+import { decryptSecrets } from '@/lib/server/integrations/encryption'
+import type { GitHubIntegrationConfig } from '@/lib/server/integrations/github/types'
+import {
+  buildInboundTicketThreadBody,
+  buildOutboundGitHubCommentBody,
+  createGitHubIssueComment,
+  deleteGitHubIssueComment,
+  findThreadLinkByExternalComment,
+  findThreadLinkByThread,
+  getThreadAuthorName,
+  listGitHubIssueComments,
+  loadThreadForSync,
+  markThreadLinkDeleted,
+  parseQuackbackThreadMarker,
+  upsertThreadExternalLink,
+  type GitHubIssueComment,
+} from '@/lib/server/integrations/github/ticket-comments'
+import {
+  addThread,
+  editThread,
+  listPublicThreadsForTicket,
+} from '@/lib/server/domains/tickets/ticket.threads'
+
+type Direction = 'both' | 'github-to-quackback' | 'quackback-to-github'
+
+interface Flags {
+  dryRun: boolean
+  integrationId: string | null
+  ticketId: string | null
+  direction: Direction
+  since: string | null
+}
+
+interface Counters {
+  created: number
+  updated: number
+  deleted: number
+  linked: number
+  skipped: number
+}
+
+interface GitHubIntegrationRow {
+  id: IntegrationId
+  principalId: PrincipalId | null
+  config: GitHubIntegrationConfig
+  accessToken: string
+}
+
+interface TicketIssueLink {
+  ticketId: TicketId
+  externalId: string
+  externalUrl: string | null
+}
+
+function printUsage(): void {
+  console.log(`Backfill GitHub ticket comment sync.
+
+Usage:
+  bun apps/web/scripts/backfill-github-ticket-comments.ts [flags]
+
+Flags:
+  --dry-run                 Preview without writing.
+  --integration-id=ID       Limit to one GitHub integration.
+  --ticket-id=ID            Limit to one linked ticket.
+  --direction=DIR           both | github-to-quackback | quackback-to-github (default both).
+  --since=ISO_TIMESTAMP     Only fetch GitHub comments updated since this timestamp.
+  --help                    Show this message.
+
+Notes:
+  Deletes are only reconciled when --since is omitted, because GitHub's list endpoint
+  cannot report deleted comments inside a since window.
+`)
+}
+
+function parseFlags(argv: string[]): Flags {
+  const direction = readArg(argv, '--direction') ?? 'both'
+  if (!['both', 'github-to-quackback', 'quackback-to-github'].includes(direction)) {
+    throw new Error('--direction must be both, github-to-quackback, or quackback-to-github')
+  }
+  const since = readArg(argv, '--since')
+  if (since && Number.isNaN(Date.parse(since))) {
+    throw new Error('--since must be an ISO timestamp')
+  }
+  return {
+    dryRun: argv.includes('--dry-run'),
+    integrationId: readArg(argv, '--integration-id'),
+    ticketId: readArg(argv, '--ticket-id'),
+    direction: direction as Direction,
+    since: since ? new Date(since).toISOString() : null,
+  }
+}
+
+function readArg(argv: string[], name: string): string | null {
+  const prefix = `${name}=`
+  const value = argv.find((arg) => arg.startsWith(prefix))
+  return value ? value.slice(prefix.length) : null
+}
+
+async function loadIntegrations(flags: Flags): Promise<GitHubIntegrationRow[]> {
+  const conditions = [eq(integrations.integrationType, 'github'), eq(integrations.status, 'active')]
+  if (flags.integrationId) {
+    conditions.push(eq(integrations.id, flags.integrationId as IntegrationId))
+  }
+
+  const rows = await db.query.integrations.findMany({
+    where: and(...conditions),
+  })
+
+  return rows.flatMap((row) => {
+    const config = (row.config ?? {}) as GitHubIntegrationConfig
+    const ownerRepo = config.channelId
+    if (!ownerRepo) {
+      console.warn(`[github-comments-backfill] skip integration ${row.id}: missing channelId`)
+      return []
+    }
+    if (!row.secrets) {
+      console.warn(`[github-comments-backfill] skip integration ${row.id}: missing secrets`)
+      return []
+    }
+    const secrets = decryptSecrets<{ accessToken?: string }>(row.secrets)
+    if (!secrets.accessToken) {
+      console.warn(`[github-comments-backfill] skip integration ${row.id}: missing access token`)
+      return []
+    }
+    return [
+      {
+        id: row.id as IntegrationId,
+        principalId: (row.principalId as PrincipalId | null) ?? null,
+        config,
+        accessToken: secrets.accessToken,
+      },
+    ]
+  })
+}
+
+async function loadIssueLinks(
+  integration: GitHubIntegrationRow,
+  flags: Flags
+): Promise<TicketIssueLink[]> {
+  const conditions = [
+    eq(ticketExternalLinks.integrationId, integration.id),
+    eq(ticketExternalLinks.status, 'active'),
+  ]
+  if (flags.ticketId) {
+    conditions.push(eq(ticketExternalLinks.ticketId, flags.ticketId as TicketId))
+  }
+  return db
+    .select({
+      ticketId: ticketExternalLinks.ticketId,
+      externalId: ticketExternalLinks.externalId,
+      externalUrl: ticketExternalLinks.externalUrl,
+    })
+    .from(ticketExternalLinks)
+    .where(and(...conditions))
+}
+
+async function backfillGitHubToQuackback(
+  integration: GitHubIntegrationRow,
+  issueLink: TicketIssueLink,
+  flags: Flags,
+  counters: Counters
+): Promise<void> {
+  const comments = await listGitHubIssueComments({
+    ownerRepo: integration.config.channelId,
+    issueNumber: issueLink.externalId,
+    accessToken: integration.accessToken,
+    since: flags.since ?? undefined,
+  })
+  const remoteIds = new Set(comments.map((comment) => String(comment.id)))
+
+  for (const comment of comments) {
+    const externalCommentId = String(comment.id)
+    const marker = parseQuackbackThreadMarker(comment.body)
+    if (marker) {
+      if (marker.integrationId === integration.id) {
+        await maybeLinkMarker(integration, issueLink, comment, marker, flags, counters)
+      } else {
+        counters.skipped++
+      }
+      continue
+    }
+
+    if (!commentBody(comment)) {
+      counters.skipped++
+      continue
+    }
+
+    const link = await findThreadLinkByExternalComment({
+      integrationId: integration.id,
+      externalCommentId,
+    })
+    const nextBody = buildInboundTicketThreadBody(comment)
+
+    if (link?.status === 'active') {
+      const thread = await loadThreadForSync(link.threadId)
+      if (!thread || thread.deletedAt) {
+        await createInboundThread(integration, issueLink, comment, flags, counters)
+        continue
+      }
+      if (thread.bodyText !== nextBody) {
+        if (flags.dryRun) {
+          console.log(
+            `[dry-run] update ticket thread ${thread.id} from GitHub comment ${externalCommentId}`
+          )
+        } else {
+          await editThread({
+            threadId: thread.id,
+            actorPrincipalId: (thread.principalId as PrincipalId | null) ?? integration.principalId,
+            bodyText: nextBody,
+            syncSourceIntegrationId: integration.id,
+          })
+          await upsertThreadExternalLink({
+            ticketId: issueLink.ticketId,
+            threadId: thread.id,
+            integrationId: integration.id,
+            externalIssueId: issueLink.externalId,
+            externalCommentId,
+            externalUrl: comment.html_url ?? null,
+            syncDirection: 'inbound',
+          })
+        }
+        counters.updated++
+      } else {
+        counters.skipped++
+      }
+      continue
+    }
+
+    await createInboundThread(integration, issueLink, comment, flags, counters)
+  }
+
+  if (!flags.since) {
+    await deleteMissingInboundThreads(integration, issueLink, remoteIds, flags, counters)
+  }
+}
+
+async function backfillQuackbackToGitHub(
+  integration: GitHubIntegrationRow,
+  issueLink: TicketIssueLink,
+  flags: Flags,
+  counters: Counters
+): Promise<void> {
+  const comments = await listGitHubIssueComments({
+    ownerRepo: integration.config.channelId,
+    issueNumber: issueLink.externalId,
+    accessToken: integration.accessToken,
+  })
+  const markerByThreadId = new Map<string, GitHubIssueComment>()
+  for (const comment of comments) {
+    const marker = parseQuackbackThreadMarker(comment.body)
+    if (marker?.integrationId === integration.id && marker.ticketId === issueLink.ticketId) {
+      markerByThreadId.set(marker.threadId, comment)
+    }
+  }
+
+  const publicThreads = await listPublicThreadsForTicket(issueLink.ticketId)
+  const sinceMs = flags.since ? Date.parse(flags.since) : null
+
+  for (const thread of publicThreads) {
+    if (
+      sinceMs &&
+      thread.createdAt.getTime() < sinceMs &&
+      (thread.editedAt?.getTime() ?? 0) < sinceMs
+    ) {
+      counters.skipped++
+      continue
+    }
+
+    const link = await findThreadLinkByThread({
+      integrationId: integration.id,
+      threadId: thread.id,
+    })
+    if (link?.status === 'active') {
+      counters.skipped++
+      continue
+    }
+    if (link?.status === 'deleted') {
+      counters.skipped++
+      continue
+    }
+
+    const markerComment = markerByThreadId.get(thread.id)
+    if (markerComment) {
+      if (flags.dryRun) {
+        console.log(
+          `[dry-run] link existing GitHub comment ${markerComment.id} to ticket thread ${thread.id}`
+        )
+      } else {
+        await upsertThreadExternalLink({
+          ticketId: issueLink.ticketId,
+          threadId: thread.id,
+          integrationId: integration.id,
+          externalIssueId: issueLink.externalId,
+          externalCommentId: String(markerComment.id),
+          externalUrl: markerComment.html_url ?? null,
+          syncDirection: 'outbound',
+        })
+      }
+      counters.linked++
+      continue
+    }
+
+    const authorName = await getThreadAuthorName(thread.principalId)
+    const body = buildOutboundGitHubCommentBody({
+      ticketId: issueLink.ticketId,
+      threadId: thread.id,
+      integrationId: integration.id,
+      bodyText: thread.bodyText,
+      authorName,
+      isFromRequester: false,
+    })
+
+    if (flags.dryRun) {
+      console.log(
+        `[dry-run] create GitHub comment for ticket ${issueLink.ticketId} thread ${thread.id}`
+      )
+    } else {
+      const comment = await createGitHubIssueComment({
+        ownerRepo: integration.config.channelId,
+        issueNumber: issueLink.externalId,
+        accessToken: integration.accessToken,
+        body,
+      })
+      await upsertThreadExternalLink({
+        ticketId: issueLink.ticketId,
+        threadId: thread.id,
+        integrationId: integration.id,
+        externalIssueId: issueLink.externalId,
+        externalCommentId: comment.id,
+        externalUrl: comment.htmlUrl,
+        syncDirection: 'outbound',
+      })
+    }
+    counters.created++
+  }
+
+  if (!flags.since) {
+    await deleteRemoteCommentsForDeletedThreads(integration, issueLink, flags, counters)
+  }
+}
+
+async function maybeLinkMarker(
+  integration: GitHubIntegrationRow,
+  issueLink: TicketIssueLink,
+  comment: GitHubIssueComment,
+  marker: { ticketId: string; threadId: string; integrationId: string },
+  flags: Flags,
+  counters: Counters
+): Promise<void> {
+  if (flags.dryRun) {
+    console.log(`[dry-run] link marker GitHub comment ${comment.id} to thread ${marker.threadId}`)
+  } else {
+    await upsertThreadExternalLink({
+      ticketId: marker.ticketId,
+      threadId: marker.threadId,
+      integrationId: integration.id,
+      externalIssueId: issueLink.externalId,
+      externalCommentId: String(comment.id),
+      externalUrl: comment.html_url ?? null,
+      syncDirection: 'outbound',
+    })
+  }
+  counters.linked++
+}
+
+async function createInboundThread(
+  integration: GitHubIntegrationRow,
+  issueLink: TicketIssueLink,
+  comment: GitHubIssueComment,
+  flags: Flags,
+  counters: Counters
+): Promise<void> {
+  const externalCommentId = String(comment.id)
+  if (flags.dryRun) {
+    console.log(
+      `[dry-run] create public ticket thread on ${issueLink.ticketId} from GitHub comment ${externalCommentId}`
+    )
+  } else {
+    const thread = await addThread({
+      ticketId: issueLink.ticketId,
+      principalId: integration.principalId,
+      audience: 'public',
+      bodyText: buildInboundTicketThreadBody(comment),
+      syncSourceIntegrationId: integration.id,
+    })
+    await upsertThreadExternalLink({
+      ticketId: issueLink.ticketId,
+      threadId: thread.id,
+      integrationId: integration.id,
+      externalIssueId: issueLink.externalId,
+      externalCommentId,
+      externalUrl: comment.html_url ?? null,
+      syncDirection: 'inbound',
+    })
+  }
+  counters.created++
+}
+
+async function deleteMissingInboundThreads(
+  integration: GitHubIntegrationRow,
+  issueLink: TicketIssueLink,
+  remoteIds: Set<string>,
+  flags: Flags,
+  counters: Counters
+): Promise<void> {
+  const links = await db
+    .select({
+      threadId: ticketThreadExternalLinks.threadId,
+      externalCommentId: ticketThreadExternalLinks.externalCommentId,
+      syncDirection: ticketThreadExternalLinks.syncDirection,
+    })
+    .from(ticketThreadExternalLinks)
+    .where(
+      and(
+        eq(ticketThreadExternalLinks.integrationId, integration.id),
+        eq(ticketThreadExternalLinks.externalIssueId, issueLink.externalId),
+        eq(ticketThreadExternalLinks.status, 'active')
+      )
+    )
+
+  for (const link of links) {
+    if (link.syncDirection === 'outbound') continue
+    if (remoteIds.has(link.externalCommentId)) continue
+    if (flags.dryRun) {
+      console.log(
+        `[dry-run] delete local thread ${link.threadId} because GitHub comment ${link.externalCommentId} is gone`
+      )
+    } else {
+      await softDeleteLinkedThread(integration, link.threadId, link.externalCommentId)
+    }
+    counters.deleted++
+  }
+}
+
+async function deleteRemoteCommentsForDeletedThreads(
+  integration: GitHubIntegrationRow,
+  issueLink: TicketIssueLink,
+  flags: Flags,
+  counters: Counters
+): Promise<void> {
+  const links = await db
+    .select({
+      threadId: ticketThreadExternalLinks.threadId,
+      externalCommentId: ticketThreadExternalLinks.externalCommentId,
+    })
+    .from(ticketThreadExternalLinks)
+    .where(
+      and(
+        eq(ticketThreadExternalLinks.integrationId, integration.id),
+        eq(ticketThreadExternalLinks.externalIssueId, issueLink.externalId),
+        eq(ticketThreadExternalLinks.status, 'active')
+      )
+    )
+
+  for (const link of links) {
+    const thread = await loadThreadForSync(link.threadId)
+    if (!thread?.deletedAt) continue
+    if (flags.dryRun) {
+      console.log(
+        `[dry-run] delete GitHub comment ${link.externalCommentId} for deleted thread ${link.threadId}`
+      )
+    } else {
+      await deleteGitHubIssueComment({
+        ownerRepo: integration.config.channelId,
+        commentId: link.externalCommentId,
+        accessToken: integration.accessToken,
+      })
+      await markThreadLinkDeleted({
+        integrationId: integration.id,
+        externalCommentId: link.externalCommentId,
+      })
+    }
+    counters.deleted++
+  }
+}
+
+async function softDeleteLinkedThread(
+  integration: GitHubIntegrationRow,
+  threadId: TicketThreadId,
+  externalCommentId: string
+): Promise<void> {
+  const { softDeleteThread } = await import('@/lib/server/domains/tickets/ticket.threads')
+  const thread = await db.query.ticketThreads.findFirst({
+    where: eq(ticketThreads.id, threadId),
+    columns: { principalId: true, deletedAt: true },
+  })
+  if (!thread || thread.deletedAt) {
+    await markThreadLinkDeleted({ integrationId: integration.id, externalCommentId })
+    return
+  }
+  await softDeleteThread(
+    threadId,
+    (thread.principalId as PrincipalId | null) ?? integration.principalId,
+    integration.id
+  )
+  await markThreadLinkDeleted({ integrationId: integration.id, externalCommentId })
+}
+
+function commentBody(comment: GitHubIssueComment): string {
+  return (comment.body ?? '').trim()
+}
+
+async function main(): Promise<void> {
+  const argv = process.argv.slice(2)
+  if (argv.includes('--help')) {
+    printUsage()
+    return
+  }
+  if (!process.env.DATABASE_URL) {
+    throw new Error('DATABASE_URL is required')
+  }
+
+  const flags = parseFlags(argv)
+  const counters: Counters = { created: 0, updated: 0, deleted: 0, linked: 0, skipped: 0 }
+  console.log('[github-comments-backfill] start', flags)
+
+  const integrationsToProcess = await loadIntegrations(flags)
+  if (integrationsToProcess.length === 0) {
+    console.log('[github-comments-backfill] no matching active GitHub integrations')
+    return
+  }
+
+  for (const integration of integrationsToProcess) {
+    const links = await loadIssueLinks(integration, flags)
+    console.log('[github-comments-backfill] integration', {
+      integrationId: integration.id,
+      repo: integration.config.channelId,
+      linkedTickets: links.length,
+    })
+
+    for (const issueLink of links) {
+      if (flags.direction === 'both' || flags.direction === 'github-to-quackback') {
+        await backfillGitHubToQuackback(integration, issueLink, flags, counters)
+      }
+      if (flags.direction === 'both' || flags.direction === 'quackback-to-github') {
+        await backfillQuackbackToGitHub(integration, issueLink, flags, counters)
+      }
+    }
+  }
+
+  console.log('[github-comments-backfill] summary', counters)
+}
+
+main().catch((error) => {
+  console.error('[github-comments-backfill] failed', error)
+  process.exit(1)
+})
diff --git a/apps/web/scripts/backfill-ticket-contacts.ts b/apps/web/scripts/backfill-ticket-contacts.ts
new file mode 100644
index 000000000..d457edb97
--- /dev/null
+++ b/apps/web/scripts/backfill-ticket-contacts.ts
@@ -0,0 +1,319 @@
+#!/usr/bin/env bun
+/**
+ * Backfill historical data for the portal-tickets identity model.
+ *
+ * Closes the gap left by Phases A + B for rows that already existed before
+ * those landed:
+ *
+ *   Phase 1 — link existing portal users to CRM contacts via
+ *             `contact_user_links`. Mirrors the better-auth
+ *             `databaseHooks.user.create.after` behavior, applied
+ *             retroactively. Gated on `emailVerified = true` so we only
+ *             link identities the user has demonstrably proven they own.
+ *
+ *   Phase 2 — populate `tickets.requesterContactId` for tickets that were
+ *             filed with a `requesterPrincipalId` but no contact (the
+ *             pre-Phase-B portal-creation path). Resolves principal → user
+ *             → email → contact and writes the contact id back.
+ *
+ * Both phases are idempotent — re-running is a no-op for rows already in
+ * the desired state. Use `--dry-run` for a preview that reports candidate
+ * counts without writing.
+ *
+ * Usage:
+ *   bun apps/web/scripts/backfill-ticket-contacts.ts             # Run both phases
+ *   bun apps/web/scripts/backfill-ticket-contacts.ts --dry-run   # Preview
+ *   bun apps/web/scripts/backfill-ticket-contacts.ts --users-only
+ *   bun apps/web/scripts/backfill-ticket-contacts.ts --tickets-only
+ *   bun apps/web/scripts/backfill-ticket-contacts.ts --batch-size=200
+ *   bun apps/web/scripts/backfill-ticket-contacts.ts --limit=1000
+ *   bun apps/web/scripts/backfill-ticket-contacts.ts --help
+ *
+ * Environment:
+ *   DATABASE_URL — Required. PostgreSQL connection string.
+ */
+
+// Load .env if available — same pattern as sibling backfill scripts.
+try {
+  const { config } = await import('dotenv')
+  config({ path: '.env', quiet: true })
+} catch {
+  // dotenv not available, rely on environment variables
+}
+
+import { db, eq, and, isNull, isNotNull, gt, asc, tickets, principal, user } from '@/lib/server/db'
+import type { ContactId, PrincipalId, TicketId, UserId } from '@quackback/ids'
+import { linkContactForUser } from '@/lib/server/auth/link-contact'
+import {
+  findOrCreateByEmail,
+  linkContactToUser,
+} from '@/lib/server/domains/organizations/contact.service'
+
+// ---------------------------------------------------------------------------
+// CLI parsing
+// ---------------------------------------------------------------------------
+
+interface Flags {
+  dryRun: boolean
+  usersOnly: boolean
+  ticketsOnly: boolean
+  batchSize: number
+  limit: number | null
+}
+
+function printUsage(): void {
+  console.log(`Backfill ticket-contact identity links.
+
+Usage:
+  bun apps/web/scripts/backfill-ticket-contacts.ts [flags]
+
+Flags:
+  --dry-run          Preview without writing.
+  --users-only       Skip the ticket backfill phase.
+  --tickets-only     Skip the user-link phase.
+  --batch-size=N     Rows per batch (default 100, max 500).
+  --limit=N          Cap total processed rows per phase.
+  --help             Show this message.
+
+Environment:
+  DATABASE_URL       Required. PostgreSQL connection string.
+`)
+}
+
+function parseFlags(argv: string[]): Flags {
+  const dryRun = argv.includes('--dry-run')
+  const usersOnly = argv.includes('--users-only')
+  const ticketsOnly = argv.includes('--tickets-only')
+  if (usersOnly && ticketsOnly) {
+    console.error(
+      '[backfill-ticket-contacts] --users-only and --tickets-only are mutually exclusive'
+    )
+    process.exit(2)
+  }
+  const batchSizeArg = argv.find((a) => a.startsWith('--batch-size='))
+  let batchSize = batchSizeArg ? parseInt(batchSizeArg.split('=')[1] ?? '', 10) : 100
+  if (!Number.isFinite(batchSize) || batchSize <= 0) batchSize = 100
+  if (batchSize > 500) batchSize = 500
+  const limitArg = argv.find((a) => a.startsWith('--limit='))
+  const limit = limitArg ? parseInt(limitArg.split('=')[1] ?? '', 10) : NaN
+  return {
+    dryRun,
+    usersOnly,
+    ticketsOnly,
+    batchSize,
+    limit: Number.isFinite(limit) && limit > 0 ? limit : null,
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Phase 1 — link existing verified users to contacts
+// ---------------------------------------------------------------------------
+
+interface UserPhaseStats {
+  candidates: number
+  processed: number
+  errors: number
+}
+
+async function phase1LinkUsers(flags: Flags): Promise<UserPhaseStats> {
+  const stats: UserPhaseStats = { candidates: 0, processed: 0, errors: 0 }
+
+  let cursor: string | null = null
+  while (true) {
+    if (flags.limit != null && stats.candidates >= flags.limit) break
+    const remaining = flags.limit != null ? flags.limit - stats.candidates : flags.batchSize
+    const take = Math.min(flags.batchSize, remaining)
+
+    const rows = await db
+      .select({ id: user.id, email: user.email, isAnonymous: user.isAnonymous })
+      .from(user)
+      .where(
+        and(
+          isNotNull(user.email),
+          eq(user.emailVerified, true),
+          eq(user.isAnonymous, false),
+          cursor ? gt(user.id, cursor) : undefined
+        )
+      )
+      .orderBy(asc(user.id))
+      .limit(take)
+    if (rows.length === 0) break
+
+    for (const row of rows) {
+      stats.candidates += 1
+      cursor = row.id
+      if (!row.email) continue // belt-and-suspenders; filtered above
+      if (flags.dryRun) continue
+      try {
+        await linkContactForUser({
+          userId: row.id as UserId,
+          email: row.email,
+          emailVerified: true,
+          anonymous: row.isAnonymous,
+        })
+        stats.processed += 1
+      } catch (err) {
+        stats.errors += 1
+        console.error('[backfill-ticket-contacts] phase1 user error', {
+          userId: row.id,
+          error: err instanceof Error ? err.message : err,
+        })
+      }
+    }
+
+    if (rows.length < take) break
+  }
+
+  return stats
+}
+
+// ---------------------------------------------------------------------------
+// Phase 2 — backfill tickets.requesterContactId
+// ---------------------------------------------------------------------------
+
+interface TicketPhaseStats {
+  candidates: number
+  processed: number
+  missingEmail: number
+  errors: number
+}
+
+async function phase2BackfillTickets(flags: Flags): Promise<TicketPhaseStats> {
+  const stats: TicketPhaseStats = { candidates: 0, processed: 0, missingEmail: 0, errors: 0 }
+
+  let cursor: string | null = null
+  while (true) {
+    if (flags.limit != null && stats.candidates >= flags.limit) break
+    const remaining = flags.limit != null ? flags.limit - stats.candidates : flags.batchSize
+    const take = Math.min(flags.batchSize, remaining)
+
+    const rows = await db
+      .select({
+        id: tickets.id,
+        requesterPrincipalId: tickets.requesterPrincipalId,
+      })
+      .from(tickets)
+      .where(
+        and(
+          isNotNull(tickets.requesterPrincipalId),
+          isNull(tickets.requesterContactId),
+          isNull(tickets.deletedAt),
+          cursor ? gt(tickets.id, cursor) : undefined
+        )
+      )
+      .orderBy(asc(tickets.id))
+      .limit(take)
+    if (rows.length === 0) break
+
+    for (const row of rows) {
+      stats.candidates += 1
+      cursor = row.id
+      try {
+        const contactId = await resolveContactForTicket(row.requesterPrincipalId as PrincipalId)
+        if (!contactId) {
+          stats.missingEmail += 1
+          continue
+        }
+        if (flags.dryRun) {
+          console.log(
+            `[backfill-ticket-contacts] [dry-run] would set ticket ${row.id}.requesterContactId = ${contactId}`
+          )
+          continue
+        }
+        await db
+          .update(tickets)
+          .set({ requesterContactId: contactId })
+          .where(eq(tickets.id, row.id as TicketId))
+        stats.processed += 1
+      } catch (err) {
+        stats.errors += 1
+        console.error('[backfill-ticket-contacts] phase2 ticket error', {
+          ticketId: row.id,
+          error: err instanceof Error ? err.message : err,
+        })
+      }
+    }
+
+    if (rows.length < take) break
+  }
+
+  return stats
+}
+
+/**
+ * Resolve the contact id for a ticket's requester principal.
+ *
+ * Mirrors `resolveRequesterContactId` in `ticket.service.ts` but exposed at
+ * script level so we can decide policy (skip vs. error) per row. Returns
+ * `null` when the principal isn't a user, has no email, or any link
+ * step fails — those rows are reported as `missingEmail` and skipped.
+ */
+async function resolveContactForTicket(principalId: PrincipalId): Promise<ContactId | null> {
+  const principalRow = await db.query.principal.findFirst({
+    where: eq(principal.id, principalId),
+    columns: { userId: true, type: true },
+  })
+  if (!principalRow || !principalRow.userId || principalRow.type !== 'user') return null
+  const userRow = await db.query.user.findFirst({
+    where: eq(user.id, principalRow.userId as UserId),
+    columns: { email: true },
+  })
+  if (!userRow?.email) return null
+  const contact = await findOrCreateByEmail({ email: userRow.email })
+  // Best-effort link — keeps the user/contact pair joined for future queries.
+  await linkContactToUser({
+    contactId: contact.id,
+    userId: principalRow.userId as UserId,
+    linkedByPrincipalId: null,
+  })
+  return contact.id
+}
+
+// ---------------------------------------------------------------------------
+// Entrypoint
+// ---------------------------------------------------------------------------
+
+async function main(): Promise<void> {
+  const argv = process.argv.slice(2)
+  if (argv.includes('--help') || argv.includes('-h')) {
+    printUsage()
+    return
+  }
+  if (!process.env.DATABASE_URL) {
+    console.error('[backfill-ticket-contacts] DATABASE_URL is required')
+    process.exit(1)
+  }
+  const flags = parseFlags(argv)
+
+  console.log('[backfill-ticket-contacts] start', {
+    dryRun: flags.dryRun,
+    usersOnly: flags.usersOnly,
+    ticketsOnly: flags.ticketsOnly,
+    batchSize: flags.batchSize,
+    limit: flags.limit,
+  })
+
+  let userStats: UserPhaseStats | null = null
+  let ticketStats: TicketPhaseStats | null = null
+
+  if (!flags.ticketsOnly) {
+    console.log('[backfill-ticket-contacts] phase 1 — link users to contacts')
+    userStats = await phase1LinkUsers(flags)
+    console.log('[backfill-ticket-contacts] phase 1 done', userStats)
+  }
+  if (!flags.usersOnly) {
+    console.log('[backfill-ticket-contacts] phase 2 — backfill ticket.requesterContactId')
+    ticketStats = await phase2BackfillTickets(flags)
+    console.log('[backfill-ticket-contacts] phase 2 done', ticketStats)
+  }
+
+  console.log('[backfill-ticket-contacts] summary', {
+    users: userStats,
+    tickets: ticketStats,
+  })
+
+  const errors = (userStats?.errors ?? 0) + (ticketStats?.errors ?? 0)
+  process.exit(errors > 0 ? 1 : 0)
+}
+
+await main()
diff --git a/apps/web/src/components/admin/contacts/__tests__/contact-create-dialog.test.tsx b/apps/web/src/components/admin/contacts/__tests__/contact-create-dialog.test.tsx
new file mode 100644
index 000000000..96a279c04
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/__tests__/contact-create-dialog.test.tsx
@@ -0,0 +1,202 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { ContactCreateDialog } from '../contact-create-dialog'
+
+type MutationOptions<T> = {
+  mutationFn: () => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  createContactFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  navigate: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({
+    navigate: mocks.navigate,
+  }),
+}))
+
+vi.mock('@/lib/server/functions/contacts', () => ({
+  createContactFn: mocks.createContactFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+  }: {
+    id?: string
+    type?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLInputElement>) => void
+    maxLength?: number
+    className?: string
+  }) => <input id={id} type={type} value={value} onChange={onChange} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({
+    children,
+  }: {
+    children: ReactNode
+    open?: boolean
+    onOpenChange?: (open: boolean) => void
+  }) => <div>{children}</div>,
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section>{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+  DialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@/components/admin/shared/org-picker', () => ({
+  OrgPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    allowClear?: boolean
+  }) => (
+    <select
+      aria-label="Organization"
+      value={value ?? ''}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+        onValueChange(event.currentTarget.value || null)
+      }
+    >
+      <option value="">No organization</option>
+      <option value="org_default">Default org</option>
+      <option value="org_beta">Beta</option>
+    </select>
+  ),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createContactFn.mockResolvedValue({ id: 'contact_created' })
+})
+
+describe('ContactCreateDialog', () => {
+  it('requires either a name or an email before creating a contact', () => {
+    render(<ContactCreateDialog trigger={<button type="button">Open</button>} />)
+
+    fireEvent.submit(screen.getByRole('button', { name: 'Create' }).closest('form')!)
+
+    expect(mocks.toastError).toHaveBeenCalledWith('Name or email is required')
+    expect(mocks.createContactFn).not.toHaveBeenCalled()
+  })
+
+  it('submits trimmed fields, invalidates the list, resets and navigates to the contact', async () => {
+    render(
+      <ContactCreateDialog
+        trigger={<button type="button">Open</button>}
+        defaultOrganizationId={'org_default' as never}
+      />
+    )
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Ada Lovelace  ' } })
+    fireEvent.change(screen.getByLabelText('Email'), { target: { value: '  ada@example.com  ' } })
+    fireEvent.change(screen.getByLabelText('Phone'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Title'), { target: { value: '  Engineer  ' } })
+    fireEvent.change(screen.getByLabelText('Organization'), { target: { value: 'org_beta' } })
+    fireEvent.change(screen.getByLabelText('External ID'), { target: { value: '  crm-42  ' } })
+    fireEvent.submit(screen.getByRole('button', { name: 'Create' }).closest('form')!)
+
+    await waitFor(() => {
+      expect(mocks.createContactFn).toHaveBeenCalledWith({
+        data: {
+          name: 'Ada Lovelace',
+          email: 'ada@example.com',
+          phone: null,
+          title: 'Engineer',
+          externalId: 'crm-42',
+          organizationId: 'org_beta',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['contacts'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Contact created')
+    expect(mocks.navigate).toHaveBeenCalledWith({
+      to: '/admin/contacts/people/$contactId',
+      params: { contactId: 'contact_created' },
+    })
+    expect(screen.getByLabelText('Name')).toHaveValue('')
+    expect(screen.getByLabelText('Organization')).toHaveValue('org_default')
+  })
+
+  it('reports create failures from the server function', async () => {
+    mocks.createContactFn.mockRejectedValueOnce(new Error('Duplicate contact'))
+    render(<ContactCreateDialog trigger={<button type="button">Open</button>} />)
+
+    fireEvent.change(screen.getByLabelText('Email'), { target: { value: 'ada@example.com' } })
+    fireEvent.submit(screen.getByRole('button', { name: 'Create' }).closest('form')!)
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Duplicate contact')
+    })
+    expect(mocks.navigate).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/components/admin/contacts/__tests__/contact-linked-users-tab.test.tsx b/apps/web/src/components/admin/contacts/__tests__/contact-linked-users-tab.test.tsx
new file mode 100644
index 000000000..c25764fac
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/__tests__/contact-linked-users-tab.test.tsx
@@ -0,0 +1,320 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { ContactLinkedUsersTab } from '../contact-linked-users-tab'
+
+type QueryOptions<T> = {
+  queryKey: readonly unknown[]
+  queryFn: () => T
+  staleTime?: number
+}
+
+type MutationOptions<TVars, TResult> = {
+  mutationFn: (vars: TVars) => Promise<TResult>
+  onSuccess?: (result: TResult) => void
+  onError?: (error: Error) => void
+}
+
+type Link = {
+  id: string
+  userId: string
+  linkedAt: string
+}
+
+type Principal = {
+  id: string
+  userId: string | null
+  displayName: string | null
+  email: string | null
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  linkContactToUserFn: vi.fn(),
+  unlinkContactFromUserFn: vi.fn(),
+  searchPrincipalsFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  permissionAllowed: true,
+  links: [] as Link[],
+  principals: [] as Principal[],
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: () => ({
+    data: mocks.links,
+  }),
+  useQuery: <T,>(options: QueryOptions<T>) => ({
+    data: options.queryFn(),
+  }),
+  useMutation: <TVars, TResult>(options: MutationOptions<TVars, TResult>) => ({
+    isPending: false,
+    mutate: async (vars: TVars) => {
+      try {
+        const result = await options.mutationFn(vars)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+    fallback = null,
+  }: {
+    children: ReactNode
+    fallback?: ReactNode
+    permission: string
+  }) => (mocks.permissionAllowed ? <>{children}</> : <>{fallback}</>),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/avatar', () => ({
+  Avatar: ({ children }: { children: ReactNode; className?: string }) => <span>{children}</span>,
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    className?: string
+  }) => <td colSpan={colSpan}>{children}</td>,
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({
+    value,
+    onValueChange,
+    excludeIds,
+    placeholder,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    roleFilter?: string[]
+    excludeIds: string[]
+    placeholder?: string
+  }) => (
+    <select
+      aria-label="Add user"
+      value={value ?? ''}
+      data-exclude-ids={excludeIds.join(',')}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+        onValueChange(event.currentTarget.value || null)
+      }
+    >
+      <option value="">{placeholder ?? 'Pick user'}</option>
+      <option value="principal_new">New user</option>
+      <option value="principal_without_user">Principal without user</option>
+    </select>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  TrashIcon: () => <span aria-hidden="true">trash</span>,
+}))
+
+vi.mock('@/lib/server/functions/contacts', () => ({
+  linkContactToUserFn: mocks.linkContactToUserFn,
+  unlinkContactFromUserFn: mocks.unlinkContactFromUserFn,
+}))
+
+vi.mock('@/lib/server/functions/principals', () => ({
+  searchPrincipalsFn: mocks.searchPrincipalsFn,
+}))
+
+vi.mock('@/lib/client/queries/contacts', () => ({
+  contactQueries: {
+    links: (contactId: string) => ({ queryKey: ['contacts', contactId, 'links'] }),
+  },
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ORG_MANAGE: 'org.manage',
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.permissionAllowed = true
+  mocks.links = [
+    { id: 'link_1', userId: 'user_existing', linkedAt: '2026-06-18T12:00:00.000Z' },
+    { id: 'link_2', userId: 'user_unknown', linkedAt: '2026-06-18T13:00:00.000Z' },
+  ]
+  mocks.principals = [
+    {
+      id: 'principal_existing',
+      userId: 'user_existing',
+      displayName: 'Existing User',
+      email: 'existing@example.com',
+    },
+    {
+      id: 'principal_new',
+      userId: 'user_new',
+      displayName: 'New User',
+      email: 'new@example.com',
+    },
+    {
+      id: 'principal_without_user',
+      userId: null,
+      displayName: 'No User',
+      email: null,
+    },
+  ]
+  mocks.searchPrincipalsFn.mockImplementation(() => mocks.principals)
+  mocks.linkContactToUserFn.mockResolvedValue({ id: 'link_new' })
+  mocks.unlinkContactFromUserFn.mockResolvedValue(undefined)
+})
+
+describe('ContactLinkedUsersTab', () => {
+  it('renders linked users with principal enrichment and picker exclusions', () => {
+    render(<ContactLinkedUsersTab contactId={'contact_1' as never} />)
+
+    expect(mocks.searchPrincipalsFn).toHaveBeenCalledWith({
+      data: { roleFilter: ['user'], limit: 50 },
+    })
+    expect(screen.getByText('Existing User')).toBeInTheDocument()
+    expect(screen.getByText('existing@example.com')).toBeInTheDocument()
+    expect(screen.getByText('user_unknown')).toBeInTheDocument()
+    expect(screen.getByLabelText('Add user')).toHaveAttribute(
+      'data-exclude-ids',
+      'principal_existing'
+    )
+  })
+
+  it('links a selected user and rejects principals that do not resolve to a user', async () => {
+    render(<ContactLinkedUsersTab contactId={'contact_1' as never} />)
+
+    expect(screen.getByRole('button', { name: 'Link' })).toBeDisabled()
+    fireEvent.change(screen.getByLabelText('Add user'), {
+      target: { value: 'principal_without_user' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Link' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Selected principal has no associated user')
+    expect(mocks.linkContactToUserFn).not.toHaveBeenCalled()
+
+    fireEvent.change(screen.getByLabelText('Add user'), { target: { value: 'principal_new' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Link' }))
+
+    await waitFor(() => {
+      expect(mocks.linkContactToUserFn).toHaveBeenCalledWith({
+        data: {
+          contactId: 'contact_1',
+          userId: 'user_new',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['contacts', 'contact_1', 'links'],
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('User linked')
+  })
+
+  it('unlinks existing users and reports link/unlink failures', async () => {
+    mocks.linkContactToUserFn.mockRejectedValueOnce(new Error('Link denied'))
+    mocks.unlinkContactFromUserFn.mockRejectedValueOnce(new Error('Unlink denied'))
+
+    render(<ContactLinkedUsersTab contactId={'contact_1' as never} />)
+
+    fireEvent.change(screen.getByLabelText('Add user'), { target: { value: 'principal_new' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Link' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Link denied')
+    })
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Unlink' })[0])
+    await waitFor(() => {
+      expect(mocks.unlinkContactFromUserFn).toHaveBeenCalledWith({
+        data: {
+          contactId: 'contact_1',
+          userId: 'user_existing',
+        },
+      })
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith('Unlink denied')
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Unlink' })[0])
+    await waitFor(() => {
+      expect(mocks.toastSuccess).toHaveBeenCalledWith('User unlinked')
+    })
+  })
+
+  it('renders empty and permission-denied states without mutation controls', () => {
+    mocks.links = []
+    render(<ContactLinkedUsersTab contactId={'contact_1' as never} />)
+
+    expect(screen.getByText('No linked users yet.')).toBeInTheDocument()
+
+    cleanup()
+    mocks.links = [{ id: 'link_1', userId: 'user_existing', linkedAt: '2026-06-18T12:00:00.000Z' }]
+    mocks.permissionAllowed = false
+    render(<ContactLinkedUsersTab contactId={'contact_1' as never} />)
+
+    expect(screen.queryByLabelText('Add user')).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Unlink user' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Unlink' })).not.toBeInTheDocument()
+    expect(screen.getByText('Existing User')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/contacts/__tests__/contact-list-and-tabs.test.tsx b/apps/web/src/components/admin/contacts/__tests__/contact-list-and-tabs.test.tsx
new file mode 100644
index 000000000..120e3c249
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/__tests__/contact-list-and-tabs.test.tsx
@@ -0,0 +1,355 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import { ContactList } from '../contact-list'
+import { ContactTicketsTab } from '../contact-tickets-tab'
+import { OrganizationList } from '../organization-list'
+import { OrganizationContactsTab } from '../organization-contacts-tab'
+import { OrganizationTicketsTab } from '../organization-tickets-tab'
+
+type ContactRow = {
+  id: string
+  name: string | null
+  email: string | null
+  phone?: string | null
+  title: string | null
+  organizationId: string | null
+  archivedAt: string | null
+}
+
+type TicketRow = {
+  id: string
+  subject: string
+  priority: string
+  channel: string
+  lastActivityAt: string | null
+}
+
+type OrganizationRow = {
+  id: string
+  name: string
+  domain: string | null
+  website: string | null
+  externalId: string | null
+  archivedAt: string | null
+}
+
+const mocks = vi.hoisted(() => ({
+  searchContacts: [] as ContactRow[],
+  orgContacts: [] as ContactRow[],
+  organizations: [] as Array<{ id: string; name: string }>,
+  organizationList: [] as OrganizationRow[],
+  organizationListParams: undefined as unknown,
+  ticketRows: [] as TicketRow[],
+  listTicketsFn: vi.fn(),
+  permissionAllowed: true,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: (options: { queryKey?: unknown[]; queryFn?: () => { rows: TicketRow[] } }) => {
+    if (options.queryFn) return { data: options.queryFn() }
+    if (options.queryKey?.[1] === 'byOrg') return { data: mocks.orgContacts }
+    if (options.queryKey?.[0] === 'organizations') return { data: mocks.organizationList }
+    return { data: mocks.searchContacts }
+  },
+  useQuery: () => ({
+    data: mocks.organizations,
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    params,
+    to,
+  }: {
+    children: ReactNode
+    params?: Record<string, string>
+    to: string
+  }) => {
+    const href = Object.entries(params ?? {}).reduce(
+      (path, [key, value]) => path.replace(`$${key}`, value),
+      to
+    )
+    return <a href={href}>{children}</a>
+  },
+}))
+
+vi.mock('@/lib/client/queries/contacts', () => ({
+  contactQueries: {
+    search: (params: unknown) => ({ queryKey: ['contacts', 'search', params] }),
+    byOrg: (organizationId: string, params: unknown) => ({
+      queryKey: ['contacts', 'byOrg', organizationId, params],
+    }),
+  },
+}))
+
+vi.mock('@/lib/client/queries/organizations', () => ({
+  organizationQueries: {
+    list: (params: unknown) => {
+      mocks.organizationListParams = params
+      return { queryKey: ['organizations', 'list', params] }
+    },
+  },
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  listTicketsFn: mocks.listTicketsFn,
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: { children: ReactNode; permission: string }) =>
+    mocks.permissionAllowed ? <>{children}</> : null,
+}))
+
+vi.mock('@/components/admin/contacts/contact-create-dialog', () => ({
+  ContactCreateDialog: ({
+    defaultOrganizationId,
+    trigger,
+  }: {
+    defaultOrganizationId: string
+    trigger: ReactNode
+  }) => <div data-default-organization-id={defaultOrganizationId}>{trigger}</div>,
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ORG_MANAGE: 'org.manage',
+  },
+}))
+
+function contact(overrides: Partial<ContactRow> = {}): ContactRow {
+  return {
+    id: 'contact_1',
+    name: 'Ada Lovelace',
+    email: 'ada@example.com',
+    phone: '+1 555 1000',
+    title: 'Engineer',
+    organizationId: 'org_acme',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function organization(overrides: Partial<OrganizationRow> = {}): OrganizationRow {
+  return {
+    id: 'org_acme',
+    name: 'Acme',
+    domain: 'acme.com',
+    website: 'https://acme.com',
+    externalId: 'crm-acme',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.searchContacts = []
+  mocks.orgContacts = []
+  mocks.organizations = []
+  mocks.organizationList = []
+  mocks.organizationListParams = undefined
+  mocks.ticketRows = []
+  mocks.permissionAllowed = true
+  mocks.listTicketsFn.mockImplementation(() => ({ rows: mocks.ticketRows }))
+})
+
+describe('ContactList', () => {
+  it('renders search rows with organization names, fallbacks and status badges', () => {
+    mocks.searchContacts = [
+      contact(),
+      contact({
+        id: 'contact_email',
+        name: null,
+        email: 'fallback@example.com',
+        organizationId: 'org_unknown',
+        title: null,
+        archivedAt: '2026-06-20T10:00:00.000Z',
+      }),
+      contact({
+        id: 'contact_id',
+        name: null,
+        email: null,
+        organizationId: null,
+      }),
+    ]
+    mocks.organizations = [{ id: 'org_acme', name: 'Acme' }]
+
+    render(<ContactList search="ada" showArchived />)
+
+    expect(screen.getByRole('link', { name: 'Ada Lovelace' })).toHaveAttribute(
+      'href',
+      '/admin/contacts/people/contact_1'
+    )
+    expect(screen.getByText('Acme')).toBeInTheDocument()
+    expect(screen.getByText('org_unknown')).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: 'fallback@example.com' })).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: 'contact_id' })).toBeInTheDocument()
+    expect(screen.getAllByText('Active')).toHaveLength(2)
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+  })
+
+  it('renders an empty contact-list row', () => {
+    render(<ContactList search="" showArchived={false} />)
+
+    expect(screen.getByText('No contacts.')).toBeInTheDocument()
+  })
+})
+
+describe('ContactTicketsTab', () => {
+  it('requests tickets for the contact and renders ticket rows', () => {
+    mocks.ticketRows = [
+      {
+        id: 'ticket_1',
+        subject: 'Cannot sign in',
+        priority: 'urgent',
+        channel: 'portal',
+        lastActivityAt: '2026-06-20T10:00:00.000Z',
+      },
+      {
+        id: 'ticket_2',
+        subject: 'Billing question',
+        priority: 'normal',
+        channel: 'email',
+        lastActivityAt: null,
+      },
+    ]
+
+    render(<ContactTicketsTab contactId={'contact_1' as never} />)
+
+    expect(mocks.listTicketsFn).toHaveBeenCalledWith({
+      data: { scope: 'all', requesterContactId: 'contact_1', limit: 100 },
+    })
+    expect(screen.getByRole('link', { name: 'Cannot sign in' })).toHaveAttribute(
+      'href',
+      '/admin/tickets/ticket_1'
+    )
+    expect(screen.getByText('urgent')).toBeInTheDocument()
+    expect(screen.getByText('portal')).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: 'Billing question' })).toBeInTheDocument()
+    expect(screen.getByText('email')).toBeInTheDocument()
+  })
+
+  it('renders an empty ticket row', () => {
+    render(<ContactTicketsTab contactId={'contact_1' as never} />)
+
+    expect(screen.getByText('No tickets for this contact.')).toBeInTheDocument()
+  })
+})
+
+describe('OrganizationContactsTab', () => {
+  it('renders organization contacts and passes the organization id to the create dialog', () => {
+    mocks.orgContacts = [
+      contact(),
+      contact({
+        id: 'contact_archived',
+        name: null,
+        email: null,
+        phone: null,
+        title: null,
+        organizationId: 'org_acme',
+        archivedAt: '2026-06-20T10:00:00.000Z',
+      }),
+    ]
+
+    const { container } = render(<OrganizationContactsTab organizationId={'org_acme' as never} />)
+
+    expect(screen.getByRole('button', { name: /Add contact/ })).toBeInTheDocument()
+    expect(container.querySelector('[data-default-organization-id="org_acme"]')).not.toBeNull()
+    expect(screen.getByRole('link', { name: 'Ada Lovelace' })).toHaveAttribute(
+      'href',
+      '/admin/contacts/people/contact_1'
+    )
+    expect(screen.getByRole('link', { name: 'contact_archived' })).toBeInTheDocument()
+    expect(screen.getByText('+1 555 1000')).toBeInTheDocument()
+    expect(screen.getByText('Engineer')).toBeInTheDocument()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+  })
+
+  it('hides the add-contact action when the actor lacks org management permission', () => {
+    mocks.permissionAllowed = false
+
+    render(<OrganizationContactsTab organizationId={'org_acme' as never} />)
+
+    expect(screen.queryByRole('button', { name: /Add contact/ })).not.toBeInTheDocument()
+    expect(screen.getByText('No contacts in this organization yet.')).toBeInTheDocument()
+  })
+})
+
+describe('OrganizationList', () => {
+  it('trims search, filters archived rows and renders organization fallbacks', () => {
+    mocks.organizationList = [
+      organization(),
+      organization({
+        id: 'org_archived',
+        name: 'Archived org',
+        domain: null,
+        website: null,
+        externalId: null,
+        archivedAt: '2026-06-20T10:00:00.000Z',
+      }),
+    ]
+
+    const { rerender } = render(<OrganizationList search="  acme  " showArchived={false} />)
+
+    expect(mocks.organizationListParams).toEqual({
+      includeArchived: true,
+      search: 'acme',
+    })
+    expect(screen.getByRole('link', { name: 'Acme' })).toHaveAttribute(
+      'href',
+      '/admin/contacts/organizations/org_acme'
+    )
+    expect(screen.getByText('acme.com')).toBeInTheDocument()
+    expect(screen.getByText('https://acme.com')).toBeInTheDocument()
+    expect(screen.getByText('crm-acme')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: 'Archived org' })).not.toBeInTheDocument()
+
+    rerender(<OrganizationList search="" showArchived />)
+
+    expect(mocks.organizationListParams).toEqual({ includeArchived: true })
+    expect(screen.getByRole('link', { name: 'Archived org' })).toBeInTheDocument()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+  })
+
+  it('renders an empty organization-list row', () => {
+    render(<OrganizationList search="" showArchived={false} />)
+
+    expect(screen.getByText('No organizations.')).toBeInTheDocument()
+  })
+})
+
+describe('OrganizationTicketsTab', () => {
+  it('requests tickets for the organization and renders ticket rows', () => {
+    mocks.ticketRows = [
+      {
+        id: 'ticket_1',
+        subject: 'SLA escalation',
+        priority: 'high',
+        channel: 'email',
+        lastActivityAt: '2026-06-20T10:00:00.000Z',
+      },
+    ]
+
+    render(<OrganizationTicketsTab organizationId={'org_acme' as never} />)
+
+    expect(mocks.listTicketsFn).toHaveBeenCalledWith({
+      data: { scope: 'all', organizationId: 'org_acme', limit: 100 },
+    })
+    expect(screen.getByRole('link', { name: 'SLA escalation' })).toHaveAttribute(
+      'href',
+      '/admin/tickets/ticket_1'
+    )
+    expect(screen.getByText('high')).toBeInTheDocument()
+    expect(screen.getByText('email')).toBeInTheDocument()
+  })
+
+  it('renders an empty organization-ticket row', () => {
+    render(<OrganizationTicketsTab organizationId={'org_acme' as never} />)
+
+    expect(screen.getByText('No tickets for this organization.')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/contacts/__tests__/contact-overview-tab.test.tsx b/apps/web/src/components/admin/contacts/__tests__/contact-overview-tab.test.tsx
new file mode 100644
index 000000000..9bec0da9e
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/__tests__/contact-overview-tab.test.tsx
@@ -0,0 +1,295 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { ContactOverviewTab } from '../contact-overview-tab'
+
+type ContactProp = Parameters<typeof ContactOverviewTab>[0]['contact']
+
+type MutationOptions<T> = {
+  mutationFn: () => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  updateContactFn: vi.fn(),
+  archiveContactFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  permissionAllowed: true,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+    fallback = null,
+  }: {
+    children: ReactNode
+    fallback?: ReactNode
+    permission: string
+  }) => (mocks.permissionAllowed ? <>{children}</> : <>{fallback}</>),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+  }: {
+    id?: string
+    type?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLInputElement>) => void
+    maxLength?: number
+    className?: string
+  }) => <input id={id} type={type} value={value} onChange={onChange} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@/components/admin/shared/org-picker', () => ({
+  OrgPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    allowClear?: boolean
+  }) => (
+    <select
+      aria-label="Organization"
+      value={value ?? ''}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+        onValueChange(event.currentTarget.value || null)
+      }
+    >
+      <option value="">No organization</option>
+      <option value="org_acme">Acme</option>
+      <option value="org_beta">Beta</option>
+    </select>
+  ),
+}))
+
+vi.mock('@/lib/server/functions/contacts', () => ({
+  updateContactFn: mocks.updateContactFn,
+  archiveContactFn: mocks.archiveContactFn,
+}))
+
+vi.mock('@/lib/client/queries/contacts', () => ({
+  contactQueries: {
+    detail: (contactId: string) => ({ queryKey: ['contacts', 'detail', contactId] }),
+  },
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ORG_MANAGE: 'org.manage',
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function contact(overrides: Partial<ContactProp> = {}): ContactProp {
+  return {
+    id: 'contact_1',
+    name: 'Ada Lovelace',
+    email: 'ada@example.com',
+    phone: '+1 555 1000',
+    title: 'Engineer',
+    externalId: 'crm-123',
+    organizationId: 'org_acme',
+    archivedAt: null,
+    ...overrides,
+  } as ContactProp
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.permissionAllowed = true
+  mocks.updateContactFn.mockResolvedValue({ id: 'contact_1' })
+  mocks.archiveContactFn.mockResolvedValue({ id: 'contact_1' })
+})
+
+describe('ContactOverviewTab', () => {
+  it('saves trimmed contact fields, invalidates detail/list queries and shows success', async () => {
+    render(<ContactOverviewTab contact={contact()} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Grace Hopper  ' } })
+    fireEvent.change(screen.getByLabelText('Email'), { target: { value: '  grace@example.com  ' } })
+    fireEvent.change(screen.getByLabelText('Phone'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Title'), { target: { value: '  Admiral  ' } })
+    fireEvent.change(screen.getByLabelText('Organization'), { target: { value: 'org_beta' } })
+    fireEvent.change(screen.getByLabelText('External ID'), { target: { value: '  crm-456  ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateContactFn).toHaveBeenCalledWith({
+        data: {
+          contactId: 'contact_1',
+          name: 'Grace Hopper',
+          email: 'grace@example.com',
+          phone: null,
+          title: 'Admiral',
+          externalId: 'crm-456',
+          organizationId: 'org_beta',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['contacts', 'detail', 'contact_1'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['contacts'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Contact updated')
+  })
+
+  it('requires at least a name or email before saving and reports save failures', async () => {
+    render(<ContactOverviewTab contact={contact()} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Email'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    expect(mocks.toastError).toHaveBeenCalledWith('Name or email is required')
+    expect(mocks.updateContactFn).not.toHaveBeenCalled()
+
+    fireEvent.change(screen.getByLabelText('Email'), { target: { value: 'ada@example.com' } })
+    mocks.updateContactFn.mockRejectedValueOnce(new Error('Duplicate contact'))
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Duplicate contact')
+    })
+  })
+
+  it('resets local fields when the contact prop changes', () => {
+    const { rerender } = render(<ContactOverviewTab contact={contact()} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Unsaved edit' } })
+    expect(screen.getByLabelText('Name')).toHaveValue('Unsaved edit')
+
+    rerender(
+      <ContactOverviewTab
+        contact={contact({
+          id: 'contact_2',
+          name: null,
+          email: 'new@example.com',
+          phone: null,
+          title: null,
+          externalId: null,
+          organizationId: null,
+        })}
+      />
+    )
+
+    expect(screen.getByLabelText('Name')).toHaveValue('')
+    expect(screen.getByLabelText('Email')).toHaveValue('new@example.com')
+    expect(screen.getByLabelText('Phone')).toHaveValue('')
+    expect(screen.getByLabelText('Title')).toHaveValue('')
+    expect(screen.getByLabelText('External ID')).toHaveValue('')
+    expect(screen.getByLabelText('Organization')).toHaveValue('')
+  })
+
+  it('archives active contacts and reports archive failures', async () => {
+    render(<ContactOverviewTab contact={contact()} />)
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Archive' })[1])
+
+    await waitFor(() => {
+      expect(mocks.archiveContactFn).toHaveBeenCalledWith({
+        data: { contactId: 'contact_1' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Contact archived')
+
+    mocks.archiveContactFn.mockRejectedValueOnce(new Error('Archive denied'))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Archive' })[1])
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Archive denied')
+    })
+  })
+
+  it('renders archived and denied-management states without mutation controls', () => {
+    const { rerender } = render(
+      <ContactOverviewTab contact={contact({ archivedAt: new Date('2026-06-01T00:00:00.000Z') })} />
+    )
+
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+    expect(
+      screen.getByText('This contact is archived. Restoring is not currently supported.')
+    ).toBeInTheDocument()
+
+    mocks.permissionAllowed = false
+    rerender(<ContactOverviewTab contact={contact()} />)
+
+    expect(screen.queryByRole('button', { name: 'Save changes' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Archive' })).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/contacts/__tests__/organization-create-dialog.test.tsx b/apps/web/src/components/admin/contacts/__tests__/organization-create-dialog.test.tsx
new file mode 100644
index 000000000..2debdd7fc
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/__tests__/organization-create-dialog.test.tsx
@@ -0,0 +1,201 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { OrganizationCreateDialog } from '../organization-create-dialog'
+
+type MutationOptions<T> = {
+  mutationFn: () => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  createOrganizationFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  navigate: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({
+    navigate: mocks.navigate,
+  }),
+}))
+
+vi.mock('@/lib/server/functions/organizations', () => ({
+  createOrganizationFn: mocks.createOrganizationFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLInputElement>) => void
+    required?: boolean
+    maxLength?: number
+    placeholder?: string
+    className?: string
+  }) => <input id={id} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+    rows,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLTextAreaElement>) => void
+    rows?: number
+    maxLength?: number
+  }) => <textarea id={id} value={value} onChange={onChange} rows={rows} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({
+    children,
+  }: {
+    children: ReactNode
+    open?: boolean
+    onOpenChange?: (open: boolean) => void
+  }) => <div>{children}</div>,
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section>{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+  DialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createOrganizationFn.mockResolvedValue({ id: 'org_created' })
+})
+
+describe('OrganizationCreateDialog', () => {
+  it('requires a name before creating an organization', () => {
+    render(<OrganizationCreateDialog trigger={<button type="button">Open</button>} />)
+
+    fireEvent.submit(screen.getByRole('button', { name: 'Create' }).closest('form')!)
+
+    expect(mocks.toastError).toHaveBeenCalledWith('Name is required')
+    expect(mocks.createOrganizationFn).not.toHaveBeenCalled()
+  })
+
+  it('submits trimmed fields, invalidates organizations and navigates on success', async () => {
+    render(<OrganizationCreateDialog trigger={<button type="button">Open</button>} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Acme  ' } })
+    fireEvent.change(screen.getByLabelText('Domain'), { target: { value: '  acme.com  ' } })
+    fireEvent.change(screen.getByLabelText('Website'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('External ID'), { target: { value: '  crm-acme  ' } })
+    fireEvent.change(screen.getByLabelText('Notes'), { target: { value: '  Enterprise  ' } })
+    fireEvent.submit(screen.getByRole('button', { name: 'Create' }).closest('form')!)
+
+    await waitFor(() => {
+      expect(mocks.createOrganizationFn).toHaveBeenCalledWith({
+        data: {
+          name: 'Acme',
+          domain: 'acme.com',
+          website: null,
+          externalId: 'crm-acme',
+          notes: 'Enterprise',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['organizations'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Organization created')
+    expect(mocks.navigate).toHaveBeenCalledWith({
+      to: '/admin/contacts/organizations/$organizationId',
+      params: { organizationId: 'org_created' },
+    })
+    expect(screen.getByLabelText('Name')).toHaveValue('')
+    expect(screen.getByLabelText('Domain')).toHaveValue('')
+  })
+
+  it('turns empty optional fields into null and reports create failures', async () => {
+    mocks.createOrganizationFn.mockRejectedValueOnce(new Error('Duplicate organization'))
+    render(<OrganizationCreateDialog trigger={<button type="button">Open</button>} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Acme' } })
+    fireEvent.change(screen.getByLabelText('Domain'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Website'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('External ID'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Notes'), { target: { value: '   ' } })
+    fireEvent.submit(screen.getByRole('button', { name: 'Create' }).closest('form')!)
+
+    await waitFor(() => {
+      expect(mocks.createOrganizationFn).toHaveBeenCalledWith({
+        data: {
+          name: 'Acme',
+          domain: null,
+          website: null,
+          externalId: null,
+          notes: null,
+        },
+      })
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith('Duplicate organization')
+    expect(mocks.navigate).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/components/admin/contacts/__tests__/organization-overview-tab.test.tsx b/apps/web/src/components/admin/contacts/__tests__/organization-overview-tab.test.tsx
new file mode 100644
index 000000000..eb441c668
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/__tests__/organization-overview-tab.test.tsx
@@ -0,0 +1,297 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { OrganizationOverviewTab } from '../organization-overview-tab'
+
+type OrganizationProp = Parameters<typeof OrganizationOverviewTab>[0]['organization']
+
+type MutationOptions<T> = {
+  mutationFn: () => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  updateOrganizationFn: vi.fn(),
+  archiveOrganizationFn: vi.fn(),
+  unarchiveOrganizationFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  permissionAllowed: true,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+    fallback = null,
+  }: {
+    children: ReactNode
+    fallback?: ReactNode
+    permission: string
+  }) => (mocks.permissionAllowed ? <>{children}</> : <>{fallback}</>),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLInputElement>) => void
+    required?: boolean
+    maxLength?: number
+    className?: string
+  }) => <input id={id} value={value} onChange={onChange} />,
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+    rows,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLTextAreaElement>) => void
+    rows?: number
+    maxLength?: number
+  }) => <textarea id={id} value={value} onChange={onChange} rows={rows} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@/lib/server/functions/organizations', () => ({
+  updateOrganizationFn: mocks.updateOrganizationFn,
+  archiveOrganizationFn: mocks.archiveOrganizationFn,
+  unarchiveOrganizationFn: mocks.unarchiveOrganizationFn,
+}))
+
+vi.mock('@/lib/client/queries/organizations', () => ({
+  organizationQueries: {
+    detail: (organizationId: string) => ({
+      queryKey: ['organizations', 'detail', organizationId],
+    }),
+  },
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ORG_MANAGE: 'org.manage',
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function organization(overrides: Partial<OrganizationProp> = {}): OrganizationProp {
+  return {
+    id: 'org_acme',
+    name: 'Acme',
+    domain: 'acme.example',
+    website: 'https://acme.example',
+    externalId: 'crm-acme',
+    notes: 'Important account',
+    archivedAt: null,
+    ...overrides,
+  } as OrganizationProp
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.permissionAllowed = true
+  mocks.updateOrganizationFn.mockResolvedValue({ id: 'org_acme' })
+  mocks.archiveOrganizationFn.mockResolvedValue({ id: 'org_acme' })
+  mocks.unarchiveOrganizationFn.mockResolvedValue({ id: 'org_acme' })
+})
+
+describe('OrganizationOverviewTab', () => {
+  it('saves trimmed organization fields and invalidates detail/list queries', async () => {
+    render(<OrganizationOverviewTab organization={organization()} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Beta Corp  ' } })
+    fireEvent.change(screen.getByLabelText('Domain'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Website'), {
+      target: { value: '  https://beta.example  ' },
+    })
+    fireEvent.change(screen.getByLabelText('External ID'), { target: { value: '  crm-beta  ' } })
+    fireEvent.change(screen.getByLabelText('Notes'), { target: { value: '  Renewal soon  ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateOrganizationFn).toHaveBeenCalledWith({
+        data: {
+          organizationId: 'org_acme',
+          name: 'Beta Corp',
+          domain: null,
+          website: 'https://beta.example',
+          externalId: 'crm-beta',
+          notes: 'Renewal soon',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['organizations', 'detail', 'org_acme'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['organizations'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Organization updated')
+  })
+
+  it('validates name and reports save failures', async () => {
+    render(<OrganizationOverviewTab organization={organization()} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    expect(mocks.toastError).toHaveBeenCalledWith('Name is required')
+    expect(mocks.updateOrganizationFn).not.toHaveBeenCalled()
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Acme' } })
+    mocks.updateOrganizationFn.mockRejectedValueOnce(new Error('Duplicate organization'))
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Duplicate organization')
+    })
+  })
+
+  it('resets local fields when the organization prop changes', () => {
+    const { rerender } = render(<OrganizationOverviewTab organization={organization()} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Unsaved' } })
+    expect(screen.getByLabelText('Name')).toHaveValue('Unsaved')
+
+    rerender(
+      <OrganizationOverviewTab
+        organization={organization({
+          id: 'org_beta',
+          name: 'Beta',
+          domain: null,
+          website: null,
+          externalId: null,
+          notes: null,
+        })}
+      />
+    )
+
+    expect(screen.getByLabelText('Name')).toHaveValue('Beta')
+    expect(screen.getByLabelText('Domain')).toHaveValue('')
+    expect(screen.getByLabelText('Website')).toHaveValue('')
+    expect(screen.getByLabelText('External ID')).toHaveValue('')
+    expect(screen.getByLabelText('Notes')).toHaveValue('')
+  })
+
+  it('archives and unarchives organizations and reports archive failures', async () => {
+    const { rerender } = render(<OrganizationOverviewTab organization={organization()} />)
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Archive' })[1])
+    await waitFor(() => {
+      expect(mocks.archiveOrganizationFn).toHaveBeenCalledWith({
+        data: { organizationId: 'org_acme' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Organization archived')
+
+    mocks.archiveOrganizationFn.mockRejectedValueOnce(new Error('Archive denied'))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Archive' })[1])
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Archive denied')
+    })
+
+    rerender(
+      <OrganizationOverviewTab
+        organization={organization({ archivedAt: new Date('2026-06-01T00:00:00.000Z') })}
+      />
+    )
+    fireEvent.click(screen.getByRole('button', { name: 'Unarchive' }))
+    await waitFor(() => {
+      expect(mocks.unarchiveOrganizationFn).toHaveBeenCalledWith({
+        data: { organizationId: 'org_acme' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Organization unarchived')
+
+    mocks.unarchiveOrganizationFn.mockRejectedValueOnce(new Error('Unarchive denied'))
+    fireEvent.click(screen.getByRole('button', { name: 'Unarchive' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Unarchive denied')
+    })
+  })
+
+  it('hides mutation controls when organization management permission is denied', () => {
+    mocks.permissionAllowed = false
+
+    render(<OrganizationOverviewTab organization={organization()} />)
+
+    expect(screen.queryByRole('button', { name: 'Save changes' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Archive' })).not.toBeInTheDocument()
+    expect(screen.getByLabelText('Name')).toHaveValue('Acme')
+  })
+})
diff --git a/apps/web/src/components/admin/contacts/contact-create-dialog.tsx b/apps/web/src/components/admin/contacts/contact-create-dialog.tsx
new file mode 100644
index 000000000..fb9d6172f
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/contact-create-dialog.tsx
@@ -0,0 +1,177 @@
+/**
+ * Create-contact dialog. Optional `defaultOrganizationId` prop pre-selects the
+ * org picker (used from the org-detail Contacts tab).
+ */
+import { useState, useEffect } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import type { ContactId, OrganizationId } from '@quackback/ids'
+import { createContactFn } from '@/lib/server/functions/contacts'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@/components/ui/dialog'
+import { OrgPicker } from '@/components/admin/shared/org-picker'
+
+interface Props {
+  trigger: React.ReactNode
+  defaultOrganizationId?: OrganizationId
+}
+
+export function ContactCreateDialog({ trigger, defaultOrganizationId }: Props) {
+  const [open, setOpen] = useState(false)
+  const router = useRouter()
+  const qc = useQueryClient()
+
+  const [name, setName] = useState('')
+  const [email, setEmail] = useState('')
+  const [phone, setPhone] = useState('')
+  const [title, setTitle] = useState('')
+  const [externalId, setExternalId] = useState('')
+  const [organizationId, setOrganizationId] = useState<OrganizationId | null>(
+    defaultOrganizationId ?? null
+  )
+
+  useEffect(() => {
+    if (open) setOrganizationId(defaultOrganizationId ?? null)
+  }, [open, defaultOrganizationId])
+
+  const reset = () => {
+    setName('')
+    setEmail('')
+    setPhone('')
+    setTitle('')
+    setExternalId('')
+    setOrganizationId(defaultOrganizationId ?? null)
+  }
+
+  const mutation = useMutation({
+    mutationFn: () =>
+      createContactFn({
+        data: {
+          name: name.trim() || null,
+          email: email.trim() || null,
+          phone: phone.trim() || null,
+          title: title.trim() || null,
+          externalId: externalId.trim() || null,
+          organizationId: organizationId ?? null,
+        },
+      }),
+    onSuccess: (contact) => {
+      qc.invalidateQueries({ queryKey: ['contacts'] })
+      toast.success('Contact created')
+      setOpen(false)
+      reset()
+      router.navigate({
+        to: '/admin/contacts/people/$contactId',
+        params: { contactId: contact.id as ContactId },
+      })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <Dialog open={open} onOpenChange={setOpen}>
+      <DialogTrigger asChild>{trigger}</DialogTrigger>
+      <DialogContent className="max-w-lg">
+        <DialogHeader>
+          <DialogTitle>New contact</DialogTitle>
+          <DialogDescription>
+            People you support — typically a customer or end-user representative.
+          </DialogDescription>
+        </DialogHeader>
+
+        <form
+          onSubmit={(e) => {
+            e.preventDefault()
+            if (!name.trim() && !email.trim()) {
+              toast.error('Name or email is required')
+              return
+            }
+            mutation.mutate()
+          }}
+          className="space-y-3"
+        >
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-1">
+              <Label htmlFor="contact-name">Name</Label>
+              <Input
+                id="contact-name"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                maxLength={200}
+              />
+            </div>
+            <div className="space-y-1">
+              <Label htmlFor="contact-email">Email</Label>
+              <Input
+                id="contact-email"
+                type="email"
+                value={email}
+                onChange={(e) => setEmail(e.target.value)}
+                maxLength={320}
+              />
+            </div>
+          </div>
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-1">
+              <Label htmlFor="contact-phone">Phone</Label>
+              <Input
+                id="contact-phone"
+                value={phone}
+                onChange={(e) => setPhone(e.target.value)}
+                maxLength={64}
+              />
+            </div>
+            <div className="space-y-1">
+              <Label htmlFor="contact-title">Title</Label>
+              <Input
+                id="contact-title"
+                value={title}
+                onChange={(e) => setTitle(e.target.value)}
+                maxLength={120}
+              />
+            </div>
+          </div>
+          <div className="space-y-1">
+            <Label>Organization</Label>
+            <OrgPicker value={organizationId} onValueChange={setOrganizationId} allowClear />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="contact-external-id">External ID</Label>
+            <Input
+              id="contact-external-id"
+              value={externalId}
+              onChange={(e) => setExternalId(e.target.value)}
+              maxLength={255}
+              className="font-mono text-xs"
+            />
+          </div>
+
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="outline"
+              onClick={() => setOpen(false)}
+              disabled={mutation.isPending}
+            >
+              Cancel
+            </Button>
+            <Button type="submit" disabled={mutation.isPending}>
+              Create
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/contact-linked-users-tab.tsx b/apps/web/src/components/admin/contacts/contact-linked-users-tab.tsx
new file mode 100644
index 000000000..8fa5317d8
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/contact-linked-users-tab.tsx
@@ -0,0 +1,235 @@
+/**
+ * Linked users tab — manage portal-user links for a contact.
+ *
+ * Approach:
+ * - List existing links (`listLinksForContactFn`) → show userId + linkedAt;
+ *   enrich displayName/email via `searchPrincipalsFn({roleFilter:['user']})`
+ *   client-side Map keyed by userId.
+ * - Add: `<PrincipalPicker roleFilter={['user']}>` returns PrincipalId; we
+ *   resolve PrincipalId → UserId via the same map and call `linkContactToUserFn`.
+ * - Remove: AlertDialog → `unlinkContactFromUserFn`.
+ */
+import { useState, useMemo } from 'react'
+import { useSuspenseQuery, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { ContactId, PrincipalId, UserId } from '@quackback/ids'
+import { linkContactToUserFn, unlinkContactFromUserFn } from '@/lib/server/functions/contacts'
+import { searchPrincipalsFn } from '@/lib/server/functions/principals'
+import { contactQueries } from '@/lib/client/queries/contacts'
+import { Button } from '@/components/ui/button'
+import { Avatar } from '@/components/ui/avatar'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { TrashIcon } from '@heroicons/react/24/outline'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export function ContactLinkedUsersTab({ contactId }: { contactId: ContactId }) {
+  const qc = useQueryClient()
+  const { data: links } = useSuspenseQuery(contactQueries.links(contactId))
+
+  // Resolve userId → display info via a single principals query.
+  const principalsQuery = useQuery({
+    queryKey: ['principals', 'allUsers'],
+    queryFn: () => searchPrincipalsFn({ data: { roleFilter: ['user'], limit: 50 } }),
+    staleTime: 60_000,
+  })
+  const userMap = useMemo(() => {
+    const m = new Map<
+      string,
+      { principalId: PrincipalId; displayName: string | null; email: string | null }
+    >()
+    for (const p of principalsQuery.data ?? []) {
+      if (p.userId)
+        m.set(p.userId, {
+          principalId: p.id,
+          displayName: p.displayName,
+          email: p.email,
+        })
+    }
+    return m
+  }, [principalsQuery.data])
+
+  const linkedUserIds = useMemo(() => links.map((l) => l.userId as UserId), [links])
+  const excludePrincipalIds = useMemo(() => {
+    const ids: PrincipalId[] = []
+    for (const u of linkedUserIds) {
+      const info = userMap.get(u)
+      if (info) ids.push(info.principalId)
+    }
+    return ids
+  }, [linkedUserIds, userMap])
+
+  const [addPrincipalId, setAddPrincipalId] = useState<PrincipalId | null>(null)
+
+  const invalidate = () =>
+    qc.invalidateQueries({ queryKey: contactQueries.links(contactId).queryKey })
+
+  const linkMutation = useMutation({
+    mutationFn: (userId: UserId) => linkContactToUserFn({ data: { contactId, userId } }),
+    onSuccess: () => {
+      setAddPrincipalId(null)
+      invalidate()
+      toast.success('User linked')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const unlinkMutation = useMutation({
+    mutationFn: (userId: UserId) => unlinkContactFromUserFn({ data: { contactId, userId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('User unlinked')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const handleAdd = () => {
+    if (!addPrincipalId) return
+    // Find userId for the picked principalId.
+    let resolvedUserId: UserId | null = null
+    for (const [uid, info] of userMap.entries()) {
+      if (info.principalId === addPrincipalId) {
+        resolvedUserId = uid as UserId
+        break
+      }
+    }
+    if (!resolvedUserId) {
+      toast.error('Selected principal has no associated user')
+      return
+    }
+    linkMutation.mutate(resolvedUserId)
+  }
+
+  return (
+    <div className="space-y-4 max-w-3xl">
+      <div>
+        <h2 className="text-sm font-semibold">Linked users</h2>
+        <p className="text-xs text-muted-foreground">
+          Portal users associated with this contact. Linking ties their authenticated identity to
+          ticket history.
+        </p>
+      </div>
+
+      <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+        <div className="rounded border border-border/50 p-3 space-y-2">
+          <div className="grid grid-cols-[1fr,auto] gap-2 items-end">
+            <div className="space-y-1">
+              <label className="text-xs font-medium text-muted-foreground">Add user</label>
+              <PrincipalPicker
+                value={addPrincipalId}
+                onValueChange={setAddPrincipalId}
+                roleFilter={['user']}
+                excludeIds={excludePrincipalIds}
+                placeholder="Pick portal user…"
+              />
+            </div>
+            <Button
+              size="sm"
+              disabled={!addPrincipalId || linkMutation.isPending}
+              onClick={handleAdd}
+            >
+              Link
+            </Button>
+          </div>
+        </div>
+      </PermissionGate>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>User</TableHead>
+              <TableHead className="w-44">Linked at</TableHead>
+              <TableHead className="w-12" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {links.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={3} className="text-center text-sm text-muted-foreground py-6">
+                  No linked users yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              links.map((l) => {
+                const info = userMap.get(l.userId)
+                const label = info?.displayName ?? info?.email ?? l.userId
+                return (
+                  <TableRow key={l.id}>
+                    <TableCell>
+                      <div className="flex items-center gap-2">
+                        <Avatar className="h-6 w-6 text-[10px]">
+                          {label.slice(0, 2).toUpperCase()}
+                        </Avatar>
+                        <div className="flex flex-col">
+                          <span className="text-sm">{label}</span>
+                          {info?.email && info?.displayName && (
+                            <span className="text-[11px] text-muted-foreground">{info.email}</span>
+                          )}
+                        </div>
+                      </div>
+                    </TableCell>
+                    <TableCell className="text-xs text-muted-foreground">
+                      {new Date(l.linkedAt).toLocaleString()}
+                    </TableCell>
+                    <TableCell>
+                      <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+                        <AlertDialog>
+                          <AlertDialogTrigger asChild>
+                            <Button
+                              variant="ghost"
+                              size="sm"
+                              className="h-7 w-7 p-0"
+                              aria-label="Unlink user"
+                            >
+                              <TrashIcon className="h-3.5 w-3.5" />
+                            </Button>
+                          </AlertDialogTrigger>
+                          <AlertDialogContent>
+                            <AlertDialogHeader>
+                              <AlertDialogTitle>Unlink user?</AlertDialogTitle>
+                              <AlertDialogDescription>
+                                The contact will no longer be associated with this portal user.
+                              </AlertDialogDescription>
+                            </AlertDialogHeader>
+                            <AlertDialogFooter>
+                              <AlertDialogCancel>Cancel</AlertDialogCancel>
+                              <AlertDialogAction
+                                onClick={() => unlinkMutation.mutate(l.userId as UserId)}
+                              >
+                                Unlink
+                              </AlertDialogAction>
+                            </AlertDialogFooter>
+                          </AlertDialogContent>
+                        </AlertDialog>
+                      </PermissionGate>
+                    </TableCell>
+                  </TableRow>
+                )
+              })
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/contact-list.tsx b/apps/web/src/components/admin/contacts/contact-list.tsx
new file mode 100644
index 000000000..d884a2f5f
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/contact-list.tsx
@@ -0,0 +1,89 @@
+/**
+ * Cross-org contact table. Resolves organization names via list-cache lookup.
+ */
+import { useMemo } from 'react'
+import { Link } from '@tanstack/react-router'
+import { useSuspenseQuery, useQuery } from '@tanstack/react-query'
+import type { ContactId } from '@quackback/ids'
+import { contactQueries } from '@/lib/client/queries/contacts'
+import { organizationQueries } from '@/lib/client/queries/organizations'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+
+interface Props {
+  search: string
+  showArchived: boolean
+}
+
+export function ContactList({ search, showArchived }: Props) {
+  const { data: contacts } = useSuspenseQuery(
+    contactQueries.search({ query: search, includeArchived: showArchived })
+  )
+
+  // Best-effort org name lookup. Stays optional so we don't block the list.
+  const orgsQuery = useQuery(organizationQueries.list({ includeArchived: true }))
+  const orgMap = useMemo(() => {
+    const m = new Map<string, string>()
+    for (const o of orgsQuery.data ?? []) m.set(o.id, o.name)
+    return m
+  }, [orgsQuery.data])
+
+  return (
+    <div className="rounded-md border border-border/50">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Name</TableHead>
+            <TableHead>Email</TableHead>
+            <TableHead>Organization</TableHead>
+            <TableHead>Title</TableHead>
+            <TableHead className="w-24">Status</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {contacts.length === 0 ? (
+            <TableRow>
+              <TableCell colSpan={5} className="text-center text-sm text-muted-foreground py-6">
+                No contacts.
+              </TableCell>
+            </TableRow>
+          ) : (
+            contacts.map((c) => (
+              <TableRow key={c.id} className="hover:bg-muted/50">
+                <TableCell className="font-medium">
+                  <Link
+                    to="/admin/contacts/people/$contactId"
+                    params={{ contactId: c.id as ContactId }}
+                  >
+                    {c.name ?? c.email ?? c.id}
+                  </Link>
+                </TableCell>
+                <TableCell className="text-xs text-muted-foreground">{c.email ?? '—'}</TableCell>
+                <TableCell className="text-xs text-muted-foreground">
+                  {c.organizationId ? (orgMap.get(c.organizationId) ?? c.organizationId) : '—'}
+                </TableCell>
+                <TableCell className="text-xs text-muted-foreground">{c.title ?? '—'}</TableCell>
+                <TableCell>
+                  {c.archivedAt ? (
+                    <Badge variant="outline" className="text-muted-foreground">
+                      Archived
+                    </Badge>
+                  ) : (
+                    <Badge variant="outline">Active</Badge>
+                  )}
+                </TableCell>
+              </TableRow>
+            ))
+          )}
+        </TableBody>
+      </Table>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/contact-overview-tab.tsx b/apps/web/src/components/admin/contacts/contact-overview-tab.tsx
new file mode 100644
index 000000000..dd3c63d77
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/contact-overview-tab.tsx
@@ -0,0 +1,202 @@
+/**
+ * Editable contact form. Bottom Archive section. No unarchive (backend does
+ * not expose unarchiveContactFn).
+ */
+import { useState, useEffect } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { Contact } from '@/lib/shared/db-types'
+import type { OrganizationId } from '@quackback/ids'
+import { updateContactFn, archiveContactFn } from '@/lib/server/functions/contacts'
+import { contactQueries } from '@/lib/client/queries/contacts'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { OrgPicker } from '@/components/admin/shared/org-picker'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export function ContactOverviewTab({ contact }: { contact: Contact }) {
+  const qc = useQueryClient()
+  const [name, setName] = useState(contact.name ?? '')
+  const [email, setEmail] = useState(contact.email ?? '')
+  const [phone, setPhone] = useState(contact.phone ?? '')
+  const [title, setTitle] = useState(contact.title ?? '')
+  const [externalId, setExternalId] = useState(contact.externalId ?? '')
+  const [organizationId, setOrganizationId] = useState<OrganizationId | null>(
+    (contact.organizationId as OrganizationId | null) ?? null
+  )
+
+  useEffect(() => {
+    setName(contact.name ?? '')
+    setEmail(contact.email ?? '')
+    setPhone(contact.phone ?? '')
+    setTitle(contact.title ?? '')
+    setExternalId(contact.externalId ?? '')
+    setOrganizationId((contact.organizationId as OrganizationId | null) ?? null)
+  }, [contact])
+
+  const invalidate = () => {
+    qc.invalidateQueries({ queryKey: contactQueries.detail(contact.id).queryKey })
+    qc.invalidateQueries({ queryKey: ['contacts'] })
+  }
+
+  const saveMutation = useMutation({
+    mutationFn: () =>
+      updateContactFn({
+        data: {
+          contactId: contact.id,
+          name: name.trim() || null,
+          email: email.trim() || null,
+          phone: phone.trim() || null,
+          title: title.trim() || null,
+          externalId: externalId.trim() || null,
+          organizationId: organizationId ?? null,
+        },
+      }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Contact updated')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const archiveMutation = useMutation({
+    mutationFn: () => archiveContactFn({ data: { contactId: contact.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Contact archived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-6 max-w-2xl">
+      <form
+        onSubmit={(e) => {
+          e.preventDefault()
+          if (!name.trim() && !email.trim()) {
+            toast.error('Name or email is required')
+            return
+          }
+          saveMutation.mutate()
+        }}
+        className="space-y-3"
+      >
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-1">
+            <Label htmlFor="contact-name">Name</Label>
+            <Input
+              id="contact-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              maxLength={200}
+            />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="contact-email">Email</Label>
+            <Input
+              id="contact-email"
+              type="email"
+              value={email}
+              onChange={(e) => setEmail(e.target.value)}
+              maxLength={320}
+            />
+          </div>
+        </div>
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-1">
+            <Label htmlFor="contact-phone">Phone</Label>
+            <Input
+              id="contact-phone"
+              value={phone}
+              onChange={(e) => setPhone(e.target.value)}
+              maxLength={64}
+            />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="contact-title">Title</Label>
+            <Input
+              id="contact-title"
+              value={title}
+              onChange={(e) => setTitle(e.target.value)}
+              maxLength={120}
+            />
+          </div>
+        </div>
+        <div className="space-y-1">
+          <Label>Organization</Label>
+          <OrgPicker value={organizationId} onValueChange={setOrganizationId} allowClear />
+        </div>
+        <div className="space-y-1">
+          <Label htmlFor="contact-external-id">External ID</Label>
+          <Input
+            id="contact-external-id"
+            value={externalId}
+            onChange={(e) => setExternalId(e.target.value)}
+            maxLength={255}
+            className="font-mono text-xs"
+          />
+        </div>
+
+        <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+          <div className="flex justify-end">
+            <Button type="submit" disabled={saveMutation.isPending}>
+              Save changes
+            </Button>
+          </div>
+        </PermissionGate>
+      </form>
+
+      <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+        {contact.archivedAt ? (
+          <div className="rounded-md border border-border/50 p-4 space-y-2">
+            <div className="text-sm font-medium">Archived</div>
+            <p className="text-xs text-muted-foreground">
+              This contact is archived. Restoring is not currently supported.
+            </p>
+          </div>
+        ) : (
+          <div className="rounded-md border border-border/50 p-4 space-y-2">
+            <div className="text-sm font-medium">Archive</div>
+            <p className="text-xs text-muted-foreground">
+              Archived contacts are hidden from pickers; existing tickets keep their reference.
+            </p>
+            <AlertDialog>
+              <AlertDialogTrigger asChild>
+                <Button variant="outline" size="sm">
+                  Archive
+                </Button>
+              </AlertDialogTrigger>
+              <AlertDialogContent>
+                <AlertDialogHeader>
+                  <AlertDialogTitle>Archive contact?</AlertDialogTitle>
+                  <AlertDialogDescription>
+                    This action cannot be undone from the UI.
+                  </AlertDialogDescription>
+                </AlertDialogHeader>
+                <AlertDialogFooter>
+                  <AlertDialogCancel>Cancel</AlertDialogCancel>
+                  <AlertDialogAction onClick={() => archiveMutation.mutate()}>
+                    Archive
+                  </AlertDialogAction>
+                </AlertDialogFooter>
+              </AlertDialogContent>
+            </AlertDialog>
+          </div>
+        )}
+      </PermissionGate>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/contact-tickets-tab.tsx b/apps/web/src/components/admin/contacts/contact-tickets-tab.tsx
new file mode 100644
index 000000000..498269e59
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/contact-tickets-tab.tsx
@@ -0,0 +1,71 @@
+/**
+ * Tickets where this contact is the requester. Uses extended `listTicketsFn`
+ * with `requesterContactId` filter (Phase G0a backend gap).
+ */
+import { Link } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { ContactId, TicketId } from '@quackback/ids'
+import { listTicketsFn } from '@/lib/server/functions/tickets'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+
+export function ContactTicketsTab({ contactId }: { contactId: ContactId }) {
+  const { data } = useSuspenseQuery({
+    queryKey: ['tickets', 'byContact', contactId],
+    queryFn: () =>
+      listTicketsFn({
+        data: { scope: 'all', requesterContactId: contactId, limit: 100 },
+      }),
+    staleTime: 30_000,
+  })
+
+  return (
+    <div className="rounded-md border border-border/50">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Subject</TableHead>
+            <TableHead className="w-28">Priority</TableHead>
+            <TableHead className="w-28">Channel</TableHead>
+            <TableHead className="w-44">Last activity</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {data.rows.length === 0 ? (
+            <TableRow>
+              <TableCell colSpan={4} className="text-center text-sm text-muted-foreground py-6">
+                No tickets for this contact.
+              </TableCell>
+            </TableRow>
+          ) : (
+            data.rows.map((t) => (
+              <TableRow key={t.id} className="hover:bg-muted/50">
+                <TableCell className="font-medium">
+                  <Link to="/admin/tickets/$ticketId" params={{ ticketId: t.id as TicketId }}>
+                    {t.subject}
+                  </Link>
+                </TableCell>
+                <TableCell>
+                  <Badge variant="outline" className="text-[10px]">
+                    {t.priority}
+                  </Badge>
+                </TableCell>
+                <TableCell className="text-xs text-muted-foreground">{t.channel}</TableCell>
+                <TableCell className="text-xs text-muted-foreground">
+                  {t.lastActivityAt ? new Date(t.lastActivityAt).toLocaleString() : '—'}
+                </TableCell>
+              </TableRow>
+            ))
+          )}
+        </TableBody>
+      </Table>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/organization-contacts-tab.tsx b/apps/web/src/components/admin/contacts/organization-contacts-tab.tsx
new file mode 100644
index 000000000..cbe34c998
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/organization-contacts-tab.tsx
@@ -0,0 +1,93 @@
+/**
+ * Contacts belonging to an organization + Add-contact button.
+ */
+import { Link } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { OrganizationId, ContactId } from '@quackback/ids'
+import { contactQueries } from '@/lib/client/queries/contacts'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { PlusIcon } from '@heroicons/react/24/solid'
+import { ContactCreateDialog } from '@/components/admin/contacts/contact-create-dialog'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export function OrganizationContactsTab({ organizationId }: { organizationId: OrganizationId }) {
+  const { data: contacts } = useSuspenseQuery(
+    contactQueries.byOrg(organizationId, { includeArchived: false })
+  )
+
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center justify-end">
+        <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+          <ContactCreateDialog
+            defaultOrganizationId={organizationId}
+            trigger={
+              <Button size="sm">
+                <PlusIcon className="h-4 w-4 mr-1" />
+                Add contact
+              </Button>
+            }
+          />
+        </PermissionGate>
+      </div>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead>Email</TableHead>
+              <TableHead>Phone</TableHead>
+              <TableHead>Title</TableHead>
+              <TableHead className="w-24">Status</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {contacts.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={5} className="text-center text-sm text-muted-foreground py-6">
+                  No contacts in this organization yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              contacts.map((c) => (
+                <TableRow key={c.id} className="hover:bg-muted/50">
+                  <TableCell className="font-medium">
+                    <Link
+                      to="/admin/contacts/people/$contactId"
+                      params={{ contactId: c.id as ContactId }}
+                    >
+                      {c.name ?? c.email ?? c.id}
+                    </Link>
+                  </TableCell>
+                  <TableCell className="text-xs text-muted-foreground">{c.email ?? '—'}</TableCell>
+                  <TableCell className="text-xs text-muted-foreground">{c.phone ?? '—'}</TableCell>
+                  <TableCell className="text-xs text-muted-foreground">{c.title ?? '—'}</TableCell>
+                  <TableCell>
+                    {c.archivedAt ? (
+                      <Badge variant="outline" className="text-muted-foreground">
+                        Archived
+                      </Badge>
+                    ) : (
+                      <Badge variant="outline">Active</Badge>
+                    )}
+                  </TableCell>
+                </TableRow>
+              ))
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/organization-create-dialog.tsx b/apps/web/src/components/admin/contacts/organization-create-dialog.tsx
new file mode 100644
index 000000000..eb841739c
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/organization-create-dialog.tsx
@@ -0,0 +1,159 @@
+/**
+ * Create-organization dialog. Navigates to detail on success.
+ */
+import { useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import type { OrganizationId } from '@quackback/ids'
+import { createOrganizationFn } from '@/lib/server/functions/organizations'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@/components/ui/dialog'
+
+export function OrganizationCreateDialog({ trigger }: { trigger: React.ReactNode }) {
+  const [open, setOpen] = useState(false)
+  const router = useRouter()
+  const qc = useQueryClient()
+
+  const [name, setName] = useState('')
+  const [domain, setDomain] = useState('')
+  const [website, setWebsite] = useState('')
+  const [externalId, setExternalId] = useState('')
+  const [notes, setNotes] = useState('')
+
+  const reset = () => {
+    setName('')
+    setDomain('')
+    setWebsite('')
+    setExternalId('')
+    setNotes('')
+  }
+
+  const mutation = useMutation({
+    mutationFn: () =>
+      createOrganizationFn({
+        data: {
+          name: name.trim(),
+          domain: domain.trim() || null,
+          website: website.trim() || null,
+          externalId: externalId.trim() || null,
+          notes: notes.trim() || null,
+        },
+      }),
+    onSuccess: (org) => {
+      qc.invalidateQueries({ queryKey: ['organizations'] })
+      toast.success('Organization created')
+      setOpen(false)
+      reset()
+      router.navigate({
+        to: '/admin/contacts/organizations/$organizationId',
+        params: { organizationId: org.id as OrganizationId },
+      })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <Dialog open={open} onOpenChange={setOpen}>
+      <DialogTrigger asChild>{trigger}</DialogTrigger>
+      <DialogContent className="max-w-lg">
+        <DialogHeader>
+          <DialogTitle>New organization</DialogTitle>
+          <DialogDescription>
+            Companies, departments, or any account-level grouping.
+          </DialogDescription>
+        </DialogHeader>
+
+        <form
+          onSubmit={(e) => {
+            e.preventDefault()
+            if (!name.trim()) {
+              toast.error('Name is required')
+              return
+            }
+            mutation.mutate()
+          }}
+          className="space-y-3"
+        >
+          <div className="space-y-1">
+            <Label htmlFor="org-name">Name</Label>
+            <Input
+              id="org-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              required
+              maxLength={200}
+            />
+          </div>
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-1">
+              <Label htmlFor="org-domain">Domain</Label>
+              <Input
+                id="org-domain"
+                value={domain}
+                onChange={(e) => setDomain(e.target.value)}
+                maxLength={255}
+                placeholder="acme.com"
+              />
+            </div>
+            <div className="space-y-1">
+              <Label htmlFor="org-website">Website</Label>
+              <Input
+                id="org-website"
+                value={website}
+                onChange={(e) => setWebsite(e.target.value)}
+                maxLength={500}
+                placeholder="https://…"
+              />
+            </div>
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="org-external-id">External ID</Label>
+            <Input
+              id="org-external-id"
+              value={externalId}
+              onChange={(e) => setExternalId(e.target.value)}
+              maxLength={255}
+              className="font-mono text-xs"
+            />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="org-notes">Notes</Label>
+            <Textarea
+              id="org-notes"
+              value={notes}
+              onChange={(e) => setNotes(e.target.value)}
+              rows={3}
+              maxLength={5000}
+            />
+          </div>
+
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="outline"
+              onClick={() => setOpen(false)}
+              disabled={mutation.isPending}
+            >
+              Cancel
+            </Button>
+            <Button type="submit" disabled={mutation.isPending}>
+              Create
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/organization-list.tsx b/apps/web/src/components/admin/contacts/organization-list.tsx
new file mode 100644
index 000000000..6566d8e87
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/organization-list.tsx
@@ -0,0 +1,91 @@
+/**
+ * Table of organizations with name (Link), domain, website, externalId, status.
+ */
+import { useMemo } from 'react'
+import { Link } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { OrganizationId } from '@quackback/ids'
+import { organizationQueries } from '@/lib/client/queries/organizations'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+
+interface Props {
+  search: string
+  showArchived: boolean
+}
+
+export function OrganizationList({ search, showArchived }: Props) {
+  const trimmedSearch = search.trim()
+  const { data: orgs } = useSuspenseQuery(
+    organizationQueries.list({
+      includeArchived: true,
+      ...(trimmedSearch ? { search: trimmedSearch } : {}),
+    })
+  )
+
+  const rows = useMemo(
+    () => (showArchived ? orgs : orgs.filter((o) => o.archivedAt == null)),
+    [orgs, showArchived]
+  )
+
+  return (
+    <div className="rounded-md border border-border/50">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Name</TableHead>
+            <TableHead>Domain</TableHead>
+            <TableHead>Website</TableHead>
+            <TableHead>External ID</TableHead>
+            <TableHead className="w-24">Status</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {rows.length === 0 ? (
+            <TableRow>
+              <TableCell colSpan={5} className="text-center text-sm text-muted-foreground py-6">
+                No organizations.
+              </TableCell>
+            </TableRow>
+          ) : (
+            rows.map((org) => (
+              <TableRow key={org.id} className="cursor-pointer hover:bg-muted/50">
+                <TableCell className="font-medium">
+                  <Link
+                    to="/admin/contacts/organizations/$organizationId"
+                    params={{ organizationId: org.id as OrganizationId }}
+                  >
+                    {org.name}
+                  </Link>
+                </TableCell>
+                <TableCell className="text-xs text-muted-foreground">{org.domain ?? '—'}</TableCell>
+                <TableCell className="text-xs text-muted-foreground truncate max-w-[200px]">
+                  {org.website ?? '—'}
+                </TableCell>
+                <TableCell className="font-mono text-xs text-muted-foreground">
+                  {org.externalId ?? '—'}
+                </TableCell>
+                <TableCell>
+                  {org.archivedAt ? (
+                    <Badge variant="outline" className="text-muted-foreground">
+                      Archived
+                    </Badge>
+                  ) : (
+                    <Badge variant="outline">Active</Badge>
+                  )}
+                </TableCell>
+              </TableRow>
+            ))
+          )}
+        </TableBody>
+      </Table>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/organization-overview-tab.tsx b/apps/web/src/components/admin/contacts/organization-overview-tab.tsx
new file mode 100644
index 000000000..267362dbc
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/organization-overview-tab.tsx
@@ -0,0 +1,205 @@
+/**
+ * Editable overview form for an organization. Bottom Archive/Unarchive section.
+ */
+import { useState, useEffect } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { Organization } from '@/lib/shared/db-types'
+import {
+  updateOrganizationFn,
+  archiveOrganizationFn,
+  unarchiveOrganizationFn,
+} from '@/lib/server/functions/organizations'
+import { organizationQueries } from '@/lib/client/queries/organizations'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export function OrganizationOverviewTab({ organization }: { organization: Organization }) {
+  const qc = useQueryClient()
+  const [name, setName] = useState(organization.name)
+  const [domain, setDomain] = useState(organization.domain ?? '')
+  const [website, setWebsite] = useState(organization.website ?? '')
+  const [externalId, setExternalId] = useState(organization.externalId ?? '')
+  const [notes, setNotes] = useState(organization.notes ?? '')
+
+  useEffect(() => {
+    setName(organization.name)
+    setDomain(organization.domain ?? '')
+    setWebsite(organization.website ?? '')
+    setExternalId(organization.externalId ?? '')
+    setNotes(organization.notes ?? '')
+  }, [organization])
+
+  const invalidate = () => {
+    qc.invalidateQueries({ queryKey: organizationQueries.detail(organization.id).queryKey })
+    qc.invalidateQueries({ queryKey: ['organizations'] })
+  }
+
+  const saveMutation = useMutation({
+    mutationFn: () =>
+      updateOrganizationFn({
+        data: {
+          organizationId: organization.id,
+          name: name.trim(),
+          domain: domain.trim() || null,
+          website: website.trim() || null,
+          externalId: externalId.trim() || null,
+          notes: notes.trim() || null,
+        },
+      }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Organization updated')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const archiveMutation = useMutation({
+    mutationFn: () => archiveOrganizationFn({ data: { organizationId: organization.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Organization archived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const unarchiveMutation = useMutation({
+    mutationFn: () => unarchiveOrganizationFn({ data: { organizationId: organization.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Organization unarchived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-6 max-w-2xl">
+      <form
+        onSubmit={(e) => {
+          e.preventDefault()
+          if (!name.trim()) {
+            toast.error('Name is required')
+            return
+          }
+          saveMutation.mutate()
+        }}
+        className="space-y-3"
+      >
+        <div className="space-y-1">
+          <Label htmlFor="org-name">Name</Label>
+          <Input
+            id="org-name"
+            value={name}
+            onChange={(e) => setName(e.target.value)}
+            required
+            maxLength={200}
+          />
+        </div>
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-1">
+            <Label htmlFor="org-domain">Domain</Label>
+            <Input
+              id="org-domain"
+              value={domain}
+              onChange={(e) => setDomain(e.target.value)}
+              maxLength={255}
+            />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="org-website">Website</Label>
+            <Input
+              id="org-website"
+              value={website}
+              onChange={(e) => setWebsite(e.target.value)}
+              maxLength={500}
+            />
+          </div>
+        </div>
+        <div className="space-y-1">
+          <Label htmlFor="org-external-id">External ID</Label>
+          <Input
+            id="org-external-id"
+            value={externalId}
+            onChange={(e) => setExternalId(e.target.value)}
+            maxLength={255}
+            className="font-mono text-xs"
+          />
+        </div>
+        <div className="space-y-1">
+          <Label htmlFor="org-notes">Notes</Label>
+          <Textarea
+            id="org-notes"
+            value={notes}
+            onChange={(e) => setNotes(e.target.value)}
+            rows={4}
+            maxLength={5000}
+          />
+        </div>
+
+        <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+          <div className="flex justify-end">
+            <Button type="submit" disabled={saveMutation.isPending}>
+              Save changes
+            </Button>
+          </div>
+        </PermissionGate>
+      </form>
+
+      <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+        <div className="rounded-md border border-border/50 p-4 space-y-2">
+          <div className="text-sm font-medium">Archive</div>
+          <p className="text-xs text-muted-foreground">
+            Archived organizations are hidden from pickers; existing tickets keep their reference.
+          </p>
+          {organization.archivedAt ? (
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => unarchiveMutation.mutate()}
+              disabled={unarchiveMutation.isPending}
+            >
+              Unarchive
+            </Button>
+          ) : (
+            <AlertDialog>
+              <AlertDialogTrigger asChild>
+                <Button variant="outline" size="sm">
+                  Archive
+                </Button>
+              </AlertDialogTrigger>
+              <AlertDialogContent>
+                <AlertDialogHeader>
+                  <AlertDialogTitle>Archive {organization.name}?</AlertDialogTitle>
+                  <AlertDialogDescription>
+                    The organization will be hidden from pickers. You can unarchive it later.
+                  </AlertDialogDescription>
+                </AlertDialogHeader>
+                <AlertDialogFooter>
+                  <AlertDialogCancel>Cancel</AlertDialogCancel>
+                  <AlertDialogAction onClick={() => archiveMutation.mutate()}>
+                    Archive
+                  </AlertDialogAction>
+                </AlertDialogFooter>
+              </AlertDialogContent>
+            </AlertDialog>
+          )}
+        </div>
+      </PermissionGate>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/contacts/organization-tickets-tab.tsx b/apps/web/src/components/admin/contacts/organization-tickets-tab.tsx
new file mode 100644
index 000000000..2bcf06ba9
--- /dev/null
+++ b/apps/web/src/components/admin/contacts/organization-tickets-tab.tsx
@@ -0,0 +1,71 @@
+/**
+ * Tickets filed by/under an organization. Uses extended `listTicketsFn`
+ * with `organizationId` filter (Phase G0a backend gap).
+ */
+import { Link } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { OrganizationId, TicketId } from '@quackback/ids'
+import { listTicketsFn } from '@/lib/server/functions/tickets'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+
+export function OrganizationTicketsTab({ organizationId }: { organizationId: OrganizationId }) {
+  const { data } = useSuspenseQuery({
+    queryKey: ['tickets', 'byOrg', organizationId],
+    queryFn: () =>
+      listTicketsFn({
+        data: { scope: 'all', organizationId, limit: 100 },
+      }),
+    staleTime: 30_000,
+  })
+
+  return (
+    <div className="rounded-md border border-border/50">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Subject</TableHead>
+            <TableHead className="w-28">Priority</TableHead>
+            <TableHead className="w-28">Channel</TableHead>
+            <TableHead className="w-44">Last activity</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {data.rows.length === 0 ? (
+            <TableRow>
+              <TableCell colSpan={4} className="text-center text-sm text-muted-foreground py-6">
+                No tickets for this organization.
+              </TableCell>
+            </TableRow>
+          ) : (
+            data.rows.map((t) => (
+              <TableRow key={t.id} className="hover:bg-muted/50">
+                <TableCell className="font-medium">
+                  <Link to="/admin/tickets/$ticketId" params={{ ticketId: t.id as TicketId }}>
+                    {t.subject}
+                  </Link>
+                </TableCell>
+                <TableCell>
+                  <Badge variant="outline" className="text-[10px]">
+                    {t.priority}
+                  </Badge>
+                </TableCell>
+                <TableCell className="text-xs text-muted-foreground">{t.channel}</TableCell>
+                <TableCell className="text-xs text-muted-foreground">
+                  {t.lastActivityAt ? new Date(t.lastActivityAt).toLocaleString() : '—'}
+                </TableCell>
+              </TableRow>
+            ))
+          )}
+        </TableBody>
+      </Table>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/customers/__tests__/customer-people-table.test.tsx b/apps/web/src/components/admin/customers/__tests__/customer-people-table.test.tsx
new file mode 100644
index 000000000..96ea95e7a
--- /dev/null
+++ b/apps/web/src/components/admin/customers/__tests__/customer-people-table.test.tsx
@@ -0,0 +1,267 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import { CustomerPeopleTable } from '../customer-people-table'
+
+type PermissionData = {
+  workspacePermissions: string[]
+  teamPermissions: Array<{ permissions: string[] }>
+}
+
+type PersonRow = {
+  id: string
+  name: string | null
+  email: string | null
+  avatarUrl: string | null
+  contactId: string | null
+  principalIds: string[]
+  organizationName: string | null
+  title: string | null
+  hasPortalUser: boolean
+  emailVerified: boolean
+  segments: Array<{ id: string; name: string }>
+  postCount: number
+  commentCount: number
+  voteCount: number
+  ticketCount: number
+  archivedAt: string | null
+  kind: 'linked' | 'contact' | 'user'
+}
+
+const mocks = vi.hoisted(() => ({
+  customerPeopleArgs: [] as Array<Record<string, unknown>>,
+  permissionData: null as PermissionData | null,
+  items: [] as PersonRow[],
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: () => ({
+    data: { items: mocks.items },
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    to,
+    params,
+    search,
+  }: {
+    children: ReactNode
+    to: string
+    params?: Record<string, string>
+    search?: Record<string, string>
+    className?: string
+  }) => {
+    let href = to
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        href = href.replace(`$${key}`, value)
+      }
+    }
+    const query = search ? `?${new URLSearchParams(search).toString()}` : ''
+    return <a href={`${href}${query}`}>{children}</a>
+  },
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    className?: string
+  }) => <td colSpan={colSpan}>{children}</td>,
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode; className?: string }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/avatar', () => ({
+  Avatar: ({ src, name }: { src?: string | null; name?: string | null; className?: string }) => (
+    <span>{src ? `avatar:${src}` : `avatar:${name ?? 'empty'}`}</span>
+  ),
+}))
+
+vi.mock('@/lib/client/queries/admin', () => ({
+  adminQueries: {
+    customerPeople: (args: Record<string, unknown>) => {
+      mocks.customerPeopleArgs.push(args)
+      return { queryKey: ['admin', 'customer-people', args] }
+    },
+  },
+}))
+
+vi.mock('@/lib/client/hooks/use-authz-queries', () => ({
+  useMyPermissions: () => ({
+    data: mocks.permissionData,
+  }),
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ORG_VIEW: 'org.view',
+    TICKET_VIEW_ALL: 'ticket.view_all',
+  },
+}))
+
+function person(overrides: Partial<PersonRow>): PersonRow {
+  return {
+    id: 'person_1',
+    name: 'Ada Lovelace',
+    email: 'ada@example.com',
+    avatarUrl: null,
+    contactId: 'contact_1',
+    principalIds: ['principal_1'],
+    organizationName: 'Acme',
+    title: 'Engineer',
+    hasPortalUser: true,
+    emailVerified: true,
+    segments: [],
+    postCount: 0,
+    commentCount: 0,
+    voteCount: 0,
+    ticketCount: 0,
+    archivedAt: null,
+    kind: 'linked',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.customerPeopleArgs = []
+  mocks.permissionData = {
+    workspacePermissions: ['org.view'],
+    teamPermissions: [{ permissions: ['ticket.view_all'] }],
+  }
+  mocks.items = [
+    person({
+      id: 'person_contact',
+      name: 'Ada Lovelace',
+      contactId: 'contact_ada',
+      segments: [
+        { id: 'seg_1', name: 'VIP' },
+        { id: 'seg_2', name: 'Beta' },
+        { id: 'seg_3', name: 'Enterprise' },
+        { id: 'seg_4', name: 'EU' },
+      ],
+      postCount: 1_200,
+      commentCount: 5,
+      voteCount: 0,
+      ticketCount: 1_500,
+      kind: 'linked',
+    }),
+    person({
+      id: 'person_user',
+      name: null,
+      email: null,
+      avatarUrl: 'https://example.com/avatar.png',
+      contactId: null,
+      principalIds: ['principal_user'],
+      organizationName: null,
+      title: null,
+      hasPortalUser: false,
+      emailVerified: false,
+      segments: [],
+      postCount: 0,
+      commentCount: 2,
+      voteCount: 3,
+      ticketCount: 0,
+      archivedAt: '2026-06-01T00:00:00.000Z',
+      kind: 'user',
+    }),
+    person({
+      id: 'person_unverified',
+      name: 'Unverified User',
+      email: 'unverified@example.com',
+      contactId: 'contact_unverified',
+      hasPortalUser: true,
+      emailVerified: false,
+      organizationName: null,
+      title: null,
+      archivedAt: null,
+      kind: 'contact',
+    }),
+  ]
+})
+
+describe('CustomerPeopleTable', () => {
+  it('passes trimmed search and archived filters into the admin query', () => {
+    render(<CustomerPeopleTable search="  ada  " showArchived />)
+
+    expect(mocks.customerPeopleArgs[0]).toEqual({
+      includeArchived: true,
+      limit: 100,
+      search: 'ada',
+    })
+  })
+
+  it('renders CRM and ticket columns when permissions are present', () => {
+    render(<CustomerPeopleTable search="" showArchived={false} />)
+
+    expect(screen.getByText('Organization')).toBeInTheDocument()
+    expect(screen.getByText('Tickets')).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: 'Ada Lovelace' })).toHaveAttribute(
+      'href',
+      '/admin/contacts/people/contact_ada'
+    )
+    expect(screen.getByRole('link', { name: 'person_user' })).toHaveAttribute(
+      'href',
+      '/admin/users?selected=principal_user'
+    )
+    expect(screen.getByText('avatar:https://example.com/avatar.png')).toBeInTheDocument()
+    expect(screen.getByText('No email')).toBeInTheDocument()
+    expect(screen.getByText('Acme')).toBeInTheDocument()
+    expect(screen.getByText('Engineer')).toBeInTheDocument()
+    expect(screen.getAllByText('Portal user')).toHaveLength(2)
+    expect(screen.getByText('Verified')).toBeInTheDocument()
+    expect(screen.getByText('Unverified')).toBeInTheDocument()
+    expect(screen.getByText('Contact only')).toBeInTheDocument()
+    expect(screen.getByText('VIP')).toBeInTheDocument()
+    expect(screen.getByText('+1')).toBeInTheDocument()
+    expect(screen.getByText('1.2k')).toBeInTheDocument()
+    expect(screen.getByText('1.5k')).toBeInTheDocument()
+    expect(screen.getByText('Linked')).toBeInTheDocument()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+  })
+
+  it('hides CRM and ticket columns when permissions are missing', () => {
+    mocks.permissionData = {
+      workspacePermissions: [],
+      teamPermissions: [],
+    }
+
+    render(<CustomerPeopleTable search="   " showArchived={false} />)
+
+    expect(mocks.customerPeopleArgs[0]).toEqual({
+      includeArchived: false,
+      limit: 100,
+    })
+    expect(screen.queryByText('Organization')).not.toBeInTheDocument()
+    expect(screen.queryByText('Tickets')).not.toBeInTheDocument()
+    expect(screen.queryByText('Acme')).not.toBeInTheDocument()
+    expect(screen.queryByText('1.5k')).not.toBeInTheDocument()
+  })
+
+  it('renders the empty state with the correct column count when permissions are unknown', () => {
+    mocks.permissionData = null
+    mocks.items = []
+
+    render(<CustomerPeopleTable search="" showArchived={false} />)
+
+    expect(screen.getByText('No people.')).toBeInTheDocument()
+    expect(screen.getByText('No people.').closest('td')).toHaveAttribute('colspan', '5')
+  })
+})
diff --git a/apps/web/src/components/admin/customers/customer-people-table.tsx b/apps/web/src/components/admin/customers/customer-people-table.tsx
new file mode 100644
index 000000000..823601f7b
--- /dev/null
+++ b/apps/web/src/components/admin/customers/customer-people-table.tsx
@@ -0,0 +1,179 @@
+import { Link } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { ContactId, PrincipalId } from '@quackback/ids'
+import { adminQueries } from '@/lib/client/queries/admin'
+import { useMyPermissions } from '@/lib/client/hooks/use-authz-queries'
+import { PERMISSIONS, type PermissionKey } from '@/lib/server/domains/authz'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+import { Avatar } from '@/components/ui/avatar'
+
+interface Props {
+  search: string
+  showArchived: boolean
+}
+
+function formatCount(value: number): string {
+  return value > 999 ? `${Math.round(value / 100) / 10}k` : String(value)
+}
+
+function permissionSetHas(
+  permissionData: ReturnType<typeof useMyPermissions>['data'],
+  permission: PermissionKey
+): boolean {
+  if (!permissionData) return false
+  return (
+    permissionData.workspacePermissions.includes(permission) ||
+    permissionData.teamPermissions.some((team) => team.permissions.includes(permission))
+  )
+}
+
+export function CustomerPeopleTable({ search, showArchived }: Props) {
+  const trimmedSearch = search.trim()
+  const { data: myPerms } = useMyPermissions()
+  const showCrmColumns = permissionSetHas(myPerms, PERMISSIONS.ORG_VIEW)
+  const showTicketColumn = permissionSetHas(myPerms, PERMISSIONS.TICKET_VIEW_ALL)
+  const columnCount = 5 + (showCrmColumns ? 1 : 0) + (showTicketColumn ? 1 : 0)
+  const { data } = useSuspenseQuery(
+    adminQueries.customerPeople({
+      includeArchived: showArchived,
+      limit: 100,
+      ...(trimmedSearch ? { search: trimmedSearch } : {}),
+    })
+  )
+
+  return (
+    <div className="rounded-md border border-border/50">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Person</TableHead>
+            {showCrmColumns ? <TableHead>Organization</TableHead> : null}
+            <TableHead>Portal</TableHead>
+            <TableHead>Segments</TableHead>
+            <TableHead className="text-right">Activity</TableHead>
+            {showTicketColumn ? <TableHead className="text-right">Tickets</TableHead> : null}
+            <TableHead className="w-24">Status</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {data.items.length === 0 ? (
+            <TableRow>
+              <TableCell
+                colSpan={columnCount}
+                className="py-6 text-center text-sm text-muted-foreground"
+              >
+                No people.
+              </TableCell>
+            </TableRow>
+          ) : (
+            data.items.map((person) => {
+              const label = person.name ?? person.email ?? person.id
+              const personLink = person.contactId ? (
+                <Link
+                  to="/admin/contacts/people/$contactId"
+                  params={{ contactId: person.contactId as ContactId }}
+                  className="block truncate text-sm font-medium"
+                >
+                  {label}
+                </Link>
+              ) : (
+                <Link
+                  to="/admin/users"
+                  search={{ selected: person.principalIds[0] as PrincipalId }}
+                  className="block truncate text-sm font-medium"
+                >
+                  {label}
+                </Link>
+              )
+
+              return (
+                <TableRow key={person.id} className="hover:bg-muted/50">
+                  <TableCell>
+                    <div className="flex min-w-0 items-center gap-2">
+                      <Avatar src={person.avatarUrl} name={label} className="h-7 w-7 text-[10px]" />
+                      <div className="min-w-0">
+                        {personLink}
+                        <div className="truncate text-xs text-muted-foreground">
+                          {person.email ?? 'No email'}
+                        </div>
+                      </div>
+                    </div>
+                  </TableCell>
+                  {showCrmColumns ? (
+                    <TableCell className="text-xs text-muted-foreground">
+                      {person.organizationName ?? '—'}
+                      {person.title ? (
+                        <span className="block truncate text-[11px]">{person.title}</span>
+                      ) : null}
+                    </TableCell>
+                  ) : null}
+                  <TableCell>
+                    {person.hasPortalUser ? (
+                      <div className="flex flex-wrap gap-1">
+                        <Badge variant="outline">Portal user</Badge>
+                        {person.emailVerified ? (
+                          <Badge variant="outline">Verified</Badge>
+                        ) : (
+                          <Badge variant="outline" className="text-muted-foreground">
+                            Unverified
+                          </Badge>
+                        )}
+                      </div>
+                    ) : (
+                      <Badge variant="outline" className="text-muted-foreground">
+                        Contact only
+                      </Badge>
+                    )}
+                  </TableCell>
+                  <TableCell>
+                    <div className="flex max-w-[220px] flex-wrap gap-1">
+                      {person.segments.length === 0 ? (
+                        <span className="text-xs text-muted-foreground">—</span>
+                      ) : (
+                        person.segments.slice(0, 3).map((segment) => (
+                          <Badge key={segment.id} variant="secondary" className="font-normal">
+                            {segment.name}
+                          </Badge>
+                        ))
+                      )}
+                      {person.segments.length > 3 ? (
+                        <Badge variant="outline">+{person.segments.length - 3}</Badge>
+                      ) : null}
+                    </div>
+                  </TableCell>
+                  <TableCell className="text-right text-xs text-muted-foreground">
+                    {formatCount(person.postCount + person.commentCount + person.voteCount)}
+                  </TableCell>
+                  {showTicketColumn ? (
+                    <TableCell className="text-right text-xs text-muted-foreground">
+                      {formatCount(person.ticketCount)}
+                    </TableCell>
+                  ) : null}
+                  <TableCell>
+                    {person.archivedAt ? (
+                      <Badge variant="outline" className="text-muted-foreground">
+                        Archived
+                      </Badge>
+                    ) : person.kind === 'linked' ? (
+                      <Badge variant="outline">Linked</Badge>
+                    ) : (
+                      <Badge variant="outline">Active</Badge>
+                    )}
+                  </TableCell>
+                </TableRow>
+              )
+            })
+          )}
+        </TableBody>
+      </Table>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/notifications/__tests__/my-ticket-subscriptions-panel.test.tsx b/apps/web/src/components/admin/notifications/__tests__/my-ticket-subscriptions-panel.test.tsx
new file mode 100644
index 000000000..2327cee92
--- /dev/null
+++ b/apps/web/src/components/admin/notifications/__tests__/my-ticket-subscriptions-panel.test.tsx
@@ -0,0 +1,291 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { MyTicketSubscriptionsPanel } from '../my-ticket-subscriptions-panel'
+
+type Subscription = {
+  id: string
+  ticketId: string
+  mutedUntil: string | null
+  source: string
+  ticket: {
+    subject: string | null
+    priority: string
+    updatedAt: string
+  }
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  fetchNextPage: vi.fn(),
+  unsubscribeFromTicketFn: vi.fn(),
+  listMyTicketSubscriptionsFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  isLoading: false,
+  hasNextPage: false,
+  isFetchingNextPage: false,
+  pages: [] as Array<{ subscriptions: Subscription[]; nextCursor: unknown }>,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useInfiniteQuery: (options: { queryFn: (args: { pageParam: unknown }) => unknown }) => {
+    options.queryFn({ pageParam: null })
+    return {
+      data: { pages: mocks.pages },
+      isLoading: mocks.isLoading,
+      hasNextPage: mocks.hasNextPage,
+      isFetchingNextPage: mocks.isFetchingNextPage,
+      fetchNextPage: mocks.fetchNextPage,
+    }
+  },
+  useMutation: (options: { mutationFn: (ticketId: string) => Promise<unknown> }) => ({
+    mutateAsync: (ticketId: string) => options.mutationFn(ticketId),
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    to,
+    params,
+  }: {
+    children: ReactNode
+    to: string
+    params: { ticketId: string }
+    className?: string
+  }) => <a href={to.replace('$ticketId', params.ticketId)}>{children}</a>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    size?: string
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/checkbox', () => ({
+  Checkbox: ({
+    checked,
+    onCheckedChange,
+    'aria-label': ariaLabel,
+  }: {
+    checked: boolean | 'indeterminate'
+    onCheckedChange: (checked: boolean) => void
+    'aria-label'?: string
+  }) => (
+    <input
+      type="checkbox"
+      aria-label={ariaLabel}
+      data-state={checked === 'indeterminate' ? 'indeterminate' : String(checked)}
+      checked={checked === true}
+      onChange={() => onCheckedChange(checked !== true)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/shared/empty-state', () => ({
+  EmptyState: ({
+    title,
+    description,
+  }: {
+    icon: unknown
+    title: string
+    description: string
+    className?: string
+  }) => (
+    <div>
+      <h2>{title}</h2>
+      <p>{description}</p>
+    </div>
+  ),
+}))
+
+vi.mock('@/components/shared/spinner', () => ({
+  Spinner: ({ size }: { size?: string }) => <div>Spinner:{size}</div>,
+}))
+
+vi.mock('@/components/ui/time-ago', () => ({
+  TimeAgo: ({ date }: { date: string }) => <time>{date}</time>,
+}))
+
+vi.mock('@/components/admin/tickets/ticket-priority-chip', () => ({
+  TicketPriorityChip: ({ priority }: { priority: string }) => <span>priority:{priority}</span>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  BellIcon: () => <span aria-hidden="true">bell</span>,
+  BellSlashIcon: () => <span aria-hidden="true">bell-slash</span>,
+}))
+
+vi.mock('@/lib/server/functions/notifications', () => ({
+  listMyTicketSubscriptionsFn: mocks.listMyTicketSubscriptionsFn,
+  unsubscribeFromTicketFn: mocks.unsubscribeFromTicketFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function subscription(overrides: Partial<Subscription>): Subscription {
+  return {
+    id: 'subscription_1',
+    ticketId: 'ticket_1',
+    mutedUntil: null,
+    source: 'manual',
+    ticket: {
+      subject: 'Printer is down',
+      priority: 'normal',
+      updatedAt: '2026-06-18T12:00:00.000Z',
+    },
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.isLoading = false
+  mocks.hasNextPage = false
+  mocks.isFetchingNextPage = false
+  mocks.pages = [
+    {
+      subscriptions: [
+        subscription({ id: 'sub_1', ticketId: 'ticket_1', source: 'manual' }),
+        subscription({
+          id: 'sub_2',
+          ticketId: 'ticket_fail',
+          source: 'auto_team_member',
+          mutedUntil: '2099-01-01T00:00:00.000Z',
+          ticket: {
+            subject: null,
+            priority: 'urgent',
+            updatedAt: '2026-06-18T13:00:00.000Z',
+          },
+        }),
+        subscription({
+          id: 'sub_3',
+          ticketId: 'ticket_custom',
+          source: 'custom_source',
+          ticket: {
+            subject: 'Custom source ticket',
+            priority: 'low',
+            updatedAt: '2026-06-18T14:00:00.000Z',
+          },
+        }),
+      ],
+      nextCursor: null,
+    },
+  ]
+  mocks.listMyTicketSubscriptionsFn.mockResolvedValue({ subscriptions: [], nextCursor: null })
+  mocks.unsubscribeFromTicketFn.mockResolvedValue(undefined)
+})
+
+describe('MyTicketSubscriptionsPanel', () => {
+  it('renders loading and empty states', () => {
+    mocks.isLoading = true
+    render(<MyTicketSubscriptionsPanel />)
+
+    expect(screen.getByText('Spinner:xl')).toBeInTheDocument()
+
+    mocks.isLoading = false
+    mocks.pages = [{ subscriptions: [], nextCursor: null }]
+    const { rerender } = render(<MyTicketSubscriptionsPanel />)
+    rerender(<MyTicketSubscriptionsPanel />)
+
+    expect(screen.getByText('No ticket subscriptions yet')).toBeInTheDocument()
+    expect(
+      screen.getByText('Subscribe to a ticket from its detail page to get notified about updates.')
+    ).toBeInTheDocument()
+  })
+
+  it('renders subscription labels, muted state and pagination controls', () => {
+    mocks.hasNextPage = true
+    render(<MyTicketSubscriptionsPanel />)
+
+    expect(mocks.listMyTicketSubscriptionsFn).toHaveBeenCalledWith({
+      data: { limit: 50, cursor: undefined },
+    })
+    expect(screen.getByText('3 subscriptions')).toBeInTheDocument()
+    expect(screen.getByText('Printer is down')).toBeInTheDocument()
+    expect(screen.getByText('(no subject)')).toBeInTheDocument()
+    expect(screen.getByText('Manual')).toBeInTheDocument()
+    expect(screen.getByText('Auto · team')).toBeInTheDocument()
+    expect(screen.getByText('custom_source')).toBeInTheDocument()
+    expect(screen.getByText('priority:urgent')).toBeInTheDocument()
+    expect(screen.getByText('muted until')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Load more' }))
+    expect(mocks.fetchNextPage).toHaveBeenCalledTimes(1)
+
+    mocks.isFetchingNextPage = true
+    const { rerender } = render(<MyTicketSubscriptionsPanel />)
+    rerender(<MyTicketSubscriptionsPanel />)
+    expect(screen.getByRole('button', { name: 'Loading…' })).toBeDisabled()
+  })
+
+  it('selects individual and all subscriptions and bulk unsubscribes successfully', async () => {
+    render(<MyTicketSubscriptionsPanel />)
+
+    expect(screen.getByRole('button', { name: 'Unsubscribe selected' })).toBeDisabled()
+    fireEvent.click(screen.getByLabelText('Select ticket Printer is down'))
+    expect(screen.getByText('1 selected')).toBeInTheDocument()
+    expect(screen.getByLabelText('Select all')).toHaveAttribute('data-state', 'indeterminate')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Unsubscribe selected' }))
+    await waitFor(() => {
+      expect(mocks.unsubscribeFromTicketFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket_1' },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'my-subscriptions'],
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Unsubscribed from 1 ticket')
+
+    fireEvent.click(screen.getByLabelText('Select all'))
+    expect(screen.getByText('3 selected')).toBeInTheDocument()
+    fireEvent.click(screen.getByLabelText('Select all'))
+    expect(screen.getByText('3 subscriptions')).toBeInTheDocument()
+  })
+
+  it('reports partial bulk unsubscribe failures', async () => {
+    mocks.unsubscribeFromTicketFn.mockImplementation(({ data }: { data: { ticketId: string } }) =>
+      data.ticketId === 'ticket_fail' ? Promise.reject(new Error('Denied')) : Promise.resolve()
+    )
+
+    render(<MyTicketSubscriptionsPanel />)
+
+    fireEvent.click(screen.getByLabelText('Select all'))
+    fireEvent.click(screen.getByRole('button', { name: 'Unsubscribe selected' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Unsubscribed from 2; 1 failed')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/notifications/my-ticket-subscriptions-panel.tsx b/apps/web/src/components/admin/notifications/my-ticket-subscriptions-panel.tsx
new file mode 100644
index 000000000..95cfbcd30
--- /dev/null
+++ b/apps/web/src/components/admin/notifications/my-ticket-subscriptions-panel.tsx
@@ -0,0 +1,189 @@
+/**
+ * Lists all tickets the current principal is subscribed to. Allows
+ * bulk unsubscribe via sequential mutations (page-size N is small).
+ */
+import { useState } from 'react'
+import { Link } from '@tanstack/react-router'
+import { useInfiniteQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import { BellIcon, BellSlashIcon } from '@heroicons/react/24/outline'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/button'
+import { Checkbox } from '@/components/ui/checkbox'
+import { Badge } from '@/components/ui/badge'
+import { EmptyState } from '@/components/shared/empty-state'
+import { Spinner } from '@/components/shared/spinner'
+import { TimeAgo } from '@/components/ui/time-ago'
+import {
+  TicketPriorityChip,
+  type TicketPriority,
+} from '@/components/admin/tickets/ticket-priority-chip'
+import {
+  listMyTicketSubscriptionsFn,
+  unsubscribeFromTicketFn,
+} from '@/lib/server/functions/notifications'
+
+const SOURCE_LABEL: Record<string, string> = {
+  manual: 'Manual',
+  auto_assigned: 'Auto · assignee',
+  auto_participant: 'Auto · participant',
+  auto_team_member: 'Auto · team',
+}
+
+export function MyTicketSubscriptionsPanel() {
+  const qc = useQueryClient()
+  const [selected, setSelected] = useState<Set<string>>(new Set())
+  const [unsubscribing, setUnsubscribing] = useState(false)
+
+  const query = useInfiniteQuery({
+    queryKey: ['tickets', 'my-subscriptions'] as const,
+    initialPageParam: null as { createdAt: string; id: string } | null,
+    queryFn: ({ pageParam }) =>
+      listMyTicketSubscriptionsFn({
+        data: { limit: 50, cursor: pageParam ?? undefined },
+      }),
+    getNextPageParam: (last) => last.nextCursor,
+  })
+
+  const unsubscribeOne = useMutation({
+    mutationFn: (ticketId: string) => unsubscribeFromTicketFn({ data: { ticketId } }),
+  })
+
+  const subscriptions = query.data?.pages.flatMap((p) => p.subscriptions) ?? []
+
+  function toggle(ticketId: string, on: boolean) {
+    setSelected((prev) => {
+      const next = new Set(prev)
+      if (on) next.add(ticketId)
+      else next.delete(ticketId)
+      return next
+    })
+  }
+
+  function toggleAll(on: boolean) {
+    setSelected(on ? new Set(subscriptions.map((s) => s.ticketId)) : new Set())
+  }
+
+  async function bulkUnsubscribe() {
+    if (selected.size === 0) return
+    setUnsubscribing(true)
+    let ok = 0
+    let failed = 0
+    for (const ticketId of selected) {
+      try {
+        await unsubscribeOne.mutateAsync(ticketId)
+        ok += 1
+      } catch {
+        failed += 1
+      }
+    }
+    setSelected(new Set())
+    setUnsubscribing(false)
+    qc.invalidateQueries({ queryKey: ['tickets', 'my-subscriptions'] })
+    if (failed === 0) {
+      toast.success(`Unsubscribed from ${ok} ticket${ok === 1 ? '' : 's'}`)
+    } else {
+      toast.error(`Unsubscribed from ${ok}; ${failed} failed`)
+    }
+  }
+
+  if (query.isLoading) {
+    return (
+      <div className="flex items-center justify-center py-24">
+        <Spinner size="xl" />
+      </div>
+    )
+  }
+
+  if (subscriptions.length === 0) {
+    return (
+      <EmptyState
+        icon={BellIcon}
+        title="No ticket subscriptions yet"
+        description="Subscribe to a ticket from its detail page to get notified about updates."
+        className="py-24"
+      />
+    )
+  }
+
+  const allSelected = selected.size === subscriptions.length
+  const someSelected = selected.size > 0 && !allSelected
+
+  return (
+    <div className="flex flex-col">
+      <div className="flex items-center gap-3 px-6 py-3 border-b border-border/50">
+        <Checkbox
+          checked={allSelected ? true : someSelected ? 'indeterminate' : false}
+          onCheckedChange={(v) => toggleAll(v === true)}
+          aria-label="Select all"
+        />
+        <span className="text-sm text-muted-foreground">
+          {selected.size > 0
+            ? `${selected.size} selected`
+            : `${subscriptions.length} subscription${subscriptions.length === 1 ? '' : 's'}`}
+        </span>
+        <div className="ml-auto">
+          <Button
+            size="sm"
+            variant="outline"
+            onClick={bulkUnsubscribe}
+            disabled={selected.size === 0 || unsubscribing}
+          >
+            <BellSlashIcon className="h-4 w-4 mr-1" />
+            Unsubscribe selected
+          </Button>
+        </div>
+      </div>
+      <ul className="divide-y divide-border/50">
+        {subscriptions.map((s) => {
+          const isMuted = s.mutedUntil && new Date(s.mutedUntil).getTime() > Date.now()
+          return (
+            <li key={s.id} className="flex items-center gap-3 px-6 py-3">
+              <Checkbox
+                checked={selected.has(s.ticketId)}
+                onCheckedChange={(v) => toggle(s.ticketId, v === true)}
+                aria-label={`Select ticket ${s.ticket.subject ?? s.ticketId}`}
+              />
+              <div className="flex-1 min-w-0">
+                <Link
+                  to="/admin/tickets/$ticketId"
+                  params={{ ticketId: s.ticketId }}
+                  className="text-sm font-medium hover:underline truncate block"
+                >
+                  {s.ticket.subject ?? '(no subject)'}
+                </Link>
+                <div className="flex items-center gap-2 text-xs text-muted-foreground mt-0.5">
+                  <TicketPriorityChip priority={s.ticket.priority as TicketPriority} />
+                  <Badge variant="secondary" className="text-[10px]">
+                    {SOURCE_LABEL[s.source] ?? s.source}
+                  </Badge>
+                  {isMuted && (
+                    <span className="inline-flex items-center gap-1 text-amber-600">
+                      <BellSlashIcon className="h-3 w-3" />
+                      muted until <TimeAgo date={s.mutedUntil!} />
+                    </span>
+                  )}
+                  <span>·</span>
+                  <span>
+                    updated <TimeAgo date={s.ticket.updatedAt} />
+                  </span>
+                </div>
+              </div>
+            </li>
+          )
+        })}
+      </ul>
+      {query.hasNextPage && (
+        <div className="flex justify-center py-4">
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => query.fetchNextPage()}
+            disabled={query.isFetchingNextPage}
+          >
+            {query.isFetchingNextPage ? 'Loading…' : 'Load more'}
+          </Button>
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/__tests__/membership-tabs.test.tsx b/apps/web/src/components/admin/settings/__tests__/membership-tabs.test.tsx
new file mode 100644
index 000000000..86febb24d
--- /dev/null
+++ b/apps/web/src/components/admin/settings/__tests__/membership-tabs.test.tsx
@@ -0,0 +1,449 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { InboxMembersTab } from '../inboxes/inbox-members-tab'
+import { TeamMembersTab } from '../teams/team-members-tab'
+
+type QueryOptions<T> = {
+  queryKey: readonly unknown[]
+  queryFn: () => T
+  enabled?: boolean
+  staleTime?: number
+}
+
+type MutationOptions<TVars, TResult> = {
+  mutationFn: (vars: TVars) => Promise<TResult>
+  onSuccess?: (result: TResult) => void
+  onError?: (error: Error) => void
+}
+
+type InboxMembership = {
+  id: string
+  principalId: string
+  role: 'owner' | 'agent' | 'viewer'
+}
+
+type TeamMembership = {
+  id: string
+  principalId: string
+  role: 'lead' | 'member'
+}
+
+type Principal = {
+  id: string
+  displayName: string | null
+  avatarUrl: string | null
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  addInboxMembershipFn: vi.fn(),
+  updateInboxMembershipRoleFn: vi.fn(),
+  removeInboxMembershipFn: vi.fn(),
+  addTeamMemberFn: vi.fn(),
+  removeTeamMemberFn: vi.fn(),
+  getPrincipalsByIdsFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  permissionAllowed: true,
+  inboxMemberships: [] as InboxMembership[],
+  teamMemberships: [] as TeamMembership[],
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: (options: { queryKey: readonly unknown[] }) => {
+    const [scope] = options.queryKey
+    return {
+      data: scope === 'inboxes' ? mocks.inboxMemberships : mocks.teamMemberships,
+    }
+  },
+  useQuery: <T,>(options: QueryOptions<T>) => ({
+    data: options.enabled === false ? undefined : options.queryFn(),
+  }),
+  useMutation: <TVars, TResult>(options: MutationOptions<TVars, TResult>) => ({
+    isPending: false,
+    mutate: async (vars: TVars) => {
+      try {
+        const result = await options.mutationFn(vars)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+    fallback = null,
+  }: {
+    children: ReactNode
+    fallback?: ReactNode
+    permission: string
+  }) => (mocks.permissionAllowed ? <>{children}</> : <>{fallback}</>),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/avatar', () => ({
+  Avatar: ({ children }: { children: ReactNode; className?: string }) => <span>{children}</span>,
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    className?: string
+  }) => <td colSpan={colSpan}>{children}</td>,
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select
+      aria-label={`select-${value}`}
+      value={value}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) => onValueChange(event.currentTarget.value)}
+    >
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode; className?: string }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({
+    value,
+    onValueChange,
+    excludeIds,
+    placeholder,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    excludeIds: string[]
+    placeholder?: string
+  }) => (
+    <select
+      aria-label="Add member"
+      value={value ?? ''}
+      data-exclude-ids={excludeIds.join(',')}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+        onValueChange(event.currentTarget.value || null)
+      }
+    >
+      <option value="">{placeholder ?? 'Pick principal'}</option>
+      <option value="principal_new">New principal</option>
+      <option value="principal_extra">Extra principal</option>
+    </select>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  TrashIcon: () => <span aria-hidden="true">trash</span>,
+}))
+
+vi.mock('@/lib/server/functions/inboxes', () => ({
+  addInboxMembershipFn: mocks.addInboxMembershipFn,
+  updateInboxMembershipRoleFn: mocks.updateInboxMembershipRoleFn,
+  removeInboxMembershipFn: mocks.removeInboxMembershipFn,
+}))
+
+vi.mock('@/lib/server/functions/teams', () => ({
+  addTeamMemberFn: mocks.addTeamMemberFn,
+  removeTeamMemberFn: mocks.removeTeamMemberFn,
+}))
+
+vi.mock('@/lib/server/functions/principals', () => ({
+  getPrincipalsByIdsFn: mocks.getPrincipalsByIdsFn,
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    memberships: (inboxId: string) => ({
+      queryKey: ['inboxes', inboxId, 'memberships'],
+    }),
+  },
+}))
+
+vi.mock('@/lib/client/queries/teams', () => ({
+  teamQueries: {
+    members: (teamId: string) => ({
+      queryKey: ['teams', teamId, 'members'],
+    }),
+  },
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    INBOX_MANAGE: 'inbox.manage',
+    ADMIN_MANAGE_USERS: 'admin.manage_users',
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.permissionAllowed = true
+  mocks.inboxMemberships = [
+    { id: 'inbox_member_owner', principalId: 'principal_owner', role: 'owner' },
+    { id: 'inbox_member_viewer', principalId: 'principal_viewer', role: 'viewer' },
+  ]
+  mocks.teamMemberships = [{ id: 'team_member_lead', principalId: 'principal_lead', role: 'lead' }]
+  mocks.getPrincipalsByIdsFn.mockImplementation(
+    ({ data }: { data: { ids: string[] } }): Principal[] =>
+      data.ids.map((id) => ({
+        id,
+        displayName:
+          id === 'principal_owner' ? 'Owner Person' : id === 'principal_lead' ? 'Team Lead' : null,
+        avatarUrl: id === 'principal_owner' ? 'https://example.com/avatar.png' : null,
+      }))
+  )
+  mocks.addInboxMembershipFn.mockResolvedValue({ id: 'inbox_member_new' })
+  mocks.updateInboxMembershipRoleFn.mockResolvedValue({ id: 'inbox_member_owner' })
+  mocks.removeInboxMembershipFn.mockResolvedValue(undefined)
+  mocks.addTeamMemberFn.mockResolvedValue({ id: 'team_member_new' })
+  mocks.removeTeamMemberFn.mockResolvedValue(undefined)
+})
+
+describe('membership tabs', () => {
+  it('renders the inbox member table with enriched principals and empty-state fallback', () => {
+    render(<InboxMembersTab inboxId={'inbox_support' as never} />)
+
+    expect(mocks.getPrincipalsByIdsFn).toHaveBeenCalledWith({
+      data: { ids: ['principal_owner', 'principal_viewer'] },
+    })
+    expect(screen.getByText('Owner Person')).toBeInTheDocument()
+    expect(screen.getByText('principal_viewer')).toBeInTheDocument()
+    expect(screen.getByAltText('')).toHaveAttribute('src', 'https://example.com/avatar.png')
+    expect(screen.getByLabelText('Add member')).toHaveAttribute(
+      'data-exclude-ids',
+      'principal_owner,principal_viewer'
+    )
+
+    cleanup()
+    mocks.inboxMemberships = []
+    render(<InboxMembersTab inboxId={'inbox_empty' as never} />)
+
+    expect(screen.getByText('No members yet.')).toBeInTheDocument()
+  })
+
+  it('adds, updates and removes inbox members with cache invalidation and toast feedback', async () => {
+    render(<InboxMembersTab inboxId={'inbox_support' as never} />)
+
+    expect(screen.getByRole('button', { name: 'Add' })).toBeDisabled()
+    fireEvent.change(screen.getByLabelText('Add member'), {
+      target: { value: 'principal_new' },
+    })
+    fireEvent.change(screen.getByLabelText('select-agent'), { target: { value: 'owner' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Add' }))
+
+    await waitFor(() => {
+      expect(mocks.addInboxMembershipFn).toHaveBeenCalledWith({
+        data: {
+          inboxId: 'inbox_support',
+          principalId: 'principal_new',
+          role: 'owner',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['inboxes', 'inbox_support', 'memberships'],
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Member added')
+
+    fireEvent.change(screen.getByLabelText('select-owner'), { target: { value: 'viewer' } })
+    await waitFor(() => {
+      expect(mocks.updateInboxMembershipRoleFn).toHaveBeenCalledWith({
+        data: {
+          membershipId: 'inbox_member_owner',
+          role: 'viewer',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Role updated')
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Remove' })[0])
+    await waitFor(() => {
+      expect(mocks.removeInboxMembershipFn).toHaveBeenCalledWith({
+        data: { membershipId: 'inbox_member_owner' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Member removed')
+  })
+
+  it('shows inbox role fallbacks and surfaces mutation failures when access is denied or rejected', async () => {
+    mocks.permissionAllowed = false
+    render(<InboxMembersTab inboxId={'inbox_support' as never} />)
+
+    expect(screen.queryByLabelText('Add member')).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Remove member' })).not.toBeInTheDocument()
+    expect(screen.getByText('owner')).toBeInTheDocument()
+    expect(screen.getByText('viewer')).toBeInTheDocument()
+
+    cleanup()
+    mocks.permissionAllowed = true
+    mocks.addInboxMembershipFn.mockRejectedValueOnce(new Error('Already a member'))
+    render(<InboxMembersTab inboxId={'inbox_support' as never} />)
+
+    fireEvent.change(screen.getByLabelText('Add member'), {
+      target: { value: 'principal_extra' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Add' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Already a member')
+    })
+  })
+
+  it('adds, updates and removes team members through the team member tab', async () => {
+    render(<TeamMembersTab teamId={'team_support' as never} />)
+
+    expect(mocks.getPrincipalsByIdsFn).toHaveBeenCalledWith({
+      data: { ids: ['principal_lead'] },
+    })
+    expect(screen.getByText('Team Lead')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Add' })).toBeDisabled()
+
+    fireEvent.change(screen.getByLabelText('Add member'), {
+      target: { value: 'principal_new' },
+    })
+    fireEvent.change(screen.getByLabelText('select-member'), { target: { value: 'lead' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Add' }))
+
+    await waitFor(() => {
+      expect(mocks.addTeamMemberFn).toHaveBeenCalledWith({
+        data: {
+          teamId: 'team_support',
+          principalId: 'principal_new',
+          role: 'lead',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['teams', 'team_support', 'members'],
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Member added')
+
+    fireEvent.change(screen.getByLabelText('select-lead'), { target: { value: 'member' } })
+    await waitFor(() => {
+      expect(mocks.addTeamMemberFn).toHaveBeenCalledWith({
+        data: {
+          teamId: 'team_support',
+          principalId: 'principal_lead',
+          role: 'member',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Role updated')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Remove' }))
+    await waitFor(() => {
+      expect(mocks.removeTeamMemberFn).toHaveBeenCalledWith({
+        data: {
+          teamId: 'team_support',
+          principalId: 'principal_lead',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Member removed')
+  })
+
+  it('renders team empty and no-permission states and reports mutation failures', async () => {
+    mocks.teamMemberships = []
+    render(<TeamMembersTab teamId={'team_empty' as never} />)
+
+    expect(screen.getByText('No members yet.')).toBeInTheDocument()
+    expect(mocks.getPrincipalsByIdsFn).not.toHaveBeenCalled()
+
+    cleanup()
+    mocks.teamMemberships = [
+      { id: 'team_member_lead', principalId: 'principal_lead', role: 'lead' },
+    ]
+    mocks.permissionAllowed = false
+    render(<TeamMembersTab teamId={'team_support' as never} />)
+
+    expect(screen.queryByLabelText('Add member')).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Remove member' })).not.toBeInTheDocument()
+    expect(screen.getByText('lead')).toBeInTheDocument()
+
+    cleanup()
+    mocks.permissionAllowed = true
+    mocks.removeTeamMemberFn.mockRejectedValueOnce(new Error('Cannot remove last lead'))
+    render(<TeamMembersTab teamId={'team_support' as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Remove' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Cannot remove last lead')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/settings/audit/__tests__/audit-csv-and-diff.test.tsx b/apps/web/src/components/admin/settings/audit/__tests__/audit-csv-and-diff.test.tsx
new file mode 100644
index 000000000..3845ab9d1
--- /dev/null
+++ b/apps/web/src/components/admin/settings/audit/__tests__/audit-csv-and-diff.test.tsx
@@ -0,0 +1,121 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import type { UnifiedAuditEventRow } from '@/lib/server/domains/audit/audit.unified'
+import { downloadAuditCsv, rowsToCsv } from '../audit-csv'
+import { AuditDiffViewer } from '../audit-diff-viewer'
+
+function row(overrides: Partial<UnifiedAuditEventRow> = {}): UnifiedAuditEventRow {
+  return {
+    id: 'audit_1',
+    occurredAt: new Date('2026-06-20T10:00:00.000Z'),
+    origin: 'api',
+    action: 'ticket.updated',
+    outcome: 'success',
+    source: 'rest',
+    principalId: 'principal_1',
+    actorUserId: 'user_1',
+    actorEmail: 'agent@example.com',
+    actorDisplayName: 'Agent, One',
+    actorRole: 'admin',
+    actorType: 'user',
+    authMethod: 'api_key',
+    ipAddress: '203.0.113.10',
+    userAgent: 'cli "quoted"',
+    targetType: 'ticket',
+    targetId: 'ticket_1',
+    requestId: 'req_1',
+    diff: { before: { priority: 'normal' }, after: { priority: 'urgent' } },
+    metadata: { nested: true },
+    ...overrides,
+  } as UnifiedAuditEventRow
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe('audit CSV helpers', () => {
+  it('serializes audit rows with ISO dates, empty nullable fields and escaped CSV values', () => {
+    const csv = rowsToCsv([
+      row(),
+      row({
+        id: 'audit_2',
+        occurredAt: '2026-06-21T11:00:00.000Z' as unknown as Date,
+        actorEmail: null,
+        actorDisplayName: 'Plain Agent',
+        userAgent: 'line\nbreak',
+        diff: null,
+        metadata: ['array', 'value'],
+      }),
+    ])
+
+    const lines = csv.split('\n')
+    expect(lines[0]).toBe(
+      'occurred_at,origin,action,outcome,source,actor_principal_id,actor_user_id,actor_email,actor_display_name,actor_role,actor_type,auth_method,ip_address,user_agent,target_type,target_id,request_id,diff,metadata'
+    )
+    expect(lines[1]).toContain('2026-06-20T10:00:00.000Z')
+    expect(lines[1]).toContain('"Agent, One"')
+    expect(lines[1]).toContain('"cli ""quoted"""')
+    expect(lines[1]).toContain('"{""before"":{""priority"":""normal""}')
+    expect(lines[2]).toContain('2026-06-21T11:00:00.000Z')
+    expect(lines[2]).toContain(',,Plain Agent')
+    expect(csv).toContain('"line\nbreak"')
+    expect(csv).toContain('[""array"",""value""]')
+  })
+
+  it('downloads the generated CSV through a temporary object URL', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-06-20T12:00:00.000Z'))
+    const createObjectURL = vi.spyOn(URL, 'createObjectURL').mockReturnValue('blob:audit')
+    const revokeObjectURL = vi.spyOn(URL, 'revokeObjectURL').mockImplementation(() => undefined)
+    const click = vi.spyOn(HTMLAnchorElement.prototype, 'click').mockImplementation(() => undefined)
+
+    downloadAuditCsv([row()])
+
+    expect(createObjectURL).toHaveBeenCalledWith(expect.any(Blob))
+    expect(click).toHaveBeenCalled()
+    expect(revokeObjectURL).toHaveBeenCalledWith('blob:audit')
+    expect(document.querySelector('a[download="audit-log-2026-06-20.csv"]')).toBeNull()
+  })
+})
+
+describe('AuditDiffViewer', () => {
+  it('renders before, after, context and request metadata sections', () => {
+    render(
+      <AuditDiffViewer
+        diff={{
+          before: { priority: 'normal' },
+          after: { priority: 'urgent' },
+          context: { reason: 'bulk edit' },
+        }}
+        ipAddress="203.0.113.10"
+        userAgent="quackback-cli/1.0"
+      />
+    )
+
+    expect(screen.getByText('Before')).toBeInTheDocument()
+    expect(screen.getByText(/"priority": "normal"/)).toBeInTheDocument()
+    expect(screen.getByText('After')).toBeInTheDocument()
+    expect(screen.getByText(/"priority": "urgent"/)).toBeInTheDocument()
+    expect(screen.getByText('Context')).toBeInTheDocument()
+    expect(screen.getByText('203.0.113.10')).toBeInTheDocument()
+    expect(screen.getByText('quackback-cli/1.0')).toBeInTheDocument()
+  })
+
+  it('renders raw object diffs and a placeholder for empty or primitive diffs without metadata', () => {
+    const { rerender } = render(
+      <AuditDiffViewer diff={{ custom: ['value'] }} ipAddress={null} userAgent={null} />
+    )
+
+    expect(screen.getByText('Diff')).toBeInTheDocument()
+    expect(screen.getByText(/"custom"/)).toBeInTheDocument()
+
+    rerender(<AuditDiffViewer diff={null} ipAddress={null} userAgent={null} />)
+    expect(screen.getByText('No change details recorded.')).toBeInTheDocument()
+
+    rerender(<AuditDiffViewer diff={['array']} ipAddress={null} userAgent={null} />)
+    expect(screen.getByText('No change details recorded.')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/audit/__tests__/audit-table-filter.test.tsx b/apps/web/src/components/admin/settings/audit/__tests__/audit-table-filter.test.tsx
new file mode 100644
index 000000000..d17c53095
--- /dev/null
+++ b/apps/web/src/components/admin/settings/audit/__tests__/audit-table-filter.test.tsx
@@ -0,0 +1,409 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { AuditEventTable } from '../audit-event-table'
+import { AuditFilterBar } from '../audit-filter-bar'
+import type { AuditFilters } from '@/lib/client/queries/audit'
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+  disabled?: boolean
+}
+
+const mocks = vi.hoisted(() => ({
+  auditPages: [] as Array<{ items: unknown[] }>,
+  hasNextPage: true,
+  isFetchingNextPage: false,
+  fetchNextPage: vi.fn(),
+  principals: [] as Array<{
+    id: string
+    displayName: string | null
+    email: string | null
+    role: string
+  }>,
+  actions: ['ticket.created', 'ticket.updated'],
+  downloadAuditCsv: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseInfiniteQuery: () => ({
+    data: { pages: mocks.auditPages },
+    hasNextPage: mocks.hasNextPage,
+    isFetchingNextPage: mocks.isFetchingNextPage,
+    fetchNextPage: mocks.fetchNextPage,
+  }),
+  useQuery: (options: { queryKey?: readonly unknown[] }) => {
+    if (options.queryKey?.[0] === 'principals') return { data: mocks.principals }
+    return { data: mocks.actions }
+  },
+}))
+
+vi.mock('@/lib/client/queries/audit', async () => {
+  const actual = await vi.importActual<typeof import('@/lib/client/queries/audit')>(
+    '@/lib/client/queries/audit'
+  )
+  return {
+    ...actual,
+    auditQueries: {
+      list: (filters: unknown) => ({ queryKey: ['audit', 'list', filters] }),
+      actions: () => ({ queryKey: ['audit', 'actions'] }),
+    },
+    defaultAuditFilters: () => ({ limit: 50 }),
+    rangeToFromIso: (range: string) => (range === 'all' ? undefined : `from-${range}`),
+  }
+})
+
+vi.mock('@/lib/client/hooks/use-debounced-value', () => ({
+  useDebouncedValue: (value: unknown) => value,
+}))
+
+vi.mock('@/lib/server/functions/principals', () => ({
+  getPrincipalsByIdsFn: vi.fn(),
+}))
+
+vi.mock('../audit-csv', () => ({
+  downloadAuditCsv: mocks.downloadAuditCsv,
+}))
+
+vi.mock('../audit-diff-viewer', () => ({
+  AuditDiffViewer: ({
+    diff,
+    ipAddress,
+    userAgent,
+  }: {
+    diff?: unknown
+    ipAddress?: string | null
+    userAgent?: string | null
+  }) => (
+    <div>
+      Diff {JSON.stringify(diff)} {ipAddress} {userAgent}
+    </div>
+  ),
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: ComponentProps) => <table>{children}</table>,
+  TableHeader: ({ children }: ComponentProps) => <thead>{children}</thead>,
+  TableBody: ({ children }: ComponentProps) => <tbody>{children}</tbody>,
+  TableRow: ({ children, className }: ComponentProps) => <tr className={className}>{children}</tr>,
+  TableHead: ({ children, className }: ComponentProps) => <th className={className}>{children}</th>,
+  TableCell: ({
+    children,
+    className,
+    colSpan,
+    title,
+  }: ComponentProps & { colSpan?: number; title?: string }) => (
+    <td className={className} colSpan={colSpan} title={title}>
+      {children}
+    </td>
+  ),
+}))
+
+vi.mock('@/components/ui/avatar', () => ({
+  Avatar: ({ children, className }: ComponentProps) => (
+    <span className={className}>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children, variant, className }: ComponentProps & { variant?: string }) => (
+    <span className={className} data-variant={variant}>
+      {children}
+    </span>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children, onClick, disabled }: ComponentProps) => (
+    <button type="button" onClick={onClick} disabled={disabled}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    value,
+    onChange,
+    onBlur,
+    onKeyDown,
+    placeholder,
+    type,
+    className,
+    list,
+  }: {
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    onBlur?: () => void
+    onKeyDown?: (event: React.KeyboardEvent<HTMLInputElement>) => void
+    placeholder?: string
+    type?: string
+    className?: string
+    list?: string
+  }) => (
+    <input
+      value={value}
+      onChange={onChange}
+      onBlur={onBlur}
+      onKeyDown={onKeyDown}
+      placeholder={placeholder}
+      type={type}
+      className={className}
+      list={list}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor, className }: ComponentProps & { htmlFor?: string }) => (
+    <label htmlFor={htmlFor} className={className}>
+      {children}
+    </label>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    checked,
+    onCheckedChange,
+    id,
+  }: {
+    checked?: boolean
+    onCheckedChange?: (checked: boolean) => void
+    id?: string
+  }) => (
+    <button
+      id={id}
+      type="button"
+      role="switch"
+      aria-checked={checked ? 'true' : 'false'}
+      onClick={() => onCheckedChange?.(!checked)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/select', async () => {
+  const React = await import('react')
+  const SelectContext = React.createContext<{ onValueChange?: (value: string) => void }>({})
+
+  return {
+    Select: ({
+      value,
+      onValueChange,
+      children,
+    }: {
+      value?: string
+      onValueChange?: (value: string) => void
+      children?: ReactNode
+    }) => (
+      <SelectContext.Provider value={{ onValueChange }}>
+        <div data-value={value}>{children}</div>
+      </SelectContext.Provider>
+    ),
+    SelectContent: ({ children }: ComponentProps) => <div>{children}</div>,
+    SelectTrigger: ({ children }: ComponentProps) => <div>{children}</div>,
+    SelectValue: () => <span />,
+    SelectItem: ({ value, children }: ComponentProps & { value: string }) => {
+      const context = React.useContext(SelectContext)
+      return (
+        <button type="button" onClick={() => context.onValueChange?.(value)}>
+          {children}
+        </button>
+      )
+    },
+  }
+})
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({ onValueChange }: { onValueChange: (value: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('principal_2')}>
+      Pick actor
+    </button>
+  ),
+}))
+
+function auditRow(overrides: Record<string, unknown>) {
+  return {
+    id: 'evt-1',
+    origin: 'workspace',
+    principalId: 'principal_1',
+    actorDisplayName: null,
+    actorEmail: null,
+    actorUserId: null,
+    actorType: 'user',
+    actorRole: 'admin',
+    authMethod: 'password',
+    action: 'ticket.created',
+    targetType: 'ticket',
+    targetId: 'ticket-1',
+    outcome: 'success',
+    source: 'web',
+    occurredAt: '2026-06-19T10:15:00.000Z',
+    diff: { after: { subject: 'Hi' } },
+    ipAddress: '127.0.0.1',
+    userAgent: 'Vitest',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.auditPages = [
+    {
+      items: [
+        auditRow({ id: 'evt-1' }),
+        auditRow({
+          id: 'evt-2',
+          origin: 'security',
+          principalId: null,
+          actorDisplayName: 'Deleted User',
+          actorEmail: 'deleted@example.com',
+          actorRole: null,
+          authMethod: null,
+          outcome: 'failure',
+          source: null,
+          targetType: null,
+          targetId: null,
+          action: 'auth.login.failed',
+        }),
+        auditRow({
+          id: 'evt-3',
+          principalId: null,
+          actorDisplayName: null,
+          actorEmail: null,
+          actorUserId: null,
+          actorType: null,
+          outcome: null,
+        }),
+      ],
+    },
+  ]
+  mocks.principals = [
+    {
+      id: 'principal_1',
+      displayName: 'Ada Admin',
+      email: 'ada@example.com',
+      role: 'owner',
+    },
+  ]
+  mocks.hasNextPage = true
+  mocks.isFetchingNextPage = false
+})
+
+describe('AuditEventTable', () => {
+  it('renders rows, resolves actors, expands details, exports csv, and paginates', () => {
+    render(<AuditEventTable filters={{ limit: 50 } as AuditFilters} />)
+
+    expect(screen.getByText('3 events shown')).toBeTruthy()
+    expect(screen.getAllByText('Ada Admin').length).toBeGreaterThan(0)
+    expect(screen.getByText('ada@example.com · admin · user · password')).toBeTruthy()
+    expect(screen.getAllByText('Deleted User').length).toBeGreaterThan(0)
+    expect(screen.getAllByText('System').length).toBeGreaterThan(0)
+    expect(screen.getAllByText('success').length).toBeGreaterThan(0)
+    expect(screen.getAllByText('failure').length).toBeGreaterThan(0)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Export CSV' }))
+    expect(mocks.downloadAuditCsv).toHaveBeenCalledWith(mocks.auditPages[0].items)
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Expand row' })[0])
+    expect(screen.getAllByText(/Diff/).length).toBeGreaterThan(0)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Load more' }))
+    expect(mocks.fetchNextPage).toHaveBeenCalledTimes(1)
+  })
+
+  it('renders empty and terminal states', () => {
+    mocks.auditPages = [{ items: [] }]
+    mocks.hasNextPage = false
+
+    render(<AuditEventTable filters={{ limit: 50 } as AuditFilters} />)
+
+    expect(screen.getByText('0 events shown')).toBeTruthy()
+    expect(
+      screen.getAllByText('No audit events match the current filters.').length
+    ).toBeGreaterThan(0)
+    expect(screen.getByRole('button', { name: 'Export CSV' })).toBeDisabled()
+    expect(screen.getByText('End of matching events.')).toBeTruthy()
+  })
+})
+
+describe('AuditFilterBar', () => {
+  it('propagates filter changes from selects, inputs, actor picker, prefix mode, and clear', () => {
+    const onChange = vi.fn()
+    const value = {
+      limit: 50,
+      origin: 'workspace',
+      principalId: 'principal_1',
+      action: 'ticket.created',
+      targetType: 'ticket',
+      targetId: 'ticket-1',
+      source: 'web',
+      fromIso: '2026-06-19T10:15:00.000Z',
+      toIso: '2026-06-20T10:15:00.000Z',
+    } as AuditFilters
+
+    render(<AuditFilterBar value={value} onChange={onChange} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Security' }))
+    expect(onChange).toHaveBeenCalledWith(expect.objectContaining({ origin: 'security' }))
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick actor' }))
+    expect(onChange).toHaveBeenCalledWith(expect.objectContaining({ principalId: 'principal_2' }))
+
+    fireEvent.change(screen.getByPlaceholderText('e.g. ticket.created'), {
+      target: { value: 'ticket.' },
+    })
+    expect(onChange).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'ticket.', actionPrefix: undefined })
+    )
+
+    fireEvent.click(screen.getByRole('switch'))
+    expect(onChange).toHaveBeenCalledWith(
+      expect.objectContaining({ action: undefined, actionPrefix: 'ticket.created' })
+    )
+
+    fireEvent.change(screen.getByPlaceholderText('name@example.com'), {
+      target: { value: 'auditor@example.com' },
+    })
+    expect(onChange).toHaveBeenCalledWith(
+      expect.objectContaining({ actorEmail: 'auditor@example.com' })
+    )
+
+    fireEvent.change(screen.getByPlaceholderText('e.g. ticket'), {
+      target: { value: 'organization' },
+    })
+    fireEvent.blur(screen.getByPlaceholderText('e.g. ticket'))
+    expect(onChange).toHaveBeenCalledWith(expect.objectContaining({ targetType: 'organization' }))
+
+    fireEvent.change(screen.getByPlaceholderText('ticket_...'), {
+      target: { value: 'ticket-2' },
+    })
+    fireEvent.keyDown(screen.getByPlaceholderText('ticket_...'), { key: 'Enter' })
+    expect(onChange).toHaveBeenCalledWith(expect.objectContaining({ targetId: 'ticket-2' }))
+
+    fireEvent.click(screen.getByRole('button', { name: 'api' }))
+    expect(onChange).toHaveBeenCalledWith(expect.objectContaining({ source: 'api' }))
+
+    fireEvent.click(screen.getByRole('button', { name: 'All time' }))
+    expect(onChange).toHaveBeenCalledWith(
+      expect.objectContaining({ fromIso: undefined, toIso: undefined })
+    )
+
+    fireEvent.change(screen.getByDisplayValue(/2026-06-19T\d\d:15/), {
+      target: { value: '2026-06-21T12:30' },
+    })
+    expect(onChange).toHaveBeenCalledWith(expect.objectContaining({ fromIso: expect.any(String) }))
+
+    fireEvent.click(screen.getByRole('button', { name: 'Clear filters' }))
+    expect(onChange).toHaveBeenCalledWith({ limit: 50 })
+  })
+
+  it('disables clear when no filters are active', () => {
+    render(<AuditFilterBar value={{ limit: 50 } as AuditFilters} onChange={vi.fn()} />)
+
+    expect(screen.getByRole('button', { name: 'Clear filters' })).toBeDisabled()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/audit/audit-csv.ts b/apps/web/src/components/admin/settings/audit/audit-csv.ts
new file mode 100644
index 000000000..6e7447f21
--- /dev/null
+++ b/apps/web/src/components/admin/settings/audit/audit-csv.ts
@@ -0,0 +1,79 @@
+import type { UnifiedAuditEventRow } from '@/lib/server/domains/audit/audit.unified'
+
+function toIso(value: Date | string): string {
+  return value instanceof Date ? value.toISOString() : new Date(value).toISOString()
+}
+
+function escapeCsv(value: unknown): string {
+  if (value === null || value === undefined) return ''
+  const text = typeof value === 'string' ? value : JSON.stringify(value)
+  return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text
+}
+
+export function rowsToCsv(rows: UnifiedAuditEventRow[]): string {
+  const headers = [
+    'occurred_at',
+    'origin',
+    'action',
+    'outcome',
+    'source',
+    'actor_principal_id',
+    'actor_user_id',
+    'actor_email',
+    'actor_display_name',
+    'actor_role',
+    'actor_type',
+    'auth_method',
+    'ip_address',
+    'user_agent',
+    'target_type',
+    'target_id',
+    'request_id',
+    'diff',
+    'metadata',
+  ]
+
+  const lines = [
+    headers.join(','),
+    ...rows.map((row) =>
+      [
+        toIso(row.occurredAt),
+        row.origin,
+        row.action,
+        row.outcome,
+        row.source,
+        row.principalId,
+        row.actorUserId,
+        row.actorEmail,
+        row.actorDisplayName,
+        row.actorRole,
+        row.actorType,
+        row.authMethod,
+        row.ipAddress,
+        row.userAgent,
+        row.targetType,
+        row.targetId,
+        row.requestId,
+        row.diff,
+        row.metadata,
+      ]
+        .map(escapeCsv)
+        .join(',')
+    ),
+  ]
+
+  return lines.join('\n')
+}
+
+export function downloadAuditCsv(rows: UnifiedAuditEventRow[]): void {
+  const csv = rowsToCsv(rows)
+  const blob = new Blob([csv], { type: 'text/csv;charset=utf-8' })
+  const url = URL.createObjectURL(blob)
+  const a = document.createElement('a')
+  a.href = url
+  a.download = `audit-log-${new Date().toISOString().slice(0, 10)}.csv`
+  document.body.appendChild(a)
+  a.click()
+  document.body.removeChild(a)
+  URL.revokeObjectURL(url)
+}
diff --git a/apps/web/src/components/admin/settings/audit/audit-diff-viewer.tsx b/apps/web/src/components/admin/settings/audit/audit-diff-viewer.tsx
new file mode 100644
index 000000000..cc76a2443
--- /dev/null
+++ b/apps/web/src/components/admin/settings/audit/audit-diff-viewer.tsx
@@ -0,0 +1,72 @@
+/**
+ * Renders the structured `AuditDiff` JSON in three optional panels
+ * (Before / After / Context) plus a small IP / UA metadata grid.
+ */
+interface Props {
+  diff: unknown
+  ipAddress: string | null
+  userAgent: string | null
+}
+
+function isObject(v: unknown): v is Record<string, unknown> {
+  return typeof v === 'object' && v !== null && !Array.isArray(v)
+}
+
+function Section({ label, value }: { label: string; value: unknown }) {
+  return (
+    <div className="space-y-1">
+      <div className="text-[11px] font-semibold uppercase tracking-wide text-muted-foreground">
+        {label}
+      </div>
+      <pre className="text-[11px] bg-muted/40 rounded p-2 overflow-x-auto whitespace-pre-wrap break-all">
+        {JSON.stringify(value, null, 2)}
+      </pre>
+    </div>
+  )
+}
+
+export function AuditDiffViewer({ diff, ipAddress, userAgent }: Props) {
+  const obj = isObject(diff) ? diff : null
+  const before = obj && 'before' in obj ? obj.before : undefined
+  const after = obj && 'after' in obj ? obj.after : undefined
+  const context = obj && 'context' in obj ? obj.context : undefined
+  const hasAnyDiffSection = before !== undefined || after !== undefined || context !== undefined
+  const hasMeta = Boolean(ipAddress || userAgent)
+
+  if (!hasAnyDiffSection && !hasMeta) {
+    // Render the raw diff if it's a non-empty primitive/array, otherwise
+    // a small placeholder.
+    if (obj && Object.keys(obj).length > 0) {
+      return (
+        <div className="space-y-3">
+          <Section label="Diff" value={obj} />
+        </div>
+      )
+    }
+    return <div className="text-xs text-muted-foreground italic">No change details recorded.</div>
+  }
+
+  return (
+    <div className="space-y-3">
+      {before !== undefined && <Section label="Before" value={before} />}
+      {after !== undefined && <Section label="After" value={after} />}
+      {context !== undefined && <Section label="Context" value={context} />}
+      {hasMeta && (
+        <div className="grid grid-cols-1 md:grid-cols-2 gap-2 text-[11px]">
+          {ipAddress && (
+            <div>
+              <span className="font-semibold uppercase text-muted-foreground">IP:</span>{' '}
+              <span className="font-mono">{ipAddress}</span>
+            </div>
+          )}
+          {userAgent && (
+            <div className="truncate" title={userAgent}>
+              <span className="font-semibold uppercase text-muted-foreground">UA:</span>{' '}
+              <span className="font-mono">{userAgent}</span>
+            </div>
+          )}
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/audit/audit-event-table.tsx b/apps/web/src/components/admin/settings/audit/audit-event-table.tsx
new file mode 100644
index 000000000..4072bfce5
--- /dev/null
+++ b/apps/web/src/components/admin/settings/audit/audit-event-table.tsx
@@ -0,0 +1,365 @@
+/**
+ * Unified audit event table — cursor-paged via `useSuspenseInfiniteQuery`.
+ * Workspace actors are resolved in a single batched lookup; security rows use
+ * denormalized actor fields so deleted users still render coherently.
+ */
+import { Fragment, useMemo, useState } from 'react'
+import { useQuery, useSuspenseInfiniteQuery } from '@tanstack/react-query'
+import type { PrincipalId } from '@quackback/ids'
+import { auditQueries, type AuditFilters } from '@/lib/client/queries/audit'
+import { getPrincipalsByIdsFn } from '@/lib/server/functions/principals'
+import type { UnifiedAuditEventRow } from '@/lib/server/domains/audit/audit.unified'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Avatar } from '@/components/ui/avatar'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { ArrowDownTrayIcon, ChevronDownIcon, ChevronRightIcon } from '@heroicons/react/24/outline'
+import { AuditDiffViewer } from './audit-diff-viewer'
+import { downloadAuditCsv } from './audit-csv'
+
+interface Props {
+  filters: AuditFilters
+}
+
+function toDate(value: Date | string): Date {
+  return value instanceof Date ? value : new Date(value)
+}
+
+function formatTimestamp(value: Date | string): { date: string; time: string; full: string } {
+  const d = toDate(value)
+  return {
+    date: d.toLocaleDateString('en-US', { month: 'short', day: 'numeric' }),
+    time: d.toLocaleTimeString('en-US', { hour: 'numeric', minute: '2-digit' }),
+    full: d.toLocaleString('en-US', {
+      year: 'numeric',
+      month: 'short',
+      day: 'numeric',
+      hour: 'numeric',
+      minute: '2-digit',
+    }),
+  }
+}
+
+function OriginBadge({ origin }: { origin: UnifiedAuditEventRow['origin'] }) {
+  return (
+    <Badge variant={origin === 'security' ? 'secondary' : 'outline'} className="text-[10px]">
+      {origin}
+    </Badge>
+  )
+}
+
+function OutcomeBadge({ outcome }: { outcome: UnifiedAuditEventRow['outcome'] }) {
+  if (!outcome) return <span className="text-xs text-muted-foreground">—</span>
+  return (
+    <Badge variant={outcome === 'success' ? 'secondary' : 'destructive'} className="text-xs">
+      {outcome}
+    </Badge>
+  )
+}
+
+function TargetCell({ row }: { row: UnifiedAuditEventRow }) {
+  if (!row.targetType) return <span className="text-muted-foreground">—</span>
+  return (
+    <div className="flex flex-col text-xs">
+      <span className="font-mono text-muted-foreground">{row.targetType}</span>
+      {row.targetId ? (
+        <span className="truncate font-mono text-[11px]" title={row.targetId}>
+          {row.targetId}
+        </span>
+      ) : null}
+    </div>
+  )
+}
+
+export function AuditEventTable({ filters }: Props) {
+  const query = useSuspenseInfiniteQuery(auditQueries.list(filters))
+  const items = useMemo(() => query.data.pages.flatMap((p) => p.items), [query.data])
+
+  const principalIds = useMemo(() => {
+    const set = new Set<string>()
+    for (const row of items) {
+      if (row.origin === 'workspace' && row.principalId) set.add(row.principalId)
+    }
+    return Array.from(set)
+  }, [items])
+
+  const principalsQuery = useQuery({
+    queryKey: ['principals', 'byIds', principalIds] as const,
+    queryFn: () => getPrincipalsByIdsFn({ data: { ids: principalIds as PrincipalId[] } }),
+    enabled: principalIds.length > 0,
+    staleTime: 60_000,
+  })
+
+  const principalMap = useMemo(() => {
+    const m = new Map<string, { displayName: string | null; email: string | null; role: string }>()
+    for (const principal of principalsQuery.data ?? []) {
+      m.set(principal.id, {
+        displayName: principal.displayName,
+        email: principal.email,
+        role: principal.role,
+      })
+    }
+    return m
+  }, [principalsQuery.data])
+
+  const rowKey = (row: Pick<UnifiedAuditEventRow, 'origin' | 'id'>) => `${row.origin}:${row.id}`
+
+  const [expanded, setExpanded] = useState<Set<string>>(new Set())
+  const toggle = (id: string) => {
+    setExpanded((prev) => {
+      const next = new Set(prev)
+      if (next.has(id)) next.delete(id)
+      else next.add(id)
+      return next
+    })
+  }
+
+  const actorLabel = (row: UnifiedAuditEventRow) => {
+    const resolved = row.principalId ? principalMap.get(row.principalId) : null
+    return (
+      resolved?.displayName ??
+      resolved?.email ??
+      row.actorDisplayName ??
+      row.actorEmail ??
+      row.principalId ??
+      row.actorUserId ??
+      (row.actorType ? `(${row.actorType})` : null)
+    )
+  }
+
+  const actorSubtitle = (row: UnifiedAuditEventRow) => {
+    const resolved = row.principalId ? principalMap.get(row.principalId) : null
+    return [resolved?.email, row.actorRole ?? resolved?.role, row.actorType, row.authMethod]
+      .filter(Boolean)
+      .join(' · ')
+  }
+
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center justify-between gap-3">
+        <span className="text-xs text-muted-foreground">{items.length} events shown</span>
+        <Button
+          variant="outline"
+          size="sm"
+          disabled={items.length === 0}
+          onClick={() => downloadAuditCsv(items)}
+        >
+          <ArrowDownTrayIcon className="h-4 w-4" />
+          Export CSV
+        </Button>
+      </div>
+
+      <div className="hidden md:block overflow-x-auto rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead className="w-8" />
+              <TableHead className="w-28">When</TableHead>
+              <TableHead className="w-24">Origin</TableHead>
+              <TableHead>Actor</TableHead>
+              <TableHead>Action</TableHead>
+              <TableHead>Target</TableHead>
+              <TableHead className="w-24">Outcome</TableHead>
+              <TableHead className="w-24">Source</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {items.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={8} className="text-center text-sm text-muted-foreground py-6">
+                  No audit events match the current filters.
+                </TableCell>
+              </TableRow>
+            ) : (
+              items.map((row) => {
+                const key = rowKey(row)
+                const isOpen = expanded.has(key)
+                const actor = actorLabel(row)
+                const subtitle = actorSubtitle(row)
+                const stamp = formatTimestamp(row.occurredAt)
+                return (
+                  <Fragment key={key}>
+                    <TableRow className="hover:bg-muted/50">
+                      <TableCell>
+                        <button
+                          type="button"
+                          aria-label={isOpen ? 'Collapse row' : 'Expand row'}
+                          onClick={() => toggle(key)}
+                          className="text-muted-foreground hover:text-foreground"
+                        >
+                          {isOpen ? (
+                            <ChevronDownIcon className="h-4 w-4" />
+                          ) : (
+                            <ChevronRightIcon className="h-4 w-4" />
+                          )}
+                        </button>
+                      </TableCell>
+                      <TableCell
+                        className="whitespace-nowrap text-xs text-muted-foreground"
+                        title={stamp.full}
+                      >
+                        <div className="flex flex-col leading-tight">
+                          <span>{stamp.date}</span>
+                          <span className="text-[10px]">{stamp.time}</span>
+                        </div>
+                      </TableCell>
+                      <TableCell>
+                        <OriginBadge origin={row.origin} />
+                      </TableCell>
+                      <TableCell>
+                        {actor ? (
+                          <div className="flex items-center gap-2">
+                            <Avatar className="h-6 w-6 text-[10px]">
+                              {actor.slice(0, 2).toUpperCase()}
+                            </Avatar>
+                            <div className="flex min-w-0 flex-col">
+                              <span className="truncate text-sm">{actor}</span>
+                              {subtitle ? (
+                                <span className="truncate text-[11px] text-muted-foreground">
+                                  {subtitle}
+                                </span>
+                              ) : null}
+                            </div>
+                          </div>
+                        ) : (
+                          <Badge variant="outline" className="text-[10px]">
+                            System
+                          </Badge>
+                        )}
+                      </TableCell>
+                      <TableCell>
+                        <code className="text-[11px] bg-muted/40 px-1.5 py-0.5 rounded">
+                          {row.action}
+                        </code>
+                      </TableCell>
+                      <TableCell>
+                        <TargetCell row={row} />
+                      </TableCell>
+                      <TableCell>
+                        <OutcomeBadge outcome={row.outcome} />
+                      </TableCell>
+                      <TableCell>
+                        <Badge variant="outline" className="text-[10px]">
+                          {row.source ?? '—'}
+                        </Badge>
+                      </TableCell>
+                    </TableRow>
+                    {isOpen && (
+                      <TableRow className="bg-muted/20 hover:bg-muted/20">
+                        <TableCell />
+                        <TableCell colSpan={7} className="py-3">
+                          <AuditDiffViewer
+                            diff={row.diff}
+                            ipAddress={row.ipAddress}
+                            userAgent={row.userAgent}
+                          />
+                        </TableCell>
+                      </TableRow>
+                    )}
+                  </Fragment>
+                )
+              })
+            )}
+          </TableBody>
+        </Table>
+      </div>
+
+      <div className="md:hidden rounded-md border divide-y divide-border">
+        {items.length === 0 ? (
+          <p className="py-8 text-center text-sm text-muted-foreground">
+            No audit events match the current filters.
+          </p>
+        ) : (
+          items.map((row) => {
+            const key = rowKey(row)
+            const isOpen = expanded.has(key)
+            const stamp = formatTimestamp(row.occurredAt)
+            const actor = actorLabel(row)
+            return (
+              <div key={key} className="p-3 space-y-3">
+                <div className="flex items-start justify-between gap-2">
+                  <div className="min-w-0 space-y-1">
+                    <div className="flex items-center gap-2">
+                      <OriginBadge origin={row.origin} />
+                      <span className="text-xs text-muted-foreground" title={stamp.full}>
+                        {stamp.date} {stamp.time}
+                      </span>
+                    </div>
+                    <p className="truncate font-mono text-xs" title={row.action}>
+                      {row.action}
+                    </p>
+                  </div>
+                  <OutcomeBadge outcome={row.outcome} />
+                </div>
+
+                <div className="space-y-1 text-xs text-muted-foreground">
+                  {actor ? (
+                    <div className="flex gap-2">
+                      <span className="w-14 shrink-0 font-medium text-foreground/60">Actor</span>
+                      <span className="truncate">{actor}</span>
+                    </div>
+                  ) : null}
+                  {row.targetType ? (
+                    <div className="flex gap-2">
+                      <span className="w-14 shrink-0 font-medium text-foreground/60">Target</span>
+                      <div className="min-w-0">
+                        <span className="uppercase tracking-wide text-[10px]">
+                          {row.targetType}
+                        </span>
+                        {row.targetId ? (
+                          <p className="truncate font-mono text-[11px]" title={row.targetId}>
+                            {row.targetId}
+                          </p>
+                        ) : null}
+                      </div>
+                    </div>
+                  ) : null}
+                  {row.source ? (
+                    <div className="flex gap-2">
+                      <span className="w-14 shrink-0 font-medium text-foreground/60">Source</span>
+                      <span>{row.source}</span>
+                    </div>
+                  ) : null}
+                </div>
+
+                <Button variant="ghost" size="sm" onClick={() => toggle(key)} className="h-8 px-2">
+                  {isOpen ? 'Hide details' : 'Show details'}
+                </Button>
+                {isOpen ? (
+                  <AuditDiffViewer
+                    diff={row.diff}
+                    ipAddress={row.ipAddress}
+                    userAgent={row.userAgent}
+                  />
+                ) : null}
+              </div>
+            )
+          })
+        )}
+      </div>
+
+      <div className="flex items-center justify-between">
+        <span className="text-xs text-muted-foreground">
+          {query.hasNextPage ? 'More events are available.' : 'End of matching events.'}
+        </span>
+        {query.hasNextPage ? (
+          <Button
+            variant="outline"
+            size="sm"
+            disabled={query.isFetchingNextPage}
+            onClick={() => query.fetchNextPage()}
+          >
+            {query.isFetchingNextPage ? 'Loading...' : 'Load more'}
+          </Button>
+        ) : null}
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/audit/audit-filter-bar.tsx b/apps/web/src/components/admin/settings/audit/audit-filter-bar.tsx
new file mode 100644
index 000000000..9f3d42c04
--- /dev/null
+++ b/apps/web/src/components/admin/settings/audit/audit-filter-bar.tsx
@@ -0,0 +1,340 @@
+/**
+ * Filter bar for the unified audit log. All controls drive a single
+ * `AuditFilters` object; changes propagate up immediately and the underlying
+ * infinite query resets its cursor when filters change.
+ */
+import { useState, useEffect } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import type { PrincipalId } from '@quackback/ids'
+import {
+  auditQueries,
+  defaultAuditFilters,
+  rangeToFromIso,
+  type AuditFilters,
+  type AuditOriginFilter,
+  type AuditSourceFilter,
+  type AuditTimeRange,
+} from '@/lib/client/queries/audit'
+import { useDebouncedValue } from '@/lib/client/hooks/use-debounced-value'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Switch } from '@/components/ui/switch'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+
+interface Props {
+  value: AuditFilters
+  onChange: (next: AuditFilters) => void
+}
+
+const SOURCES: AuditSourceFilter[] = ['web', 'api', 'integration', 'system', 'mcp']
+const ALL = '__all__'
+const ORIGINS: Array<{ label: string; value: AuditOriginFilter | typeof ALL }> = [
+  { label: 'All', value: ALL },
+  { label: 'Workspace', value: 'workspace' },
+  { label: 'Security', value: 'security' },
+]
+
+const TIME_RANGES: Array<{ label: string; value: AuditTimeRange }> = [
+  { label: 'Last 7 days', value: '7d' },
+  { label: 'Last 30 days', value: '30d' },
+  { label: 'Last 90 days', value: '90d' },
+  { label: 'All time', value: 'all' },
+  { label: 'Custom', value: 'custom' },
+]
+
+function isoToLocal(iso: string | undefined): string {
+  if (!iso) return ''
+  const d = new Date(iso)
+  if (isNaN(d.getTime())) return ''
+  // Build YYYY-MM-DDTHH:mm in local time.
+  const pad = (n: number) => String(n).padStart(2, '0')
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}`
+}
+
+function localToIso(local: string): string | undefined {
+  if (!local) return undefined
+  const d = new Date(local)
+  if (isNaN(d.getTime())) return undefined
+  return d.toISOString()
+}
+
+export function AuditFilterBar({ value, onChange }: Props) {
+  const actionsQuery = useQuery(auditQueries.actions())
+  const actions = actionsQuery.data ?? []
+
+  // Derive the "current action" string and the prefix-mode flag from the
+  // incoming filter values so the controls round-trip cleanly.
+  const currentAction = value.action ?? value.actionPrefix ?? ''
+  const [prefixMode, setPrefixMode] = useState(Boolean(value.actionPrefix))
+
+  const [timeRange, setTimeRange] = useState<AuditTimeRange>('30d')
+  const [actorEmail, setActorEmail] = useState(value.actorEmail ?? '')
+  const debouncedActorEmail = useDebouncedValue(actorEmail, 300)
+
+  // Local text buffers so typing doesn't refetch every server query.
+  const [targetType, setTargetType] = useState(value.targetType ?? '')
+  const [targetId, setTargetId] = useState(value.targetId ?? '')
+
+  useEffect(() => {
+    setTargetType(value.targetType ?? '')
+  }, [value.targetType])
+
+  useEffect(() => {
+    setTargetId(value.targetId ?? '')
+  }, [value.targetId])
+
+  useEffect(() => {
+    setActorEmail(value.actorEmail ?? '')
+  }, [value.actorEmail])
+
+  useEffect(() => {
+    const trimmed = debouncedActorEmail.trim()
+    const next = trimmed || undefined
+    if ((value.actorEmail ?? undefined) !== next) {
+      onChange({ ...value, actorEmail: next })
+    }
+  }, [debouncedActorEmail, onChange, value])
+
+  const setOrigin = (next: string) =>
+    onChange({
+      ...value,
+      origin: next === ALL ? undefined : (next as AuditOriginFilter),
+    })
+
+  const setActor = (next: PrincipalId | null) => onChange({ ...value, principalId: next })
+
+  const setAction = (next: string) => {
+    const trimmed = next.trim()
+    if (!trimmed) {
+      onChange({ ...value, action: undefined, actionPrefix: undefined })
+      return
+    }
+    if (prefixMode) onChange({ ...value, action: undefined, actionPrefix: trimmed })
+    else onChange({ ...value, action: trimmed, actionPrefix: undefined })
+  }
+
+  const togglePrefix = (next: boolean) => {
+    setPrefixMode(next)
+    if (!currentAction) return
+    if (next) onChange({ ...value, action: undefined, actionPrefix: currentAction })
+    else onChange({ ...value, action: currentAction, actionPrefix: undefined })
+  }
+
+  const setSource = (next: string) =>
+    onChange({
+      ...value,
+      source: next === ALL ? undefined : (next as AuditSourceFilter),
+    })
+
+  const setRange = (next: AuditTimeRange) => {
+    setTimeRange(next)
+    if (next === 'custom') return
+    onChange({
+      ...value,
+      fromIso: rangeToFromIso(next),
+      toIso: undefined,
+    })
+  }
+
+  const setFrom = (local: string) => {
+    setTimeRange('custom')
+    onChange({ ...value, fromIso: localToIso(local) })
+  }
+
+  const setTo = (local: string) => {
+    setTimeRange('custom')
+    onChange({ ...value, toIso: localToIso(local) })
+  }
+
+  const commitTargetType = () => onChange({ ...value, targetType: targetType.trim() || undefined })
+  const commitTargetId = () => onChange({ ...value, targetId: targetId.trim() || undefined })
+
+  const clearAll = () => {
+    setPrefixMode(false)
+    setTargetType('')
+    setTargetId('')
+    setActorEmail('')
+    setTimeRange('30d')
+    onChange(defaultAuditFilters())
+  }
+
+  const hasFilters =
+    Boolean(value.origin) ||
+    Boolean(value.principalId) ||
+    Boolean(value.actorEmail) ||
+    Boolean(value.action) ||
+    Boolean(value.actionPrefix) ||
+    Boolean(value.targetType) ||
+    Boolean(value.targetId) ||
+    Boolean(value.source) ||
+    Boolean(value.fromIso) ||
+    Boolean(value.toIso)
+
+  return (
+    <div className="rounded-md border border-border/50 p-3 space-y-3">
+      <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-3">
+        <div className="space-y-1">
+          <Label className="text-xs">Origin</Label>
+          <Select value={value.origin ?? ALL} onValueChange={setOrigin}>
+            <SelectTrigger className="h-9">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              {ORIGINS.map((origin) => (
+                <SelectItem key={origin.value} value={origin.value}>
+                  {origin.label}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">Actor principal</Label>
+          <PrincipalPicker
+            value={value.principalId ?? null}
+            onValueChange={setActor}
+            allowUnassigned
+            placeholder="Any actor"
+          />
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">Action</Label>
+          <div className="flex items-center gap-2">
+            <Input
+              list="audit-actions"
+              value={currentAction}
+              onChange={(e) => setAction(e.target.value)}
+              placeholder={prefixMode ? 'e.g. ticket.' : 'e.g. ticket.created'}
+              className="h-9"
+            />
+            <datalist id="audit-actions">
+              {actions.map((a) => (
+                <option key={a} value={a} />
+              ))}
+            </datalist>
+          </div>
+          <div className="flex items-center gap-2 pt-1">
+            <Switch id="audit-prefix-mode" checked={prefixMode} onCheckedChange={togglePrefix} />
+            <Label htmlFor="audit-prefix-mode" className="text-[11px] font-normal">
+              Match as prefix
+            </Label>
+          </div>
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">Actor email</Label>
+          <Input
+            type="search"
+            value={actorEmail}
+            onChange={(e) => setActorEmail(e.target.value)}
+            placeholder="name@example.com"
+            className="h-9"
+          />
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">Target type</Label>
+          <Input
+            value={targetType}
+            onChange={(e) => setTargetType(e.target.value)}
+            onBlur={commitTargetType}
+            onKeyDown={(e) => {
+              if (e.key === 'Enter') {
+                e.preventDefault()
+                commitTargetType()
+              }
+            }}
+            placeholder="e.g. ticket"
+            className="h-9"
+          />
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">Target ID</Label>
+          <Input
+            value={targetId}
+            onChange={(e) => setTargetId(e.target.value)}
+            onBlur={commitTargetId}
+            onKeyDown={(e) => {
+              if (e.key === 'Enter') {
+                e.preventDefault()
+                commitTargetId()
+              }
+            }}
+            placeholder="ticket_..."
+            className="h-9"
+          />
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">Source</Label>
+          <Select value={value.source ?? ALL} onValueChange={setSource}>
+            <SelectTrigger className="h-9">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem value={ALL}>Any</SelectItem>
+              {SOURCES.map((s) => (
+                <SelectItem key={s} value={s}>
+                  {s}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">Range</Label>
+          <Select value={timeRange} onValueChange={(next) => setRange(next as AuditTimeRange)}>
+            <SelectTrigger className="h-9">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              {TIME_RANGES.map((range) => (
+                <SelectItem key={range.value} value={range.value}>
+                  {range.label}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">From</Label>
+          <Input
+            type="datetime-local"
+            value={isoToLocal(value.fromIso)}
+            onChange={(e) => setFrom(e.target.value)}
+            className="h-9"
+          />
+        </div>
+
+        <div className="space-y-1">
+          <Label className="text-xs">To</Label>
+          <Input
+            type="datetime-local"
+            value={isoToLocal(value.toIso)}
+            onChange={(e) => setTo(e.target.value)}
+            className="h-9"
+          />
+        </div>
+      </div>
+
+      <div className="flex justify-end">
+        <Button variant="ghost" size="sm" onClick={clearAll} disabled={!hasFilters}>
+          Clear filters
+        </Button>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-channel-dialog.test.tsx b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-channel-dialog.test.tsx
new file mode 100644
index 000000000..30bc40724
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-channel-dialog.test.tsx
@@ -0,0 +1,341 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { InboxChannelDialog } from '../inbox-channel-dialog'
+
+type MutationOptions = {
+  mutationFn: () => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  addInboxChannelFn: vi.fn(),
+  updateInboxChannelFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/dialog', () => {
+  let openDialog: (open: boolean) => void = () => undefined
+  let currentOpen = false
+
+  return {
+    Dialog: ({
+      open,
+      onOpenChange,
+      children,
+    }: {
+      open: boolean
+      onOpenChange: (open: boolean) => void
+      children: ReactNode
+    }) => {
+      currentOpen = open
+      openDialog = onOpenChange
+      return <div>{children}</div>
+    },
+    DialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => (
+      <button type="button" onClick={() => openDialog(true)}>
+        {children}
+      </button>
+    ),
+    DialogContent: ({ children }: { children: ReactNode; className?: string }) =>
+      currentOpen ? <section role="dialog">{children}</section> : null,
+    DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+    DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+    DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+    DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+  }
+})
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    type?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    placeholder?: string
+    required?: boolean
+    maxLength?: number
+    autoComplete?: string
+  }) => <input id={id} type={type} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input id={id} type="checkbox" checked={checked} onChange={() => onCheckedChange(!checked)} />
+  ),
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    disabled,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    disabled?: boolean
+    children: ReactNode
+  }) => (
+    <select
+      aria-label="Kind"
+      value={value}
+      disabled={disabled}
+      onChange={(event) => onValueChange(event.currentTarget.value)}
+    >
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/lib/server/functions/inboxes', () => ({
+  addInboxChannelFn: mocks.addInboxChannelFn,
+  updateInboxChannelFn: mocks.updateInboxChannelFn,
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    channels: (inboxId: string) => ({ queryKey: ['inboxes', inboxId, 'channels'] }),
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function renderDialog(channel?: React.ComponentProps<typeof InboxChannelDialog>['channel']) {
+  return render(
+    <InboxChannelDialog
+      inboxId={'inbox_1' as never}
+      channel={channel}
+      trigger={<span>Open channel dialog</span>}
+    />
+  )
+}
+
+function openDialog() {
+  fireEvent.click(screen.getByRole('button', { name: 'Open channel dialog' }))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.addInboxChannelFn.mockResolvedValue({ id: 'inbox_channel_new' })
+  mocks.updateInboxChannelFn.mockResolvedValue({ id: 'inbox_channel_1' })
+})
+
+describe('InboxChannelDialog', () => {
+  it('creates an email channel with trimmed config and invalidates channel queries', async () => {
+    renderDialog()
+    openDialog()
+
+    expect(screen.getByRole('heading', { name: 'Add channel' })).toBeInTheDocument()
+    expect(screen.getByText('No additional configuration required.')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Add channel' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Label is required')
+
+    fireEvent.change(screen.getByLabelText('Kind'), { target: { value: 'email' } })
+    fireEvent.change(screen.getByLabelText('Label'), {
+      target: { value: '  Email support  ' },
+    })
+    fireEvent.change(screen.getByLabelText('External ID'), {
+      target: { value: '  provider-123  ' },
+    })
+    fireEvent.change(screen.getByLabelText('Mailbox'), {
+      target: { value: '  support@example.com  ' },
+    })
+    fireEvent.change(screen.getByLabelText('Forwarding address'), {
+      target: { value: '  forward@example.com  ' },
+    })
+    fireEvent.click(screen.getByLabelText('Enabled'))
+    fireEvent.click(screen.getByRole('button', { name: 'Add channel' }))
+
+    await waitFor(() => {
+      expect(mocks.addInboxChannelFn).toHaveBeenCalledWith({
+        data: {
+          inboxId: 'inbox_1',
+          kind: 'email',
+          label: 'Email support',
+          externalId: 'provider-123',
+          enabled: false,
+          config: {
+            mailbox: 'support@example.com',
+            forwardingAddress: 'forward@example.com',
+          },
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['inboxes', 'inbox_1', 'channels'],
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Channel added')
+    await waitFor(() => {
+      expect(screen.queryByRole('heading', { name: 'Add channel' })).not.toBeInTheDocument()
+    })
+  })
+
+  it('creates a webhook channel with signing config and a write-only secret', async () => {
+    renderDialog()
+    openDialog()
+
+    fireEvent.change(screen.getByLabelText('Kind'), { target: { value: 'webhook' } })
+    fireEvent.change(screen.getByLabelText('Label'), { target: { value: 'Webhook' } })
+    fireEvent.change(screen.getByLabelText('External ID'), { target: { value: '  ' } })
+    fireEvent.change(screen.getByLabelText('Signing header'), {
+      target: { value: ' X-Hook-Signature ' },
+    })
+    fireEvent.change(screen.getByLabelText('Secret'), { target: { value: ' new-secret ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Add channel' }))
+
+    await waitFor(() => {
+      expect(mocks.addInboxChannelFn).toHaveBeenCalledWith({
+        data: expect.objectContaining({
+          kind: 'webhook',
+          label: 'Webhook',
+          externalId: null,
+          enabled: true,
+          config: {
+            signingHeader: 'X-Hook-Signature',
+            secret: 'new-secret',
+          },
+        }),
+      })
+    })
+  })
+
+  it('updates an existing webhook channel without changing its kind', async () => {
+    renderDialog({
+      id: 'inbox_channel_1',
+      kind: 'webhook',
+      label: 'Current webhook',
+      externalId: null,
+      enabled: false,
+      config: { signingHeader: 'X-Old-Signature', retained: 'value' },
+    } as never)
+    openDialog()
+
+    expect(screen.getByRole('heading', { name: 'Edit channel' })).toBeInTheDocument()
+    expect(screen.getByLabelText('Kind')).toBeDisabled()
+    expect(screen.getByText('Channel kind cannot change after creation.')).toBeInTheDocument()
+    expect(screen.getByLabelText('Enabled')).not.toBeChecked()
+
+    fireEvent.change(screen.getByLabelText('Label'), { target: { value: 'Updated webhook' } })
+    fireEvent.change(screen.getByLabelText('Signing header'), {
+      target: { value: ' X-New-Signature ' },
+    })
+    fireEvent.change(screen.getByLabelText(/Secret/), { target: { value: ' rotated ' } })
+    fireEvent.click(screen.getByLabelText('Enabled'))
+    fireEvent.click(screen.getByRole('button', { name: 'Save channel' }))
+
+    await waitFor(() => {
+      expect(mocks.updateInboxChannelFn).toHaveBeenCalledWith({
+        data: {
+          channelId: 'inbox_channel_1',
+          label: 'Updated webhook',
+          externalId: null,
+          enabled: true,
+          config: {
+            signingHeader: 'X-New-Signature',
+            retained: 'value',
+            secret: 'rotated',
+          },
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Channel updated')
+  })
+
+  it('cancels and reports update errors', async () => {
+    mocks.updateInboxChannelFn.mockRejectedValueOnce(new Error('Cannot update channel'))
+    renderDialog({
+      id: 'inbox_channel_1',
+      kind: 'api',
+      label: 'API',
+      externalId: 'api-1',
+      enabled: true,
+      config: null,
+    } as never)
+    openDialog()
+
+    expect(screen.getByText('No additional configuration required.')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+    expect(screen.queryByRole('heading', { name: 'Edit channel' })).not.toBeInTheDocument()
+
+    openDialog()
+    fireEvent.change(screen.getByLabelText('External ID'), { target: { value: '  ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save channel' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Cannot update channel')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-channels-tab.test.tsx b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-channels-tab.test.tsx
new file mode 100644
index 000000000..102bf738b
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-channels-tab.test.tsx
@@ -0,0 +1,299 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { InboxChannelsTab } from '../inbox-channels-tab'
+
+type Channel = {
+  id: string
+  kind: string
+  label: string
+  externalId: string | null
+  enabled: boolean
+  archivedAt: string | null
+}
+
+type MutationOptions<TVars, TResult> = {
+  mutationFn: (vars: TVars) => Promise<TResult>
+  onSuccess?: (result: TResult) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  updateInboxChannelFn: vi.fn(),
+  archiveInboxChannelFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  permissionAllowed: true,
+  channels: [] as Channel[],
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: () => ({
+    data: mocks.channels,
+  }),
+  useMutation: <TVars, TResult>(options: MutationOptions<TVars, TResult>) => ({
+    isPending: false,
+    mutate: async (vars: TVars) => {
+      try {
+        const result = await options.mutationFn(vars)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+    fallback = null,
+  }: {
+    children: ReactNode
+    fallback?: ReactNode
+    permission: string
+  }) => (mocks.permissionAllowed ? <>{children}</> : <>{fallback}</>),
+}))
+
+vi.mock('../inbox-channel-dialog', () => ({
+  InboxChannelDialog: ({
+    trigger,
+    channel,
+  }: {
+    inboxId: string
+    trigger: ReactNode
+    channel?: Channel
+  }) => (
+    <div>
+      {trigger}
+      <span>{channel ? `Edit dialog for ${channel.label}` : 'Add channel dialog'}</span>
+    </div>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    checked,
+    disabled,
+    onCheckedChange,
+    'aria-label': ariaLabel,
+  }: {
+    checked: boolean
+    disabled?: boolean
+    onCheckedChange: (checked: boolean) => void
+    'aria-label'?: string
+  }) => (
+    <input
+      type="checkbox"
+      aria-label={ariaLabel}
+      checked={checked}
+      disabled={disabled}
+      onChange={() => onCheckedChange(!checked)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    className?: string
+  }) => <td colSpan={colSpan}>{children}</td>,
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  PencilSquareIcon: () => <span aria-hidden="true">pencil</span>,
+  PlusIcon: () => <span aria-hidden="true">plus</span>,
+  TrashIcon: () => <span aria-hidden="true">trash</span>,
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    channels: (inboxId: string) => ({ queryKey: ['inboxes', inboxId, 'channels'] }),
+  },
+}))
+
+vi.mock('@/lib/server/functions/inboxes', () => ({
+  updateInboxChannelFn: mocks.updateInboxChannelFn,
+  archiveInboxChannelFn: mocks.archiveInboxChannelFn,
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    INBOX_CHANNEL_MANAGE: 'inbox_channel.manage',
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.permissionAllowed = true
+  mocks.channels = [
+    {
+      id: 'channel_portal',
+      kind: 'portal',
+      label: 'Portal',
+      externalId: null,
+      enabled: true,
+      archivedAt: null,
+    },
+    {
+      id: 'channel_email',
+      kind: 'email',
+      label: 'Support email',
+      externalId: 'mailbox_1',
+      enabled: false,
+      archivedAt: '2026-06-01T00:00:00.000Z',
+    },
+    {
+      id: 'channel_custom',
+      kind: 'custom',
+      label: 'Custom channel',
+      externalId: 'custom_1',
+      enabled: true,
+      archivedAt: null,
+    },
+  ]
+  mocks.updateInboxChannelFn.mockResolvedValue({ id: 'channel_portal' })
+  mocks.archiveInboxChannelFn.mockResolvedValue(undefined)
+})
+
+describe('InboxChannelsTab', () => {
+  it('renders empty state and add-channel affordance', () => {
+    mocks.channels = []
+    render(<InboxChannelsTab inboxId={'inbox_1' as never} />)
+
+    expect(screen.getByText('No channels yet.')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Add channel' })).toBeInTheDocument()
+    expect(screen.getByText('Add channel dialog')).toBeInTheDocument()
+  })
+
+  it('renders channel rows with status, external id fallbacks and edit affordances', () => {
+    render(<InboxChannelsTab inboxId={'inbox_1' as never} />)
+
+    expect(screen.getByText('portal')).toBeInTheDocument()
+    expect(screen.getByText('email')).toBeInTheDocument()
+    expect(screen.getByText('custom')).toBeInTheDocument()
+    expect(screen.getByText('Portal')).toBeInTheDocument()
+    expect(screen.getByText('Support email')).toBeInTheDocument()
+    expect(screen.getByText('mailbox_1')).toBeInTheDocument()
+    expect(screen.getByText('—')).toBeInTheDocument()
+    expect(screen.getAllByText('Active')).toHaveLength(2)
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+    expect(screen.getByText('Edit dialog for Portal')).toBeInTheDocument()
+  })
+
+  it('toggles and archives active channels with cache invalidation', async () => {
+    render(<InboxChannelsTab inboxId={'inbox_1' as never} />)
+
+    fireEvent.click(screen.getAllByLabelText('Toggle channel enabled')[0])
+    await waitFor(() => {
+      expect(mocks.updateInboxChannelFn).toHaveBeenCalledWith({
+        data: { channelId: 'channel_portal', enabled: false },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['inboxes', 'inbox_1', 'channels'],
+    })
+
+    expect(screen.getAllByLabelText('Toggle channel enabled')[1]).toBeDisabled()
+    fireEvent.click(screen.getAllByRole('button', { name: 'Archive' })[0])
+    await waitFor(() => {
+      expect(mocks.archiveInboxChannelFn).toHaveBeenCalledWith({
+        data: { channelId: 'channel_portal' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Channel archived')
+  })
+
+  it('reports mutation errors and renders permission-denied fallback states', async () => {
+    mocks.updateInboxChannelFn.mockRejectedValueOnce(new Error('Toggle denied'))
+    mocks.archiveInboxChannelFn.mockRejectedValueOnce(new Error('Archive denied'))
+    render(<InboxChannelsTab inboxId={'inbox_1' as never} />)
+
+    fireEvent.click(screen.getAllByLabelText('Toggle channel enabled')[0])
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Toggle denied')
+    })
+    fireEvent.click(screen.getAllByRole('button', { name: 'Archive' })[0])
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Archive denied')
+    })
+
+    cleanup()
+    mocks.permissionAllowed = false
+    render(<InboxChannelsTab inboxId={'inbox_1' as never} />)
+
+    expect(screen.queryByRole('button', { name: 'Add channel' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Edit channel' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Archive channel' })).not.toBeInTheDocument()
+    expect(screen.getAllByText('on')).toHaveLength(2)
+    expect(screen.getByText('off')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-create-dialog.test.tsx b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-create-dialog.test.tsx
new file mode 100644
index 000000000..2f2e62488
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-create-dialog.test.tsx
@@ -0,0 +1,352 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { InboxCreateDialog } from '../inbox-create-dialog'
+
+type MutationOptions<T> = {
+  mutationFn: () => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  createInboxFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  navigate: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({
+    navigate: mocks.navigate,
+  }),
+}))
+
+vi.mock('@/components/ui/dialog', () => {
+  let openDialog: (open: boolean) => void = () => undefined
+  let currentOpen = false
+
+  return {
+    Dialog: ({
+      open,
+      onOpenChange,
+      children,
+    }: {
+      open: boolean
+      onOpenChange: (open: boolean) => void
+      children: ReactNode
+    }) => {
+      currentOpen = open
+      openDialog = onOpenChange
+      return <div>{children}</div>
+    },
+    DialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => (
+      <button type="button" onClick={() => openDialog(true)}>
+        {children}
+      </button>
+    ),
+    DialogContent: ({ children }: { children: ReactNode; className?: string }) =>
+      currentOpen ? <section role="dialog">{children}</section> : null,
+    DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+    DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+    DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+    DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+  }
+})
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    placeholder?: string
+    required?: boolean
+    maxLength?: number
+  }) => <input id={id} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+    rows,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLTextAreaElement>) => void
+    rows?: number
+  }) => <textarea id={id} value={value} onChange={onChange} rows={rows} />,
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select
+      aria-label={`select-${value}`}
+      value={value}
+      onChange={(event) => onValueChange(event.currentTarget.value)}
+    >
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({
+    value,
+    onValueChange,
+    placeholder,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    allowClear?: boolean
+    placeholder?: string
+  }) => (
+    <select
+      aria-label="Primary team"
+      value={value ?? ''}
+      onChange={(event) => onValueChange(event.currentTarget.value || null)}
+    >
+      <option value="">{placeholder ?? 'No team'}</option>
+      <option value="team_support">Support</option>
+      <option value="team_success">Success</option>
+    </select>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/status-picker', () => ({
+  StatusPicker: ({
+    value,
+    onValueChange,
+    placeholder,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    placeholder?: string
+  }) => (
+    <select
+      aria-label="Default status"
+      value={value ?? ''}
+      onChange={(event) => onValueChange(event.currentTarget.value || null)}
+    >
+      <option value="">{placeholder ?? 'Workspace default'}</option>
+      <option value="status_open">Open</option>
+      <option value="status_triage">Triage</option>
+    </select>
+  ),
+}))
+
+vi.mock('@/lib/server/functions/inboxes', () => ({
+  createInboxFn: mocks.createInboxFn,
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    list: () => ({ queryKey: ['inboxes', 'list'] }),
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function renderDialog() {
+  return render(<InboxCreateDialog trigger={<span>Open inbox dialog</span>} />)
+}
+
+function openDialog() {
+  fireEvent.click(screen.getByRole('button', { name: 'Open inbox dialog' }))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createInboxFn.mockResolvedValue({ id: 'inbox_created' })
+})
+
+describe('InboxCreateDialog', () => {
+  it('opens from the trigger and validates required slug and name fields', () => {
+    renderDialog()
+    expect(screen.queryByRole('heading', { name: 'New inbox' })).not.toBeInTheDocument()
+
+    openDialog()
+
+    expect(screen.getByRole('heading', { name: 'New inbox' })).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Create inbox' }))
+
+    expect(mocks.toastError).toHaveBeenCalledWith('Slug and name are required')
+    expect(mocks.createInboxFn).not.toHaveBeenCalled()
+  })
+
+  it('creates an inbox with trimmed defaults, invalidates inbox lists and navigates to detail', async () => {
+    renderDialog()
+    openDialog()
+
+    fireEvent.change(screen.getByLabelText('Slug'), { target: { value: 'SUPPORT' } })
+    expect(screen.getByLabelText('Slug')).toHaveValue('support')
+    fireEvent.change(screen.getByLabelText('Name'), {
+      target: { value: '  Customer Support  ' },
+    })
+    fireEvent.change(screen.getByLabelText('Description'), {
+      target: { value: '  All customer requests  ' },
+    })
+    fireEvent.change(screen.getByLabelText('Primary team'), {
+      target: { value: 'team_support' },
+    })
+    fireEvent.change(screen.getByLabelText('select-team'), { target: { value: 'shared' } })
+    fireEvent.change(screen.getByLabelText('select-normal'), { target: { value: 'urgent' } })
+    fireEvent.change(screen.getByLabelText('Default status'), {
+      target: { value: 'status_triage' },
+    })
+    fireEvent.change(screen.getByLabelText('Color'), { target: { value: '  #22c55e  ' } })
+    fireEvent.change(screen.getByLabelText('Icon'), { target: { value: '  InboxIcon  ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create inbox' }))
+
+    await waitFor(() => {
+      expect(mocks.createInboxFn).toHaveBeenCalledWith({
+        data: {
+          slug: 'support',
+          name: 'Customer Support',
+          description: 'All customer requests',
+          primaryTeamId: 'team_support',
+          defaultStatusId: 'status_triage',
+          defaultVisibilityScope: 'shared',
+          defaultPriority: 'urgent',
+          color: '#22c55e',
+          icon: 'InboxIcon',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['inboxes', 'list'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['inboxes'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Inbox created')
+    expect(mocks.navigate).toHaveBeenCalledWith({
+      to: '/admin/settings/inboxes/$inboxId',
+      params: { inboxId: 'inbox_created' },
+    })
+    await waitFor(() => {
+      expect(screen.queryByRole('heading', { name: 'New inbox' })).not.toBeInTheDocument()
+    })
+
+    openDialog()
+    expect(screen.getByLabelText('Slug')).toHaveValue('')
+    expect(screen.getByLabelText('Name')).toHaveValue('')
+    expect(screen.getByLabelText('Description')).toHaveValue('')
+    expect(screen.getByLabelText('Primary team')).toHaveValue('')
+    expect(screen.getByLabelText('Default status')).toHaveValue('')
+    expect(screen.getByLabelText('select-team')).toHaveValue('team')
+    expect(screen.getByLabelText('select-normal')).toHaveValue('normal')
+  })
+
+  it('submits nullable optional fields and keeps the dialog open when creation fails', async () => {
+    mocks.createInboxFn.mockRejectedValueOnce(new Error('Slug already exists'))
+
+    renderDialog()
+    openDialog()
+
+    fireEvent.change(screen.getByLabelText('Slug'), { target: { value: 'OPS' } })
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Operations  ' } })
+    fireEvent.change(screen.getByLabelText('Description'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Color'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Icon'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create inbox' }))
+
+    await waitFor(() => {
+      expect(mocks.createInboxFn).toHaveBeenCalledWith({
+        data: {
+          slug: 'ops',
+          name: 'Operations',
+          description: null,
+          primaryTeamId: null,
+          defaultStatusId: null,
+          defaultVisibilityScope: 'team',
+          defaultPriority: 'normal',
+          color: null,
+          icon: null,
+        },
+      })
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith('Slug already exists')
+    expect(mocks.invalidateQueries).not.toHaveBeenCalled()
+    expect(mocks.navigate).not.toHaveBeenCalled()
+    expect(screen.getByRole('heading', { name: 'New inbox' })).toBeInTheDocument()
+  })
+
+  it('closes the dialog without submitting when cancelled', () => {
+    renderDialog()
+    openDialog()
+
+    fireEvent.change(screen.getByLabelText('Slug'), { target: { value: 'support' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+
+    expect(mocks.createInboxFn).not.toHaveBeenCalled()
+    expect(screen.queryByRole('heading', { name: 'New inbox' })).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-list.test.tsx b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-list.test.tsx
new file mode 100644
index 000000000..378bce4af
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-list.test.tsx
@@ -0,0 +1,135 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { InboxList } from '../inbox-list'
+
+type InboxRow = {
+  id: string
+  name: string
+  slug: string
+  color: string | null
+  defaultPriority: string
+  defaultVisibilityScope: string
+  archivedAt: string | null
+}
+
+const mocks = vi.hoisted(() => ({
+  inboxes: [] as InboxRow[],
+  listParams: undefined as unknown,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: () => ({
+    data: mocks.inboxes,
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    params,
+    to,
+  }: {
+    children: ReactNode
+    params?: Record<string, string>
+    to: string
+    className?: string
+  }) => {
+    const href = Object.entries(params ?? {}).reduce(
+      (path, [key, value]) => path.replace(`$${key}`, value),
+      to
+    )
+    return <a href={href}>{children}</a>
+  },
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input
+      id={id}
+      type="checkbox"
+      checked={checked}
+      onChange={(event) => onCheckedChange(event.currentTarget.checked)}
+    />
+  ),
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    list: (params: unknown) => {
+      mocks.listParams = params
+      return { queryKey: ['inboxes', 'list', params] }
+    },
+  },
+}))
+
+function inbox(overrides: Partial<InboxRow> = {}): InboxRow {
+  return {
+    id: 'inbox_support',
+    name: 'Support',
+    slug: 'support',
+    color: '#22c55e',
+    defaultPriority: 'normal',
+    defaultVisibilityScope: 'team',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  mocks.inboxes = []
+  mocks.listParams = undefined
+})
+
+describe('InboxList', () => {
+  it('renders active inboxes by default and reveals archived rows through the toggle', () => {
+    mocks.inboxes = [
+      inbox(),
+      inbox({
+        id: 'inbox_archived',
+        name: 'Archived',
+        slug: 'archived',
+        color: null,
+        defaultPriority: 'urgent',
+        defaultVisibilityScope: 'private',
+        archivedAt: '2026-06-20T10:00:00.000Z',
+      }),
+    ]
+
+    render(<InboxList />)
+
+    expect(mocks.listParams).toEqual({ includeArchived: true })
+    expect(screen.getByRole('link', { name: /Support/ })).toHaveAttribute(
+      'href',
+      '/admin/settings/inboxes/inbox_support'
+    )
+    expect(screen.getByText('support')).toBeInTheDocument()
+    expect(screen.getByText('normal · team')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /Archived/ })).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getByLabelText('Show archived'))
+
+    expect(screen.getByRole('link', { name: /Archived/ })).toHaveAttribute(
+      'href',
+      '/admin/settings/inboxes/inbox_archived'
+    )
+    expect(screen.getByText('urgent · private')).toBeInTheDocument()
+    expect(screen.getAllByText('Archived')).toHaveLength(2)
+  })
+
+  it('renders an empty state when there are no visible inboxes', () => {
+    render(<InboxList />)
+
+    expect(screen.getByText('No inboxes yet.')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-overview-tab.test.tsx b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-overview-tab.test.tsx
new file mode 100644
index 000000000..05cd05a96
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/__tests__/inbox-overview-tab.test.tsx
@@ -0,0 +1,344 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { InboxOverviewTab } from '../inbox-overview-tab'
+
+type MutationOptions = {
+  mutationFn: () => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  updateInboxFn: vi.fn(),
+  archiveInboxFn: vi.fn(),
+  unarchiveInboxFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+    disabled,
+    readOnly,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    placeholder?: string
+    disabled?: boolean
+    readOnly?: boolean
+    required?: boolean
+    maxLength?: number
+    className?: string
+  }) => (
+    <input
+      id={id}
+      value={value}
+      onChange={onChange}
+      placeholder={placeholder}
+      disabled={disabled}
+      readOnly={readOnly}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLTextAreaElement>) => void
+    rows?: number
+  }) => <textarea id={id} value={value} onChange={onChange} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select value={value} onChange={(event) => onValueChange(event.currentTarget.value)}>
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('team_primary')}>
+        Pick primary team
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear primary team
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/status-picker', () => ({
+  StatusPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('ticket_status_default')}>
+        Pick default status
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear default status
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/lib/server/functions/inboxes', () => ({
+  updateInboxFn: mocks.updateInboxFn,
+  archiveInboxFn: mocks.archiveInboxFn,
+  unarchiveInboxFn: mocks.unarchiveInboxFn,
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    detail: (inboxId: string) => ({ queryKey: ['inboxes', inboxId, 'detail'] }),
+    list: () => ({ queryKey: ['inboxes', 'list'] }),
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function inbox(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'inbox_1',
+    slug: 'support',
+    name: 'Support inbox',
+    description: 'Customer questions',
+    primaryTeamId: null,
+    defaultStatusId: null,
+    defaultVisibilityScope: 'team',
+    defaultPriority: 'normal',
+    color: null,
+    icon: null,
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.updateInboxFn.mockResolvedValue({ id: 'inbox_1' })
+  mocks.archiveInboxFn.mockResolvedValue({ id: 'inbox_1' })
+  mocks.unarchiveInboxFn.mockResolvedValue({ id: 'inbox_1' })
+})
+
+describe('InboxOverviewTab', () => {
+  it('validates and saves normalized inbox overview settings', async () => {
+    render(<InboxOverviewTab inbox={inbox() as never} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Name is required')
+
+    fireEvent.change(screen.getByLabelText('Name'), {
+      target: { value: '  Priority support  ' },
+    })
+    fireEvent.change(screen.getByLabelText('Description'), {
+      target: { value: '  Handles urgent cases  ' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Pick primary team' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick default status' }))
+    fireEvent.change(screen.getAllByRole('combobox')[0], { target: { value: 'shared' } })
+    fireEvent.change(screen.getAllByRole('combobox')[1], { target: { value: 'urgent' } })
+    fireEvent.change(screen.getByLabelText('Color'), { target: { value: ' #22c55e ' } })
+    fireEvent.change(screen.getByLabelText('Icon'), { target: { value: ' InboxIcon ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateInboxFn).toHaveBeenCalledWith({
+        data: {
+          inboxId: 'inbox_1',
+          name: 'Priority support',
+          description: 'Handles urgent cases',
+          primaryTeamId: 'team_primary',
+          defaultStatusId: 'ticket_status_default',
+          defaultVisibilityScope: 'shared',
+          defaultPriority: 'urgent',
+          color: '#22c55e',
+          icon: 'InboxIcon',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['inboxes', 'inbox_1', 'detail'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['inboxes', 'list'] })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['inboxes'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Inbox updated')
+  })
+
+  it('saves nullable fields and reports update errors', async () => {
+    mocks.updateInboxFn.mockRejectedValueOnce(new Error('Update failed'))
+    render(
+      <InboxOverviewTab
+        inbox={
+          inbox({
+            description: null,
+            primaryTeamId: 'team_old',
+            defaultStatusId: 'ticket_status_old',
+            color: '#000000',
+            icon: 'OldIcon',
+          }) as never
+        }
+      />
+    )
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Support' } })
+    fireEvent.change(screen.getByLabelText('Description'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Clear primary team' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Clear default status' }))
+    fireEvent.change(screen.getByLabelText('Color'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Icon'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateInboxFn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            description: null,
+            primaryTeamId: null,
+            defaultStatusId: null,
+            color: null,
+            icon: null,
+          }),
+        })
+      )
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith('Update failed')
+  })
+
+  it('archives active inboxes and unarchives archived inboxes', async () => {
+    const { rerender } = render(<InboxOverviewTab inbox={inbox() as never} />)
+
+    expect(screen.getByText(/Hide this inbox from queues/)).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Archive' }))
+
+    await waitFor(() => {
+      expect(mocks.archiveInboxFn).toHaveBeenCalledWith({ data: { inboxId: 'inbox_1' } })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Inbox archived')
+
+    rerender(
+      <InboxOverviewTab inbox={inbox({ archivedAt: '2026-06-19T10:00:00.000Z' }) as never} />
+    )
+    fireEvent.click(screen.getByRole('button', { name: 'Unarchive' }))
+
+    await waitFor(() => {
+      expect(mocks.unarchiveInboxFn).toHaveBeenCalledWith({ data: { inboxId: 'inbox_1' } })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Inbox unarchived')
+  })
+
+  it('resets local form state when the inbox prop changes and reports archive errors', async () => {
+    mocks.archiveInboxFn.mockRejectedValueOnce(new Error('Archive failed'))
+    const { rerender } = render(<InboxOverviewTab inbox={inbox() as never} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Unsaved name' } })
+    rerender(
+      <InboxOverviewTab
+        inbox={inbox({ id: 'inbox_2', slug: 'sales', name: 'Sales inbox' }) as never}
+      />
+    )
+
+    expect(screen.getByLabelText('Name')).toHaveValue('Sales inbox')
+    fireEvent.click(screen.getByRole('button', { name: 'Archive' }))
+
+    await waitFor(() => {
+      expect(mocks.archiveInboxFn).toHaveBeenCalledWith({ data: { inboxId: 'inbox_2' } })
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith('Archive failed')
+  })
+})
diff --git a/apps/web/src/components/admin/settings/inboxes/inbox-channel-dialog.tsx b/apps/web/src/components/admin/settings/inboxes/inbox-channel-dialog.tsx
new file mode 100644
index 000000000..2cd25227c
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/inbox-channel-dialog.tsx
@@ -0,0 +1,278 @@
+/**
+ * Add/edit dialog for inbox channels. The channel kind is locked once created
+ * because the backend `updateInboxChannelFn` does not accept it. Per-kind
+ * config fields are intentionally minimal in v1; the backend stores them as
+ * an opaque jsonb record.
+ */
+import { useState, useEffect } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { InboxId, InboxChannelId } from '@quackback/ids'
+import type { InboxChannel } from '@/lib/shared/db-types'
+import { addInboxChannelFn, updateInboxChannelFn } from '@/lib/server/functions/inboxes'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Switch } from '@/components/ui/switch'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@/components/ui/dialog'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+
+const CHANNEL_KINDS = ['portal', 'email', 'api', 'widget', 'webhook'] as const
+type ChannelKind = (typeof CHANNEL_KINDS)[number]
+
+export interface InboxChannelDialogProps {
+  inboxId: InboxId
+  channel?: InboxChannel
+  trigger: React.ReactNode
+}
+
+export function InboxChannelDialog({ inboxId, channel, trigger }: InboxChannelDialogProps) {
+  const isEdit = channel != null
+  const [open, setOpen] = useState(false)
+  const qc = useQueryClient()
+
+  const initialConfig = (channel?.config ?? {}) as Record<string, string | undefined>
+
+  const [kind, setKind] = useState<ChannelKind>((channel?.kind as ChannelKind) ?? 'portal')
+  const [label, setLabel] = useState(channel?.label ?? '')
+  const [externalId, setExternalId] = useState(channel?.externalId ?? '')
+  const [enabled, setEnabled] = useState(channel?.enabled ?? true)
+
+  // Per-kind config inputs.
+  const [mailbox, setMailbox] = useState(String(initialConfig.mailbox ?? ''))
+  const [forwardingAddress, setForwardingAddress] = useState(
+    String(initialConfig.forwardingAddress ?? '')
+  )
+  const [secret, setSecret] = useState('')
+  const [signingHeader, setSigningHeader] = useState(String(initialConfig.signingHeader ?? ''))
+
+  useEffect(() => {
+    if (!open) return
+    setKind((channel?.kind as ChannelKind) ?? 'portal')
+    setLabel(channel?.label ?? '')
+    setExternalId(channel?.externalId ?? '')
+    setEnabled(channel?.enabled ?? true)
+    const cfg = (channel?.config ?? {}) as Record<string, string | undefined>
+    setMailbox(String(cfg.mailbox ?? ''))
+    setForwardingAddress(String(cfg.forwardingAddress ?? ''))
+    setSecret('')
+    setSigningHeader(String(cfg.signingHeader ?? ''))
+  }, [channel, open])
+
+  const buildConfig = (): Record<string, unknown> => {
+    if (kind === 'email') {
+      return {
+        ...(mailbox.trim() ? { mailbox: mailbox.trim() } : {}),
+        ...(forwardingAddress.trim() ? { forwardingAddress: forwardingAddress.trim() } : {}),
+      }
+    }
+    if (kind === 'webhook') {
+      const merged: Record<string, unknown> = {
+        ...(channel?.config ?? {}),
+        ...(signingHeader.trim() ? { signingHeader: signingHeader.trim() } : {}),
+      }
+      // Only persist secret if user typed one (write-only field).
+      if (secret.trim()) merged.secret = secret.trim()
+      return merged
+    }
+    return {}
+  }
+
+  const invalidate = () =>
+    qc.invalidateQueries({ queryKey: inboxQueries.channels(inboxId).queryKey })
+
+  const createMutation = useMutation({
+    mutationFn: () =>
+      addInboxChannelFn({
+        data: {
+          inboxId,
+          kind,
+          label: label.trim(),
+          externalId: externalId.trim() || null,
+          enabled,
+          config: buildConfig(),
+        },
+      }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Channel added')
+      setOpen(false)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const updateMutation = useMutation({
+    mutationFn: () =>
+      updateInboxChannelFn({
+        data: {
+          channelId: channel!.id as InboxChannelId,
+          label: label.trim(),
+          externalId: externalId.trim() || null,
+          enabled,
+          config: buildConfig(),
+        },
+      }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Channel updated')
+      setOpen(false)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const submitting = createMutation.isPending || updateMutation.isPending
+
+  return (
+    <Dialog open={open} onOpenChange={setOpen}>
+      <DialogTrigger asChild>{trigger}</DialogTrigger>
+      <DialogContent className="max-w-md">
+        <DialogHeader>
+          <DialogTitle>{isEdit ? 'Edit channel' : 'Add channel'}</DialogTitle>
+          <DialogDescription>Channels feed tickets into this inbox.</DialogDescription>
+        </DialogHeader>
+
+        <form
+          onSubmit={(e) => {
+            e.preventDefault()
+            if (!label.trim()) {
+              toast.error('Label is required')
+              return
+            }
+            if (isEdit) updateMutation.mutate()
+            else createMutation.mutate()
+          }}
+          className="space-y-3"
+        >
+          <div className="space-y-1">
+            <Label>Kind</Label>
+            <Select value={kind} onValueChange={(v) => setKind(v as ChannelKind)} disabled={isEdit}>
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {CHANNEL_KINDS.map((k) => (
+                  <SelectItem key={k} value={k}>
+                    {k}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            {isEdit && (
+              <p className="text-[11px] text-muted-foreground">
+                Channel kind cannot change after creation.
+              </p>
+            )}
+          </div>
+
+          <div className="space-y-1">
+            <Label htmlFor="channel-label">Label</Label>
+            <Input
+              id="channel-label"
+              value={label}
+              onChange={(e) => setLabel(e.target.value)}
+              required
+              maxLength={200}
+            />
+          </div>
+
+          <div className="space-y-1">
+            <Label htmlFor="channel-external-id">External ID</Label>
+            <Input
+              id="channel-external-id"
+              value={externalId}
+              onChange={(e) => setExternalId(e.target.value)}
+              maxLength={200}
+              placeholder="provider-side identifier"
+            />
+          </div>
+
+          {kind === 'email' && (
+            <>
+              <div className="space-y-1">
+                <Label htmlFor="ch-mailbox">Mailbox</Label>
+                <Input
+                  id="ch-mailbox"
+                  value={mailbox}
+                  onChange={(e) => setMailbox(e.target.value)}
+                  placeholder="support@example.com"
+                />
+              </div>
+              <div className="space-y-1">
+                <Label htmlFor="ch-forwarding">Forwarding address</Label>
+                <Input
+                  id="ch-forwarding"
+                  value={forwardingAddress}
+                  onChange={(e) => setForwardingAddress(e.target.value)}
+                  placeholder="optional"
+                />
+              </div>
+            </>
+          )}
+
+          {kind === 'webhook' && (
+            <>
+              <div className="space-y-1">
+                <Label htmlFor="ch-signing-header">Signing header</Label>
+                <Input
+                  id="ch-signing-header"
+                  value={signingHeader}
+                  onChange={(e) => setSigningHeader(e.target.value)}
+                  placeholder="X-Webhook-Signature"
+                />
+              </div>
+              <div className="space-y-1">
+                <Label htmlFor="ch-secret">
+                  Secret {isEdit && '(leave blank to keep current)'}
+                </Label>
+                <Input
+                  id="ch-secret"
+                  type="password"
+                  value={secret}
+                  onChange={(e) => setSecret(e.target.value)}
+                  autoComplete="new-password"
+                />
+              </div>
+            </>
+          )}
+
+          {(kind === 'portal' || kind === 'widget' || kind === 'api') && (
+            <p className="text-xs text-muted-foreground border border-border/50 rounded p-2">
+              No additional configuration required.
+            </p>
+          )}
+
+          <div className="flex items-center gap-2">
+            <Switch id="ch-enabled" checked={enabled} onCheckedChange={setEnabled} />
+            <Label htmlFor="ch-enabled" className="font-normal">
+              Enabled
+            </Label>
+          </div>
+
+          <DialogFooter>
+            <Button type="button" variant="outline" onClick={() => setOpen(false)}>
+              Cancel
+            </Button>
+            <Button type="submit" disabled={submitting}>
+              {submitting ? 'Saving…' : isEdit ? 'Save channel' : 'Add channel'}
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/inboxes/inbox-channels-tab.tsx b/apps/web/src/components/admin/settings/inboxes/inbox-channels-tab.tsx
new file mode 100644
index 000000000..8498800b2
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/inbox-channels-tab.tsx
@@ -0,0 +1,216 @@
+/**
+ * Channels tab for an inbox detail page. Lists existing channels with inline
+ * enable toggles + edit + archive buttons. Add/edit/archive are gated by the
+ * `INBOX_CHANNEL_MANAGE` permission.
+ */
+import { useSuspenseQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { InboxId, InboxChannelId } from '@quackback/ids'
+import { updateInboxChannelFn, archiveInboxChannelFn } from '@/lib/server/functions/inboxes'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Switch } from '@/components/ui/switch'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { TrashIcon, PencilSquareIcon, PlusIcon } from '@heroicons/react/24/outline'
+import { InboxChannelDialog } from './inbox-channel-dialog'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const KIND_COLORS: Record<string, string> = {
+  portal: 'bg-blue-100 text-blue-900 dark:bg-blue-950/40 dark:text-blue-200',
+  email: 'bg-amber-100 text-amber-900 dark:bg-amber-950/40 dark:text-amber-200',
+  api: 'bg-violet-100 text-violet-900 dark:bg-violet-950/40 dark:text-violet-200',
+  widget: 'bg-emerald-100 text-emerald-900 dark:bg-emerald-950/40 dark:text-emerald-200',
+  webhook: 'bg-rose-100 text-rose-900 dark:bg-rose-950/40 dark:text-rose-200',
+}
+
+export function InboxChannelsTab({ inboxId }: { inboxId: InboxId }) {
+  const qc = useQueryClient()
+  const { data: channels } = useSuspenseQuery(inboxQueries.channels(inboxId))
+
+  const invalidate = () =>
+    qc.invalidateQueries({ queryKey: inboxQueries.channels(inboxId).queryKey })
+
+  const toggleMutation = useMutation({
+    mutationFn: (vars: { channelId: InboxChannelId; enabled: boolean }) =>
+      updateInboxChannelFn({ data: { channelId: vars.channelId, enabled: vars.enabled } }),
+    onSuccess: () => invalidate(),
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const archiveMutation = useMutation({
+    mutationFn: (channelId: InboxChannelId) => archiveInboxChannelFn({ data: { channelId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Channel archived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-3 max-w-4xl">
+      <div className="flex items-center justify-between">
+        <div>
+          <h2 className="text-sm font-semibold">Channels</h2>
+          <p className="text-xs text-muted-foreground">
+            Sources that can create tickets in this inbox.
+          </p>
+        </div>
+        <PermissionGate permission={PERMISSIONS.INBOX_CHANNEL_MANAGE}>
+          <InboxChannelDialog
+            inboxId={inboxId}
+            trigger={
+              <Button size="sm">
+                <PlusIcon className="h-4 w-4 mr-1" />
+                Add channel
+              </Button>
+            }
+          />
+        </PermissionGate>
+      </div>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Kind</TableHead>
+              <TableHead>Label</TableHead>
+              <TableHead>External ID</TableHead>
+              <TableHead className="w-20">Enabled</TableHead>
+              <TableHead className="w-24">Status</TableHead>
+              <TableHead className="w-24" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {channels.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={6} className="text-center text-sm text-muted-foreground py-6">
+                  No channels yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              channels.map((ch) => (
+                <TableRow key={ch.id}>
+                  <TableCell>
+                    <span
+                      className={`text-[10px] uppercase tracking-wide px-1.5 py-0.5 rounded font-medium ${
+                        KIND_COLORS[ch.kind] ?? 'bg-muted text-foreground'
+                      }`}
+                    >
+                      {ch.kind}
+                    </span>
+                  </TableCell>
+                  <TableCell className="font-medium">{ch.label}</TableCell>
+                  <TableCell className="font-mono text-xs text-muted-foreground">
+                    {ch.externalId ?? '—'}
+                  </TableCell>
+                  <TableCell>
+                    <PermissionGate
+                      permission={PERMISSIONS.INBOX_CHANNEL_MANAGE}
+                      fallback={
+                        <Badge variant="outline" className="text-[10px]">
+                          {ch.enabled ? 'on' : 'off'}
+                        </Badge>
+                      }
+                    >
+                      <Switch
+                        checked={ch.enabled}
+                        disabled={ch.archivedAt != null || toggleMutation.isPending}
+                        onCheckedChange={(v) =>
+                          toggleMutation.mutate({
+                            channelId: ch.id as InboxChannelId,
+                            enabled: v,
+                          })
+                        }
+                        aria-label="Toggle channel enabled"
+                      />
+                    </PermissionGate>
+                  </TableCell>
+                  <TableCell>
+                    {ch.archivedAt ? (
+                      <Badge variant="outline" className="text-muted-foreground">
+                        Archived
+                      </Badge>
+                    ) : (
+                      <Badge variant="outline">Active</Badge>
+                    )}
+                  </TableCell>
+                  <TableCell>
+                    <PermissionGate permission={PERMISSIONS.INBOX_CHANNEL_MANAGE}>
+                      <div className="flex items-center gap-1 justify-end">
+                        <InboxChannelDialog
+                          inboxId={inboxId}
+                          channel={ch}
+                          trigger={
+                            <Button
+                              variant="ghost"
+                              size="sm"
+                              className="h-7 w-7 p-0"
+                              aria-label="Edit channel"
+                            >
+                              <PencilSquareIcon className="h-3.5 w-3.5" />
+                            </Button>
+                          }
+                        />
+                        {ch.archivedAt == null && (
+                          <AlertDialog>
+                            <AlertDialogTrigger asChild>
+                              <Button
+                                variant="ghost"
+                                size="sm"
+                                className="h-7 w-7 p-0"
+                                aria-label="Archive channel"
+                              >
+                                <TrashIcon className="h-3.5 w-3.5" />
+                              </Button>
+                            </AlertDialogTrigger>
+                            <AlertDialogContent>
+                              <AlertDialogHeader>
+                                <AlertDialogTitle>Archive channel?</AlertDialogTitle>
+                                <AlertDialogDescription>
+                                  Tickets that arrived via this channel are kept; new tickets will
+                                  no longer flow through it.
+                                </AlertDialogDescription>
+                              </AlertDialogHeader>
+                              <AlertDialogFooter>
+                                <AlertDialogCancel>Cancel</AlertDialogCancel>
+                                <AlertDialogAction
+                                  onClick={() => archiveMutation.mutate(ch.id as InboxChannelId)}
+                                >
+                                  Archive
+                                </AlertDialogAction>
+                              </AlertDialogFooter>
+                            </AlertDialogContent>
+                          </AlertDialog>
+                        )}
+                      </div>
+                    </PermissionGate>
+                  </TableCell>
+                </TableRow>
+              ))
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/inboxes/inbox-create-dialog.tsx b/apps/web/src/components/admin/settings/inboxes/inbox-create-dialog.tsx
new file mode 100644
index 000000000..b596668ad
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/inbox-create-dialog.tsx
@@ -0,0 +1,245 @@
+/**
+ * Create-inbox dialog. Captures slug + display name + a few defaults; submit
+ * calls `createInboxFn`, then navigates to the new inbox detail page.
+ */
+import { useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import type { TeamId, TicketStatusId, InboxId } from '@quackback/ids'
+import { createInboxFn } from '@/lib/server/functions/inboxes'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@/components/ui/dialog'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import { StatusPicker } from '@/components/admin/shared/status-picker'
+
+const PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+const VISIBILITY = ['team', 'org', 'shared', 'private'] as const
+
+export function InboxCreateDialog({ trigger }: { trigger: React.ReactNode }) {
+  const [open, setOpen] = useState(false)
+  const router = useRouter()
+  const qc = useQueryClient()
+
+  const [slug, setSlug] = useState('')
+  const [name, setName] = useState('')
+  const [description, setDescription] = useState('')
+  const [primaryTeamId, setPrimaryTeamId] = useState<TeamId | null>(null)
+  const [defaultStatusId, setDefaultStatusId] = useState<TicketStatusId | null>(null)
+  const [defaultVisibilityScope, setDefaultVisibilityScope] =
+    useState<(typeof VISIBILITY)[number]>('team')
+  const [defaultPriority, setDefaultPriority] = useState<(typeof PRIORITIES)[number]>('normal')
+  const [color, setColor] = useState('')
+  const [icon, setIcon] = useState('')
+
+  const reset = () => {
+    setSlug('')
+    setName('')
+    setDescription('')
+    setPrimaryTeamId(null)
+    setDefaultStatusId(null)
+    setDefaultVisibilityScope('team')
+    setDefaultPriority('normal')
+    setColor('')
+    setIcon('')
+  }
+
+  const mutation = useMutation({
+    mutationFn: () =>
+      createInboxFn({
+        data: {
+          slug: slug.trim(),
+          name: name.trim(),
+          description: description.trim() || null,
+          primaryTeamId: primaryTeamId ?? null,
+          defaultStatusId: defaultStatusId ?? null,
+          defaultVisibilityScope,
+          defaultPriority,
+          color: color.trim() || null,
+          icon: icon.trim() || null,
+        },
+      }),
+    onSuccess: (inbox) => {
+      qc.invalidateQueries({ queryKey: inboxQueries.list().queryKey })
+      qc.invalidateQueries({ queryKey: ['inboxes'] })
+      toast.success('Inbox created')
+      setOpen(false)
+      reset()
+      router.navigate({
+        to: '/admin/settings/inboxes/$inboxId',
+        params: { inboxId: inbox.id as InboxId },
+      })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <Dialog open={open} onOpenChange={setOpen}>
+      <DialogTrigger asChild>{trigger}</DialogTrigger>
+      <DialogContent className="max-w-lg">
+        <DialogHeader>
+          <DialogTitle>New inbox</DialogTitle>
+          <DialogDescription>
+            An inbox is a named queue with its own channels, members and routing defaults.
+          </DialogDescription>
+        </DialogHeader>
+
+        <form
+          onSubmit={(e) => {
+            e.preventDefault()
+            if (!slug.trim() || !name.trim()) {
+              toast.error('Slug and name are required')
+              return
+            }
+            mutation.mutate()
+          }}
+          className="space-y-3"
+        >
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-1">
+              <Label htmlFor="slug">Slug</Label>
+              <Input
+                id="slug"
+                value={slug}
+                onChange={(e) => setSlug(e.target.value.toLowerCase())}
+                placeholder="support"
+                required
+                maxLength={100}
+              />
+            </div>
+            <div className="space-y-1">
+              <Label htmlFor="name">Name</Label>
+              <Input
+                id="name"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                placeholder="Customer support"
+                required
+                maxLength={200}
+              />
+            </div>
+          </div>
+
+          <div className="space-y-1">
+            <Label htmlFor="description">Description</Label>
+            <Textarea
+              id="description"
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+              rows={2}
+            />
+          </div>
+
+          <div className="space-y-1">
+            <Label>Primary team</Label>
+            <TeamPicker
+              value={primaryTeamId}
+              onValueChange={setPrimaryTeamId}
+              allowClear
+              placeholder="No team"
+            />
+          </div>
+
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-1">
+              <Label>Default visibility</Label>
+              <Select
+                value={defaultVisibilityScope}
+                onValueChange={(v) => setDefaultVisibilityScope(v as (typeof VISIBILITY)[number])}
+              >
+                <SelectTrigger>
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {VISIBILITY.map((v) => (
+                    <SelectItem key={v} value={v}>
+                      {v}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="space-y-1">
+              <Label>Default priority</Label>
+              <Select
+                value={defaultPriority}
+                onValueChange={(v) => setDefaultPriority(v as (typeof PRIORITIES)[number])}
+              >
+                <SelectTrigger>
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {PRIORITIES.map((p) => (
+                    <SelectItem key={p} value={p}>
+                      {p}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+          </div>
+
+          <div className="space-y-1">
+            <Label>Default status</Label>
+            <StatusPicker
+              value={defaultStatusId}
+              onValueChange={setDefaultStatusId}
+              placeholder="Workspace default"
+            />
+          </div>
+
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-1">
+              <Label htmlFor="color">Color</Label>
+              <Input
+                id="color"
+                value={color}
+                onChange={(e) => setColor(e.target.value)}
+                placeholder="#22c55e"
+                maxLength={16}
+              />
+            </div>
+            <div className="space-y-1">
+              <Label htmlFor="icon">Icon</Label>
+              <Input
+                id="icon"
+                value={icon}
+                onChange={(e) => setIcon(e.target.value)}
+                placeholder="InboxIcon"
+                maxLength={64}
+              />
+            </div>
+          </div>
+
+          <DialogFooter>
+            <Button type="button" variant="outline" onClick={() => setOpen(false)}>
+              Cancel
+            </Button>
+            <Button type="submit" disabled={mutation.isPending}>
+              {mutation.isPending ? 'Creating…' : 'Create inbox'}
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/inboxes/inbox-list.tsx b/apps/web/src/components/admin/settings/inboxes/inbox-list.tsx
new file mode 100644
index 000000000..c75b77700
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/inbox-list.tsx
@@ -0,0 +1,97 @@
+/**
+ * `<InboxList />` — table of all inboxes with name (color dot), slug, primary
+ * team, defaults summary, and active/archived chip. Row click navigates to
+ * the detail page. The "Show archived" toggle reveals soft-deleted rows.
+ */
+import { useState, useMemo } from 'react'
+import { Link } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { InboxId } from '@quackback/ids'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+import { Switch } from '@/components/ui/switch'
+import { Label } from '@/components/ui/label'
+
+export function InboxList() {
+  const [showArchived, setShowArchived] = useState(false)
+  const { data: inboxes } = useSuspenseQuery(inboxQueries.list({ includeArchived: true }))
+
+  const rows = useMemo(
+    () => (showArchived ? inboxes : inboxes.filter((i) => i.archivedAt == null)),
+    [inboxes, showArchived]
+  )
+
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center justify-end gap-2">
+        <Switch id="show-archived" checked={showArchived} onCheckedChange={setShowArchived} />
+        <Label htmlFor="show-archived" className="text-xs font-normal">
+          Show archived
+        </Label>
+      </div>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead>Slug</TableHead>
+              <TableHead>Defaults</TableHead>
+              <TableHead className="w-24">Status</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {rows.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={4} className="text-center text-sm text-muted-foreground py-6">
+                  No inboxes yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              rows.map((inbox) => (
+                <TableRow key={inbox.id} className="cursor-pointer hover:bg-muted/50">
+                  <TableCell className="font-medium">
+                    <Link
+                      to="/admin/settings/inboxes/$inboxId"
+                      params={{ inboxId: inbox.id as InboxId }}
+                      className="flex items-center gap-2"
+                    >
+                      <span
+                        className="inline-block h-2.5 w-2.5 rounded-full border border-border/50"
+                        style={{ backgroundColor: inbox.color ?? 'transparent' }}
+                      />
+                      <span className="truncate">{inbox.name}</span>
+                    </Link>
+                  </TableCell>
+                  <TableCell className="font-mono text-xs text-muted-foreground">
+                    {inbox.slug}
+                  </TableCell>
+                  <TableCell className="text-xs text-muted-foreground">
+                    {inbox.defaultPriority} · {inbox.defaultVisibilityScope}
+                  </TableCell>
+                  <TableCell>
+                    {inbox.archivedAt ? (
+                      <Badge variant="outline" className="text-muted-foreground">
+                        Archived
+                      </Badge>
+                    ) : (
+                      <Badge variant="outline">Active</Badge>
+                    )}
+                  </TableCell>
+                </TableRow>
+              ))
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/inboxes/inbox-members-tab.tsx b/apps/web/src/components/admin/settings/inboxes/inbox-members-tab.tsx
new file mode 100644
index 000000000..5800224c8
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/inbox-members-tab.tsx
@@ -0,0 +1,267 @@
+/**
+ * Members tab for an inbox detail page. Lists current memberships with role
+ * inline-edit + remove. Adds members via `<PrincipalPicker>` filtered to
+ * exclude already-present principals.
+ */
+import { useState, useMemo } from 'react'
+import { useSuspenseQuery, useMutation, useQueryClient, useQuery } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { InboxId, PrincipalId, InboxMembershipId } from '@quackback/ids'
+import {
+  addInboxMembershipFn,
+  updateInboxMembershipRoleFn,
+  removeInboxMembershipFn,
+} from '@/lib/server/functions/inboxes'
+import { getPrincipalsByIdsFn } from '@/lib/server/functions/principals'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import { Button } from '@/components/ui/button'
+import { Avatar } from '@/components/ui/avatar'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { TrashIcon } from '@heroicons/react/24/outline'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const ROLES = ['owner', 'agent', 'viewer'] as const
+type MembershipRole = (typeof ROLES)[number]
+
+export function InboxMembersTab({ inboxId }: { inboxId: InboxId }) {
+  const qc = useQueryClient()
+  const { data: memberships } = useSuspenseQuery(inboxQueries.memberships(inboxId))
+
+  const principalIds = useMemo(
+    () => memberships.map((m) => m.principalId as PrincipalId),
+    [memberships]
+  )
+
+  const principalsQuery = useQuery({
+    queryKey: ['principals', 'byIds', principalIds],
+    queryFn: () => getPrincipalsByIdsFn({ data: { ids: principalIds } }),
+    enabled: principalIds.length > 0,
+    staleTime: 60_000,
+  })
+  const principalMap = useMemo(() => {
+    const m = new Map<string, { displayName: string | null; avatarUrl: string | null }>()
+    for (const p of principalsQuery.data ?? []) {
+      m.set(p.id, { displayName: p.displayName, avatarUrl: p.avatarUrl })
+    }
+    return m
+  }, [principalsQuery.data])
+
+  const [addPrincipalId, setAddPrincipalId] = useState<PrincipalId | null>(null)
+  const [addRole, setAddRole] = useState<MembershipRole>('agent')
+
+  const invalidate = () =>
+    qc.invalidateQueries({ queryKey: inboxQueries.memberships(inboxId).queryKey })
+
+  const addMutation = useMutation({
+    mutationFn: () =>
+      addInboxMembershipFn({
+        data: { inboxId, principalId: addPrincipalId!, role: addRole },
+      }),
+    onSuccess: () => {
+      setAddPrincipalId(null)
+      setAddRole('agent')
+      invalidate()
+      toast.success('Member added')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const updateRoleMutation = useMutation({
+    mutationFn: (vars: { membershipId: InboxMembershipId; role: MembershipRole }) =>
+      updateInboxMembershipRoleFn({
+        data: { membershipId: vars.membershipId, role: vars.role },
+      }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Role updated')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const removeMutation = useMutation({
+    mutationFn: (membershipId: InboxMembershipId) =>
+      removeInboxMembershipFn({ data: { membershipId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Member removed')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-3 max-w-3xl">
+      <div>
+        <h2 className="text-sm font-semibold">Members</h2>
+        <p className="text-xs text-muted-foreground">
+          Principals who have explicit access to this inbox.
+        </p>
+      </div>
+
+      <PermissionGate permission={PERMISSIONS.INBOX_MANAGE}>
+        <div className="rounded border border-border/50 p-3 space-y-2">
+          <div className="grid grid-cols-[1fr,140px,auto] gap-2 items-end">
+            <div className="space-y-1">
+              <label className="text-xs font-medium text-muted-foreground">Add member</label>
+              <PrincipalPicker
+                value={addPrincipalId}
+                onValueChange={setAddPrincipalId}
+                excludeIds={principalIds}
+                placeholder="Pick principal…"
+              />
+            </div>
+            <div className="space-y-1">
+              <label className="text-xs font-medium text-muted-foreground">Role</label>
+              <Select value={addRole} onValueChange={(v) => setAddRole(v as MembershipRole)}>
+                <SelectTrigger>
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {ROLES.map((r) => (
+                    <SelectItem key={r} value={r}>
+                      {r}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <Button
+              size="sm"
+              disabled={!addPrincipalId || addMutation.isPending}
+              onClick={() => addMutation.mutate()}
+            >
+              Add
+            </Button>
+          </div>
+        </div>
+      </PermissionGate>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Member</TableHead>
+              <TableHead className="w-32">Role</TableHead>
+              <TableHead className="w-12" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {memberships.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={3} className="text-center text-sm text-muted-foreground py-6">
+                  No members yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              memberships.map((m) => {
+                const info = principalMap.get(m.principalId)
+                const label = info?.displayName ?? m.principalId
+                return (
+                  <TableRow key={m.id}>
+                    <TableCell>
+                      <div className="flex items-center gap-2">
+                        <Avatar className="h-6 w-6 text-[10px]">
+                          {info?.avatarUrl ? (
+                            <img src={info.avatarUrl} alt="" />
+                          ) : (
+                            label.slice(0, 2).toUpperCase()
+                          )}
+                        </Avatar>
+                        <span className="text-sm">{label}</span>
+                      </div>
+                    </TableCell>
+                    <TableCell>
+                      <PermissionGate
+                        permission={PERMISSIONS.INBOX_MANAGE}
+                        fallback={<span className="text-xs text-muted-foreground">{m.role}</span>}
+                      >
+                        <Select
+                          value={m.role}
+                          onValueChange={(v) =>
+                            updateRoleMutation.mutate({
+                              membershipId: m.id as InboxMembershipId,
+                              role: v as MembershipRole,
+                            })
+                          }
+                        >
+                          <SelectTrigger className="h-7 text-xs">
+                            <SelectValue />
+                          </SelectTrigger>
+                          <SelectContent>
+                            {ROLES.map((r) => (
+                              <SelectItem key={r} value={r}>
+                                {r}
+                              </SelectItem>
+                            ))}
+                          </SelectContent>
+                        </Select>
+                      </PermissionGate>
+                    </TableCell>
+                    <TableCell>
+                      <PermissionGate permission={PERMISSIONS.INBOX_MANAGE}>
+                        <AlertDialog>
+                          <AlertDialogTrigger asChild>
+                            <Button
+                              variant="ghost"
+                              size="sm"
+                              className="h-7 w-7 p-0"
+                              aria-label="Remove member"
+                            >
+                              <TrashIcon className="h-3.5 w-3.5" />
+                            </Button>
+                          </AlertDialogTrigger>
+                          <AlertDialogContent>
+                            <AlertDialogHeader>
+                              <AlertDialogTitle>Remove member?</AlertDialogTitle>
+                              <AlertDialogDescription>
+                                They will lose direct access to this inbox.
+                              </AlertDialogDescription>
+                            </AlertDialogHeader>
+                            <AlertDialogFooter>
+                              <AlertDialogCancel>Cancel</AlertDialogCancel>
+                              <AlertDialogAction
+                                onClick={() => removeMutation.mutate(m.id as InboxMembershipId)}
+                              >
+                                Remove
+                              </AlertDialogAction>
+                            </AlertDialogFooter>
+                          </AlertDialogContent>
+                        </AlertDialog>
+                      </PermissionGate>
+                    </TableCell>
+                  </TableRow>
+                )
+              })
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/inboxes/inbox-overview-tab.tsx b/apps/web/src/components/admin/settings/inboxes/inbox-overview-tab.tsx
new file mode 100644
index 000000000..5505b003d
--- /dev/null
+++ b/apps/web/src/components/admin/settings/inboxes/inbox-overview-tab.tsx
@@ -0,0 +1,297 @@
+/**
+ * Overview tab for an inbox detail page. Editable form for name/description/
+ * defaults plus an Archive / Unarchive button. Slug is read-only because
+ * `updateInboxFn` does not accept it.
+ */
+import { useState, useEffect } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { Inbox } from '@/lib/shared/db-types'
+import type { TeamId, TicketStatusId } from '@quackback/ids'
+import { updateInboxFn, archiveInboxFn, unarchiveInboxFn } from '@/lib/server/functions/inboxes'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import { StatusPicker } from '@/components/admin/shared/status-picker'
+
+const PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+const VISIBILITY = ['team', 'org', 'shared', 'private'] as const
+
+export interface InboxOverviewTabProps {
+  inbox: Inbox
+}
+
+export function InboxOverviewTab({ inbox }: InboxOverviewTabProps) {
+  const qc = useQueryClient()
+  const [name, setName] = useState(inbox.name)
+  const [description, setDescription] = useState(inbox.description ?? '')
+  const [primaryTeamId, setPrimaryTeamId] = useState<TeamId | null>(
+    inbox.primaryTeamId as TeamId | null
+  )
+  const [defaultStatusId, setDefaultStatusId] = useState<TicketStatusId | null>(
+    inbox.defaultStatusId as TicketStatusId | null
+  )
+  const [defaultVisibilityScope, setDefaultVisibilityScope] = useState<(typeof VISIBILITY)[number]>(
+    inbox.defaultVisibilityScope as (typeof VISIBILITY)[number]
+  )
+  const [defaultPriority, setDefaultPriority] = useState<(typeof PRIORITIES)[number]>(
+    inbox.defaultPriority as (typeof PRIORITIES)[number]
+  )
+  const [color, setColor] = useState(inbox.color ?? '')
+  const [icon, setIcon] = useState(inbox.icon ?? '')
+
+  // Reset local state when the inbox prop changes (after a refetch).
+  useEffect(() => {
+    setName(inbox.name)
+    setDescription(inbox.description ?? '')
+    setPrimaryTeamId(inbox.primaryTeamId as TeamId | null)
+    setDefaultStatusId(inbox.defaultStatusId as TicketStatusId | null)
+    setDefaultVisibilityScope(inbox.defaultVisibilityScope as (typeof VISIBILITY)[number])
+    setDefaultPriority(inbox.defaultPriority as (typeof PRIORITIES)[number])
+    setColor(inbox.color ?? '')
+    setIcon(inbox.icon ?? '')
+  }, [inbox])
+
+  const invalidate = () => {
+    qc.invalidateQueries({ queryKey: inboxQueries.detail(inbox.id).queryKey })
+    qc.invalidateQueries({ queryKey: inboxQueries.list().queryKey })
+    qc.invalidateQueries({ queryKey: ['inboxes'] })
+  }
+
+  const saveMutation = useMutation({
+    mutationFn: () =>
+      updateInboxFn({
+        data: {
+          inboxId: inbox.id,
+          name: name.trim(),
+          description: description.trim() || null,
+          primaryTeamId: primaryTeamId ?? null,
+          defaultStatusId: defaultStatusId ?? null,
+          defaultVisibilityScope,
+          defaultPriority,
+          color: color.trim() || null,
+          icon: icon.trim() || null,
+        },
+      }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Inbox updated')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const archiveMutation = useMutation({
+    mutationFn: () => archiveInboxFn({ data: { inboxId: inbox.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Inbox archived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const unarchiveMutation = useMutation({
+    mutationFn: () => unarchiveInboxFn({ data: { inboxId: inbox.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Inbox unarchived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-4 max-w-2xl">
+      <form
+        onSubmit={(e) => {
+          e.preventDefault()
+          if (!name.trim()) {
+            toast.error('Name is required')
+            return
+          }
+          saveMutation.mutate()
+        }}
+        className="space-y-3"
+      >
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-1">
+            <Label>Slug</Label>
+            <Input value={inbox.slug} disabled readOnly className="font-mono text-xs" />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="inbox-name">Name</Label>
+            <Input
+              id="inbox-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              required
+              maxLength={200}
+            />
+          </div>
+        </div>
+
+        <div className="space-y-1">
+          <Label htmlFor="inbox-description">Description</Label>
+          <Textarea
+            id="inbox-description"
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+            rows={2}
+          />
+        </div>
+
+        <div className="space-y-1">
+          <Label>Primary team</Label>
+          <TeamPicker
+            value={primaryTeamId}
+            onValueChange={setPrimaryTeamId}
+            allowClear
+            placeholder="No team"
+          />
+        </div>
+
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-1">
+            <Label>Default visibility</Label>
+            <Select
+              value={defaultVisibilityScope}
+              onValueChange={(v) => setDefaultVisibilityScope(v as (typeof VISIBILITY)[number])}
+            >
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {VISIBILITY.map((v) => (
+                  <SelectItem key={v} value={v}>
+                    {v}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+          <div className="space-y-1">
+            <Label>Default priority</Label>
+            <Select
+              value={defaultPriority}
+              onValueChange={(v) => setDefaultPriority(v as (typeof PRIORITIES)[number])}
+            >
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {PRIORITIES.map((p) => (
+                  <SelectItem key={p} value={p}>
+                    {p}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+
+        <div className="space-y-1">
+          <Label>Default status</Label>
+          <StatusPicker
+            value={defaultStatusId}
+            onValueChange={setDefaultStatusId}
+            placeholder="Workspace default"
+          />
+        </div>
+
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-1">
+            <Label htmlFor="inbox-color">Color</Label>
+            <Input
+              id="inbox-color"
+              value={color}
+              onChange={(e) => setColor(e.target.value)}
+              placeholder="#22c55e"
+              maxLength={16}
+            />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="inbox-icon">Icon</Label>
+            <Input
+              id="inbox-icon"
+              value={icon}
+              onChange={(e) => setIcon(e.target.value)}
+              placeholder="InboxIcon"
+              maxLength={64}
+            />
+          </div>
+        </div>
+
+        <div className="flex justify-end gap-2 pt-2">
+          <Button type="submit" disabled={saveMutation.isPending}>
+            {saveMutation.isPending ? 'Saving…' : 'Save changes'}
+          </Button>
+        </div>
+      </form>
+
+      <div className="border-t border-border/50 pt-4">
+        <h3 className="text-sm font-semibold mb-2">Archive</h3>
+        {inbox.archivedAt ? (
+          <div className="flex items-center justify-between gap-2">
+            <p className="text-xs text-muted-foreground">
+              Archived. Tickets in this inbox remain accessible but new routing rules will skip it.
+            </p>
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => unarchiveMutation.mutate()}
+              disabled={unarchiveMutation.isPending}
+            >
+              Unarchive
+            </Button>
+          </div>
+        ) : (
+          <div className="flex items-center justify-between gap-2">
+            <p className="text-xs text-muted-foreground">
+              Hide this inbox from queues and routing. Existing tickets are preserved.
+            </p>
+            <AlertDialog>
+              <AlertDialogTrigger asChild>
+                <Button variant="outline" size="sm">
+                  Archive…
+                </Button>
+              </AlertDialogTrigger>
+              <AlertDialogContent>
+                <AlertDialogHeader>
+                  <AlertDialogTitle>Archive this inbox?</AlertDialogTitle>
+                  <AlertDialogDescription>
+                    Members will no longer see it in their saved views. You can unarchive it later.
+                  </AlertDialogDescription>
+                </AlertDialogHeader>
+                <AlertDialogFooter>
+                  <AlertDialogCancel>Cancel</AlertDialogCancel>
+                  <AlertDialogAction onClick={() => archiveMutation.mutate()}>
+                    Archive
+                  </AlertDialogAction>
+                </AlertDialogFooter>
+              </AlertDialogContent>
+            </AlertDialog>
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/roles/__tests__/role-dialogs.test.tsx b/apps/web/src/components/admin/settings/roles/__tests__/role-dialogs.test.tsx
new file mode 100644
index 000000000..aa21f7b98
--- /dev/null
+++ b/apps/web/src/components/admin/settings/roles/__tests__/role-dialogs.test.tsx
@@ -0,0 +1,516 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import type { RoleId } from '@quackback/ids'
+import { DeleteRoleDialog } from '../delete-role-dialog'
+import { RoleCreateDialog } from '../role-create-dialog'
+import { RoleDetailPanel } from '../role-detail-panel'
+import { RoleEditDialog } from '../role-edit-dialog'
+import { RoleList } from '../role-list'
+import { RolePermissionMatrix } from '../role-permission-matrix'
+import { RolesSettings } from '../roles-settings'
+
+const mocks = vi.hoisted(() => ({
+  createRoleFn: vi.fn(),
+  deleteRoleFn: vi.fn(),
+  getRoleFn: vi.fn(),
+  setRolePermissionsFn: vi.fn(),
+  updateRoleFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  routerInvalidate: vi.fn(),
+  roleDetail: {
+    permissionKeys: ['tickets.read'],
+  },
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: () => ({
+    data: mocks.roleDetail,
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({
+    invalidate: mocks.routerInvalidate,
+  }),
+}))
+
+vi.mock('@/lib/server/functions/roles', () => ({
+  createRoleFn: mocks.createRoleFn,
+  deleteRoleFn: mocks.deleteRoleFn,
+  getRoleFn: mocks.getRoleFn,
+  setRolePermissionsFn: mocks.setRolePermissionsFn,
+  updateRoleFn: mocks.updateRoleFn,
+}))
+
+vi.mock('@/components/admin/settings/api-keys/scope-picker', () => ({
+  ScopePicker: ({
+    value,
+    onChange,
+    disabled,
+  }: {
+    value: string[]
+    onChange: (value: string[]) => void
+    disabled?: boolean
+  }) => (
+    <div>
+      <span>Scopes: {value.join(', ') || 'none'}</span>
+      <span>Picker {disabled ? 'disabled' : 'enabled'}</span>
+      <button
+        type="button"
+        disabled={disabled}
+        onClick={() =>
+          onChange([...value, value.includes('tickets.read') ? 'tickets.write' : 'tickets.read'])
+        }
+      >
+        {value.includes('tickets.read') ? 'Add ticket write' : 'Add ticket read'}
+      </button>
+    </div>
+  ),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({
+    children,
+    open,
+  }: {
+    children: ReactNode
+    open?: boolean
+    onOpenChange?: (open: boolean) => void
+  }) => (open ? <div>{children}</div> : null),
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section>{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    disabled,
+    placeholder,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: { target: { value: string } }) => void
+    disabled?: boolean
+    placeholder?: string
+    maxLength?: number
+    autoFocus?: boolean
+  }) => (
+    <input
+      id={id}
+      value={value}
+      disabled={disabled}
+      placeholder={placeholder}
+      onChange={(event) => onChange?.({ target: { value: event.currentTarget.value } })}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createRoleFn.mockResolvedValue({ id: 'role_1' })
+  mocks.deleteRoleFn.mockResolvedValue({ ok: true })
+  mocks.setRolePermissionsFn.mockResolvedValue({ ok: true })
+  mocks.updateRoleFn.mockResolvedValue({ ok: true })
+  mocks.roleDetail = {
+    permissionKeys: ['tickets.read'],
+  }
+})
+
+describe('RoleCreateDialog', () => {
+  it('creates a trimmed role, invalidates role data, and closes', async () => {
+    const onOpenChange = vi.fn()
+    const onCreated = vi.fn()
+    render(<RoleCreateDialog open onOpenChange={onOpenChange} onCreated={onCreated} />)
+
+    expect(screen.getByRole('heading', { name: 'Create role' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Create role' })).toBeDisabled()
+
+    fireEvent.change(screen.getByLabelText('Key'), { target: { value: '  custom-role  ' } })
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Custom Role  ' } })
+    fireEvent.change(screen.getByLabelText('Description'), {
+      target: { value: '  Can triage tickets  ' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Add ticket read' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create role' }))
+
+    await waitFor(() => {
+      expect(mocks.createRoleFn).toHaveBeenCalledWith({
+        data: {
+          key: 'custom-role',
+          name: 'Custom Role',
+          description: 'Can triage tickets',
+          permissionKeys: ['tickets.read'],
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['admin', 'roles'] })
+    expect(mocks.routerInvalidate).toHaveBeenCalled()
+    expect(onCreated).toHaveBeenCalledWith('role_1')
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('renders create failures and resets state when cancelled', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    mocks.createRoleFn.mockRejectedValueOnce(new Error('Role key already exists'))
+    const onOpenChange = vi.fn()
+    render(<RoleCreateDialog open onOpenChange={onOpenChange} />)
+
+    fireEvent.change(screen.getByLabelText('Key'), { target: { value: 'agent' } })
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Agent' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create role' }))
+
+    await waitFor(() => {
+      expect(screen.getByText('Role key already exists')).toBeInTheDocument()
+    })
+    expect(console.error).toHaveBeenCalledWith('Failed to create role:', expect.any(Error))
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+    expect(screen.getByLabelText('Key')).toHaveValue('')
+    expect(screen.getByLabelText('Name')).toHaveValue('')
+  })
+})
+
+describe('DeleteRoleDialog', () => {
+  it('blocks deletion while assignments still reference the role', () => {
+    render(
+      <DeleteRoleDialog
+        open
+        onOpenChange={vi.fn()}
+        role={{ id: 'role_1' as RoleId, name: 'Agent', assignmentCount: 2 }}
+      />
+    )
+
+    expect(screen.getByText(/This role has 2 active assignments/)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Delete role' })).toBeDisabled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Delete role' }))
+    expect(mocks.deleteRoleFn).not.toHaveBeenCalled()
+  })
+
+  it('deletes unassigned roles and closes the dialog', async () => {
+    const onOpenChange = vi.fn()
+    render(
+      <DeleteRoleDialog
+        open
+        onOpenChange={onOpenChange}
+        role={{ id: 'role_1' as RoleId, name: 'Agent', assignmentCount: 0 }}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Delete role' }))
+
+    await waitFor(() => {
+      expect(mocks.deleteRoleFn).toHaveBeenCalledWith({ data: { id: 'role_1' } })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['admin', 'roles'] })
+    expect(mocks.routerInvalidate).toHaveBeenCalled()
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('renders delete failures and supports cancelling', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    mocks.deleteRoleFn.mockRejectedValueOnce('denied')
+    const onOpenChange = vi.fn()
+    render(
+      <DeleteRoleDialog
+        open
+        onOpenChange={onOpenChange}
+        role={{ id: 'role_1' as RoleId, name: 'Agent', assignmentCount: 0 }}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Delete role' }))
+
+    await waitFor(() => {
+      expect(screen.getByText('Failed to delete role')).toBeInTheDocument()
+    })
+    expect(console.error).toHaveBeenCalledWith('Failed to delete role:', 'denied')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+})
+
+describe('RoleEditDialog', () => {
+  it('updates a role with trimmed values and invalidates role data', async () => {
+    const onOpenChange = vi.fn()
+    render(
+      <RoleEditDialog
+        open
+        onOpenChange={onOpenChange}
+        role={{ id: 'role_1' as RoleId, name: 'Agent', description: 'Old description' }}
+      />
+    )
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Support Agent  ' } })
+    fireEvent.change(screen.getByLabelText('Description'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }))
+
+    await waitFor(() => {
+      expect(mocks.updateRoleFn).toHaveBeenCalledWith({
+        data: {
+          id: 'role_1',
+          name: 'Support Agent',
+          description: null,
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['admin', 'roles'] })
+    expect(mocks.routerInvalidate).toHaveBeenCalled()
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('renders validation and update failures', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    mocks.updateRoleFn.mockRejectedValueOnce(new Error('Name is already taken'))
+    render(
+      <RoleEditDialog
+        open
+        onOpenChange={vi.fn()}
+        role={{ id: 'role_1' as RoleId, name: 'Agent', description: null }}
+      />
+    )
+
+    const nameInput = screen.getByLabelText('Name')
+    fireEvent.change(nameInput, { target: { value: '   ' } })
+    fireEvent.submit(nameInput.closest('form') as HTMLFormElement)
+    expect(screen.getByText('Name is required')).toBeInTheDocument()
+
+    fireEvent.change(nameInput, { target: { value: 'Agent 2' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }))
+
+    await waitFor(() => {
+      expect(screen.getByText('Name is already taken')).toBeInTheDocument()
+    })
+    expect(console.error).toHaveBeenCalledWith('Failed to update role:', expect.any(Error))
+  })
+})
+
+describe('RolePermissionMatrix', () => {
+  it('saves changed permission keys and can reset the draft', async () => {
+    render(<RolePermissionMatrix roleId={'role_1' as RoleId} isSystem={false} />)
+
+    expect(screen.getByRole('button', { name: 'Save permissions' })).toBeDisabled()
+    expect(screen.getByRole('button', { name: 'Reset' })).toBeDisabled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Add ticket write' }))
+    expect(screen.getByRole('button', { name: 'Save permissions' })).toBeEnabled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Save permissions' }))
+
+    await waitFor(() => {
+      expect(mocks.setRolePermissionsFn).toHaveBeenCalledWith({
+        data: {
+          roleId: 'role_1',
+          permissionKeys: ['tickets.read', 'tickets.write'],
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['admin', 'roles'] })
+    expect(mocks.routerInvalidate).toHaveBeenCalled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Reset' }))
+    expect(screen.getByText('Scopes: tickets.read')).toBeInTheDocument()
+  })
+
+  it('renders permission save failures and hides controls for system roles', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    mocks.setRolePermissionsFn.mockRejectedValueOnce('denied')
+    const { rerender } = render(
+      <RolePermissionMatrix roleId={'role_1' as RoleId} isSystem={false} />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Add ticket write' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Save permissions' }))
+
+    await waitFor(() => {
+      expect(screen.getByText('Failed to save permissions')).toBeInTheDocument()
+    })
+    expect(console.error).toHaveBeenCalledWith('Failed to save permissions:', 'denied')
+
+    rerender(<RolePermissionMatrix roleId={'role_1' as RoleId} isSystem />)
+    expect(screen.getByText('Picker disabled')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Save permissions' })).not.toBeInTheDocument()
+  })
+})
+
+describe('RoleList', () => {
+  it('renders role metadata, active state, and selection callbacks', () => {
+    const onSelect = vi.fn()
+    render(
+      <RoleList
+        selectedId={'role_system' as RoleId}
+        onSelect={onSelect}
+        roles={[
+          {
+            id: 'role_system' as RoleId,
+            key: 'owner',
+            name: 'Owner',
+            description: null,
+            isSystem: true,
+            permissionCount: 7,
+            assignmentCount: 1,
+          },
+          {
+            id: 'role_custom' as RoleId,
+            key: 'support',
+            name: 'Support',
+            description: 'Support role',
+            isSystem: false,
+            permissionCount: 3,
+            assignmentCount: 0,
+          },
+        ]}
+      />
+    )
+
+    expect(screen.getByText('Owner')).toBeInTheDocument()
+    expect(screen.getByText('owner')).toBeInTheDocument()
+    expect(screen.getByText('7 perms')).toBeInTheDocument()
+    expect(screen.getByText('1 assigned')).toBeInTheDocument()
+    expect(screen.getByText('Support')).toBeInTheDocument()
+    expect(screen.getByText('3 perms')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: /Support/ }))
+    expect(onSelect).toHaveBeenCalledWith('role_custom')
+  })
+})
+
+describe('RoleDetailPanel', () => {
+  it('renders editable role metadata and opens edit/delete dialogs', () => {
+    render(
+      <RoleDetailPanel
+        role={{
+          id: 'role_custom' as RoleId,
+          key: 'support',
+          name: 'Support',
+          description: 'Can triage tickets',
+          isSystem: false,
+          permissionCount: 3,
+          assignmentCount: 1,
+        }}
+      />
+    )
+
+    expect(screen.getByRole('heading', { name: 'Support' })).toBeInTheDocument()
+    expect(screen.getByText('support')).toBeInTheDocument()
+    expect(screen.getByText('1 assignment')).toBeInTheDocument()
+    expect(screen.getByText('Can triage tickets')).toBeInTheDocument()
+    expect(screen.getByText('Scopes: tickets.read')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Edit Support' }))
+    expect(screen.getByRole('heading', { name: 'Edit role' })).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Delete Support' }))
+    expect(screen.getByRole('heading', { name: 'Delete role' })).toBeInTheDocument()
+  })
+
+  it('renders system roles as locked and disables destructive controls', () => {
+    render(
+      <RoleDetailPanel
+        role={{
+          id: 'role_system' as RoleId,
+          key: 'owner',
+          name: 'Owner',
+          description: null,
+          isSystem: true,
+          permissionCount: 7,
+          assignmentCount: 2,
+        }}
+      />
+    )
+
+    expect(screen.getByText('System')).toBeInTheDocument()
+    expect(screen.getByText('2 assignments')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Edit Owner' })).toBeDisabled()
+    expect(screen.getByRole('button', { name: 'Delete Owner' })).toBeDisabled()
+    expect(screen.getByText('Picker disabled')).toBeInTheDocument()
+    expect(screen.queryByRole('heading', { name: 'Edit role' })).not.toBeInTheDocument()
+  })
+})
+
+describe('RolesSettings', () => {
+  it('selects roles and opens the create role dialog', () => {
+    render(
+      <RolesSettings
+        roles={[
+          {
+            id: 'role_owner' as RoleId,
+            key: 'owner',
+            name: 'Owner',
+            description: null,
+            isSystem: true,
+            permissionCount: 7,
+            assignmentCount: 1,
+          },
+          {
+            id: 'role_support' as RoleId,
+            key: 'support',
+            name: 'Support',
+            description: 'Support role',
+            isSystem: false,
+            permissionCount: 3,
+            assignmentCount: 0,
+          },
+        ]}
+      />
+    )
+
+    expect(screen.getAllByText('Owner')).toHaveLength(2)
+    expect(screen.getByText('1 assignment')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: /Support/ }))
+    expect(screen.getByRole('heading', { name: 'Support' })).toBeInTheDocument()
+    expect(screen.getByText('Support role')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: /Create role/ }))
+    expect(screen.getByRole('heading', { name: 'Create role' })).toBeInTheDocument()
+  })
+
+  it('renders an empty selection state when no roles exist', () => {
+    render(<RolesSettings roles={[]} />)
+
+    expect(screen.getByText('No role selected.')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/roles/delete-role-dialog.tsx b/apps/web/src/components/admin/settings/roles/delete-role-dialog.tsx
new file mode 100644
index 000000000..a08a46093
--- /dev/null
+++ b/apps/web/src/components/admin/settings/roles/delete-role-dialog.tsx
@@ -0,0 +1,81 @@
+'use client'
+
+import { useState, useTransition } from 'react'
+import { useQueryClient } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { deleteRoleFn } from '@/lib/server/functions/roles'
+import type { RoleId } from '@quackback/ids'
+
+interface Props {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  role: { id: RoleId; name: string; assignmentCount: number }
+}
+
+export function DeleteRoleDialog({ open, onOpenChange, role }: Props) {
+  const router = useRouter()
+  const queryClient = useQueryClient()
+  const [isPending, startTransition] = useTransition()
+  const [error, setError] = useState<string | null>(null)
+  const [submitting, setSubmitting] = useState(false)
+
+  const blocked = role.assignmentCount > 0
+
+  const handleConfirm = async () => {
+    if (blocked) return
+    setError(null)
+    setSubmitting(true)
+    try {
+      await deleteRoleFn({ data: { id: role.id } })
+      startTransition(() => {
+        queryClient.invalidateQueries({ queryKey: ['admin', 'roles'] })
+        router.invalidate()
+      })
+      onOpenChange(false)
+    } catch (err) {
+      console.error('Failed to delete role:', err)
+      setError(err instanceof Error ? err.message : 'Failed to delete role')
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  const busy = submitting || isPending
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle>Delete role</DialogTitle>
+          <DialogDescription>
+            Permanently delete <strong>{role.name}</strong>. This cannot be undone.
+          </DialogDescription>
+        </DialogHeader>
+        {blocked && (
+          <p className="text-xs text-amber-700 dark:text-amber-400 bg-amber-50 dark:bg-amber-950/30 border border-amber-200 dark:border-amber-900 rounded-md p-2">
+            This role has {role.assignmentCount} active assignment
+            {role.assignmentCount === 1 ? '' : 's'}. Revoke them before deleting.
+          </p>
+        )}
+        {error && <p className="text-sm text-destructive">{error}</p>}
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)} disabled={busy}>
+            Cancel
+          </Button>
+          <Button variant="destructive" onClick={handleConfirm} disabled={busy || blocked}>
+            {busy ? 'Deleting…' : 'Delete role'}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/roles/role-create-dialog.tsx b/apps/web/src/components/admin/settings/roles/role-create-dialog.tsx
new file mode 100644
index 000000000..5504143e8
--- /dev/null
+++ b/apps/web/src/components/admin/settings/roles/role-create-dialog.tsx
@@ -0,0 +1,158 @@
+'use client'
+
+import { useState, useTransition } from 'react'
+import { useQueryClient } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import type { RoleId } from '@quackback/ids'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { ScopePicker } from '@/components/admin/settings/api-keys/scope-picker'
+import { createRoleFn } from '@/lib/server/functions/roles'
+import type { PermissionKey } from '@/lib/server/domains/authz'
+
+interface Props {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  onCreated?: (id: RoleId) => void
+}
+
+export function RoleCreateDialog({ open, onOpenChange, onCreated }: Props) {
+  const router = useRouter()
+  const queryClient = useQueryClient()
+  const [isPending, startTransition] = useTransition()
+
+  const [key, setKey] = useState('')
+  const [name, setName] = useState('')
+  const [description, setDescription] = useState('')
+  const [permissionKeys, setPermissionKeys] = useState<string[]>([])
+  const [error, setError] = useState<string | null>(null)
+  const [submitting, setSubmitting] = useState(false)
+
+  const handleOpenChange = (next: boolean) => {
+    if (!next) {
+      setKey('')
+      setName('')
+      setDescription('')
+      setPermissionKeys([])
+      setError(null)
+    }
+    onOpenChange(next)
+  }
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setError(null)
+    if (!key.trim() || !name.trim()) {
+      setError('Key and name are required')
+      return
+    }
+    setSubmitting(true)
+    try {
+      const { id } = await createRoleFn({
+        data: {
+          key: key.trim(),
+          name: name.trim(),
+          description: description.trim() || null,
+          permissionKeys: permissionKeys as PermissionKey[],
+        },
+      })
+      startTransition(() => {
+        queryClient.invalidateQueries({ queryKey: ['admin', 'roles'] })
+        router.invalidate()
+      })
+      onCreated?.(id)
+      handleOpenChange(false)
+    } catch (err) {
+      console.error('Failed to create role:', err)
+      setError(err instanceof Error ? err.message : 'Failed to create role')
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  const busy = submitting || isPending
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent className="sm:max-w-2xl max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>Create role</DialogTitle>
+          <DialogDescription>
+            Define a new role bundle. Pick the permissions agents holding this role should have.
+          </DialogDescription>
+        </DialogHeader>
+
+        <form onSubmit={handleSubmit} className="space-y-4 py-2">
+          <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
+            <div className="space-y-2">
+              <Label htmlFor="role-key">Key</Label>
+              <Input
+                id="role-key"
+                placeholder="trial-supervisor"
+                value={key}
+                onChange={(e) => setKey(e.target.value)}
+                disabled={busy}
+                maxLength={64}
+                autoFocus
+              />
+              <p className="text-[10px] text-muted-foreground">lowercase, digits, _ or - only</p>
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="role-name">Name</Label>
+              <Input
+                id="role-name"
+                placeholder="Trial supervisor"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                disabled={busy}
+                maxLength={128}
+              />
+            </div>
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="role-description">Description</Label>
+            <Input
+              id="role-description"
+              placeholder="Optional"
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+              disabled={busy}
+              maxLength={2000}
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label>Permissions</Label>
+            <ScopePicker value={permissionKeys} onChange={setPermissionKeys} disabled={busy} />
+          </div>
+
+          {error && <p className="text-sm text-destructive">{error}</p>}
+
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="outline"
+              onClick={() => handleOpenChange(false)}
+              disabled={busy}
+            >
+              Cancel
+            </Button>
+            <Button type="submit" disabled={busy || !key.trim() || !name.trim()}>
+              {busy ? 'Creating…' : 'Create role'}
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/roles/role-detail-panel.tsx b/apps/web/src/components/admin/settings/roles/role-detail-panel.tsx
new file mode 100644
index 000000000..f588662ed
--- /dev/null
+++ b/apps/web/src/components/admin/settings/roles/role-detail-panel.tsx
@@ -0,0 +1,80 @@
+'use client'
+
+import { useState, Suspense } from 'react'
+import { LockClosedIcon, PencilIcon, TrashIcon } from '@heroicons/react/24/outline'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { RolePermissionMatrix } from './role-permission-matrix'
+import { RoleEditDialog } from './role-edit-dialog'
+import { DeleteRoleDialog } from './delete-role-dialog'
+import type { RoleListItem } from '@/lib/server/domains/authz/role.service'
+
+interface Props {
+  role: RoleListItem
+}
+
+export function RoleDetailPanel({ role }: Props) {
+  const [editOpen, setEditOpen] = useState(false)
+  const [deleteOpen, setDeleteOpen] = useState(false)
+
+  return (
+    <div className="rounded-lg border border-border/50 p-4 space-y-4">
+      <div className="flex items-start justify-between gap-3">
+        <div className="min-w-0 space-y-1">
+          <div className="flex items-center gap-2">
+            {role.isSystem && <LockClosedIcon className="h-3.5 w-3.5 text-muted-foreground" />}
+            <h2 className="text-base font-semibold truncate">{role.name}</h2>
+            {role.isSystem && (
+              <Badge variant="outline" className="text-[10px]">
+                System
+              </Badge>
+            )}
+          </div>
+          <div className="flex items-center gap-2 text-[11px] text-muted-foreground">
+            <code className="font-mono">{role.key}</code>
+            <span>·</span>
+            <span>
+              {role.assignmentCount} assignment{role.assignmentCount === 1 ? '' : 's'}
+            </span>
+          </div>
+          {role.description && (
+            <p className="text-xs text-muted-foreground pt-1">{role.description}</p>
+          )}
+        </div>
+        <div className="flex items-center gap-2 shrink-0">
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => setEditOpen(true)}
+            disabled={role.isSystem}
+            aria-label={`Edit ${role.name}`}
+          >
+            <PencilIcon className="h-4 w-4" />
+          </Button>
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => setDeleteOpen(true)}
+            disabled={role.isSystem}
+            aria-label={`Delete ${role.name}`}
+          >
+            <TrashIcon className="h-4 w-4" />
+          </Button>
+        </div>
+      </div>
+
+      <Suspense
+        fallback={<div className="text-xs text-muted-foreground">Loading permissions…</div>}
+      >
+        <RolePermissionMatrix key={role.id} roleId={role.id} isSystem={role.isSystem} />
+      </Suspense>
+
+      {!role.isSystem && (
+        <>
+          <RoleEditDialog open={editOpen} onOpenChange={setEditOpen} role={role} />
+          <DeleteRoleDialog open={deleteOpen} onOpenChange={setDeleteOpen} role={role} />
+        </>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/roles/role-edit-dialog.tsx b/apps/web/src/components/admin/settings/roles/role-edit-dialog.tsx
new file mode 100644
index 000000000..c78bda17b
--- /dev/null
+++ b/apps/web/src/components/admin/settings/roles/role-edit-dialog.tsx
@@ -0,0 +1,111 @@
+'use client'
+
+import { useState, useTransition } from 'react'
+import { useQueryClient } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import type { RoleId } from '@quackback/ids'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { updateRoleFn } from '@/lib/server/functions/roles'
+
+interface Props {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  role: { id: RoleId; name: string; description: string | null }
+}
+
+export function RoleEditDialog({ open, onOpenChange, role }: Props) {
+  const router = useRouter()
+  const queryClient = useQueryClient()
+  const [isPending, startTransition] = useTransition()
+  const [name, setName] = useState(role.name)
+  const [description, setDescription] = useState(role.description ?? '')
+  const [error, setError] = useState<string | null>(null)
+  const [submitting, setSubmitting] = useState(false)
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setError(null)
+    if (!name.trim()) {
+      setError('Name is required')
+      return
+    }
+    setSubmitting(true)
+    try {
+      await updateRoleFn({
+        data: {
+          id: role.id,
+          name: name.trim(),
+          description: description.trim() || null,
+        },
+      })
+      startTransition(() => {
+        queryClient.invalidateQueries({ queryKey: ['admin', 'roles'] })
+        router.invalidate()
+      })
+      onOpenChange(false)
+    } catch (err) {
+      console.error('Failed to update role:', err)
+      setError(err instanceof Error ? err.message : 'Failed to update role')
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  const busy = submitting || isPending
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle>Edit role</DialogTitle>
+        </DialogHeader>
+        <form onSubmit={handleSubmit} className="space-y-4 py-2">
+          <div className="space-y-2">
+            <Label htmlFor="role-edit-name">Name</Label>
+            <Input
+              id="role-edit-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              disabled={busy}
+              autoFocus
+              maxLength={128}
+            />
+          </div>
+          <div className="space-y-2">
+            <Label htmlFor="role-edit-description">Description</Label>
+            <Input
+              id="role-edit-description"
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+              disabled={busy}
+              maxLength={2000}
+            />
+          </div>
+          {error && <p className="text-sm text-destructive">{error}</p>}
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="outline"
+              onClick={() => onOpenChange(false)}
+              disabled={busy}
+            >
+              Cancel
+            </Button>
+            <Button type="submit" disabled={busy || !name.trim()}>
+              {busy ? 'Saving…' : 'Save'}
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/roles/role-list.tsx b/apps/web/src/components/admin/settings/roles/role-list.tsx
new file mode 100644
index 000000000..8debee9de
--- /dev/null
+++ b/apps/web/src/components/admin/settings/roles/role-list.tsx
@@ -0,0 +1,50 @@
+'use client'
+
+import { LockClosedIcon } from '@heroicons/react/24/solid'
+import { cn } from '@/lib/shared/utils'
+import type { RoleListItem } from '@/lib/server/domains/authz/role.service'
+import type { RoleId } from '@quackback/ids'
+
+interface Props {
+  roles: RoleListItem[]
+  selectedId: RoleId | null
+  onSelect: (id: RoleId) => void
+}
+
+export function RoleList({ roles, selectedId, onSelect }: Props) {
+  return (
+    <div className="rounded-lg border border-border/50 overflow-hidden">
+      <ul className="divide-y divide-border/50">
+        {roles.map((r) => {
+          const active = r.id === selectedId
+          return (
+            <li key={r.id}>
+              <button
+                type="button"
+                onClick={() => onSelect(r.id)}
+                className={cn(
+                  'w-full text-left px-3 py-2 transition-colors hover:bg-muted/50',
+                  active && 'bg-muted'
+                )}
+              >
+                <div className="flex items-center gap-1.5">
+                  {r.isSystem && (
+                    <LockClosedIcon className="h-3 w-3 text-muted-foreground shrink-0" />
+                  )}
+                  <span className="text-sm font-medium truncate">{r.name}</span>
+                </div>
+                <div className="mt-0.5 flex items-center gap-2 text-[10px] text-muted-foreground">
+                  <code className="font-mono">{r.key}</code>
+                  <span>·</span>
+                  <span>{r.permissionCount} perms</span>
+                  <span>·</span>
+                  <span>{r.assignmentCount} assigned</span>
+                </div>
+              </button>
+            </li>
+          )
+        })}
+      </ul>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/roles/role-permission-matrix.tsx b/apps/web/src/components/admin/settings/roles/role-permission-matrix.tsx
new file mode 100644
index 000000000..c9dd20100
--- /dev/null
+++ b/apps/web/src/components/admin/settings/roles/role-permission-matrix.tsx
@@ -0,0 +1,88 @@
+'use client'
+
+import { useState, useTransition, useMemo } from 'react'
+import { useQueryClient, useSuspenseQuery } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import { Button } from '@/components/ui/button'
+import { ScopePicker } from '@/components/admin/settings/api-keys/scope-picker'
+import { getRoleFn, setRolePermissionsFn } from '@/lib/server/functions/roles'
+import type { RoleId } from '@quackback/ids'
+import type { PermissionKey } from '@/lib/server/domains/authz'
+
+interface Props {
+  roleId: RoleId
+  isSystem: boolean
+}
+
+const roleQuery = (id: RoleId) => ({
+  queryKey: ['admin', 'roles', 'detail', id] as const,
+  queryFn: () => getRoleFn({ data: { id } }),
+})
+
+/**
+ * Read+edit grid for one role's permissions.
+ * Parent should remount with `key={roleId}` when selected role changes.
+ */
+export function RolePermissionMatrix({ roleId, isSystem }: Props) {
+  const router = useRouter()
+  const queryClient = useQueryClient()
+  const { data } = useSuspenseQuery(roleQuery(roleId))
+  const [isPending, startTransition] = useTransition()
+  const [submitting, setSubmitting] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [draft, setDraft] = useState<string[]>(data.permissionKeys)
+
+  const initialSet = useMemo(() => new Set(data.permissionKeys), [data.permissionKeys])
+  const draftSet = useMemo(() => new Set(draft), [draft])
+  const dirty =
+    draft.length !== data.permissionKeys.length ||
+    draft.some((k) => !initialSet.has(k as PermissionKey)) ||
+    data.permissionKeys.some((k) => !draftSet.has(k))
+
+  const handleSave = async () => {
+    setError(null)
+    setSubmitting(true)
+    try {
+      await setRolePermissionsFn({
+        data: { roleId, permissionKeys: draft as PermissionKey[] },
+      })
+      startTransition(() => {
+        queryClient.invalidateQueries({ queryKey: ['admin', 'roles'] })
+        router.invalidate()
+      })
+    } catch (err) {
+      console.error('Failed to save permissions:', err)
+      setError(err instanceof Error ? err.message : 'Failed to save permissions')
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  const busy = submitting || isPending
+
+  return (
+    <div className="space-y-3">
+      <ScopePicker
+        value={draft}
+        onChange={isSystem ? () => undefined : setDraft}
+        disabled={isSystem || busy}
+      />
+      {error && <p className="text-sm text-destructive">{error}</p>}
+      {!isSystem && (
+        <div className="flex justify-end gap-2">
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => setDraft(data.permissionKeys)}
+            disabled={!dirty || busy}
+          >
+            Reset
+          </Button>
+          <Button size="sm" onClick={handleSave} disabled={!dirty || busy}>
+            {busy ? 'Saving…' : 'Save permissions'}
+          </Button>
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/roles/roles-settings.tsx b/apps/web/src/components/admin/settings/roles/roles-settings.tsx
new file mode 100644
index 000000000..dedec0c84
--- /dev/null
+++ b/apps/web/src/components/admin/settings/roles/roles-settings.tsx
@@ -0,0 +1,59 @@
+'use client'
+
+import { useState, useEffect } from 'react'
+import { PlusIcon } from '@heroicons/react/24/outline'
+import { Button } from '@/components/ui/button'
+import { RoleList } from './role-list'
+import { RoleDetailPanel } from './role-detail-panel'
+import { RoleCreateDialog } from './role-create-dialog'
+import type { RoleListItem } from '@/lib/server/domains/authz/role.service'
+import type { RoleId } from '@quackback/ids'
+
+interface Props {
+  roles: RoleListItem[]
+}
+
+export function RolesSettings({ roles }: Props) {
+  const [selectedId, setSelectedId] = useState<RoleId | null>(roles[0]?.id ?? null)
+  const [createOpen, setCreateOpen] = useState(false)
+
+  // Re-anchor selection if the currently-selected role disappears (delete).
+  useEffect(() => {
+    if (!selectedId) {
+      setSelectedId(roles[0]?.id ?? null)
+      return
+    }
+    const stillExists = roles.some((r) => r.id === selectedId)
+    if (!stillExists) setSelectedId(roles[0]?.id ?? null)
+  }, [roles, selectedId])
+
+  const selected = roles.find((r) => r.id === selectedId) ?? null
+
+  return (
+    <div className="space-y-4">
+      <div className="flex justify-end">
+        <Button size="sm" onClick={() => setCreateOpen(true)}>
+          <PlusIcon className="h-4 w-4 mr-1.5" />
+          Create role
+        </Button>
+      </div>
+
+      <div className="grid grid-cols-1 md:grid-cols-[260px_1fr] gap-4">
+        <RoleList roles={roles} selectedId={selectedId} onSelect={setSelectedId} />
+        {selected ? (
+          <RoleDetailPanel role={selected} />
+        ) : (
+          <div className="rounded-lg border border-dashed border-border/60 p-8 text-center text-xs text-muted-foreground">
+            No role selected.
+          </div>
+        )}
+      </div>
+
+      <RoleCreateDialog
+        open={createOpen}
+        onOpenChange={setCreateOpen}
+        onCreated={(id) => setSelectedId(id)}
+      />
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/routing/__tests__/routing-actions-builder.test.tsx b/apps/web/src/components/admin/settings/routing/__tests__/routing-actions-builder.test.tsx
new file mode 100644
index 000000000..1898fd6ce
--- /dev/null
+++ b/apps/web/src/components/admin/settings/routing/__tests__/routing-actions-builder.test.tsx
@@ -0,0 +1,209 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { type BuilderAction, RoutingActionsBuilder } from '../routing-actions-builder'
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    children,
+    value,
+    onValueChange,
+  }: {
+    children: ReactNode
+    value: string
+    onValueChange: (value: string) => void
+  }) => {
+    const ariaLabel = ['low', 'normal', 'high', 'urgent'].includes(value)
+      ? 'Priority'
+      : ['team', 'org', 'shared', 'private'].includes(value)
+        ? 'Visibility'
+        : 'Action type'
+    return (
+      <select
+        aria-label={ariaLabel}
+        value={value}
+        onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+          onValueChange(event.currentTarget.value)
+        }
+      >
+        {children}
+      </select>
+    )
+  },
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: () => null,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/admin/shared/inbox-picker', () => ({
+  InboxPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    allowClear?: boolean
+    placeholder?: string
+  }) => (
+    <select
+      aria-label="Inbox"
+      value={value ?? ''}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+        onValueChange(event.currentTarget.value || null)
+      }
+    >
+      <option value="">No inbox</option>
+      <option value="inbox_1">Support inbox</option>
+    </select>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    allowClear?: boolean
+    placeholder?: string
+  }) => (
+    <select
+      aria-label="Team"
+      value={value ?? ''}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+        onValueChange(event.currentTarget.value || null)
+      }
+    >
+      <option value="">No team</option>
+      <option value="team_1">Support team</option>
+    </select>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    placeholder?: string
+  }) => (
+    <select
+      aria-label="Principal"
+      value={value ?? ''}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+        onValueChange(event.currentTarget.value || null)
+      }
+    >
+      <option value="">No principal</option>
+      <option value="principal_1">Ada</option>
+    </select>
+  ),
+}))
+
+describe('RoutingActionsBuilder', () => {
+  it('adds actions, removes actions, and clears value when the action type changes', () => {
+    const onChange = vi.fn()
+
+    render(
+      <RoutingActionsBuilder
+        value={[{ type: 'assignToInbox', value: 'inbox_1' }]}
+        onChange={onChange}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /Add action/ }))
+    expect(onChange).toHaveBeenCalledWith([
+      { type: 'assignToInbox', value: 'inbox_1' },
+      { type: 'assignToInbox', value: '' },
+    ])
+
+    fireEvent.change(screen.getByLabelText('Action type'), { target: { value: 'assignToTeam' } })
+    expect(onChange).toHaveBeenCalledWith([{ type: 'assignToTeam', value: '' }])
+
+    fireEvent.click(screen.getByRole('button', { name: 'Remove action' }))
+    expect(onChange).toHaveBeenCalledWith([])
+  })
+
+  it('renders every value input branch and updates action values', () => {
+    const onChange = vi.fn()
+    const actions: BuilderAction[] = [
+      { type: 'assignToInbox', value: '' },
+      { type: 'assignToTeam', value: '' },
+      { type: 'assignToPrincipal', value: '' },
+      { type: 'addParticipant', value: '' },
+      { type: 'setPriority', value: 'normal' },
+      { type: 'setVisibility', value: 'team' },
+    ]
+
+    render(<RoutingActionsBuilder value={actions} onChange={onChange} />)
+
+    fireEvent.change(screen.getByLabelText('Inbox'), { target: { value: 'inbox_1' } })
+    expect(onChange).toHaveBeenCalledWith([
+      { type: 'assignToInbox', value: 'inbox_1' },
+      ...actions.slice(1),
+    ])
+
+    fireEvent.change(screen.getByLabelText('Team'), { target: { value: 'team_1' } })
+    expect(onChange).toHaveBeenCalledWith([
+      actions[0],
+      { type: 'assignToTeam', value: 'team_1' },
+      ...actions.slice(2),
+    ])
+
+    const principalInputs = screen.getAllByLabelText('Principal')
+    fireEvent.change(principalInputs[0], { target: { value: 'principal_1' } })
+    expect(onChange).toHaveBeenCalledWith([
+      ...actions.slice(0, 2),
+      { type: 'assignToPrincipal', value: 'principal_1' },
+      ...actions.slice(3),
+    ])
+
+    fireEvent.change(principalInputs[1], { target: { value: 'principal_1' } })
+    expect(onChange).toHaveBeenCalledWith([
+      ...actions.slice(0, 3),
+      { type: 'addParticipant', value: 'principal_1' },
+      ...actions.slice(4),
+    ])
+
+    fireEvent.change(screen.getByLabelText('Priority'), { target: { value: 'urgent' } })
+    expect(onChange).toHaveBeenCalledWith([
+      ...actions.slice(0, 4),
+      { type: 'setPriority', value: 'urgent' },
+      actions[5],
+    ])
+
+    fireEvent.change(screen.getByLabelText('Visibility'), { target: { value: 'private' } })
+    expect(onChange).toHaveBeenCalledWith([
+      ...actions.slice(0, 5),
+      { type: 'setVisibility', value: 'private' },
+    ])
+  })
+})
diff --git a/apps/web/src/components/admin/settings/routing/__tests__/routing-conditions-builder.test.tsx b/apps/web/src/components/admin/settings/routing/__tests__/routing-conditions-builder.test.tsx
new file mode 100644
index 000000000..965916865
--- /dev/null
+++ b/apps/web/src/components/admin/settings/routing/__tests__/routing-conditions-builder.test.tsx
@@ -0,0 +1,192 @@
+// @vitest-environment happy-dom
+import { useState, type ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { RoutingConditionsBuilder, type BuilderRuleSet } from '../routing-conditions-builder'
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    'aria-label'?: string
+    variant?: string
+    size?: string
+    className?: string
+  }) => (
+    <button type={type} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    value,
+    onChange,
+    placeholder,
+  }: {
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    placeholder?: string
+    className?: string
+  }) => <input value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select value={value} onChange={(event) => onValueChange(event.currentTarget.value)}>
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  TrashIcon: () => <span />,
+  PlusIcon: () => <span />,
+}))
+
+const onChange = vi.fn()
+
+function Harness({ initial }: { initial: BuilderRuleSet }) {
+  const [value, setValue] = useState(initial)
+  return (
+    <>
+      <RoutingConditionsBuilder
+        value={value}
+        onChange={(next) => {
+          onChange(next)
+          setValue(next)
+        }}
+      />
+      <pre data-testid="value">{JSON.stringify(value)}</pre>
+    </>
+  )
+}
+
+function currentValue(): BuilderRuleSet {
+  return JSON.parse(screen.getByTestId('value').textContent ?? '{}') as BuilderRuleSet
+}
+
+beforeEach(() => {
+  onChange.mockClear()
+})
+
+describe('RoutingConditionsBuilder', () => {
+  it('adds, removes, and changes match mode for conditions', () => {
+    render(<Harness initial={{ match: 'all', conditions: [] }} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Any' }))
+    expect(currentValue().match).toBe('any')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Add condition' }))
+    expect(currentValue().conditions).toEqual([{ field: 'subject', op: 'contains', value: '' }])
+
+    fireEvent.click(screen.getByRole('button', { name: 'Remove condition' }))
+    expect(currentValue().conditions).toEqual([])
+  })
+
+  it('edits scalar values and normalizes when switching to and from in-operator arrays', () => {
+    render(
+      <Harness
+        initial={{
+          match: 'all',
+          conditions: [{ field: 'subject', op: 'contains', value: 'billing' }],
+        }}
+      />
+    )
+
+    fireEvent.change(screen.getByPlaceholderText(/value/), {
+      target: { value: 'invoice' },
+    })
+    expect(currentValue().conditions[0]).toEqual({
+      field: 'subject',
+      op: 'contains',
+      value: 'invoice',
+    })
+
+    fireEvent.change(screen.getAllByRole('combobox')[1], { target: { value: 'in' } })
+    expect(currentValue().conditions[0].value).toEqual(['invoice'])
+
+    fireEvent.change(screen.getByPlaceholderText(/value1/), {
+      target: { value: 'alpha, beta, , gamma ' },
+    })
+    expect(currentValue().conditions[0].value).toEqual(['alpha', 'beta', 'gamma'])
+
+    fireEvent.change(screen.getAllByRole('combobox')[1], { target: { value: 'matches' } })
+    expect(currentValue().conditions[0]).toEqual({
+      field: 'subject',
+      op: 'matches',
+      value: 'alpha',
+    })
+    expect(screen.getByPlaceholderText(/regex/)).toBeInTheDocument()
+  })
+
+  it('resets values when changing fields and supports enum scalar selects', () => {
+    render(
+      <Harness
+        initial={{
+          match: 'all',
+          conditions: [{ field: 'subject', op: 'eq', value: 'existing' }],
+        }}
+      />
+    )
+
+    fireEvent.change(screen.getAllByRole('combobox')[0], { target: { value: 'priority' } })
+    expect(currentValue().conditions[0]).toEqual({
+      field: 'priority',
+      op: 'eq',
+      value: '',
+    })
+
+    fireEvent.change(screen.getAllByRole('combobox')[2], { target: { value: 'urgent' } })
+    expect(currentValue().conditions[0].value).toBe('urgent')
+  })
+
+  it('supports enum in-operator toggles for ticket channels and inbox channel kinds', () => {
+    const view = render(
+      <Harness
+        initial={{
+          match: 'all',
+          conditions: [{ field: 'channel', op: 'in', value: ['email'] }],
+        }}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'email' }))
+    expect(currentValue().conditions[0].value).toEqual([])
+    fireEvent.click(screen.getByRole('button', { name: 'widget' }))
+    expect(currentValue().conditions[0].value).toEqual(['widget'])
+
+    view.unmount()
+    render(
+      <Harness
+        initial={{
+          match: 'all',
+          conditions: [{ field: 'inboxChannelKind', op: 'in', value: [] }],
+        }}
+      />
+    )
+    fireEvent.click(screen.getByRole('button', { name: 'webhook' }))
+    expect(currentValue().conditions[0].value).toEqual(['webhook'])
+  })
+})
diff --git a/apps/web/src/components/admin/settings/routing/__tests__/routing-rule-editor-sheet.test.tsx b/apps/web/src/components/admin/settings/routing/__tests__/routing-rule-editor-sheet.test.tsx
new file mode 100644
index 000000000..4751c2784
--- /dev/null
+++ b/apps/web/src/components/admin/settings/routing/__tests__/routing-rule-editor-sheet.test.tsx
@@ -0,0 +1,386 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { RoutingRuleEditorSheet } from '../routing-rule-editor-sheet'
+
+type MutationOptions = {
+  mutationFn: () => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+type RuleSet = {
+  match: 'all' | 'any'
+  conditions: Array<{ field: string; op: string; value: string | string[] }>
+}
+
+type Action = { type: string; value: string }
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  createRoutingRuleFn: vi.fn(),
+  updateRoutingRuleFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/sheet', () => ({
+  Sheet: ({ open, children }: { open: boolean; children: ReactNode }) =>
+    open ? <div role="dialog">{children}</div> : null,
+  SheetContent: ({ children }: { children: ReactNode; side?: string; className?: string }) => (
+    <section>{children}</section>
+  ),
+  SheetDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  SheetFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  SheetHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  SheetTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    type?: string
+    value?: string | number
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    placeholder?: string
+    min?: number
+    max?: number
+  }) => <input id={id} type={type} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLTextAreaElement>) => void
+    placeholder?: string
+    rows?: number
+  }) => <textarea id={id} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input id={id} type="checkbox" checked={checked} onChange={() => onCheckedChange(!checked)} />
+  ),
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select value={value} onChange={(event) => onValueChange(event.currentTarget.value)}>
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/admin/shared/inbox-picker', () => ({
+  InboxPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('inbox_scope')}>
+      Pick scoped inbox
+    </button>
+  ),
+}))
+
+vi.mock('../routing-conditions-builder', () => ({
+  RoutingConditionsBuilder: ({
+    value,
+    onChange,
+  }: {
+    value: RuleSet
+    onChange: (next: RuleSet) => void
+  }) => (
+    <div>
+      <div>conditions:{value.conditions.length}</div>
+      <button type="button" onClick={() => onChange({ match: 'all', conditions: [] })}>
+        Empty conditions
+      </button>
+      <button
+        type="button"
+        onClick={() =>
+          onChange({
+            match: 'all',
+            conditions: [{ field: 'subject', op: 'contains', value: '' }],
+          })
+        }
+      >
+        Missing condition value
+      </button>
+      <button
+        type="button"
+        onClick={() =>
+          onChange({
+            match: 'any',
+            conditions: [{ field: 'priority', op: 'eq', value: 'urgent' }],
+          })
+        }
+      >
+        Valid condition
+      </button>
+    </div>
+  ),
+}))
+
+vi.mock('../routing-actions-builder', () => ({
+  RoutingActionsBuilder: ({
+    value,
+    onChange,
+  }: {
+    value: Action[]
+    onChange: (next: Action[]) => void
+  }) => (
+    <div>
+      <div>actions:{value.length}</div>
+      <button type="button" onClick={() => onChange([])}>
+        Empty actions
+      </button>
+      <button type="button" onClick={() => onChange([{ type: 'assignToInbox', value: '' }])}>
+        Missing action value
+      </button>
+      <button
+        type="button"
+        onClick={() => onChange([{ type: 'assignToInbox', value: 'inbox_action' }])}
+      >
+        Valid action
+      </button>
+    </div>
+  ),
+}))
+
+vi.mock('@/lib/server/functions/routing', () => ({
+  createRoutingRuleFn: mocks.createRoutingRuleFn,
+  updateRoutingRuleFn: mocks.updateRoutingRuleFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function renderSheet(props: Partial<React.ComponentProps<typeof RoutingRuleEditorSheet>> = {}) {
+  const onOpenChange = vi.fn()
+  const view = render(<RoutingRuleEditorSheet open onOpenChange={onOpenChange} {...props} />)
+  return { ...view, onOpenChange }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createRoutingRuleFn.mockResolvedValue({ id: 'routing_rule_new' })
+  mocks.updateRoutingRuleFn.mockResolvedValue({ id: 'routing_rule_1' })
+})
+
+describe('RoutingRuleEditorSheet', () => {
+  it('does not render content while closed', () => {
+    render(<RoutingRuleEditorSheet open={false} onOpenChange={vi.fn()} />)
+
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+  })
+
+  it('validates and creates a scoped routing rule', async () => {
+    const { onOpenChange } = renderSheet()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Create rule' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Name is required')
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  VIP routing  ' } })
+    fireEvent.change(screen.getByLabelText('Description'), {
+      target: { value: '  Move urgent customers  ' },
+    })
+    fireEvent.change(screen.getByRole('combobox'), { target: { value: 'inbox' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create rule' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Pick an inbox or switch to workspace scope')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick scoped inbox' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Empty conditions' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create rule' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('At least one condition is required')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Missing condition value' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create rule' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Condition on "subject" is missing a value')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Valid condition' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Empty actions' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create rule' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('At least one action is required')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Missing action value' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create rule' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Action "assignToInbox" is missing a value')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Valid action' }))
+    fireEvent.change(screen.getByLabelText('Priority'), { target: { value: '' } })
+    fireEvent.click(screen.getByLabelText('Enabled'))
+    fireEvent.click(screen.getByRole('button', { name: 'Create rule' }))
+
+    await waitFor(() => {
+      expect(mocks.createRoutingRuleFn).toHaveBeenCalledWith({
+        data: {
+          name: 'VIP routing',
+          description: 'Move urgent customers',
+          priority: 0,
+          enabled: false,
+          conditions: {
+            match: 'any',
+            conditions: [{ field: 'priority', op: 'eq', value: 'urgent' }],
+          },
+          actions: [{ type: 'assignToInbox', value: 'inbox_action' }],
+          inboxIdScope: 'inbox_scope',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Routing rule created')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['routing-rules'] })
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('prefills and updates existing routing rules', async () => {
+    const { onOpenChange } = renderSheet({
+      rule: {
+        id: 'routing_rule_1',
+        name: 'Existing rule',
+        description: null,
+        inboxIdScope: null,
+        priority: 25,
+        enabled: true,
+        conditions: {
+          match: 'all',
+          conditions: [{ field: 'channel', op: 'eq', value: 'email' }],
+        },
+        actions: [{ type: 'assignToInbox', value: 'inbox_email' }],
+      } as never,
+    })
+
+    expect(screen.getByRole('heading', { name: 'Edit routing rule' })).toBeInTheDocument()
+    expect(screen.getByLabelText('Name')).toHaveValue('Existing rule')
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Updated rule' } })
+    fireEvent.change(screen.getByLabelText('Description'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateRoutingRuleFn).toHaveBeenCalledWith({
+        data: {
+          ruleId: 'routing_rule_1',
+          name: 'Updated rule',
+          description: null,
+          priority: 25,
+          enabled: true,
+          conditions: {
+            match: 'all',
+            conditions: [{ field: 'channel', op: 'eq', value: 'email' }],
+          },
+          actions: [{ type: 'assignToInbox', value: 'inbox_email' }],
+          inboxIdScope: null,
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Routing rule updated')
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('reports update errors and cancels edits', async () => {
+    mocks.updateRoutingRuleFn.mockRejectedValueOnce(new Error('Update failed'))
+    const { onOpenChange } = renderSheet({
+      rule: {
+        id: 'routing_rule_1',
+        name: 'Existing rule',
+        description: 'Existing description',
+        inboxIdScope: 'inbox_existing',
+        priority: 10,
+        enabled: false,
+        conditions: null,
+        actions: null,
+      } as never,
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Valid condition' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Valid action' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Update failed')
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+})
diff --git a/apps/web/src/components/admin/settings/routing/__tests__/routing-rule-list.test.tsx b/apps/web/src/components/admin/settings/routing/__tests__/routing-rule-list.test.tsx
new file mode 100644
index 000000000..e5ca1d97f
--- /dev/null
+++ b/apps/web/src/components/admin/settings/routing/__tests__/routing-rule-list.test.tsx
@@ -0,0 +1,401 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { RoutingRuleList } from '../routing-rule-list'
+
+type MutationOptions<TVars, TResult> = {
+  mutationFn: (vars: TVars) => Promise<TResult>
+  onSuccess?: (result: TResult) => void
+  onError?: (error: Error) => void
+}
+
+type Rule = {
+  id: string
+  name: string
+  inboxIdScope: string | null
+  enabled: boolean
+  priority: number
+  conditions: { conditions?: unknown[] } | null
+  actions: unknown[] | null
+  matchCount: number
+  lastMatchedAt: string | null
+}
+
+type Inbox = {
+  id: string
+  slug: string
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  reorderRoutingRulesFn: vi.fn(),
+  updateRoutingRuleFn: vi.fn(),
+  deleteRoutingRuleFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  permissionAllowed: true,
+  rules: [] as Rule[],
+  inboxes: [] as Inbox[],
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: (options: { queryKey: readonly unknown[] }) => ({
+    data: options.queryKey[0] === 'routing-rules' ? mocks.rules : mocks.inboxes,
+  }),
+  useMutation: <TVars, TResult>(options: MutationOptions<TVars, TResult>) => ({
+    isPending: false,
+    mutate: async (vars: TVars) => {
+      try {
+        const result = await options.mutationFn(vars)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@dnd-kit/core', () => ({
+  DndContext: ({
+    children,
+    onDragEnd,
+  }: {
+    children: ReactNode
+    sensors?: unknown
+    collisionDetection?: unknown
+    onDragEnd: (event: { active: { id: string }; over: { id: string } | null }) => void
+  }) => (
+    <div>
+      {children}
+      <button
+        type="button"
+        onClick={() => onDragEnd({ active: { id: 'rule_two' }, over: { id: 'rule_one' } })}
+      >
+        Drag second before first
+      </button>
+      <button
+        type="button"
+        onClick={() => onDragEnd({ active: { id: 'rule_one' }, over: { id: 'rule_one' } })}
+      >
+        Drag same item
+      </button>
+      <button
+        type="button"
+        onClick={() => onDragEnd({ active: { id: 'missing_rule' }, over: { id: 'rule_one' } })}
+      >
+        Drag missing item
+      </button>
+      <button type="button" onClick={() => onDragEnd({ active: { id: 'rule_one' }, over: null })}>
+        Drop without target
+      </button>
+    </div>
+  ),
+  KeyboardSensor: class KeyboardSensor {},
+  PointerSensor: class PointerSensor {},
+  closestCenter: vi.fn(),
+  useSensor: (sensor: unknown, options?: unknown) => ({ sensor, options }),
+  useSensors: (...sensors: unknown[]) => sensors,
+}))
+
+vi.mock('@dnd-kit/sortable', () => ({
+  SortableContext: ({ children }: { children: ReactNode; items: string[]; strategy: unknown }) => (
+    <div>{children}</div>
+  ),
+  arrayMove: <T,>(items: T[], oldIndex: number, newIndex: number): T[] => {
+    const next = items.slice()
+    const [item] = next.splice(oldIndex, 1)
+    next.splice(newIndex, 0, item)
+    return next
+  },
+  sortableKeyboardCoordinates: vi.fn(),
+  useSortable: ({ id }: { id: string }) => ({
+    attributes: { 'data-sortable-id': id },
+    listeners: {},
+    setNodeRef: vi.fn(),
+    transform: null,
+    transition: undefined,
+    isDragging: id === 'dragging_rule',
+  }),
+  verticalListSortingStrategy: 'vertical',
+}))
+
+vi.mock('@dnd-kit/utilities', () => ({
+  CSS: {
+    Transform: {
+      toString: (transform: unknown) => (transform ? 'translate3d(0, 0, 0)' : undefined),
+    },
+  },
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+    fallback = null,
+  }: {
+    children: ReactNode
+    fallback?: ReactNode
+    permission: string
+  }) => (mocks.permissionAllowed ? <>{children}</> : <>{fallback}</>),
+}))
+
+vi.mock('@/components/admin/settings/routing/routing-rule-editor-sheet', () => ({
+  RoutingRuleEditorSheet: ({
+    open,
+    onOpenChange,
+    rule,
+  }: {
+    open: boolean
+    onOpenChange: (open: boolean) => void
+    rule: Rule
+  }) =>
+    open ? (
+      <section role="dialog">
+        <span>Editing {rule.name}</span>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close editor
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    checked,
+    onCheckedChange,
+  }: {
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input
+      aria-label={`enabled-${checked ? 'on' : 'off'}`}
+      type="checkbox"
+      checked={checked}
+      onChange={() => onCheckedChange(!checked)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  Bars3Icon: () => <span aria-hidden="true">bars</span>,
+  PencilSquareIcon: () => <span aria-hidden="true">pencil</span>,
+  TrashIcon: () => <span aria-hidden="true">trash</span>,
+}))
+
+vi.mock('@/lib/server/functions/routing', () => ({
+  reorderRoutingRulesFn: mocks.reorderRoutingRulesFn,
+  updateRoutingRuleFn: mocks.updateRoutingRuleFn,
+  deleteRoutingRuleFn: mocks.deleteRoutingRuleFn,
+}))
+
+vi.mock('@/lib/client/queries/routing-rules', () => ({
+  routingRuleQueries: {
+    list: ({ inboxIdScope }: { inboxIdScope?: string }) => ({
+      queryKey: ['routing-rules', { inboxIdScope }],
+    }),
+  },
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    list: ({ includeArchived }: { includeArchived?: boolean } = {}) => ({
+      queryKey: ['inboxes', 'list', { includeArchived }],
+    }),
+  },
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ROUTING_RULE_MANAGE: 'routing_rule.manage',
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.permissionAllowed = true
+  mocks.inboxes = [
+    { id: 'inbox_sales', slug: 'sales' },
+    { id: 'inbox_support', slug: 'support' },
+  ]
+  mocks.rules = [
+    {
+      id: 'rule_one',
+      name: 'Workspace urgent tickets',
+      inboxIdScope: null,
+      enabled: true,
+      priority: 10,
+      conditions: { conditions: [{ field: 'priority' }] },
+      actions: [{ type: 'assign_team' }],
+      matchCount: 1,
+      lastMatchedAt: '2026-06-18T10:00:00.000Z',
+    },
+    {
+      id: 'rule_two',
+      name: 'Sales billing route',
+      inboxIdScope: 'inbox_sales',
+      enabled: false,
+      priority: 20,
+      conditions: { conditions: [{ field: 'subject' }, { field: 'body' }] },
+      actions: [],
+      matchCount: 2,
+      lastMatchedAt: null,
+    },
+  ]
+  mocks.reorderRoutingRulesFn.mockResolvedValue(undefined)
+  mocks.updateRoutingRuleFn.mockResolvedValue({ id: 'rule_one' })
+  mocks.deleteRoutingRuleFn.mockResolvedValue(undefined)
+})
+
+describe('RoutingRuleList', () => {
+  it('renders an empty state when there are no rules', () => {
+    mocks.rules = []
+
+    render(<RoutingRuleList inboxIdScope="workspace" />)
+
+    expect(screen.getByText('No routing rules yet.')).toBeInTheDocument()
+  })
+
+  it('renders scoped rule summaries and exposes edit, toggle and delete actions', async () => {
+    render(<RoutingRuleList inboxIdScope="workspace" />)
+
+    expect(screen.getByText('Workspace urgent tickets')).toBeInTheDocument()
+    expect(screen.getByText('Sales billing route')).toBeInTheDocument()
+    expect(screen.getByText('Workspace')).toBeInTheDocument()
+    expect(screen.getByText('sales')).toBeInTheDocument()
+    expect(screen.getByText(/1 condition/)).toHaveTextContent('1 condition')
+    expect(screen.getByText(/2 conditions/)).toHaveTextContent('2 conditions')
+
+    fireEvent.click(screen.getByLabelText('enabled-on'))
+    await waitFor(() => {
+      expect(mocks.updateRoutingRuleFn).toHaveBeenCalledWith({
+        data: {
+          ruleId: 'rule_one',
+          enabled: false,
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['routing-rules'] })
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Edit rule' })[0])
+    expect(screen.getByRole('dialog')).toHaveTextContent('Editing Workspace urgent tickets')
+    fireEvent.click(screen.getByRole('button', { name: 'Close editor' }))
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Delete' })[0])
+    await waitFor(() => {
+      expect(mocks.deleteRoutingRuleFn).toHaveBeenCalledWith({
+        data: { ruleId: 'rule_one' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Rule deleted')
+  })
+
+  it('reorders rules optimistically and ignores no-op drag events', async () => {
+    render(<RoutingRuleList />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Drag same item' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Drag missing item' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Drop without target' }))
+    expect(mocks.reorderRoutingRulesFn).not.toHaveBeenCalled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Drag second before first' }))
+    await waitFor(() => {
+      expect(mocks.reorderRoutingRulesFn).toHaveBeenCalledWith({
+        data: { orderedIds: ['rule_two', 'rule_one'] },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['routing-rules'] })
+  })
+
+  it('restores server order and reports errors when reorder, toggle or delete fail', async () => {
+    mocks.reorderRoutingRulesFn.mockRejectedValueOnce(new Error('Cannot reorder'))
+    mocks.updateRoutingRuleFn.mockRejectedValueOnce(new Error('Cannot toggle'))
+    mocks.deleteRoutingRuleFn.mockRejectedValueOnce(new Error('Cannot delete'))
+
+    render(<RoutingRuleList />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Drag second before first' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Cannot reorder')
+    })
+
+    fireEvent.click(screen.getByLabelText('enabled-on'))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Cannot toggle')
+    })
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Delete' })[0])
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Cannot delete')
+    })
+  })
+
+  it('renders status badges instead of controls when routing management is denied', () => {
+    mocks.permissionAllowed = false
+
+    render(<RoutingRuleList />)
+
+    expect(screen.queryByRole('button', { name: 'Drag to reorder' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Edit rule' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Delete rule' })).not.toBeInTheDocument()
+    expect(screen.getByText('Enabled')).toBeInTheDocument()
+    expect(screen.getByText('Disabled')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/routing/routing-actions-builder.tsx b/apps/web/src/components/admin/settings/routing/routing-actions-builder.tsx
new file mode 100644
index 000000000..52e4f2200
--- /dev/null
+++ b/apps/web/src/components/admin/settings/routing/routing-actions-builder.tsx
@@ -0,0 +1,176 @@
+/**
+ * Actions builder for routing rules. Each action is `{type, value: string}`
+ * where the value is an entity id (inbox/team/principal) or an enum value
+ * (priority/visibility).
+ */
+import type { InboxId, TeamId, PrincipalId } from '@quackback/ids'
+import { Button } from '@/components/ui/button'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { TrashIcon, PlusIcon } from '@heroicons/react/24/outline'
+import { InboxPicker } from '@/components/admin/shared/inbox-picker'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+
+const ACTION_TYPES = [
+  'assignToInbox',
+  'assignToTeam',
+  'assignToPrincipal',
+  'setPriority',
+  'setVisibility',
+  'addParticipant',
+] as const
+type ActionType = (typeof ACTION_TYPES)[number]
+
+const PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+const VISIBILITY = ['team', 'org', 'shared', 'private'] as const
+
+const TYPE_LABELS: Record<ActionType, string> = {
+  assignToInbox: 'Assign to inbox',
+  assignToTeam: 'Assign to team',
+  assignToPrincipal: 'Assign to principal',
+  setPriority: 'Set priority',
+  setVisibility: 'Set visibility',
+  addParticipant: 'Add participant',
+}
+
+export interface BuilderAction {
+  type: ActionType
+  value: string
+}
+
+interface Props {
+  value: BuilderAction[]
+  onChange: (next: BuilderAction[]) => void
+}
+
+export function RoutingActionsBuilder({ value, onChange }: Props) {
+  const update = (idx: number, patch: Partial<BuilderAction>) => {
+    onChange(
+      value.map((a, i) => {
+        if (i !== idx) return a
+        const merged = { ...a, ...patch }
+        if (patch.type !== undefined && patch.type !== a.type) {
+          merged.value = ''
+        }
+        return merged
+      })
+    )
+  }
+  const add = () => onChange([...value, { type: 'assignToInbox', value: '' }])
+  const remove = (idx: number) => onChange(value.filter((_, i) => i !== idx))
+
+  return (
+    <div className="space-y-2">
+      {value.map((a, idx) => (
+        <div key={idx} className="grid grid-cols-[200px_1fr_auto] gap-2 items-start">
+          <Select value={a.type} onValueChange={(v) => update(idx, { type: v as ActionType })}>
+            <SelectTrigger className="h-8 text-xs">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              {ACTION_TYPES.map((t) => (
+                <SelectItem key={t} value={t}>
+                  {TYPE_LABELS[t]}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+          <ActionValueInput
+            type={a.type}
+            value={a.value}
+            onChange={(v) => update(idx, { value: v })}
+          />
+          <Button
+            variant="ghost"
+            size="sm"
+            className="h-8 w-8 p-0"
+            onClick={() => remove(idx)}
+            aria-label="Remove action"
+          >
+            <TrashIcon className="h-3.5 w-3.5" />
+          </Button>
+        </div>
+      ))}
+      <Button variant="outline" size="sm" onClick={add}>
+        <PlusIcon className="h-3.5 w-3.5 mr-1" />
+        Add action
+      </Button>
+    </div>
+  )
+}
+
+function ActionValueInput({
+  type,
+  value,
+  onChange,
+}: {
+  type: ActionType
+  value: string
+  onChange: (v: string) => void
+}) {
+  switch (type) {
+    case 'assignToInbox':
+      return (
+        <InboxPicker
+          value={(value as InboxId) || null}
+          onValueChange={(v) => onChange((v as string) ?? '')}
+          allowClear
+          placeholder="Pick inbox…"
+        />
+      )
+    case 'assignToTeam':
+      return (
+        <TeamPicker
+          value={(value as TeamId) || null}
+          onValueChange={(v) => onChange((v as string) ?? '')}
+          allowClear
+          placeholder="Pick team…"
+        />
+      )
+    case 'assignToPrincipal':
+    case 'addParticipant':
+      return (
+        <PrincipalPicker
+          value={(value as PrincipalId) || null}
+          onValueChange={(v) => onChange((v as string) ?? '')}
+          placeholder="Pick principal…"
+        />
+      )
+    case 'setPriority':
+      return (
+        <Select value={value} onValueChange={onChange}>
+          <SelectTrigger className="h-8 text-xs">
+            <SelectValue placeholder="Pick priority…" />
+          </SelectTrigger>
+          <SelectContent>
+            {PRIORITIES.map((p) => (
+              <SelectItem key={p} value={p}>
+                {p}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      )
+    case 'setVisibility':
+      return (
+        <Select value={value} onValueChange={onChange}>
+          <SelectTrigger className="h-8 text-xs">
+            <SelectValue placeholder="Pick visibility…" />
+          </SelectTrigger>
+          <SelectContent>
+            {VISIBILITY.map((v) => (
+              <SelectItem key={v} value={v}>
+                {v}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      )
+  }
+}
diff --git a/apps/web/src/components/admin/settings/routing/routing-conditions-builder.tsx b/apps/web/src/components/admin/settings/routing/routing-conditions-builder.tsx
new file mode 100644
index 000000000..53506fd8e
--- /dev/null
+++ b/apps/web/src/components/admin/settings/routing/routing-conditions-builder.tsx
@@ -0,0 +1,274 @@
+/**
+ * Conditions builder. Edits a `{match: 'all'|'any', conditions: RoutingCondition[]}`
+ * structure used by routing rules. Per-field value renderer adapts to the
+ * selected field + op (string vs string[] when op === 'in').
+ */
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { TrashIcon, PlusIcon } from '@heroicons/react/24/outline'
+import { cn } from '@/lib/shared/utils'
+
+const FIELDS = [
+  'subject',
+  'descriptionText',
+  'channel',
+  'priority',
+  'organizationDomain',
+  'requesterEmail',
+  'inboxChannelKind',
+] as const
+type Field = (typeof FIELDS)[number]
+
+const OPS = ['eq', 'contains', 'matches', 'in'] as const
+type Op = (typeof OPS)[number]
+
+const PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+const TICKET_CHANNELS = ['portal', 'email', 'api', 'widget'] as const
+const INBOX_CHANNEL_KINDS = ['portal', 'email', 'api', 'widget', 'webhook'] as const
+
+const FIELD_LABELS: Record<Field, string> = {
+  subject: 'Subject',
+  descriptionText: 'Description text',
+  channel: 'Ticket channel',
+  priority: 'Priority',
+  organizationDomain: 'Organization domain',
+  requesterEmail: 'Requester email',
+  inboxChannelKind: 'Inbox channel kind',
+}
+
+export interface BuilderCondition {
+  field: Field
+  op: Op
+  value: string | string[]
+}
+
+export interface BuilderRuleSet {
+  match: 'all' | 'any'
+  conditions: BuilderCondition[]
+}
+
+interface Props {
+  value: BuilderRuleSet
+  onChange: (next: BuilderRuleSet) => void
+}
+
+export function RoutingConditionsBuilder({ value, onChange }: Props) {
+  const updateCondition = (idx: number, patch: Partial<BuilderCondition>) => {
+    const next = value.conditions.map((c, i) => {
+      if (i !== idx) return c
+      const merged = { ...c, ...patch }
+      // Normalize value shape when op flips between array (`in`) and scalar.
+      if (patch.op !== undefined && patch.op !== c.op) {
+        if (patch.op === 'in' && !Array.isArray(merged.value)) {
+          merged.value = merged.value ? [merged.value] : []
+        } else if (patch.op !== 'in' && Array.isArray(merged.value)) {
+          merged.value = merged.value[0] ?? ''
+        }
+      }
+      // When changing field, reset value to a sensible default for that field.
+      if (patch.field !== undefined && patch.field !== c.field) {
+        merged.value = merged.op === 'in' ? [] : ''
+      }
+      return merged
+    })
+    onChange({ ...value, conditions: next })
+  }
+
+  const addCondition = () => {
+    onChange({
+      ...value,
+      conditions: [...value.conditions, { field: 'subject', op: 'contains', value: '' }],
+    })
+  }
+
+  const removeCondition = (idx: number) => {
+    onChange({
+      ...value,
+      conditions: value.conditions.filter((_, i) => i !== idx),
+    })
+  }
+
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center gap-2">
+        <span className="text-xs font-medium text-muted-foreground">Match</span>
+        <div className="inline-flex rounded-md border border-border/60 overflow-hidden">
+          {(['all', 'any'] as const).map((m) => (
+            <button
+              key={m}
+              type="button"
+              onClick={() => onChange({ ...value, match: m })}
+              className={cn(
+                'px-2.5 py-1 text-xs',
+                value.match === m
+                  ? 'bg-primary text-primary-foreground'
+                  : 'bg-background text-muted-foreground hover:bg-muted'
+              )}
+            >
+              {m === 'all' ? 'All' : 'Any'}
+            </button>
+          ))}
+        </div>
+        <span className="text-xs text-muted-foreground">of the following</span>
+      </div>
+
+      <div className="space-y-2">
+        {value.conditions.map((c, idx) => (
+          <div key={idx} className="grid grid-cols-[180px_140px_1fr_auto] gap-2 items-start">
+            <Select
+              value={c.field}
+              onValueChange={(v) => updateCondition(idx, { field: v as Field })}
+            >
+              <SelectTrigger className="h-8 text-xs">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {FIELDS.map((f) => (
+                  <SelectItem key={f} value={f}>
+                    {FIELD_LABELS[f]}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            <Select value={c.op} onValueChange={(v) => updateCondition(idx, { op: v as Op })}>
+              <SelectTrigger className="h-8 text-xs">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {OPS.map((o) => (
+                  <SelectItem key={o} value={o}>
+                    {o}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            <ConditionValueInput
+              field={c.field}
+              op={c.op}
+              value={c.value}
+              onChange={(v) => updateCondition(idx, { value: v })}
+            />
+            <Button
+              variant="ghost"
+              size="sm"
+              className="h-8 w-8 p-0"
+              onClick={() => removeCondition(idx)}
+              aria-label="Remove condition"
+            >
+              <TrashIcon className="h-3.5 w-3.5" />
+            </Button>
+          </div>
+        ))}
+      </div>
+
+      <Button variant="outline" size="sm" onClick={addCondition}>
+        <PlusIcon className="h-3.5 w-3.5 mr-1" />
+        Add condition
+      </Button>
+    </div>
+  )
+}
+
+function ConditionValueInput({
+  field,
+  op,
+  value,
+  onChange,
+}: {
+  field: Field
+  op: Op
+  value: string | string[]
+  onChange: (v: string | string[]) => void
+}) {
+  const enumOptions =
+    field === 'channel'
+      ? (TICKET_CHANNELS as readonly string[])
+      : field === 'priority'
+        ? (PRIORITIES as readonly string[])
+        : field === 'inboxChannelKind'
+          ? (INBOX_CHANNEL_KINDS as readonly string[])
+          : null
+
+  // For `in` op on enum fields, render comma-separated select chips.
+  if (op === 'in') {
+    const arrVal = Array.isArray(value) ? value : value ? [value] : []
+    if (enumOptions) {
+      // Multi-toggle
+      return (
+        <div className="flex flex-wrap gap-1">
+          {enumOptions.map((opt) => {
+            const checked = arrVal.includes(opt)
+            return (
+              <button
+                key={opt}
+                type="button"
+                onClick={() => {
+                  const next = checked ? arrVal.filter((v) => v !== opt) : [...arrVal, opt]
+                  onChange(next)
+                }}
+                className={
+                  'text-[11px] rounded border px-2 py-0.5 ' +
+                  (checked
+                    ? 'bg-primary text-primary-foreground border-primary'
+                    : 'bg-background border-border/60 text-muted-foreground hover:bg-muted')
+                }
+              >
+                {opt}
+              </button>
+            )
+          })}
+        </div>
+      )
+    }
+    // Free-text comma list for non-enum fields.
+    return (
+      <Input
+        className="h-8 text-xs"
+        value={arrVal.join(', ')}
+        placeholder="value1, value2, …"
+        onChange={(e) =>
+          onChange(
+            e.target.value
+              .split(',')
+              .map((s) => s.trim())
+              .filter(Boolean)
+          )
+        }
+      />
+    )
+  }
+
+  // Scalar ops on enum fields → Select.
+  if (enumOptions) {
+    return (
+      <Select value={typeof value === 'string' ? value : ''} onValueChange={(v) => onChange(v)}>
+        <SelectTrigger className="h-8 text-xs">
+          <SelectValue placeholder="Pick value…" />
+        </SelectTrigger>
+        <SelectContent>
+          {enumOptions.map((opt) => (
+            <SelectItem key={opt} value={opt}>
+              {opt}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    )
+  }
+
+  return (
+    <Input
+      className="h-8 text-xs"
+      value={typeof value === 'string' ? value : ''}
+      placeholder={op === 'matches' ? 'regex…' : 'value…'}
+      onChange={(e) => onChange(e.target.value)}
+    />
+  )
+}
diff --git a/apps/web/src/components/admin/settings/routing/routing-rule-editor-sheet.tsx b/apps/web/src/components/admin/settings/routing/routing-rule-editor-sheet.tsx
new file mode 100644
index 000000000..2925399e3
--- /dev/null
+++ b/apps/web/src/components/admin/settings/routing/routing-rule-editor-sheet.tsx
@@ -0,0 +1,279 @@
+/**
+ * Routing rule editor — Sheet drawer used for both create and edit. When `rule`
+ * is provided, prefills + calls update; otherwise calls create. Conditions and
+ * actions are jsonb on the server; the builders below shape them.
+ */
+import { useEffect, useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { InboxId, RoutingRuleId } from '@quackback/ids'
+import type { RoutingRule } from '@/lib/shared/db-types'
+import { createRoutingRuleFn, updateRoutingRuleFn } from '@/lib/server/functions/routing'
+import {
+  Sheet,
+  SheetContent,
+  SheetDescription,
+  SheetFooter,
+  SheetHeader,
+  SheetTitle,
+} from '@/components/ui/sheet'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import { Switch } from '@/components/ui/switch'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { InboxPicker } from '@/components/admin/shared/inbox-picker'
+import {
+  RoutingConditionsBuilder,
+  type BuilderRuleSet,
+  type BuilderCondition,
+} from './routing-conditions-builder'
+import { RoutingActionsBuilder, type BuilderAction } from './routing-actions-builder'
+
+interface Props {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  rule?: RoutingRule
+}
+
+const DEFAULT_RULE_SET: BuilderRuleSet = {
+  match: 'all',
+  conditions: [{ field: 'subject', op: 'contains', value: '' }],
+}
+const DEFAULT_ACTIONS: BuilderAction[] = [{ type: 'assignToInbox', value: '' }]
+
+export function RoutingRuleEditorSheet({ open, onOpenChange, rule }: Props) {
+  const qc = useQueryClient()
+  const isEdit = Boolean(rule)
+
+  const [name, setName] = useState('')
+  const [description, setDescription] = useState('')
+  const [scopeMode, setScopeMode] = useState<'workspace' | 'inbox'>('workspace')
+  const [inboxScope, setInboxScope] = useState<InboxId | null>(null)
+  const [priority, setPriority] = useState<number>(100)
+  const [enabled, setEnabled] = useState(true)
+  const [ruleSet, setRuleSet] = useState<BuilderRuleSet>(DEFAULT_RULE_SET)
+  const [actions, setActions] = useState<BuilderAction[]>(DEFAULT_ACTIONS)
+
+  // Prefill / reset when sheet opens or rule changes.
+  useEffect(() => {
+    if (!open) return
+    if (rule) {
+      setName(rule.name)
+      setDescription(rule.description ?? '')
+      setScopeMode(rule.inboxIdScope ? 'inbox' : 'workspace')
+      setInboxScope((rule.inboxIdScope as InboxId | null) ?? null)
+      setPriority(rule.priority)
+      setEnabled(rule.enabled)
+      const rsRaw = rule.conditions as {
+        match?: 'all' | 'any'
+        conditions?: BuilderCondition[]
+      } | null
+      setRuleSet({
+        match: rsRaw?.match ?? 'all',
+        conditions:
+          rsRaw?.conditions && rsRaw.conditions.length > 0
+            ? rsRaw.conditions
+            : DEFAULT_RULE_SET.conditions,
+      })
+      const aRaw = (rule.actions as BuilderAction[] | null) ?? []
+      setActions(aRaw.length > 0 ? aRaw : DEFAULT_ACTIONS)
+    } else {
+      setName('')
+      setDescription('')
+      setScopeMode('workspace')
+      setInboxScope(null)
+      setPriority(100)
+      setEnabled(true)
+      setRuleSet(DEFAULT_RULE_SET)
+      setActions(DEFAULT_ACTIONS)
+    }
+  }, [open, rule])
+
+  const validate = (): string | null => {
+    if (!name.trim()) return 'Name is required'
+    if (scopeMode === 'inbox' && !inboxScope) return 'Pick an inbox or switch to workspace scope'
+    if (ruleSet.conditions.length === 0) return 'At least one condition is required'
+    for (const c of ruleSet.conditions) {
+      if (Array.isArray(c.value) ? c.value.length === 0 : !c.value) {
+        return `Condition on "${c.field}" is missing a value`
+      }
+    }
+    if (actions.length === 0) return 'At least one action is required'
+    for (const a of actions) {
+      if (!a.value) return `Action "${a.type}" is missing a value`
+    }
+    return null
+  }
+
+  const createMutation = useMutation({
+    mutationFn: () =>
+      createRoutingRuleFn({
+        data: {
+          name: name.trim(),
+          description: description.trim() || null,
+          priority,
+          enabled,
+          conditions: ruleSet,
+          actions,
+          inboxIdScope: scopeMode === 'inbox' ? inboxScope : null,
+        },
+      }),
+    onSuccess: () => {
+      toast.success('Routing rule created')
+      qc.invalidateQueries({ queryKey: ['routing-rules'] })
+      onOpenChange(false)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const updateMutation = useMutation({
+    mutationFn: () =>
+      updateRoutingRuleFn({
+        data: {
+          ruleId: rule!.id as RoutingRuleId,
+          name: name.trim(),
+          description: description.trim() || null,
+          priority,
+          enabled,
+          conditions: ruleSet,
+          actions,
+          inboxIdScope: scopeMode === 'inbox' ? inboxScope : null,
+        },
+      }),
+    onSuccess: () => {
+      toast.success('Routing rule updated')
+      qc.invalidateQueries({ queryKey: ['routing-rules'] })
+      onOpenChange(false)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const handleSave = () => {
+    const err = validate()
+    if (err) {
+      toast.error(err)
+      return
+    }
+    if (isEdit) updateMutation.mutate()
+    else createMutation.mutate()
+  }
+
+  const isPending = createMutation.isPending || updateMutation.isPending
+
+  return (
+    <Sheet open={open} onOpenChange={onOpenChange}>
+      <SheetContent side="right" className="w-full sm:max-w-2xl overflow-y-auto">
+        <SheetHeader>
+          <SheetTitle>{isEdit ? 'Edit routing rule' : 'New routing rule'}</SheetTitle>
+          <SheetDescription>
+            Conditions are evaluated against incoming tickets; matching rules apply their actions in
+            order.
+          </SheetDescription>
+        </SheetHeader>
+
+        <div className="space-y-5 py-4 px-4">
+          <section className="space-y-3">
+            <h3 className="text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+              Basics
+            </h3>
+            <div className="space-y-2">
+              <Label htmlFor="rule-name">Name</Label>
+              <Input
+                id="rule-name"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                placeholder="e.g. Urgent VIP tickets → tier 2"
+              />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="rule-desc">Description</Label>
+              <Textarea
+                id="rule-desc"
+                value={description}
+                onChange={(e) => setDescription(e.target.value)}
+                rows={2}
+                placeholder="Optional"
+              />
+            </div>
+            <div className="grid grid-cols-2 gap-3">
+              <div className="space-y-2">
+                <Label>Scope</Label>
+                <Select
+                  value={scopeMode}
+                  onValueChange={(v) => setScopeMode(v as 'workspace' | 'inbox')}
+                >
+                  <SelectTrigger>
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="workspace">Workspace-wide</SelectItem>
+                    <SelectItem value="inbox">Specific inbox</SelectItem>
+                  </SelectContent>
+                </Select>
+              </div>
+              <div className="space-y-2">
+                <Label htmlFor="rule-priority">Priority</Label>
+                <Input
+                  id="rule-priority"
+                  type="number"
+                  min={0}
+                  max={1_000_000}
+                  value={priority}
+                  onChange={(e) => setPriority(Number(e.target.value) || 0)}
+                />
+              </div>
+            </div>
+            {scopeMode === 'inbox' && (
+              <div className="space-y-2">
+                <Label>Inbox</Label>
+                <InboxPicker
+                  value={inboxScope}
+                  onValueChange={setInboxScope}
+                  allowClear
+                  placeholder="Pick inbox…"
+                />
+              </div>
+            )}
+            <div className="flex items-center gap-2">
+              <Switch checked={enabled} onCheckedChange={setEnabled} id="rule-enabled" />
+              <Label htmlFor="rule-enabled" className="text-xs cursor-pointer">
+                Enabled
+              </Label>
+            </div>
+          </section>
+
+          <section className="space-y-3">
+            <h3 className="text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+              Conditions
+            </h3>
+            <RoutingConditionsBuilder value={ruleSet} onChange={setRuleSet} />
+          </section>
+
+          <section className="space-y-3">
+            <h3 className="text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+              Actions
+            </h3>
+            <RoutingActionsBuilder value={actions} onChange={setActions} />
+          </section>
+        </div>
+
+        <SheetFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)} disabled={isPending}>
+            Cancel
+          </Button>
+          <Button onClick={handleSave} disabled={isPending}>
+            {isEdit ? 'Save changes' : 'Create rule'}
+          </Button>
+        </SheetFooter>
+      </SheetContent>
+    </Sheet>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/routing/routing-rule-list.tsx b/apps/web/src/components/admin/settings/routing/routing-rule-list.tsx
new file mode 100644
index 000000000..d018a2fc4
--- /dev/null
+++ b/apps/web/src/components/admin/settings/routing/routing-rule-list.tsx
@@ -0,0 +1,259 @@
+/**
+ * Routing rule list with drag-reorder. Lower priority = runs first.
+ * Shows priority badge, name, scope, enabled toggle, match stats, edit/delete.
+ */
+import { useState, useEffect } from 'react'
+import { useSuspenseQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import {
+  DndContext,
+  closestCenter,
+  KeyboardSensor,
+  PointerSensor,
+  useSensor,
+  useSensors,
+  type DragEndEvent,
+} from '@dnd-kit/core'
+import {
+  arrayMove,
+  SortableContext,
+  sortableKeyboardCoordinates,
+  useSortable,
+  verticalListSortingStrategy,
+} from '@dnd-kit/sortable'
+import { CSS } from '@dnd-kit/utilities'
+import { Bars3Icon, PencilSquareIcon, TrashIcon } from '@heroicons/react/24/outline'
+import type { InboxId, RoutingRuleId } from '@quackback/ids'
+import type { RoutingRule } from '@/lib/shared/db-types'
+import {
+  reorderRoutingRulesFn,
+  updateRoutingRuleFn,
+  deleteRoutingRuleFn,
+} from '@/lib/server/functions/routing'
+import { routingRuleQueries } from '@/lib/client/queries/routing-rules'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import { Button } from '@/components/ui/button'
+import { Switch } from '@/components/ui/switch'
+import { Badge } from '@/components/ui/badge'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { RoutingRuleEditorSheet } from './routing-rule-editor-sheet'
+
+interface Props {
+  inboxIdScope?: InboxId | 'workspace'
+}
+
+export function RoutingRuleList({ inboxIdScope }: Props) {
+  const qc = useQueryClient()
+  const listKey = routingRuleQueries.list({ inboxIdScope }).queryKey
+  const { data: serverRules } = useSuspenseQuery(routingRuleQueries.list({ inboxIdScope }))
+  const { data: inboxes } = useSuspenseQuery(inboxQueries.list({ includeArchived: true }))
+
+  // Local mirror so optimistic reorder can render before server confirms.
+  const [rules, setRules] = useState<RoutingRule[]>(serverRules)
+  useEffect(() => {
+    setRules(serverRules)
+  }, [serverRules])
+
+  const inboxLabel = (id: string | null): string => {
+    if (!id) return 'Workspace'
+    const ix = inboxes.find((i) => i.id === id)
+    return ix ? ix.slug : '—'
+  }
+
+  const sensors = useSensors(
+    useSensor(PointerSensor, { activationConstraint: { distance: 4 } }),
+    useSensor(KeyboardSensor, { coordinateGetter: sortableKeyboardCoordinates })
+  )
+
+  const reorderMutation = useMutation({
+    mutationFn: (orderedIds: RoutingRuleId[]) => reorderRoutingRulesFn({ data: { orderedIds } }),
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['routing-rules'] }),
+    onError: (e: Error) => {
+      toast.error(e.message)
+      setRules(serverRules)
+    },
+  })
+
+  const toggleEnabledMutation = useMutation({
+    mutationFn: (vars: { ruleId: RoutingRuleId; enabled: boolean }) =>
+      updateRoutingRuleFn({ data: { ruleId: vars.ruleId, enabled: vars.enabled } }),
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['routing-rules'] }),
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const deleteMutation = useMutation({
+    mutationFn: (ruleId: RoutingRuleId) => deleteRoutingRuleFn({ data: { ruleId } }),
+    onSuccess: () => {
+      toast.success('Rule deleted')
+      qc.invalidateQueries({ queryKey: ['routing-rules'] })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const handleDragEnd = (event: DragEndEvent) => {
+    const { active, over } = event
+    if (!over || active.id === over.id) return
+    const oldIndex = rules.findIndex((r) => r.id === active.id)
+    const newIndex = rules.findIndex((r) => r.id === over.id)
+    if (oldIndex < 0 || newIndex < 0) return
+    const next = arrayMove(rules, oldIndex, newIndex)
+    setRules(next)
+    reorderMutation.mutate(next.map((r) => r.id as RoutingRuleId))
+  }
+
+  // Force the listKey to be referenced so eslint doesn't flag it; the queryKey
+  // itself is consumed by useSuspenseQuery via routingRuleQueries.list().
+  void listKey
+
+  if (rules.length === 0) {
+    return (
+      <div className="rounded-md border border-border/50 p-8 text-center text-sm text-muted-foreground">
+        No routing rules yet.
+      </div>
+    )
+  }
+
+  return (
+    <div className="rounded-md border border-border/50 divide-y divide-border/50">
+      <DndContext sensors={sensors} collisionDetection={closestCenter} onDragEnd={handleDragEnd}>
+        <SortableContext items={rules.map((r) => r.id)} strategy={verticalListSortingStrategy}>
+          {rules.map((rule, idx) => (
+            <SortableRuleRow
+              key={rule.id}
+              rule={rule}
+              position={idx + 1}
+              inboxLabel={inboxLabel(rule.inboxIdScope as string | null)}
+              onToggleEnabled={(enabled) =>
+                toggleEnabledMutation.mutate({ ruleId: rule.id as RoutingRuleId, enabled })
+              }
+              onDelete={() => deleteMutation.mutate(rule.id as RoutingRuleId)}
+            />
+          ))}
+        </SortableContext>
+      </DndContext>
+    </div>
+  )
+}
+
+interface RowProps {
+  rule: RoutingRule
+  position: number
+  inboxLabel: string
+  onToggleEnabled: (enabled: boolean) => void
+  onDelete: () => void
+}
+
+function SortableRuleRow({ rule, position, inboxLabel, onToggleEnabled, onDelete }: RowProps) {
+  const { attributes, listeners, setNodeRef, transform, transition, isDragging } = useSortable({
+    id: rule.id,
+  })
+  const [editOpen, setEditOpen] = useState(false)
+  const style = {
+    transform: CSS.Transform.toString(transform),
+    transition,
+    opacity: isDragging ? 0.5 : 1,
+  }
+
+  const conditions = (rule.conditions as { conditions?: unknown[] } | null)?.conditions ?? []
+  const actions = (rule.actions as unknown[]) ?? []
+  const lastMatched = rule.lastMatchedAt ? new Date(rule.lastMatchedAt as unknown as string) : null
+
+  return (
+    <div
+      ref={setNodeRef}
+      style={style}
+      className="flex items-center gap-3 px-3 py-2 hover:bg-muted/30 group"
+    >
+      <PermissionGate
+        permission={PERMISSIONS.ROUTING_RULE_MANAGE}
+        fallback={<div className="w-3.5" />}
+      >
+        <button
+          {...attributes}
+          {...listeners}
+          className="touch-none cursor-grab active:cursor-grabbing"
+          aria-label="Drag to reorder"
+        >
+          <Bars3Icon className="h-3.5 w-3.5 text-muted-foreground opacity-0 group-hover:opacity-100" />
+        </button>
+      </PermissionGate>
+
+      <Badge variant="outline" className="font-mono text-[10px] w-8 justify-center">
+        {position}
+      </Badge>
+
+      <div className="flex-1 min-w-0">
+        <div className="flex items-center gap-2">
+          <span className="text-sm font-medium truncate">{rule.name}</span>
+          <Badge variant="outline" className="text-[10px]">
+            {inboxLabel}
+          </Badge>
+        </div>
+        <div className="text-[11px] text-muted-foreground mt-0.5">
+          {conditions.length} condition{conditions.length === 1 ? '' : 's'} · {actions.length}{' '}
+          action{actions.length === 1 ? '' : 's'} · {rule.matchCount} match
+          {rule.matchCount === 1 ? '' : 'es'}
+          {lastMatched && (
+            <>
+              {' · last '}
+              {lastMatched.toLocaleDateString()}
+            </>
+          )}
+        </div>
+      </div>
+
+      <PermissionGate
+        permission={PERMISSIONS.ROUTING_RULE_MANAGE}
+        fallback={
+          <Badge variant="outline" className="text-[10px]">
+            {rule.enabled ? 'Enabled' : 'Disabled'}
+          </Badge>
+        }
+      >
+        <Switch checked={rule.enabled} onCheckedChange={onToggleEnabled} />
+        <Button
+          variant="ghost"
+          size="sm"
+          className="h-7 w-7 p-0"
+          onClick={() => setEditOpen(true)}
+          aria-label="Edit rule"
+        >
+          <PencilSquareIcon className="h-3.5 w-3.5" />
+        </Button>
+        <AlertDialog>
+          <AlertDialogTrigger asChild>
+            <Button variant="ghost" size="sm" className="h-7 w-7 p-0" aria-label="Delete rule">
+              <TrashIcon className="h-3.5 w-3.5" />
+            </Button>
+          </AlertDialogTrigger>
+          <AlertDialogContent>
+            <AlertDialogHeader>
+              <AlertDialogTitle>Delete this routing rule?</AlertDialogTitle>
+              <AlertDialogDescription>
+                "{rule.name}" will stop running on incoming tickets. This cannot be undone.
+              </AlertDialogDescription>
+            </AlertDialogHeader>
+            <AlertDialogFooter>
+              <AlertDialogCancel>Cancel</AlertDialogCancel>
+              <AlertDialogAction onClick={onDelete}>Delete</AlertDialogAction>
+            </AlertDialogFooter>
+          </AlertDialogContent>
+        </AlertDialog>
+      </PermissionGate>
+
+      <RoutingRuleEditorSheet open={editOpen} onOpenChange={setEditOpen} rule={rule} />
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/security/__tests__/audit-log-csv.test.ts b/apps/web/src/components/admin/settings/security/__tests__/audit-log-csv.test.ts
index c9e61b433..103904344 100644
--- a/apps/web/src/components/admin/settings/security/__tests__/audit-log-csv.test.ts
+++ b/apps/web/src/components/admin/settings/security/__tests__/audit-log-csv.test.ts
@@ -1,46 +1,45 @@
 /**
- * CSV export for the audit-log table.
- *
- * The 0070_audit_log_observability migration added request_id (indexed
- * for cross-event forensics), actor_type, and auth_method. These must
- * appear in the CSV export — the export is the operator's primary
- * offline-forensics tool, so leaving the new columns out keeps them
- * effectively invisible.
+ * CSV export for the unified audit-log table.
  */
 import { describe, it, expect } from 'vitest'
-import { rowsToCsv } from '../audit-log-page'
-import type { AuditEventRow } from '@/lib/server/functions/audit-log'
+import { rowsToCsv } from '../../audit/audit-csv'
+import type { UnifiedAuditEventRow } from '@/lib/server/domains/audit/audit.unified'
 
-function row(overrides: Partial<AuditEventRow> = {}): AuditEventRow {
+function row(overrides: Partial<UnifiedAuditEventRow> = {}): UnifiedAuditEventRow {
   return {
     id: 'audit_1',
-    occurredAt: '2026-05-20T10:30:00.000Z',
+    origin: 'security',
+    occurredAt: new Date('2026-05-20T10:30:00.000Z'),
+    principalId: null,
     actorUserId: null,
     actorEmail: 'demo@example.com',
+    actorDisplayName: null,
     actorRole: 'admin',
-    actorIp: '127.0.0.1',
-    actorUserAgent: 'Mozilla/5.0',
-    eventType: 'auth.signin.succeeded',
-    eventOutcome: 'success',
+    actorType: null,
+    authMethod: null,
+    action: 'auth.signin.succeeded',
+    outcome: 'success',
+    source: null,
+    ipAddress: '127.0.0.1',
+    userAgent: 'Mozilla/5.0',
     targetType: null,
     targetId: null,
-    beforeValue: null,
-    afterValue: null,
-    metadata: null,
     requestId: null,
-    actorType: null,
-    authMethod: null,
+    diff: {},
+    metadata: null,
     ...overrides,
   }
 }
 
-describe('rowsToCsv — audit-log observability columns', () => {
+describe('rowsToCsv — unified audit observability columns', () => {
   it('includes request_id, actor_type, auth_method in the header row', () => {
     const csv = rowsToCsv([row()])
     const [header] = csv.split('\n')
     expect(header).toContain('request_id')
     expect(header).toContain('actor_type')
     expect(header).toContain('auth_method')
+    expect(header).toContain('origin')
+    expect(header).toContain('source')
   })
 
   it('emits the values in each data row', () => {
@@ -51,6 +50,35 @@ describe('rowsToCsv — audit-log observability columns', () => {
     expect(dataRow).toContain('sso')
   })
 
+  it('exports workspace and security rows together', () => {
+    const csv = rowsToCsv([
+      row({
+        origin: 'workspace',
+        principalId: 'principal_1',
+        actorEmail: 'owner@example.com',
+        actorDisplayName: 'Owner',
+        action: 'ticket.created',
+        outcome: null,
+        source: 'web',
+        targetType: 'ticket',
+        targetId: 'ticket_1',
+        diff: { after: { status: 'open' } },
+      }),
+      row({
+        origin: 'security',
+        action: 'auth.signin.success',
+        requestId: 'req_abc123',
+        actorType: 'user',
+        authMethod: 'sso',
+      }),
+    ])
+
+    expect(csv).toContain('workspace')
+    expect(csv).toContain('ticket.created')
+    expect(csv).toContain('security')
+    expect(csv).toContain('auth.signin.success')
+  })
+
   it('emits empty cells (not "null") when the observability fields are null', () => {
     const csv = rowsToCsv([row({ requestId: null, actorType: null, authMethod: null })])
     // Should not contain the literal string "null" — empty CSV cell instead.
diff --git a/apps/web/src/components/admin/settings/security/__tests__/portal-auth-tab.test.tsx b/apps/web/src/components/admin/settings/security/__tests__/portal-auth-tab.test.tsx
new file mode 100644
index 000000000..137c8259a
--- /dev/null
+++ b/apps/web/src/components/admin/settings/security/__tests__/portal-auth-tab.test.tsx
@@ -0,0 +1,394 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { PortalAuthTab } from '../portal-auth-tab'
+
+const mocks = vi.hoisted(() => ({
+  routerInvalidate: vi.fn(),
+  updatePortalAccessFn: vi.fn(),
+  query: {
+    data: [
+      { id: 'segment_1', name: 'Enterprise' },
+      { id: 'segment_2', name: 'Trial' },
+    ],
+    isLoading: false,
+    isError: false,
+  } as {
+    data?: Array<{ id: string; name: string }>
+    isLoading: boolean
+    isError: boolean
+  },
+  openInviteDialog: vi.fn(),
+  inviteOpenChange: vi.fn(),
+  sendInvites: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    to,
+  }: {
+    children: ReactNode
+    to: string
+    search?: Record<string, unknown>
+    className?: string
+  }) => <a href={to}>{children}</a>,
+  useRouter: () => ({
+    invalidate: mocks.routerInvalidate,
+  }),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQuery: () => mocks.query,
+}))
+
+vi.mock('@/lib/server/functions/portal-access', () => ({
+  updatePortalAccessFn: mocks.updatePortalAccessFn,
+}))
+
+vi.mock('@/lib/server/functions/admin', () => ({
+  listSegmentsFn: vi.fn(),
+}))
+
+vi.mock('@/components/admin/settings/settings-card', () => ({
+  SettingsCard: ({
+    title,
+    description,
+    action,
+    children,
+  }: {
+    title: string
+    description: string
+    action?: ReactNode
+    children: ReactNode
+  }) => (
+    <section>
+      <h2>{title}</h2>
+      <p>{description}</p>
+      {action}
+      {children}
+    </section>
+  ),
+}))
+
+vi.mock('@/components/admin/settings/portal-privacy-dialog', () => ({
+  PortalPrivacyDialog: ({
+    open,
+    onOpenChange,
+    onConfirm,
+  }: {
+    open: boolean
+    onOpenChange: (open: boolean) => void
+    onConfirm: () => void
+  }) =>
+    open ? (
+      <section role="alertdialog">
+        <span>Private portal confirmation</span>
+        <button type="button" onClick={onConfirm}>
+          Confirm private
+        </button>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Cancel private
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('@/components/admin/users/use-portal-invites', () => ({
+  usePortalInvites: () => ({
+    invites: [
+      { id: 'invite_1', status: 'pending' },
+      { id: 'invite_2', status: 'accepted' },
+    ],
+    pendingCount: 1,
+    acceptedCount: 1,
+    isLoading: false,
+    lastSentSummary: 'Sent 2 invites',
+    dialogOpen: true,
+    emailsInput: 'ada@example.com',
+    messageInput: 'hello',
+    emailError: null,
+    batchResults: [],
+    sendBusy: false,
+    openDialog: mocks.openInviteDialog,
+    onOpenChange: mocks.inviteOpenChange,
+    onEmailsChange: vi.fn(),
+    onMessageChange: vi.fn(),
+    onSend: mocks.sendInvites,
+  }),
+}))
+
+vi.mock('@/components/admin/users/invite-people-dialog', () => ({
+  InvitePeopleDialog: ({
+    open,
+    emailsInput,
+    onOpenChange,
+    onSend,
+  }: {
+    open: boolean
+    emailsInput: string
+    onOpenChange: (open: boolean) => void
+    onSend: () => void
+    [key: string]: unknown
+  }) =>
+    open ? (
+      <section>
+        Invite dialog {emailsInput}
+        <button type="button" onClick={onSend}>
+          Send invites
+        </button>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close invites
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('@/components/admin/segments/segment-multi-select', () => ({
+  SegmentMultiSelect: ({
+    segments,
+    value,
+    onChange,
+    disabled,
+  }: {
+    segments: Array<{ id: string; name: string }>
+    value: string[]
+    onChange: (value: string[]) => void
+    disabled?: boolean
+  }) => (
+    <section>
+      <span>
+        Segment picker {segments.map((segment) => segment.name).join(', ')} selected{' '}
+        {value.join(', ') || 'none'}
+      </span>
+      <button type="button" disabled={disabled} onClick={() => onChange(['segment_2'])}>
+        Pick trial segment
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    disabled,
+    type = 'button',
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    disabled?: boolean
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+  }) => (
+    <button type={type} onClick={onClick} disabled={disabled}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    value,
+    onChange,
+    onKeyDown,
+    placeholder,
+    disabled,
+    'aria-label': ariaLabel,
+  }: {
+    value?: string
+    onChange?: (event: { target: { value: string } }) => void
+    onKeyDown?: (event: { key: string; preventDefault: () => void }) => void
+    placeholder?: string
+    disabled?: boolean
+    'aria-label'?: string
+    'aria-invalid'?: boolean
+    className?: string
+  }) => (
+    <input
+      aria-label={ariaLabel}
+      value={value}
+      placeholder={placeholder}
+      disabled={disabled}
+      onChange={(event) => onChange?.({ target: { value: event.currentTarget.value } })}
+      onKeyDown={(event) =>
+        onKeyDown?.({ key: event.key, preventDefault: () => event.preventDefault() })
+      }
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    checked,
+    disabled,
+    onCheckedChange,
+    'aria-label': ariaLabel,
+  }: {
+    id?: string
+    checked?: boolean
+    disabled?: boolean
+    onCheckedChange?: (checked: boolean) => void
+    'aria-label'?: string
+  }) => (
+    <input
+      type="checkbox"
+      checked={checked}
+      disabled={disabled}
+      aria-label={ariaLabel}
+      onChange={(event) => onCheckedChange?.(event.currentTarget.checked)}
+    />
+  ),
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  ArrowPathIcon: () => <span aria-hidden="true">refresh</span>,
+  ArrowRightIcon: () => <span aria-hidden="true">right</span>,
+  GlobeAltIcon: () => <span aria-hidden="true">globe</span>,
+  LockClosedIcon: () => <span aria-hidden="true">lock</span>,
+  PlusIcon: () => <span aria-hidden="true">plus</span>,
+  XMarkIcon: () => <span aria-hidden="true">remove</span>,
+}))
+
+function privateConfig(overrides: Record<string, unknown> = {}) {
+  return {
+    access: {
+      visibility: 'private',
+      allowedDomains: ['acme.com'],
+      widgetSignIn: true,
+      allowedSegmentIds: ['segment_1'],
+      ...overrides,
+    },
+  } as never
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.query = {
+    data: [
+      { id: 'segment_1', name: 'Enterprise' },
+      { id: 'segment_2', name: 'Trial' },
+    ],
+    isLoading: false,
+    isError: false,
+  }
+  mocks.updatePortalAccessFn.mockResolvedValue(undefined)
+})
+
+describe('PortalAuthTab', () => {
+  it('updates private portal domains, segments, widget sign-in, and invite actions', async () => {
+    render(<PortalAuthTab portalConfig={privateConfig()} />)
+
+    expect(screen.getByText('Your team always has access.')).toBeInTheDocument()
+    expect(screen.getByText('acme.com')).toBeInTheDocument()
+    expect(
+      screen.getByText(/Segment picker Enterprise, Trial selected segment_1/)
+    ).toBeInTheDocument()
+    expect(
+      screen.getByText('Members of 1 selected segment can access this portal.')
+    ).toBeInTheDocument()
+    expect(screen.getByText('1 pending · 1 accepted')).toBeInTheDocument()
+    expect(screen.getByText('Sent 2 invites')).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /Manage invites/ })).toHaveAttribute(
+      'href',
+      '/admin/users'
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /Invite people/ }))
+    expect(mocks.openInviteDialog).toHaveBeenCalled()
+    fireEvent.click(screen.getByRole('button', { name: 'Send invites' }))
+    expect(mocks.sendInvites).toHaveBeenCalled()
+
+    fireEvent.change(screen.getByLabelText('Add email domain'), {
+      target: { value: 'bad domain' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: /Add/ }))
+    expect(screen.getByText('Enter a valid domain, e.g. acme.com')).toBeInTheDocument()
+
+    fireEvent.change(screen.getByLabelText('Add email domain'), {
+      target: { value: '@Example.COM' },
+    })
+    fireEvent.keyDown(screen.getByLabelText('Add email domain'), { key: 'Enter' })
+    await waitFor(() => {
+      expect(mocks.updatePortalAccessFn).toHaveBeenCalledWith({
+        data: {
+          visibility: 'private',
+          allowedDomains: ['acme.com', 'example.com'],
+          widgetSignIn: true,
+          allowedSegmentIds: ['segment_1'],
+        },
+      })
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Remove acme.com' }))
+    await waitFor(() => {
+      expect(mocks.updatePortalAccessFn).toHaveBeenCalledWith({
+        data: {
+          visibility: 'private',
+          allowedDomains: ['example.com'],
+          widgetSignIn: true,
+          allowedSegmentIds: ['segment_1'],
+        },
+      })
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick trial segment' }))
+    await waitFor(() => {
+      expect(mocks.updatePortalAccessFn).toHaveBeenCalledWith({
+        data: expect.objectContaining({ allowedSegmentIds: ['segment_2'] }),
+      })
+    })
+
+    fireEvent.click(screen.getByLabelText('Allow widget-authenticated users to access the portal'))
+    await waitFor(() => {
+      expect(mocks.updatePortalAccessFn).toHaveBeenCalledWith({
+        data: expect.objectContaining({ widgetSignIn: false }),
+      })
+    })
+  })
+
+  it('confirms private visibility and reverts optimistic access changes on save failure', async () => {
+    mocks.updatePortalAccessFn.mockRejectedValueOnce(new Error('denied'))
+    render(<PortalAuthTab portalConfig={{ access: { visibility: 'public' } } as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: /Private/ }))
+    expect(screen.getByText('Private portal confirmation')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel private' }))
+    expect(screen.queryByText('Private portal confirmation')).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: /Private/ }))
+    fireEvent.click(screen.getByRole('button', { name: 'Confirm private' }))
+    await waitFor(() => {
+      expect(mocks.updatePortalAccessFn).toHaveBeenCalledWith({
+        data: {
+          visibility: 'private',
+          allowedDomains: [],
+          widgetSignIn: false,
+          allowedSegmentIds: [],
+        },
+      })
+    })
+    expect(screen.queryByText('Your team always has access.')).not.toBeInTheDocument()
+  })
+
+  it('renders segment loading, error, and empty states', () => {
+    mocks.query = { data: undefined, isLoading: true, isError: false }
+    const { rerender } = render(<PortalAuthTab portalConfig={privateConfig()} />)
+    expect(screen.getByText(/Loading segments/)).toBeInTheDocument()
+
+    mocks.query = { data: undefined, isLoading: false, isError: true }
+    rerender(<PortalAuthTab portalConfig={privateConfig()} />)
+    expect(
+      screen.getByText('Could not load segments. Reload the page to try again.')
+    ).toBeInTheDocument()
+
+    mocks.query = { data: [], isLoading: false, isError: false }
+    rerender(<PortalAuthTab portalConfig={privateConfig()} />)
+    expect(
+      screen.getByText('No segments defined yet. Create segments in Customers.')
+    ).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/security/portal-auth-tab.tsx b/apps/web/src/components/admin/settings/security/portal-auth-tab.tsx
index d4466205c..031d7170b 100644
--- a/apps/web/src/components/admin/settings/security/portal-auth-tab.tsx
+++ b/apps/web/src/components/admin/settings/security/portal-auth-tab.tsx
@@ -368,7 +368,7 @@ export function PortalAuthTab({ portalConfig }: PortalAuthTabProps) {
 
           <SettingsCard
             title="Allowed segments"
-            description="Members of these segments can view the portal. Segments are defined on the People page."
+            description="Members of these segments can view the portal. Segments are managed in Customers."
           >
             {segmentsQuery.isLoading ? (
               <p className="text-xs text-muted-foreground">Loading segments…</p>
@@ -378,7 +378,7 @@ export function PortalAuthTab({ portalConfig }: PortalAuthTabProps) {
               </p>
             ) : (segmentsQuery.data ?? []).length === 0 ? (
               <p className="text-xs text-muted-foreground">
-                No segments defined yet. Create segments on the People page.
+                No segments defined yet. Create segments in Customers.
               </p>
             ) : (
               <div className="space-y-3">
diff --git a/apps/web/src/components/admin/settings/sla/__tests__/business-hours-dialog.test.tsx b/apps/web/src/components/admin/settings/sla/__tests__/business-hours-dialog.test.tsx
new file mode 100644
index 000000000..b4edb03c8
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/__tests__/business-hours-dialog.test.tsx
@@ -0,0 +1,249 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { BusinessHoursDialog } from '../business-hours-dialog'
+
+type MutationOptions = {
+  mutationFn: () => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  createBusinessHoursFn: vi.fn(),
+  updateBusinessHoursFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({ open, children }: { open: boolean; children: ReactNode }) =>
+    open ? <div role="dialog">{children}</div> : null,
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section>{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    'aria-label'?: string
+    variant?: string
+    size?: string
+    className?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+    type = 'text',
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    placeholder?: string
+    type?: string
+    step?: number
+    className?: string
+  }) => <input id={id} type={type} value={value} placeholder={placeholder} onChange={onChange} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  TrashIcon: () => <span />,
+  PlusIcon: () => <span />,
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  createBusinessHoursFn: mocks.createBusinessHoursFn,
+  updateBusinessHoursFn: mocks.updateBusinessHoursFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function renderDialog(props: Partial<React.ComponentProps<typeof BusinessHoursDialog>> = {}) {
+  const onOpenChange = vi.fn()
+  const view = render(<BusinessHoursDialog open onOpenChange={onOpenChange} {...props} />)
+  return { ...view, onOpenChange }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createBusinessHoursFn.mockResolvedValue({ id: 'business_hours_new' })
+  mocks.updateBusinessHoursFn.mockResolvedValue({ id: 'business_hours_1' })
+})
+
+describe('BusinessHoursDialog', () => {
+  it('does not render dialog content when closed', () => {
+    render(<BusinessHoursDialog open={false} onOpenChange={vi.fn()} />)
+
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+  })
+
+  it('validates create input and submits a trimmed create payload', async () => {
+    const { container, onOpenChange } = renderDialog()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Name is required')
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  EU support  ' } })
+    fireEvent.change(screen.getByLabelText('Timezone (IANA)'), { target: { value: '' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Timezone is required')
+
+    fireEvent.change(screen.getByLabelText('Timezone (IANA)'), {
+      target: { value: '  Europe/Stockholm  ' },
+    })
+    const timeInputs = Array.from(container.querySelectorAll('input[type="time"]'))
+    fireEvent.change(timeInputs[0], { target: { value: '18:00' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Mon: range start must be before end')
+
+    fireEvent.change(timeInputs[0], { target: { value: '09:30' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Add holiday' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Holiday date must be YYYY-MM-DD')
+
+    fireEvent.change(container.querySelector('input[type="date"]') as HTMLInputElement, {
+      target: { value: '2026-12-24' },
+    })
+    fireEvent.change(screen.getByPlaceholderText('Label (optional)'), {
+      target: { value: 'Christmas Eve' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+
+    await waitFor(() => {
+      expect(mocks.createBusinessHoursFn).toHaveBeenCalledWith({
+        data: expect.objectContaining({
+          name: 'EU support',
+          timezone: 'Europe/Stockholm',
+          holidays: [{ date: '2026-12-24', label: 'Christmas Eve' }],
+        }),
+      })
+    })
+    expect(mocks.createBusinessHoursFn.mock.calls[0][0].data.schedule.mon).toEqual([
+      { start: '09:30', end: '17:00' },
+    ])
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Calendar created')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['business-hours'] })
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('supports adding and removing ranges and holidays in edit mode', async () => {
+    const { container, onOpenChange } = renderDialog({
+      row: {
+        id: 'business_hours_1',
+        name: 'Existing calendar',
+        timezone: 'America/New_York',
+        schedule: {
+          mon: [],
+          tue: [{ start: '10:00', end: '16:00' }],
+          wed: [],
+          thu: [],
+          fri: [],
+          sat: [],
+          sun: [],
+        },
+        holidays: [{ date: '2026-01-01', label: 'New year' }],
+      } as never,
+    })
+
+    expect(screen.getByRole('heading', { name: 'Edit calendar' })).toBeInTheDocument()
+    expect(screen.getByDisplayValue('Existing calendar')).toBeInTheDocument()
+    expect(screen.getAllByText('Closed').length).toBeGreaterThan(0)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Updated calendar' } })
+    fireEvent.click(screen.getAllByRole('button', { name: 'Range' })[0])
+    const timeInputs = Array.from(container.querySelectorAll('input[type="time"]'))
+    fireEvent.change(timeInputs[0], { target: { value: '08:00' } })
+    fireEvent.change(timeInputs[1], { target: { value: '12:00' } })
+    fireEvent.click(screen.getAllByRole('button', { name: 'Remove holiday' })[0])
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateBusinessHoursFn).toHaveBeenCalledWith({
+        data: expect.objectContaining({
+          id: 'business_hours_1',
+          name: 'Updated calendar',
+          timezone: 'America/New_York',
+          holidays: [],
+        }),
+      })
+    })
+    expect(mocks.updateBusinessHoursFn.mock.calls[0][0].data.schedule.mon).toEqual([
+      { start: '08:00', end: '12:00' },
+    ])
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Calendar updated')
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('removes schedule ranges, cancels, and reports server errors', async () => {
+    mocks.createBusinessHoursFn.mockRejectedValueOnce(new Error('Calendar already exists'))
+    const { container, onOpenChange } = renderDialog()
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Remove range' })[0])
+    expect(screen.getAllByText('Closed').length).toBeGreaterThan(0)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'EU support' } })
+    const timeInputs = Array.from(container.querySelectorAll('input[type="time"]'))
+    fireEvent.change(timeInputs[0], { target: { value: '09:00' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Calendar already exists')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/settings/sla/__tests__/business-hours-list.test.tsx b/apps/web/src/components/admin/settings/sla/__tests__/business-hours-list.test.tsx
new file mode 100644
index 000000000..09d6a561f
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/__tests__/business-hours-list.test.tsx
@@ -0,0 +1,264 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import type { BusinessHoursId } from '@quackback/ids'
+import { BusinessHoursList } from '../business-hours-list'
+
+type BusinessHoursRow = {
+  id: BusinessHoursId
+  name: string
+  timezone: string
+  holidays: unknown[] | null
+  archivedAt: string | null
+}
+
+type MutationOptions = {
+  mutationFn: (id: BusinessHoursId) => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  rows: [] as BusinessHoursRow[],
+  archiveBusinessHoursFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: () => ({
+    data: mocks.rows,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    mutate: async (id: BusinessHoursId) => {
+      try {
+        const result = await options.mutationFn(id)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/lib/client/queries/business-hours', () => ({
+  businessHoursQueries: {
+    list: (params: unknown) => ({ queryKey: ['business-hours', params] }),
+  },
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  archiveBusinessHoursFn: mocks.archiveBusinessHoursFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: { children: ReactNode; permission: string }) => <>{children}</>,
+}))
+
+vi.mock('../business-hours-dialog', () => ({
+  BusinessHoursDialog: ({
+    open,
+    onOpenChange,
+    row,
+  }: {
+    open: boolean
+    onOpenChange: (open: boolean) => void
+    row?: BusinessHoursRow
+  }) =>
+    open ? (
+      <section>
+        Editing {row?.name}
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close editor
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    className?: string
+  }) => <td colSpan={colSpan}>{children}</td>,
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input
+      id={id}
+      type="checkbox"
+      checked={checked}
+      onChange={(event) => onCheckedChange(event.currentTarget.checked)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    'aria-label': ariaLabel,
+  }: {
+    children?: ReactNode
+    onClick?: () => void
+    variant?: string
+    size?: string
+    className?: string
+    'aria-label'?: string
+  }) => (
+    <button type="button" onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArchiveBoxIcon: () => <span aria-hidden="true">archive</span>,
+  PencilSquareIcon: () => <span aria-hidden="true">edit</span>,
+}))
+
+function row(overrides: Partial<BusinessHoursRow> = {}): BusinessHoursRow {
+  return {
+    id: 'business_hours_1' as BusinessHoursId,
+    name: 'EU support',
+    timezone: 'Europe/Stockholm',
+    holidays: [{ date: '2026-12-24' }],
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.archiveBusinessHoursFn.mockResolvedValue({ ok: true })
+  mocks.rows = [
+    row(),
+    row({
+      id: 'business_hours_archived' as BusinessHoursId,
+      name: 'Legacy hours',
+      timezone: 'UTC',
+      holidays: null,
+      archivedAt: '2026-06-20T10:00:00.000Z',
+    }),
+  ]
+})
+
+describe('BusinessHoursList', () => {
+  it('renders active calendars by default, reveals archived rows, and opens edit', () => {
+    render(<BusinessHoursList />)
+
+    expect(screen.getByText('EU support')).toBeInTheDocument()
+    expect(screen.getByText('Europe/Stockholm')).toBeInTheDocument()
+    expect(screen.getByText('1')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.queryByText('Legacy hours')).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getByLabelText('Show archived'))
+
+    expect(screen.getByText('Legacy hours')).toBeInTheDocument()
+    expect(screen.getByText('UTC')).toBeInTheDocument()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Edit calendar' })[0])
+    expect(screen.getByText(/Editing EU support/)).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Close editor' }))
+    expect(screen.queryByText(/Editing EU support/)).not.toBeInTheDocument()
+  })
+
+  it('archives active calendars and refreshes the list', async () => {
+    render(<BusinessHoursList />)
+
+    expect(screen.getByText('Archive this calendar?')).toBeInTheDocument()
+    expect(
+      screen.getByText(
+        "SLA policies referencing it will continue to work, but it won't appear in pickers for new policies."
+      )
+    ).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Archive' }))
+
+    await waitFor(() => {
+      expect(mocks.archiveBusinessHoursFn).toHaveBeenCalledWith({
+        data: { id: 'business_hours_1' },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['business-hours'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Calendar archived')
+  })
+
+  it('reports archive failures and renders the empty state', async () => {
+    mocks.archiveBusinessHoursFn.mockRejectedValueOnce(new Error('Cannot archive default calendar'))
+    const { rerender } = render(<BusinessHoursList />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Archive' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Cannot archive default calendar')
+    })
+
+    mocks.rows = []
+    rerender(<BusinessHoursList />)
+
+    expect(screen.getByText('No calendars yet.')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/sla/__tests__/sla-escalation-dialog.test.tsx b/apps/web/src/components/admin/settings/sla/__tests__/sla-escalation-dialog.test.tsx
new file mode 100644
index 000000000..b34fb0d3f
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/__tests__/sla-escalation-dialog.test.tsx
@@ -0,0 +1,331 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { SlaEscalationDialog } from '../sla-escalation-dialog'
+
+type MutationOptions = {
+  mutationFn: () => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  createEscalationRuleFn: vi.fn(),
+  updateEscalationRuleFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({ open, children }: { open: boolean; children: ReactNode }) =>
+    open ? <div role="dialog">{children}</div> : null,
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section>{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    type?: string
+    value?: string | number
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    placeholder?: string
+  }) => <input id={id} type={type} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input id={id} type="checkbox" checked={checked} onChange={() => onCheckedChange(!checked)} />
+  ),
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select value={value} onChange={(event) => onValueChange(event.currentTarget.value)}>
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('team_escalation')}>
+        Pick escalation team
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear escalation team
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({ onValueChange }: { onValueChange: (ids: string[]) => void }) => (
+    <button type="button" onClick={() => onValueChange(['principal_manager', 'principal_owner'])}>
+      Pick escalation principals
+    </button>
+  ),
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  createEscalationRuleFn: mocks.createEscalationRuleFn,
+  updateEscalationRuleFn: mocks.updateEscalationRuleFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function renderDialog(props: Partial<React.ComponentProps<typeof SlaEscalationDialog>> = {}) {
+  const onOpenChange = vi.fn()
+  const view = render(
+    <SlaEscalationDialog
+      policyId={'sla_policy_1' as never}
+      open
+      onOpenChange={onOpenChange}
+      {...props}
+    />
+  )
+  return { ...view, onOpenChange }
+}
+
+function selects() {
+  return screen.getAllByRole('combobox') as HTMLSelectElement[]
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createEscalationRuleFn.mockResolvedValue({ id: 'escalation_rule_new' })
+  mocks.updateEscalationRuleFn.mockResolvedValue({ id: 'escalation_rule_1' })
+})
+
+describe('SlaEscalationDialog', () => {
+  it('does not render content while closed', () => {
+    render(
+      <SlaEscalationDialog policyId={'sla_policy_1' as never} open={false} onOpenChange={vi.fn()} />
+    )
+
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+  })
+
+  it('validates and creates a team escalation rule', async () => {
+    const { onOpenChange } = renderDialog()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Name is required')
+
+    fireEvent.change(screen.getByLabelText('Name'), {
+      target: { value: '  Notify team lead  ' },
+    })
+    fireEvent.change(selects()[0], { target: { value: 'resolution' } })
+    fireEvent.change(screen.getByLabelText('Lead minutes (signed)'), {
+      target: { value: '15' },
+    })
+    expect(screen.getByText('Fires 15m before breach')).toBeInTheDocument()
+
+    fireEvent.change(selects()[1], { target: { value: 'team' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Pick a team')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick escalation team' }))
+    fireEvent.click(screen.getByRole('button', { name: 'in_app' }))
+    fireEvent.click(screen.getByRole('button', { name: 'email' }))
+    fireEvent.click(screen.getByRole('button', { name: 'webhook' }))
+    fireEvent.click(screen.getByLabelText('Enabled'))
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+
+    await waitFor(() => {
+      expect(mocks.createEscalationRuleFn).toHaveBeenCalledWith({
+        data: {
+          policyId: 'sla_policy_1',
+          name: 'Notify team lead',
+          leadMinutes: 15,
+          targetKind: 'resolution',
+          recipientType: 'team',
+          recipientTeamId: 'team_escalation',
+          recipientPrincipalIds: undefined,
+          channels: ['email', 'webhook'],
+          enabled: false,
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Escalation created')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['sla', 'escalations', 'sla_policy_1'],
+    })
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('requires principals and at least one channel before create', async () => {
+    renderDialog()
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Notify owners' } })
+    fireEvent.change(screen.getByLabelText('Lead minutes (signed)'), {
+      target: { value: '-10' },
+    })
+    expect(screen.getByText('Fires 10m after breach')).toBeInTheDocument()
+    fireEvent.change(selects()[1], { target: { value: 'principals' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Pick at least one principal')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick escalation principals' }))
+    fireEvent.click(screen.getByRole('button', { name: 'in_app' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Pick at least one channel')
+
+    fireEvent.click(screen.getByRole('button', { name: 'email' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create' }))
+
+    await waitFor(() => {
+      expect(mocks.createEscalationRuleFn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            leadMinutes: -10,
+            recipientType: 'principals',
+            recipientTeamId: null,
+            recipientPrincipalIds: ['principal_manager', 'principal_owner'],
+            channels: ['email'],
+          }),
+        })
+      )
+    })
+  })
+
+  it('updates an existing escalation and reports update errors', async () => {
+    mocks.updateEscalationRuleFn.mockRejectedValueOnce(new Error('Escalation update failed'))
+    const { onOpenChange } = renderDialog({
+      rule: {
+        id: 'escalation_rule_1',
+        name: 'Existing rule',
+        leadMinutes: 0,
+        targetKind: 'next_response',
+        recipientType: 'principals',
+        recipientTeamId: null,
+        recipientPrincipalIds: null,
+        channels: null,
+        enabled: true,
+      } as never,
+    })
+
+    expect(screen.getByRole('heading', { name: 'Edit escalation' })).toBeInTheDocument()
+    expect(screen.getByText('Fires at breach')).toBeInTheDocument()
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Updated rule' } })
+    fireEvent.change(selects()[1], { target: { value: 'inbox_members' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Escalation update failed')
+    })
+
+    mocks.updateEscalationRuleFn.mockResolvedValueOnce({ id: 'escalation_rule_1' })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateEscalationRuleFn).toHaveBeenLastCalledWith({
+        data: {
+          id: 'escalation_rule_1',
+          name: 'Updated rule',
+          leadMinutes: 0,
+          targetKind: 'next_response',
+          recipientType: 'inbox_members',
+          recipientTeamId: null,
+          recipientPrincipalIds: undefined,
+          channels: ['in_app'],
+          enabled: true,
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Escalation updated')
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('cancels edits through onOpenChange', () => {
+    const { onOpenChange } = renderDialog()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+})
diff --git a/apps/web/src/components/admin/settings/sla/__tests__/sla-escalations-tab.test.tsx b/apps/web/src/components/admin/settings/sla/__tests__/sla-escalations-tab.test.tsx
new file mode 100644
index 000000000..4d2c3041f
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/__tests__/sla-escalations-tab.test.tsx
@@ -0,0 +1,313 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { SlaEscalationsTab } from '../sla-escalations-tab'
+
+type Rule = {
+  id: string
+  name: string
+  targetKind: string
+  leadMinutes: number
+  recipientType: string
+  recipientTeamId: string | null
+  recipientPrincipalIds: string[] | null
+  channels: string[] | null
+  enabled: boolean
+}
+
+type MutationOptions<TVars, TResult> = {
+  mutationFn: (vars: TVars) => Promise<TResult>
+  onSuccess?: (result: TResult) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  updateEscalationRuleFn: vi.fn(),
+  deleteEscalationRuleFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  permissionAllowed: true,
+  rules: [] as Rule[],
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: () => ({
+    data: mocks.rules,
+  }),
+  useMutation: <TVars, TResult>(options: MutationOptions<TVars, TResult>) => ({
+    isPending: false,
+    mutate: async (vars: TVars) => {
+      try {
+        const result = await options.mutationFn(vars)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+    fallback = null,
+  }: {
+    children: ReactNode
+    fallback?: ReactNode
+    permission: string
+  }) => (mocks.permissionAllowed ? <>{children}</> : <>{fallback}</>),
+}))
+
+vi.mock('../sla-escalation-dialog', () => ({
+  SlaEscalationDialog: ({
+    open,
+    onOpenChange,
+    rule,
+  }: {
+    policyId: string
+    open: boolean
+    onOpenChange: (open: boolean) => void
+    rule?: Rule
+  }) =>
+    open ? (
+      <section role="dialog">
+        <span>{rule ? `Editing ${rule.name}` : 'Creating escalation'}</span>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close escalation dialog
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    checked,
+    onCheckedChange,
+  }: {
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input
+      type="checkbox"
+      aria-label={`enabled-${checked ? 'on' : 'off'}`}
+      checked={checked}
+      onChange={() => onCheckedChange(!checked)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    className?: string
+  }) => <td colSpan={colSpan}>{children}</td>,
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  PencilSquareIcon: () => <span aria-hidden="true">pencil</span>,
+  PlusIcon: () => <span aria-hidden="true">plus</span>,
+  TrashIcon: () => <span aria-hidden="true">trash</span>,
+}))
+
+vi.mock('@/lib/client/queries/sla', () => ({
+  slaQueries: {
+    escalations: (policyId: string) => ({ queryKey: ['sla', 'escalations', policyId] }),
+  },
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  updateEscalationRuleFn: mocks.updateEscalationRuleFn,
+  deleteEscalationRuleFn: mocks.deleteEscalationRuleFn,
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ESCALATION_RULE_MANAGE: 'escalation_rule.manage',
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.permissionAllowed = true
+  mocks.rules = [
+    {
+      id: 'rule_before',
+      name: 'Warn before breach',
+      targetKind: 'first_response',
+      leadMinutes: 15,
+      recipientType: 'team',
+      recipientTeamId: 'team_support',
+      recipientPrincipalIds: null,
+      channels: ['email', 'slack'],
+      enabled: true,
+    },
+    {
+      id: 'rule_at',
+      name: 'Escalate at breach',
+      targetKind: 'resolution',
+      leadMinutes: 0,
+      recipientType: 'principals',
+      recipientTeamId: null,
+      recipientPrincipalIds: ['principal_1', 'principal_2'],
+      channels: null,
+      enabled: false,
+    },
+    {
+      id: 'rule_after',
+      name: 'After breach',
+      targetKind: 'resolution',
+      leadMinutes: -30,
+      recipientType: 'manager',
+      recipientTeamId: null,
+      recipientPrincipalIds: null,
+      channels: ['email'],
+      enabled: true,
+    },
+  ]
+  mocks.updateEscalationRuleFn.mockResolvedValue({ id: 'rule_before' })
+  mocks.deleteEscalationRuleFn.mockResolvedValue(undefined)
+})
+
+describe('SlaEscalationsTab', () => {
+  it('renders empty state and opens the create dialog', () => {
+    mocks.rules = []
+    render(<SlaEscalationsTab policyId={'policy_1' as never} />)
+
+    expect(screen.getByText('No escalation rules yet.')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'New escalation' }))
+    expect(screen.getByRole('dialog')).toHaveTextContent('Creating escalation')
+    fireEvent.click(screen.getByRole('button', { name: 'Close escalation dialog' }))
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+  })
+
+  it('renders lead-time, recipient and channel labels and opens edit dialog', () => {
+    render(<SlaEscalationsTab policyId={'policy_1' as never} />)
+
+    expect(screen.getByText('15m before breach')).toBeInTheDocument()
+    expect(screen.getByText('At breach')).toBeInTheDocument()
+    expect(screen.getByText('30m after breach')).toBeInTheDocument()
+    expect(screen.getByText('team: team_support')).toBeInTheDocument()
+    expect(screen.getByText('2 principal(s)')).toBeInTheDocument()
+    expect(screen.getByText('manager')).toBeInTheDocument()
+    expect(screen.getAllByText('email')).toHaveLength(2)
+    expect(screen.getByText('slack')).toBeInTheDocument()
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Edit escalation' })[0])
+    expect(screen.getByRole('dialog')).toHaveTextContent('Editing Warn before breach')
+  })
+
+  it('toggles and deletes escalation rules with cache invalidation', async () => {
+    render(<SlaEscalationsTab policyId={'policy_1' as never} />)
+
+    fireEvent.click(screen.getAllByLabelText('enabled-on')[0])
+    await waitFor(() => {
+      expect(mocks.updateEscalationRuleFn).toHaveBeenCalledWith({
+        data: { id: 'rule_before', enabled: false },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['sla', 'escalations', 'policy_1'],
+    })
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Delete' })[0])
+    await waitFor(() => {
+      expect(mocks.deleteEscalationRuleFn).toHaveBeenCalledWith({
+        data: { id: 'rule_before' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Escalation rule deleted')
+  })
+
+  it('reports mutation errors and renders read-only fallback badges without permission', async () => {
+    mocks.updateEscalationRuleFn.mockRejectedValueOnce(new Error('Toggle denied'))
+    mocks.deleteEscalationRuleFn.mockRejectedValueOnce(new Error('Delete denied'))
+    render(<SlaEscalationsTab policyId={'policy_1' as never} />)
+
+    fireEvent.click(screen.getAllByLabelText('enabled-on')[0])
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Toggle denied')
+    })
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Delete' })[0])
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Delete denied')
+    })
+
+    cleanup()
+    mocks.permissionAllowed = false
+    render(<SlaEscalationsTab policyId={'policy_1' as never} />)
+    expect(screen.queryByRole('button', { name: 'New escalation' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Edit escalation' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Delete escalation' })).not.toBeInTheDocument()
+    expect(screen.getAllByText('On')).toHaveLength(2)
+    expect(screen.getByText('Off')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/sla/__tests__/sla-list-and-targets.test.tsx b/apps/web/src/components/admin/settings/sla/__tests__/sla-list-and-targets.test.tsx
new file mode 100644
index 000000000..447652324
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/__tests__/sla-list-and-targets.test.tsx
@@ -0,0 +1,351 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import type { SlaPolicyId } from '@quackback/ids'
+import { SlaPolicyList } from '../sla-policy-list'
+import { SlaTargetsTab } from '../sla-targets-tab'
+
+type PolicyRow = {
+  id: SlaPolicyId
+  name: string
+  scope: string
+  appliesToPriorities: string[] | null
+  businessHoursId: string | null
+  enabled: boolean
+  archivedAt: string | null
+}
+
+type CalendarRow = {
+  id: string
+  name: string
+}
+
+type MutationOptions<TVars> = {
+  mutationFn: (vars: TVars) => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  policies: [] as PolicyRow[],
+  calendars: [] as CalendarRow[],
+  updateSlaPolicyFn: vi.fn(),
+  replaceSlaTargetsFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: (options: { queryKey?: readonly unknown[] }) => {
+    if (options.queryKey?.[0] === 'sla') {
+      return { data: mocks.policies }
+    }
+    return { data: mocks.calendars }
+  },
+  useMutation: <TVars,>(options: MutationOptions<TVars>) => ({
+    isPending: false,
+    mutate: async (vars: TVars) => {
+      try {
+        const result = await options.mutationFn(vars)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    to,
+    params,
+  }: {
+    children: ReactNode
+    to: string
+    params?: Record<string, string>
+    className?: string
+  }) => (
+    <a
+      href={Object.entries(params ?? {}).reduce(
+        (path, [key, value]) => path.replace(`$${key}`, value),
+        to
+      )}
+    >
+      {children}
+    </a>
+  ),
+}))
+
+vi.mock('@/lib/client/queries/sla', () => ({
+  slaQueries: {
+    policies: (params: unknown) => ({ queryKey: ['sla', 'policies', params] }),
+  },
+}))
+
+vi.mock('@/lib/client/queries/business-hours', () => ({
+  businessHoursQueries: {
+    list: (params: unknown) => ({ queryKey: ['business-hours', params] }),
+  },
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  replaceSlaTargetsFn: mocks.replaceSlaTargetsFn,
+  updateSlaPolicyFn: mocks.updateSlaPolicyFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+  }: {
+    children: ReactNode
+    permission: string
+    fallback?: ReactNode
+  }) => <>{children}</>,
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    className?: string
+  }) => <td colSpan={colSpan}>{children}</td>,
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode; className?: string }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input
+      id={id}
+      type="checkbox"
+      checked={checked}
+      onChange={(event) => onCheckedChange(event.currentTarget.checked)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+  }) => (
+    <button type="button" disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+    type = 'text',
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: { target: { value: string } }) => void
+    placeholder?: string
+    type?: string
+    min?: number
+    className?: string
+  }) => (
+    <input
+      id={id}
+      type={type}
+      value={value}
+      placeholder={placeholder}
+      onChange={(event) => onChange?.({ target: { value: event.currentTarget.value } })}
+    />
+  ),
+}))
+
+function policy(overrides: Partial<PolicyRow> = {}): PolicyRow {
+  return {
+    id: 'sla_policy_1' as SlaPolicyId,
+    name: 'Default SLA',
+    scope: 'global',
+    appliesToPriorities: null,
+    businessHoursId: 'business_hours_1',
+    enabled: true,
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.updateSlaPolicyFn.mockResolvedValue({ ok: true })
+  mocks.replaceSlaTargetsFn.mockResolvedValue({ ok: true })
+  mocks.calendars = [{ id: 'business_hours_1', name: 'EU support' }]
+  mocks.policies = [
+    policy(),
+    policy({
+      id: 'sla_policy_archived' as SlaPolicyId,
+      name: 'Archived SLA',
+      scope: 'team',
+      appliesToPriorities: ['urgent', 'high'],
+      businessHoursId: 'missing_calendar',
+      enabled: false,
+      archivedAt: '2026-06-20T10:00:00.000Z',
+    }),
+  ]
+})
+
+describe('SlaPolicyList', () => {
+  it('renders active policies, toggles enabled state, and reveals archived rows', async () => {
+    render(<SlaPolicyList />)
+
+    expect(screen.getByRole('link', { name: 'Default SLA' })).toHaveAttribute(
+      'href',
+      '/admin/settings/sla/sla_policy_1'
+    )
+    expect(screen.getByText('global')).toBeInTheDocument()
+    expect(screen.getByText('All')).toBeInTheDocument()
+    expect(screen.getByText('EU support')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.queryByText('Archived SLA')).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getAllByRole('checkbox')[1])
+
+    await waitFor(() => {
+      expect(mocks.updateSlaPolicyFn).toHaveBeenCalledWith({
+        data: {
+          id: 'sla_policy_1',
+          enabled: false,
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['sla'] })
+
+    fireEvent.click(screen.getByLabelText('Show archived'))
+
+    expect(screen.getByRole('link', { name: 'Archived SLA' })).toHaveAttribute(
+      'href',
+      '/admin/settings/sla/sla_policy_archived'
+    )
+    expect(screen.getByText('team')).toBeInTheDocument()
+    expect(screen.getByText('urgent')).toBeInTheDocument()
+    expect(screen.getByText('high')).toBeInTheDocument()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+    expect(screen.getByText('—')).toBeInTheDocument()
+  })
+
+  it('reports toggle failures and renders an empty state', async () => {
+    mocks.updateSlaPolicyFn.mockRejectedValueOnce(new Error('Cannot pause default SLA'))
+    const { rerender } = render(<SlaPolicyList />)
+
+    fireEvent.click(screen.getAllByRole('checkbox')[1])
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Cannot pause default SLA')
+    })
+
+    mocks.policies = []
+    rerender(<SlaPolicyList />)
+    expect(screen.getByText('No SLA policies yet.')).toBeInTheDocument()
+  })
+})
+
+describe('SlaTargetsTab', () => {
+  it('saves positive integer targets and omits blank or invalid rows', async () => {
+    render(
+      <SlaTargetsTab
+        policyId={'sla_policy_1' as SlaPolicyId}
+        initialTargets={
+          [
+            {
+              id: 'target_1',
+              policyId: 'sla_policy_1',
+              kind: 'first_response',
+              minutes: 15,
+            },
+            {
+              id: 'target_2',
+              policyId: 'sla_policy_1',
+              kind: 'resolution',
+              minutes: 240,
+            },
+          ] as never
+        }
+      />
+    )
+
+    expect(screen.getByText(/Leave a target empty/)).toBeInTheDocument()
+    expect(screen.getByLabelText('First response')).toHaveValue(15)
+    expect(screen.getByLabelText('Resolution')).toHaveValue(240)
+
+    fireEvent.change(screen.getByLabelText('First response'), { target: { value: 'abc' } })
+    fireEvent.change(screen.getByLabelText('Next response'), { target: { value: '30' } })
+    fireEvent.change(screen.getByLabelText('Resolution'), { target: { value: '0' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save targets' }))
+
+    await waitFor(() => {
+      expect(mocks.replaceSlaTargetsFn).toHaveBeenCalledWith({
+        data: {
+          policyId: 'sla_policy_1',
+          targets: [{ kind: 'next_response', minutes: 30 }],
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Targets updated')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['sla'] })
+  })
+
+  it('reports target save failures', async () => {
+    mocks.replaceSlaTargetsFn.mockRejectedValueOnce(new Error('Targets rejected'))
+    render(<SlaTargetsTab policyId={'sla_policy_1' as SlaPolicyId} initialTargets={[] as never} />)
+
+    fireEvent.change(screen.getByLabelText('Resolution'), { target: { value: '60' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save targets' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Targets rejected')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/settings/sla/__tests__/sla-policy-create-dialog.test.tsx b/apps/web/src/components/admin/settings/sla/__tests__/sla-policy-create-dialog.test.tsx
new file mode 100644
index 000000000..23cb9dd72
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/__tests__/sla-policy-create-dialog.test.tsx
@@ -0,0 +1,303 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { SlaPolicyCreateDialog } from '../sla-policy-create-dialog'
+
+type MutationOptions = {
+  mutationFn: () => Promise<{ id: string }>
+  onSuccess?: (result: { id: string }) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  navigate: vi.fn(),
+  createSlaPolicyFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: () => ({
+    data: [
+      { id: 'business_hours_active', name: 'Active calendar', archivedAt: null },
+      { id: 'business_hours_archived', name: 'Archived calendar', archivedAt: '2026-01-01' },
+    ],
+  }),
+  useMutation: (options: MutationOptions) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({
+    navigate: mocks.navigate,
+  }),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({ open, children }: { open: boolean; children: ReactNode }) =>
+    open ? <div role="dialog">{children}</div> : null,
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section>{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    type?: string
+    value?: string | number
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    placeholder?: string
+  }) => <input id={id} type={type} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLTextAreaElement>) => void
+    placeholder?: string
+    rows?: number
+  }) => <textarea id={id} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input id={id} type="checkbox" checked={checked} onChange={() => onCheckedChange(!checked)} />
+  ),
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select value={value} onChange={(event) => onValueChange(event.currentTarget.value)}>
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('team_sla')}>
+      Pick SLA team
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/inbox-picker', () => ({
+  InboxPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('inbox_sla')}>
+      Pick SLA inbox
+    </button>
+  ),
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  createSlaPolicyFn: mocks.createSlaPolicyFn,
+}))
+
+vi.mock('@/lib/client/queries/business-hours', () => ({
+  businessHoursQueries: {
+    list: (params: unknown) => ({ queryKey: ['business-hours', params] }),
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function renderDialog(open = true) {
+  const onOpenChange = vi.fn()
+  const view = render(<SlaPolicyCreateDialog open={open} onOpenChange={onOpenChange} />)
+  return { ...view, onOpenChange }
+}
+
+function selects() {
+  return screen.getAllByRole('combobox') as HTMLSelectElement[]
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createSlaPolicyFn.mockResolvedValue({ id: 'sla_policy_new' })
+})
+
+describe('SlaPolicyCreateDialog', () => {
+  it('does not render content while closed', () => {
+    renderDialog(false)
+
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+  })
+
+  it('validates team scope and creates a policy with selected filters', async () => {
+    const { onOpenChange } = renderDialog()
+
+    expect(screen.getByRole('heading', { name: 'New SLA policy' })).toBeInTheDocument()
+    expect(screen.getByText('All priorities')).toBeInTheDocument()
+    expect(screen.queryByText('Archived calendar')).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Create policy' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Name is required')
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Premium SLA  ' } })
+    fireEvent.change(screen.getByLabelText('Description'), {
+      target: { value: '  Premium customers only  ' },
+    })
+    fireEvent.change(selects()[0], { target: { value: 'team' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create policy' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Pick a team for team scope')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick SLA team' }))
+    fireEvent.change(screen.getByLabelText('Priority (lower runs first)'), {
+      target: { value: '' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'low' }))
+    fireEvent.click(screen.getByRole('button', { name: 'urgent' }))
+    fireEvent.click(screen.getByRole('button', { name: 'low' }))
+    fireEvent.change(selects()[1], { target: { value: 'business_hours_active' } })
+    fireEvent.click(screen.getByLabelText('Pending'))
+    fireEvent.click(screen.getByLabelText('On hold'))
+    fireEvent.click(screen.getByLabelText('Enabled'))
+    fireEvent.click(screen.getByRole('button', { name: 'Create policy' }))
+
+    await waitFor(() => {
+      expect(mocks.createSlaPolicyFn).toHaveBeenCalledWith({
+        data: {
+          name: 'Premium SLA',
+          description: 'Premium customers only',
+          priority: 0,
+          enabled: false,
+          scope: 'team',
+          scopeTeamId: 'team_sla',
+          scopeInboxId: null,
+          appliesToPriorities: ['urgent'],
+          businessHoursId: 'business_hours_active',
+          pauseOnPending: false,
+          pauseOnOnHold: false,
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Policy created')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['sla'] })
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+    expect(mocks.navigate).toHaveBeenCalledWith({
+      to: '/admin/settings/sla/$policyId',
+      params: { policyId: 'sla_policy_new' },
+    })
+    expect(screen.getByLabelText('Name')).toHaveValue('')
+  })
+
+  it('validates inbox scope and reports create errors', async () => {
+    mocks.createSlaPolicyFn.mockRejectedValueOnce(new Error('Policy already exists'))
+    renderDialog()
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Inbox SLA' } })
+    fireEvent.change(selects()[0], { target: { value: 'inbox' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create policy' }))
+    expect(mocks.toastError).toHaveBeenCalledWith('Pick an inbox for inbox scope')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick SLA inbox' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create policy' }))
+
+    await waitFor(() => {
+      expect(mocks.createSlaPolicyFn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            description: null,
+            scope: 'inbox',
+            scopeTeamId: null,
+            scopeInboxId: 'inbox_sla',
+            appliesToPriorities: undefined,
+            businessHoursId: null,
+          }),
+        })
+      )
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith('Policy already exists')
+  })
+
+  it('cancels through onOpenChange', () => {
+    const { onOpenChange } = renderDialog()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+})
diff --git a/apps/web/src/components/admin/settings/sla/__tests__/sla-policy-overview-tab.test.tsx b/apps/web/src/components/admin/settings/sla/__tests__/sla-policy-overview-tab.test.tsx
new file mode 100644
index 000000000..38f3d91d8
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/__tests__/sla-policy-overview-tab.test.tsx
@@ -0,0 +1,312 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { SlaPolicyOverviewTab } from '../sla-policy-overview-tab'
+
+type MutationOptions = {
+  mutationFn: () => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  updateSlaPolicyFn: vi.fn(),
+  archiveSlaPolicyFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: () => ({
+    data: [
+      { id: 'business_hours_active', name: 'Active calendar', archivedAt: null },
+      { id: 'business_hours_archived', name: 'Archived calendar', archivedAt: '2026-01-01' },
+    ],
+  }),
+  useMutation: (options: MutationOptions) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+  }: {
+    id?: string
+    type?: string
+    value?: string | number
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+  }) => <input id={id} type={type} value={value} onChange={onChange} />,
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLTextAreaElement>) => void
+    rows?: number
+  }) => <textarea id={id} value={value} onChange={onChange} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input id={id} type="checkbox" checked={checked} onChange={() => onCheckedChange(!checked)} />
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string }) => <span>{children}</span>,
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select value={value} onChange={(event) => onValueChange(event.currentTarget.value)}>
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: { children: ReactNode; permission: string }) => <>{children}</>,
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  updateSlaPolicyFn: mocks.updateSlaPolicyFn,
+  archiveSlaPolicyFn: mocks.archiveSlaPolicyFn,
+}))
+
+vi.mock('@/lib/client/queries/business-hours', () => ({
+  businessHoursQueries: {
+    list: (params: unknown) => ({ queryKey: ['business-hours', params] }),
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function policy(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'sla_policy_1',
+    name: 'Premium policy',
+    description: 'Initial description',
+    priority: 100,
+    enabled: true,
+    scope: 'team',
+    scopeTeamId: 'team_support',
+    scopeInboxId: null,
+    appliesToPriorities: ['low'],
+    businessHoursId: 'business_hours_archived',
+    pauseOnPending: true,
+    pauseOnOnHold: true,
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.updateSlaPolicyFn.mockResolvedValue({ id: 'sla_policy_1' })
+  mocks.archiveSlaPolicyFn.mockResolvedValue({ id: 'sla_policy_1' })
+})
+
+describe('SlaPolicyOverviewTab', () => {
+  it('updates editable policy fields and keeps the current archived calendar selectable', async () => {
+    render(<SlaPolicyOverviewTab policy={policy() as never} />)
+
+    expect(screen.getByText('team')).toBeInTheDocument()
+    expect(screen.getByText('team: team_support')).toBeInTheDocument()
+    expect(screen.getByText('Archived calendar')).toBeInTheDocument()
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Updated SLA  ' } })
+    fireEvent.change(screen.getByLabelText('Description'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Priority (lower runs first)'), {
+      target: { value: '' },
+    })
+    fireEvent.change(screen.getByRole('combobox'), { target: { value: 'business_hours_active' } })
+    fireEvent.click(screen.getByRole('button', { name: 'low' }))
+    fireEvent.click(screen.getByRole('button', { name: 'urgent' }))
+    fireEvent.click(screen.getByLabelText('Pending'))
+    fireEvent.click(screen.getByLabelText('On hold'))
+    fireEvent.click(screen.getByLabelText('Enabled'))
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateSlaPolicyFn).toHaveBeenCalledWith({
+        data: {
+          id: 'sla_policy_1',
+          name: 'Updated SLA',
+          description: null,
+          priority: 0,
+          enabled: false,
+          appliesToPriorities: ['urgent'],
+          businessHoursId: 'business_hours_active',
+          pauseOnPending: false,
+          pauseOnOnHold: false,
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Policy updated')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['sla'] })
+  })
+
+  it('sends all-priorities and 24-7 calendar payloads when filters are cleared', async () => {
+    render(
+      <SlaPolicyOverviewTab
+        policy={policy({ appliesToPriorities: null, businessHoursId: null }) as never}
+      />
+    )
+
+    expect(screen.getByText('All priorities')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateSlaPolicyFn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            appliesToPriorities: undefined,
+            businessHoursId: null,
+          }),
+        })
+      )
+    })
+  })
+
+  it('archives active policies and hides archive controls for archived policies', async () => {
+    const { rerender } = render(<SlaPolicyOverviewTab policy={policy() as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Archive' }))
+
+    await waitFor(() => {
+      expect(mocks.archiveSlaPolicyFn).toHaveBeenCalledWith({ data: { id: 'sla_policy_1' } })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Policy archived')
+
+    rerender(
+      <SlaPolicyOverviewTab policy={policy({ archivedAt: '2026-06-19T10:00:00.000Z' }) as never} />
+    )
+    expect(screen.queryByText('Archive this SLA policy?')).not.toBeInTheDocument()
+  })
+
+  it('resets local form state on policy changes and reports mutation errors', async () => {
+    mocks.updateSlaPolicyFn.mockRejectedValueOnce(new Error('Update failed'))
+    mocks.archiveSlaPolicyFn.mockRejectedValueOnce(new Error('Archive failed'))
+    const { rerender } = render(<SlaPolicyOverviewTab policy={policy() as never} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Unsaved' } })
+    rerender(
+      <SlaPolicyOverviewTab
+        policy={
+          policy({
+            id: 'sla_policy_2',
+            name: 'Replacement policy',
+            scope: 'inbox',
+            scopeTeamId: null,
+            scopeInboxId: 'inbox_support',
+          }) as never
+        }
+      />
+    )
+    expect(screen.getByLabelText('Name')).toHaveValue('Replacement policy')
+    expect(screen.getByText('inbox: inbox_support')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Update failed')
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Archive' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Archive failed')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/settings/sla/__tests__/sla-tick-trigger.test.tsx b/apps/web/src/components/admin/settings/sla/__tests__/sla-tick-trigger.test.tsx
new file mode 100644
index 000000000..7d1f29a91
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/__tests__/sla-tick-trigger.test.tsx
@@ -0,0 +1,114 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { SlaTickTrigger } from '../sla-tick-trigger'
+
+type MutationOptions = {
+  mutationFn: () => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  runSlaTickFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  isPending: false,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useMutation: (options: MutationOptions) => ({
+    isPending: mocks.isPending,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  runSlaTickFn: mocks.runSlaTickFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: { children: ReactNode; permission: string }) => <>{children}</>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    variant?: string
+    size?: string
+  }) => (
+    <button type="button" disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  BoltIcon: () => <span aria-hidden="true">bolt</span>,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.isPending = false
+  mocks.runSlaTickFn.mockResolvedValue({ processed: 3, fired: 2 })
+})
+
+describe('SlaTickTrigger', () => {
+  it('runs the SLA tick and reports processed/fired counts', async () => {
+    render(<SlaTickTrigger />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Run tick now' }))
+
+    await waitFor(() => {
+      expect(mocks.runSlaTickFn).toHaveBeenCalledWith({ data: {} })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Tick ran — processed 3, fired 2')
+  })
+
+  it('uses zero fallback counts and reports failures', async () => {
+    const { rerender } = render(<SlaTickTrigger />)
+
+    mocks.runSlaTickFn.mockResolvedValueOnce(null)
+    fireEvent.click(screen.getByRole('button', { name: 'Run tick now' }))
+
+    await waitFor(() => {
+      expect(mocks.toastSuccess).toHaveBeenCalledWith('Tick ran — processed 0, fired 0')
+    })
+
+    mocks.runSlaTickFn.mockRejectedValueOnce(new Error('Tick failed'))
+    rerender(<SlaTickTrigger />)
+    fireEvent.click(screen.getByRole('button', { name: 'Run tick now' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Tick failed')
+    })
+  })
+
+  it('disables the trigger while pending', () => {
+    mocks.isPending = true
+    render(<SlaTickTrigger />)
+
+    expect(screen.getByRole('button', { name: 'Run tick now' })).toBeDisabled()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/sla/business-hours-dialog.tsx b/apps/web/src/components/admin/settings/sla/business-hours-dialog.tsx
new file mode 100644
index 000000000..ae94d36be
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/business-hours-dialog.tsx
@@ -0,0 +1,333 @@
+/**
+ * Business hours create/edit Dialog. Holds the week-grid editor (per-weekday
+ * `[start,end]` ranges) and a holiday list. Reused for both create and edit
+ * via the optional `row` prop.
+ */
+import { useEffect, useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { BusinessHoursId } from '@quackback/ids'
+import type { BusinessHours } from '@/lib/shared/db-types'
+import { createBusinessHoursFn, updateBusinessHoursFn } from '@/lib/server/functions/sla'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { TrashIcon, PlusIcon } from '@heroicons/react/24/outline'
+
+interface Range {
+  start: string
+  end: string
+}
+type DayKey = 'mon' | 'tue' | 'wed' | 'thu' | 'fri' | 'sat' | 'sun'
+type Schedule = Record<DayKey, Range[]>
+interface Holiday {
+  date: string
+  label?: string
+}
+
+const DAYS: { key: DayKey; label: string }[] = [
+  { key: 'mon', label: 'Mon' },
+  { key: 'tue', label: 'Tue' },
+  { key: 'wed', label: 'Wed' },
+  { key: 'thu', label: 'Thu' },
+  { key: 'fri', label: 'Fri' },
+  { key: 'sat', label: 'Sat' },
+  { key: 'sun', label: 'Sun' },
+]
+
+const EMPTY_SCHEDULE: Schedule = {
+  mon: [{ start: '09:00', end: '17:00' }],
+  tue: [{ start: '09:00', end: '17:00' }],
+  wed: [{ start: '09:00', end: '17:00' }],
+  thu: [{ start: '09:00', end: '17:00' }],
+  fri: [{ start: '09:00', end: '17:00' }],
+  sat: [],
+  sun: [],
+}
+
+interface Props {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  row?: BusinessHours
+}
+
+export function BusinessHoursDialog({ open, onOpenChange, row }: Props) {
+  const qc = useQueryClient()
+  const isEdit = Boolean(row)
+
+  const [name, setName] = useState('')
+  const [timezone, setTimezone] = useState('UTC')
+  const [schedule, setSchedule] = useState<Schedule>(EMPTY_SCHEDULE)
+  const [holidays, setHolidays] = useState<Holiday[]>([])
+
+  useEffect(() => {
+    if (!open) return
+    if (row) {
+      setName(row.name)
+      setTimezone(row.timezone)
+      const sRaw = row.schedule as Partial<Schedule> | null
+      setSchedule({
+        mon: sRaw?.mon ?? [],
+        tue: sRaw?.tue ?? [],
+        wed: sRaw?.wed ?? [],
+        thu: sRaw?.thu ?? [],
+        fri: sRaw?.fri ?? [],
+        sat: sRaw?.sat ?? [],
+        sun: sRaw?.sun ?? [],
+      })
+      setHolidays(((row.holidays as Holiday[] | null) ?? []).map((h) => ({ ...h })))
+    } else {
+      setName('')
+      setTimezone('UTC')
+      setSchedule(JSON.parse(JSON.stringify(EMPTY_SCHEDULE)))
+      setHolidays([])
+    }
+  }, [open, row])
+
+  const updateRange = (day: DayKey, idx: number, patch: Partial<Range>) => {
+    setSchedule((prev) => ({
+      ...prev,
+      [day]: prev[day].map((r, i) => (i === idx ? { ...r, ...patch } : r)),
+    }))
+  }
+  const addRange = (day: DayKey) => {
+    setSchedule((prev) => ({
+      ...prev,
+      [day]: [...prev[day], { start: '09:00', end: '17:00' }],
+    }))
+  }
+  const removeRange = (day: DayKey, idx: number) => {
+    setSchedule((prev) => ({
+      ...prev,
+      [day]: prev[day].filter((_, i) => i !== idx),
+    }))
+  }
+
+  const validate = (): string | null => {
+    if (!name.trim()) return 'Name is required'
+    if (!timezone.trim()) return 'Timezone is required'
+    const timeRe = /^([01]\d|2[0-3]):[0-5]\d$/
+    for (const { key, label } of DAYS) {
+      for (const r of schedule[key]) {
+        if (!timeRe.test(r.start) || !timeRe.test(r.end)) {
+          return `${label}: invalid time format (use HH:MM)`
+        }
+        if (r.start >= r.end) return `${label}: range start must be before end`
+      }
+    }
+    const dateRe = /^\d{4}-\d{2}-\d{2}$/
+    for (const h of holidays) {
+      if (!dateRe.test(h.date)) return 'Holiday date must be YYYY-MM-DD'
+    }
+    return null
+  }
+
+  const createMutation = useMutation({
+    mutationFn: () =>
+      createBusinessHoursFn({
+        data: {
+          name: name.trim(),
+          timezone: timezone.trim(),
+          schedule,
+          holidays: holidays.length > 0 ? holidays : undefined,
+        },
+      }),
+    onSuccess: () => {
+      toast.success('Calendar created')
+      qc.invalidateQueries({ queryKey: ['business-hours'] })
+      onOpenChange(false)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const updateMutation = useMutation({
+    mutationFn: () =>
+      updateBusinessHoursFn({
+        data: {
+          id: row!.id as BusinessHoursId,
+          name: name.trim(),
+          timezone: timezone.trim(),
+          schedule,
+          holidays,
+        },
+      }),
+    onSuccess: () => {
+      toast.success('Calendar updated')
+      qc.invalidateQueries({ queryKey: ['business-hours'] })
+      onOpenChange(false)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const handleSave = () => {
+    const err = validate()
+    if (err) {
+      toast.error(err)
+      return
+    }
+    if (isEdit) updateMutation.mutate()
+    else createMutation.mutate()
+  }
+
+  const isPending = createMutation.isPending || updateMutation.isPending
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-3xl max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>{isEdit ? 'Edit calendar' : 'New business-hours calendar'}</DialogTitle>
+          <DialogDescription>
+            Define working hours per weekday. SLA policies use this to compute due times.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-5">
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-2">
+              <Label htmlFor="bh-name">Name</Label>
+              <Input
+                id="bh-name"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                placeholder="e.g. EU office hours"
+              />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="bh-tz">Timezone (IANA)</Label>
+              <Input
+                id="bh-tz"
+                value={timezone}
+                onChange={(e) => setTimezone(e.target.value)}
+                placeholder="e.g. Europe/Stockholm"
+              />
+            </div>
+          </div>
+
+          <div className="space-y-2">
+            <Label>Schedule</Label>
+            <div className="rounded border border-border/50 divide-y divide-border/50">
+              {DAYS.map(({ key, label }) => (
+                <div key={key} className="flex items-start gap-3 px-3 py-2">
+                  <span className="text-xs font-semibold w-10 mt-1.5">{label}</span>
+                  <div className="flex-1 space-y-1">
+                    {schedule[key].length === 0 && (
+                      <p className="text-xs text-muted-foreground py-1">Closed</p>
+                    )}
+                    {schedule[key].map((r, idx) => (
+                      <div key={idx} className="flex items-center gap-2">
+                        <Input
+                          type="time"
+                          step={60}
+                          value={r.start}
+                          onChange={(e) => updateRange(key, idx, { start: e.target.value })}
+                          className="h-8 w-28 text-xs"
+                        />
+                        <span className="text-xs text-muted-foreground">–</span>
+                        <Input
+                          type="time"
+                          step={60}
+                          value={r.end}
+                          onChange={(e) => updateRange(key, idx, { end: e.target.value })}
+                          className="h-8 w-28 text-xs"
+                        />
+                        <Button
+                          variant="ghost"
+                          size="sm"
+                          className="h-7 w-7 p-0"
+                          onClick={() => removeRange(key, idx)}
+                          aria-label="Remove range"
+                        >
+                          <TrashIcon className="h-3.5 w-3.5" />
+                        </Button>
+                      </div>
+                    ))}
+                  </div>
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    className="h-7 text-xs"
+                    onClick={() => addRange(key)}
+                  >
+                    <PlusIcon className="h-3.5 w-3.5 mr-1" />
+                    Range
+                  </Button>
+                </div>
+              ))}
+            </div>
+          </div>
+
+          <div className="space-y-2">
+            <div className="flex items-center justify-between">
+              <Label>Holidays</Label>
+              <Button
+                variant="ghost"
+                size="sm"
+                className="h-7 text-xs"
+                onClick={() => setHolidays((prev) => [...prev, { date: '', label: '' }])}
+              >
+                <PlusIcon className="h-3.5 w-3.5 mr-1" />
+                Add holiday
+              </Button>
+            </div>
+            {holidays.length === 0 ? (
+              <p className="text-xs text-muted-foreground">No holidays.</p>
+            ) : (
+              <div className="space-y-1">
+                {holidays.map((h, idx) => (
+                  <div key={idx} className="flex items-center gap-2">
+                    <Input
+                      type="date"
+                      value={h.date}
+                      onChange={(e) =>
+                        setHolidays((prev) =>
+                          prev.map((x, i) => (i === idx ? { ...x, date: e.target.value } : x))
+                        )
+                      }
+                      className="h-8 w-40 text-xs"
+                    />
+                    <Input
+                      value={h.label ?? ''}
+                      onChange={(e) =>
+                        setHolidays((prev) =>
+                          prev.map((x, i) => (i === idx ? { ...x, label: e.target.value } : x))
+                        )
+                      }
+                      placeholder="Label (optional)"
+                      className="h-8 flex-1 text-xs"
+                    />
+                    <Button
+                      variant="ghost"
+                      size="sm"
+                      className="h-7 w-7 p-0"
+                      onClick={() => setHolidays((prev) => prev.filter((_, i) => i !== idx))}
+                      aria-label="Remove holiday"
+                    >
+                      <TrashIcon className="h-3.5 w-3.5" />
+                    </Button>
+                  </div>
+                ))}
+              </div>
+            )}
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)} disabled={isPending}>
+            Cancel
+          </Button>
+          <Button onClick={handleSave} disabled={isPending}>
+            {isEdit ? 'Save changes' : 'Create'}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/sla/business-hours-list.tsx b/apps/web/src/components/admin/settings/sla/business-hours-list.tsx
new file mode 100644
index 000000000..6f1dc33b5
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/business-hours-list.tsx
@@ -0,0 +1,166 @@
+/**
+ * Business-hours list — table with name/timezone/holiday count + edit/archive
+ * actions. "Show archived" toggle. Edit opens the shared dialog with prefill.
+ */
+import { useState } from 'react'
+import { useSuspenseQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { BusinessHoursId } from '@quackback/ids'
+import type { BusinessHours } from '@/lib/shared/db-types'
+import { businessHoursQueries } from '@/lib/client/queries/business-hours'
+import { archiveBusinessHoursFn } from '@/lib/server/functions/sla'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Switch } from '@/components/ui/switch'
+import { Label } from '@/components/ui/label'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { PencilSquareIcon, ArchiveBoxIcon } from '@heroicons/react/24/outline'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { BusinessHoursDialog } from './business-hours-dialog'
+
+export function BusinessHoursList() {
+  const qc = useQueryClient()
+  const [showArchived, setShowArchived] = useState(false)
+  const [editingRow, setEditingRow] = useState<BusinessHours | null>(null)
+  const { data: rows } = useSuspenseQuery(businessHoursQueries.list({ includeArchived: true }))
+
+  const archiveMutation = useMutation({
+    mutationFn: (id: BusinessHoursId) => archiveBusinessHoursFn({ data: { id } }),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['business-hours'] })
+      toast.success('Calendar archived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const visible = rows.filter((r) => showArchived || !r.archivedAt)
+
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center gap-2">
+        <Switch id="show-archived-bh" checked={showArchived} onCheckedChange={setShowArchived} />
+        <Label htmlFor="show-archived-bh" className="text-xs cursor-pointer">
+          Show archived
+        </Label>
+      </div>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead className="w-32">Timezone</TableHead>
+              <TableHead className="w-24">Holidays</TableHead>
+              <TableHead className="w-24">Status</TableHead>
+              <TableHead className="w-24" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {visible.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={5} className="text-center text-sm text-muted-foreground py-6">
+                  No calendars yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              visible.map((row) => {
+                const holidays = (row.holidays as unknown[] | null) ?? []
+                return (
+                  <TableRow key={row.id}>
+                    <TableCell className="font-medium">{row.name}</TableCell>
+                    <TableCell className="font-mono text-xs">{row.timezone}</TableCell>
+                    <TableCell>{holidays.length}</TableCell>
+                    <TableCell>
+                      {row.archivedAt ? (
+                        <Badge variant="outline" className="text-muted-foreground">
+                          Archived
+                        </Badge>
+                      ) : (
+                        <Badge variant="outline">Active</Badge>
+                      )}
+                    </TableCell>
+                    <TableCell className="text-right">
+                      <PermissionGate permission={PERMISSIONS.BUSINESS_HOURS_MANAGE}>
+                        <div className="flex items-center justify-end gap-1">
+                          <Button
+                            variant="ghost"
+                            size="sm"
+                            className="h-7 w-7 p-0"
+                            onClick={() => setEditingRow(row)}
+                            aria-label="Edit calendar"
+                          >
+                            <PencilSquareIcon className="h-3.5 w-3.5" />
+                          </Button>
+                          {!row.archivedAt && (
+                            <AlertDialog>
+                              <AlertDialogTrigger asChild>
+                                <Button
+                                  variant="ghost"
+                                  size="sm"
+                                  className="h-7 w-7 p-0"
+                                  aria-label="Archive calendar"
+                                >
+                                  <ArchiveBoxIcon className="h-3.5 w-3.5" />
+                                </Button>
+                              </AlertDialogTrigger>
+                              <AlertDialogContent>
+                                <AlertDialogHeader>
+                                  <AlertDialogTitle>Archive this calendar?</AlertDialogTitle>
+                                  <AlertDialogDescription>
+                                    SLA policies referencing it will continue to work, but it
+                                    won&apos;t appear in pickers for new policies.
+                                  </AlertDialogDescription>
+                                </AlertDialogHeader>
+                                <AlertDialogFooter>
+                                  <AlertDialogCancel>Cancel</AlertDialogCancel>
+                                  <AlertDialogAction
+                                    onClick={() =>
+                                      archiveMutation.mutate(row.id as BusinessHoursId)
+                                    }
+                                  >
+                                    Archive
+                                  </AlertDialogAction>
+                                </AlertDialogFooter>
+                              </AlertDialogContent>
+                            </AlertDialog>
+                          )}
+                        </div>
+                      </PermissionGate>
+                    </TableCell>
+                  </TableRow>
+                )
+              })
+            )}
+          </TableBody>
+        </Table>
+      </div>
+
+      <BusinessHoursDialog
+        open={editingRow !== null}
+        onOpenChange={(open) => {
+          if (!open) setEditingRow(null)
+        }}
+        row={editingRow ?? undefined}
+      />
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/sla/sla-escalation-dialog.tsx b/apps/web/src/components/admin/settings/sla/sla-escalation-dialog.tsx
new file mode 100644
index 000000000..805309a3e
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/sla-escalation-dialog.tsx
@@ -0,0 +1,298 @@
+/**
+ * SLA escalation create/edit dialog. Recipient sub-form is conditional on
+ * recipientType. Channels is a multi-toggle. leadMinutes is signed.
+ */
+import { useEffect, useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { SlaPolicyId, EscalationRuleId, TeamId, PrincipalId } from '@quackback/ids'
+import type { EscalationRule } from '@/lib/shared/db-types'
+import { createEscalationRuleFn, updateEscalationRuleFn } from '@/lib/server/functions/sla'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Switch } from '@/components/ui/switch'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+import { cn } from '@/lib/shared/utils'
+
+const TARGET_KINDS = ['first_response', 'next_response', 'resolution'] as const
+const RECIPIENT_TYPES = ['assignee', 'team', 'principals', 'inbox_members'] as const
+const CHANNELS = ['in_app', 'email', 'webhook'] as const
+type TargetKind = (typeof TARGET_KINDS)[number]
+type RecipientType = (typeof RECIPIENT_TYPES)[number]
+type Channel = (typeof CHANNELS)[number]
+
+interface Props {
+  policyId: SlaPolicyId
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  rule?: EscalationRule
+}
+
+export function SlaEscalationDialog({ policyId, open, onOpenChange, rule }: Props) {
+  const qc = useQueryClient()
+  const isEdit = Boolean(rule)
+
+  const [name, setName] = useState('')
+  const [leadMinutes, setLeadMinutes] = useState(0)
+  const [targetKind, setTargetKind] = useState<TargetKind>('first_response')
+  const [recipientType, setRecipientType] = useState<RecipientType>('assignee')
+  const [recipientTeamId, setRecipientTeamId] = useState<TeamId | null>(null)
+  const [recipientPrincipalIds, setRecipientPrincipalIds] = useState<PrincipalId[]>([])
+  const [channels, setChannels] = useState<Channel[]>(['in_app'])
+  const [enabled, setEnabled] = useState(true)
+
+  useEffect(() => {
+    if (!open) return
+    if (rule) {
+      setName(rule.name)
+      setLeadMinutes(rule.leadMinutes)
+      setTargetKind(rule.targetKind as TargetKind)
+      setRecipientType(rule.recipientType as RecipientType)
+      setRecipientTeamId((rule.recipientTeamId as TeamId | null) ?? null)
+      setRecipientPrincipalIds(
+        ((rule.recipientPrincipalIds as string[] | null) ?? []) as PrincipalId[]
+      )
+      setChannels(((rule.channels as Channel[] | null) ?? ['in_app']) as Channel[])
+      setEnabled(rule.enabled)
+    } else {
+      setName('')
+      setLeadMinutes(0)
+      setTargetKind('first_response')
+      setRecipientType('assignee')
+      setRecipientTeamId(null)
+      setRecipientPrincipalIds([])
+      setChannels(['in_app'])
+      setEnabled(true)
+    }
+  }, [open, rule])
+
+  const toggleChannel = (c: Channel) => {
+    setChannels((prev) => (prev.includes(c) ? prev.filter((x) => x !== c) : [...prev, c]))
+  }
+
+  const validate = (): string | null => {
+    if (!name.trim()) return 'Name is required'
+    if (recipientType === 'team' && !recipientTeamId) return 'Pick a team'
+    if (recipientType === 'principals' && recipientPrincipalIds.length === 0)
+      return 'Pick at least one principal'
+    if (channels.length === 0) return 'Pick at least one channel'
+    return null
+  }
+
+  const createMutation = useMutation({
+    mutationFn: () =>
+      createEscalationRuleFn({
+        data: {
+          policyId,
+          name: name.trim(),
+          leadMinutes,
+          targetKind,
+          recipientType,
+          recipientTeamId: recipientType === 'team' ? recipientTeamId : null,
+          recipientPrincipalIds: recipientType === 'principals' ? recipientPrincipalIds : undefined,
+          channels,
+          enabled,
+        },
+      }),
+    onSuccess: () => {
+      toast.success('Escalation created')
+      qc.invalidateQueries({ queryKey: ['sla', 'escalations', policyId] })
+      onOpenChange(false)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const updateMutation = useMutation({
+    mutationFn: () =>
+      updateEscalationRuleFn({
+        data: {
+          id: rule!.id as EscalationRuleId,
+          name: name.trim(),
+          leadMinutes,
+          targetKind,
+          recipientType,
+          recipientTeamId: recipientType === 'team' ? recipientTeamId : null,
+          recipientPrincipalIds: recipientType === 'principals' ? recipientPrincipalIds : undefined,
+          channels,
+          enabled,
+        },
+      }),
+    onSuccess: () => {
+      toast.success('Escalation updated')
+      qc.invalidateQueries({ queryKey: ['sla', 'escalations', policyId] })
+      onOpenChange(false)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const handleSave = () => {
+    const err = validate()
+    if (err) {
+      toast.error(err)
+      return
+    }
+    if (isEdit) updateMutation.mutate()
+    else createMutation.mutate()
+  }
+
+  const isPending = createMutation.isPending || updateMutation.isPending
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-2xl max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>{isEdit ? 'Edit escalation' : 'New escalation'}</DialogTitle>
+          <DialogDescription>
+            Fires relative to the chosen target&apos;s due time. Positive lead = before breach,
+            negative = after.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4">
+          <div className="space-y-2">
+            <Label htmlFor="esc-name">Name</Label>
+            <Input
+              id="esc-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              placeholder="e.g. Notify lead 15m before breach"
+            />
+          </div>
+
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-2">
+              <Label>Target</Label>
+              <Select value={targetKind} onValueChange={(v) => setTargetKind(v as TargetKind)}>
+                <SelectTrigger>
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {TARGET_KINDS.map((k) => (
+                    <SelectItem key={k} value={k}>
+                      {k}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="esc-lead">Lead minutes (signed)</Label>
+              <Input
+                id="esc-lead"
+                type="number"
+                value={leadMinutes}
+                onChange={(e) => setLeadMinutes(Number(e.target.value) || 0)}
+              />
+              <p className="text-[11px] text-muted-foreground">
+                {leadMinutes > 0
+                  ? `Fires ${leadMinutes}m before breach`
+                  : leadMinutes < 0
+                    ? `Fires ${Math.abs(leadMinutes)}m after breach`
+                    : 'Fires at breach'}
+              </p>
+            </div>
+          </div>
+
+          <div className="space-y-2">
+            <Label>Recipient type</Label>
+            <Select
+              value={recipientType}
+              onValueChange={(v) => setRecipientType(v as RecipientType)}
+            >
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {RECIPIENT_TYPES.map((t) => (
+                  <SelectItem key={t} value={t}>
+                    {t}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+
+          {recipientType === 'team' && (
+            <div className="space-y-2">
+              <Label>Team</Label>
+              <TeamPicker
+                value={recipientTeamId}
+                onValueChange={setRecipientTeamId}
+                allowClear
+                placeholder="Pick team…"
+              />
+            </div>
+          )}
+          {recipientType === 'principals' && (
+            <div className="space-y-2">
+              <Label>Principals</Label>
+              <PrincipalPicker
+                multiple
+                value={recipientPrincipalIds}
+                onValueChange={setRecipientPrincipalIds}
+                placeholder="Pick principals…"
+              />
+            </div>
+          )}
+
+          <div className="space-y-2">
+            <Label>Channels</Label>
+            <div className="flex flex-wrap gap-1">
+              {CHANNELS.map((c) => {
+                const checked = channels.includes(c)
+                return (
+                  <button
+                    key={c}
+                    type="button"
+                    onClick={() => toggleChannel(c)}
+                    className={cn(
+                      'text-[11px] rounded border px-2 py-0.5',
+                      checked
+                        ? 'bg-primary text-primary-foreground border-primary'
+                        : 'bg-background border-border/60 text-muted-foreground hover:bg-muted'
+                    )}
+                  >
+                    {c}
+                  </button>
+                )
+              })}
+            </div>
+          </div>
+
+          <div className="flex items-center gap-2">
+            <Switch checked={enabled} onCheckedChange={setEnabled} id="esc-enabled" />
+            <Label htmlFor="esc-enabled" className="text-xs cursor-pointer">
+              Enabled
+            </Label>
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)} disabled={isPending}>
+            Cancel
+          </Button>
+          <Button onClick={handleSave} disabled={isPending}>
+            {isEdit ? 'Save changes' : 'Create'}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/sla/sla-escalations-tab.tsx b/apps/web/src/components/admin/settings/sla/sla-escalations-tab.tsx
new file mode 100644
index 000000000..74ac1ddaf
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/sla-escalations-tab.tsx
@@ -0,0 +1,213 @@
+/**
+ * SLA escalations tab — list of escalation rules with inline enable toggle,
+ * edit + delete buttons. New/edit opens the shared escalation dialog.
+ */
+import { useState } from 'react'
+import { useSuspenseQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { SlaPolicyId, EscalationRuleId } from '@quackback/ids'
+import type { EscalationRule } from '@/lib/shared/db-types'
+import { slaQueries } from '@/lib/client/queries/sla'
+import { updateEscalationRuleFn, deleteEscalationRuleFn } from '@/lib/server/functions/sla'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Switch } from '@/components/ui/switch'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { PencilSquareIcon, TrashIcon, PlusIcon } from '@heroicons/react/24/outline'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { SlaEscalationDialog } from './sla-escalation-dialog'
+
+function formatLead(lead: number): string {
+  if (lead > 0) return `${lead}m before breach`
+  if (lead < 0) return `${Math.abs(lead)}m after breach`
+  return 'At breach'
+}
+
+export function SlaEscalationsTab({ policyId }: { policyId: SlaPolicyId }) {
+  const qc = useQueryClient()
+  const { data: rules } = useSuspenseQuery(slaQueries.escalations(policyId))
+  const [createOpen, setCreateOpen] = useState(false)
+  const [editingRule, setEditingRule] = useState<EscalationRule | null>(null)
+
+  const toggleEnabled = useMutation({
+    mutationFn: (vars: { id: EscalationRuleId; enabled: boolean }) =>
+      updateEscalationRuleFn({ data: { id: vars.id, enabled: vars.enabled } }),
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['sla', 'escalations', policyId] }),
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const deleteMutation = useMutation({
+    mutationFn: (id: EscalationRuleId) => deleteEscalationRuleFn({ data: { id } }),
+    onSuccess: () => {
+      toast.success('Escalation rule deleted')
+      qc.invalidateQueries({ queryKey: ['sla', 'escalations', policyId] })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-3 max-w-4xl">
+      <div className="flex items-center justify-between">
+        <p className="text-xs text-muted-foreground">
+          Escalations fire relative to a target&apos;s due time and notify recipients on the chosen
+          channels.
+        </p>
+        <PermissionGate permission={PERMISSIONS.ESCALATION_RULE_MANAGE}>
+          <Button size="sm" onClick={() => setCreateOpen(true)}>
+            <PlusIcon className="h-4 w-4 mr-1" />
+            New escalation
+          </Button>
+        </PermissionGate>
+      </div>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead className="w-32">Target</TableHead>
+              <TableHead className="w-40">When</TableHead>
+              <TableHead>Recipient</TableHead>
+              <TableHead className="w-40">Channels</TableHead>
+              <TableHead className="w-20">Enabled</TableHead>
+              <TableHead className="w-20" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {rules.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={7} className="text-center text-sm text-muted-foreground py-6">
+                  No escalation rules yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              rules.map((r) => {
+                const channels = (r.channels as string[] | null) ?? []
+                const principalIds = (r.recipientPrincipalIds as string[] | null) ?? []
+                let recipientLabel: string = r.recipientType
+                if (r.recipientType === 'team' && r.recipientTeamId) {
+                  recipientLabel = `team: ${String(r.recipientTeamId)}`
+                } else if (r.recipientType === 'principals') {
+                  recipientLabel = `${principalIds.length} principal(s)`
+                }
+                return (
+                  <TableRow key={r.id}>
+                    <TableCell className="font-medium">{r.name}</TableCell>
+                    <TableCell>
+                      <Badge variant="outline" className="text-[10px]">
+                        {r.targetKind}
+                      </Badge>
+                    </TableCell>
+                    <TableCell className="text-xs">{formatLead(r.leadMinutes)}</TableCell>
+                    <TableCell className="text-xs">{recipientLabel}</TableCell>
+                    <TableCell>
+                      <div className="flex flex-wrap gap-1">
+                        {channels.map((c) => (
+                          <Badge key={c} variant="outline" className="text-[10px]">
+                            {c}
+                          </Badge>
+                        ))}
+                      </div>
+                    </TableCell>
+                    <TableCell>
+                      <PermissionGate
+                        permission={PERMISSIONS.ESCALATION_RULE_MANAGE}
+                        fallback={
+                          <Badge variant="outline" className="text-[10px]">
+                            {r.enabled ? 'On' : 'Off'}
+                          </Badge>
+                        }
+                      >
+                        <Switch
+                          checked={r.enabled}
+                          onCheckedChange={(v) =>
+                            toggleEnabled.mutate({
+                              id: r.id as EscalationRuleId,
+                              enabled: v,
+                            })
+                          }
+                        />
+                      </PermissionGate>
+                    </TableCell>
+                    <TableCell>
+                      <PermissionGate permission={PERMISSIONS.ESCALATION_RULE_MANAGE}>
+                        <div className="flex items-center gap-1">
+                          <Button
+                            variant="ghost"
+                            size="sm"
+                            className="h-7 w-7 p-0"
+                            onClick={() => setEditingRule(r)}
+                            aria-label="Edit escalation"
+                          >
+                            <PencilSquareIcon className="h-3.5 w-3.5" />
+                          </Button>
+                          <AlertDialog>
+                            <AlertDialogTrigger asChild>
+                              <Button
+                                variant="ghost"
+                                size="sm"
+                                className="h-7 w-7 p-0"
+                                aria-label="Delete escalation"
+                              >
+                                <TrashIcon className="h-3.5 w-3.5" />
+                              </Button>
+                            </AlertDialogTrigger>
+                            <AlertDialogContent>
+                              <AlertDialogHeader>
+                                <AlertDialogTitle>Delete this escalation?</AlertDialogTitle>
+                                <AlertDialogDescription>
+                                  &quot;{r.name}&quot; will stop firing on this policy.
+                                </AlertDialogDescription>
+                              </AlertDialogHeader>
+                              <AlertDialogFooter>
+                                <AlertDialogCancel>Cancel</AlertDialogCancel>
+                                <AlertDialogAction
+                                  onClick={() => deleteMutation.mutate(r.id as EscalationRuleId)}
+                                >
+                                  Delete
+                                </AlertDialogAction>
+                              </AlertDialogFooter>
+                            </AlertDialogContent>
+                          </AlertDialog>
+                        </div>
+                      </PermissionGate>
+                    </TableCell>
+                  </TableRow>
+                )
+              })
+            )}
+          </TableBody>
+        </Table>
+      </div>
+
+      <SlaEscalationDialog policyId={policyId} open={createOpen} onOpenChange={setCreateOpen} />
+      <SlaEscalationDialog
+        policyId={policyId}
+        open={editingRule !== null}
+        onOpenChange={(o) => {
+          if (!o) setEditingRule(null)
+        }}
+        rule={editingRule ?? undefined}
+      />
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/sla/sla-policy-create-dialog.tsx b/apps/web/src/components/admin/settings/sla/sla-policy-create-dialog.tsx
new file mode 100644
index 000000000..a1cd6596f
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/sla-policy-create-dialog.tsx
@@ -0,0 +1,305 @@
+/**
+ * SLA policy create dialog. Scope is creation-only (backend update doesn't
+ * accept scope changes). On success navigates to the detail page so the user
+ * can configure targets + escalations.
+ */
+import { useState } from 'react'
+import { useMutation, useQueryClient, useSuspenseQuery } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import type { TeamId, InboxId, BusinessHoursId, SlaPolicyId } from '@quackback/ids'
+import { createSlaPolicyFn } from '@/lib/server/functions/sla'
+import { businessHoursQueries } from '@/lib/client/queries/business-hours'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import { Switch } from '@/components/ui/switch'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import { InboxPicker } from '@/components/admin/shared/inbox-picker'
+import { cn } from '@/lib/shared/utils'
+
+type Scope = 'workspace' | 'team' | 'inbox'
+const PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+
+interface Props {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}
+
+export function SlaPolicyCreateDialog({ open, onOpenChange }: Props) {
+  const qc = useQueryClient()
+  const router = useRouter()
+  const { data: calendars } = useSuspenseQuery(businessHoursQueries.list({}))
+
+  const [name, setName] = useState('')
+  const [description, setDescription] = useState('')
+  const [scope, setScope] = useState<Scope>('workspace')
+  const [scopeTeamId, setScopeTeamId] = useState<TeamId | null>(null)
+  const [scopeInboxId, setScopeInboxId] = useState<InboxId | null>(null)
+  const [appliesToPriorities, setAppliesToPriorities] = useState<string[]>([])
+  const [businessHoursId, setBusinessHoursId] = useState<string>('')
+  const [pauseOnPending, setPauseOnPending] = useState(true)
+  const [pauseOnOnHold, setPauseOnOnHold] = useState(true)
+  const [enabled, setEnabled] = useState(true)
+  const [priority, setPriority] = useState(100)
+
+  const reset = () => {
+    setName('')
+    setDescription('')
+    setScope('workspace')
+    setScopeTeamId(null)
+    setScopeInboxId(null)
+    setAppliesToPriorities([])
+    setBusinessHoursId('')
+    setPauseOnPending(true)
+    setPauseOnOnHold(true)
+    setEnabled(true)
+    setPriority(100)
+  }
+
+  const togglePriority = (p: string) => {
+    setAppliesToPriorities((prev) =>
+      prev.includes(p) ? prev.filter((x) => x !== p) : [...prev, p]
+    )
+  }
+
+  const createMutation = useMutation({
+    mutationFn: () =>
+      createSlaPolicyFn({
+        data: {
+          name: name.trim(),
+          description: description.trim() || null,
+          priority,
+          enabled,
+          scope,
+          scopeTeamId: scope === 'team' ? scopeTeamId : null,
+          scopeInboxId: scope === 'inbox' ? scopeInboxId : null,
+          appliesToPriorities:
+            appliesToPriorities.length > 0
+              ? (appliesToPriorities as ('low' | 'normal' | 'high' | 'urgent')[])
+              : undefined,
+          businessHoursId: businessHoursId ? (businessHoursId as BusinessHoursId) : null,
+          pauseOnPending,
+          pauseOnOnHold,
+        },
+      }),
+    onSuccess: (policy) => {
+      toast.success('Policy created')
+      qc.invalidateQueries({ queryKey: ['sla'] })
+      onOpenChange(false)
+      reset()
+      router.navigate({
+        to: '/admin/settings/sla/$policyId',
+        params: { policyId: policy.id as SlaPolicyId },
+      })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const handleSave = () => {
+    if (!name.trim()) {
+      toast.error('Name is required')
+      return
+    }
+    if (scope === 'team' && !scopeTeamId) {
+      toast.error('Pick a team for team scope')
+      return
+    }
+    if (scope === 'inbox' && !scopeInboxId) {
+      toast.error('Pick an inbox for inbox scope')
+      return
+    }
+    createMutation.mutate()
+  }
+
+  return (
+    <Dialog
+      open={open}
+      onOpenChange={(o) => {
+        if (!o) reset()
+        onOpenChange(o)
+      }}
+    >
+      <DialogContent className="max-w-2xl max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>New SLA policy</DialogTitle>
+          <DialogDescription>
+            Scope determines which tickets the policy applies to. Targets and escalations are
+            configured after creation.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4">
+          <div className="space-y-2">
+            <Label htmlFor="sla-name">Name</Label>
+            <Input
+              id="sla-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              placeholder="e.g. Premium customer SLA"
+            />
+          </div>
+          <div className="space-y-2">
+            <Label htmlFor="sla-desc">Description</Label>
+            <Textarea
+              id="sla-desc"
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+              rows={2}
+              placeholder="Optional"
+            />
+          </div>
+
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-2">
+              <Label>Scope</Label>
+              <Select value={scope} onValueChange={(v) => setScope(v as Scope)}>
+                <SelectTrigger>
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="workspace">Workspace</SelectItem>
+                  <SelectItem value="team">Team</SelectItem>
+                  <SelectItem value="inbox">Inbox</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="sla-priority">Priority (lower runs first)</Label>
+              <Input
+                id="sla-priority"
+                type="number"
+                value={priority}
+                onChange={(e) => setPriority(Number(e.target.value) || 0)}
+              />
+            </div>
+          </div>
+
+          {scope === 'team' && (
+            <div className="space-y-2">
+              <Label>Team</Label>
+              <TeamPicker
+                value={scopeTeamId}
+                onValueChange={setScopeTeamId}
+                allowClear
+                placeholder="Pick team…"
+              />
+            </div>
+          )}
+          {scope === 'inbox' && (
+            <div className="space-y-2">
+              <Label>Inbox</Label>
+              <InboxPicker
+                value={scopeInboxId}
+                onValueChange={setScopeInboxId}
+                allowClear
+                placeholder="Pick inbox…"
+              />
+            </div>
+          )}
+
+          <div className="space-y-2">
+            <Label>Applies to priorities</Label>
+            <div className="flex flex-wrap gap-1">
+              {PRIORITIES.map((p) => {
+                const checked = appliesToPriorities.includes(p)
+                return (
+                  <button
+                    key={p}
+                    type="button"
+                    onClick={() => togglePriority(p)}
+                    className={cn(
+                      'text-[11px] rounded border px-2 py-0.5',
+                      checked
+                        ? 'bg-primary text-primary-foreground border-primary'
+                        : 'bg-background border-border/60 text-muted-foreground hover:bg-muted'
+                    )}
+                  >
+                    {p}
+                  </button>
+                )
+              })}
+              {appliesToPriorities.length === 0 && (
+                <span className="text-xs text-muted-foreground self-center ml-2">
+                  All priorities
+                </span>
+              )}
+            </div>
+          </div>
+
+          <div className="space-y-2">
+            <Label>Business hours</Label>
+            <Select
+              value={businessHoursId || '__none'}
+              onValueChange={(v) => setBusinessHoursId(v === '__none' ? '' : v)}
+            >
+              <SelectTrigger>
+                <SelectValue placeholder="Pick calendar…" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="__none">None (24/7)</SelectItem>
+                {calendars
+                  .filter((c) => !c.archivedAt)
+                  .map((c) => (
+                    <SelectItem key={c.id} value={c.id}>
+                      {c.name}
+                    </SelectItem>
+                  ))}
+              </SelectContent>
+            </Select>
+          </div>
+
+          <div className="space-y-2">
+            <Label>Pause clocks when ticket is</Label>
+            <div className="flex items-center gap-4">
+              <label className="flex items-center gap-2 text-xs">
+                <Switch checked={pauseOnPending} onCheckedChange={setPauseOnPending} />
+                Pending
+              </label>
+              <label className="flex items-center gap-2 text-xs">
+                <Switch checked={pauseOnOnHold} onCheckedChange={setPauseOnOnHold} />
+                On hold
+              </label>
+            </div>
+          </div>
+
+          <div className="flex items-center gap-2">
+            <Switch checked={enabled} onCheckedChange={setEnabled} id="sla-enabled" />
+            <Label htmlFor="sla-enabled" className="text-xs cursor-pointer">
+              Enabled
+            </Label>
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button
+            variant="outline"
+            onClick={() => onOpenChange(false)}
+            disabled={createMutation.isPending}
+          >
+            Cancel
+          </Button>
+          <Button onClick={handleSave} disabled={createMutation.isPending}>
+            Create policy
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/sla/sla-policy-list.tsx b/apps/web/src/components/admin/settings/sla/sla-policy-list.tsx
new file mode 100644
index 000000000..300587a0e
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/sla-policy-list.tsx
@@ -0,0 +1,148 @@
+/**
+ * SLA policy list. Each row links to detail. Inline enabled toggle.
+ */
+import { useState } from 'react'
+import { useSuspenseQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import { Link } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import type { SlaPolicyId } from '@quackback/ids'
+import { slaQueries } from '@/lib/client/queries/sla'
+import { businessHoursQueries } from '@/lib/client/queries/business-hours'
+import { updateSlaPolicyFn } from '@/lib/server/functions/sla'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Switch } from '@/components/ui/switch'
+import { Label } from '@/components/ui/label'
+import { Badge } from '@/components/ui/badge'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export function SlaPolicyList() {
+  const qc = useQueryClient()
+  const [showArchived, setShowArchived] = useState(false)
+  const { data: policies } = useSuspenseQuery(slaQueries.policies({ includeArchived: true }))
+  const { data: calendars } = useSuspenseQuery(businessHoursQueries.list({}))
+
+  const calendarLabel = (id: string | null): string => {
+    if (!id) return '—'
+    const c = calendars.find((x) => x.id === id)
+    return c?.name ?? '—'
+  }
+
+  const toggleEnabled = useMutation({
+    mutationFn: (vars: { id: SlaPolicyId; enabled: boolean }) =>
+      updateSlaPolicyFn({ data: { id: vars.id, enabled: vars.enabled } }),
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['sla'] }),
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const visible = policies.filter((p) => showArchived || !p.archivedAt)
+
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center gap-2">
+        <Switch id="show-archived-sla" checked={showArchived} onCheckedChange={setShowArchived} />
+        <Label htmlFor="show-archived-sla" className="text-xs cursor-pointer">
+          Show archived
+        </Label>
+      </div>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead className="w-32">Scope</TableHead>
+              <TableHead>Priorities</TableHead>
+              <TableHead className="w-44">Business hours</TableHead>
+              <TableHead className="w-20">Enabled</TableHead>
+              <TableHead className="w-24">Status</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {visible.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={6} className="text-center text-sm text-muted-foreground py-6">
+                  No SLA policies yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              visible.map((p) => {
+                const priorities = (p.appliesToPriorities as string[] | null) ?? []
+                return (
+                  <TableRow key={p.id} className="hover:bg-muted/30">
+                    <TableCell className="font-medium">
+                      <Link
+                        to="/admin/settings/sla/$policyId"
+                        params={{ policyId: p.id }}
+                        className="hover:underline"
+                      >
+                        {p.name}
+                      </Link>
+                    </TableCell>
+                    <TableCell>
+                      <Badge variant="outline" className="text-[10px]">
+                        {p.scope}
+                      </Badge>
+                    </TableCell>
+                    <TableCell>
+                      <div className="flex flex-wrap gap-1">
+                        {priorities.length === 0 ? (
+                          <span className="text-xs text-muted-foreground">All</span>
+                        ) : (
+                          priorities.map((pr) => (
+                            <Badge key={pr} variant="outline" className="text-[10px]">
+                              {pr}
+                            </Badge>
+                          ))
+                        )}
+                      </div>
+                    </TableCell>
+                    <TableCell className="text-xs">
+                      {calendarLabel(p.businessHoursId as string | null)}
+                    </TableCell>
+                    <TableCell>
+                      <PermissionGate
+                        permission={PERMISSIONS.SLA_MANAGE}
+                        fallback={
+                          <Badge variant="outline" className="text-[10px]">
+                            {p.enabled ? 'On' : 'Off'}
+                          </Badge>
+                        }
+                      >
+                        <Switch
+                          checked={p.enabled}
+                          onCheckedChange={(v) =>
+                            toggleEnabled.mutate({
+                              id: p.id as SlaPolicyId,
+                              enabled: v,
+                            })
+                          }
+                        />
+                      </PermissionGate>
+                    </TableCell>
+                    <TableCell>
+                      {p.archivedAt ? (
+                        <Badge variant="outline" className="text-muted-foreground">
+                          Archived
+                        </Badge>
+                      ) : (
+                        <Badge variant="outline">Active</Badge>
+                      )}
+                    </TableCell>
+                  </TableRow>
+                )
+              })
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/sla/sla-policy-overview-tab.tsx b/apps/web/src/components/admin/settings/sla/sla-policy-overview-tab.tsx
new file mode 100644
index 000000000..6be1c3491
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/sla-policy-overview-tab.tsx
@@ -0,0 +1,264 @@
+/**
+ * SLA policy overview tab — editable form. Scope is read-only (backend update
+ * doesn't accept scope changes).
+ */
+import { useEffect, useState } from 'react'
+import { useMutation, useQueryClient, useSuspenseQuery } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { BusinessHoursId, SlaPolicyId } from '@quackback/ids'
+import type { SlaPolicy } from '@/lib/shared/db-types'
+import { updateSlaPolicyFn, archiveSlaPolicyFn } from '@/lib/server/functions/sla'
+import { businessHoursQueries } from '@/lib/client/queries/business-hours'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import { Switch } from '@/components/ui/switch'
+import { Badge } from '@/components/ui/badge'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { cn } from '@/lib/shared/utils'
+
+const PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+
+export function SlaPolicyOverviewTab({ policy }: { policy: SlaPolicy }) {
+  const qc = useQueryClient()
+  const { data: calendars } = useSuspenseQuery(businessHoursQueries.list({}))
+
+  const [name, setName] = useState(policy.name)
+  const [description, setDescription] = useState(policy.description ?? '')
+  const [priority, setPriority] = useState(policy.priority)
+  const [enabled, setEnabled] = useState(policy.enabled)
+  const [appliesToPriorities, setAppliesToPriorities] = useState<string[]>(
+    (policy.appliesToPriorities as string[] | null) ?? []
+  )
+  const [businessHoursId, setBusinessHoursId] = useState<string>(
+    (policy.businessHoursId as string | null) ?? ''
+  )
+  const [pauseOnPending, setPauseOnPending] = useState(policy.pauseOnPending)
+  const [pauseOnOnHold, setPauseOnOnHold] = useState(policy.pauseOnOnHold)
+
+  useEffect(() => {
+    setName(policy.name)
+    setDescription(policy.description ?? '')
+    setPriority(policy.priority)
+    setEnabled(policy.enabled)
+    setAppliesToPriorities((policy.appliesToPriorities as string[] | null) ?? [])
+    setBusinessHoursId((policy.businessHoursId as string | null) ?? '')
+    setPauseOnPending(policy.pauseOnPending)
+    setPauseOnOnHold(policy.pauseOnOnHold)
+  }, [policy])
+
+  const togglePriority = (p: string) => {
+    setAppliesToPriorities((prev) =>
+      prev.includes(p) ? prev.filter((x) => x !== p) : [...prev, p]
+    )
+  }
+
+  const saveMutation = useMutation({
+    mutationFn: () =>
+      updateSlaPolicyFn({
+        data: {
+          id: policy.id as SlaPolicyId,
+          name: name.trim(),
+          description: description.trim() || null,
+          priority,
+          enabled,
+          appliesToPriorities:
+            appliesToPriorities.length > 0
+              ? (appliesToPriorities as ('low' | 'normal' | 'high' | 'urgent')[])
+              : undefined,
+          businessHoursId: businessHoursId ? (businessHoursId as BusinessHoursId) : null,
+          pauseOnPending,
+          pauseOnOnHold,
+        },
+      }),
+    onSuccess: () => {
+      toast.success('Policy updated')
+      qc.invalidateQueries({ queryKey: ['sla'] })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const archiveMutation = useMutation({
+    mutationFn: () => archiveSlaPolicyFn({ data: { id: policy.id as SlaPolicyId } }),
+    onSuccess: () => {
+      toast.success('Policy archived')
+      qc.invalidateQueries({ queryKey: ['sla'] })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-6 max-w-3xl">
+      <div className="space-y-4">
+        <div className="space-y-2">
+          <Label>Scope (cannot be changed)</Label>
+          <div className="flex items-center gap-2">
+            <Badge variant="outline">{policy.scope}</Badge>
+            {policy.scopeTeamId && (
+              <span className="text-xs text-muted-foreground font-mono">
+                team: {String(policy.scopeTeamId)}
+              </span>
+            )}
+            {policy.scopeInboxId && (
+              <span className="text-xs text-muted-foreground font-mono">
+                inbox: {String(policy.scopeInboxId)}
+              </span>
+            )}
+          </div>
+        </div>
+
+        <div className="space-y-2">
+          <Label htmlFor="ov-name">Name</Label>
+          <Input id="ov-name" value={name} onChange={(e) => setName(e.target.value)} />
+        </div>
+        <div className="space-y-2">
+          <Label htmlFor="ov-desc">Description</Label>
+          <Textarea
+            id="ov-desc"
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+            rows={2}
+          />
+        </div>
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-2">
+            <Label htmlFor="ov-priority">Priority (lower runs first)</Label>
+            <Input
+              id="ov-priority"
+              type="number"
+              value={priority}
+              onChange={(e) => setPriority(Number(e.target.value) || 0)}
+            />
+          </div>
+          <div className="space-y-2">
+            <Label>Business hours</Label>
+            <Select
+              value={businessHoursId || '__none'}
+              onValueChange={(v) => setBusinessHoursId(v === '__none' ? '' : v)}
+            >
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="__none">None (24/7)</SelectItem>
+                {calendars
+                  .filter((c) => !c.archivedAt || c.id === businessHoursId)
+                  .map((c) => (
+                    <SelectItem key={c.id} value={c.id}>
+                      {c.name}
+                    </SelectItem>
+                  ))}
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+
+        <div className="space-y-2">
+          <Label>Applies to priorities</Label>
+          <div className="flex flex-wrap gap-1">
+            {PRIORITIES.map((p) => {
+              const checked = appliesToPriorities.includes(p)
+              return (
+                <button
+                  key={p}
+                  type="button"
+                  onClick={() => togglePriority(p)}
+                  className={cn(
+                    'text-[11px] rounded border px-2 py-0.5',
+                    checked
+                      ? 'bg-primary text-primary-foreground border-primary'
+                      : 'bg-background border-border/60 text-muted-foreground hover:bg-muted'
+                  )}
+                >
+                  {p}
+                </button>
+              )
+            })}
+            {appliesToPriorities.length === 0 && (
+              <span className="text-xs text-muted-foreground self-center ml-2">All priorities</span>
+            )}
+          </div>
+        </div>
+
+        <div className="space-y-2">
+          <Label>Pause clocks when ticket is</Label>
+          <div className="flex items-center gap-4">
+            <label className="flex items-center gap-2 text-xs">
+              <Switch checked={pauseOnPending} onCheckedChange={setPauseOnPending} />
+              Pending
+            </label>
+            <label className="flex items-center gap-2 text-xs">
+              <Switch checked={pauseOnOnHold} onCheckedChange={setPauseOnOnHold} />
+              On hold
+            </label>
+          </div>
+        </div>
+
+        <div className="flex items-center gap-2">
+          <Switch checked={enabled} onCheckedChange={setEnabled} id="ov-enabled" />
+          <Label htmlFor="ov-enabled" className="text-xs cursor-pointer">
+            Enabled
+          </Label>
+        </div>
+
+        <PermissionGate permission={PERMISSIONS.SLA_MANAGE}>
+          <Button onClick={() => saveMutation.mutate()} disabled={saveMutation.isPending}>
+            Save changes
+          </Button>
+        </PermissionGate>
+      </div>
+
+      {!policy.archivedAt && (
+        <div className="rounded border border-destructive/30 p-3 space-y-2">
+          <p className="text-xs font-semibold text-destructive">Archive</p>
+          <p className="text-xs text-muted-foreground">
+            Archived policies stop binding to new tickets. Existing clocks continue running.
+          </p>
+          <PermissionGate permission={PERMISSIONS.SLA_MANAGE}>
+            <AlertDialog>
+              <AlertDialogTrigger asChild>
+                <Button variant="outline" size="sm">
+                  Archive policy
+                </Button>
+              </AlertDialogTrigger>
+              <AlertDialogContent>
+                <AlertDialogHeader>
+                  <AlertDialogTitle>Archive this SLA policy?</AlertDialogTitle>
+                  <AlertDialogDescription>
+                    New tickets will not bind to this policy. This cannot be undone via UI.
+                  </AlertDialogDescription>
+                </AlertDialogHeader>
+                <AlertDialogFooter>
+                  <AlertDialogCancel>Cancel</AlertDialogCancel>
+                  <AlertDialogAction onClick={() => archiveMutation.mutate()}>
+                    Archive
+                  </AlertDialogAction>
+                </AlertDialogFooter>
+              </AlertDialogContent>
+            </AlertDialog>
+          </PermissionGate>
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/sla/sla-targets-tab.tsx b/apps/web/src/components/admin/settings/sla/sla-targets-tab.tsx
new file mode 100644
index 000000000..4edac955e
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/sla-targets-tab.tsx
@@ -0,0 +1,90 @@
+/**
+ * SLA targets tab. Three rows for first_response/next_response/resolution.
+ * Targets are bulk-replaced server-side: omit a kind to remove its target.
+ */
+import { useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { SlaPolicyId } from '@quackback/ids'
+import type { SlaTarget } from '@/lib/shared/db-types'
+import { replaceSlaTargetsFn } from '@/lib/server/functions/sla'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const KINDS = [
+  { key: 'first_response', label: 'First response', desc: 'Time to first agent reply' },
+  { key: 'next_response', label: 'Next response', desc: 'Time between subsequent replies' },
+  { key: 'resolution', label: 'Resolution', desc: 'Time until ticket is resolved' },
+] as const
+type Kind = (typeof KINDS)[number]['key']
+
+interface Props {
+  policyId: SlaPolicyId
+  initialTargets: SlaTarget[]
+}
+
+export function SlaTargetsTab({ policyId, initialTargets }: Props) {
+  const qc = useQueryClient()
+  const initial: Record<Kind, string> = { first_response: '', next_response: '', resolution: '' }
+  for (const t of initialTargets) {
+    if (t.kind in initial) initial[t.kind as Kind] = String(t.minutes)
+  }
+  const [values, setValues] = useState<Record<Kind, string>>(initial)
+
+  const saveMutation = useMutation({
+    mutationFn: () => {
+      const targets: { kind: Kind; minutes: number }[] = []
+      for (const { key } of KINDS) {
+        const raw = values[key].trim()
+        if (!raw) continue
+        const n = Number(raw)
+        if (Number.isInteger(n) && n > 0) targets.push({ kind: key, minutes: n })
+      }
+      return replaceSlaTargetsFn({ data: { policyId, targets } })
+    },
+    onSuccess: () => {
+      toast.success('Targets updated')
+      qc.invalidateQueries({ queryKey: ['sla'] })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-4 max-w-2xl">
+      <p className="text-xs text-muted-foreground">
+        Leave a target empty to remove it. Times are in minutes; the SLA engine will compute due
+        timestamps using the policy&apos;s business hours.
+      </p>
+      <div className="space-y-3">
+        {KINDS.map(({ key, label, desc }) => (
+          <div key={key} className="grid grid-cols-[1fr,160px] gap-3 items-end">
+            <div>
+              <Label htmlFor={`tgt-${key}`}>{label}</Label>
+              <p className="text-[11px] text-muted-foreground">{desc}</p>
+            </div>
+            <div className="flex items-center gap-2">
+              <Input
+                id={`tgt-${key}`}
+                type="number"
+                min={0}
+                value={values[key]}
+                onChange={(e) => setValues((prev) => ({ ...prev, [key]: e.target.value }))}
+                placeholder="—"
+                className="h-8 text-xs"
+              />
+              <span className="text-xs text-muted-foreground">min</span>
+            </div>
+          </div>
+        ))}
+      </div>
+      <PermissionGate permission={PERMISSIONS.SLA_MANAGE}>
+        <Button onClick={() => saveMutation.mutate()} disabled={saveMutation.isPending}>
+          Save targets
+        </Button>
+      </PermissionGate>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/sla/sla-tick-trigger.tsx b/apps/web/src/components/admin/settings/sla/sla-tick-trigger.tsx
new file mode 100644
index 000000000..877521747
--- /dev/null
+++ b/apps/web/src/components/admin/settings/sla/sla-tick-trigger.tsx
@@ -0,0 +1,38 @@
+/**
+ * Admin-only "Run escalation tick now" button. Useful for verifying escalation
+ * rules without waiting for the cron job.
+ */
+import { useMutation } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import { runSlaTickFn } from '@/lib/server/functions/sla'
+import { Button } from '@/components/ui/button'
+import { BoltIcon } from '@heroicons/react/24/outline'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export function SlaTickTrigger() {
+  const mutation = useMutation({
+    mutationFn: () => runSlaTickFn({ data: {} }),
+    onSuccess: (result) => {
+      const r = result as { processed?: number; fired?: number } | null
+      const processed = r?.processed ?? 0
+      const fired = r?.fired ?? 0
+      toast.success(`Tick ran — processed ${processed}, fired ${fired}`)
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <PermissionGate permission={PERMISSIONS.SLA_MANAGE}>
+      <Button
+        variant="outline"
+        size="sm"
+        onClick={() => mutation.mutate()}
+        disabled={mutation.isPending}
+      >
+        <BoltIcon className="h-4 w-4 mr-1" />
+        Run tick now
+      </Button>
+    </PermissionGate>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/team/__tests__/manage-principal-roles-dialog.test.tsx b/apps/web/src/components/admin/settings/team/__tests__/manage-principal-roles-dialog.test.tsx
new file mode 100644
index 000000000..4b7ad784c
--- /dev/null
+++ b/apps/web/src/components/admin/settings/team/__tests__/manage-principal-roles-dialog.test.tsx
@@ -0,0 +1,332 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { ManagePrincipalRolesDialog } from '../manage-principal-roles-dialog'
+
+type Assignment = {
+  id: string
+  role: {
+    id: string
+    name: string
+    key: string
+    isSystem: boolean
+  }
+  teamName: string | null
+}
+
+type Role = {
+  id: string
+  name: string
+  key: string
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  routerInvalidate: vi.fn(),
+  listAssignmentsForPrincipalFn: vi.fn(),
+  listRolesFn: vi.fn(),
+  assignRoleFn: vi.fn(),
+  revokeRoleAssignmentFn: vi.fn(),
+  assignments: [] as Assignment[],
+  roles: [] as Role[],
+  assignmentsLoading: false,
+  rolesLoading: false,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useQuery: (options: {
+    queryKey: readonly unknown[]
+    queryFn: () => unknown
+    enabled?: boolean
+  }) => {
+    if (options.enabled === false) {
+      return { data: undefined, isLoading: false }
+    }
+    const [, kind] = options.queryKey
+    if (kind === 'principal-roles') {
+      options.queryFn()
+      return { data: mocks.assignments, isLoading: mocks.assignmentsLoading }
+    }
+    options.queryFn()
+    return { data: mocks.roles, isLoading: mocks.rolesLoading }
+  },
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({
+    invalidate: mocks.routerInvalidate,
+  }),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({
+    open,
+    children,
+  }: {
+    open: boolean
+    onOpenChange: (open: boolean) => void
+    children: ReactNode
+  }) => (open ? <div>{children}</div> : null),
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section role="dialog">{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children }: { children: ReactNode; className?: string }) => <label>{children}</label>,
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    disabled,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    disabled?: boolean
+    children: ReactNode
+  }) => (
+    <select
+      aria-label="Role"
+      value={value}
+      disabled={disabled}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) => onValueChange(event.currentTarget.value)}
+    >
+      <option value="">Pick a role</option>
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: ({ placeholder }: { placeholder?: string }) => <>{placeholder}</>,
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({
+    value,
+    onValueChange,
+    disabled,
+    placeholder,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    placeholder?: string
+    allowClear?: boolean
+    disabled?: boolean
+  }) => (
+    <select
+      aria-label="Team"
+      value={value ?? ''}
+      disabled={disabled}
+      onChange={(event: ChangeEvent<HTMLSelectElement>) =>
+        onValueChange(event.currentTarget.value || null)
+      }
+    >
+      <option value="">{placeholder ?? 'Workspace-wide'}</option>
+      <option value="team_support">Support</option>
+    </select>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  TrashIcon: () => <span aria-hidden="true">trash</span>,
+}))
+
+vi.mock('@/lib/server/functions/roles', () => ({
+  listAssignmentsForPrincipalFn: mocks.listAssignmentsForPrincipalFn,
+  listRolesFn: mocks.listRolesFn,
+  assignRoleFn: mocks.assignRoleFn,
+  revokeRoleAssignmentFn: mocks.revokeRoleAssignmentFn,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.assignmentsLoading = false
+  mocks.rolesLoading = false
+  mocks.assignments = [
+    {
+      id: 'assignment_owner',
+      role: {
+        id: 'role_owner',
+        name: 'Owner',
+        key: 'owner',
+        isSystem: true,
+      },
+      teamName: null,
+    },
+    {
+      id: 'assignment_agent',
+      role: {
+        id: 'role_agent',
+        name: 'Agent',
+        key: 'agent',
+        isSystem: false,
+      },
+      teamName: 'Support',
+    },
+  ]
+  mocks.roles = [
+    { id: 'role_admin', name: 'Admin', key: 'admin' },
+    { id: 'role_agent', name: 'Agent', key: 'agent' },
+  ]
+  mocks.listAssignmentsForPrincipalFn.mockResolvedValue(mocks.assignments)
+  mocks.listRolesFn.mockResolvedValue(mocks.roles)
+  mocks.assignRoleFn.mockResolvedValue({ id: 'assignment_new' })
+  mocks.revokeRoleAssignmentFn.mockResolvedValue(undefined)
+})
+
+function renderDialog(open = true) {
+  return render(
+    <ManagePrincipalRolesDialog
+      open={open}
+      onOpenChange={vi.fn()}
+      principalId={'principal_1' as never}
+      principalName="Ada Admin"
+    />
+  )
+}
+
+describe('ManagePrincipalRolesDialog', () => {
+  it('does not render dialog content while closed', () => {
+    renderDialog(false)
+
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+    expect(mocks.listAssignmentsForPrincipalFn).not.toHaveBeenCalled()
+    expect(mocks.listRolesFn).not.toHaveBeenCalled()
+  })
+
+  it('renders loading, empty and populated grant states', () => {
+    mocks.assignmentsLoading = true
+    mocks.rolesLoading = true
+    mocks.assignments = []
+    renderDialog()
+
+    expect(screen.getByText('Loading…')).toBeInTheDocument()
+    expect(screen.getByLabelText('Role')).toBeDisabled()
+    expect(mocks.listAssignmentsForPrincipalFn).toHaveBeenCalledWith({
+      data: { principalId: 'principal_1' },
+    })
+    expect(mocks.listRolesFn).toHaveBeenCalled()
+
+    mocks.assignmentsLoading = false
+    mocks.rolesLoading = false
+    mocks.assignments = []
+    const { rerender } = renderDialog()
+    expect(screen.getByText('No role grants yet.')).toBeInTheDocument()
+
+    mocks.assignments = [
+      {
+        id: 'assignment_owner',
+        role: { id: 'role_owner', name: 'Owner', key: 'owner', isSystem: true },
+        teamName: null,
+      },
+    ]
+    rerender(
+      <ManagePrincipalRolesDialog
+        open
+        onOpenChange={vi.fn()}
+        principalId={'principal_1' as never}
+        principalName="Ada Admin"
+      />
+    )
+    expect(screen.getByText('Owner')).toBeInTheDocument()
+    expect(screen.getByText('System')).toBeInTheDocument()
+    expect(screen.getByText('Workspace')).toBeInTheDocument()
+  })
+
+  it('grants scoped roles, resets selections and invalidates RBAC queries', async () => {
+    renderDialog()
+
+    expect(screen.getByRole('button', { name: 'Grant role' })).toBeDisabled()
+    fireEvent.change(screen.getByLabelText('Role'), { target: { value: 'role_admin' } })
+    fireEvent.change(screen.getByLabelText('Team'), { target: { value: 'team_support' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Grant role' }))
+
+    await waitFor(() => {
+      expect(mocks.assignRoleFn).toHaveBeenCalledWith({
+        data: {
+          principalId: 'principal_1',
+          roleId: 'role_admin',
+          teamId: 'team_support',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['admin', 'principal-roles', 'principal_1'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['admin', 'roles'] })
+    expect(mocks.routerInvalidate).toHaveBeenCalled()
+    expect(screen.getByLabelText('Role')).toHaveValue('')
+    expect(screen.getByLabelText('Team')).toHaveValue('')
+  })
+
+  it('revokes grants and reports grant/revoke errors', async () => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    mocks.assignRoleFn.mockRejectedValueOnce(new Error('Grant denied'))
+    mocks.revokeRoleAssignmentFn.mockRejectedValueOnce(new Error('Revoke denied'))
+
+    renderDialog()
+
+    fireEvent.change(screen.getByLabelText('Role'), { target: { value: 'role_admin' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Grant role' }))
+    await waitFor(() => {
+      expect(screen.getByText('Grant denied')).toBeInTheDocument()
+    })
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Revoke' })[0])
+    await waitFor(() => {
+      expect(mocks.revokeRoleAssignmentFn).toHaveBeenCalledWith({
+        data: { assignmentId: 'assignment_owner' },
+      })
+    })
+    expect(screen.getByText('Revoke denied')).toBeInTheDocument()
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Revoke' })[0])
+    await waitFor(() => {
+      expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+        queryKey: ['admin', 'principal-roles', 'principal_1'],
+      })
+    })
+    consoleError.mockRestore()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/team/__tests__/member-actions.test.tsx b/apps/web/src/components/admin/settings/team/__tests__/member-actions.test.tsx
new file mode 100644
index 000000000..2dba33e45
--- /dev/null
+++ b/apps/web/src/components/admin/settings/team/__tests__/member-actions.test.tsx
@@ -0,0 +1,268 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { MemberActions } from '../member-actions'
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  updateMemberRoleFn: vi.fn(),
+  removeTeamMemberFn: vi.fn(),
+  forceSignOutUserFn: vi.fn(),
+  adminResetTwoFactorFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  alert: vi.fn(),
+  consoleError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/lib/server/functions/admin', () => ({
+  updateMemberRoleFn: mocks.updateMemberRoleFn,
+  removeTeamMemberFn: mocks.removeTeamMemberFn,
+  forceSignOutUserFn: mocks.forceSignOutUserFn,
+}))
+
+vi.mock('@/lib/server/functions/admin-reset-two-factor', () => ({
+  adminResetTwoFactorFn: mocks.adminResetTwoFactorFn,
+}))
+
+vi.mock('../manage-principal-roles-dialog', () => ({
+  ManagePrincipalRolesDialog: ({
+    open,
+    onOpenChange,
+    principalId,
+    principalName,
+  }: {
+    open: boolean
+    onOpenChange: (open: boolean) => void
+    principalId: string
+    principalName: string
+  }) =>
+    open ? (
+      <section>
+        Manage roles for {principalName} ({principalId})
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close roles
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('@/components/shared/confirm-dialog', () => ({
+  ConfirmDialog: ({
+    open,
+    title,
+    description,
+    confirmLabel,
+    onConfirm,
+    onOpenChange,
+  }: {
+    open: boolean
+    title: string
+    description: ReactNode
+    confirmLabel: string
+    variant?: string
+    isPending?: boolean
+    onConfirm: () => void | Promise<void>
+    onOpenChange: (open: boolean) => void
+  }) =>
+    open ? (
+      <section role="alertdialog">
+        <h2>{title}</h2>
+        <p>{description}</p>
+        <button type="button" onClick={() => void onConfirm()}>
+          {confirmLabel}
+        </button>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close confirm
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    variant?: string
+    size?: string
+    className?: string
+  }) => (
+    <button type="button" disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/dropdown-menu', () => ({
+  DropdownMenu: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DropdownMenuContent: ({ children }: { children: ReactNode; align?: string }) => (
+    <div>{children}</div>
+  ),
+  DropdownMenuItem: ({
+    children,
+    disabled,
+    onClick,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    variant?: string
+    className?: string
+  }) => (
+    <button type="button" disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+  DropdownMenuSeparator: () => <hr />,
+  DropdownMenuTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => (
+    <>{children}</>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  ArrowRightOnRectangleIcon: () => <span aria-hidden="true">signout</span>,
+  EllipsisVerticalIcon: () => <span aria-hidden="true">menu</span>,
+  ShieldCheckIcon: () => <span aria-hidden="true">admin</span>,
+  ShieldExclamationIcon: () => <span aria-hidden="true">2fa</span>,
+  UserIcon: () => <span aria-hidden="true">user</span>,
+  UserMinusIcon: () => <span aria-hidden="true">remove</span>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  KeyIcon: () => <span aria-hidden="true">key</span>,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.updateMemberRoleFn.mockResolvedValue(undefined)
+  mocks.removeTeamMemberFn.mockResolvedValue(undefined)
+  mocks.forceSignOutUserFn.mockResolvedValue({ revokeCount: 2 })
+  mocks.adminResetTwoFactorFn.mockResolvedValue(undefined)
+  mocks.invalidateQueries.mockResolvedValue(undefined)
+  vi.stubGlobal('alert', mocks.alert)
+  vi.spyOn(console, 'error').mockImplementation(mocks.consoleError)
+})
+
+describe('MemberActions', () => {
+  it('runs member administration actions and invalidates team queries', async () => {
+    render(
+      <MemberActions
+        principalId="principal_1"
+        userId="user_1"
+        memberName="Ada"
+        memberRole="member"
+        isLastAdmin={false}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /Make admin/ }))
+    expect(screen.getByRole('heading', { name: 'Make admin?' })).toBeInTheDocument()
+    fireEvent.click(screen.getAllByRole('button', { name: 'Make admin' }).at(-1)!)
+    await waitFor(() => {
+      expect(mocks.updateMemberRoleFn).toHaveBeenCalledWith({
+        data: { principalId: 'principal_1', role: 'admin' },
+      })
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: /Manage roles/ }))
+    expect(screen.getByText(/Manage roles for Ada/)).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Close roles' }))
+    expect(screen.queryByText(/Manage roles for Ada/)).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: /Reset two-factor/ }))
+    expect(
+      screen.getByRole('heading', { name: 'Reset two-factor authentication?' })
+    ).toBeInTheDocument()
+    fireEvent.click(screen.getAllByRole('button', { name: 'Reset two-factor' }).at(-1)!)
+    await waitFor(() => {
+      expect(mocks.adminResetTwoFactorFn).toHaveBeenCalledWith({ data: { userId: 'user_1' } })
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: /Sign out everywhere/ }))
+    expect(screen.getByRole('heading', { name: 'Sign out everywhere?' })).toBeInTheDocument()
+    fireEvent.click(screen.getAllByRole('button', { name: 'Sign out everywhere' }).at(-1)!)
+    await waitFor(() => {
+      expect(mocks.forceSignOutUserFn).toHaveBeenCalledWith({ data: { userId: 'user_1' } })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Signed Ada out of 2 sessions.')
+
+    fireEvent.click(screen.getAllByRole('button', { name: /Remove from team/ })[0])
+    expect(screen.getByRole('heading', { name: 'Remove team member?' })).toBeInTheDocument()
+    fireEvent.click(screen.getAllByRole('button', { name: 'Remove from team' }).at(-1)!)
+    await waitFor(() => {
+      expect(mocks.removeTeamMemberFn).toHaveBeenCalledWith({
+        data: { principalId: 'principal_1' },
+      })
+    })
+
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['settings', 'team'] })
+  })
+
+  it('handles admin demotion, one-session signout copy, and service errors', async () => {
+    mocks.forceSignOutUserFn.mockResolvedValueOnce({ revokeCount: 1 })
+    mocks.updateMemberRoleFn.mockRejectedValueOnce(new Error('cannot demote'))
+    const { rerender } = render(
+      <MemberActions
+        principalId="principal_2"
+        userId="user_2"
+        memberName="Grace"
+        memberRole="admin"
+        isLastAdmin={false}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /Make member/ }))
+    expect(screen.getByRole('heading', { name: 'Remove admin privileges?' })).toBeInTheDocument()
+    fireEvent.click(screen.getAllByRole('button', { name: 'Remove admin' }).at(-1)!)
+    await waitFor(() => {
+      expect(mocks.alert).toHaveBeenCalledWith('cannot demote')
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: /Sign out everywhere/ }))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Sign out everywhere' }).at(-1)!)
+    await waitFor(() => {
+      expect(mocks.toastSuccess).toHaveBeenCalledWith('Signed Grace out of 1 session.')
+    })
+
+    mocks.forceSignOutUserFn.mockRejectedValueOnce(new Error('session revoke failed'))
+    fireEvent.click(screen.getByRole('button', { name: /Sign out everywhere/ }))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Sign out everywhere' }).at(-1)!)
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('session revoke failed')
+    })
+
+    rerender(
+      <MemberActions
+        principalId="principal_3"
+        userId={null}
+        memberName="Linus"
+        memberRole="admin"
+        isLastAdmin
+      />
+    )
+
+    expect(screen.getByRole('button', { name: /Make member/ })).toBeDisabled()
+    expect(screen.getByRole('button', { name: /Remove from team/ })).toBeDisabled()
+    expect(screen.queryByRole('button', { name: /Reset two-factor/ })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: /Sign out everywhere/ })).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/team/manage-principal-roles-dialog.tsx b/apps/web/src/components/admin/settings/team/manage-principal-roles-dialog.tsx
new file mode 100644
index 000000000..81a51d3a9
--- /dev/null
+++ b/apps/web/src/components/admin/settings/team/manage-principal-roles-dialog.tsx
@@ -0,0 +1,221 @@
+'use client'
+
+import { useState, useTransition } from 'react'
+import { useQuery, useQueryClient } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import { TrashIcon } from '@heroicons/react/24/outline'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
+import { Label } from '@/components/ui/label'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import {
+  listAssignmentsForPrincipalFn,
+  listRolesFn,
+  assignRoleFn,
+  revokeRoleAssignmentFn,
+} from '@/lib/server/functions/roles'
+import type { PrincipalId, RoleId, RoleAssignmentId, TeamId } from '@quackback/ids'
+
+interface Props {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  principalId: PrincipalId
+  principalName: string
+}
+
+export function ManagePrincipalRolesDialog({
+  open,
+  onOpenChange,
+  principalId,
+  principalName,
+}: Props) {
+  const router = useRouter()
+  const queryClient = useQueryClient()
+  const [isPending, startTransition] = useTransition()
+  const [error, setError] = useState<string | null>(null)
+  const [busyId, setBusyId] = useState<RoleAssignmentId | null>(null)
+
+  const [pickRoleId, setPickRoleId] = useState<RoleId | null>(null)
+  const [pickTeamId, setPickTeamId] = useState<TeamId | null>(null)
+  const [granting, setGranting] = useState(false)
+
+  const assignmentsQuery = useQuery({
+    queryKey: ['admin', 'principal-roles', principalId],
+    queryFn: () => listAssignmentsForPrincipalFn({ data: { principalId } }),
+    enabled: open,
+  })
+
+  const rolesQuery = useQuery({
+    queryKey: ['admin', 'roles', 'list'],
+    queryFn: () => listRolesFn(),
+    enabled: open,
+  })
+
+  const invalidate = () => {
+    startTransition(() => {
+      queryClient.invalidateQueries({
+        queryKey: ['admin', 'principal-roles', principalId],
+      })
+      queryClient.invalidateQueries({ queryKey: ['admin', 'roles'] })
+      router.invalidate()
+    })
+  }
+
+  const handleRevoke = async (assignmentId: RoleAssignmentId) => {
+    setError(null)
+    setBusyId(assignmentId)
+    try {
+      await revokeRoleAssignmentFn({ data: { assignmentId } })
+      invalidate()
+    } catch (err) {
+      console.error('Failed to revoke role assignment:', err)
+      setError(err instanceof Error ? err.message : 'Failed to revoke')
+    } finally {
+      setBusyId(null)
+    }
+  }
+
+  const handleGrant = async () => {
+    if (!pickRoleId) return
+    setError(null)
+    setGranting(true)
+    try {
+      await assignRoleFn({
+        data: {
+          principalId,
+          roleId: pickRoleId,
+          teamId: pickTeamId ?? null,
+        },
+      })
+      setPickRoleId(null)
+      setPickTeamId(null)
+      invalidate()
+    } catch (err) {
+      console.error('Failed to grant role:', err)
+      setError(err instanceof Error ? err.message : 'Failed to grant role')
+    } finally {
+      setGranting(false)
+    }
+  }
+
+  const assignments = assignmentsQuery.data ?? []
+  const roles = rolesQuery.data ?? []
+  const busy = isPending || granting
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-xl">
+        <DialogHeader>
+          <DialogTitle>Manage roles</DialogTitle>
+          <DialogDescription>
+            Grants for <strong>{principalName}</strong>. Workspace-wide grants apply everywhere;
+            team-scoped grants only apply to that team.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4">
+          <div className="space-y-2">
+            <Label className="text-xs">Current grants</Label>
+            {assignmentsQuery.isLoading ? (
+              <div className="text-xs text-muted-foreground">Loading…</div>
+            ) : assignments.length === 0 ? (
+              <div className="text-xs text-muted-foreground italic">No role grants yet.</div>
+            ) : (
+              <ul className="rounded-md border border-border/50 divide-y divide-border/50">
+                {assignments.map((a) => (
+                  <li key={a.id} className="flex items-center justify-between gap-2 px-3 py-2">
+                    <div className="min-w-0 space-y-0.5">
+                      <div className="flex items-center gap-2">
+                        <span className="text-sm font-medium truncate">{a.role.name}</span>
+                        {a.role.isSystem && (
+                          <Badge variant="outline" className="text-[10px]">
+                            System
+                          </Badge>
+                        )}
+                      </div>
+                      <div className="text-[10px] text-muted-foreground flex items-center gap-1.5">
+                        <code className="font-mono">{a.role.key}</code>
+                        <span>·</span>
+                        {a.teamName ? (
+                          <Badge variant="secondary" className="text-[10px]">
+                            Team: {a.teamName}
+                          </Badge>
+                        ) : (
+                          <Badge variant="secondary" className="text-[10px]">
+                            Workspace
+                          </Badge>
+                        )}
+                      </div>
+                    </div>
+                    <Button
+                      variant="ghost"
+                      size="sm"
+                      onClick={() => handleRevoke(a.id)}
+                      disabled={busy || busyId === a.id}
+                      aria-label="Revoke"
+                    >
+                      <TrashIcon className="h-4 w-4" />
+                    </Button>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
+
+          <div className="space-y-2 border-t border-border/50 pt-4">
+            <Label className="text-xs">Grant a role</Label>
+            <div className="grid grid-cols-1 sm:grid-cols-2 gap-2">
+              <Select
+                value={pickRoleId ?? ''}
+                onValueChange={(v) => setPickRoleId(v ? (v as RoleId) : null)}
+                disabled={busy || rolesQuery.isLoading}
+              >
+                <SelectTrigger>
+                  <SelectValue placeholder="Pick a role" />
+                </SelectTrigger>
+                <SelectContent>
+                  {roles.map((r) => (
+                    <SelectItem key={r.id} value={r.id}>
+                      {r.name}
+                      <span className="ml-2 text-[10px] text-muted-foreground font-mono">
+                        {r.key}
+                      </span>
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+              <TeamPicker
+                value={pickTeamId}
+                onValueChange={setPickTeamId}
+                placeholder="Workspace-wide (no team)"
+                allowClear
+                disabled={busy}
+              />
+            </div>
+            <div className="flex justify-end">
+              <Button size="sm" onClick={handleGrant} disabled={busy || !pickRoleId}>
+                {granting ? 'Granting…' : 'Grant role'}
+              </Button>
+            </div>
+          </div>
+
+          {error && <p className="text-sm text-destructive">{error}</p>}
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/team/member-actions.tsx b/apps/web/src/components/admin/settings/team/member-actions.tsx
index 71f519280..ba418067a 100644
--- a/apps/web/src/components/admin/settings/team/member-actions.tsx
+++ b/apps/web/src/components/admin/settings/team/member-actions.tsx
@@ -11,6 +11,7 @@ import {
   UserMinusIcon,
   ArrowRightOnRectangleIcon,
 } from '@heroicons/react/24/solid'
+import { KeyIcon } from '@heroicons/react/24/outline'
 import { Button } from '@/components/ui/button'
 import {
   DropdownMenu,
@@ -20,6 +21,8 @@ import {
   DropdownMenuTrigger,
 } from '@/components/ui/dropdown-menu'
 import { ConfirmDialog } from '@/components/shared/confirm-dialog'
+import { ManagePrincipalRolesDialog } from './manage-principal-roles-dialog'
+import type { PrincipalId } from '@quackback/ids'
 import {
   updateMemberRoleFn,
   removeTeamMemberFn,
@@ -46,6 +49,7 @@ export function MemberActions({
   const [isLoading, setIsLoading] = useState(false)
   const [roleDialogOpen, setRoleDialogOpen] = useState(false)
   const [removeDialogOpen, setRemoveDialogOpen] = useState(false)
+  const [manageRolesOpen, setManageRolesOpen] = useState(false)
   const [resetTfaDialogOpen, setResetTfaDialogOpen] = useState(false)
   const [forceSignOutDialogOpen, setForceSignOutDialogOpen] = useState(false)
 
@@ -142,6 +146,10 @@ export function MemberActions({
               </>
             )}
           </DropdownMenuItem>
+          <DropdownMenuItem onClick={() => setManageRolesOpen(true)} className="gap-2">
+            <KeyIcon className="h-4 w-4" />
+            Manage roles
+          </DropdownMenuItem>
           {userId ? (
             <DropdownMenuItem onClick={() => setResetTfaDialogOpen(true)} className="gap-2">
               <ShieldExclamationIcon className="h-4 w-4" />
@@ -208,6 +216,13 @@ export function MemberActions({
         onConfirm={handleRemove}
       />
 
+      <ManagePrincipalRolesDialog
+        open={manageRolesOpen}
+        onOpenChange={setManageRolesOpen}
+        principalId={principalId as PrincipalId}
+        principalName={memberName}
+      />
+
       <ConfirmDialog
         open={resetTfaDialogOpen}
         onOpenChange={setResetTfaDialogOpen}
diff --git a/apps/web/src/components/admin/settings/teams/__tests__/team-create-dialog.test.tsx b/apps/web/src/components/admin/settings/teams/__tests__/team-create-dialog.test.tsx
new file mode 100644
index 000000000..833f04265
--- /dev/null
+++ b/apps/web/src/components/admin/settings/teams/__tests__/team-create-dialog.test.tsx
@@ -0,0 +1,210 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { TeamCreateDialog } from '../team-create-dialog'
+
+type MutationOptions<T> = {
+  mutationFn: () => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  createTeamFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  navigate: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({
+    navigate: mocks.navigate,
+  }),
+}))
+
+vi.mock('@/lib/server/functions/teams', () => ({
+  createTeamFn: mocks.createTeamFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string
+    type?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLInputElement>) => void
+    required?: boolean
+    maxLength?: number
+    placeholder?: string
+    className?: string
+  }) => <input id={id} type={type} value={value} onChange={onChange} placeholder={placeholder} />,
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+    rows,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLTextAreaElement>) => void
+    rows?: number
+    maxLength?: number
+  }) => <textarea id={id} value={value} onChange={onChange} rows={rows} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({
+    children,
+  }: {
+    children: ReactNode
+    open?: boolean
+    onOpenChange?: (open: boolean) => void
+  }) => <div>{children}</div>,
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section>{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+  DialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createTeamFn.mockResolvedValue({ id: 'team_created' })
+})
+
+describe('TeamCreateDialog', () => {
+  it('requires slug and name and validates the slug format before creating', () => {
+    render(<TeamCreateDialog trigger={<button type="button">Open</button>} />)
+
+    fireEvent.submit(screen.getByRole('button', { name: 'Create team' }).closest('form')!)
+    expect(mocks.toastError).toHaveBeenCalledWith('Slug and name are required')
+
+    fireEvent.change(screen.getByLabelText('Slug'), { target: { value: 'sales_team' } })
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Sales' } })
+    fireEvent.submit(screen.getByRole('button', { name: 'Create team' }).closest('form')!)
+
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      'Slug must be lowercase letters, numbers, or hyphens'
+    )
+    expect(mocks.createTeamFn).not.toHaveBeenCalled()
+  })
+
+  it('normalizes slug input, submits trimmed optional fields and navigates on success', async () => {
+    render(<TeamCreateDialog trigger={<button type="button">Open</button>} />)
+
+    fireEvent.change(screen.getByLabelText('Slug'), { target: { value: 'Tier-1' } })
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Tier 1  ' } })
+    fireEvent.change(screen.getByLabelText('Description'), { target: { value: '  First line  ' } })
+    fireEvent.change(screen.getByLabelText('Short label'), { target: { value: '  T1  ' } })
+    fireEvent.change(screen.getByPlaceholderText('#6366f1'), { target: { value: '  #22c55e  ' } })
+    fireEvent.submit(screen.getByRole('button', { name: 'Create team' }).closest('form')!)
+
+    await waitFor(() => {
+      expect(mocks.createTeamFn).toHaveBeenCalledWith({
+        data: {
+          slug: 'tier-1',
+          name: 'Tier 1',
+          description: 'First line',
+          shortLabel: 'T1',
+          color: '#22c55e',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['teams'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Team created')
+    expect(mocks.navigate).toHaveBeenCalledWith({
+      to: '/admin/settings/teams/$teamId',
+      params: { teamId: 'team_created' },
+    })
+    expect(screen.getByLabelText('Slug')).toHaveValue('')
+    expect(screen.getByLabelText('Description')).toHaveValue('')
+  })
+
+  it('turns empty optional values into null and reports create failures', async () => {
+    mocks.createTeamFn.mockRejectedValueOnce(new Error('Duplicate team'))
+    render(<TeamCreateDialog trigger={<button type="button">Open</button>} />)
+
+    fireEvent.change(screen.getByLabelText('Slug'), { target: { value: 'support' } })
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Support' } })
+    fireEvent.change(screen.getByLabelText('Description'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Short label'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByPlaceholderText('#6366f1'), { target: { value: '   ' } })
+    fireEvent.submit(screen.getByRole('button', { name: 'Create team' }).closest('form')!)
+
+    await waitFor(() => {
+      expect(mocks.createTeamFn).toHaveBeenCalledWith({
+        data: {
+          slug: 'support',
+          name: 'Support',
+          description: null,
+          shortLabel: null,
+          color: null,
+        },
+      })
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith('Duplicate team')
+    expect(mocks.navigate).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/teams/__tests__/team-list.test.tsx b/apps/web/src/components/admin/settings/teams/__tests__/team-list.test.tsx
new file mode 100644
index 000000000..d47ecc18d
--- /dev/null
+++ b/apps/web/src/components/admin/settings/teams/__tests__/team-list.test.tsx
@@ -0,0 +1,158 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import type { TeamId } from '@quackback/ids'
+import { TeamList } from '../team-list'
+
+type TeamRow = {
+  id: TeamId
+  name: string
+  slug: string
+  shortLabel: string | null
+  color: string | null
+  archivedAt: string | null
+}
+
+const mocks = vi.hoisted(() => ({
+  teams: [] as TeamRow[],
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: () => ({
+    data: mocks.teams,
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    to,
+    params,
+  }: {
+    children: ReactNode
+    to: string
+    params?: Record<string, string>
+    className?: string
+  }) => (
+    <a
+      href={Object.entries(params ?? {}).reduce(
+        (path, [key, value]) => path.replace(`$${key}`, value),
+        to
+      )}
+    >
+      {children}
+    </a>
+  ),
+}))
+
+vi.mock('@/lib/client/queries/teams', () => ({
+  teamQueries: {
+    list: (params: unknown) => ({ queryKey: ['teams', params] }),
+  },
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    className?: string
+  }) => <td colSpan={colSpan}>{children}</td>,
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode; className?: string }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+  }) => (
+    <input
+      id={id}
+      type="checkbox"
+      checked={checked}
+      onChange={(event) => onCheckedChange(event.currentTarget.checked)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span>{children}</span>
+  ),
+}))
+
+function team(overrides: Partial<TeamRow> = {}): TeamRow {
+  return {
+    id: 'team_1' as TeamId,
+    name: 'Support',
+    slug: 'support',
+    shortLabel: 'SUP',
+    color: '#2563eb',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  mocks.teams = [
+    team(),
+    team({
+      id: 'team_archived' as TeamId,
+      name: 'Legacy',
+      slug: 'legacy',
+      shortLabel: null,
+      color: null,
+      archivedAt: '2026-06-20T10:00:00.000Z',
+    }),
+  ]
+})
+
+describe('TeamList', () => {
+  it('renders active teams by default and reveals archived teams', () => {
+    render(<TeamList />)
+
+    expect(screen.getByRole('link', { name: /Support/ })).toHaveAttribute(
+      'href',
+      '/admin/settings/teams/team_1'
+    )
+    expect(screen.getByText('support')).toBeInTheDocument()
+    expect(screen.getByText('SUP')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.queryByText('Legacy')).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getByLabelText('Show archived'))
+
+    expect(screen.getByRole('link', { name: /Legacy/ })).toHaveAttribute(
+      'href',
+      '/admin/settings/teams/team_archived'
+    )
+    expect(screen.getByText('legacy')).toBeInTheDocument()
+    expect(screen.getByText('—')).toBeInTheDocument()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+  })
+
+  it('renders an empty state when there are no visible teams', () => {
+    mocks.teams = []
+    render(<TeamList />)
+
+    expect(screen.getByText('No teams yet. Create your first team.')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/teams/__tests__/team-overview-tab.test.tsx b/apps/web/src/components/admin/settings/teams/__tests__/team-overview-tab.test.tsx
new file mode 100644
index 000000000..4dd62ba74
--- /dev/null
+++ b/apps/web/src/components/admin/settings/teams/__tests__/team-overview-tab.test.tsx
@@ -0,0 +1,306 @@
+// @vitest-environment happy-dom
+import type { ChangeEvent, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { TeamOverviewTab } from '../team-overview-tab'
+
+type TeamProp = Parameters<typeof TeamOverviewTab>[0]['team']
+
+type MutationOptions<T> = {
+  mutationFn: () => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  updateTeamFn: vi.fn(),
+  archiveTeamFn: vi.fn(),
+  unarchiveTeamFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  permissionAllowed: true,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({
+    children,
+    fallback = null,
+  }: {
+    children: ReactNode
+    fallback?: ReactNode
+    permission: string
+  }) => (mocks.permissionAllowed ? <>{children}</> : <>{fallback}</>),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    type = 'text',
+    value,
+    onChange,
+    disabled,
+    readOnly,
+    placeholder,
+  }: {
+    id?: string
+    type?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLInputElement>) => void
+    disabled?: boolean
+    readOnly?: boolean
+    required?: boolean
+    maxLength?: number
+    placeholder?: string
+    className?: string
+  }) => (
+    <input
+      id={id}
+      type={type}
+      value={value}
+      onChange={onChange}
+      disabled={disabled}
+      readOnly={readOnly}
+      placeholder={placeholder}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/textarea', () => ({
+  Textarea: ({
+    id,
+    value,
+    onChange,
+    rows,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: ChangeEvent<HTMLTextAreaElement>) => void
+    rows?: number
+    maxLength?: number
+  }) => <textarea id={id} value={value} onChange={onChange} rows={rows} />,
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+    <button type="button">{children}</button>
+  ),
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <section>{children}</section>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
+  AlertDialogTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+}))
+
+vi.mock('@/lib/server/functions/teams', () => ({
+  updateTeamFn: mocks.updateTeamFn,
+  archiveTeamFn: mocks.archiveTeamFn,
+  unarchiveTeamFn: mocks.unarchiveTeamFn,
+}))
+
+vi.mock('@/lib/client/queries/teams', () => ({
+  teamQueries: {
+    detail: (teamId: string) => ({ queryKey: ['teams', 'detail', teamId] }),
+  },
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ADMIN_MANAGE_USERS: 'admin.manage_users',
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function team(overrides: Partial<TeamProp> = {}): TeamProp {
+  return {
+    id: 'team_support',
+    slug: 'support',
+    name: 'Support',
+    description: 'Handles tickets',
+    shortLabel: 'SUP',
+    color: '#22c55e',
+    archivedAt: null,
+    ...overrides,
+  } as TeamProp
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.permissionAllowed = true
+  mocks.updateTeamFn.mockResolvedValue({ id: 'team_support' })
+  mocks.archiveTeamFn.mockResolvedValue({ id: 'team_support' })
+  mocks.unarchiveTeamFn.mockResolvedValue({ id: 'team_support' })
+})
+
+describe('TeamOverviewTab', () => {
+  it('saves trimmed team fields, invalidates detail/list queries and shows success', async () => {
+    render(<TeamOverviewTab team={team()} />)
+
+    expect(screen.getByDisplayValue('support')).toBeDisabled()
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '  Success  ' } })
+    fireEvent.change(screen.getByLabelText('Description'), { target: { value: '   ' } })
+    fireEvent.change(screen.getByLabelText('Short label'), { target: { value: '  CS  ' } })
+    fireEvent.change(screen.getByPlaceholderText('#6366f1'), { target: { value: '  #6366f1  ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateTeamFn).toHaveBeenCalledWith({
+        data: {
+          teamId: 'team_support',
+          name: 'Success',
+          description: null,
+          shortLabel: 'CS',
+          color: '#6366f1',
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['teams', 'detail', 'team_support'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['teams'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Team updated')
+  })
+
+  it('validates name and reports save failures', async () => {
+    render(<TeamOverviewTab team={team()} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: '   ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    expect(mocks.toastError).toHaveBeenCalledWith('Name is required')
+    expect(mocks.updateTeamFn).not.toHaveBeenCalled()
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Support' } })
+    mocks.updateTeamFn.mockRejectedValueOnce(new Error('Duplicate team'))
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Duplicate team')
+    })
+  })
+
+  it('resets editable fields when the team prop changes', () => {
+    const { rerender } = render(<TeamOverviewTab team={team()} />)
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Unsaved' } })
+    expect(screen.getByLabelText('Name')).toHaveValue('Unsaved')
+
+    rerender(
+      <TeamOverviewTab
+        team={team({
+          id: 'team_sales',
+          slug: 'sales',
+          name: 'Sales',
+          description: null,
+          shortLabel: null,
+          color: null,
+        })}
+      />
+    )
+
+    expect(screen.getByDisplayValue('sales')).toBeDisabled()
+    expect(screen.getByLabelText('Name')).toHaveValue('Sales')
+    expect(screen.getByLabelText('Description')).toHaveValue('')
+    expect(screen.getByLabelText('Short label')).toHaveValue('')
+    expect(screen.getByLabelText('Color')).toHaveValue('#6366f1')
+  })
+
+  it('archives and unarchives teams and reports archive failures', async () => {
+    const { rerender } = render(<TeamOverviewTab team={team()} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Archive' }))
+    await waitFor(() => {
+      expect(mocks.archiveTeamFn).toHaveBeenCalledWith({
+        data: { teamId: 'team_support' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Team archived')
+
+    mocks.archiveTeamFn.mockRejectedValueOnce(new Error('Archive denied'))
+    fireEvent.click(screen.getByRole('button', { name: 'Archive' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Archive denied')
+    })
+
+    rerender(<TeamOverviewTab team={team({ archivedAt: new Date('2026-06-01T00:00:00.000Z') })} />)
+    fireEvent.click(screen.getByRole('button', { name: 'Unarchive team' }))
+    await waitFor(() => {
+      expect(mocks.unarchiveTeamFn).toHaveBeenCalledWith({
+        data: { teamId: 'team_support' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Team unarchived')
+
+    mocks.unarchiveTeamFn.mockRejectedValueOnce(new Error('Unarchive denied'))
+    fireEvent.click(screen.getByRole('button', { name: 'Unarchive team' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Unarchive denied')
+    })
+  })
+
+  it('hides mutation controls when user management permission is denied', () => {
+    mocks.permissionAllowed = false
+
+    render(<TeamOverviewTab team={team()} />)
+
+    expect(screen.queryByRole('button', { name: 'Save changes' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Archive team' })).not.toBeInTheDocument()
+    expect(screen.getByLabelText('Name')).toHaveValue('Support')
+  })
+})
diff --git a/apps/web/src/components/admin/settings/teams/team-create-dialog.tsx b/apps/web/src/components/admin/settings/teams/team-create-dialog.tsx
new file mode 100644
index 000000000..8f5dbc39f
--- /dev/null
+++ b/apps/web/src/components/admin/settings/teams/team-create-dialog.tsx
@@ -0,0 +1,183 @@
+/**
+ * Create-team dialog. slug + name + optional description/shortLabel/color.
+ * On success navigates to the team detail page.
+ */
+import { useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import type { TeamId } from '@quackback/ids'
+import { createTeamFn } from '@/lib/server/functions/teams'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@/components/ui/dialog'
+
+const SLUG_RE = /^[a-z0-9-]+$/
+
+export function TeamCreateDialog({ trigger }: { trigger: React.ReactNode }) {
+  const [open, setOpen] = useState(false)
+  const router = useRouter()
+  const qc = useQueryClient()
+
+  const [slug, setSlug] = useState('')
+  const [name, setName] = useState('')
+  const [description, setDescription] = useState('')
+  const [shortLabel, setShortLabel] = useState('')
+  const [color, setColor] = useState('')
+
+  const reset = () => {
+    setSlug('')
+    setName('')
+    setDescription('')
+    setShortLabel('')
+    setColor('')
+  }
+
+  const mutation = useMutation({
+    mutationFn: () =>
+      createTeamFn({
+        data: {
+          slug: slug.trim(),
+          name: name.trim(),
+          description: description.trim() || null,
+          shortLabel: shortLabel.trim() || null,
+          color: color.trim() || null,
+        },
+      }),
+    onSuccess: (team) => {
+      qc.invalidateQueries({ queryKey: ['teams'] })
+      toast.success('Team created')
+      setOpen(false)
+      reset()
+      router.navigate({
+        to: '/admin/settings/teams/$teamId',
+        params: { teamId: team.id as TeamId },
+      })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <Dialog open={open} onOpenChange={setOpen}>
+      <DialogTrigger asChild>{trigger}</DialogTrigger>
+      <DialogContent className="max-w-lg">
+        <DialogHeader>
+          <DialogTitle>New team</DialogTitle>
+          <DialogDescription>
+            Workspace teams group agents for routing, sharing, and SLA scopes.
+          </DialogDescription>
+        </DialogHeader>
+
+        <form
+          onSubmit={(e) => {
+            e.preventDefault()
+            const slugTrim = slug.trim()
+            if (!slugTrim || !name.trim()) {
+              toast.error('Slug and name are required')
+              return
+            }
+            if (!SLUG_RE.test(slugTrim)) {
+              toast.error('Slug must be lowercase letters, numbers, or hyphens')
+              return
+            }
+            mutation.mutate()
+          }}
+          className="space-y-3"
+        >
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-1">
+              <Label htmlFor="team-slug">Slug</Label>
+              <Input
+                id="team-slug"
+                value={slug}
+                onChange={(e) => setSlug(e.target.value.toLowerCase())}
+                placeholder="tier-1"
+                required
+                maxLength={64}
+              />
+            </div>
+            <div className="space-y-1">
+              <Label htmlFor="team-name">Name</Label>
+              <Input
+                id="team-name"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                placeholder="Tier 1 support"
+                required
+                maxLength={120}
+              />
+            </div>
+          </div>
+
+          <div className="space-y-1">
+            <Label htmlFor="team-description">Description</Label>
+            <Textarea
+              id="team-description"
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+              rows={2}
+              maxLength={500}
+            />
+          </div>
+
+          <div className="grid grid-cols-2 gap-3">
+            <div className="space-y-1">
+              <Label htmlFor="team-short-label">Short label</Label>
+              <Input
+                id="team-short-label"
+                value={shortLabel}
+                onChange={(e) => setShortLabel(e.target.value)}
+                placeholder="T1"
+                maxLength={8}
+              />
+              <p className="text-[11px] text-muted-foreground">Up to 8 chars. Optional.</p>
+            </div>
+            <div className="space-y-1">
+              <Label htmlFor="team-color">Color</Label>
+              <div className="flex items-center gap-2">
+                <Input
+                  id="team-color"
+                  type="color"
+                  value={color || '#6366f1'}
+                  onChange={(e) => setColor(e.target.value)}
+                  className="h-9 w-12 p-1"
+                />
+                <Input
+                  value={color}
+                  onChange={(e) => setColor(e.target.value)}
+                  placeholder="#6366f1"
+                  maxLength={16}
+                  className="font-mono text-xs"
+                />
+              </div>
+            </div>
+          </div>
+
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="outline"
+              onClick={() => setOpen(false)}
+              disabled={mutation.isPending}
+            >
+              Cancel
+            </Button>
+            <Button type="submit" disabled={mutation.isPending}>
+              Create team
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/teams/team-list.tsx b/apps/web/src/components/admin/settings/teams/team-list.tsx
new file mode 100644
index 000000000..6216d7448
--- /dev/null
+++ b/apps/web/src/components/admin/settings/teams/team-list.tsx
@@ -0,0 +1,109 @@
+/**
+ * `<TeamList />` — table of workspace teams with name, slug, short label chip,
+ * and active/archived status. Show-archived toggle.
+ */
+import { useState, useMemo } from 'react'
+import { Link } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { TeamId } from '@quackback/ids'
+import { teamQueries } from '@/lib/client/queries/teams'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+import { Switch } from '@/components/ui/switch'
+import { Label } from '@/components/ui/label'
+
+export function TeamList() {
+  const [showArchived, setShowArchived] = useState(false)
+  const { data: teams } = useSuspenseQuery(teamQueries.list({ includeArchived: true }))
+
+  const rows = useMemo(
+    () => (showArchived ? teams : teams.filter((t) => t.archivedAt == null)),
+    [teams, showArchived]
+  )
+
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center justify-end gap-2">
+        <Switch id="show-archived-teams" checked={showArchived} onCheckedChange={setShowArchived} />
+        <Label htmlFor="show-archived-teams" className="text-xs font-normal">
+          Show archived
+        </Label>
+      </div>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead>Slug</TableHead>
+              <TableHead className="w-32">Short label</TableHead>
+              <TableHead className="w-24">Status</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {rows.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={4} className="text-center text-sm text-muted-foreground py-6">
+                  No teams yet. Create your first team.
+                </TableCell>
+              </TableRow>
+            ) : (
+              rows.map((team) => (
+                <TableRow key={team.id} className="cursor-pointer hover:bg-muted/50">
+                  <TableCell className="font-medium">
+                    <Link
+                      to="/admin/settings/teams/$teamId"
+                      params={{ teamId: team.id as TeamId }}
+                      className="flex items-center gap-2"
+                    >
+                      <span
+                        className="inline-block h-2.5 w-2.5 rounded-sm border border-border/50"
+                        style={{ backgroundColor: team.color ?? 'transparent' }}
+                        aria-hidden
+                      />
+                      <span className="truncate">{team.name}</span>
+                    </Link>
+                  </TableCell>
+                  <TableCell className="font-mono text-xs text-muted-foreground">
+                    {team.slug}
+                  </TableCell>
+                  <TableCell>
+                    {team.shortLabel ? (
+                      <span
+                        className="inline-flex items-center rounded px-1.5 py-0.5 text-[10px] font-medium"
+                        style={{
+                          backgroundColor: team.color ?? 'var(--muted)',
+                          color: team.color ? '#fff' : undefined,
+                        }}
+                      >
+                        {team.shortLabel}
+                      </span>
+                    ) : (
+                      <span className="text-xs text-muted-foreground">—</span>
+                    )}
+                  </TableCell>
+                  <TableCell>
+                    {team.archivedAt ? (
+                      <Badge variant="outline" className="text-muted-foreground">
+                        Archived
+                      </Badge>
+                    ) : (
+                      <Badge variant="outline">Active</Badge>
+                    )}
+                  </TableCell>
+                </TableRow>
+              ))
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/teams/team-members-tab.tsx b/apps/web/src/components/admin/settings/teams/team-members-tab.tsx
new file mode 100644
index 000000000..ffc91532e
--- /dev/null
+++ b/apps/web/src/components/admin/settings/teams/team-members-tab.tsx
@@ -0,0 +1,264 @@
+/**
+ * Members tab for a team detail page. Lists current memberships enriched via
+ * `getPrincipalsByIdsFn`, with inline role select (re-uses upsert
+ * `addTeamMemberFn`) and remove action. Add row uses `<PrincipalPicker>`
+ * filtered by current member ids.
+ */
+import { useState, useMemo } from 'react'
+import { useSuspenseQuery, useMutation, useQueryClient, useQuery } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { TeamId, PrincipalId } from '@quackback/ids'
+import { addTeamMemberFn, removeTeamMemberFn } from '@/lib/server/functions/teams'
+import { getPrincipalsByIdsFn } from '@/lib/server/functions/principals'
+import { teamQueries } from '@/lib/client/queries/teams'
+import { Button } from '@/components/ui/button'
+import { Avatar } from '@/components/ui/avatar'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { TrashIcon } from '@heroicons/react/24/outline'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const ROLES = ['lead', 'member'] as const
+type MemberRole = (typeof ROLES)[number]
+
+export function TeamMembersTab({ teamId }: { teamId: TeamId }) {
+  const qc = useQueryClient()
+  const { data: memberships } = useSuspenseQuery(teamQueries.members(teamId))
+
+  const principalIds = useMemo(
+    () => memberships.map((m) => m.principalId as PrincipalId),
+    [memberships]
+  )
+
+  const principalsQuery = useQuery({
+    queryKey: ['principals', 'byIds', principalIds],
+    queryFn: () => getPrincipalsByIdsFn({ data: { ids: principalIds } }),
+    enabled: principalIds.length > 0,
+    staleTime: 60_000,
+  })
+  const principalMap = useMemo(() => {
+    const m = new Map<string, { displayName: string | null; avatarUrl: string | null }>()
+    for (const p of principalsQuery.data ?? []) {
+      m.set(p.id, { displayName: p.displayName, avatarUrl: p.avatarUrl })
+    }
+    return m
+  }, [principalsQuery.data])
+
+  const [addPrincipalId, setAddPrincipalId] = useState<PrincipalId | null>(null)
+  const [addRole, setAddRole] = useState<MemberRole>('member')
+
+  const invalidate = () => qc.invalidateQueries({ queryKey: teamQueries.members(teamId).queryKey })
+
+  const addMutation = useMutation({
+    mutationFn: () =>
+      addTeamMemberFn({
+        data: { teamId, principalId: addPrincipalId!, role: addRole },
+      }),
+    onSuccess: () => {
+      setAddPrincipalId(null)
+      setAddRole('member')
+      invalidate()
+      toast.success('Member added')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  // Role-change reuses addTeamMemberFn (backend is upsert).
+  const updateRoleMutation = useMutation({
+    mutationFn: (vars: { principalId: PrincipalId; role: MemberRole }) =>
+      addTeamMemberFn({
+        data: { teamId, principalId: vars.principalId, role: vars.role },
+      }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Role updated')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const removeMutation = useMutation({
+    mutationFn: (principalId: PrincipalId) => removeTeamMemberFn({ data: { teamId, principalId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Member removed')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-4 max-w-3xl">
+      <div>
+        <h2 className="text-sm font-semibold">Members</h2>
+        <p className="text-xs text-muted-foreground">
+          Principals belonging to this team. Leads can be referenced by routing rules and SLA
+          recipients.
+        </p>
+      </div>
+
+      <PermissionGate permission={PERMISSIONS.ADMIN_MANAGE_USERS}>
+        <div className="rounded border border-border/50 p-3 space-y-2">
+          <div className="grid grid-cols-[1fr,140px,auto] gap-2 items-end">
+            <div className="space-y-1">
+              <label className="text-xs font-medium text-muted-foreground">Add member</label>
+              <PrincipalPicker
+                value={addPrincipalId}
+                onValueChange={setAddPrincipalId}
+                excludeIds={principalIds}
+                placeholder="Pick principal…"
+              />
+            </div>
+            <div className="space-y-1">
+              <label className="text-xs font-medium text-muted-foreground">Role</label>
+              <Select value={addRole} onValueChange={(v) => setAddRole(v as MemberRole)}>
+                <SelectTrigger>
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {ROLES.map((r) => (
+                    <SelectItem key={r} value={r}>
+                      {r}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <Button
+              size="sm"
+              disabled={!addPrincipalId || addMutation.isPending}
+              onClick={() => addMutation.mutate()}
+            >
+              Add
+            </Button>
+          </div>
+        </div>
+      </PermissionGate>
+
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Member</TableHead>
+              <TableHead className="w-32">Role</TableHead>
+              <TableHead className="w-12" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {memberships.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={3} className="text-center text-sm text-muted-foreground py-6">
+                  No members yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              memberships.map((m) => {
+                const info = principalMap.get(m.principalId)
+                const label = info?.displayName ?? m.principalId
+                return (
+                  <TableRow key={m.id}>
+                    <TableCell>
+                      <div className="flex items-center gap-2">
+                        <Avatar className="h-6 w-6 text-[10px]">
+                          {info?.avatarUrl ? (
+                            <img src={info.avatarUrl} alt="" />
+                          ) : (
+                            label.slice(0, 2).toUpperCase()
+                          )}
+                        </Avatar>
+                        <span className="text-sm">{label}</span>
+                      </div>
+                    </TableCell>
+                    <TableCell>
+                      <PermissionGate
+                        permission={PERMISSIONS.ADMIN_MANAGE_USERS}
+                        fallback={<span className="text-xs text-muted-foreground">{m.role}</span>}
+                      >
+                        <Select
+                          value={m.role}
+                          onValueChange={(v) =>
+                            updateRoleMutation.mutate({
+                              principalId: m.principalId as PrincipalId,
+                              role: v as MemberRole,
+                            })
+                          }
+                        >
+                          <SelectTrigger className="h-7 text-xs">
+                            <SelectValue />
+                          </SelectTrigger>
+                          <SelectContent>
+                            {ROLES.map((r) => (
+                              <SelectItem key={r} value={r}>
+                                {r}
+                              </SelectItem>
+                            ))}
+                          </SelectContent>
+                        </Select>
+                      </PermissionGate>
+                    </TableCell>
+                    <TableCell>
+                      <PermissionGate permission={PERMISSIONS.ADMIN_MANAGE_USERS}>
+                        <AlertDialog>
+                          <AlertDialogTrigger asChild>
+                            <Button
+                              variant="ghost"
+                              size="sm"
+                              className="h-7 w-7 p-0"
+                              aria-label="Remove member"
+                            >
+                              <TrashIcon className="h-3.5 w-3.5" />
+                            </Button>
+                          </AlertDialogTrigger>
+                          <AlertDialogContent>
+                            <AlertDialogHeader>
+                              <AlertDialogTitle>Remove member?</AlertDialogTitle>
+                              <AlertDialogDescription>
+                                They will be removed from this team.
+                              </AlertDialogDescription>
+                            </AlertDialogHeader>
+                            <AlertDialogFooter>
+                              <AlertDialogCancel>Cancel</AlertDialogCancel>
+                              <AlertDialogAction
+                                onClick={() => removeMutation.mutate(m.principalId as PrincipalId)}
+                              >
+                                Remove
+                              </AlertDialogAction>
+                            </AlertDialogFooter>
+                          </AlertDialogContent>
+                        </AlertDialog>
+                      </PermissionGate>
+                    </TableCell>
+                  </TableRow>
+                )
+              })
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/teams/team-overview-tab.tsx b/apps/web/src/components/admin/settings/teams/team-overview-tab.tsx
new file mode 100644
index 000000000..ce8d5b20e
--- /dev/null
+++ b/apps/web/src/components/admin/settings/teams/team-overview-tab.tsx
@@ -0,0 +1,209 @@
+/**
+ * Overview tab for a team detail page. Editable form for name/description/
+ * shortLabel/color plus an Archive / Unarchive section. Slug is read-only
+ * because `updateTeamFn` does not accept it.
+ */
+import { useState, useEffect } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import type { Team } from '@/lib/shared/db-types'
+import { updateTeamFn, archiveTeamFn, unarchiveTeamFn } from '@/lib/server/functions/teams'
+import { teamQueries } from '@/lib/client/queries/teams'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Textarea } from '@/components/ui/textarea'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export function TeamOverviewTab({ team }: { team: Team }) {
+  const qc = useQueryClient()
+  const [name, setName] = useState(team.name)
+  const [description, setDescription] = useState(team.description ?? '')
+  const [shortLabel, setShortLabel] = useState(team.shortLabel ?? '')
+  const [color, setColor] = useState(team.color ?? '')
+
+  useEffect(() => {
+    setName(team.name)
+    setDescription(team.description ?? '')
+    setShortLabel(team.shortLabel ?? '')
+    setColor(team.color ?? '')
+  }, [team])
+
+  const invalidate = () => {
+    qc.invalidateQueries({ queryKey: teamQueries.detail(team.id).queryKey })
+    qc.invalidateQueries({ queryKey: ['teams'] })
+  }
+
+  const saveMutation = useMutation({
+    mutationFn: () =>
+      updateTeamFn({
+        data: {
+          teamId: team.id,
+          name: name.trim(),
+          description: description.trim() || null,
+          shortLabel: shortLabel.trim() || null,
+          color: color.trim() || null,
+        },
+      }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Team updated')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const archiveMutation = useMutation({
+    mutationFn: () => archiveTeamFn({ data: { teamId: team.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Team archived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const unarchiveMutation = useMutation({
+    mutationFn: () => unarchiveTeamFn({ data: { teamId: team.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Team unarchived')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-6 max-w-2xl">
+      <form
+        onSubmit={(e) => {
+          e.preventDefault()
+          if (!name.trim()) {
+            toast.error('Name is required')
+            return
+          }
+          saveMutation.mutate()
+        }}
+        className="space-y-3"
+      >
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-1">
+            <Label>Slug</Label>
+            <Input value={team.slug} disabled readOnly className="font-mono text-xs" />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="team-name">Name</Label>
+            <Input
+              id="team-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              required
+              maxLength={120}
+            />
+          </div>
+        </div>
+
+        <div className="space-y-1">
+          <Label htmlFor="team-description">Description</Label>
+          <Textarea
+            id="team-description"
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+            rows={2}
+            maxLength={500}
+          />
+        </div>
+
+        <div className="grid grid-cols-2 gap-3">
+          <div className="space-y-1">
+            <Label htmlFor="team-short-label">Short label</Label>
+            <Input
+              id="team-short-label"
+              value={shortLabel}
+              onChange={(e) => setShortLabel(e.target.value)}
+              maxLength={8}
+              placeholder="T1"
+            />
+          </div>
+          <div className="space-y-1">
+            <Label htmlFor="team-color">Color</Label>
+            <div className="flex items-center gap-2">
+              <Input
+                id="team-color"
+                type="color"
+                value={color || '#6366f1'}
+                onChange={(e) => setColor(e.target.value)}
+                className="h-9 w-12 p-1"
+              />
+              <Input
+                value={color}
+                onChange={(e) => setColor(e.target.value)}
+                placeholder="#6366f1"
+                maxLength={16}
+                className="font-mono text-xs"
+              />
+            </div>
+          </div>
+        </div>
+
+        <PermissionGate permission={PERMISSIONS.ADMIN_MANAGE_USERS}>
+          <div className="flex justify-end">
+            <Button type="submit" disabled={saveMutation.isPending}>
+              Save changes
+            </Button>
+          </div>
+        </PermissionGate>
+      </form>
+
+      <PermissionGate permission={PERMISSIONS.ADMIN_MANAGE_USERS}>
+        <div className="rounded-md border border-border/50 p-4 space-y-2">
+          <div className="text-sm font-medium">Archive</div>
+          <p className="text-xs text-muted-foreground">
+            Archived teams are hidden from pickers but historical references remain intact.
+          </p>
+          {team.archivedAt ? (
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => unarchiveMutation.mutate()}
+              disabled={unarchiveMutation.isPending}
+            >
+              Unarchive team
+            </Button>
+          ) : (
+            <AlertDialog>
+              <AlertDialogTrigger asChild>
+                <Button variant="outline" size="sm">
+                  Archive team
+                </Button>
+              </AlertDialogTrigger>
+              <AlertDialogContent>
+                <AlertDialogHeader>
+                  <AlertDialogTitle>Archive {team.name}?</AlertDialogTitle>
+                  <AlertDialogDescription>
+                    The team will be hidden from pickers. You can unarchive it later.
+                  </AlertDialogDescription>
+                </AlertDialogHeader>
+                <AlertDialogFooter>
+                  <AlertDialogCancel>Cancel</AlertDialogCancel>
+                  <AlertDialogAction onClick={() => archiveMutation.mutate()}>
+                    Archive
+                  </AlertDialogAction>
+                </AlertDialogFooter>
+              </AlertDialogContent>
+            </AlertDialog>
+          )}
+        </div>
+      </PermissionGate>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-deliveries-table.test.tsx b/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-deliveries-table.test.tsx
new file mode 100644
index 000000000..6b3c83ff6
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-deliveries-table.test.tsx
@@ -0,0 +1,227 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { WebhookDeliveriesTable } from '../webhook-deliveries-table'
+
+type Delivery = {
+  id: string
+  webhookId: string
+  eventId: string
+  eventType: string
+  attemptNumber: number
+  status: string
+  httpStatus: number | null
+  errorMessage: string | null
+  requestUrl: string
+  requestPayloadBytes: number
+  responseBodySnippet: string | null
+  latencyMs: number | null
+  signatureTimestamp: number
+  attemptedAt: string
+  nextRetryAt: string | null
+}
+
+const mocks = vi.hoisted(() => ({
+  fetchNextPage: vi.fn(),
+  pages: [] as Array<{ deliveries: Delivery[] }>,
+  hasNextPage: false,
+  isFetchingNextPage: false,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseInfiniteQuery: () => ({
+    data: { pages: mocks.pages },
+    hasNextPage: mocks.hasNextPage,
+    isFetchingNextPage: mocks.isFetchingNextPage,
+    fetchNextPage: mocks.fetchNextPage,
+  }),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children, variant }: { children: ReactNode; variant?: string; className?: string }) => (
+    <span data-variant={variant ?? 'default'}>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableCell: ({
+    children,
+    colSpan,
+    title,
+  }: {
+    children?: ReactNode
+    colSpan?: number
+    title?: string
+    className?: string
+  }) => (
+    <td colSpan={colSpan} title={title}>
+      {children}
+    </td>
+  ),
+  TableHead: ({ children }: { children?: ReactNode; className?: string }) => <th>{children}</th>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableRow: ({ children }: { children: ReactNode; className?: string }) => <tr>{children}</tr>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ChevronDownIcon: () => <span aria-hidden="true">down</span>,
+  ChevronRightIcon: () => <span aria-hidden="true">right</span>,
+}))
+
+vi.mock('@/lib/client/queries/webhook-deliveries', () => ({
+  webhookDeliveryQueries: {
+    list: (webhookId: string, filters: { status?: string }) => ({
+      queryKey: ['webhook-deliveries', webhookId, filters],
+    }),
+  },
+}))
+
+function delivery(overrides: Partial<Delivery>): Delivery {
+  return {
+    id: 'delivery_1',
+    webhookId: 'webhook_1',
+    eventId: 'event_1',
+    eventType: 'ticket.created',
+    attemptNumber: 1,
+    status: 'success',
+    httpStatus: 200,
+    errorMessage: null,
+    requestUrl: 'https://example.com/webhook',
+    requestPayloadBytes: 128,
+    responseBodySnippet: null,
+    latencyMs: 42,
+    signatureTimestamp: 1_718_707_200,
+    attemptedAt: '2026-06-18T12:00:00.000Z',
+    nextRetryAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.pages = []
+  mocks.hasNextPage = false
+  mocks.isFetchingNextPage = false
+})
+
+describe('WebhookDeliveriesTable', () => {
+  it('renders an empty delivery state and hidden pagination controls', () => {
+    render(<WebhookDeliveriesTable webhookId={'webhook_empty' as never} status="success" />)
+
+    expect(screen.getByText('No deliveries recorded for this webhook yet.')).toBeInTheDocument()
+    expect(screen.getByText('0 deliveries shown')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Load more' })).not.toBeInTheDocument()
+  })
+
+  it('renders all status pills and compact fallback values', () => {
+    mocks.pages = [
+      {
+        deliveries: [
+          delivery({ id: 'success', status: 'success', eventType: 'ticket.created' }),
+          delivery({
+            id: 'retrying',
+            status: 'failed_retryable',
+            eventType: 'ticket.updated',
+            httpStatus: null,
+            latencyMs: null,
+          }),
+          delivery({ id: 'terminal', status: 'failed_terminal', eventType: 'ticket.closed' }),
+          delivery({ id: 'blocked', status: 'blocked_ssrf', eventType: 'webhook.blocked' }),
+          delivery({ id: 'queued', status: 'queued', eventType: 'webhook.queued' }),
+          delivery({ id: 'custom', status: 'custom_state', eventType: 'webhook.custom' }),
+        ],
+      },
+    ]
+
+    render(<WebhookDeliveriesTable webhookId={'webhook_1' as never} />)
+
+    expect(screen.getByText('Success')).toBeInTheDocument()
+    expect(screen.getByText('Retrying')).toBeInTheDocument()
+    expect(screen.getByText('Failed')).toBeInTheDocument()
+    expect(screen.getByText('Blocked (SSRF)')).toBeInTheDocument()
+    expect(screen.getByText('Queued')).toBeInTheDocument()
+    expect(screen.getByText('custom_state')).toBeInTheDocument()
+    expect(screen.getByText('6 deliveries shown')).toBeInTheDocument()
+    expect(screen.getAllByText('—')).toHaveLength(2)
+    expect(screen.getAllByText('42ms')).toHaveLength(5)
+  })
+
+  it('expands and collapses details, including retry, error and response metadata', () => {
+    mocks.pages = [
+      {
+        deliveries: [
+          delivery({
+            id: 'retrying',
+            status: 'failed_retryable',
+            eventId: 'event_retry',
+            eventType: 'ticket.reply.created',
+            errorMessage: 'Connection refused',
+            responseBodySnippet: '{"ok":false}',
+            nextRetryAt: '2026-06-18T12:10:00.000Z',
+          }),
+        ],
+      },
+    ]
+
+    render(<WebhookDeliveriesTable webhookId={'webhook_1' as never} />)
+
+    expect(screen.queryByText('Request URL')).not.toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Expand row' }))
+
+    expect(screen.getByRole('button', { name: 'Collapse row' })).toBeInTheDocument()
+    expect(screen.getByText('Request URL')).toBeInTheDocument()
+    expect(screen.getByText('https://example.com/webhook')).toBeInTheDocument()
+    expect(screen.getByText('Event ID')).toBeInTheDocument()
+    expect(screen.getByText('event_retry')).toBeInTheDocument()
+    expect(screen.getByText('Payload size')).toBeInTheDocument()
+    expect(screen.getByText('128 bytes')).toBeInTheDocument()
+    expect(screen.getByText('Signature timestamp')).toBeInTheDocument()
+    expect(screen.getByText(/1718707200/)).toBeInTheDocument()
+    expect(screen.getByText('Next retry')).toBeInTheDocument()
+    expect(screen.getByText('Error')).toBeInTheDocument()
+    expect(screen.getByText('Connection refused')).toBeInTheDocument()
+    expect(screen.getByText('Response body (snippet)')).toBeInTheDocument()
+    expect(screen.getByText('{"ok":false}')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Collapse row' }))
+    expect(screen.queryByText('Request URL')).not.toBeInTheDocument()
+  })
+
+  it('fetches the next page and reflects loading state', () => {
+    mocks.pages = [{ deliveries: [delivery({ id: 'success' })] }]
+    mocks.hasNextPage = true
+
+    const { rerender } = render(<WebhookDeliveriesTable webhookId={'webhook_1' as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Load more' }))
+    expect(mocks.fetchNextPage).toHaveBeenCalledTimes(1)
+
+    mocks.isFetchingNextPage = true
+    rerender(<WebhookDeliveriesTable webhookId={'webhook_1' as never} />)
+
+    expect(screen.getByRole('button', { name: 'Loading…' })).toBeDisabled()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-dialogs.test.tsx b/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-dialogs.test.tsx
new file mode 100644
index 000000000..281b2f543
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-dialogs.test.tsx
@@ -0,0 +1,571 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { CreateWebhookDialog } from '../create-webhook-dialog'
+import { EditWebhookDialog } from '../edit-webhook-dialog'
+import { TestWebhookDialog } from '../test-webhook-dialog'
+import { WebhookDeliveriesDrawer } from '../webhook-deliveries-drawer'
+
+type WebhookFixture = {
+  id: string
+  url: string
+  events: string[]
+  inboxIds?: string[] | null
+  status: 'active' | 'disabled'
+  failureCount: number
+  lastError?: string | null
+}
+
+const mocks = vi.hoisted(() => ({
+  createWebhookFn: vi.fn(),
+  updateWebhookFn: vi.fn(),
+  testWebhookFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  routerInvalidate: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({
+    invalidate: mocks.routerInvalidate,
+  }),
+}))
+
+vi.mock('@/lib/server/functions/webhooks', () => ({
+  createWebhookFn: mocks.createWebhookFn,
+  testWebhookFn: mocks.testWebhookFn,
+  updateWebhookFn: mocks.updateWebhookFn,
+}))
+
+vi.mock('@/components/shared/secret-reveal-dialog', () => ({
+  SecretRevealDialog: ({
+    open,
+    title,
+    description,
+    secretLabel,
+    secretValue,
+    confirmLabel,
+    onOpenChange,
+    children,
+  }: {
+    open: boolean
+    title: string
+    description: string
+    secretLabel: string
+    secretValue: string
+    confirmLabel: string
+    onOpenChange: (open: boolean) => void
+    children?: ReactNode
+  }) =>
+    open ? (
+      <section>
+        <h2>{title}</h2>
+        <p>{description}</p>
+        <span>{secretLabel}</span>
+        <code>{secretValue}</code>
+        {children}
+        <button type="button" onClick={() => onOpenChange(false)}>
+          {confirmLabel}
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('../webhook-event-picker', () => ({
+  WebhookEventPicker: ({
+    value,
+    onChange,
+    disabled,
+  }: {
+    value: string[]
+    onChange: (value: string[]) => void
+    disabled?: boolean
+  }) => (
+    <section>
+      <span>Events: {value.join(', ') || 'none'}</span>
+      <button
+        type="button"
+        disabled={disabled}
+        onClick={() => onChange([...value, 'ticket.created'])}
+      >
+        Add ticket event
+      </button>
+      <button type="button" disabled={disabled} onClick={() => onChange([])}>
+        Clear events
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('../webhook-inbox-picker', () => ({
+  WebhookInboxPicker: ({
+    value,
+    onChange,
+    active,
+    disabled,
+  }: {
+    value: string[]
+    onChange: (value: string[]) => void
+    active: boolean
+    disabled?: boolean
+  }) => (
+    <section>
+      <span>
+        Inbox picker {active ? 'active' : 'inactive'}: {value.join(', ') || 'all'}
+      </span>
+      <button
+        type="button"
+        disabled={disabled || !active}
+        onClick={() => onChange([...value, 'inbox_1'])}
+      >
+        Add inbox
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('../rotate-webhook-secret-dialog', () => ({
+  RotateWebhookSecretDialog: ({
+    open,
+    onOpenChange,
+    onSecretRotated,
+  }: {
+    webhook: WebhookFixture
+    open: boolean
+    onOpenChange: (open: boolean) => void
+    onSecretRotated: (secret: string) => void
+  }) =>
+    open ? (
+      <section>
+        <button
+          type="button"
+          onClick={() => {
+            onSecretRotated('whsec_new')
+            onOpenChange(false)
+          }}
+        >
+          Confirm rotate
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('../webhook-deliveries-table', () => ({
+  WebhookDeliveriesTable: ({ webhookId, status }: { webhookId: string; status?: string }) => (
+    <div>
+      Deliveries table {webhookId} {status ?? 'all'}
+    </div>
+  ),
+}))
+
+vi.mock('@/components/shared/copy-button', () => ({
+  CopyButton: ({
+    value,
+  }: {
+    value: string
+    'aria-label'?: string
+    variant?: string
+    size?: string
+  }) => <button type="button">Copy {value}</button>,
+}))
+
+vi.mock('@/components/shared/warning-box', () => ({
+  WarningBox: ({
+    title,
+    description,
+  }: {
+    variant: string
+    title: string
+    description?: string
+  }) => (
+    <aside>
+      <strong>{title}</strong>
+      {description && <p>{description}</p>}
+    </aside>
+  ),
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({
+    children,
+    open,
+  }: {
+    children: ReactNode
+    open?: boolean
+    onOpenChange?: (open: boolean) => void
+  }) => (open ? <div role="dialog">{children}</div> : null),
+  DialogContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <section>{children}</section>
+  ),
+  DialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/sheet', () => ({
+  Sheet: ({
+    children,
+    open,
+  }: {
+    children: ReactNode
+    open?: boolean
+    onOpenChange?: (open: boolean) => void
+  }) => (open ? <div>{children}</div> : null),
+  SheetContent: ({ children }: { children: ReactNode; side?: string; className?: string }) => (
+    <section>{children}</section>
+  ),
+  SheetDescription: ({
+    children,
+    title,
+  }: {
+    children: ReactNode
+    title?: string
+    className?: string
+  }) => <p title={title}>{children}</p>,
+  SheetHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  SheetTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    'aria-label'?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+    type = 'text',
+    disabled,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: { target: { value: string } }) => void
+    placeholder?: string
+    type?: string
+    disabled?: boolean
+    required?: boolean
+  }) => (
+    <input
+      id={id}
+      type={type}
+      value={value}
+      disabled={disabled}
+      placeholder={placeholder}
+      onChange={(event) => onChange?.({ target: { value: event.currentTarget.value } })}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children: ReactNode; htmlFor?: string; className?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+    disabled,
+    'aria-label': ariaLabel,
+  }: {
+    id?: string
+    checked?: boolean
+    onCheckedChange?: (checked: boolean) => void
+    disabled?: boolean
+    'aria-label'?: string
+  }) => (
+    <input
+      id={id}
+      type="checkbox"
+      checked={checked}
+      disabled={disabled}
+      aria-label={ariaLabel}
+      onChange={(event) => onCheckedChange?.(event.currentTarget.checked)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/select', async () => {
+  const React = await import('react')
+  const SelectContext = React.createContext<{ onValueChange?: (value: string) => void }>({})
+  return {
+    Select: ({
+      value,
+      onValueChange,
+      children,
+    }: {
+      value?: string
+      onValueChange?: (value: string) => void
+      children?: ReactNode
+    }) => (
+      <SelectContext.Provider value={{ onValueChange }}>
+        <div data-value={value}>{children}</div>
+      </SelectContext.Provider>
+    ),
+    SelectContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+    SelectItem: ({ children, value }: { children: ReactNode; value: string }) => {
+      const context = React.useContext(SelectContext)
+      return (
+        <button type="button" onClick={() => context.onValueChange?.(value)}>
+          {children}
+        </button>
+      )
+    },
+    SelectTrigger: ({ children }: { children?: ReactNode; id?: string; className?: string }) => (
+      <>{children}</>
+    ),
+    SelectValue: ({ placeholder }: { placeholder?: string }) => <span>{placeholder}</span>,
+  }
+})
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArrowPathIcon: () => <span aria-hidden="true">rotate</span>,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  CheckCircleIcon: () => <span aria-hidden="true">success</span>,
+  XCircleIcon: () => <span aria-hidden="true">failure</span>,
+}))
+
+function webhook(overrides: Partial<WebhookFixture> = {}): WebhookFixture {
+  return {
+    id: 'webhook_1',
+    url: 'https://example.test/webhook',
+    events: ['ticket.created'],
+    inboxIds: null,
+    status: 'active',
+    failureCount: 0,
+    lastError: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.createWebhookFn.mockResolvedValue({ secret: 'whsec_created' })
+  mocks.updateWebhookFn.mockResolvedValue({ ok: true })
+  mocks.testWebhookFn.mockResolvedValue({
+    success: true,
+    eventId: 'evt_test_1',
+    errorMessage: null,
+  })
+})
+
+describe('CreateWebhookDialog', () => {
+  it('creates a webhook with ticket inbox scope and reveals the signing secret', async () => {
+    const onOpenChange = vi.fn()
+    render(<CreateWebhookDialog open onOpenChange={onOpenChange} />)
+
+    fireEvent.change(screen.getByLabelText('Endpoint URL'), {
+      target: { value: 'https://receiver.test/hooks/quackback' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Add ticket event' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Add inbox' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create Webhook' }))
+
+    await waitFor(() => {
+      expect(mocks.createWebhookFn).toHaveBeenCalledWith({
+        data: {
+          url: 'https://receiver.test/hooks/quackback',
+          events: ['ticket.created'],
+          inboxIds: ['inbox_1'],
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['admin', 'webhooks'] })
+    expect(mocks.routerInvalidate).toHaveBeenCalled()
+    expect(screen.getByText('Webhook Created')).toBeInTheDocument()
+    expect(screen.getByText('whsec_created')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: "I've saved my secret" }))
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('shows create failures with no inbox scope when no inbox is selected', async () => {
+    mocks.createWebhookFn.mockRejectedValueOnce('denied')
+    render(<CreateWebhookDialog open onOpenChange={vi.fn()} />)
+
+    fireEvent.change(screen.getByLabelText('Endpoint URL'), {
+      target: { value: 'https://receiver.test/hooks/quackback' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Add ticket event' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create Webhook' }))
+
+    await waitFor(() => {
+      expect(screen.getByText('Failed to create webhook')).toBeInTheDocument()
+    })
+    expect(mocks.createWebhookFn).toHaveBeenCalledWith({
+      data: {
+        url: 'https://receiver.test/hooks/quackback',
+        events: ['ticket.created'],
+        inboxIds: undefined,
+      },
+    })
+  })
+})
+
+describe('EditWebhookDialog', () => {
+  it('updates webhook configuration, rotates the secret, and shows auto-disabled warnings', async () => {
+    const onOpenChange = vi.fn()
+    render(
+      <EditWebhookDialog
+        open
+        onOpenChange={onOpenChange}
+        webhook={
+          webhook({
+            status: 'disabled',
+            failureCount: 50,
+            lastError: 'Endpoint returned 500',
+            inboxIds: ['inbox_old'],
+          }) as never
+        }
+      />
+    )
+
+    expect(screen.getByText('Auto-disabled after 50 failures')).toBeInTheDocument()
+    expect(screen.getByText('Last error: Endpoint returned 500')).toBeInTheDocument()
+
+    fireEvent.change(screen.getByLabelText('Endpoint URL'), {
+      target: { value: 'https://receiver.test/new' },
+    })
+    fireEvent.click(screen.getByLabelText('Toggle webhook enabled'))
+    fireEvent.click(screen.getByRole('button', { name: 'Add inbox' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Save Changes' }))
+
+    await waitFor(() => {
+      expect(mocks.updateWebhookFn).toHaveBeenCalledWith({
+        data: {
+          webhookId: 'webhook_1',
+          url: 'https://receiver.test/new',
+          events: ['ticket.created'],
+          inboxIds: ['inbox_old', 'inbox_1'],
+          status: 'active',
+        },
+      })
+    })
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Rotate signing secret' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Confirm rotate' }))
+    expect(screen.getByText('whsec_new')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Copy whsec_new' })).toBeInTheDocument()
+  })
+
+  it('validates events and reports update failures', async () => {
+    mocks.updateWebhookFn.mockRejectedValueOnce(new Error('Webhook rejected'))
+    render(<EditWebhookDialog open onOpenChange={vi.fn()} webhook={webhook() as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Clear events' }))
+    fireEvent.submit(screen.getByLabelText('Endpoint URL').closest('form') as HTMLFormElement)
+    expect(screen.getByText('Select at least one event')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Add ticket event' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Save Changes' }))
+
+    await waitFor(() => {
+      expect(screen.getByText('Webhook rejected')).toBeInTheDocument()
+    })
+  })
+})
+
+describe('TestWebhookDialog', () => {
+  it('sends test events, reports outcomes, and resets on close', async () => {
+    const onOpenChange = vi.fn()
+    render(<TestWebhookDialog webhook={webhook() as never} onOpenChange={onOpenChange} />)
+
+    expect(screen.getByText(/Posts a canonical sample payload/)).toHaveTextContent(
+      'https://example.test/webhook'
+    )
+    fireEvent.click(screen.getByRole('button', { name: 'Send test' }))
+
+    await waitFor(() => {
+      expect(mocks.testWebhookFn).toHaveBeenCalledWith({
+        data: { webhookId: 'webhook_1', eventType: 'ticket.created' },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['admin', 'webhook-deliveries'],
+    })
+    expect(screen.getByText('Delivered successfully')).toBeInTheDocument()
+    expect(screen.getByText('Event id: evt_test_1')).toBeInTheDocument()
+
+    mocks.testWebhookFn.mockResolvedValueOnce({
+      success: false,
+      eventId: 'evt_test_2',
+      errorMessage: 'HTTP 500',
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Send test' }))
+    await waitFor(() => {
+      expect(screen.getByText('Delivery failed')).toBeInTheDocument()
+    })
+    expect(screen.getByText('HTTP 500')).toBeInTheDocument()
+
+    mocks.testWebhookFn.mockRejectedValueOnce('network down')
+    fireEvent.click(screen.getByRole('button', { name: 'Send test' }))
+    await waitFor(() => {
+      expect(screen.getByText('Test failed')).toBeInTheDocument()
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Close' }))
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
+
+  it('renders nothing without a selected webhook', () => {
+    render(<TestWebhookDialog webhook={null} onOpenChange={vi.fn()} />)
+
+    expect(screen.queryByText('Send test event')).not.toBeInTheDocument()
+  })
+})
+
+describe('WebhookDeliveriesDrawer', () => {
+  it('filters deliveries by status and hides content without a webhook', () => {
+    const { rerender } = render(
+      <WebhookDeliveriesDrawer webhook={webhook() as never} onOpenChange={vi.fn()} />
+    )
+
+    expect(screen.getByText('Deliveries')).toBeInTheDocument()
+    expect(screen.getByText('https://example.test/webhook')).toHaveAttribute(
+      'title',
+      'https://example.test/webhook'
+    )
+    expect(screen.getByText('Deliveries table webhook_1 all')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Failed' }))
+    expect(screen.getByText('Deliveries table webhook_1 failed_terminal')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Any' }))
+    expect(screen.getByText('Deliveries table webhook_1 all')).toBeInTheDocument()
+
+    rerender(<WebhookDeliveriesDrawer webhook={null} onOpenChange={vi.fn()} />)
+    expect(screen.queryByText('Deliveries')).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-event-picker.defaults.test.tsx b/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-event-picker.defaults.test.tsx
new file mode 100644
index 000000000..b12cc81b9
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-event-picker.defaults.test.tsx
@@ -0,0 +1,73 @@
+// @vitest-environment happy-dom
+/**
+ * Phase 6 housekeeping: lock in that no webhook event category — including
+ * `configuration` — is auto-selected. The create-webhook dialog initializes
+ * `selectedEvents` to `[]`; verify the picker honours that and renders every
+ * category with a `(0/N)` counter and no checkboxes pre-checked.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+
+vi.mock('@/lib/server/functions/webhooks', () => ({
+  fetchSamplePayloadsFn: vi.fn(async () => ({})),
+}))
+
+import { WebhookEventPicker } from '../webhook-event-picker'
+import { WEBHOOK_EVENT_CATEGORIES, WEBHOOK_EVENT_CONFIG } from '@/lib/shared/webhook-events'
+
+function renderPicker(value: string[] = []) {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  return render(
+    <QueryClientProvider client={qc}>
+      <WebhookEventPicker value={value} onChange={vi.fn()} />
+    </QueryClientProvider>
+  )
+}
+
+describe('WebhookEventPicker defaults (Phase 6 housekeeping)', () => {
+  it('renders every category with 0/N selected when value is empty', () => {
+    renderPicker([])
+
+    for (const cat of WEBHOOK_EVENT_CATEGORIES) {
+      const total = WEBHOOK_EVENT_CONFIG.filter((e) => e.category === cat.id).length
+      if (total === 0) continue
+      const counter = `(0/${total})`
+      const matches = screen.getAllByText((_, node) => {
+        if (!node) return false
+        const txt = node.textContent ?? ''
+        return txt.includes(cat.label) && txt.includes(counter)
+      })
+      expect(matches.length).toBeGreaterThan(0)
+    }
+  })
+
+  it('does NOT pre-check the configuration category (or any other)', () => {
+    renderPicker([])
+
+    const checkboxes = screen.getAllByRole('checkbox') as HTMLInputElement[]
+    expect(checkboxes.length).toBe(WEBHOOK_EVENT_CONFIG.length)
+    for (const cb of checkboxes) {
+      // Radix renders checked state via aria-checked + data-state, not the
+      // native `checked` prop.
+      expect(cb.getAttribute('aria-checked')).not.toBe('true')
+      expect(cb.getAttribute('data-state')).not.toBe('checked')
+    }
+  })
+
+  it('configuration category is opt-in (no events from it included by default)', () => {
+    renderPicker([])
+    const configurationEventIds = WEBHOOK_EVENT_CONFIG.filter(
+      (e) => e.category === 'configuration'
+    ).map((e) => e.id)
+    expect(configurationEventIds.length).toBeGreaterThan(0)
+    // Sanity: the picker exposes per-event aria-labels of the form
+    // "Subscribe to <Label> events". Every configuration checkbox must be
+    // unchecked.
+    for (const id of configurationEventIds) {
+      const cfg = WEBHOOK_EVENT_CONFIG.find((e) => e.id === id)!
+      const cb = screen.getByLabelText(`Subscribe to ${cfg.label} events`) as HTMLInputElement
+      expect(cb.getAttribute('aria-checked')).not.toBe('true')
+    }
+  })
+})
diff --git a/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-inbox-picker.test.tsx b/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-inbox-picker.test.tsx
new file mode 100644
index 000000000..9a2250cc1
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/__tests__/webhook-inbox-picker.test.tsx
@@ -0,0 +1,121 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { WebhookInboxPicker } from '../webhook-inbox-picker'
+
+const mocks = vi.hoisted(() => ({
+  query: {
+    data: [
+      { id: 'inbox_1', name: 'Support', slug: 'support' },
+      { id: 'inbox_2', name: 'Billing', slug: 'billing' },
+    ],
+    isLoading: false,
+  } as {
+    data?: Array<{ id: string; name: string; slug: string }>
+    isLoading: boolean
+  },
+}))
+
+vi.mock('@/lib/client/hooks/use-inboxes-queries', () => ({
+  useInboxes: vi.fn(() => mocks.query),
+}))
+
+vi.mock('@/components/ui/checkbox', () => ({
+  Checkbox: ({
+    checked,
+    disabled,
+    onCheckedChange,
+    'aria-label': ariaLabel,
+  }: {
+    checked?: boolean
+    disabled?: boolean
+    onCheckedChange?: () => void
+    'aria-label'?: string
+  }) => (
+    <button
+      type="button"
+      aria-label={ariaLabel}
+      aria-pressed={checked}
+      disabled={disabled}
+      onClick={() => onCheckedChange?.()}
+    >
+      {checked ? 'checked' : 'unchecked'}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children }: { children: ReactNode; className?: string }) => <span>{children}</span>,
+}))
+
+beforeEach(() => {
+  mocks.query = {
+    data: [
+      { id: 'inbox_1', name: 'Support', slug: 'support' },
+      { id: 'inbox_2', name: 'Billing', slug: 'billing' },
+    ],
+    isLoading: false,
+  }
+})
+
+describe('WebhookInboxPicker', () => {
+  it('selects, clears, and removes inbox filters while active', () => {
+    const onChange = vi.fn()
+    const { rerender } = render(
+      <WebhookInboxPicker value={[]} onChange={onChange} active disabled={false} />
+    )
+
+    expect(screen.getByText('Inboxes (optional)')).toBeInTheDocument()
+    expect(screen.getByText('Empty = match tickets in any inbox.')).toBeInTheDocument()
+    expect(screen.getByText('Support')).toBeInTheDocument()
+    expect(screen.getByText('support')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Filter by inbox Support' }))
+    expect(onChange).toHaveBeenCalledWith(['inbox_1'])
+
+    rerender(<WebhookInboxPicker value={['inbox_1']} onChange={onChange} active />)
+    expect(
+      screen.getByText('Only deliver ticket events from the selected inbox.')
+    ).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Filter by inbox Support' })).toHaveAttribute(
+      'aria-pressed',
+      'true'
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Filter by inbox Support' }))
+    expect(onChange).toHaveBeenCalledWith([])
+
+    rerender(<WebhookInboxPicker value={['inbox_1', 'inbox_2']} onChange={onChange} active />)
+    expect(
+      screen.getByText('Only deliver ticket events from the selected inboxes.')
+    ).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Clear' }))
+    expect(onChange).toHaveBeenCalledWith([])
+  })
+
+  it('disables filters and shows the inactive hint when no ticket events are selected', () => {
+    const onChange = vi.fn()
+    render(<WebhookInboxPicker value={['inbox_1']} onChange={onChange} active={false} />)
+
+    expect(screen.getByText(/Filter is ignored unless/)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Filter by inbox Support' })).toBeDisabled()
+    fireEvent.click(screen.getByRole('button', { name: 'Filter by inbox Support' }))
+    expect(onChange).not.toHaveBeenCalled()
+  })
+
+  it('renders loading and empty inbox states', () => {
+    mocks.query = { data: undefined, isLoading: true }
+    const { rerender } = render(
+      <WebhookInboxPicker value={[]} onChange={vi.fn()} active disabled={false} />
+    )
+
+    expect(screen.getByText(/Loading inboxes/)).toBeInTheDocument()
+
+    mocks.query = { data: [], isLoading: false }
+    rerender(<WebhookInboxPicker value={[]} onChange={vi.fn()} active disabled={false} />)
+
+    expect(screen.getByText('No inboxes configured.')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/webhooks/__tests__/webhooks-settings.test.tsx b/apps/web/src/components/admin/settings/webhooks/__tests__/webhooks-settings.test.tsx
new file mode 100644
index 000000000..46a4f6f88
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/__tests__/webhooks-settings.test.tsx
@@ -0,0 +1,312 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { WebhooksSettings } from '../webhooks-settings'
+
+type WebhookFixture = {
+  id: string
+  url: string
+  events: string[]
+  status: 'active' | 'disabled'
+  failureCount: number
+  lastTriggeredAt?: Date | null
+  lastError?: string | null
+}
+
+vi.mock('../create-webhook-dialog', () => ({
+  CreateWebhookDialog: ({
+    open,
+    onOpenChange,
+  }: {
+    open: boolean
+    onOpenChange: (open: boolean) => void
+  }) =>
+    open ? (
+      <section>
+        <span>Create webhook dialog</span>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close create
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('../edit-webhook-dialog', () => ({
+  EditWebhookDialog: ({
+    webhook,
+    open,
+    onOpenChange,
+  }: {
+    webhook: WebhookFixture
+    open: boolean
+    onOpenChange: (open: boolean) => void
+  }) =>
+    open ? (
+      <section>
+        <span>Edit {webhook.url}</span>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close edit
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('../delete-webhook-dialog', () => ({
+  DeleteWebhookDialog: ({
+    webhook,
+    open,
+    onOpenChange,
+  }: {
+    webhook: WebhookFixture
+    open: boolean
+    onOpenChange: (open: boolean) => void
+  }) =>
+    open ? (
+      <section>
+        <span>Delete {webhook.url}</span>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close delete
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('../webhook-deliveries-drawer', () => ({
+  WebhookDeliveriesDrawer: ({
+    webhook,
+    onOpenChange,
+  }: {
+    webhook: WebhookFixture | null
+    onOpenChange: (open: boolean) => void
+  }) =>
+    webhook ? (
+      <section>
+        <span>Deliveries {webhook.url}</span>
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close deliveries
+        </button>
+      </section>
+    ) : null,
+}))
+
+vi.mock('@/components/shared/empty-state', () => ({
+  EmptyState: ({
+    title,
+    description,
+    action,
+  }: {
+    icon: unknown
+    title: string
+    description: string
+    action?: ReactNode
+  }) => (
+    <section>
+      <h2>{title}</h2>
+      <p>{description}</p>
+      {action}
+    </section>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    disabled,
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    disabled?: boolean
+    variant?: string
+    size?: string
+    className?: string
+    'aria-label'?: string
+  }) => (
+    <button type="button" onClick={onClick} disabled={disabled} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children, title }: { children: ReactNode; variant?: string; title?: string }) => (
+    <span title={title}>{children}</span>
+  ),
+}))
+
+vi.mock('@/components/ui/dropdown-menu', () => ({
+  DropdownMenu: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DropdownMenuContent: ({ children }: { children: ReactNode; align?: string }) => (
+    <div>{children}</div>
+  ),
+  DropdownMenuItem: ({
+    children,
+    onClick,
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    className?: string
+  }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  DropdownMenuTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => (
+    <>{children}</>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  BoltIcon: () => <span aria-hidden="true">bolt</span>,
+  PencilIcon: () => <span aria-hidden="true">edit</span>,
+  PlusIcon: () => <span aria-hidden="true">plus</span>,
+  QueueListIcon: () => <span aria-hidden="true">queue</span>,
+  TrashIcon: () => <span aria-hidden="true">trash</span>,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  EllipsisVerticalIcon: () => <span aria-hidden="true">menu</span>,
+}))
+
+function webhook(overrides: Partial<WebhookFixture> = {}): WebhookFixture {
+  return {
+    id: overrides.id ?? 'webhook_1',
+    url: overrides.url ?? 'https://receiver.test/hook',
+    events: overrides.events ?? ['post.created', 'ticket.created'],
+    status: overrides.status ?? 'active',
+    failureCount: overrides.failureCount ?? 0,
+    lastTriggeredAt: overrides.lastTriggeredAt ?? null,
+    lastError: overrides.lastError ?? null,
+  }
+}
+
+describe('WebhooksSettings', () => {
+  it('opens the create dialog from the empty state and closes it', () => {
+    render(<WebhooksSettings webhooks={[]} />)
+
+    expect(screen.getByText('No webhooks configured')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: /Create your first webhook/ }))
+    expect(screen.getByText('Create webhook dialog')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Close create' }))
+    expect(screen.queryByText('Create webhook dialog')).not.toBeInTheDocument()
+  })
+
+  it('renders statuses, event labels, timestamps, errors, and opens row actions', () => {
+    render(
+      <WebhooksSettings
+        webhooks={
+          [
+            webhook({
+              id: 'webhook_active',
+              url: 'https://receiver.test/active',
+              events: ['post.created', 'ticket.created'],
+              lastTriggeredAt: new Date(Date.now() - 60_000),
+            }),
+            webhook({
+              id: 'webhook_issues',
+              url: 'https://receiver.test/issues',
+              events: ['comment.created'],
+              failureCount: 2,
+              lastError: 'HTTP 502',
+            }),
+            webhook({
+              id: 'webhook_failing',
+              url: 'https://receiver.test/failing',
+              events: ['post.status_changed'],
+              failureCount: 25,
+            }),
+            webhook({
+              id: 'webhook_disabled',
+              url: 'https://receiver.test/disabled',
+              events: ['changelog.published'],
+              status: 'disabled',
+            }),
+            webhook({
+              id: 'webhook_auto_disabled',
+              url: 'https://receiver.test/auto',
+              events: ['unknown.event'],
+              status: 'disabled',
+              failureCount: 50,
+              lastError: 'too many failures',
+            }),
+          ] as never
+        }
+      />
+    )
+
+    expect(screen.getByText('5 of 25 webhooks')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.getByText('Issues (2)')).toHaveAttribute('title', '2 consecutive failures')
+    expect(screen.getByText('Failing (25/50)')).toHaveAttribute('title', '25 consecutive failures')
+    expect(screen.getByText('Disabled')).toBeInTheDocument()
+    expect(screen.getByText('Auto-disabled')).toHaveAttribute(
+      'title',
+      'Auto-disabled after 50 failures'
+    )
+    expect(screen.getByText(/New Post/)).toHaveTextContent('ticket.created')
+    expect(screen.getByText('New Comment')).toBeInTheDocument()
+    expect(screen.getByText('Status Changed')).toBeInTheDocument()
+    expect(screen.getByText('Changelog Published')).toBeInTheDocument()
+    expect(screen.getByText('unknown.event')).toBeInTheDocument()
+    expect(screen.getByText(/Last fired/)).toBeInTheDocument()
+    expect(screen.getByText('Error: HTTP 502')).toHaveAttribute('title', 'HTTP 502')
+    expect(screen.getByText('Error: too many failures')).toHaveAttribute(
+      'title',
+      'too many failures'
+    )
+
+    fireEvent.click(
+      screen.getByRole('button', {
+        name: 'View deliveries for https://receiver.test/active',
+      })
+    )
+    expect(screen.getByText('Deliveries https://receiver.test/active')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Close deliveries' }))
+    expect(screen.queryByText('Deliveries https://receiver.test/active')).not.toBeInTheDocument()
+
+    fireEvent.click(
+      screen.getByRole('button', {
+        name: 'Edit webhook https://receiver.test/active',
+      })
+    )
+    expect(screen.getByText('Edit https://receiver.test/active')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Close edit' }))
+    expect(screen.queryByText('Edit https://receiver.test/active')).not.toBeInTheDocument()
+
+    fireEvent.click(
+      screen.getByRole('button', {
+        name: 'Delete webhook https://receiver.test/active',
+      })
+    )
+    expect(screen.getByText('Delete https://receiver.test/active')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Close delete' }))
+    expect(screen.queryByText('Delete https://receiver.test/active')).not.toBeInTheDocument()
+  })
+
+  it('opens the create dialog from the header and disables creation at the limit', () => {
+    const { rerender } = render(
+      <WebhooksSettings webhooks={[webhook({ id: 'webhook_1' })] as never} />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /Create Webhook/ }))
+    expect(screen.getByText('Create webhook dialog')).toBeInTheDocument()
+
+    rerender(
+      <WebhooksSettings
+        webhooks={
+          Array.from({ length: 25 }, (_, index) =>
+            webhook({
+              id: `webhook_${index}`,
+              url: `https://receiver.test/${index}`,
+            })
+          ) as never
+        }
+      />
+    )
+
+    expect(screen.getByRole('button', { name: /Create Webhook/ })).toBeDisabled()
+  })
+})
diff --git a/apps/web/src/components/admin/settings/webhooks/create-webhook-dialog.tsx b/apps/web/src/components/admin/settings/webhooks/create-webhook-dialog.tsx
index 3ffd54b58..35df02921 100644
--- a/apps/web/src/components/admin/settings/webhooks/create-webhook-dialog.tsx
+++ b/apps/web/src/components/admin/settings/webhooks/create-webhook-dialog.tsx
@@ -7,7 +7,6 @@ import { SecretRevealDialog } from '@/components/shared/secret-reveal-dialog'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
-import { Checkbox } from '@/components/ui/checkbox'
 import {
   Dialog,
   DialogContent,
@@ -17,7 +16,9 @@ import {
   DialogTitle,
 } from '@/components/ui/dialog'
 import { createWebhookFn } from '@/lib/server/functions/webhooks'
-import { WEBHOOK_EVENTS, WEBHOOK_EVENT_CONFIG } from '@/lib/shared/webhook-events'
+import { WEBHOOK_EVENTS } from '@/lib/shared/webhook-events'
+import { WebhookEventPicker } from './webhook-event-picker'
+import { WebhookInboxPicker } from './webhook-inbox-picker'
 
 interface CreateWebhookDialogProps {
   open: boolean
@@ -32,6 +33,7 @@ export function CreateWebhookDialog({ open, onOpenChange }: CreateWebhookDialogP
   // Form state
   const [url, setUrl] = useState('')
   const [selectedEvents, setSelectedEvents] = useState<string[]>([])
+  const [selectedInboxIds, setSelectedInboxIds] = useState<string[]>([])
   const [error, setError] = useState<string | null>(null)
 
   // Secret reveal state
@@ -51,6 +53,7 @@ export function CreateWebhookDialog({ open, onOpenChange }: CreateWebhookDialogP
         data: {
           url,
           events: selectedEvents as (typeof WEBHOOK_EVENTS)[number][],
+          inboxIds: selectedInboxIds.length > 0 ? selectedInboxIds : undefined,
         },
       })
 
@@ -69,17 +72,12 @@ export function CreateWebhookDialog({ open, onOpenChange }: CreateWebhookDialogP
   const handleClose = () => {
     setUrl('')
     setSelectedEvents([])
+    setSelectedInboxIds([])
     setError(null)
     setCreatedSecret(null)
     onOpenChange(false)
   }
 
-  const toggleEvent = (eventId: string) => {
-    setSelectedEvents((prev) =>
-      prev.includes(eventId) ? prev.filter((e) => e !== eventId) : [...prev, eventId]
-    )
-  }
-
   // Secret reveal view
   if (createdSecret) {
     return (
@@ -134,29 +132,18 @@ export function CreateWebhookDialog({ open, onOpenChange }: CreateWebhookDialogP
               <p className="text-xs text-muted-foreground">Must be HTTPS in production</p>
             </div>
 
-            <div className="space-y-2">
-              <Label>Events</Label>
-              <div className="space-y-2">
-                {WEBHOOK_EVENT_CONFIG.map((event) => (
-                  <label
-                    key={event.id}
-                    className="flex items-start gap-3 rounded-lg border p-3 cursor-pointer hover:bg-muted/50 transition-colors"
-                  >
-                    <Checkbox
-                      checked={selectedEvents.includes(event.id)}
-                      onCheckedChange={() => toggleEvent(event.id)}
-                      disabled={isPending}
-                      className="mt-0.5"
-                      aria-label={`Subscribe to ${event.label} events`}
-                    />
-                    <div>
-                      <p className="text-sm font-medium">{event.label}</p>
-                      <p className="text-xs text-muted-foreground">{event.description}</p>
-                    </div>
-                  </label>
-                ))}
-              </div>
-            </div>
+            <WebhookEventPicker
+              value={selectedEvents}
+              onChange={setSelectedEvents}
+              disabled={isPending}
+            />
+
+            <WebhookInboxPicker
+              value={selectedInboxIds}
+              onChange={setSelectedInboxIds}
+              disabled={isPending}
+              active={selectedEvents.some((e) => e.startsWith('ticket.'))}
+            />
 
             {error && <p className="text-sm text-destructive">{error}</p>}
           </div>
diff --git a/apps/web/src/components/admin/settings/webhooks/edit-webhook-dialog.tsx b/apps/web/src/components/admin/settings/webhooks/edit-webhook-dialog.tsx
index 54547a02c..14a1e1330 100644
--- a/apps/web/src/components/admin/settings/webhooks/edit-webhook-dialog.tsx
+++ b/apps/web/src/components/admin/settings/webhooks/edit-webhook-dialog.tsx
@@ -6,7 +6,6 @@ import { useRouter } from '@tanstack/react-router'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
-import { Checkbox } from '@/components/ui/checkbox'
 import { Switch } from '@/components/ui/switch'
 import {
   Dialog,
@@ -20,7 +19,9 @@ import { updateWebhookFn } from '@/lib/server/functions/webhooks'
 import { ArrowPathIcon } from '@heroicons/react/24/outline'
 import { CopyButton } from '@/components/shared/copy-button'
 import { WarningBox } from '@/components/shared/warning-box'
-import { WEBHOOK_EVENTS, WEBHOOK_EVENT_CONFIG } from '@/lib/shared/webhook-events'
+import { WEBHOOK_EVENTS } from '@/lib/shared/webhook-events'
+import { WebhookEventPicker } from './webhook-event-picker'
+import { WebhookInboxPicker } from './webhook-inbox-picker'
 import { RotateWebhookSecretDialog } from './rotate-webhook-secret-dialog'
 import type { Webhook } from '@/lib/shared/types'
 
@@ -38,6 +39,7 @@ export function EditWebhookDialog({ webhook, open, onOpenChange }: EditWebhookDi
   // Form state
   const [url, setUrl] = useState(webhook.url)
   const [selectedEvents, setSelectedEvents] = useState<string[]>(webhook.events)
+  const [selectedInboxIds, setSelectedInboxIds] = useState<string[]>(webhook.inboxIds ?? [])
   const [isEnabled, setIsEnabled] = useState(webhook.status === 'active')
   const [error, setError] = useState<string | null>(null)
 
@@ -49,6 +51,7 @@ export function EditWebhookDialog({ webhook, open, onOpenChange }: EditWebhookDi
   useEffect(() => {
     setUrl(webhook.url)
     setSelectedEvents(webhook.events)
+    setSelectedInboxIds(webhook.inboxIds ?? [])
     setIsEnabled(webhook.status === 'active')
     setError(null)
     setNewSecret(null)
@@ -69,6 +72,7 @@ export function EditWebhookDialog({ webhook, open, onOpenChange }: EditWebhookDi
           webhookId: webhook.id,
           url,
           events: selectedEvents as (typeof WEBHOOK_EVENTS)[number][],
+          inboxIds: selectedInboxIds.length > 0 ? selectedInboxIds : null,
           status: isEnabled ? 'active' : 'disabled',
         },
       })
@@ -84,12 +88,6 @@ export function EditWebhookDialog({ webhook, open, onOpenChange }: EditWebhookDi
     }
   }
 
-  const toggleEvent = (eventId: string) => {
-    setSelectedEvents((prev) =>
-      prev.includes(eventId) ? prev.filter((e) => e !== eventId) : [...prev, eventId]
-    )
-  }
-
   const handleSecretRotated = (secret: string) => {
     setNewSecret(secret)
   }
@@ -120,29 +118,18 @@ export function EditWebhookDialog({ webhook, open, onOpenChange }: EditWebhookDi
                 />
               </div>
 
-              <div className="space-y-2">
-                <Label>Events</Label>
-                <div className="space-y-2">
-                  {WEBHOOK_EVENT_CONFIG.map((event) => (
-                    <label
-                      key={event.id}
-                      className="flex items-start gap-3 rounded-lg border p-3 cursor-pointer hover:bg-muted/50 transition-colors"
-                    >
-                      <Checkbox
-                        checked={selectedEvents.includes(event.id)}
-                        onCheckedChange={() => toggleEvent(event.id)}
-                        disabled={isPending}
-                        className="mt-0.5"
-                        aria-label={`Subscribe to ${event.label} events`}
-                      />
-                      <div>
-                        <p className="text-sm font-medium">{event.label}</p>
-                        <p className="text-xs text-muted-foreground">{event.description}</p>
-                      </div>
-                    </label>
-                  ))}
-                </div>
-              </div>
+              <WebhookEventPicker
+                value={selectedEvents}
+                onChange={setSelectedEvents}
+                disabled={isPending}
+              />
+
+              <WebhookInboxPicker
+                value={selectedInboxIds}
+                onChange={setSelectedInboxIds}
+                disabled={isPending}
+                active={selectedEvents.some((e) => e.startsWith('ticket.'))}
+              />
 
               <div className="flex items-center justify-between rounded-lg border p-4">
                 <div>
@@ -192,7 +179,7 @@ export function EditWebhookDialog({ webhook, open, onOpenChange }: EditWebhookDi
                   </div>
                 ) : (
                   <div className="flex items-center justify-between rounded-lg border p-3">
-                    <p className="text-xs text-muted-foreground">
+                    <p className="text-sm text-muted-foreground">
                       Rotate to generate a new signing secret
                     </p>
                     <Button
diff --git a/apps/web/src/components/admin/settings/webhooks/test-webhook-dialog.tsx b/apps/web/src/components/admin/settings/webhooks/test-webhook-dialog.tsx
new file mode 100644
index 000000000..cfdd9685b
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/test-webhook-dialog.tsx
@@ -0,0 +1,145 @@
+'use client'
+
+import { useState } from 'react'
+import { useQueryClient } from '@tanstack/react-query'
+import { CheckCircleIcon, XCircleIcon } from '@heroicons/react/24/solid'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Label } from '@/components/ui/label'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { testWebhookFn } from '@/lib/server/functions/webhooks'
+import type { Webhook } from '@/lib/shared/types'
+
+interface TestWebhookDialogProps {
+  webhook: Webhook | null
+  onOpenChange: (open: boolean) => void
+}
+
+interface TestOutcome {
+  success: boolean
+  errorMessage?: string | null
+  eventId: string
+}
+
+export function TestWebhookDialog({ webhook, onOpenChange }: TestWebhookDialogProps) {
+  const queryClient = useQueryClient()
+  const [eventType, setEventType] = useState<string>('')
+  const [pending, setPending] = useState(false)
+  const [outcome, setOutcome] = useState<TestOutcome | null>(null)
+  const [error, setError] = useState<string | null>(null)
+
+  if (!webhook) return null
+
+  const events = webhook.events
+  const selectedEvent = eventType || events[0] || ''
+
+  async function handleSend() {
+    setPending(true)
+    setError(null)
+    setOutcome(null)
+    try {
+      if (!webhook) return
+      const result = await testWebhookFn({
+        data: { webhookId: webhook.id, eventType: selectedEvent as never },
+      })
+      setOutcome(result as TestOutcome)
+      // refresh deliveries list so the new attempt appears immediately
+      void queryClient.invalidateQueries({ queryKey: ['admin', 'webhook-deliveries'] })
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Test failed')
+    } finally {
+      setPending(false)
+    }
+  }
+
+  function close(open: boolean) {
+    if (open) return
+    setOutcome(null)
+    setError(null)
+    setEventType('')
+    onOpenChange(false)
+  }
+
+  return (
+    <Dialog open={!!webhook} onOpenChange={close}>
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Send test event</DialogTitle>
+          <DialogDescription>
+            Posts a canonical sample payload to{' '}
+            <code className="bg-muted px-1 rounded text-xs">{webhook.url}</code> and reports the
+            HTTP outcome. The attempt is logged to the deliveries list with an
+            <code className="bg-muted mx-1 px-1 rounded text-xs">evt_test_</code>id so receivers can
+            ignore it.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-3">
+          <div className="space-y-1">
+            <Label htmlFor="test-event-type">Event type</Label>
+            <Select value={selectedEvent} onValueChange={setEventType}>
+              <SelectTrigger id="test-event-type">
+                <SelectValue placeholder="Choose an event" />
+              </SelectTrigger>
+              <SelectContent>
+                {events.map((ev) => (
+                  <SelectItem key={ev} value={ev}>
+                    {ev}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+
+          {outcome && (
+            <div
+              className={
+                'flex items-start gap-2 rounded-md border p-3 text-sm ' +
+                (outcome.success
+                  ? 'border-emerald-500/40 bg-emerald-500/5 text-emerald-700 dark:text-emerald-300'
+                  : 'border-destructive/40 bg-destructive/5 text-destructive')
+              }
+            >
+              {outcome.success ? (
+                <CheckCircleIcon className="h-5 w-5 shrink-0" />
+              ) : (
+                <XCircleIcon className="h-5 w-5 shrink-0" />
+              )}
+              <div className="space-y-0.5">
+                <p className="font-medium">
+                  {outcome.success ? 'Delivered successfully' : 'Delivery failed'}
+                </p>
+                <p className="text-xs">Event id: {outcome.eventId}</p>
+                {outcome.errorMessage && <p className="text-xs">{outcome.errorMessage}</p>}
+              </div>
+            </div>
+          )}
+
+          {error && <p className="text-sm text-destructive">{error}</p>}
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={() => close(false)} disabled={pending}>
+            Close
+          </Button>
+          <Button onClick={handleSend} disabled={pending || !selectedEvent}>
+            {pending ? 'Sending…' : 'Send test'}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/webhooks/webhook-deliveries-drawer.tsx b/apps/web/src/components/admin/settings/webhooks/webhook-deliveries-drawer.tsx
new file mode 100644
index 000000000..4572201cd
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/webhook-deliveries-drawer.tsx
@@ -0,0 +1,78 @@
+/**
+ * Drawer for inspecting webhook delivery attempts. Opens when `webhook` is
+ * non-null; closes when `onOpenChange(false)` is called.
+ */
+import { useState, Suspense } from 'react'
+import {
+  Sheet,
+  SheetContent,
+  SheetDescription,
+  SheetHeader,
+  SheetTitle,
+} from '@/components/ui/sheet'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { Label } from '@/components/ui/label'
+import type { WebhookId } from '@quackback/ids'
+import type { Webhook } from '@/lib/shared/types'
+import type { WebhookDeliveryStatusFilter } from '@/lib/client/queries/webhook-deliveries'
+import { WebhookDeliveriesTable } from './webhook-deliveries-table'
+
+interface Props {
+  webhook: Webhook | null
+  onOpenChange: (open: boolean) => void
+}
+
+const ALL = '__all__'
+
+export function WebhookDeliveriesDrawer({ webhook, onOpenChange }: Props) {
+  const [status, setStatus] = useState<WebhookDeliveryStatusFilter | undefined>(undefined)
+
+  return (
+    <Sheet open={!!webhook} onOpenChange={onOpenChange}>
+      <SheetContent side="right" className="w-full sm:max-w-3xl overflow-y-auto">
+        <SheetHeader>
+          <SheetTitle>Deliveries</SheetTitle>
+          <SheetDescription className="truncate" title={webhook?.url}>
+            {webhook?.url ?? ''}
+          </SheetDescription>
+        </SheetHeader>
+
+        {webhook && (
+          <div className="space-y-4 py-4 px-4">
+            <div className="flex items-center gap-2">
+              <Label className="text-xs">Status:</Label>
+              <Select
+                value={status ?? ALL}
+                onValueChange={(v) =>
+                  setStatus(v === ALL ? undefined : (v as WebhookDeliveryStatusFilter))
+                }
+              >
+                <SelectTrigger className="h-8 w-44 text-xs">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value={ALL}>Any</SelectItem>
+                  <SelectItem value="success">Success</SelectItem>
+                  <SelectItem value="failed_retryable">Retrying</SelectItem>
+                  <SelectItem value="failed_terminal">Failed</SelectItem>
+                  <SelectItem value="blocked_ssrf">Blocked (SSRF)</SelectItem>
+                  <SelectItem value="queued">Queued</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+
+            <Suspense fallback={<div className="text-xs text-muted-foreground">Loading…</div>}>
+              <WebhookDeliveriesTable webhookId={webhook.id as WebhookId} status={status} />
+            </Suspense>
+          </div>
+        )}
+      </SheetContent>
+    </Sheet>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/webhooks/webhook-deliveries-table.tsx b/apps/web/src/components/admin/settings/webhooks/webhook-deliveries-table.tsx
new file mode 100644
index 000000000..1675476b0
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/webhook-deliveries-table.tsx
@@ -0,0 +1,242 @@
+/**
+ * Webhook deliveries table — cursor-paged list of attempts. Status filter
+ * passed in by the parent drawer; rows expand to show request URL, response
+ * snippet, error message, and retry metadata.
+ */
+import { Fragment, useState, useMemo } from 'react'
+import { useSuspenseInfiniteQuery } from '@tanstack/react-query'
+import type { WebhookId } from '@quackback/ids'
+import {
+  webhookDeliveryQueries,
+  type WebhookDeliveryStatusFilter,
+} from '@/lib/client/queries/webhook-deliveries'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { ChevronDownIcon, ChevronRightIcon } from '@heroicons/react/24/outline'
+
+interface Props {
+  webhookId: WebhookId
+  status?: WebhookDeliveryStatusFilter
+}
+
+type DeliveryRow = {
+  id: string
+  webhookId: string
+  eventId: string
+  eventType: string
+  attemptNumber: number
+  status: string
+  httpStatus: number | null
+  errorMessage: string | null
+  requestUrl: string
+  requestPayloadBytes: number
+  responseBodySnippet: string | null
+  latencyMs: number | null
+  signatureTimestamp: number
+  attemptedAt: string
+  nextRetryAt: string | null
+}
+
+function StatusPill({ status }: { status: string }) {
+  switch (status) {
+    case 'success':
+      return (
+        <Badge className="bg-emerald-100 text-emerald-900 hover:bg-emerald-100 dark:bg-emerald-950 dark:text-emerald-200">
+          Success
+        </Badge>
+      )
+    case 'failed_retryable':
+      return (
+        <Badge className="bg-amber-100 text-amber-900 hover:bg-amber-100 dark:bg-amber-950 dark:text-amber-200">
+          Retrying
+        </Badge>
+      )
+    case 'failed_terminal':
+      return <Badge variant="destructive">Failed</Badge>
+    case 'blocked_ssrf':
+      return (
+        <Badge variant="outline" className="border-destructive text-destructive">
+          Blocked (SSRF)
+        </Badge>
+      )
+    case 'queued':
+      return <Badge variant="secondary">Queued</Badge>
+    default:
+      return <Badge variant="outline">{status}</Badge>
+  }
+}
+
+export function WebhookDeliveriesTable({ webhookId, status }: Props) {
+  const query = useSuspenseInfiniteQuery(webhookDeliveryQueries.list(webhookId, { status }))
+  const rows = useMemo<DeliveryRow[]>(
+    () => query.data.pages.flatMap((p) => p.deliveries as DeliveryRow[]),
+    [query.data]
+  )
+
+  const [expanded, setExpanded] = useState<Set<string>>(new Set())
+  const toggle = (id: string) => {
+    setExpanded((prev) => {
+      const next = new Set(prev)
+      if (next.has(id)) next.delete(id)
+      else next.add(id)
+      return next
+    })
+  }
+
+  return (
+    <div className="space-y-3">
+      <div className="rounded-md border border-border/50">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead className="w-8" />
+              <TableHead className="w-44">Attempted at</TableHead>
+              <TableHead className="w-16">#</TableHead>
+              <TableHead className="w-28">Status</TableHead>
+              <TableHead className="w-16">HTTP</TableHead>
+              <TableHead className="w-20">Latency</TableHead>
+              <TableHead>Event</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {rows.length === 0 ? (
+              <TableRow>
+                <TableCell colSpan={7} className="text-center text-sm text-muted-foreground py-6">
+                  No deliveries recorded for this webhook yet.
+                </TableCell>
+              </TableRow>
+            ) : (
+              rows.map((row) => {
+                const isOpen = expanded.has(row.id)
+                return (
+                  <Fragment key={row.id}>
+                    <TableRow className="hover:bg-muted/50">
+                      <TableCell>
+                        <button
+                          type="button"
+                          aria-label={isOpen ? 'Collapse row' : 'Expand row'}
+                          onClick={() => toggle(row.id)}
+                          className="text-muted-foreground hover:text-foreground"
+                        >
+                          {isOpen ? (
+                            <ChevronDownIcon className="h-4 w-4" />
+                          ) : (
+                            <ChevronRightIcon className="h-4 w-4" />
+                          )}
+                        </button>
+                      </TableCell>
+                      <TableCell
+                        className="text-xs text-muted-foreground"
+                        title={new Date(row.attemptedAt).toISOString()}
+                      >
+                        {new Date(row.attemptedAt).toLocaleString()}
+                      </TableCell>
+                      <TableCell className="text-xs font-mono">{row.attemptNumber}</TableCell>
+                      <TableCell>
+                        <StatusPill status={row.status} />
+                      </TableCell>
+                      <TableCell className="text-xs font-mono">{row.httpStatus ?? '—'}</TableCell>
+                      <TableCell className="text-xs text-muted-foreground">
+                        {row.latencyMs != null ? `${row.latencyMs}ms` : '—'}
+                      </TableCell>
+                      <TableCell>
+                        <code className="text-[11px] bg-muted/40 px-1.5 py-0.5 rounded">
+                          {row.eventType}
+                        </code>
+                      </TableCell>
+                    </TableRow>
+                    {isOpen && (
+                      <TableRow className="bg-muted/20 hover:bg-muted/20">
+                        <TableCell />
+                        <TableCell colSpan={6} className="py-3">
+                          <DeliveryDetail row={row} />
+                        </TableCell>
+                      </TableRow>
+                    )}
+                  </Fragment>
+                )
+              })
+            )}
+          </TableBody>
+        </Table>
+      </div>
+
+      <div className="flex items-center justify-between">
+        <span className="text-xs text-muted-foreground">{rows.length} deliveries shown</span>
+        {query.hasNextPage && (
+          <Button
+            variant="outline"
+            size="sm"
+            disabled={query.isFetchingNextPage}
+            onClick={() => query.fetchNextPage()}
+          >
+            {query.isFetchingNextPage ? 'Loading…' : 'Load more'}
+          </Button>
+        )}
+      </div>
+    </div>
+  )
+}
+
+function DeliveryDetail({ row }: { row: DeliveryRow }) {
+  return (
+    <div className="space-y-3 text-xs">
+      <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
+        <Field label="Request URL" mono value={row.requestUrl} />
+        <Field label="Event ID" mono value={row.eventId} />
+        <Field label="Payload size" value={`${row.requestPayloadBytes} bytes`} />
+        <Field
+          label="Signature timestamp"
+          mono
+          value={`${row.signatureTimestamp} (${new Date(row.signatureTimestamp * 1000).toISOString()})`}
+        />
+        {row.nextRetryAt && (
+          <Field label="Next retry" value={new Date(row.nextRetryAt).toLocaleString()} />
+        )}
+      </div>
+
+      {row.errorMessage && (
+        <div className="space-y-1">
+          <div className="text-[11px] font-semibold uppercase tracking-wide text-destructive">
+            Error
+          </div>
+          <pre className="text-[11px] bg-destructive/10 text-destructive rounded p-2 overflow-x-auto whitespace-pre-wrap break-all">
+            {row.errorMessage}
+          </pre>
+        </div>
+      )}
+
+      {row.responseBodySnippet && (
+        <div className="space-y-1">
+          <div className="text-[11px] font-semibold uppercase tracking-wide text-muted-foreground">
+            Response body (snippet)
+          </div>
+          <pre className="text-[11px] bg-muted/40 rounded p-2 overflow-x-auto whitespace-pre-wrap break-all max-h-48">
+            {row.responseBodySnippet}
+          </pre>
+        </div>
+      )}
+    </div>
+  )
+}
+
+function Field({ label, value, mono = false }: { label: string; value: string; mono?: boolean }) {
+  return (
+    <div className="space-y-0.5 min-w-0">
+      <div className="text-[10px] font-semibold uppercase tracking-wide text-muted-foreground">
+        {label}
+      </div>
+      <div className={`text-[11px] truncate ${mono ? 'font-mono' : ''}`} title={value}>
+        {value}
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/webhooks/webhook-event-picker.tsx b/apps/web/src/components/admin/settings/webhooks/webhook-event-picker.tsx
new file mode 100644
index 000000000..02ac44cc2
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/webhook-event-picker.tsx
@@ -0,0 +1,163 @@
+'use client'
+
+import { useState } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import { ChevronDownIcon, ChevronRightIcon } from '@heroicons/react/24/outline'
+import { Checkbox } from '@/components/ui/checkbox'
+import { Label } from '@/components/ui/label'
+import {
+  WEBHOOK_EVENT_CATEGORIES,
+  WEBHOOK_EVENT_CONFIG,
+  type WebhookEventCategory,
+} from '@/lib/shared/webhook-events'
+import { fetchSamplePayloadsFn } from '@/lib/server/functions/webhooks'
+
+interface WebhookEventPickerProps {
+  value: string[]
+  onChange: (next: string[]) => void
+  disabled?: boolean
+}
+
+/**
+ * Grouped event picker shared by the create + edit webhook dialogs.
+ *
+ * Renders one section per `WEBHOOK_EVENT_CATEGORIES` entry with a
+ * "Select all" / "Clear" pair scoped to that category. Categories with no
+ * events (shouldn't happen given the static config, but defensive) are
+ * skipped.
+ */
+export function WebhookEventPicker({ value, onChange, disabled }: WebhookEventPickerProps) {
+  const [previewIds, setPreviewIds] = useState<Set<string>>(new Set())
+  const samplesQuery = useQuery({
+    queryKey: ['admin', 'webhook-sample-payloads'],
+    queryFn: () => fetchSamplePayloadsFn(),
+    enabled: previewIds.size > 0,
+    staleTime: Infinity,
+  })
+
+  const togglePreview = (eventId: string) => {
+    setPreviewIds((prev) => {
+      const next = new Set(prev)
+      if (next.has(eventId)) next.delete(eventId)
+      else next.add(eventId)
+      return next
+    })
+  }
+
+  const toggleEvent = (eventId: string) => {
+    onChange(value.includes(eventId) ? value.filter((e) => e !== eventId) : [...value, eventId])
+  }
+
+  const selectAllInCategory = (category: WebhookEventCategory) => {
+    const ids = WEBHOOK_EVENT_CONFIG.filter((e) => e.category === category).map((e) => e.id)
+    const merged = Array.from(new Set([...value, ...ids]))
+    onChange(merged)
+  }
+
+  const clearCategory = (category: WebhookEventCategory) => {
+    const ids = new Set<string>(
+      WEBHOOK_EVENT_CONFIG.filter((e) => e.category === category).map((e) => e.id)
+    )
+    onChange(value.filter((id) => !ids.has(id)))
+  }
+
+  return (
+    <div className="space-y-2">
+      <Label>Events</Label>
+      <div className="space-y-4">
+        {WEBHOOK_EVENT_CATEGORIES.map((category) => {
+          const events = WEBHOOK_EVENT_CONFIG.filter((e) => e.category === category.id)
+          if (events.length === 0) return null
+          const selectedInCategory = events.filter((e) => value.includes(e.id)).length
+          return (
+            <div key={category.id} className="space-y-2">
+              <div className="flex items-center justify-between">
+                <p className="text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+                  {category.label}
+                  <span className="ml-2 font-normal normal-case tracking-normal">
+                    ({selectedInCategory}/{events.length})
+                  </span>
+                </p>
+                <div className="flex items-center gap-2 text-xs">
+                  <button
+                    type="button"
+                    className="text-muted-foreground hover:text-foreground disabled:opacity-50"
+                    onClick={() => selectAllInCategory(category.id)}
+                    disabled={disabled || selectedInCategory === events.length}
+                  >
+                    Select all
+                  </button>
+                  <span className="text-muted-foreground/50">·</span>
+                  <button
+                    type="button"
+                    className="text-muted-foreground hover:text-foreground disabled:opacity-50"
+                    onClick={() => clearCategory(category.id)}
+                    disabled={disabled || selectedInCategory === 0}
+                  >
+                    Clear
+                  </button>
+                </div>
+              </div>
+              <div className="space-y-2">
+                {events.map((event) => {
+                  const isPreviewOpen = previewIds.has(event.id)
+                  const samples = samplesQuery.data as Record<string, unknown> | undefined
+                  const sample = samples?.[event.id]
+                  return (
+                    <div
+                      key={event.id}
+                      className="rounded-lg border hover:bg-muted/50 transition-colors"
+                    >
+                      <div className="flex items-start gap-3 p-3">
+                        <Checkbox
+                          checked={value.includes(event.id)}
+                          onCheckedChange={() => toggleEvent(event.id)}
+                          disabled={disabled}
+                          className="mt-0.5"
+                          aria-label={`Subscribe to ${event.label} events`}
+                        />
+                        <div className="flex-1 min-w-0">
+                          <p className="text-sm font-medium">{event.label}</p>
+                          <p className="text-xs text-muted-foreground">{event.description}</p>
+                        </div>
+                        <button
+                          type="button"
+                          onClick={() => togglePreview(event.id)}
+                          className="text-xs text-muted-foreground hover:text-foreground inline-flex items-center gap-1 shrink-0"
+                          aria-expanded={isPreviewOpen}
+                          aria-label={`${isPreviewOpen ? 'Hide' : 'Show'} sample payload for ${event.label}`}
+                        >
+                          {isPreviewOpen ? (
+                            <ChevronDownIcon className="h-3.5 w-3.5" />
+                          ) : (
+                            <ChevronRightIcon className="h-3.5 w-3.5" />
+                          )}
+                          Sample
+                        </button>
+                      </div>
+                      {isPreviewOpen && (
+                        <div className="border-t bg-muted/30 px-3 py-2">
+                          {samplesQuery.isLoading ? (
+                            <p className="text-[11px] text-muted-foreground">Loading…</p>
+                          ) : sample ? (
+                            <pre className="text-[11px] overflow-x-auto whitespace-pre max-h-64">
+                              {JSON.stringify(sample, null, 2)}
+                            </pre>
+                          ) : (
+                            <p className="text-[11px] text-muted-foreground">
+                              No sample available for this event.
+                            </p>
+                          )}
+                        </div>
+                      )}
+                    </div>
+                  )
+                })}
+              </div>
+            </div>
+          )
+        })}
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/webhooks/webhook-inbox-picker.tsx b/apps/web/src/components/admin/settings/webhooks/webhook-inbox-picker.tsx
new file mode 100644
index 000000000..13f18dc35
--- /dev/null
+++ b/apps/web/src/components/admin/settings/webhooks/webhook-inbox-picker.tsx
@@ -0,0 +1,84 @@
+'use client'
+
+import { useInboxes } from '@/lib/client/hooks/use-inboxes-queries'
+import { Checkbox } from '@/components/ui/checkbox'
+import { Label } from '@/components/ui/label'
+
+interface WebhookInboxPickerProps {
+  /** Currently selected inbox IDs (string ids; backend stores text[]). */
+  value: string[]
+  onChange: (next: string[]) => void
+  disabled?: boolean
+  /**
+   * When false, the picker still renders but is muted with a hint that the
+   * filter is ignored unless at least one ticket.* event is selected.
+   */
+  active: boolean
+}
+
+/**
+ * Optional inbox multi-select rendered under the event picker in the create
+ * and edit webhook dialogs. Empty selection means "all inboxes" (matches the
+ * backend semantics: `inboxIds === null || []` → match all).
+ *
+ * Phase 4 — per-inbox webhook filtering.
+ */
+export function WebhookInboxPicker({ value, onChange, disabled, active }: WebhookInboxPickerProps) {
+  const inboxesQuery = useInboxes({ includeArchived: false })
+  const inboxes = inboxesQuery.data ?? []
+
+  const toggle = (id: string) => {
+    onChange(value.includes(id) ? value.filter((v) => v !== id) : [...value, id])
+  }
+  const clear = () => onChange([])
+
+  return (
+    <div className="space-y-2" aria-disabled={!active}>
+      <div className="flex items-center justify-between">
+        <Label className={active ? '' : 'text-muted-foreground'}>Inboxes (optional)</Label>
+        {value.length > 0 && (
+          <button
+            type="button"
+            onClick={clear}
+            disabled={disabled}
+            className="text-xs text-muted-foreground hover:text-foreground disabled:opacity-50"
+          >
+            Clear
+          </button>
+        )}
+      </div>
+      <p className="text-xs text-muted-foreground">
+        {active
+          ? value.length === 0
+            ? 'Empty = match tickets in any inbox.'
+            : `Only deliver ticket events from the selected inbox${value.length === 1 ? '' : 'es'}.`
+          : 'Filter is ignored unless at least one ticket.* event is selected above.'}
+      </p>
+      {inboxesQuery.isLoading ? (
+        <p className="text-xs text-muted-foreground">Loading inboxes…</p>
+      ) : inboxes.length === 0 ? (
+        <p className="text-xs text-muted-foreground">No inboxes configured.</p>
+      ) : (
+        <div className="rounded-lg border divide-y max-h-48 overflow-y-auto">
+          {inboxes.map((inbox) => (
+            <label
+              key={inbox.id}
+              className="flex items-center gap-3 p-2 hover:bg-muted/50 transition-colors cursor-pointer"
+            >
+              <Checkbox
+                checked={value.includes(inbox.id)}
+                onCheckedChange={() => toggle(inbox.id)}
+                disabled={disabled || !active}
+                aria-label={`Filter by inbox ${inbox.name}`}
+              />
+              <div className="min-w-0 flex-1">
+                <p className="text-sm font-medium truncate">{inbox.name}</p>
+                <p className="text-xs text-muted-foreground truncate">{inbox.slug}</p>
+              </div>
+            </label>
+          ))}
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/settings/webhooks/webhooks-settings.tsx b/apps/web/src/components/admin/settings/webhooks/webhooks-settings.tsx
index 0eaea06ca..5fc7caafa 100644
--- a/apps/web/src/components/admin/settings/webhooks/webhooks-settings.tsx
+++ b/apps/web/src/components/admin/settings/webhooks/webhooks-settings.tsx
@@ -2,7 +2,13 @@
 
 import { useState } from 'react'
 import { formatDistanceToNow } from 'date-fns'
-import { PlusIcon, BoltIcon, TrashIcon, PencilIcon } from '@heroicons/react/24/outline'
+import {
+  PlusIcon,
+  BoltIcon,
+  TrashIcon,
+  PencilIcon,
+  QueueListIcon,
+} from '@heroicons/react/24/outline'
 import { EmptyState } from '@/components/shared/empty-state'
 import { EllipsisVerticalIcon } from '@heroicons/react/24/solid'
 import { Button } from '@/components/ui/button'
@@ -16,6 +22,7 @@ import {
 import { CreateWebhookDialog } from './create-webhook-dialog'
 import { EditWebhookDialog } from './edit-webhook-dialog'
 import { DeleteWebhookDialog } from './delete-webhook-dialog'
+import { WebhookDeliveriesDrawer } from './webhook-deliveries-drawer'
 import type { Webhook } from '@/lib/shared/types'
 
 const EVENT_LABELS: Record<string, string> = {
@@ -33,6 +40,7 @@ export function WebhooksSettings({ webhooks }: WebhooksSettingsProps) {
   const [createDialogOpen, setCreateDialogOpen] = useState(false)
   const [editWebhook, setEditWebhook] = useState<Webhook | null>(null)
   const [deleteWebhook, setDeleteWebhook] = useState<Webhook | null>(null)
+  const [deliveriesWebhook, setDeliveriesWebhook] = useState<Webhook | null>(null)
 
   const getStatusBadge = (webhook: Webhook) => {
     if (webhook.status === 'disabled') {
@@ -145,6 +153,14 @@ export function WebhooksSettings({ webhooks }: WebhooksSettingsProps) {
 
               {/* Desktop: show buttons */}
               <div className="hidden sm:flex items-center gap-2 shrink-0">
+                <Button
+                  variant="outline"
+                  size="sm"
+                  onClick={() => setDeliveriesWebhook(webhook)}
+                  aria-label={`View deliveries for ${webhook.url}`}
+                >
+                  <QueueListIcon className="h-4 w-4" />
+                </Button>
                 <Button
                   variant="outline"
                   size="sm"
@@ -173,6 +189,10 @@ export function WebhooksSettings({ webhooks }: WebhooksSettingsProps) {
                     </Button>
                   </DropdownMenuTrigger>
                   <DropdownMenuContent align="end">
+                    <DropdownMenuItem onClick={() => setDeliveriesWebhook(webhook)}>
+                      <QueueListIcon className="h-4 w-4 mr-2" />
+                      View deliveries
+                    </DropdownMenuItem>
                     <DropdownMenuItem onClick={() => setEditWebhook(webhook)}>
                       <PencilIcon className="h-4 w-4 mr-2" />
                       Edit Webhook
@@ -210,6 +230,11 @@ export function WebhooksSettings({ webhooks }: WebhooksSettingsProps) {
           onOpenChange={(open) => !open && setDeleteWebhook(null)}
         />
       )}
+
+      <WebhookDeliveriesDrawer
+        webhook={deliveriesWebhook}
+        onOpenChange={(open) => !open && setDeliveriesWebhook(null)}
+      />
     </div>
   )
 }
diff --git a/apps/web/src/components/admin/settings/widget/__tests__/widget-ticketing-toggle.test.tsx b/apps/web/src/components/admin/settings/widget/__tests__/widget-ticketing-toggle.test.tsx
new file mode 100644
index 000000000..a365dfed1
--- /dev/null
+++ b/apps/web/src/components/admin/settings/widget/__tests__/widget-ticketing-toggle.test.tsx
@@ -0,0 +1,74 @@
+// @vitest-environment happy-dom
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { WidgetTicketingToggle } from '../widget-ticketing-toggle'
+
+const mocks = vi.hoisted(() => ({
+  invalidate: vi.fn(),
+  updateWidgetConfigFn: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-router')>()
+  return {
+    ...actual,
+    useRouter: () => ({ invalidate: mocks.invalidate }),
+  }
+})
+
+vi.mock('@/lib/server/functions/settings', () => ({
+  updateWidgetConfigFn: mocks.updateWidgetConfigFn,
+}))
+
+afterEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('WidgetTicketingToggle', () => {
+  it('persists ticketing.enabled and invalidates settings', async () => {
+    mocks.updateWidgetConfigFn.mockResolvedValueOnce({})
+    const onEnabledChange = vi.fn()
+    render(<WidgetTicketingToggle initialEnabled={false} onEnabledChange={onEnabledChange} />)
+
+    fireEvent.click(screen.getByRole('switch', { name: 'Support tickets' }))
+
+    await waitFor(() =>
+      expect(mocks.updateWidgetConfigFn).toHaveBeenCalledWith({
+        data: { ticketing: { enabled: true } },
+      })
+    )
+    await waitFor(() => expect(mocks.invalidate).toHaveBeenCalledTimes(1))
+    expect(onEnabledChange).toHaveBeenCalledWith(true)
+  })
+
+  it('shows a saving state while the update is pending', async () => {
+    let resolveUpdate!: () => void
+    mocks.updateWidgetConfigFn.mockReturnValueOnce(
+      new Promise<void>((resolve) => {
+        resolveUpdate = resolve
+      })
+    )
+    render(<WidgetTicketingToggle initialEnabled={false} />)
+
+    fireEvent.click(screen.getByRole('switch', { name: 'Support tickets' }))
+
+    expect(screen.getByRole('switch', { name: 'Support tickets' })).toBeDisabled()
+    resolveUpdate()
+    await waitFor(() =>
+      expect(screen.getByRole('switch', { name: 'Support tickets' })).not.toBeDisabled()
+    )
+  })
+
+  it('rolls back local and preview state when saving fails', async () => {
+    mocks.updateWidgetConfigFn.mockRejectedValueOnce(new Error('failed'))
+    const onEnabledChange = vi.fn()
+    render(<WidgetTicketingToggle initialEnabled={false} onEnabledChange={onEnabledChange} />)
+
+    const toggle = screen.getByRole('switch', { name: 'Support tickets' })
+    fireEvent.click(toggle)
+
+    await waitFor(() => expect(toggle).not.toBeChecked())
+    expect(onEnabledChange).toHaveBeenNthCalledWith(1, true)
+    expect(onEnabledChange).toHaveBeenNthCalledWith(2, false)
+  })
+})
diff --git a/apps/web/src/components/admin/settings/widget/widget-ticketing-toggle.tsx b/apps/web/src/components/admin/settings/widget/widget-ticketing-toggle.tsx
new file mode 100644
index 000000000..c7027fb6d
--- /dev/null
+++ b/apps/web/src/components/admin/settings/widget/widget-ticketing-toggle.tsx
@@ -0,0 +1,69 @@
+import { useRouter } from '@tanstack/react-router'
+import { useState, useTransition } from 'react'
+import { SettingsCard } from '@/components/admin/settings/settings-card'
+import { InlineSpinner } from '@/components/admin/settings/inline-spinner'
+import { Label } from '@/components/ui/label'
+import { Switch } from '@/components/ui/switch'
+import { updateWidgetConfigFn } from '@/lib/server/functions/settings'
+
+interface WidgetTicketingToggleProps {
+  initialEnabled: boolean
+  onEnabledChange?: (enabled: boolean) => void
+}
+
+export function WidgetTicketingToggle({
+  initialEnabled,
+  onEnabledChange,
+}: WidgetTicketingToggleProps) {
+  const router = useRouter()
+  const [isPending, startTransition] = useTransition()
+  const [saving, setSaving] = useState(false)
+  const [enabled, setEnabled] = useState(initialEnabled)
+
+  async function handleToggle(checked: boolean) {
+    const previous = enabled
+    setEnabled(checked)
+    onEnabledChange?.(checked)
+    setSaving(true)
+    try {
+      await updateWidgetConfigFn({ data: { ticketing: { enabled: checked } } })
+      startTransition(() => router.invalidate())
+    } catch {
+      setEnabled(previous)
+      onEnabledChange?.(previous)
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const isBusy = saving || isPending
+
+  return (
+    <SettingsCard
+      title="Support tickets"
+      description="Let visitors open and follow up on support tickets from the widget."
+    >
+      <div className="flex items-center justify-between rounded-lg border border-border/50 p-4">
+        <div className="pr-4">
+          <Label htmlFor="widget-ticketing-toggle" className="text-sm font-medium cursor-pointer">
+            Enable support tickets in the widget
+          </Label>
+          <p className="text-xs text-muted-foreground mt-0.5">
+            Visitors can open and follow up on support tickets from the widget. Disabling this hides
+            ticket entry points and keeps widget ticket APIs unavailable.
+          </p>
+        </div>
+        <div className="flex items-center gap-2">
+          <InlineSpinner visible={isBusy} />
+          <Switch
+            id="widget-ticketing-toggle"
+            checked={enabled}
+            onCheckedChange={handleToggle}
+            disabled={isBusy}
+            aria-label="Support tickets"
+          />
+        </div>
+      </div>
+    </SettingsCard>
+  )
+}
diff --git a/apps/web/src/components/admin/shared/__tests__/principal-picker.test.tsx b/apps/web/src/components/admin/shared/__tests__/principal-picker.test.tsx
new file mode 100644
index 000000000..119eb824b
--- /dev/null
+++ b/apps/web/src/components/admin/shared/__tests__/principal-picker.test.tsx
@@ -0,0 +1,318 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { act } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { PrincipalPicker } from '../principal-picker'
+
+type PrincipalRow = {
+  id: string
+  displayName: string | null
+  email: string | null
+  avatarUrl: string | null
+  role: string
+}
+
+const mocks = vi.hoisted(() => ({
+  searchPrincipalsFn: vi.fn(),
+  getPrincipalsByIdsFn: vi.fn(),
+  searchRows: [] as PrincipalRow[],
+  selectedRows: [] as PrincipalRow[],
+  searchLoading: false,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQuery: (options: {
+    queryKey: readonly unknown[]
+    queryFn: () => unknown
+    enabled?: boolean
+  }) => {
+    const [, kind] = options.queryKey
+    if (options.enabled === false) {
+      return {
+        data: undefined,
+        isLoading: false,
+      }
+    }
+    options.queryFn()
+    return {
+      data: kind === 'search' ? mocks.searchRows : mocks.selectedRows,
+      isLoading: kind === 'search' ? mocks.searchLoading : false,
+    }
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    role,
+    'aria-expanded': ariaExpanded,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    role?: string
+    'aria-expanded'?: boolean
+    variant?: string
+    className?: string
+  }) => (
+    <button
+      type="button"
+      disabled={disabled}
+      onClick={onClick}
+      role={role}
+      aria-expanded={ariaExpanded}
+    >
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/popover', () => {
+  let currentOpen = false
+  let setOpen: (open: boolean) => void = () => undefined
+
+  return {
+    Popover: ({
+      open,
+      onOpenChange,
+      children,
+    }: {
+      open: boolean
+      onOpenChange: (open: boolean) => void
+      children: ReactNode
+    }) => {
+      currentOpen = open
+      setOpen = onOpenChange
+      return <div>{children}</div>
+    },
+    PopoverTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => (
+      <span onClick={() => setOpen(true)}>{children}</span>
+    ),
+    PopoverContent: ({ children }: { children: ReactNode; className?: string; align?: string }) =>
+      currentOpen ? <section role="listbox">{children}</section> : null,
+    PopoverAnchor: ({ children }: { children: ReactNode }) => <>{children}</>,
+  }
+})
+
+vi.mock('@/components/ui/command', () => ({
+  Command: ({ children }: { children: ReactNode; shouldFilter?: boolean }) => <div>{children}</div>,
+  CommandEmpty: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  CommandGroup: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  CommandInput: ({
+    value,
+    onValueChange,
+    placeholder,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    placeholder?: string
+  }) => (
+    <input
+      aria-label={placeholder}
+      value={value}
+      onChange={(event) => onValueChange(event.currentTarget.value)}
+    />
+  ),
+  CommandItem: ({
+    children,
+    onSelect,
+    value,
+  }: {
+    children: ReactNode
+    onSelect?: (value: string) => void
+    value: string
+    className?: string
+  }) => (
+    <button type="button" role="option" onClick={() => onSelect?.(value)}>
+      {children}
+    </button>
+  ),
+  CommandList: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+}))
+
+vi.mock('@/components/ui/avatar', () => ({
+  Avatar: ({ name, src }: { name?: string | null; src?: string | null; className?: string }) => (
+    <span>{src ? `avatar:${src}` : `avatar:${name ?? 'empty'}`}</span>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  CheckIcon: ({ className }: { className?: string }) => (
+    <span data-class-name={className}>check</span>
+  ),
+  ChevronUpDownIcon: () => <span aria-hidden="true">chevron</span>,
+}))
+
+vi.mock('@/lib/server/functions/principals', () => ({
+  searchPrincipalsFn: mocks.searchPrincipalsFn,
+  getPrincipalsByIdsFn: mocks.getPrincipalsByIdsFn,
+}))
+
+function row(overrides: Partial<PrincipalRow>): PrincipalRow {
+  return {
+    id: 'principal_1',
+    displayName: 'Ada Admin',
+    email: 'ada@example.com',
+    avatarUrl: null,
+    role: 'admin',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.clearAllMocks()
+  mocks.searchLoading = false
+  mocks.searchRows = [
+    row({ id: 'principal_1', displayName: 'Ada Admin', email: 'ada@example.com' }),
+    row({
+      id: 'principal_email_only',
+      displayName: null,
+      email: 'email-only@example.com',
+      role: 'user',
+    }),
+    row({
+      id: 'principal_id_only',
+      displayName: null,
+      email: null,
+      role: 'agent',
+      avatarUrl: 'https://example.com/avatar.png',
+    }),
+  ]
+  mocks.selectedRows = [row({ id: 'principal_1', displayName: 'Ada Admin' })]
+  mocks.searchPrincipalsFn.mockImplementation(() => mocks.searchRows)
+  mocks.getPrincipalsByIdsFn.mockImplementation(() => mocks.selectedRows)
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+function openPicker() {
+  fireEvent.click(screen.getByRole('combobox'))
+}
+
+describe('PrincipalPicker', () => {
+  it('renders placeholder labels, opens search and sends debounced search parameters', () => {
+    const onValueChange = vi.fn()
+    render(
+      <PrincipalPicker
+        value={null}
+        onValueChange={onValueChange}
+        placeholder="Pick person"
+        roleFilter={['user']}
+        excludeIds={['principal_1' as never]}
+        allowUnassigned
+      />
+    )
+
+    expect(screen.getByRole('combobox')).toHaveTextContent('Pick person')
+    expect(mocks.searchPrincipalsFn).not.toHaveBeenCalled()
+
+    openPicker()
+    expect(mocks.searchPrincipalsFn).toHaveBeenLastCalledWith({
+      data: {
+        query: undefined,
+        roleFilter: ['user'],
+        excludeIds: ['principal_1'],
+        limit: 25,
+      },
+    })
+
+    fireEvent.change(screen.getByLabelText('Search by name or email…'), {
+      target: { value: 'ada' },
+    })
+    act(() => {
+      vi.advanceTimersByTime(250)
+    })
+
+    expect(mocks.searchPrincipalsFn).toHaveBeenLastCalledWith({
+      data: {
+        query: 'ada',
+        roleFilter: ['user'],
+        excludeIds: ['principal_1'],
+        limit: 25,
+      },
+    })
+    expect(screen.getByText('Ada Admin')).toBeInTheDocument()
+    expect(screen.getAllByText('email-only@example.com')).toHaveLength(2)
+    expect(screen.getByText('principal_id_only')).toBeInTheDocument()
+    expect(screen.getByText('avatar:https://example.com/avatar.png')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('option', { name: /Unassigned/ }))
+    expect(onValueChange).toHaveBeenCalledWith(null)
+    expect(screen.queryByRole('listbox')).not.toBeInTheDocument()
+  })
+
+  it('selects a single principal, closes the popover and resolves selected labels', () => {
+    const onValueChange = vi.fn()
+    const { rerender } = render(<PrincipalPicker value={null} onValueChange={onValueChange} />)
+
+    openPicker()
+    fireEvent.click(screen.getByRole('option', { name: /Ada Admin/ }))
+
+    expect(onValueChange).toHaveBeenCalledWith('principal_1')
+    expect(screen.queryByRole('listbox')).not.toBeInTheDocument()
+
+    rerender(<PrincipalPicker value={'principal_1' as never} onValueChange={onValueChange} />)
+    expect(mocks.getPrincipalsByIdsFn).toHaveBeenCalledWith({
+      data: { ids: ['principal_1'] },
+    })
+    expect(screen.getByRole('combobox')).toHaveTextContent('Ada Admin')
+  })
+
+  it('adds and removes selections in multi-select mode and renders selected counts', () => {
+    const onValueChange = vi.fn()
+    const { rerender } = render(
+      <PrincipalPicker
+        multiple
+        value={[]}
+        onValueChange={onValueChange}
+        placeholder="Select recipients"
+      />
+    )
+
+    expect(screen.getByRole('combobox')).toHaveTextContent('Select recipients')
+    openPicker()
+    fireEvent.click(screen.getByRole('option', { name: /Ada Admin/ }))
+    expect(onValueChange).toHaveBeenCalledWith(['principal_1'])
+
+    mocks.selectedRows = [row({ id: 'principal_1', displayName: null, email: 'ada@example.com' })]
+    rerender(
+      <PrincipalPicker multiple value={['principal_1' as never]} onValueChange={onValueChange} />
+    )
+    expect(screen.getByRole('combobox')).toHaveTextContent('ada@example.com')
+
+    openPicker()
+    fireEvent.click(screen.getByRole('option', { name: /Ada Admin/ }))
+    expect(onValueChange).toHaveBeenCalledWith([])
+
+    rerender(
+      <PrincipalPicker
+        multiple
+        value={['principal_1' as never, 'principal_2' as never]}
+        onValueChange={onValueChange}
+      />
+    )
+    expect(screen.getByRole('combobox')).toHaveTextContent('2 selected')
+  })
+
+  it('renders loading and no-match states and respects disabled trigger state', () => {
+    mocks.searchRows = []
+    mocks.searchLoading = true
+    const { rerender } = render(<PrincipalPicker value={null} onValueChange={vi.fn()} disabled />)
+
+    expect(screen.getByRole('combobox')).toBeDisabled()
+
+    rerender(<PrincipalPicker value={null} onValueChange={vi.fn()} />)
+    openPicker()
+    expect(screen.getByText('Searching…')).toBeInTheDocument()
+
+    mocks.searchLoading = false
+    rerender(<PrincipalPicker value={null} onValueChange={vi.fn()} />)
+    expect(screen.getByText('No matches.')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/shared/__tests__/resource-pickers.test.tsx b/apps/web/src/components/admin/shared/__tests__/resource-pickers.test.tsx
new file mode 100644
index 000000000..8e6c53244
--- /dev/null
+++ b/apps/web/src/components/admin/shared/__tests__/resource-pickers.test.tsx
@@ -0,0 +1,382 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { ContactPicker } from '../contact-picker'
+import { InboxPicker } from '../inbox-picker'
+import { OrgPicker } from '../org-picker'
+import { PermissionGate } from '../permission-gate'
+import { ResourcePicker } from '../resource-picker'
+import { StatusPicker } from '../status-picker'
+import { TeamPicker } from '../team-picker'
+
+const mocks = vi.hoisted(() => ({
+  contactSearchCalls: [] as Array<[string, boolean]>,
+  organizationCalls: [] as Array<{ query?: string }>,
+  inboxCalls: [] as Array<{ includeArchived?: boolean }>,
+  teamCalls: [] as Array<{ includeArchived?: boolean }>,
+  hasPermission: true,
+}))
+
+vi.mock('@/lib/client/hooks/use-orgs-contacts-queries', () => ({
+  useContactSearch: (query: string, enabled: boolean) => {
+    mocks.contactSearchCalls.push([query, enabled])
+    return {
+      isLoading: query === 'loading',
+      data:
+        query === 'empty'
+          ? []
+          : [
+              { id: 'contact_1', name: 'Ada Lovelace', email: 'ada@example.com' },
+              { id: 'contact_2', name: null, email: 'contact@example.com' },
+            ],
+    }
+  },
+  useOrganizations: (params: { query?: string }) => {
+    mocks.organizationCalls.push(params)
+    return {
+      isLoading: params.query === 'loading',
+      data:
+        params.query === 'empty'
+          ? []
+          : [
+              { id: 'org_1', name: 'Acme', domain: 'acme.com' },
+              { id: 'org_2', name: 'Globex', domain: null },
+            ],
+    }
+  },
+}))
+
+vi.mock('@/lib/client/hooks/use-inboxes-queries', () => ({
+  useInboxes: (params: { includeArchived?: boolean }) => {
+    mocks.inboxCalls.push(params)
+    return {
+      isLoading: false,
+      data: [
+        { id: 'inbox_1', name: 'Support', slug: 'support' },
+        { id: 'inbox_2', name: 'Billing', slug: 'billing' },
+      ],
+    }
+  },
+}))
+
+vi.mock('@/lib/client/hooks/use-teams-queries', () => ({
+  useTeams: (params: { includeArchived?: boolean }) => {
+    mocks.teamCalls.push(params)
+    return {
+      isLoading: false,
+      data: [
+        { id: 'team_1', name: 'Success', slug: 'success', color: '#22c55e', shortLabel: 'CS' },
+        { id: 'team_2', name: 'Sales', slug: 'sales', color: null, shortLabel: null },
+      ],
+    }
+  },
+}))
+
+vi.mock('@/lib/client/hooks/use-tickets-queries', () => ({
+  useTicketStatuses: () => ({
+    isLoading: false,
+    data: [
+      { id: 'status_1', name: 'Open', category: 'open', color: '#22c55e' },
+      { id: 'status_2', name: 'Closed', category: 'closed', color: null },
+    ],
+  }),
+}))
+
+vi.mock('@/lib/client/hooks/use-authz-queries', () => ({
+  useHasPermission: vi.fn((_permission, _params) => mocks.hasPermission),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    disabled,
+    role,
+    'aria-expanded': ariaExpanded,
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    disabled?: boolean
+    role?: string
+    'aria-expanded'?: boolean
+    variant?: string
+    className?: string
+  }) => (
+    <button
+      type="button"
+      role={role}
+      aria-expanded={ariaExpanded}
+      disabled={disabled}
+      onClick={onClick}
+    >
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/popover', async () => {
+  const React = await import('react')
+  const PopoverContext = React.createContext<{ open: boolean; setOpen: (open: boolean) => void }>({
+    open: false,
+    setOpen: () => {},
+  })
+  return {
+    Popover: ({
+      children,
+      open,
+      onOpenChange,
+    }: {
+      children: ReactNode
+      open: boolean
+      onOpenChange: (open: boolean) => void
+    }) => (
+      <PopoverContext.Provider value={{ open, setOpen: onOpenChange }}>
+        <div>{children}</div>
+      </PopoverContext.Provider>
+    ),
+    PopoverContent: ({ children }: { children: ReactNode; className?: string; align?: string }) => {
+      const context = React.useContext(PopoverContext)
+      return context.open ? <section>{children}</section> : null
+    },
+    PopoverTrigger: ({ children }: { children: React.ReactElement; asChild?: boolean }) => {
+      const context = React.useContext(PopoverContext)
+      return React.cloneElement(children as React.ReactElement<{ onClick?: () => void }>, {
+        onClick: () => context.setOpen(true),
+      })
+    },
+  }
+})
+
+vi.mock('@/components/ui/command', () => ({
+  Command: ({ children }: { children: ReactNode; shouldFilter?: boolean }) => <div>{children}</div>,
+  CommandEmpty: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  CommandGroup: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  CommandInput: ({
+    placeholder,
+    value,
+    onValueChange,
+  }: {
+    placeholder?: string
+    value: string
+    onValueChange: (value: string) => void
+  }) => (
+    <input
+      placeholder={placeholder}
+      value={value}
+      onChange={(event) => onValueChange(event.currentTarget.value)}
+    />
+  ),
+  CommandItem: ({
+    children,
+    onSelect,
+    value,
+  }: {
+    children: ReactNode
+    onSelect?: () => void
+    value?: string
+    className?: string
+  }) => (
+    <button type="button" data-value={value} onClick={onSelect}>
+      {children}
+    </button>
+  ),
+  CommandList: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  CheckIcon: ({ className }: { className?: string }) => <span className={className}>check</span>,
+  ChevronUpDownIcon: () => <span aria-hidden="true">chevron</span>,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.contactSearchCalls = []
+  mocks.organizationCalls = []
+  mocks.inboxCalls = []
+  mocks.teamCalls = []
+  mocks.hasPermission = true
+})
+
+describe('ResourcePicker', () => {
+  it('selects, clears, searches, and renders labels for single values', () => {
+    const onValueChange = vi.fn()
+    const onSearchChange = vi.fn()
+    const { rerender } = render(
+      <ResourcePicker
+        value={null}
+        onValueChange={onValueChange}
+        options={[
+          { id: 'alpha', label: 'Alpha', description: 'First', trailing: <span>new</span> },
+          { id: 'beta', label: 'Beta', leading: <span>avatar</span> },
+        ]}
+        placeholder="Pick one"
+        searchPlaceholder="Search resources"
+        emptyMessage="Nothing here"
+        allowClear
+        clearLabel="No resource"
+        onSearchChange={onSearchChange}
+      />
+    )
+
+    expect(screen.getByRole('combobox')).toHaveTextContent('Pick one')
+    fireEvent.click(screen.getByRole('combobox'))
+    expect(screen.getByText('No resource')).toBeInTheDocument()
+    fireEvent.change(screen.getByPlaceholderText('Search resources'), {
+      target: { value: 'be' },
+    })
+    expect(onSearchChange).toHaveBeenCalledWith('be')
+    fireEvent.click(screen.getByRole('button', { name: /Beta/ }))
+    expect(onValueChange).toHaveBeenCalledWith('beta')
+
+    rerender(
+      <ResourcePicker
+        value="alpha"
+        onValueChange={onValueChange}
+        options={[{ id: 'alpha', label: 'Alpha', description: 'First' }]}
+        allowClear
+      />
+    )
+    expect(screen.getByRole('combobox')).toHaveTextContent('Alpha')
+    fireEvent.click(screen.getByRole('combobox'))
+    fireEvent.click(screen.getByRole('button', { name: /Clear/ }))
+    expect(onValueChange).toHaveBeenCalledWith(null)
+  })
+
+  it('toggles multiple values and reports loading empty state', () => {
+    const onValueChange = vi.fn()
+    const { rerender } = render(
+      <ResourcePicker
+        multiple
+        value={['alpha', 'missing']}
+        onValueChange={onValueChange}
+        options={[
+          { id: 'alpha', label: 'Alpha' },
+          { id: 'beta', label: 'Beta' },
+        ]}
+        placeholder="Pick many"
+      />
+    )
+
+    expect(screen.getByRole('combobox')).toHaveTextContent('2 selected')
+    fireEvent.click(screen.getByRole('combobox'))
+    fireEvent.click(screen.getByRole('button', { name: /Alpha/ }))
+    expect(onValueChange).toHaveBeenCalledWith(['missing'])
+    fireEvent.click(screen.getByRole('button', { name: /Beta/ }))
+    expect(onValueChange).toHaveBeenCalledWith(['alpha', 'missing', 'beta'])
+
+    rerender(
+      <ResourcePicker
+        multiple
+        value={[]}
+        onValueChange={onValueChange}
+        options={[]}
+        isLoading
+        emptyMessage="No values"
+      />
+    )
+    fireEvent.click(screen.getByRole('combobox'))
+    expect(screen.getByText(/Loading/)).toBeInTheDocument()
+  })
+})
+
+describe('picker wrappers', () => {
+  it('maps contacts, organizations, and inboxes into resource options', () => {
+    const onContactChange = vi.fn()
+    const onOrgChange = vi.fn()
+    const onInboxChange = vi.fn()
+    const onInboxMultiChange = vi.fn()
+    const onTeamChange = vi.fn()
+    const onTeamMultiChange = vi.fn()
+    const onStatusChange = vi.fn()
+
+    render(
+      <>
+        <ContactPicker value={null} onValueChange={onContactChange} allowClear />
+        <OrgPicker value={null} onValueChange={onOrgChange} allowClear />
+        <InboxPicker value={null} onValueChange={onInboxChange} includeArchived allowClear />
+        <InboxPicker multiple value={['inbox_1' as never]} onValueChange={onInboxMultiChange} />
+        <TeamPicker value={null} onValueChange={onTeamChange} includeArchived allowClear />
+        <TeamPicker multiple value={['team_1' as never]} onValueChange={onTeamMultiChange} />
+        <StatusPicker value={null} onValueChange={onStatusChange} />
+      </>
+    )
+
+    fireEvent.click(screen.getAllByRole('combobox')[0]!)
+    fireEvent.change(screen.getByPlaceholderText(/Search by name or email/), {
+      target: { value: 'ada' },
+    })
+    expect(mocks.contactSearchCalls.at(-1)).toEqual(['ada', true])
+    fireEvent.click(screen.getByRole('button', { name: /Ada Lovelace/ }))
+    expect(onContactChange).toHaveBeenCalledWith('contact_1')
+
+    fireEvent.click(screen.getAllByRole('combobox')[1]!)
+    fireEvent.change(screen.getByPlaceholderText(/Search organizations/), {
+      target: { value: 'acme' },
+    })
+    expect(mocks.organizationCalls.at(-1)).toEqual({ query: 'acme' })
+    fireEvent.click(screen.getByRole('button', { name: /Acme/ }))
+    expect(onOrgChange).toHaveBeenCalledWith('org_1')
+
+    fireEvent.click(screen.getAllByRole('combobox')[2]!)
+    expect(mocks.inboxCalls[0]).toEqual({ includeArchived: true })
+    fireEvent.click(screen.getByRole('button', { name: /Support/ }))
+    expect(onInboxChange).toHaveBeenCalledWith('inbox_1')
+
+    fireEvent.click(screen.getAllByRole('combobox')[3]!)
+    fireEvent.click(screen.getAllByRole('button', { name: /Billing/ }).at(-1)!)
+    expect(onInboxMultiChange).toHaveBeenCalledWith(['inbox_1', 'inbox_2'])
+
+    fireEvent.click(screen.getAllByRole('combobox')[4]!)
+    expect(mocks.teamCalls[0]).toEqual({ includeArchived: true })
+    fireEvent.click(screen.getAllByRole('button', { name: /Success/ }).at(-1)!)
+    expect(onTeamChange).toHaveBeenCalledWith('team_1')
+
+    fireEvent.click(screen.getAllByRole('combobox')[5]!)
+    fireEvent.click(screen.getAllByRole('button', { name: /Sales/ }).at(-1)!)
+    expect(onTeamMultiChange).toHaveBeenCalledWith(['team_1', 'team_2'])
+
+    fireEvent.click(screen.getAllByRole('combobox')[6]!)
+    fireEvent.click(screen.getAllByRole('button', { name: /Closed/ }).at(-1)!)
+    expect(onStatusChange).toHaveBeenCalledWith('status_2')
+  })
+
+  it('renders wrapper empty and loading messages', () => {
+    const { rerender } = render(<ContactPicker value={null} onValueChange={vi.fn()} />)
+
+    fireEvent.click(screen.getByRole('combobox'))
+    expect(screen.getByText(/Type to search/)).toBeInTheDocument()
+
+    rerender(<OrgPicker value={null} onValueChange={vi.fn()} />)
+    fireEvent.click(screen.getByRole('combobox'))
+    fireEvent.change(screen.getByPlaceholderText(/Search organizations/), {
+      target: { value: 'empty' },
+    })
+    expect(screen.getByText('No matches.')).toBeInTheDocument()
+  })
+})
+
+describe('PermissionGate', () => {
+  it('renders children or fallback from permission state', () => {
+    const { rerender } = render(
+      <PermissionGate
+        permission="ticket.view_all"
+        teamId={'team_1' as never}
+        fallback={<span>Denied</span>}
+      >
+        <span>Allowed</span>
+      </PermissionGate>
+    )
+
+    expect(screen.getByText('Allowed')).toBeInTheDocument()
+
+    mocks.hasPermission = false
+    rerender(
+      <PermissionGate permission="ticket.view_all" loadingFallback fallback={<span>Denied</span>}>
+        <span>Allowed</span>
+      </PermissionGate>
+    )
+
+    expect(screen.getByText('Denied')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/shared/__tests__/shared-controls.test.tsx b/apps/web/src/components/admin/shared/__tests__/shared-controls.test.tsx
new file mode 100644
index 000000000..e97d634da
--- /dev/null
+++ b/apps/web/src/components/admin/shared/__tests__/shared-controls.test.tsx
@@ -0,0 +1,138 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { createRouteErrorComponent, RouteErrorBoundary } from '../route-error-boundary'
+import { ScopeSelector } from '../scope-selector'
+
+vi.mock('@/components/ui/alert', () => ({
+  Alert: ({ children }: { children: ReactNode; variant?: string; className?: string }) => (
+    <section role="alert">{children}</section>
+  ),
+  AlertDescription: ({ children }: { children: ReactNode; className?: string }) => (
+    <div>{children}</div>
+  ),
+  AlertTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    variant?: string
+    size?: string
+    className?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('../team-picker', () => ({
+  TeamPicker: ({
+    value,
+    onValueChange,
+    disabled,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    disabled?: boolean
+  }) => (
+    <section>
+      Team picker {value ?? 'none'}
+      <button type="button" disabled={disabled} onClick={() => onValueChange('team_2')}>
+        Pick team
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('../inbox-picker', () => ({
+  InboxPicker: ({
+    value,
+    onValueChange,
+    disabled,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    disabled?: boolean
+  }) => (
+    <section>
+      Inbox picker {value ?? 'none'}
+      <button type="button" disabled={disabled} onClick={() => onValueChange('inbox_2')}>
+        Pick inbox
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ExclamationCircleIcon: () => <span aria-hidden="true">error</span>,
+}))
+
+describe('RouteErrorBoundary', () => {
+  it('renders errors and factory-bound titles with reset actions', () => {
+    const reset = vi.fn()
+    const { rerender } = render(
+      <RouteErrorBoundary error={new Error('Loader failed')} reset={reset} title="Custom failure" />
+    )
+
+    expect(screen.getByRole('heading', { name: 'Custom failure' })).toBeInTheDocument()
+    expect(screen.getByText('Loader failed')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Try again' }))
+    expect(reset).toHaveBeenCalled()
+
+    const Bound = createRouteErrorComponent('Bound failure')
+    rerender(<Bound error={new Error('Route failed')} reset={reset} />)
+    expect(screen.getByRole('heading', { name: 'Bound failure' })).toBeInTheDocument()
+    expect(screen.getByText('Route failed')).toBeInTheDocument()
+  })
+})
+
+describe('ScopeSelector', () => {
+  it('switches workspace, team, and inbox scopes', () => {
+    const onValueChange = vi.fn()
+    const { rerender } = render(
+      <ScopeSelector
+        value={{ kind: 'workspace' }}
+        onValueChange={onValueChange}
+        allowedKinds={['workspace', 'team', 'inbox']}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'team' }))
+    expect(onValueChange).toHaveBeenCalledWith({ kind: 'team', teamId: null, inboxId: null })
+
+    rerender(
+      <ScopeSelector
+        value={{ kind: 'team', teamId: 'team_1' as never }}
+        onValueChange={onValueChange}
+      />
+    )
+    expect(screen.getByText(/Team picker team_1/)).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Pick team' }))
+    expect(onValueChange).toHaveBeenCalledWith({
+      kind: 'team',
+      teamId: 'team_2',
+      inboxId: null,
+    })
+
+    rerender(
+      <ScopeSelector
+        value={{ kind: 'inbox', inboxId: 'inbox_1' as never }}
+        onValueChange={onValueChange}
+        disabled
+      />
+    )
+    expect(screen.getByText(/Inbox picker inbox_1/)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Pick inbox' })).toBeDisabled()
+  })
+})
diff --git a/apps/web/src/components/admin/shared/contact-picker.tsx b/apps/web/src/components/admin/shared/contact-picker.tsx
new file mode 100644
index 000000000..921efad71
--- /dev/null
+++ b/apps/web/src/components/admin/shared/contact-picker.tsx
@@ -0,0 +1,43 @@
+/**
+ * `<ContactPicker />` — single contact picker with cross-org search.
+ */
+import { useState } from 'react'
+import type { ContactId } from '@quackback/ids'
+import { useContactSearch } from '@/lib/client/hooks/use-orgs-contacts-queries'
+import { ResourcePicker } from './resource-picker'
+
+interface Props {
+  value: ContactId | null
+  onValueChange: (value: ContactId | null) => void
+  placeholder?: string
+  className?: string
+  disabled?: boolean
+  allowClear?: boolean
+}
+
+export function ContactPicker(props: Props) {
+  const [query, setQuery] = useState('')
+  const { data: contacts = [], isLoading } = useContactSearch(query, query.length > 0)
+  const options = contacts.map((c) => ({
+    id: c.id as ContactId,
+    label: c.name ?? c.email ?? c.id,
+    description: c.email ?? undefined,
+  }))
+  return (
+    <ResourcePicker<ContactId>
+      value={props.value}
+      onValueChange={props.onValueChange}
+      options={options}
+      isLoading={isLoading}
+      placeholder={props.placeholder ?? 'Select contact…'}
+      searchPlaceholder="Search by name or email…"
+      emptyMessage={
+        query.length === 0 ? 'Type to search…' : isLoading ? 'Searching…' : 'No matches.'
+      }
+      disabled={props.disabled}
+      className={props.className}
+      allowClear={props.allowClear}
+      onSearchChange={setQuery}
+    />
+  )
+}
diff --git a/apps/web/src/components/admin/shared/inbox-picker.tsx b/apps/web/src/components/admin/shared/inbox-picker.tsx
new file mode 100644
index 000000000..c6bfc23b8
--- /dev/null
+++ b/apps/web/src/components/admin/shared/inbox-picker.tsx
@@ -0,0 +1,69 @@
+/**
+ * `<InboxPicker />` — single/multi inbox picker.
+ */
+import type { InboxId } from '@quackback/ids'
+import { useInboxes } from '@/lib/client/hooks/use-inboxes-queries'
+import { ResourcePicker } from './resource-picker'
+
+interface BaseProps {
+  placeholder?: string
+  className?: string
+  disabled?: boolean
+  includeArchived?: boolean
+}
+
+interface SingleProps extends BaseProps {
+  multiple?: false
+  value: InboxId | null
+  onValueChange: (value: InboxId | null) => void
+  allowClear?: boolean
+}
+
+interface MultiProps extends BaseProps {
+  multiple: true
+  value: InboxId[]
+  onValueChange: (value: InboxId[]) => void
+}
+
+export function InboxPicker(props: SingleProps | MultiProps) {
+  const { data: inboxes = [], isLoading } = useInboxes({
+    includeArchived: props.includeArchived,
+  })
+
+  const options = inboxes.map((i) => ({
+    id: i.id as InboxId,
+    label: i.name,
+    description: i.slug,
+  }))
+
+  if (props.multiple) {
+    return (
+      <ResourcePicker<InboxId>
+        multiple
+        value={props.value}
+        onValueChange={props.onValueChange}
+        options={options}
+        isLoading={isLoading}
+        placeholder={props.placeholder ?? 'Select inboxes…'}
+        searchPlaceholder="Search inboxes…"
+        emptyMessage="No inboxes."
+        disabled={props.disabled}
+        className={props.className}
+      />
+    )
+  }
+  return (
+    <ResourcePicker<InboxId>
+      value={props.value}
+      onValueChange={props.onValueChange}
+      options={options}
+      isLoading={isLoading}
+      placeholder={props.placeholder ?? 'Select inbox…'}
+      searchPlaceholder="Search inboxes…"
+      emptyMessage="No inboxes."
+      disabled={props.disabled}
+      className={props.className}
+      allowClear={props.allowClear}
+    />
+  )
+}
diff --git a/apps/web/src/components/admin/shared/index.ts b/apps/web/src/components/admin/shared/index.ts
new file mode 100644
index 000000000..5839b0e0b
--- /dev/null
+++ b/apps/web/src/components/admin/shared/index.ts
@@ -0,0 +1,16 @@
+/**
+ * Barrel export for shared admin/agent UI primitives.
+ */
+export { PermissionGate } from './permission-gate'
+export { PrincipalPicker } from './principal-picker'
+export { TeamPicker } from './team-picker'
+export { InboxPicker } from './inbox-picker'
+export { StatusPicker } from './status-picker'
+export { OrgPicker } from './org-picker'
+export { ContactPicker } from './contact-picker'
+export { ScopeSelector } from './scope-selector'
+export type { ScopeKind, ScopeValue } from './scope-selector'
+export { ResourcePicker } from './resource-picker'
+export type { PickerOption, ResourcePickerProps } from './resource-picker'
+export { RouteErrorBoundary, createRouteErrorComponent } from './route-error-boundary'
+export type { RouteErrorBoundaryProps } from './route-error-boundary'
diff --git a/apps/web/src/components/admin/shared/org-picker.tsx b/apps/web/src/components/admin/shared/org-picker.tsx
new file mode 100644
index 000000000..a7c6a3d27
--- /dev/null
+++ b/apps/web/src/components/admin/shared/org-picker.tsx
@@ -0,0 +1,41 @@
+/**
+ * `<OrgPicker />` — single organization picker with type-ahead.
+ */
+import { useState } from 'react'
+import type { OrganizationId } from '@quackback/ids'
+import { useOrganizations } from '@/lib/client/hooks/use-orgs-contacts-queries'
+import { ResourcePicker } from './resource-picker'
+
+interface Props {
+  value: OrganizationId | null
+  onValueChange: (value: OrganizationId | null) => void
+  placeholder?: string
+  className?: string
+  disabled?: boolean
+  allowClear?: boolean
+}
+
+export function OrgPicker(props: Props) {
+  const [query, setQuery] = useState('')
+  const { data: orgs = [], isLoading } = useOrganizations({ query: query || undefined })
+  const options = orgs.map((o) => ({
+    id: o.id as OrganizationId,
+    label: o.name,
+    description: o.domain ?? undefined,
+  }))
+  return (
+    <ResourcePicker<OrganizationId>
+      value={props.value}
+      onValueChange={props.onValueChange}
+      options={options}
+      isLoading={isLoading}
+      placeholder={props.placeholder ?? 'Select organization…'}
+      searchPlaceholder="Search organizations…"
+      emptyMessage={isLoading ? 'Searching…' : 'No matches.'}
+      disabled={props.disabled}
+      className={props.className}
+      allowClear={props.allowClear}
+      onSearchChange={setQuery}
+    />
+  )
+}
diff --git a/apps/web/src/components/admin/shared/permission-gate.tsx b/apps/web/src/components/admin/shared/permission-gate.tsx
new file mode 100644
index 000000000..5959cb46f
--- /dev/null
+++ b/apps/web/src/components/admin/shared/permission-gate.tsx
@@ -0,0 +1,33 @@
+/**
+ * `<PermissionGate />` — render children only if the actor holds `permission`.
+ *
+ * Renders nothing while the underlying permission query is loading unless
+ * `loadingFallback` is provided. Use the `fallback` prop to render an
+ * alternate UI (e.g. an explanatory tooltip) when the actor is denied.
+ */
+import type { ReactNode } from 'react'
+import type { TeamId } from '@quackback/ids'
+import { useHasPermission } from '@/lib/client/hooks/use-authz-queries'
+import type { PermissionKey } from '@/lib/server/domains/authz'
+
+interface PermissionGateProps {
+  permission: PermissionKey
+  /** Optional team scope — passes `teamId` through to `useHasPermission`. */
+  teamId?: TeamId | null
+  children: ReactNode
+  fallback?: ReactNode
+  /** When true, treat loading state as "allowed" so the UI renders optimistically. */
+  loadingFallback?: boolean
+}
+
+export function PermissionGate({
+  permission,
+  teamId,
+  children,
+  fallback = null,
+  loadingFallback,
+}: PermissionGateProps) {
+  const allowed = useHasPermission(permission, { teamId, loadingFallback })
+  if (!allowed) return <>{fallback}</>
+  return <>{children}</>
+}
diff --git a/apps/web/src/components/admin/shared/principal-picker.tsx b/apps/web/src/components/admin/shared/principal-picker.tsx
new file mode 100644
index 000000000..56cf41805
--- /dev/null
+++ b/apps/web/src/components/admin/shared/principal-picker.tsx
@@ -0,0 +1,202 @@
+/**
+ * `<PrincipalPicker />` — async combobox over `searchPrincipalsFn`.
+ *
+ * Fires a debounced query as the user types and renders a picker list with
+ * avatar + name + email + role. Used by every assignee / member / recipient
+ * affordance in the agent and admin UIs.
+ */
+import { useState, useMemo, useEffect } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import { ChevronUpDownIcon, CheckIcon } from '@heroicons/react/24/solid'
+import type { PrincipalId } from '@quackback/ids'
+import {
+  Command,
+  CommandEmpty,
+  CommandGroup,
+  CommandInput,
+  CommandItem,
+  CommandList,
+} from '@/components/ui/command'
+import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import { Button } from '@/components/ui/button'
+import { Avatar } from '@/components/ui/avatar'
+import { cn } from '@/lib/shared/utils'
+import {
+  searchPrincipalsFn,
+  getPrincipalsByIdsFn,
+  type PrincipalSearchRow,
+} from '@/lib/server/functions/principals'
+
+interface BaseProps {
+  placeholder?: string
+  /** Filter the search to specific principal roles (e.g. 'user' for portal users). */
+  roleFilter?: string[]
+  /** Hide these IDs from the result list. Useful for "add member" flows. */
+  excludeIds?: PrincipalId[]
+  disabled?: boolean
+  className?: string
+}
+
+interface SinglePickerProps extends BaseProps {
+  multiple?: false
+  value: PrincipalId | null
+  onValueChange: (value: PrincipalId | null) => void
+  /** Show "Unassigned" sentinel option that emits `null`. */
+  allowUnassigned?: boolean
+}
+
+interface MultiPickerProps extends BaseProps {
+  multiple: true
+  value: PrincipalId[]
+  onValueChange: (value: PrincipalId[]) => void
+}
+
+type PrincipalPickerProps = SinglePickerProps | MultiPickerProps
+
+const principalSearchKey = (q: string, roleFilter?: string[], excludeIds?: PrincipalId[]) =>
+  ['principals', 'search', q, roleFilter ?? [], excludeIds ?? []] as const
+
+export function PrincipalPicker(props: PrincipalPickerProps) {
+  const [open, setOpen] = useState(false)
+  const [search, setSearch] = useState('')
+  const [debouncedSearch, setDebouncedSearch] = useState('')
+  useEffect(() => {
+    const t = setTimeout(() => setDebouncedSearch(search), 200)
+    return () => clearTimeout(t)
+  }, [search])
+
+  const { data: results = [], isLoading } = useQuery({
+    queryKey: principalSearchKey(debouncedSearch, props.roleFilter, props.excludeIds),
+    queryFn: () =>
+      searchPrincipalsFn({
+        data: {
+          query: debouncedSearch || undefined,
+          roleFilter: props.roleFilter,
+          excludeIds: props.excludeIds,
+          limit: 25,
+        },
+      }),
+    enabled: open,
+    staleTime: 30_000,
+  })
+
+  // Resolve labels for current value(s) so the trigger always renders.
+  const valueIds = useMemo<PrincipalId[]>(
+    () => (props.multiple ? props.value : props.value ? [props.value] : []),
+    [props]
+  )
+  const { data: selected = [] } = useQuery({
+    queryKey: ['principals', 'byIds', valueIds],
+    queryFn: () => getPrincipalsByIdsFn({ data: { ids: valueIds } }),
+    enabled: valueIds.length > 0,
+    staleTime: 60_000,
+  })
+
+  const selectedById = useMemo(() => new Map(selected.map((s) => [s.id, s] as const)), [selected])
+
+  function toggle(id: PrincipalId) {
+    if (props.multiple) {
+      const next = props.value.includes(id)
+        ? props.value.filter((v) => v !== id)
+        : [...props.value, id]
+      props.onValueChange(next)
+    } else {
+      props.onValueChange(id)
+      setOpen(false)
+    }
+  }
+
+  function renderTriggerLabel() {
+    if (props.multiple) {
+      if (props.value.length === 0) return props.placeholder ?? 'Select people…'
+      if (props.value.length === 1) {
+        const row = selectedById.get(props.value[0]!)
+        return labelOf(row) ?? '1 selected'
+      }
+      return `${props.value.length} selected`
+    }
+    if (!props.value) return props.placeholder ?? 'Select person…'
+    const row = selectedById.get(props.value)
+    return labelOf(row) ?? '…'
+  }
+
+  return (
+    <Popover open={open} onOpenChange={setOpen}>
+      <PopoverTrigger asChild>
+        <Button
+          variant="outline"
+          role="combobox"
+          aria-expanded={open}
+          disabled={props.disabled}
+          className={cn('w-full justify-between font-normal', props.className)}
+        >
+          <span className="truncate">{renderTriggerLabel()}</span>
+          <ChevronUpDownIcon className="ml-2 h-4 w-4 shrink-0 opacity-50" />
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent className="w-[--radix-popover-trigger-width] p-0" align="start">
+        <Command shouldFilter={false}>
+          <CommandInput
+            placeholder="Search by name or email…"
+            value={search}
+            onValueChange={setSearch}
+          />
+          <CommandList>
+            <CommandEmpty>{isLoading ? 'Searching…' : 'No matches.'}</CommandEmpty>
+            <CommandGroup>
+              {!props.multiple && 'allowUnassigned' in props && props.allowUnassigned && (
+                <CommandItem
+                  value="__unassigned__"
+                  onSelect={() => {
+                    ;(props as SinglePickerProps).onValueChange(null)
+                    setOpen(false)
+                  }}
+                >
+                  <CheckIcon
+                    className={cn(
+                      'mr-2 h-4 w-4',
+                      props.value == null ? 'opacity-100' : 'opacity-0'
+                    )}
+                  />
+                  <span className="text-muted-foreground">Unassigned</span>
+                </CommandItem>
+              )}
+              {results.map((row) => {
+                const isSelected = props.multiple
+                  ? props.value.includes(row.id)
+                  : props.value === row.id
+                return (
+                  <CommandItem
+                    key={row.id}
+                    value={row.id}
+                    onSelect={() => toggle(row.id)}
+                    className="flex items-center gap-2"
+                  >
+                    <CheckIcon
+                      className={cn('h-4 w-4', isSelected ? 'opacity-100' : 'opacity-0')}
+                    />
+                    <Avatar className="h-6 w-6" src={row.avatarUrl} name={row.displayName} />
+                    <div className="min-w-0 flex-1">
+                      <div className="truncate text-sm">
+                        {row.displayName ?? row.email ?? row.id}
+                      </div>
+                      {row.email && (
+                        <div className="truncate text-xs text-muted-foreground">{row.email}</div>
+                      )}
+                    </div>
+                    <span className="text-xs text-muted-foreground">{row.role}</span>
+                  </CommandItem>
+                )
+              })}
+            </CommandGroup>
+          </CommandList>
+        </Command>
+      </PopoverContent>
+    </Popover>
+  )
+}
+
+function labelOf(row: PrincipalSearchRow | undefined): string | null {
+  if (!row) return null
+  return row.displayName ?? row.email ?? row.id
+}
diff --git a/apps/web/src/components/admin/shared/resource-picker.tsx b/apps/web/src/components/admin/shared/resource-picker.tsx
new file mode 100644
index 000000000..a8710a354
--- /dev/null
+++ b/apps/web/src/components/admin/shared/resource-picker.tsx
@@ -0,0 +1,165 @@
+/**
+ * Generic searchable single/multi resource picker built on Popover + cmdk.
+ *
+ * Used by `<TeamPicker />`, `<InboxPicker />`, `<StatusPicker />`,
+ * `<OrgPicker />`, `<ContactPicker />`. Keeps the network layer external —
+ * the consumer wires its own query hook and passes the result rows in.
+ */
+import { useState, type ReactNode } from 'react'
+import { ChevronUpDownIcon, CheckIcon } from '@heroicons/react/24/solid'
+import {
+  Command,
+  CommandEmpty,
+  CommandGroup,
+  CommandInput,
+  CommandItem,
+  CommandList,
+} from '@/components/ui/command'
+import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import { Button } from '@/components/ui/button'
+import { cn } from '@/lib/shared/utils'
+
+export interface PickerOption<TId extends string> {
+  id: TId
+  label: string
+  description?: string
+  /** Optional leading visual (avatar / colour chip). */
+  leading?: ReactNode
+  /** Optional trailing badge (count / role label). */
+  trailing?: ReactNode
+}
+
+interface BaseProps<TId extends string> {
+  options: PickerOption<TId>[]
+  isLoading?: boolean
+  placeholder?: string
+  searchPlaceholder?: string
+  emptyMessage?: string
+  disabled?: boolean
+  className?: string
+  onSearchChange?: (q: string) => void
+}
+
+interface SingleProps<TId extends string> extends BaseProps<TId> {
+  multiple?: false
+  value: TId | null
+  onValueChange: (value: TId | null) => void
+  allowClear?: boolean
+  clearLabel?: string
+}
+
+interface MultiProps<TId extends string> extends BaseProps<TId> {
+  multiple: true
+  value: TId[]
+  onValueChange: (value: TId[]) => void
+}
+
+export type ResourcePickerProps<TId extends string> = SingleProps<TId> | MultiProps<TId>
+
+export function ResourcePicker<TId extends string>(props: ResourcePickerProps<TId>) {
+  const [open, setOpen] = useState(false)
+  const [search, setSearch] = useState('')
+  const optionsById = new Map(props.options.map((o) => [o.id, o]))
+
+  function toggle(id: TId) {
+    if (props.multiple) {
+      const next = props.value.includes(id)
+        ? props.value.filter((v) => v !== id)
+        : [...props.value, id]
+      props.onValueChange(next)
+    } else {
+      props.onValueChange(id)
+      setOpen(false)
+    }
+  }
+
+  function triggerLabel(): string {
+    if (props.multiple) {
+      if (props.value.length === 0) return props.placeholder ?? 'Select…'
+      if (props.value.length === 1) return optionsById.get(props.value[0]!)?.label ?? '1 selected'
+      return `${props.value.length} selected`
+    }
+    if (!props.value) return props.placeholder ?? 'Select…'
+    return optionsById.get(props.value)?.label ?? '…'
+  }
+
+  return (
+    <Popover open={open} onOpenChange={setOpen}>
+      <PopoverTrigger asChild>
+        <Button
+          variant="outline"
+          role="combobox"
+          aria-expanded={open}
+          disabled={props.disabled}
+          className={cn('w-full justify-between font-normal', props.className)}
+        >
+          <span className="truncate">{triggerLabel()}</span>
+          <ChevronUpDownIcon className="ml-2 h-4 w-4 shrink-0 opacity-50" />
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent className="w-[--radix-popover-trigger-width] p-0" align="start">
+        <Command shouldFilter={!props.onSearchChange}>
+          <CommandInput
+            placeholder={props.searchPlaceholder ?? 'Search…'}
+            value={search}
+            onValueChange={(q) => {
+              setSearch(q)
+              props.onSearchChange?.(q)
+            }}
+          />
+          <CommandList>
+            <CommandEmpty>
+              {props.isLoading ? 'Loading…' : (props.emptyMessage ?? 'No results.')}
+            </CommandEmpty>
+            <CommandGroup>
+              {!props.multiple && props.allowClear && (
+                <CommandItem
+                  value="__clear__"
+                  onSelect={() => {
+                    ;(props as SingleProps<TId>).onValueChange(null)
+                    setOpen(false)
+                  }}
+                >
+                  <CheckIcon
+                    className={cn(
+                      'mr-2 h-4 w-4',
+                      props.value == null ? 'opacity-100' : 'opacity-0'
+                    )}
+                  />
+                  <span className="text-muted-foreground">{props.clearLabel ?? 'Clear'}</span>
+                </CommandItem>
+              )}
+              {props.options.map((opt) => {
+                const isSelected = props.multiple
+                  ? props.value.includes(opt.id)
+                  : props.value === opt.id
+                return (
+                  <CommandItem
+                    key={opt.id}
+                    value={opt.id}
+                    onSelect={() => toggle(opt.id)}
+                    className="flex items-center gap-2"
+                  >
+                    <CheckIcon
+                      className={cn('h-4 w-4', isSelected ? 'opacity-100' : 'opacity-0')}
+                    />
+                    {opt.leading}
+                    <div className="min-w-0 flex-1">
+                      <div className="truncate text-sm">{opt.label}</div>
+                      {opt.description && (
+                        <div className="truncate text-xs text-muted-foreground">
+                          {opt.description}
+                        </div>
+                      )}
+                    </div>
+                    {opt.trailing}
+                  </CommandItem>
+                )
+              })}
+            </CommandGroup>
+          </CommandList>
+        </Command>
+      </PopoverContent>
+    </Popover>
+  )
+}
diff --git a/apps/web/src/components/admin/shared/route-error-boundary.tsx b/apps/web/src/components/admin/shared/route-error-boundary.tsx
new file mode 100644
index 000000000..4dcac609c
--- /dev/null
+++ b/apps/web/src/components/admin/shared/route-error-boundary.tsx
@@ -0,0 +1,44 @@
+/**
+ * Shared route-level error boundary for admin routes. Wire into a route via
+ * `errorComponent: createRouteErrorComponent('Failed to load …')`.
+ */
+import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert'
+import { Button } from '@/components/ui/button'
+import { ExclamationCircleIcon } from '@heroicons/react/24/outline'
+
+export interface RouteErrorBoundaryProps {
+  error: Error
+  reset: () => void
+  title?: string
+}
+
+export function RouteErrorBoundary({
+  error,
+  reset,
+  title = 'Something went wrong',
+}: RouteErrorBoundaryProps) {
+  return (
+    <div className="flex items-center justify-center min-h-[400px] p-4">
+      <Alert variant="destructive" className="max-w-2xl">
+        <ExclamationCircleIcon className="h-4 w-4" />
+        <AlertTitle>{title}</AlertTitle>
+        <AlertDescription className="mt-2">
+          <p className="mb-4">{error.message}</p>
+          <Button onClick={reset} variant="outline" size="sm">
+            Try again
+          </Button>
+        </AlertDescription>
+      </Alert>
+    </div>
+  )
+}
+
+/**
+ * Convenience factory: returns a TanStack Router `errorComponent` bound to a
+ * specific title.
+ */
+export function createRouteErrorComponent(title: string) {
+  return function BoundRouteErrorComponent({ error, reset }: { error: Error; reset: () => void }) {
+    return <RouteErrorBoundary error={error} reset={reset} title={title} />
+  }
+}
diff --git a/apps/web/src/components/admin/shared/scope-selector.tsx b/apps/web/src/components/admin/shared/scope-selector.tsx
new file mode 100644
index 000000000..8a71d0a49
--- /dev/null
+++ b/apps/web/src/components/admin/shared/scope-selector.tsx
@@ -0,0 +1,68 @@
+/**
+ * `<ScopeSelector />` — workspace | team | inbox toggle reused by SLA and
+ * routing-rule editors.
+ */
+import { Button } from '@/components/ui/button'
+import { cn } from '@/lib/shared/utils'
+import { TeamPicker } from './team-picker'
+import { InboxPicker } from './inbox-picker'
+import type { TeamId, InboxId } from '@quackback/ids'
+
+export type ScopeKind = 'workspace' | 'team' | 'inbox'
+
+export interface ScopeValue {
+  kind: ScopeKind
+  teamId?: TeamId | null
+  inboxId?: InboxId | null
+}
+
+interface Props {
+  value: ScopeValue
+  onValueChange: (value: ScopeValue) => void
+  /** Restrict the toggleable kinds (e.g. omit 'inbox' for routing rules). */
+  allowedKinds?: ScopeKind[]
+  disabled?: boolean
+  className?: string
+}
+
+export function ScopeSelector({
+  value,
+  onValueChange,
+  allowedKinds = ['workspace', 'team', 'inbox'],
+  disabled,
+  className,
+}: Props) {
+  return (
+    <div className={cn('flex flex-col gap-2', className)}>
+      <div className="inline-flex rounded-md border bg-background p-0.5">
+        {allowedKinds.map((kind) => (
+          <Button
+            key={kind}
+            type="button"
+            variant={value.kind === kind ? 'secondary' : 'ghost'}
+            size="sm"
+            disabled={disabled}
+            className="capitalize"
+            onClick={() => onValueChange({ kind, teamId: null, inboxId: null })}
+          >
+            {kind}
+          </Button>
+        ))}
+      </div>
+      {value.kind === 'team' && (
+        <TeamPicker
+          value={value.teamId ?? null}
+          onValueChange={(teamId) => onValueChange({ kind: 'team', teamId, inboxId: null })}
+          disabled={disabled}
+        />
+      )}
+      {value.kind === 'inbox' && (
+        <InboxPicker
+          value={value.inboxId ?? null}
+          onValueChange={(inboxId) => onValueChange({ kind: 'inbox', teamId: null, inboxId })}
+          disabled={disabled}
+        />
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/shared/status-picker.tsx b/apps/web/src/components/admin/shared/status-picker.tsx
new file mode 100644
index 000000000..cfbbb5cd2
--- /dev/null
+++ b/apps/web/src/components/admin/shared/status-picker.tsx
@@ -0,0 +1,43 @@
+/**
+ * `<StatusPicker />` — single ticket-status picker over `useTicketStatuses()`.
+ */
+import type { TicketStatusId } from '@quackback/ids'
+import { useTicketStatuses } from '@/lib/client/hooks/use-tickets-queries'
+import { ResourcePicker } from './resource-picker'
+
+interface Props {
+  value: TicketStatusId | null
+  onValueChange: (value: TicketStatusId | null) => void
+  placeholder?: string
+  className?: string
+  disabled?: boolean
+}
+
+export function StatusPicker(props: Props) {
+  const { data: statuses = [], isLoading } = useTicketStatuses()
+  const options = statuses.map((s) => ({
+    id: s.id as TicketStatusId,
+    label: s.name,
+    description: s.category,
+    leading: s.color ? (
+      <span
+        className="inline-flex h-3 w-3 rounded-full"
+        style={{ backgroundColor: s.color }}
+        aria-hidden
+      />
+    ) : null,
+  }))
+  return (
+    <ResourcePicker<TicketStatusId>
+      value={props.value}
+      onValueChange={props.onValueChange}
+      options={options}
+      isLoading={isLoading}
+      placeholder={props.placeholder ?? 'Select status…'}
+      searchPlaceholder="Search statuses…"
+      emptyMessage="No statuses."
+      disabled={props.disabled}
+      className={props.className}
+    />
+  )
+}
diff --git a/apps/web/src/components/admin/shared/team-picker.tsx b/apps/web/src/components/admin/shared/team-picker.tsx
new file mode 100644
index 000000000..d2d4274f6
--- /dev/null
+++ b/apps/web/src/components/admin/shared/team-picker.tsx
@@ -0,0 +1,77 @@
+/**
+ * `<TeamPicker />` — single/multi team picker over `useTeams()`.
+ */
+import type { TeamId } from '@quackback/ids'
+import { useTeams } from '@/lib/client/hooks/use-teams-queries'
+import { ResourcePicker } from './resource-picker'
+
+interface BaseProps {
+  placeholder?: string
+  className?: string
+  disabled?: boolean
+  includeArchived?: boolean
+}
+
+interface SingleProps extends BaseProps {
+  multiple?: false
+  value: TeamId | null
+  onValueChange: (value: TeamId | null) => void
+  allowClear?: boolean
+}
+
+interface MultiProps extends BaseProps {
+  multiple: true
+  value: TeamId[]
+  onValueChange: (value: TeamId[]) => void
+}
+
+export function TeamPicker(props: SingleProps | MultiProps) {
+  const { data: teams = [], isLoading } = useTeams({ includeArchived: props.includeArchived })
+
+  const options = teams.map((t) => ({
+    id: t.id as TeamId,
+    label: t.name,
+    description: t.slug,
+    leading: t.color ? (
+      <span
+        className="inline-flex h-3 w-3 rounded-sm"
+        style={{ backgroundColor: t.color }}
+        aria-hidden
+      />
+    ) : null,
+    trailing: t.shortLabel ? (
+      <span className="text-xs text-muted-foreground">{t.shortLabel}</span>
+    ) : null,
+  }))
+
+  if (props.multiple) {
+    return (
+      <ResourcePicker<TeamId>
+        multiple
+        value={props.value}
+        onValueChange={props.onValueChange}
+        options={options}
+        isLoading={isLoading}
+        placeholder={props.placeholder ?? 'Select teams…'}
+        searchPlaceholder="Search teams…"
+        emptyMessage="No teams."
+        disabled={props.disabled}
+        className={props.className}
+      />
+    )
+  }
+  return (
+    <ResourcePicker<TeamId>
+      value={props.value}
+      onValueChange={props.onValueChange}
+      options={options}
+      isLoading={isLoading}
+      placeholder={props.placeholder ?? 'Select team…'}
+      searchPlaceholder="Search teams…"
+      emptyMessage="No teams."
+      disabled={props.disabled}
+      className={props.className}
+      allowClear={props.allowClear}
+    />
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/__tests__/ticket-activity-timeline.test.tsx b/apps/web/src/components/admin/tickets/__tests__/ticket-activity-timeline.test.tsx
new file mode 100644
index 000000000..71508467e
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/__tests__/ticket-activity-timeline.test.tsx
@@ -0,0 +1,326 @@
+// @vitest-environment happy-dom
+import { render, screen } from '@testing-library/react'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { TicketActivityTimeline } from '../ticket-activity-timeline'
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: vi.fn(),
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    activity: vi.fn(() => ({ queryKey: ['tickets', 'activity'] })),
+  },
+}))
+
+vi.mock('@/components/ui/time-ago', () => ({
+  TimeAgo: () => <span>2 minutes ago</span>,
+}))
+
+const useSuspenseQueryMock = vi.mocked(useSuspenseQuery)
+
+function mockActivity(rows: unknown[]) {
+  useSuspenseQueryMock.mockReturnValue({ data: rows } as never)
+}
+
+describe('TicketActivityTimeline', () => {
+  beforeEach(() => {
+    useSuspenseQueryMock.mockReset()
+  })
+
+  it('renders an empty activity state', () => {
+    mockActivity([])
+
+    render(<TicketActivityTimeline ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByText('No activity yet.')).toBeInTheDocument()
+  })
+
+  it('renders description changes without exposing raw diff metadata or principal IDs', () => {
+    mockActivity([
+      {
+        id: 'ticket_act_1',
+        principalId: 'principal_01ktxq7sh1fevtx68ee59xpvx0',
+        type: 'ticket.updated',
+        actorName: null,
+        createdAt: '2026-06-12T10:00:00.000Z',
+        metadata: {
+          diff: {
+            descriptionText: {
+              from: 'old raw description',
+              to: 'new raw description',
+            },
+          },
+        },
+      },
+    ])
+
+    render(<TicketActivityTimeline ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByText('Someone updated the description')).toBeInTheDocument()
+    expect(screen.getByText('Description changed')).toBeInTheDocument()
+    expect(screen.queryByText(/descriptionText/i)).not.toBeInTheDocument()
+    expect(screen.queryByText(/principal_01ktxq7/i)).not.toBeInTheDocument()
+    expect(screen.queryByText(/old raw description/i)).not.toBeInTheDocument()
+  })
+
+  it('renders field, status, and thread activity as readable summaries', () => {
+    mockActivity([
+      {
+        id: 'ticket_act_1',
+        principalId: 'principal_1',
+        type: 'ticket.updated',
+        actorName: 'Meli',
+        createdAt: '2026-06-12T10:00:00.000Z',
+        metadata: {
+          diff: {
+            priority: { from: 'normal', to: 'urgent' },
+          },
+        },
+      },
+      {
+        id: 'ticket_act_2',
+        principalId: null,
+        type: 'ticket.status_changed',
+        actorName: null,
+        createdAt: '2026-06-12T09:00:00.000Z',
+        metadata: {
+          from: { statusId: 'ticket_status_old', category: 'open' },
+          to: { statusId: 'ticket_status_new', category: 'pending' },
+        },
+      },
+      {
+        id: 'ticket_act_3',
+        principalId: 'principal_2',
+        type: 'thread.added',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T08:00:00.000Z',
+        metadata: { threadId: 'ticket_thread_1', audience: 'public' },
+      },
+    ])
+
+    render(<TicketActivityTimeline ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByText('Meli changed priority')).toBeInTheDocument()
+    expect(screen.getByText('Normal')).toBeInTheDocument()
+    expect(screen.getByText('Urgent')).toBeInTheDocument()
+    expect(screen.getByText('System changed status')).toBeInTheDocument()
+    expect(screen.getByText('Open')).toBeInTheDocument()
+    expect(screen.getByText('Pending')).toBeInTheDocument()
+    expect(screen.getByText('Agent posted a public reply')).toBeInTheDocument()
+    expect(
+      screen.queryByText(/ticket\.updated|thread\.added|ticket_thread_1/i)
+    ).not.toBeInTheDocument()
+  })
+
+  it('renders the remaining event types and summarized metadata', () => {
+    mockActivity([
+      {
+        id: 'ticket_act_created',
+        principalId: 'principal_1',
+        type: 'ticket.created',
+        actorName: null,
+        createdAt: '2026-06-12T10:00:00.000Z',
+        metadata: { statusCategory: 'closed', priority: 'high', channel: 'github' },
+      },
+      {
+        id: 'ticket_act_routed',
+        principalId: null,
+        type: 'ticket.routed',
+        actorName: null,
+        createdAt: '2026-06-12T09:59:00.000Z',
+        metadata: {
+          ruleId: 'routing_rule_1',
+          inboxId: 'inbox_1',
+          primaryTeamId: 'team_1',
+          assigneePrincipalId: 'principal_1',
+        },
+      },
+      {
+        id: 'ticket_act_updated_many',
+        principalId: 'principal_2',
+        type: 'ticket.updated',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:58:00.000Z',
+        metadata: {
+          diff: {
+            subject: { from: 'Old subject', to: 'New subject' },
+            visibilityScope: { from: 'team', to: 'private' },
+            customFlag: { from: false, to: true },
+            score: { from: 1, to: 2 },
+            assigneePrincipalId: {
+              from: 'principal_01ktxq7sh1fevtx68ee59xpvx0',
+              to: null,
+            },
+          },
+        },
+      },
+      {
+        id: 'ticket_act_assigned',
+        principalId: 'principal_2',
+        type: 'ticket.assigned',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:57:00.000Z',
+        metadata: {
+          from: { teamId: 'team_old' },
+          to: { principalId: 'principal_3', teamId: 'team_1' },
+        },
+      },
+      {
+        id: 'ticket_act_no_assignee',
+        principalId: 'principal_2',
+        type: 'ticket.assigned',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:56:00.000Z',
+        metadata: { from: {}, to: {} },
+      },
+      {
+        id: 'ticket_act_unassigned',
+        principalId: 'principal_2',
+        type: 'ticket.unassigned',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:55:00.000Z',
+        metadata: {},
+      },
+      {
+        id: 'ticket_act_deleted',
+        principalId: 'principal_2',
+        type: 'ticket.deleted',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:54:00.000Z',
+        metadata: {},
+      },
+      {
+        id: 'ticket_act_restored',
+        principalId: 'principal_2',
+        type: 'ticket.restored',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:53:00.000Z',
+        metadata: {},
+      },
+      {
+        id: 'ticket_act_thread_unknown',
+        principalId: 'principal_2',
+        type: 'thread.added',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:52:00.000Z',
+        metadata: { audience: 'shared-team' },
+      },
+      {
+        id: 'ticket_act_thread_edited',
+        principalId: 'principal_2',
+        type: 'thread.edited',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:51:00.000Z',
+        metadata: {},
+      },
+      {
+        id: 'ticket_act_thread_deleted',
+        principalId: 'principal_2',
+        type: 'thread.deleted',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:50:00.000Z',
+        metadata: {},
+      },
+      {
+        id: 'ticket_act_participant_added',
+        principalId: 'principal_2',
+        type: 'participant.added',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:49:00.000Z',
+        metadata: { role: 'collaborator', principalId: 'principal_3', contactId: 'contact_1' },
+      },
+      {
+        id: 'ticket_act_participant_removed',
+        principalId: 'principal_2',
+        type: 'participant.removed',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:48:00.000Z',
+        metadata: {},
+      },
+      {
+        id: 'ticket_act_shared',
+        principalId: 'principal_2',
+        type: 'ticket.shared',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:47:00.000Z',
+        metadata: { accessLevel: 'full' },
+      },
+      {
+        id: 'ticket_act_unshared',
+        principalId: 'principal_2',
+        type: 'ticket.unshared',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:46:00.000Z',
+        metadata: {},
+      },
+      {
+        id: 'ticket_act_attachment_added',
+        principalId: 'principal_2',
+        type: 'attachment.added',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:45:00.000Z',
+        metadata: {
+          filename:
+            'very-long-diagnostic-bundle-name-that-should-be-truncated-before-rendering-because-it-is-more-than-one-hundred-and-twenty-characters.zip',
+        },
+      },
+      {
+        id: 'ticket_act_attachment_removed',
+        principalId: 'principal_2',
+        type: 'attachment.removed',
+        actorName: 'Agent',
+        createdAt: '2026-06-12T09:44:00.000Z',
+        metadata: {},
+      },
+      {
+        id: 'ticket_act_default',
+        principalId: 'principal_2',
+        type: 'custom.audit_event',
+        actorName: '  ',
+        createdAt: '2026-06-12T09:43:00.000Z',
+        metadata: {},
+      },
+    ])
+
+    render(
+      <TicketActivityTimeline
+        ticketId={'ticket_1' as never}
+        principalNames={{ principal_1: 'Ada', principal_2: 'Grace' }}
+      />
+    )
+
+    expect(screen.getByText('Ada created this ticket')).toBeInTheDocument()
+    expect(screen.getByText('Closed')).toBeInTheDocument()
+    expect(screen.getByText('GitHub')).toBeInTheDocument()
+    expect(screen.getByText('System routed this ticket')).toBeInTheDocument()
+    expect(screen.getByText('Matched routing rule')).toBeInTheDocument()
+    expect(screen.getByText('Agent updated 5 fields')).toBeInTheDocument()
+    expect(screen.getByText('Old subject')).toBeInTheDocument()
+    expect(screen.getByText('Private')).toBeInTheDocument()
+    expect(screen.getByText('Enabled')).toBeInTheDocument()
+    expect(screen.getByText('Assigned to person and team')).toBeInTheDocument()
+    expect(screen.getByText('Previously assigned')).toBeInTheDocument()
+    expect(screen.getByText('No assignee')).toBeInTheDocument()
+    expect(screen.getByText('Agent removed the assignee')).toBeInTheDocument()
+    expect(screen.getByText('Agent deleted this ticket')).toBeInTheDocument()
+    expect(screen.getByText('Agent restored this ticket')).toBeInTheDocument()
+    expect(screen.getByText('Agent posted shared team')).toBeInTheDocument()
+    expect(screen.getByText('Agent edited a reply')).toBeInTheDocument()
+    expect(screen.getByText('Agent deleted a reply')).toBeInTheDocument()
+    expect(screen.getByText('Agent added a participant')).toBeInTheDocument()
+    expect(screen.getByText('Collaborator')).toBeInTheDocument()
+    expect(screen.getByText('User')).toBeInTheDocument()
+    expect(screen.getByText('Contact')).toBeInTheDocument()
+    expect(screen.getByText('Agent removed a participant')).toBeInTheDocument()
+    expect(screen.getByText('Agent shared this ticket with a team')).toBeInTheDocument()
+    expect(screen.getByText('Full access')).toBeInTheDocument()
+    expect(screen.getByText('Agent removed a team share')).toBeInTheDocument()
+    expect(screen.getByText('Agent added an attachment')).toBeInTheDocument()
+    expect(screen.getByText(/very-long-diagnostic-bundle-name/)).toBeInTheDocument()
+    expect(screen.getByText('Agent removed an attachment')).toBeInTheDocument()
+    expect(screen.getByText('Grace recorded Custom Audit Event')).toBeInTheDocument()
+    expect(screen.queryByText(/principal_01ktxq7/i)).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/tickets/__tests__/ticket-header-and-chips.test.tsx b/apps/web/src/components/admin/tickets/__tests__/ticket-header-and-chips.test.tsx
new file mode 100644
index 000000000..c4559dab9
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/__tests__/ticket-header-and-chips.test.tsx
@@ -0,0 +1,322 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { SlaClockChip } from '../sla-clock-chip'
+import { TicketChannelIcon, type TicketChannel } from '../ticket-channel-icon'
+import { TicketDetailHeader } from '../ticket-detail-header'
+
+const mocks = vi.hoisted(() => ({
+  navigate: vi.fn(),
+  invalidateQueries: vi.fn(),
+  takeTicketFn: vi.fn(),
+  returnTicketFn: vi.fn(),
+  softDeleteTicketFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({ children, to }: { children: ReactNode; to: string; className?: string }) => (
+    <a href={to}>{children}</a>
+  ),
+  useRouter: () => ({
+    navigate: mocks.navigate,
+  }),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: ({
+    mutationFn,
+    onSuccess,
+    onError,
+  }: {
+    mutationFn: () => Promise<unknown>
+    onSuccess?: () => void
+    onError?: (error: Error) => void
+  }) => ({
+    isPending: false,
+    mutate: () => {
+      void mutationFn()
+        .then(() => onSuccess?.())
+        .catch((error) => onError?.(error instanceof Error ? error : new Error(String(error))))
+    },
+  }),
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  takeTicketFn: mocks.takeTicketFn,
+  returnTicketFn: mocks.returnTicketFn,
+  softDeleteTicketFn: mocks.softDeleteTicketFn,
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    detail: (ticketId: string) => ({ queryKey: ['tickets', 'detail', ticketId] }),
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    disabled,
+    'aria-label': ariaLabel,
+    asChild,
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    disabled?: boolean
+    'aria-label'?: string
+    asChild?: boolean
+    variant?: string
+    size?: string
+  }) =>
+    asChild ? (
+      <>{children}</>
+    ) : (
+      <button type="button" disabled={disabled} onClick={onClick} aria-label={ariaLabel}>
+        {children}
+      </button>
+    ),
+}))
+
+vi.mock('@/components/ui/time-ago', () => ({
+  TimeAgo: ({ date }: { date: Date | string }) => <time>{String(date)}</time>,
+}))
+
+vi.mock('../ticket-priority-chip', () => ({
+  TicketPriorityChip: ({ priority }: { priority: string }) => <span>Priority {priority}</span>,
+}))
+
+vi.mock('../ticket-subscription-menu', () => ({
+  TicketSubscriptionMenu: ({ ticketId }: { ticketId: string }) => (
+    <button type="button">Subscribe {ticketId}</button>
+  ),
+}))
+
+vi.mock('@/components/ui/alert-dialog', async () => {
+  const React = await import('react')
+  const AlertDialogContext = React.createContext<{
+    open: boolean
+    setOpen: (open: boolean) => void
+  }>({
+    open: false,
+    setOpen: () => {},
+  })
+  return {
+    AlertDialog: ({ children }: { children: ReactNode }) => {
+      const [open, setOpen] = React.useState(false)
+      return (
+        <AlertDialogContext.Provider value={{ open, setOpen }}>
+          <div>{children}</div>
+        </AlertDialogContext.Provider>
+      )
+    },
+    AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+      <button type="button" onClick={onClick}>
+        {children}
+      </button>
+    ),
+    AlertDialogCancel: ({ children }: { children: ReactNode }) => (
+      <button type="button">{children}</button>
+    ),
+    AlertDialogContent: ({ children }: { children: ReactNode }) => {
+      const context = React.useContext(AlertDialogContext)
+      return context.open ? <section role="alertdialog">{children}</section> : null
+    },
+    AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+    AlertDialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+    AlertDialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+    AlertDialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+    AlertDialogTrigger: ({ children }: { children: React.ReactElement; asChild?: boolean }) => {
+      const context = React.useContext(AlertDialogContext)
+      return React.cloneElement(children as React.ReactElement<{ onClick?: () => void }>, {
+        onClick: () => context.setOpen(true),
+      })
+    },
+  }
+})
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArrowLeftIcon: () => <span aria-hidden="true">back</span>,
+  ChatBubbleBottomCenterTextIcon: ({ 'aria-label': ariaLabel }: { 'aria-label'?: string }) => (
+    <span aria-label={ariaLabel}>widget</span>
+  ),
+  CodeBracketIcon: ({ 'aria-label': ariaLabel }: { 'aria-label'?: string }) => (
+    <span aria-label={ariaLabel}>api</span>
+  ),
+  EnvelopeIcon: ({ 'aria-label': ariaLabel }: { 'aria-label'?: string }) => (
+    <span aria-label={ariaLabel}>email</span>
+  ),
+  GlobeAltIcon: ({ 'aria-label': ariaLabel }: { 'aria-label'?: string }) => (
+    <span aria-label={ariaLabel}>portal</span>
+  ),
+  TrashIcon: () => <span aria-hidden="true">trash</span>,
+}))
+
+function ticket(overrides: Partial<Parameters<typeof TicketDetailHeader>[0]['ticket']> = {}) {
+  return {
+    id: 'ticket_1' as never,
+    subject: 'Login is broken',
+    channel: 'widget',
+    priority: 'high',
+    visibilityScope: 'team',
+    updatedAt: '2026-06-20T10:00:00.000Z',
+    assigneePrincipalId: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.spyOn(Date, 'now').mockReturnValue(new Date('2026-06-20T10:00:00.000Z').getTime())
+  mocks.takeTicketFn.mockResolvedValue(undefined)
+  mocks.returnTicketFn.mockResolvedValue(undefined)
+  mocks.softDeleteTicketFn.mockResolvedValue(undefined)
+  mocks.invalidateQueries.mockResolvedValue(undefined)
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('SlaClockChip', () => {
+  it('formats clock states, urgency colors, and kind labels', () => {
+    const { rerender } = render(
+      <SlaClockChip
+        showKind
+        clock={{
+          kind: 'first_response',
+          state: 'running',
+          dueAt: '2026-06-20T12:00:00.000Z',
+        }}
+      />
+    )
+    expect(screen.getByText('First response:')).toBeInTheDocument()
+    expect(screen.getByText('2h 0m')).toHaveAttribute(
+      'title',
+      expect.stringContaining('First response due')
+    )
+
+    rerender(
+      <SlaClockChip
+        clock={{ kind: 'resolution', state: 'running', dueAt: '2026-06-22T11:00:00.000Z' }}
+      />
+    )
+    expect(screen.getByText('2d 1h')).toBeInTheDocument()
+
+    rerender(
+      <SlaClockChip
+        clock={{ kind: 'next_response', state: 'running', dueAt: '2026-06-20T10:30:00.000Z' }}
+      />
+    )
+    expect(screen.getByText('30m')).toBeInTheDocument()
+
+    rerender(
+      <SlaClockChip
+        clock={{ kind: 'resolution', state: 'running', dueAt: '2026-06-20T09:55:00.000Z' }}
+      />
+    )
+    expect(screen.getByText(/5m/)).toBeInTheDocument()
+
+    rerender(
+      <SlaClockChip
+        clock={{ kind: 'resolution', state: 'met', dueAt: '2026-06-20T09:00:00.000Z' }}
+      />
+    )
+    expect(screen.getByText('Met')).toBeInTheDocument()
+
+    rerender(
+      <SlaClockChip
+        clock={{ kind: 'resolution', state: 'paused', dueAt: '2026-06-20T11:00:00.000Z' }}
+      />
+    )
+    expect(screen.getByText('Paused')).toBeInTheDocument()
+
+    rerender(
+      <SlaClockChip
+        clock={{ kind: 'resolution', state: 'cancelled', dueAt: '2026-06-20T11:00:00.000Z' }}
+      />
+    )
+    expect(screen.getByText('Cancelled')).toBeInTheDocument()
+  })
+})
+
+describe('TicketChannelIcon', () => {
+  it('maps every channel to an icon', () => {
+    ;(['email', 'portal', 'api', 'widget'] as TicketChannel[]).forEach((channel) => {
+      const { unmount } = render(<TicketChannelIcon channel={channel} className="custom" />)
+      expect(screen.getByLabelText(channel)).toBeInTheDocument()
+      unmount()
+    })
+  })
+})
+
+describe('TicketDetailHeader', () => {
+  it('takes, returns, subscribes, and deletes tickets', async () => {
+    const { rerender } = render(
+      <TicketDetailHeader ticket={ticket()} currentPrincipalId={'principal_1' as never} />
+    )
+
+    expect(screen.getByRole('link', { name: /Queue/ })).toHaveAttribute('href', '/admin/tickets')
+    expect(screen.getByText('Login is broken')).toBeInTheDocument()
+    expect(screen.getByLabelText('widget')).toBeInTheDocument()
+    expect(screen.getByText('Priority high')).toBeInTheDocument()
+    expect(screen.getByText('Team')).toBeInTheDocument()
+    expect(screen.getByText('Subscribe ticket_1')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Take' }))
+    await waitFor(() => {
+      expect(mocks.takeTicketFn).toHaveBeenCalledWith({ data: { ticketId: 'ticket_1' } })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'detail', 'ticket_1'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['tickets', 'list'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Assigned to you')
+
+    rerender(
+      <TicketDetailHeader
+        ticket={ticket({ assigneePrincipalId: 'principal_1' as never, visibilityScope: 'custom' })}
+        currentPrincipalId={'principal_1' as never}
+      />
+    )
+    expect(screen.getByText('custom')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Return' }))
+    await waitFor(() => {
+      expect(mocks.returnTicketFn).toHaveBeenCalledWith({ data: { ticketId: 'ticket_1' } })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Returned to team')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Delete ticket' }))
+    expect(screen.getByRole('heading', { name: 'Delete ticket?' })).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Delete' }))
+    await waitFor(() => {
+      expect(mocks.softDeleteTicketFn).toHaveBeenCalledWith({ data: { ticketId: 'ticket_1' } })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Ticket deleted')
+    expect(mocks.navigate).toHaveBeenCalledWith({ to: '/admin/tickets' })
+  })
+
+  it('reports mutation failures', async () => {
+    mocks.takeTicketFn.mockRejectedValueOnce(new Error('not allowed'))
+    render(<TicketDetailHeader ticket={ticket()} currentPrincipalId={'principal_1' as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Take' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('not allowed')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/tickets/__tests__/ticket-properties-panel.test.tsx b/apps/web/src/components/admin/tickets/__tests__/ticket-properties-panel.test.tsx
new file mode 100644
index 000000000..64feaa35f
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/__tests__/ticket-properties-panel.test.tsx
@@ -0,0 +1,381 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { TicketPropertiesPanel } from '../ticket-properties-panel'
+
+type MutationOptions = {
+  mutationFn: (value: unknown) => Promise<unknown>
+  onSuccess?: (result: unknown) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  getQueryData: vi.fn(),
+  setQueryData: vi.fn(),
+  invalidateQueries: vi.fn(),
+  assignTicketFn: vi.fn(),
+  transitionTicketStatusFn: vi.fn(),
+  updateTicketFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    getQueryData: mocks.getQueryData,
+    setQueryData: mocks.setQueryData,
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    mutate: async (value: unknown) => {
+      try {
+        const result = await options.mutationFn(value)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    size?: string
+    variant?: string
+  }) => (
+    <button type={type} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    value,
+    onChange,
+  }: {
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    className?: string
+  }) => <input aria-label="Subject draft" value={value} onChange={onChange} />,
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (value: string) => void
+    children: ReactNode
+  }) => (
+    <select value={value} onChange={(event) => onValueChange(event.currentTarget.value)}>
+      {children}
+    </select>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
+    <option value={value}>{children}</option>
+  ),
+  SelectTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  SelectValue: () => null,
+}))
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('principal_agent')}>
+        Assign agent
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Unassign agent
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/status-picker', () => ({
+  StatusPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('ticket_status_solved')}>
+        Pick status
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear status
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/inbox-picker', () => ({
+  InboxPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('inbox_support')}>
+        Pick inbox
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear inbox
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('team_primary')}>
+        Pick team
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear team
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/org-picker', () => ({
+  OrgPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('organization_acme')}>
+        Pick organization
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear organization
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/contact-picker', () => ({
+  ContactPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('contact_requester')}>
+        Pick contact
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear contact
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  assignTicketFn: mocks.assignTicketFn,
+  transitionTicketStatusFn: mocks.transitionTicketStatusFn,
+  updateTicketFn: mocks.updateTicketFn,
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    detail: (ticketId: string) => ({ queryKey: ['tickets', ticketId, 'detail'] }),
+  },
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'ticket_1',
+    subject: 'Original subject',
+    statusId: 'ticket_status_open',
+    priority: 'normal',
+    visibilityScope: 'team',
+    primaryTeamId: null,
+    inboxId: null,
+    organizationId: null,
+    requesterContactId: null,
+    assigneePrincipalId: null,
+    updatedAt: '2026-06-19T10:00:00.000Z',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.getQueryData.mockReturnValue({ updatedAt: '2026-06-19T10:30:00.000Z' })
+  mocks.assignTicketFn.mockResolvedValue({ id: 'ticket_1', updatedAt: '2026-06-19T10:31:00.000Z' })
+  mocks.transitionTicketStatusFn.mockResolvedValue({
+    id: 'ticket_1',
+    updatedAt: '2026-06-19T10:32:00.000Z',
+  })
+  mocks.updateTicketFn.mockResolvedValue({ id: 'ticket_1', updatedAt: '2026-06-19T10:33:00.000Z' })
+})
+
+describe('TicketPropertiesPanel', () => {
+  it('edits and cancels the subject inline', async () => {
+    render(<TicketPropertiesPanel ticket={ticket() as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Original subject' }))
+    fireEvent.change(screen.getByLabelText('Subject draft'), {
+      target: { value: 'Unsaved subject' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+
+    expect(screen.getByRole('button', { name: 'Original subject' })).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Original subject' }))
+    fireEvent.change(screen.getByLabelText('Subject draft'), {
+      target: { value: 'Updated subject' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }))
+
+    await waitFor(() => {
+      expect(mocks.updateTicketFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          expectedUpdatedAt: '2026-06-19T10:30:00.000Z',
+          subject: 'Updated subject',
+        },
+      })
+    })
+    expect(mocks.setQueryData).toHaveBeenCalledWith(['tickets', 'ticket_1', 'detail'], {
+      id: 'ticket_1',
+      updatedAt: '2026-06-19T10:33:00.000Z',
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'ticket_1', 'detail'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['tickets', 'list'] })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Ticket updated')
+  })
+
+  it('updates assignee and status with optimistic concurrency timestamps', async () => {
+    render(<TicketPropertiesPanel ticket={ticket() as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Assign agent' }))
+    await waitFor(() => {
+      expect(mocks.assignTicketFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          expectedUpdatedAt: '2026-06-19T10:30:00.000Z',
+          assigneePrincipalId: 'principal_agent',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Assignee updated')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Unassign agent' }))
+    await waitFor(() => {
+      expect(mocks.assignTicketFn).toHaveBeenLastCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          expectedUpdatedAt: '2026-06-19T10:30:00.000Z',
+          assigneePrincipalId: null,
+        },
+      })
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Clear status' }))
+    expect(mocks.transitionTicketStatusFn).not.toHaveBeenCalled()
+    fireEvent.click(screen.getByRole('button', { name: 'Pick status' }))
+    await waitFor(() => {
+      expect(mocks.transitionTicketStatusFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          expectedUpdatedAt: '2026-06-19T10:30:00.000Z',
+          statusId: 'ticket_status_solved',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Status updated')
+  })
+
+  it('updates ticket properties from selects and pickers', async () => {
+    render(<TicketPropertiesPanel ticket={ticket() as never} />)
+
+    fireEvent.change(screen.getAllByRole('combobox')[0], { target: { value: 'urgent' } })
+    fireEvent.change(screen.getAllByRole('combobox')[1], { target: { value: 'private' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Pick inbox' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Clear team' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick organization' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Clear contact' }))
+
+    await waitFor(() => {
+      expect(mocks.updateTicketFn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({ priority: 'urgent' }),
+        })
+      )
+    })
+    expect(mocks.updateTicketFn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ visibilityScope: 'private' }),
+      })
+    )
+    expect(mocks.updateTicketFn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ inboxId: 'inbox_support' }),
+      })
+    )
+    expect(mocks.updateTicketFn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ primaryTeamId: null }),
+      })
+    )
+    expect(mocks.updateTicketFn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ organizationId: 'organization_acme' }),
+      })
+    )
+    expect(mocks.updateTicketFn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ requesterContactId: null }),
+      })
+    )
+  })
+
+  it('falls back to the ticket timestamp and handles stale-conflict refresh actions', async () => {
+    mocks.getQueryData.mockReturnValue(undefined)
+    mocks.updateTicketFn.mockRejectedValueOnce(new Error('stale conflict'))
+    render(<TicketPropertiesPanel ticket={ticket() as never} />)
+
+    fireEvent.change(screen.getAllByRole('combobox')[0], { target: { value: 'high' } })
+
+    await waitFor(() => {
+      expect(mocks.updateTicketFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          expectedUpdatedAt: '2026-06-19T10:00:00.000Z',
+          priority: 'high',
+        },
+      })
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      'Ticket changed — refresh',
+      expect.objectContaining({
+        action: expect.objectContaining({ label: 'Refresh' }),
+      })
+    )
+
+    const refresh = mocks.toastError.mock.calls[0][1].action.onClick as () => void
+    refresh()
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'ticket_1', 'detail'],
+    })
+  })
+
+  it('reports non-conflict mutation errors', async () => {
+    mocks.assignTicketFn.mockRejectedValueOnce(new Error('No permission'))
+    render(<TicketPropertiesPanel ticket={ticket() as never} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Assign agent' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('No permission')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/tickets/__tests__/ticket-queue-table.test.tsx b/apps/web/src/components/admin/tickets/__tests__/ticket-queue-table.test.tsx
new file mode 100644
index 000000000..01a57ef46
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/__tests__/ticket-queue-table.test.tsx
@@ -0,0 +1,346 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { TicketQueueTable } from '../ticket-queue-table'
+
+type MutationOptions = {
+  mutationFn: (value: unknown) => Promise<{ succeeded: string[] }>
+  onSuccess?: (result: { succeeded: string[] }) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  bulkAssignTicketsFn: vi.fn(),
+  bulkTransitionTicketsFn: vi.fn(),
+  bulkChangeInboxFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    to,
+    params,
+    children,
+  }: {
+    to: string
+    params: Record<string, string>
+    children: ReactNode
+  }) => <a href={to.replace('$ticketId', params.ticketId)}>{children}</a>,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    mutate: async (value: unknown) => {
+      try {
+        const result = await options.mutationFn(value)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/table', () => ({
+  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
+  TableHeader: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
+  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
+  TableRow: ({ children }: { children: ReactNode }) => <tr>{children}</tr>,
+  TableHead: ({ children }: { children: ReactNode }) => <th>{children}</th>,
+  TableCell: ({ children }: { children: ReactNode }) => <td>{children}</td>,
+}))
+
+vi.mock('@/components/ui/checkbox', () => ({
+  Checkbox: ({
+    checked,
+    onCheckedChange,
+    'aria-label': ariaLabel,
+  }: {
+    checked?: boolean | 'indeterminate'
+    onCheckedChange?: (checked: boolean) => void
+    'aria-label'?: string
+  }) => (
+    <input
+      type="checkbox"
+      aria-label={ariaLabel}
+      checked={checked === true}
+      data-indeterminate={checked === 'indeterminate' ? 'true' : undefined}
+      onChange={() => onCheckedChange?.(checked !== true)}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    size?: string
+    variant?: string
+    className?: string
+  }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/popover', () => ({
+  Popover: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  PopoverTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => <>{children}</>,
+  PopoverContent: ({ children }: { children: ReactNode; align?: string; className?: string }) => (
+    <div>{children}</div>
+  ),
+}))
+
+vi.mock('@/components/ui/alert-dialog', () => ({
+  AlertDialog: ({ open, children }: { open: boolean; children: ReactNode }) =>
+    open ? <div role="alertdialog">{children}</div> : null,
+  AlertDialogContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogHeader: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogTitle: ({ children }: { children: ReactNode }) => <h2>{children}</h2>,
+  AlertDialogDescription: ({ children }: { children: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  AlertDialogCancel: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  AlertDialogAction: ({ children, onClick }: { children: ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/time-ago', () => ({
+  TimeAgo: ({ date }: { date: Date | string }) => <time>{String(date)}</time>,
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: { children: ReactNode; permission: string }) => <>{children}</>,
+}))
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('principal_assignee')}>
+      Pick assignee
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/status-picker', () => ({
+  StatusPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('ticket_status_solved')}>
+      Pick status
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/inbox-picker', () => ({
+  InboxPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <>
+      <button type="button" onClick={() => onValueChange('inbox_support')}>
+        Pick inbox
+      </button>
+      <button type="button" onClick={() => onValueChange(null)}>
+        Clear inbox
+      </button>
+    </>
+  ),
+}))
+
+vi.mock('../ticket-status-pill', () => ({
+  TicketStatusPill: ({ name, category }: { name: string; category: string }) => (
+    <span>
+      {name}:{category}
+    </span>
+  ),
+}))
+
+vi.mock('../ticket-priority-chip', () => ({
+  TicketPriorityChip: ({ priority }: { priority: string }) => <span>priority:{priority}</span>,
+}))
+
+vi.mock('../ticket-channel-icon', () => ({
+  TicketChannelIcon: ({ channel }: { channel: string }) => <span>channel:{channel}</span>,
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  bulkAssignTicketsFn: mocks.bulkAssignTicketsFn,
+  bulkTransitionTicketsFn: mocks.bulkTransitionTicketsFn,
+  bulkChangeInboxFn: mocks.bulkChangeInboxFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+const statuses = [
+  {
+    id: 'ticket_status_open',
+    name: 'Open',
+    category: 'open' as const,
+  },
+  {
+    id: 'ticket_status_solved',
+    name: 'Solved',
+    category: 'solved' as const,
+  },
+]
+
+function row(id: number, overrides: Record<string, unknown> = {}) {
+  return {
+    id: `ticket_${id}`,
+    subject: `Ticket ${id}`,
+    statusId: 'ticket_status_open',
+    priority: id % 2 === 0 ? 'high' : 'normal',
+    channel: id % 2 === 0 ? 'email' : 'widget',
+    lastActivityAt: `2026-06-19T10:${String(id).padStart(2, '0')}:00.000Z`,
+    assigneePrincipalId: null,
+    ...overrides,
+  }
+}
+
+function renderTable(rows = [row(1), row(2)]) {
+  return render(
+    <TicketQueueTable rows={rows} statuses={statuses} invalidateKey={['tickets', 'queue']} />
+  )
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.bulkAssignTicketsFn.mockResolvedValue({ succeeded: ['ticket_1'] })
+  mocks.bulkTransitionTicketsFn.mockResolvedValue({ succeeded: ['ticket_1', 'ticket_2'] })
+  mocks.bulkChangeInboxFn.mockResolvedValue({ succeeded: ['ticket_1', 'ticket_2'] })
+})
+
+describe('TicketQueueTable', () => {
+  it('renders the empty queue state', () => {
+    renderTable([])
+
+    expect(screen.getByText('No tickets in this view.')).toBeInTheDocument()
+  })
+
+  it('renders ticket rows and runs assign, transition, and inbox bulk actions', async () => {
+    renderTable([row(1), row(2, { statusId: 'missing_status' })])
+
+    expect(screen.getByRole('link', { name: 'Ticket 1' })).toHaveAttribute(
+      'href',
+      '/admin/tickets/ticket_1'
+    )
+    expect(screen.getByText('Open:open')).toBeInTheDocument()
+    expect(screen.getByText('priority:normal')).toBeInTheDocument()
+    expect(screen.getByText('channel:widget')).toBeInTheDocument()
+    expect(screen.getByText('—')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByLabelText('Select Ticket 1'))
+
+    expect(screen.getByText('1 selected')).toBeInTheDocument()
+    expect(screen.getByLabelText('Select all')).toHaveAttribute('data-indeterminate', 'true')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick assignee' }))
+
+    await waitFor(() => {
+      expect(mocks.bulkAssignTicketsFn).toHaveBeenCalledWith({
+        data: {
+          ticketIds: ['ticket_1'],
+          assigneePrincipalId: 'principal_assignee',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Assigned 1 ticket')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['tickets', 'queue'] })
+
+    fireEvent.click(screen.getByLabelText('Select all'))
+    expect(screen.getByText('2 selected')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick status' }))
+    await waitFor(() => {
+      expect(mocks.bulkTransitionTicketsFn).toHaveBeenCalledWith({
+        data: {
+          ticketIds: ['ticket_1', 'ticket_2'],
+          statusId: 'ticket_status_solved',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Transitioned 2 tickets')
+
+    fireEvent.click(screen.getByLabelText('Select all'))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick inbox' }))
+    await waitFor(() => {
+      expect(mocks.bulkChangeInboxFn).toHaveBeenCalledWith({
+        data: {
+          ticketIds: ['ticket_1', 'ticket_2'],
+          inboxId: 'inbox_support',
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Moved 2 tickets')
+  })
+
+  it('clears selected rows and reports mutation failures', async () => {
+    mocks.bulkAssignTicketsFn.mockRejectedValueOnce(new Error('No assignment permission'))
+    renderTable([row(1)])
+
+    fireEvent.click(screen.getByLabelText('Select Ticket 1'))
+    fireEvent.click(screen.getByRole('button', { name: 'Clear' }))
+
+    expect(screen.queryByText('1 selected')).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getByLabelText('Select Ticket 1'))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick assignee' }))
+
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('No assignment permission')
+    })
+  })
+
+  it('requires confirmation before applying large bulk actions', async () => {
+    const manyRows = Array.from({ length: 51 }, (_, index) => row(index + 1))
+    renderTable(manyRows)
+
+    fireEvent.click(screen.getByLabelText('Select all'))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick status' }))
+
+    expect(screen.getByRole('alertdialog')).toBeInTheDocument()
+    expect(
+      screen.getByText('You are about to apply this action to 51 tickets. Continue?')
+    ).toBeInTheDocument()
+    expect(mocks.bulkTransitionTicketsFn).not.toHaveBeenCalled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Apply' }))
+
+    await waitFor(() => {
+      expect(mocks.bulkTransitionTicketsFn).toHaveBeenCalledWith({
+        data: {
+          ticketIds: manyRows.map((ticket) => ticket.id),
+          statusId: 'ticket_status_solved',
+        },
+      })
+    })
+  })
+
+  it('can cancel a pending large bulk action', () => {
+    const manyRows = Array.from({ length: 51 }, (_, index) => row(index + 1))
+    renderTable(manyRows)
+
+    fireEvent.click(screen.getByLabelText('Select all'))
+    fireEvent.click(screen.getByRole('button', { name: 'Clear inbox' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+
+    expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
+    expect(mocks.bulkChangeInboxFn).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/components/admin/tickets/__tests__/ticket-side-panels.test.tsx b/apps/web/src/components/admin/tickets/__tests__/ticket-side-panels.test.tsx
new file mode 100644
index 000000000..beeb91178
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/__tests__/ticket-side-panels.test.tsx
@@ -0,0 +1,595 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { TicketLinkedIssues } from '../ticket-linked-issues'
+import { TicketParticipantsList } from '../ticket-participants-list'
+import { TicketPriorityChip, type TicketPriority } from '../ticket-priority-chip'
+import { TicketQueueSidebar } from '../ticket-queue-sidebar'
+import { TicketSharesPanel } from '../ticket-shares-panel'
+import { TicketSlaPanel } from '../ticket-sla-panel'
+import { TicketStatusPill, type StatusCategory } from '../ticket-status-pill'
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  linkedIssuesQuery: {
+    data: [] as Array<{
+      id: string
+      externalUrl: string | null
+      externalDisplayId: string
+      syncDirection: 'outbound' | 'inbound' | 'bidirectional'
+      integrationId: string | null
+    }>,
+    isLoading: false,
+  },
+  myInboxesQuery: {
+    data: [] as Array<{ id: string; name: string }>,
+    isLoading: false,
+  },
+  slaClocks: [] as Array<{
+    id: string
+    kind: string
+    state: string
+    dueAt: string
+    breachedAt?: string | null
+    metAt?: string | null
+  }>,
+  manualSyncTicketFn: vi.fn(),
+  addParticipantFn: vi.fn(),
+  removeParticipantFn: vi.fn(),
+  shareTicketFn: vi.fn(),
+  revokeShareFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQuery: () => mocks.linkedIssuesQuery,
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useSuspenseQuery: () => ({ data: mocks.slaClocks }),
+  useMutation: ({
+    mutationFn,
+    onSuccess,
+    onError,
+  }: {
+    mutationFn: (value?: unknown) => Promise<unknown>
+    onSuccess?: (value: unknown) => void
+    onError?: (error: Error) => void
+  }) => ({
+    isPending: false,
+    mutate: (value?: unknown) => {
+      void mutationFn(value)
+        .then((result) => onSuccess?.(result))
+        .catch((error) => onError?.(error instanceof Error ? error : new Error(String(error))))
+    },
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    to,
+    search,
+    className,
+  }: {
+    children: ReactNode
+    to: string
+    search?: Record<string, unknown>
+    className?: string
+  }) => (
+    <a
+      href={`${to}?${new URLSearchParams(search as Record<string, string>).toString()}`}
+      className={className}
+    >
+      {children}
+    </a>
+  ),
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    externalLinks: (ticketId: string) => ({ queryKey: ['tickets', 'externalLinks', ticketId] }),
+    participants: (ticketId: string) => ({ queryKey: ['tickets', 'participants', ticketId] }),
+    shares: (ticketId: string) => ({ queryKey: ['tickets', 'shares', ticketId] }),
+    slaClocks: (ticketId: string) => ({ queryKey: ['tickets', 'slaClocks', ticketId] }),
+  },
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  manualSyncTicketFn: mocks.manualSyncTicketFn,
+  addParticipantFn: mocks.addParticipantFn,
+  removeParticipantFn: mocks.removeParticipantFn,
+  revokeShareFn: mocks.revokeShareFn,
+  shareTicketFn: mocks.shareTicketFn,
+}))
+
+vi.mock('@/lib/client/hooks/use-inboxes-queries', () => ({
+  useMyInboxes: () => mocks.myInboxesQuery,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    disabled,
+    title,
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    onClick?: () => void
+    disabled?: boolean
+    title?: string
+    'aria-label'?: string
+    variant?: string
+    size?: string
+    className?: string
+  }) => (
+    <button
+      type="button"
+      onClick={onClick}
+      disabled={disabled}
+      title={title}
+      aria-label={ariaLabel}
+    >
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/select', async () => {
+  const React = await import('react')
+  const SelectContext = React.createContext<{
+    onValueChange?: (value: string) => void
+    value?: string
+  }>({})
+  return {
+    Select: ({
+      value,
+      onValueChange,
+      children,
+    }: {
+      value?: string
+      onValueChange?: (value: string) => void
+      children: ReactNode
+    }) => (
+      <SelectContext.Provider value={{ value, onValueChange }}>
+        <div data-value={value}>{children}</div>
+      </SelectContext.Provider>
+    ),
+    SelectContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+    SelectItem: ({ children, value }: { children: ReactNode; value: string }) => {
+      const context = React.useContext(SelectContext)
+      return (
+        <button type="button" onClick={() => context.onValueChange?.(value)}>
+          {children}
+        </button>
+      )
+    },
+    SelectTrigger: ({ children }: { children?: ReactNode; className?: string }) => <>{children}</>,
+    SelectValue: () => {
+      const context = React.useContext(SelectContext)
+      return <span>{context.value}</span>
+    },
+  }
+})
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+  }) => (
+    <section>
+      Principal {value ?? 'none'}
+      <button type="button" onClick={() => onValueChange('principal_2')}>
+        Pick principal
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/contact-picker', () => ({
+  ContactPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+  }) => (
+    <section>
+      Contact {value ?? 'none'}
+      <button type="button" onClick={() => onValueChange('contact_2')}>
+        Pick contact
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({
+    value,
+    onValueChange,
+    placeholder,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+    placeholder?: string
+  }) => (
+    <section>
+      Team {value ?? 'none'} {placeholder}
+      <button type="button" onClick={() => onValueChange('team_2')}>
+        Pick team
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ChevronDownIcon: () => <span aria-hidden="true">down</span>,
+  ChevronRightIcon: () => <span aria-hidden="true">right</span>,
+  GlobeAltIcon: () => <span aria-hidden="true">globe</span>,
+  InboxIcon: () => <span aria-hidden="true">inbox</span>,
+  QuestionMarkCircleIcon: () => <span aria-hidden="true">unknown</span>,
+  ShareIcon: () => <span aria-hidden="true">share</span>,
+  UserIcon: () => <span aria-hidden="true">user</span>,
+  UsersIcon: () => <span aria-hidden="true">users</span>,
+  XMarkIcon: () => <span aria-hidden="true">remove</span>,
+}))
+
+vi.mock('lucide-react', () => ({
+  ExternalLink: () => <span aria-hidden="true">external</span>,
+  GitBranch: () => <span aria-hidden="true">branch</span>,
+  RefreshCw: ({ className }: { className?: string }) => <span className={className}>sync</span>,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.linkedIssuesQuery = { data: [], isLoading: false }
+  mocks.myInboxesQuery = { data: [], isLoading: false }
+  mocks.slaClocks = []
+  mocks.manualSyncTicketFn.mockResolvedValue({ success: true })
+  mocks.addParticipantFn.mockResolvedValue(undefined)
+  mocks.removeParticipantFn.mockResolvedValue(undefined)
+  mocks.revokeShareFn.mockResolvedValue(undefined)
+  mocks.shareTicketFn.mockResolvedValue(undefined)
+  mocks.invalidateQueries.mockResolvedValue(undefined)
+})
+
+describe('TicketLinkedIssues', () => {
+  it('renders linked issues, sync directions, and sync outcomes', async () => {
+    mocks.linkedIssuesQuery = {
+      isLoading: false,
+      data: [
+        {
+          id: 'link_1',
+          externalUrl: 'https://github.test/issues/1',
+          externalDisplayId: 'GH-1',
+          syncDirection: 'outbound',
+          integrationId: 'integration_1',
+        },
+        {
+          id: 'link_2',
+          externalUrl: null,
+          externalDisplayId: 'GH-2',
+          syncDirection: 'inbound',
+          integrationId: null,
+        },
+        {
+          id: 'link_3',
+          externalUrl: 'https://github.test/issues/3',
+          externalDisplayId: 'GH-3',
+          syncDirection: 'bidirectional',
+          integrationId: 'integration_3',
+        },
+      ],
+    }
+
+    render(<TicketLinkedIssues ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByText('Linked Issues')).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /GH-1/ })).toHaveAttribute(
+      'href',
+      'https://github.test/issues/1'
+    )
+    expect(screen.getByRole('link', { name: /GH-2/ })).toHaveAttribute('href', '#')
+    expect(screen.getByText('→')).toBeInTheDocument()
+    expect(screen.getByText('←')).toBeInTheDocument()
+    expect(screen.getByText('↔')).toBeInTheDocument()
+
+    fireEvent.click(screen.getAllByTitle('Sync to GitHub')[0]!)
+    await waitFor(() => {
+      expect(mocks.manualSyncTicketFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket_1', integrationId: 'integration_1', direction: 'push' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Sync completed')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'externalLinks', 'ticket_1'],
+    })
+
+    mocks.manualSyncTicketFn.mockResolvedValueOnce({ success: false, error: 'conflict' })
+    fireEvent.click(screen.getAllByTitle('Sync to GitHub')[2]!)
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('conflict')
+    })
+  })
+
+  it('renders nothing while loading, empty, or failed sync', async () => {
+    const { container, rerender } = render(<TicketLinkedIssues ticketId={'ticket_1' as never} />)
+    expect(container).toBeEmptyDOMElement()
+
+    mocks.linkedIssuesQuery = { data: [], isLoading: true }
+    rerender(<TicketLinkedIssues ticketId={'ticket_1' as never} />)
+    expect(container).toBeEmptyDOMElement()
+
+    mocks.linkedIssuesQuery = {
+      isLoading: false,
+      data: [
+        {
+          id: 'link_1',
+          externalUrl: null,
+          externalDisplayId: 'GH-1',
+          syncDirection: 'outbound',
+          integrationId: 'integration_1',
+        },
+      ],
+    }
+    mocks.manualSyncTicketFn.mockRejectedValueOnce(new Error('network'))
+    rerender(<TicketLinkedIssues ticketId={'ticket_1' as never} />)
+    fireEvent.click(screen.getByTitle('Sync to GitHub'))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Sync failed')
+    })
+  })
+})
+
+describe('TicketParticipantsList', () => {
+  it('lists, removes, and adds principal and contact participants', async () => {
+    render(
+      <TicketParticipantsList
+        ticketId={'ticket_1' as never}
+        participants={[
+          {
+            id: 'participant_1' as never,
+            ticketId: 'ticket_1' as never,
+            principalId: 'principal_1' as never,
+            contactId: null,
+            role: 'watcher',
+          },
+          {
+            id: 'participant_2' as never,
+            ticketId: 'ticket_1' as never,
+            principalId: null,
+            contactId: 'contact_1' as never,
+            role: 'cc',
+          },
+          {
+            id: 'participant_3' as never,
+            ticketId: 'ticket_1' as never,
+            principalId: null,
+            contactId: null,
+            role: 'collaborator',
+          },
+        ]}
+        principalNames={{ principal_1: 'Ada' }}
+        contactNames={{ contact_1: 'Grace' }}
+      />
+    )
+
+    expect(screen.getByText('Ada')).toBeInTheDocument()
+    expect(screen.getByText('Grace')).toBeInTheDocument()
+    expect(screen.getByText('—')).toBeInTheDocument()
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Remove participant' })[0]!)
+    await waitFor(() => {
+      expect(mocks.removeParticipantFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket_1', participantId: 'participant_1' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Participant removed')
+
+    expect(screen.getByRole('button', { name: 'Add participant' })).toBeDisabled()
+    fireEvent.click(screen.getByRole('button', { name: 'Pick principal' }))
+    fireEvent.click(screen.getByRole('button', { name: 'collaborator' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Add participant' }))
+    await waitFor(() => {
+      expect(mocks.addParticipantFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          role: 'collaborator',
+          principalId: 'principal_2',
+          contactId: null,
+        },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Participant added')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Contact' }))
+    fireEvent.click(screen.getByRole('button', { name: 'cc' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick contact' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Add participant' }))
+    await waitFor(() => {
+      expect(mocks.addParticipantFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          role: 'cc',
+          principalId: null,
+          contactId: 'contact_2',
+        },
+      })
+    })
+  })
+
+  it('shows empty participants and mutation errors', async () => {
+    mocks.addParticipantFn.mockRejectedValueOnce(new Error('duplicate'))
+    render(<TicketParticipantsList ticketId={'ticket_1' as never} participants={[]} />)
+
+    expect(screen.getByText('No participants.')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Pick principal' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Add participant' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('duplicate')
+    })
+  })
+})
+
+describe('TicketPriorityChip', () => {
+  it('renders all priority labels', () => {
+    ;(['low', 'normal', 'high', 'urgent'] as TicketPriority[]).forEach((priority) => {
+      const { unmount } = render(<TicketPriorityChip priority={priority} className="extra" />)
+      expect(screen.getByText(priority)).toHaveClass('extra')
+      unmount()
+    })
+  })
+})
+
+describe('TicketSharesPanel', () => {
+  it('lists, revokes, and adds team shares when permitted', async () => {
+    render(
+      <TicketSharesPanel
+        ticketId={'ticket_1' as never}
+        shares={[
+          {
+            id: 'share_1' as never,
+            ticketId: 'ticket_1' as never,
+            teamId: 'team_1' as never,
+            accessLevel: 'read',
+          },
+          {
+            id: 'share_2' as never,
+            ticketId: 'ticket_1' as never,
+            teamId: 'team_unknown' as never,
+            accessLevel: 'full',
+          },
+        ]}
+        teamNames={{ team_1: 'Success' }}
+        canShare
+      />
+    )
+
+    expect(screen.getByText('Success')).toBeInTheDocument()
+    expect(screen.getByText('team_unknown')).toBeInTheDocument()
+    fireEvent.click(screen.getAllByRole('button', { name: 'Revoke share' })[0]!)
+    await waitFor(() => {
+      expect(mocks.revokeShareFn).toHaveBeenCalledWith({ data: { shareId: 'share_1' } })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Share revoked')
+
+    expect(screen.getByRole('button', { name: 'Share' })).toBeDisabled()
+    fireEvent.click(screen.getByRole('button', { name: 'Pick team' }))
+    fireEvent.click(screen.getByRole('button', { name: 'full' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }))
+    await waitFor(() => {
+      expect(mocks.shareTicketFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket_1', teamId: 'team_2', accessLevel: 'full' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Ticket shared')
+  })
+
+  it('hides share controls when not permitted and reports share errors', async () => {
+    const { rerender } = render(
+      <TicketSharesPanel ticketId={'ticket_1' as never} shares={[]} canShare={false} />
+    )
+    expect(screen.getByText('Not shared with any teams.')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Share' })).not.toBeInTheDocument()
+
+    mocks.shareTicketFn.mockRejectedValueOnce(new Error('cannot share'))
+    rerender(<TicketSharesPanel ticketId={'ticket_1' as never} shares={[]} canShare />)
+    fireEvent.click(screen.getByRole('button', { name: 'Pick team' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('cannot share')
+    })
+  })
+})
+
+describe('TicketSlaPanel and TicketStatusPill', () => {
+  it('renders empty and populated SLA clocks', () => {
+    const { rerender } = render(<TicketSlaPanel ticketId={'ticket_1' as never} />)
+    expect(screen.getByText('No SLA clocks on this ticket.')).toBeInTheDocument()
+
+    mocks.slaClocks = [
+      {
+        id: 'clock_1',
+        kind: 'first_response',
+        state: 'running',
+        dueAt: '2026-06-20T12:00:00.000Z',
+        breachedAt: null,
+        metAt: null,
+      },
+      {
+        id: 'clock_2',
+        kind: 'custom_kind',
+        state: 'paused',
+        dueAt: '2026-06-20T12:00:00.000Z',
+      },
+    ]
+    rerender(<TicketSlaPanel ticketId={'ticket_1' as never} />)
+    expect(screen.getByText('First response')).toBeInTheDocument()
+    expect(screen.getByText('custom_kind')).toBeInTheDocument()
+  })
+
+  it('renders all status category pills', () => {
+    ;(['open', 'pending', 'on_hold', 'solved', 'closed'] as StatusCategory[]).forEach(
+      (category) => {
+        const { unmount } = render(
+          <TicketStatusPill name={`Status ${category}`} category={category} className="extra" />
+        )
+        expect(screen.getByText(`Status ${category}`)).toHaveClass('extra')
+        unmount()
+      }
+    )
+  })
+})
+
+describe('TicketQueueSidebar', () => {
+  it('renders saved views, inbox links, and collapse behavior', () => {
+    mocks.myInboxesQuery = {
+      isLoading: false,
+      data: [
+        { id: 'inbox_1', name: 'Support' },
+        { id: 'inbox_2', name: 'Billing' },
+      ],
+    }
+
+    render(<TicketQueueSidebar activeScope="inbox" activeInboxId="inbox_2" />)
+
+    expect(screen.getByRole('link', { name: /Assigned to me/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('scope=my_assigned')
+    )
+    expect(screen.getByRole('link', { name: /All/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('scope=all')
+    )
+    expect(screen.getByRole('link', { name: /Billing/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('inboxId=inbox_2')
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /By inbox/ }))
+    expect(screen.queryByRole('link', { name: /Support/ })).not.toBeInTheDocument()
+  })
+
+  it('renders loading and empty inbox states', () => {
+    mocks.myInboxesQuery = { data: [], isLoading: true }
+    const { rerender } = render(<TicketQueueSidebar activeScope="all" />)
+    expect(screen.getByText(/Loading/)).toBeInTheDocument()
+
+    mocks.myInboxesQuery = { data: [], isLoading: false }
+    rerender(<TicketQueueSidebar activeScope="my_team" />)
+    expect(screen.getByText('No inboxes')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/tickets/__tests__/ticket-subscription-menu.test.tsx b/apps/web/src/components/admin/tickets/__tests__/ticket-subscription-menu.test.tsx
new file mode 100644
index 000000000..d4bb0c997
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/__tests__/ticket-subscription-menu.test.tsx
@@ -0,0 +1,294 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { TicketSubscriptionMenu } from '../ticket-subscription-menu'
+
+type Subscription = {
+  mutedUntil: string | null
+  notifyThreads: boolean
+  notifyStatus: boolean
+  notifyAssignment: boolean
+  notifyParticipants: boolean
+  notifyShares: boolean
+  notifySla: boolean
+}
+
+type MutationOptions<TVars, TResult> = {
+  mutationFn: (vars: TVars) => Promise<TResult>
+  onSuccess?: (result: TResult) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  getMyTicketSubscriptionFn: vi.fn(),
+  subscribeToTicketFn: vi.fn(),
+  unsubscribeFromTicketFn: vi.fn(),
+  updateTicketSubscriptionPrefsFn: vi.fn(),
+  muteTicketFn: vi.fn(),
+  unmuteTicketFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  subscription: null as Subscription | null,
+  isLoading: false,
+  pending: false,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useQuery: (options: { queryFn: () => unknown }) => {
+    options.queryFn()
+    return {
+      data: mocks.subscription,
+      isLoading: mocks.isLoading,
+    }
+  },
+  useMutation: <TVars, TResult>(options: MutationOptions<TVars, TResult>) => ({
+    isPending: mocks.pending,
+    mutate: async (vars: TVars) => {
+      try {
+        const result = await options.mutationFn(vars)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    'aria-label': ariaLabel,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    variant?: string
+    size?: string
+    'aria-label'?: string
+  }) => (
+    <button type="button" disabled={disabled} aria-label={ariaLabel}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/dropdown-menu', () => ({
+  DropdownMenu: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DropdownMenuCheckboxItem: ({
+    children,
+    checked,
+    onCheckedChange,
+    onSelect,
+  }: {
+    children: ReactNode
+    checked: boolean
+    onCheckedChange: (checked: boolean) => void
+    onSelect?: (event: { preventDefault: () => void }) => void
+  }) => (
+    <button
+      type="button"
+      role="menuitemcheckbox"
+      aria-checked={checked}
+      onClick={() => {
+        onCheckedChange(!checked)
+        onSelect?.({ preventDefault: vi.fn() })
+      }}
+    >
+      {children}
+    </button>
+  ),
+  DropdownMenuContent: ({
+    children,
+  }: {
+    children: ReactNode
+    align?: string
+    className?: string
+  }) => <div>{children}</div>,
+  DropdownMenuItem: ({
+    children,
+    onSelect,
+  }: {
+    children: ReactNode
+    onSelect?: () => void
+    className?: string
+  }) => (
+    <button type="button" onClick={onSelect}>
+      {children}
+    </button>
+  ),
+  DropdownMenuLabel: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DropdownMenuSeparator: () => <hr />,
+  DropdownMenuSub: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DropdownMenuSubContent: ({ children }: { children: ReactNode; className?: string }) => (
+    <div>{children}</div>
+  ),
+  DropdownMenuSubTrigger: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DropdownMenuTrigger: ({ children }: { children: ReactNode; asChild?: boolean }) => (
+    <>{children}</>
+  ),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  BellAlertIcon: () => <span aria-hidden="true">bell-alert</span>,
+  BellIcon: () => <span aria-hidden="true">bell</span>,
+  BellSlashIcon: () => <span aria-hidden="true">bell-slash</span>,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  BellIcon: () => <span aria-hidden="true">bell-solid</span>,
+}))
+
+vi.mock('@/lib/server/functions/notifications', () => ({
+  getMyTicketSubscriptionFn: mocks.getMyTicketSubscriptionFn,
+  subscribeToTicketFn: mocks.subscribeToTicketFn,
+  unsubscribeFromTicketFn: mocks.unsubscribeFromTicketFn,
+  updateTicketSubscriptionPrefsFn: mocks.updateTicketSubscriptionPrefsFn,
+  muteTicketFn: mocks.muteTicketFn,
+  unmuteTicketFn: mocks.unmuteTicketFn,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function subscription(overrides: Partial<Subscription> = {}): Subscription {
+  return {
+    mutedUntil: null,
+    notifyThreads: true,
+    notifyStatus: false,
+    notifyAssignment: true,
+    notifyParticipants: false,
+    notifyShares: true,
+    notifySla: false,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.subscription = null
+  mocks.isLoading = false
+  mocks.pending = false
+  mocks.getMyTicketSubscriptionFn.mockResolvedValue(mocks.subscription)
+  mocks.subscribeToTicketFn.mockResolvedValue(subscription())
+  mocks.unsubscribeFromTicketFn.mockResolvedValue(undefined)
+  mocks.updateTicketSubscriptionPrefsFn.mockResolvedValue(subscription())
+  mocks.muteTicketFn.mockResolvedValue(subscription({ mutedUntil: '2099-01-01T00:00:00.000Z' }))
+  mocks.unmuteTicketFn.mockResolvedValue(subscription())
+})
+
+describe('TicketSubscriptionMenu', () => {
+  it('subscribes when no subscription exists and handles subscribe errors', async () => {
+    render(<TicketSubscriptionMenu ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByRole('button', { name: 'Subscribe to ticket' })).toBeEnabled()
+    expect(mocks.getMyTicketSubscriptionFn).toHaveBeenCalledWith({
+      data: { ticketId: 'ticket_1' },
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Subscribe' }))
+    await waitFor(() => {
+      expect(mocks.subscribeToTicketFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket_1' },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'my-subscription', 'ticket_1'],
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Subscribed')
+
+    mocks.subscribeToTicketFn.mockRejectedValueOnce(new Error('Subscribe denied'))
+    fireEvent.click(screen.getByRole('button', { name: 'Subscribe' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Subscribe denied')
+    })
+  })
+
+  it('unsubscribes, updates preferences and mutes subscribed tickets', async () => {
+    mocks.subscription = subscription()
+    render(<TicketSubscriptionMenu ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByRole('button', { name: 'Subscription menu (subscribed)' })).toBeEnabled()
+    fireEvent.click(screen.getByRole('button', { name: 'Unsubscribe' }))
+    await waitFor(() => {
+      expect(mocks.unsubscribeFromTicketFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket_1' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Unsubscribed')
+
+    fireEvent.click(screen.getByRole('menuitemcheckbox', { name: 'Status changes' }))
+    await waitFor(() => {
+      expect(mocks.updateTicketSubscriptionPrefsFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          patch: { notifyStatus: true },
+        },
+      })
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Mute until I unmute' }))
+    await waitFor(() => {
+      expect(mocks.muteTicketFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket_1' },
+      })
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Muted')
+  })
+
+  it('unmutes muted subscriptions and reports mutation errors', async () => {
+    mocks.subscription = subscription({ mutedUntil: '2099-01-01T00:00:00.000Z' })
+    mocks.updateTicketSubscriptionPrefsFn.mockRejectedValueOnce(new Error('Prefs denied'))
+    mocks.muteTicketFn.mockRejectedValueOnce(new Error('Mute denied'))
+    mocks.unmuteTicketFn.mockRejectedValueOnce(new Error('Unmute denied'))
+    mocks.unsubscribeFromTicketFn.mockRejectedValueOnce(new Error('Unsubscribe denied'))
+
+    render(<TicketSubscriptionMenu ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByRole('button', { name: 'Subscription menu (muted)' })).toBeEnabled()
+
+    fireEvent.click(screen.getByRole('menuitemcheckbox', { name: 'New replies' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Prefs denied')
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Mute for 1 hour' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Mute denied')
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Unmute' }))
+    await waitFor(() => {
+      expect(mocks.unmuteTicketFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket_1' },
+      })
+    })
+    expect(mocks.toastError).toHaveBeenCalledWith('Unmute denied')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Unsubscribe' }))
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Unsubscribe denied')
+    })
+  })
+
+  it('disables the trigger while loading or any mutation is pending', () => {
+    mocks.isLoading = true
+    const { rerender } = render(<TicketSubscriptionMenu ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByRole('button', { name: 'Subscribe to ticket' })).toBeDisabled()
+
+    mocks.isLoading = false
+    mocks.pending = true
+    rerender(<TicketSubscriptionMenu ticketId={'ticket_1' as never} />)
+
+    expect(screen.getByRole('button', { name: 'Subscribe to ticket' })).toBeDisabled()
+  })
+})
diff --git a/apps/web/src/components/admin/tickets/__tests__/ticket-thread-composer.test.tsx b/apps/web/src/components/admin/tickets/__tests__/ticket-thread-composer.test.tsx
new file mode 100644
index 000000000..703be3f46
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/__tests__/ticket-thread-composer.test.tsx
@@ -0,0 +1,373 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { TicketThreadComposer } from '../ticket-thread-composer'
+
+type MutationOptions = {
+  mutationFn: () => Promise<{ id?: string }>
+  onSuccess?: (result: { id?: string }) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  addThreadFn: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  uploadImage: vi.fn(),
+  fetchMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+  }),
+  useMutation: (options: MutationOptions) => ({
+    isPending: false,
+    mutate: async () => {
+      try {
+        const result = await options.mutationFn()
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    size?: string
+    variant?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/tabs', () => {
+  let changeTab: (value: string) => void = () => undefined
+
+  return {
+    Tabs: ({
+      children,
+      onValueChange,
+    }: {
+      children: ReactNode
+      value: string
+      onValueChange: (value: string) => void
+      className?: string
+    }) => {
+      changeTab = onValueChange
+      return <div>{children}</div>
+    },
+    TabsList: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+    TabsTrigger: ({ children, value }: { children: ReactNode; value: string }) => (
+      <button type="button" onClick={() => changeTab(value)}>
+        {children}
+      </button>
+    ),
+  }
+})
+
+vi.mock('@/components/ui/rich-text-editor', () => ({
+  RichTextEditor: ({
+    onChange,
+    placeholder,
+    onImageUpload,
+  }: {
+    onChange: (json: { type: 'doc'; content?: unknown[] }, html: string, markdown: string) => void
+    placeholder: string
+    onImageUpload?: (file: File) => Promise<unknown>
+  }) => (
+    <div>
+      <textarea
+        aria-label={placeholder}
+        onChange={(event) => {
+          const text = event.currentTarget.value
+          onChange(
+            {
+              type: 'doc',
+              content: [
+                {
+                  type: 'paragraph',
+                  content: text ? [{ type: 'text', text }] : [],
+                },
+              ],
+            },
+            '',
+            text
+          )
+        }}
+      />
+      <button
+        type="button"
+        onClick={() =>
+          onChange(
+            {
+              type: 'doc',
+              content: [
+                {
+                  type: 'heading',
+                  content: [{ type: 'text', text: 'From rich json' }],
+                },
+              ],
+            },
+            '',
+            ''
+          )
+        }
+      >
+        Set JSON body
+      </button>
+      <button type="button" onClick={() => void onImageUpload?.(new File(['image'], 'inline.png'))}>
+        Upload inline image
+      </button>
+    </div>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({ onValueChange }: { onValueChange: (id: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('team_success')}>
+      Pick sharing team
+    </button>
+  ),
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  addThreadFn: mocks.addThreadFn,
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    attachments: (ticketId: string, threadId: string) => ({
+      queryKey: ['tickets', ticketId, 'threads', threadId, 'attachments'],
+    }),
+    threads: (ticketId: string) => ({ queryKey: ['tickets', ticketId, 'threads'] }),
+    detail: (ticketId: string) => ({ queryKey: ['tickets', ticketId, 'detail'] }),
+  },
+}))
+
+vi.mock('@/lib/client/hooks/use-image-upload', () => ({
+  useImageUpload: ({ prefix }: { prefix: string }) => ({
+    upload: (file: File) => mocks.uploadImage({ prefix, file }),
+  }),
+}))
+
+vi.mock('lucide-react', () => ({
+  X: () => <span>Remove attachment</span>,
+  Upload: () => <span>Upload icon</span>,
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+function renderComposer(props: Partial<React.ComponentProps<typeof TicketThreadComposer>> = {}) {
+  return render(
+    <TicketThreadComposer
+      ticketId={'ticket_1' as never}
+      canPublic
+      canInternal
+      canShared
+      {...props}
+    />
+  )
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.addThreadFn.mockResolvedValue({ id: 'ticket_thread_1' })
+  mocks.uploadImage.mockResolvedValue({ url: 'https://cdn.test/inline.png' })
+  mocks.fetchMock.mockResolvedValue({
+    ok: true,
+    text: async () => '',
+  })
+  vi.stubGlobal('fetch', mocks.fetchMock)
+})
+
+describe('TicketThreadComposer', () => {
+  it('renders a permission-denied state when no audience is allowed', () => {
+    renderComposer({ canPublic: false, canInternal: false, canShared: false })
+
+    expect(
+      screen.getByText("You don't have permission to reply on this ticket.")
+    ).toBeInTheDocument()
+  })
+
+  it('posts a public reply and invalidates ticket queries', async () => {
+    const onPosted = vi.fn()
+    renderComposer({ onPosted })
+
+    expect(screen.getByRole('button', { name: 'Post' })).toBeDisabled()
+    fireEvent.change(screen.getByLabelText(/Reply to customer/), {
+      target: { value: 'Customer-visible reply' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Post' }))
+
+    await waitFor(() => {
+      expect(mocks.addThreadFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_1',
+          audience: 'public',
+          bodyJson: {
+            type: 'doc',
+            content: [
+              {
+                type: 'paragraph',
+                content: [{ type: 'text', text: 'Customer-visible reply' }],
+              },
+            ],
+          },
+          bodyText: 'Customer-visible reply',
+          sharedWithTeamId: null,
+        },
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'ticket_1', 'threads'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'ticket_1', 'detail'],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({ queryKey: ['tickets', 'list'] })
+    expect(onPosted).toHaveBeenCalled()
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Reply posted')
+  })
+
+  it('posts an internal note using plain text extracted from rich JSON', async () => {
+    renderComposer({ canPublic: false, canShared: false })
+
+    fireEvent.click(screen.getByRole('button', { name: 'Set JSON body' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Post' }))
+
+    await waitFor(() => {
+      expect(mocks.addThreadFn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            audience: 'internal',
+            bodyText: 'From rich json',
+            sharedWithTeamId: null,
+          }),
+        })
+      )
+    })
+  })
+
+  it('requires a selected team before posting a shared-team note', async () => {
+    renderComposer({ canPublic: false, canInternal: false })
+
+    fireEvent.change(screen.getByLabelText(/Visible to your team/), {
+      target: { value: 'Shared note' },
+    })
+    expect(screen.getByRole('button', { name: 'Post' })).toBeDisabled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Pick sharing team' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Post' }))
+
+    await waitFor(() => {
+      expect(mocks.addThreadFn).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            audience: 'shared_team',
+            bodyText: 'Shared note',
+            sharedWithTeamId: 'team_success',
+          }),
+        })
+      )
+    })
+  })
+
+  it('uploads selected attachments and reports per-file upload failures', async () => {
+    mocks.fetchMock
+      .mockResolvedValueOnce({ ok: true, text: async () => '' })
+      .mockResolvedValueOnce({ ok: false, text: async () => 'storage down' })
+    const { container } = renderComposer()
+
+    fireEvent.change(screen.getByLabelText(/Reply to customer/), {
+      target: { value: 'Reply with files' },
+    })
+    const input = container.querySelector('input[type="file"]') as HTMLInputElement
+    fireEvent.change(input, {
+      target: {
+        files: [
+          new File(['one'], 'one.txt', { type: 'text/plain' }),
+          new File(['two'], 'two.txt', { type: 'text/plain' }),
+        ],
+      },
+    })
+
+    expect(screen.getByText('Attachments (2)')).toBeInTheDocument()
+    expect(screen.getByText('one.txt')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Post' }))
+
+    await waitFor(() => {
+      expect(mocks.fetchMock).toHaveBeenCalledTimes(2)
+    })
+    expect(mocks.fetchMock).toHaveBeenCalledWith(
+      '/api/v1/tickets/ticket_1/threads/ticket_thread_1/attachments',
+      expect.objectContaining({
+        method: 'POST',
+        body: expect.any(FormData),
+      })
+    )
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      'Failed to upload two.txt: Upload failed: storage down'
+    )
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['tickets', 'ticket_1', 'threads', 'ticket_thread_1', 'attachments'],
+    })
+  })
+
+  it('can remove selected attachments before posting', () => {
+    const { container } = renderComposer()
+    const input = container.querySelector('input[type="file"]') as HTMLInputElement
+    fireEvent.change(input, {
+      target: {
+        files: [new File(['one'], 'one.txt'), new File(['two'], 'two.txt')],
+      },
+    })
+
+    fireEvent.click(screen.getAllByRole('button', { name: 'Remove attachment' })[0])
+
+    expect(screen.queryByText('one.txt')).not.toBeInTheDocument()
+    expect(screen.getByText('two.txt')).toBeInTheDocument()
+    expect(screen.getByText('Attachments (1)')).toBeInTheDocument()
+  })
+
+  it('reports posting failures and wires inline image uploads', async () => {
+    mocks.addThreadFn.mockRejectedValueOnce(new Error('Cannot reply to closed ticket'))
+    renderComposer()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Upload inline image' }))
+    expect(mocks.uploadImage).toHaveBeenCalledWith({
+      prefix: 'uploads',
+      file: expect.objectContaining({ name: 'inline.png' }),
+    })
+
+    fireEvent.change(screen.getByLabelText(/Reply to customer/), {
+      target: { value: 'Reply fails' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Post' }))
+
+    expect(await screen.findByText('Post')).toBeInTheDocument()
+    await waitFor(() => {
+      expect(mocks.toastError).toHaveBeenCalledWith('Cannot reply to closed ticket')
+    })
+  })
+})
diff --git a/apps/web/src/components/admin/tickets/__tests__/ticket-thread-feed.test.tsx b/apps/web/src/components/admin/tickets/__tests__/ticket-thread-feed.test.tsx
new file mode 100644
index 000000000..26e98fc52
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/__tests__/ticket-thread-feed.test.tsx
@@ -0,0 +1,272 @@
+// @vitest-environment happy-dom
+import { describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import type { ReactElement } from 'react'
+import type { JSONContent } from '@tiptap/react'
+import { TicketThreadFeed } from '../ticket-thread-feed'
+
+// Thread rows render a `ThreadAttachmentsLoader` that calls
+// `useQuery(ticketQueries.attachments(...))`. Stub the query options so the
+// loader resolves to an empty attachment list (and renders nothing) instead of
+// hitting a real server function.
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    attachments: vi.fn((ticketId: string, threadId: string) => ({
+      queryKey: ['tickets', ticketId, 'threads', threadId, 'attachments'],
+      queryFn: async () => [],
+    })),
+  },
+}))
+
+// TicketAttachments uses react-intl <FormattedMessage>, which needs an
+// IntlProvider this test doesn't supply. The attachment list is not under
+// test here (these tests assert on author labels), so stub it out.
+vi.mock('@/components/tickets/ticket-attachments', () => ({
+  TicketAttachments: () => null,
+}))
+
+function renderWithClient(ui: ReactElement) {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  return render(<QueryClientProvider client={qc}>{ui}</QueryClientProvider>)
+}
+
+vi.mock('@/components/ui/rich-text-editor', () => {
+  function textFromDoc(content: unknown): string {
+    if (!content || typeof content !== 'object') return ''
+    let out = ''
+    const walk = (node: { type?: string; text?: unknown; content?: unknown[] }) => {
+      if (node.type === 'text' && typeof node.text === 'string') out += node.text
+      node.content?.forEach((child) => walk(child as never))
+    }
+    walk(content as never)
+    return out
+  }
+
+  return {
+    isRichTextContent: (content: unknown) =>
+      typeof content === 'object' &&
+      content !== null &&
+      'type' in content &&
+      (content as { type?: string }).type === 'doc',
+    RichTextContent: ({ content }: { content: unknown }) => (
+      <div data-testid="rich-text-content">{textFromDoc(content)}</div>
+    ),
+    RichTextEditor: ({
+      value,
+      onChange,
+      placeholder,
+    }: {
+      value?: JSONContent
+      onChange: (json: JSONContent, html: string, markdown: string) => void
+      placeholder: string
+    }) => (
+      <textarea
+        aria-label={placeholder}
+        defaultValue={textFromDoc(value)}
+        onChange={(event) => {
+          const text = event.currentTarget.value
+          onChange(
+            {
+              type: 'doc',
+              content: [
+                {
+                  type: 'paragraph',
+                  content: text ? [{ type: 'text', text }] : [],
+                },
+              ],
+            },
+            '',
+            text
+          )
+        }}
+      />
+    ),
+  }
+})
+
+describe('TicketThreadFeed description editing', () => {
+  it('renders a read-only description when no update callback is provided', () => {
+    renderWithClient(
+      <TicketThreadFeed threads={[]} description={{ text: 'Original description', json: null }} />
+    )
+
+    expect(screen.getByText('Original description')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: /edit/i })).not.toBeInTheDocument()
+  })
+
+  it('calls onDescriptionUpdate with edited rich text content', () => {
+    const onDescriptionUpdate = vi.fn()
+    renderWithClient(
+      <TicketThreadFeed threads={[]} description={null} onDescriptionUpdate={onDescriptionUpdate} />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /add a description/i }))
+    fireEvent.change(screen.getByLabelText('Add a description...'), {
+      target: { value: 'Updated description' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(onDescriptionUpdate).toHaveBeenCalledWith(
+      {
+        type: 'doc',
+        content: [
+          {
+            type: 'paragraph',
+            content: [{ type: 'text', text: 'Updated description' }],
+          },
+        ],
+      },
+      'Updated description'
+    )
+  })
+
+  it('seeds the editor from plain text when editing an existing description', () => {
+    const onDescriptionUpdate = vi.fn()
+    renderWithClient(
+      <TicketThreadFeed
+        threads={[]}
+        description={{ text: 'Line one\nLine two', json: null }}
+        onDescriptionUpdate={onDescriptionUpdate}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /edit/i }))
+    expect(screen.getByLabelText('Add a description...')).toHaveValue('Line oneLine two')
+  })
+
+  it('saves existing rich text by deriving fallback plain text from JSON', () => {
+    const onDescriptionUpdate = vi.fn()
+    const descriptionJson: JSONContent = {
+      type: 'doc',
+      content: [
+        {
+          type: 'paragraph',
+          content: [{ type: 'text', text: 'JSON description' }],
+        },
+      ],
+    }
+
+    renderWithClient(
+      <TicketThreadFeed
+        threads={[]}
+        description={{ text: null, json: descriptionJson }}
+        onDescriptionUpdate={onDescriptionUpdate}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /edit/i }))
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(onDescriptionUpdate).toHaveBeenCalledWith(descriptionJson, 'JSON description')
+  })
+
+  it('treats media-only rich text as a visible description', () => {
+    renderWithClient(
+      <TicketThreadFeed
+        threads={[]}
+        description={{
+          text: null,
+          json: {
+            type: 'doc',
+            content: [{ type: 'horizontalRule' }],
+          },
+        }}
+      />
+    )
+
+    expect(screen.getByText('Description')).toBeInTheDocument()
+    expect(screen.getByTestId('rich-text-content')).toBeInTheDocument()
+  })
+})
+
+describe('TicketThreadFeed author labels', () => {
+  it('renders principal display names instead of raw principal IDs', () => {
+    renderWithClient(
+      <TicketThreadFeed
+        threads={[
+          {
+            id: 'ticket_thread_1',
+            ticketId: 'ticket_1' as never,
+            principalId: 'principal_01ktxq7sh1fevtx68ee59xpvx0' as never,
+            audience: 'public',
+            bodyJson: null,
+            bodyText: 'Reply body',
+            sharedWithTeamId: null,
+            createdAt: '2026-06-12T10:00:00.000Z',
+            editedAt: null,
+          },
+        ]}
+        principalNames={{
+          principal_01ktxq7sh1fevtx68ee59xpvx0: 'Meli Sunbul',
+        }}
+      />
+    )
+
+    expect(screen.getByText('Meli Sunbul')).toBeInTheDocument()
+    expect(screen.queryByText(/principal_01ktxq7/i)).not.toBeInTheDocument()
+  })
+
+  it('does not expose raw principal IDs when a display name is missing', () => {
+    renderWithClient(
+      <TicketThreadFeed
+        threads={[
+          {
+            id: 'ticket_thread_1',
+            ticketId: 'ticket_1' as never,
+            principalId: 'principal_missing_name' as never,
+            audience: 'public',
+            bodyJson: null,
+            bodyText: 'Reply body',
+            sharedWithTeamId: null,
+            createdAt: '2026-06-12T10:00:00.000Z',
+            editedAt: null,
+          },
+        ]}
+      />
+    )
+
+    expect(screen.getByText('Unknown')).toBeInTheDocument()
+    expect(screen.queryByText('principal_missing_name')).not.toBeInTheDocument()
+  })
+
+  it('renders audience labels, team names, system authors, and edited markers', () => {
+    renderWithClient(
+      <TicketThreadFeed
+        threads={[
+          {
+            id: 'ticket_thread_1',
+            ticketId: 'ticket_1' as never,
+            principalId: null,
+            audience: 'internal',
+            bodyJson: null,
+            bodyText: 'Private note',
+            sharedWithTeamId: null,
+            createdAt: '2026-06-12T10:00:00.000Z',
+            editedAt: '2026-06-12T10:30:00.000Z',
+          },
+          {
+            id: 'ticket_thread_2',
+            ticketId: 'ticket_1' as never,
+            principalId: 'principal_agent' as never,
+            audience: 'shared_team',
+            bodyJson: null,
+            bodyText: 'Escalated to billing',
+            sharedWithTeamId: 'team_billing' as never,
+            createdAt: '2026-06-12T11:00:00.000Z',
+            editedAt: null,
+          },
+        ]}
+        teamNames={{ team_billing: 'Billing' }}
+        principalNames={{ principal_agent: 'Agent Smith' }}
+      />
+    )
+
+    expect(screen.getByText('System')).toBeInTheDocument()
+    expect(screen.getByText('Internal note')).toBeInTheDocument()
+    expect(screen.getByText('(edited)')).toBeInTheDocument()
+    expect(screen.getByText('Agent Smith')).toBeInTheDocument()
+    expect(screen.getByText(/Shared with team/)).toBeInTheDocument()
+    expect(screen.getByText(/Billing/)).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/admin/tickets/sla-clock-chip.tsx b/apps/web/src/components/admin/tickets/sla-clock-chip.tsx
new file mode 100644
index 000000000..320d7e1c9
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/sla-clock-chip.tsx
@@ -0,0 +1,90 @@
+/**
+ * Compact countdown chip for an SLA clock. Color ramps from green (>1h to due)
+ * through amber (<1h) to red (breached).
+ */
+import { useEffect, useState } from 'react'
+import { cn } from '@/lib/shared/utils'
+
+export type SlaClockState = 'running' | 'paused' | 'met' | 'breached' | 'cancelled'
+export type SlaClockKind = 'first_response' | 'next_response' | 'resolution'
+
+export interface SlaClockChipInput {
+  kind: SlaClockKind
+  state: SlaClockState
+  dueAt: string | Date
+  breachedAt?: string | Date | null
+  metAt?: string | Date | null
+}
+
+export interface SlaClockChipProps {
+  clock: SlaClockChipInput
+  className?: string
+  /** Show the kind label (e.g. "First response") inline. */
+  showKind?: boolean
+}
+
+function formatDelta(ms: number): string {
+  const abs = Math.abs(ms)
+  const minutes = Math.floor(abs / 60_000)
+  if (minutes < 1) return '<1m'
+  if (minutes < 60) return `${minutes}m`
+  const hours = Math.floor(minutes / 60)
+  if (hours < 24) return `${hours}h ${minutes % 60}m`
+  const days = Math.floor(hours / 24)
+  return `${days}d ${hours % 24}h`
+}
+
+const KIND_LABEL: Record<SlaClockKind, string> = {
+  first_response: 'First response',
+  next_response: 'Next response',
+  resolution: 'Resolution',
+}
+
+export function SlaClockChip({ clock, className, showKind = false }: SlaClockChipProps) {
+  // Re-render every 30s so countdown stays fresh.
+  const [, setTick] = useState(0)
+  useEffect(() => {
+    const t = setInterval(() => setTick((v) => v + 1), 30_000)
+    return () => clearInterval(t)
+  }, [])
+
+  const due = new Date(clock.dueAt).getTime()
+  const now = Date.now()
+  const remainingMs = due - now
+
+  let label: string
+  let style: string
+  if (clock.state === 'met') {
+    label = 'Met'
+    style = 'bg-emerald-100 text-emerald-800 dark:bg-emerald-950 dark:text-emerald-200'
+  } else if (clock.state === 'breached' || remainingMs < 0) {
+    label = `−${formatDelta(remainingMs)}`
+    style = 'bg-red-100 text-red-800 dark:bg-red-950 dark:text-red-200'
+  } else if (clock.state === 'paused') {
+    label = 'Paused'
+    style = 'bg-slate-100 text-slate-700 dark:bg-slate-800 dark:text-slate-200'
+  } else if (clock.state === 'cancelled') {
+    label = 'Cancelled'
+    style = 'bg-muted text-muted-foreground'
+  } else {
+    label = formatDelta(remainingMs)
+    style =
+      remainingMs < 60 * 60_000
+        ? 'bg-amber-100 text-amber-800 dark:bg-amber-950 dark:text-amber-200'
+        : 'bg-emerald-100 text-emerald-800 dark:bg-emerald-950 dark:text-emerald-200'
+  }
+
+  return (
+    <span
+      className={cn(
+        'inline-flex items-center gap-1 rounded-full px-2 py-0.5 text-xs font-medium tabular-nums',
+        style,
+        className
+      )}
+      title={`${KIND_LABEL[clock.kind]} due ${new Date(clock.dueAt).toLocaleString()}`}
+    >
+      {showKind && <span className="opacity-70">{KIND_LABEL[clock.kind]}:</span>}
+      {label}
+    </span>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-activity-timeline.tsx b/apps/web/src/components/admin/tickets/ticket-activity-timeline.tsx
new file mode 100644
index 000000000..b146efbad
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-activity-timeline.tsx
@@ -0,0 +1,515 @@
+/**
+ * Right-panel "Activity" tab. Renders the ticket's audit timeline pulled via
+ * `ticketQueries.activity()`. Each row turns the stored audit event and
+ * metadata into a readable product summary instead of exposing raw JSON/IDs.
+ */
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { TicketId } from '@quackback/ids'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { TimeAgo } from '@/components/ui/time-ago'
+import { Badge } from '@/components/ui/badge'
+import {
+  ArrowRight,
+  CheckCircle2,
+  MessageSquare,
+  Paperclip,
+  Pencil,
+  Plus,
+  RotateCcw,
+  Route,
+  Settings2,
+  Share2,
+  Trash2,
+  UserCheck,
+  UserMinus,
+  UserPlus,
+  UserX,
+  type LucideIcon,
+} from 'lucide-react'
+import type { ReactNode } from 'react'
+
+export interface TicketActivityTimelineProps {
+  ticketId: TicketId
+  principalNames?: Record<string, string>
+}
+
+interface ActivityRow {
+  id: string
+  principalId: string | null
+  type: string
+  metadata: unknown
+  createdAt: Date | string
+  actorName?: string | null
+  actorAvatarUrl?: string | null
+}
+
+interface ActivityDisplay {
+  icon: LucideIcon
+  title: string
+  detail?: ReactNode
+}
+
+interface ChangeSummary {
+  key: string
+  label: string
+  from: string | null
+  to: string | null
+}
+
+const FIELD_LABELS: Record<string, string> = {
+  description: 'Description',
+  descriptionJson: 'Description',
+  descriptionText: 'Description',
+  subject: 'Subject',
+  priority: 'Priority',
+  visibilityScope: 'Visibility',
+  primaryTeamId: 'Primary team',
+  assigneePrincipalId: 'Assignee',
+  assigneeTeamId: 'Assignee team',
+  organizationId: 'Organization',
+  requesterContactId: 'Requester contact',
+  inboxId: 'Inbox',
+}
+
+const FIELD_ACTIONS: Record<string, string> = {
+  description: 'updated the description',
+  descriptionJson: 'updated the description',
+  descriptionText: 'updated the description',
+  subject: 'changed the subject',
+  priority: 'changed priority',
+  visibilityScope: 'changed visibility',
+  primaryTeamId: 'changed primary team',
+  assigneePrincipalId: 'changed assignee',
+  assigneeTeamId: 'changed assignee team',
+  organizationId: 'changed organization',
+  requesterContactId: 'changed requester contact',
+  inboxId: 'changed inbox',
+}
+
+const CATEGORY_LABELS: Record<string, string> = {
+  open: 'Open',
+  pending: 'Pending',
+  on_hold: 'On hold',
+  solved: 'Solved',
+  closed: 'Closed',
+}
+
+const PRIORITY_LABELS: Record<string, string> = {
+  low: 'Low',
+  normal: 'Normal',
+  high: 'High',
+  urgent: 'Urgent',
+}
+
+const VISIBILITY_LABELS: Record<string, string> = {
+  team: 'Team',
+  org: 'Organization',
+  shared: 'Shared',
+  private: 'Private',
+}
+
+const CHANNEL_LABELS: Record<string, string> = {
+  api: 'API',
+  email: 'Email',
+  widget: 'Widget',
+  portal: 'Portal',
+  github: 'GitHub',
+}
+
+const AUDIENCE_LABELS: Record<string, string> = {
+  public: 'Public reply',
+  internal: 'Internal note',
+  shared_team: 'Shared-team note',
+}
+
+const AUDIENCE_ACTIONS: Record<string, string> = {
+  public: 'posted a public reply',
+  internal: 'posted an internal note',
+  shared_team: 'posted a shared-team note',
+}
+
+const PARTICIPANT_ROLE_LABELS: Record<string, string> = {
+  watcher: 'Watcher',
+  collaborator: 'Collaborator',
+  cc: 'CC',
+}
+
+const ACCESS_LABELS: Record<string, string> = {
+  read: 'Read access',
+  comment: 'Comment access',
+  full: 'Full access',
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function actorLabel(row: ActivityRow, principalNames?: Record<string, string>): string {
+  const name = row.actorName?.trim()
+  if (name) return name
+  if (row.principalId && principalNames?.[row.principalId]) return principalNames[row.principalId]
+  return row.principalId ? 'Someone' : 'System'
+}
+
+function titleCaseToken(value: string): string {
+  return value
+    .replace(/[_-]+/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .replace(/\b\w/g, (char) => char.toUpperCase())
+}
+
+function truncate(value: string, max = 80): string {
+  if (value.length <= max) return value
+  return `${value.slice(0, max - 1).trimEnd()}...`
+}
+
+function isOpaqueIdentifier(value: string): boolean {
+  return /^[a-z]+_[a-z0-9]{8,}$/i.test(value) || /^[0-9a-f-]{24,}$/i.test(value)
+}
+
+function formatKnownValue(field: string, value: string): string {
+  if (field === 'priority') return PRIORITY_LABELS[value] ?? titleCaseToken(value)
+  if (field === 'visibilityScope') return VISIBILITY_LABELS[value] ?? titleCaseToken(value)
+  if (field === 'category' || field === 'statusCategory') {
+    return CATEGORY_LABELS[value] ?? titleCaseToken(value)
+  }
+  if (field === 'channel') return CHANNEL_LABELS[value] ?? titleCaseToken(value)
+  if (field === 'audience') return AUDIENCE_LABELS[value] ?? titleCaseToken(value)
+  if (field === 'accessLevel') return ACCESS_LABELS[value] ?? titleCaseToken(value)
+  if (field === 'role') return PARTICIPANT_ROLE_LABELS[value] ?? titleCaseToken(value)
+  return value
+}
+
+function formatChangeValue(field: string, value: unknown): string | null {
+  if (value == null || value === '') return 'None'
+  if (field === 'description' || field === 'descriptionJson' || field === 'descriptionText') {
+    return null
+  }
+  if (typeof value === 'boolean') return value ? 'Enabled' : 'Disabled'
+  if (typeof value === 'number') return String(value)
+  if (typeof value !== 'string') return null
+
+  const trimmed = value.trim()
+  if (!trimmed) return 'Empty'
+  if (field.endsWith('Id') || isOpaqueIdentifier(trimmed)) return null
+
+  return truncate(formatKnownValue(field, trimmed))
+}
+
+function formatEventType(type: string): string {
+  return titleCaseToken(type.split('.').join(' '))
+}
+
+function detailPill(value: string) {
+  return (
+    <Badge variant="subtle" className="max-w-full whitespace-normal break-words px-1.5 py-0">
+      {value}
+    </Badge>
+  )
+}
+
+function ChangeLine({ change }: { change: ChangeSummary }) {
+  const hasValues = change.from !== null || change.to !== null
+
+  if (!hasValues) {
+    return <span>{change.label} changed</span>
+  }
+
+  return (
+    <span className="inline-flex max-w-full flex-wrap items-center gap-1">
+      <span>{change.label}:</span>
+      {change.from && detailPill(change.from)}
+      <ArrowRight className="size-3 shrink-0 text-muted-foreground/70" />
+      {change.to && detailPill(change.to)}
+    </span>
+  )
+}
+
+function ChangeList({ changes }: { changes: ChangeSummary[] }) {
+  if (changes.length === 0) return null
+
+  return (
+    <div className="mt-1.5 space-y-1 text-xs leading-5 text-muted-foreground">
+      {changes.map((change) => (
+        <div key={change.key}>
+          <ChangeLine change={change} />
+        </div>
+      ))}
+    </div>
+  )
+}
+
+function SummaryPills({ items }: { items: Array<string | null | undefined> }) {
+  const visible = items.filter((item): item is string => Boolean(item))
+  if (visible.length === 0) return null
+
+  return (
+    <div className="mt-1.5 flex flex-wrap gap-1">
+      {visible.map((item) => (
+        <Badge key={item} variant="outline" className="px-1.5 py-0 text-[11px]">
+          {item}
+        </Badge>
+      ))}
+    </div>
+  )
+}
+
+function collapseDiffKey(field: string): string {
+  return field === 'descriptionJson' || field === 'descriptionText' ? 'description' : field
+}
+
+function summarizeDiff(metadata: unknown): ChangeSummary[] {
+  if (!isRecord(metadata) || !isRecord(metadata.diff)) return []
+
+  const changes: ChangeSummary[] = []
+  const seen = new Set<string>()
+
+  for (const [field, rawChange] of Object.entries(metadata.diff)) {
+    if (!isRecord(rawChange)) continue
+    const key = collapseDiffKey(field)
+    if (seen.has(key)) continue
+    seen.add(key)
+
+    changes.push({
+      key,
+      label: FIELD_LABELS[key] ?? titleCaseToken(key),
+      from: formatChangeValue(key, rawChange.from),
+      to: formatChangeValue(key, rawChange.to),
+    })
+  }
+
+  return changes
+}
+
+function updatedDisplay(row: ActivityRow, actor: string): ActivityDisplay {
+  const changes = summarizeDiff(row.metadata)
+  if (changes.length === 0) {
+    return { icon: Pencil, title: `${actor} updated this ticket` }
+  }
+
+  if (changes.length === 1) {
+    const action = FIELD_ACTIONS[changes[0].key] ?? `changed ${changes[0].label.toLowerCase()}`
+    return {
+      icon: Pencil,
+      title: `${actor} ${action}`,
+      detail: <ChangeList changes={changes} />,
+    }
+  }
+
+  return {
+    icon: Pencil,
+    title: `${actor} updated ${changes.length} fields`,
+    detail: <ChangeList changes={changes} />,
+  }
+}
+
+function nestedRecord(metadata: unknown, key: string): Record<string, unknown> | null {
+  return isRecord(metadata) && isRecord(metadata[key]) ? metadata[key] : null
+}
+
+function stringMeta(metadata: unknown, key: string): string | null {
+  if (!isRecord(metadata)) return null
+  const value = metadata[key]
+  return typeof value === 'string' ? value : null
+}
+
+function statusChangeDetail(metadata: unknown) {
+  const from = nestedRecord(metadata, 'from')
+  const to = nestedRecord(metadata, 'to')
+  const fromCategory = typeof from?.category === 'string' ? from.category : null
+  const toCategory = typeof to?.category === 'string' ? to.category : null
+
+  if (!fromCategory && !toCategory) return null
+
+  return (
+    <ChangeList
+      changes={[
+        {
+          key: 'status',
+          label: 'Status',
+          from: fromCategory ? formatKnownValue('category', fromCategory) : 'None',
+          to: toCategory ? formatKnownValue('category', toCategory) : 'None',
+        },
+      ]}
+    />
+  )
+}
+
+function assignmentDetail(metadata: unknown) {
+  const to = nestedRecord(metadata, 'to')
+  const from = nestedRecord(metadata, 'from')
+  const next = to
+    ? [to.principalId ? 'person' : null, to.teamId ? 'team' : null].filter(Boolean).join(' and ')
+    : ''
+  const previous = from?.principalId || from?.teamId ? 'Previously assigned' : null
+
+  return (
+    <SummaryPills
+      items={[next ? `Assigned to ${next}` : null, previous, next ? null : 'No assignee']}
+    />
+  )
+}
+
+function routedDetail(metadata: unknown) {
+  if (!isRecord(metadata)) return null
+  return (
+    <SummaryPills
+      items={[
+        metadata.ruleId ? 'Matched routing rule' : null,
+        metadata.inboxId ? 'Set inbox' : null,
+        metadata.primaryTeamId ? 'Set team' : null,
+        metadata.assigneePrincipalId ? 'Assigned person' : null,
+      ]}
+    />
+  )
+}
+
+function activityDisplay(row: ActivityRow, actor: string): ActivityDisplay {
+  const metadata = row.metadata
+
+  switch (row.type) {
+    case 'ticket.created': {
+      const statusCategory = stringMeta(metadata, 'statusCategory')
+      const priority = stringMeta(metadata, 'priority')
+      const channel = stringMeta(metadata, 'channel')
+      return {
+        icon: Plus,
+        title: `${actor} created this ticket`,
+        detail: (
+          <SummaryPills
+            items={[
+              statusCategory ? formatKnownValue('statusCategory', statusCategory) : null,
+              priority ? formatKnownValue('priority', priority) : null,
+              channel ? formatKnownValue('channel', channel) : null,
+            ]}
+          />
+        ),
+      }
+    }
+    case 'ticket.routed':
+      return { icon: Route, title: `${actor} routed this ticket`, detail: routedDetail(metadata) }
+    case 'ticket.updated':
+      return updatedDisplay(row, actor)
+    case 'ticket.assigned':
+      return {
+        icon: UserCheck,
+        title: `${actor} assigned this ticket`,
+        detail: assignmentDetail(metadata),
+      }
+    case 'ticket.unassigned':
+      return { icon: UserMinus, title: `${actor} removed the assignee` }
+    case 'ticket.status_changed':
+      return {
+        icon: CheckCircle2,
+        title: `${actor} changed status`,
+        detail: statusChangeDetail(metadata),
+      }
+    case 'ticket.deleted':
+      return { icon: Trash2, title: `${actor} deleted this ticket` }
+    case 'ticket.restored':
+      return { icon: RotateCcw, title: `${actor} restored this ticket` }
+    case 'thread.added': {
+      const audience = stringMeta(metadata, 'audience')
+      const label = audience ? (AUDIENCE_LABELS[audience] ?? titleCaseToken(audience)) : 'Reply'
+      const action = audience
+        ? (AUDIENCE_ACTIONS[audience] ?? `posted ${label.toLowerCase()}`)
+        : 'posted a reply'
+      return {
+        icon: MessageSquare,
+        title: `${actor} ${action}`,
+        detail: <SummaryPills items={[label]} />,
+      }
+    }
+    case 'thread.edited':
+      return { icon: Pencil, title: `${actor} edited a reply` }
+    case 'thread.deleted':
+      return { icon: Trash2, title: `${actor} deleted a reply` }
+    case 'participant.added': {
+      const role = stringMeta(metadata, 'role')
+      return {
+        icon: UserPlus,
+        title: `${actor} added a participant`,
+        detail: (
+          <SummaryPills
+            items={[
+              role ? formatKnownValue('role', role) : null,
+              isRecord(metadata) && metadata.principalId ? 'User' : null,
+              isRecord(metadata) && metadata.contactId ? 'Contact' : null,
+            ]}
+          />
+        ),
+      }
+    }
+    case 'participant.removed':
+      return { icon: UserX, title: `${actor} removed a participant` }
+    case 'ticket.shared': {
+      const access = stringMeta(metadata, 'accessLevel')
+      return {
+        icon: Share2,
+        title: `${actor} shared this ticket with a team`,
+        detail: <SummaryPills items={[access ? formatKnownValue('accessLevel', access) : null]} />,
+      }
+    }
+    case 'ticket.unshared':
+      return { icon: Share2, title: `${actor} removed a team share` }
+    case 'attachment.added': {
+      const filename = stringMeta(metadata, 'filename')
+      return {
+        icon: Paperclip,
+        title: `${actor} added an attachment`,
+        detail: filename ? (
+          <div className="mt-1.5 text-xs text-muted-foreground break-words">
+            {truncate(filename, 120)}
+          </div>
+        ) : null,
+      }
+    }
+    case 'attachment.removed':
+      return { icon: Paperclip, title: `${actor} removed an attachment` }
+    default:
+      return {
+        icon: Settings2,
+        title: `${actor} recorded ${formatEventType(row.type)}`,
+      }
+  }
+}
+
+export function TicketActivityTimeline({ ticketId, principalNames }: TicketActivityTimelineProps) {
+  const { data } = useSuspenseQuery(ticketQueries.activity(ticketId, { limit: 100 }))
+  const activity = data as ActivityRow[]
+
+  if (activity.length === 0) {
+    return (
+      <div className="rounded-md border border-dashed border-border/60 px-3 py-8 text-center">
+        <p className="text-sm text-muted-foreground">No activity yet.</p>
+      </div>
+    )
+  }
+
+  return (
+    <ol className="divide-y divide-border/60">
+      {activity.map((row) => {
+        const actor = actorLabel(row, principalNames)
+        const display = activityDisplay(row, actor)
+        const Icon = display.icon
+
+        return (
+          <li key={row.id} className="flex gap-3 py-3 first:pt-0 last:pb-0">
+            <div className="mt-0.5 flex size-7 shrink-0 items-center justify-center rounded-full border border-border/60 bg-muted/40">
+              <Icon className="size-3.5 text-muted-foreground" />
+            </div>
+            <div className="min-w-0 flex-1">
+              <p className="text-sm leading-5 text-foreground break-words">{display.title}</p>
+              <TimeAgo
+                date={row.createdAt}
+                className="mt-0.5 block text-[11px] leading-4 text-muted-foreground"
+              />
+              {display.detail}
+            </div>
+          </li>
+        )
+      })}
+    </ol>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-channel-icon.tsx b/apps/web/src/components/admin/tickets/ticket-channel-icon.tsx
new file mode 100644
index 000000000..18066f2b1
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-channel-icon.tsx
@@ -0,0 +1,29 @@
+/**
+ * Channel icon for tickets. Maps the channel to a Heroicon.
+ */
+import {
+  EnvelopeIcon,
+  GlobeAltIcon,
+  CodeBracketIcon,
+  ChatBubbleBottomCenterTextIcon,
+} from '@heroicons/react/24/outline'
+import { cn } from '@/lib/shared/utils'
+
+export type TicketChannel = 'email' | 'portal' | 'api' | 'widget'
+
+export interface TicketChannelIconProps {
+  channel: TicketChannel
+  className?: string
+}
+
+const iconMap: Record<TicketChannel, typeof EnvelopeIcon> = {
+  email: EnvelopeIcon,
+  portal: GlobeAltIcon,
+  api: CodeBracketIcon,
+  widget: ChatBubbleBottomCenterTextIcon,
+}
+
+export function TicketChannelIcon({ channel, className }: TicketChannelIconProps) {
+  const Icon = iconMap[channel]
+  return <Icon className={cn('h-4 w-4 text-muted-foreground', className)} aria-label={channel} />
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-detail-header.tsx b/apps/web/src/components/admin/tickets/ticket-detail-header.tsx
new file mode 100644
index 000000000..bf46d9702
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-detail-header.tsx
@@ -0,0 +1,148 @@
+/**
+ * Detail-page header for a single ticket. Shows subject, breadcrumb back to
+ * queue, channel/priority/visibility metadata, and Take/Return + delete
+ * actions. Status transitions live in the properties panel.
+ */
+import { Link, useRouter } from '@tanstack/react-router'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { ArrowLeftIcon, TrashIcon } from '@heroicons/react/24/outline'
+import type { TicketId, PrincipalId } from '@quackback/ids'
+import { Button } from '@/components/ui/button'
+import { TimeAgo } from '@/components/ui/time-ago'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from '@/components/ui/alert-dialog'
+import { TicketChannelIcon, type TicketChannel } from './ticket-channel-icon'
+import { TicketPriorityChip, type TicketPriority } from './ticket-priority-chip'
+import { TicketSubscriptionMenu } from './ticket-subscription-menu'
+import { takeTicketFn, returnTicketFn, softDeleteTicketFn } from '@/lib/server/functions/tickets'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { toast } from 'sonner'
+
+const VISIBILITY_LABELS: Record<string, string> = {
+  team: 'Team',
+  org: 'Organization',
+  shared: 'Shared',
+  private: 'Private',
+}
+
+export interface TicketDetailHeaderProps {
+  ticket: {
+    id: TicketId
+    subject: string
+    channel: string
+    priority: string
+    visibilityScope: string
+    updatedAt: Date | string
+    assigneePrincipalId: PrincipalId | null
+  }
+  currentPrincipalId: PrincipalId
+}
+
+export function TicketDetailHeader({ ticket, currentPrincipalId }: TicketDetailHeaderProps) {
+  const router = useRouter()
+  const qc = useQueryClient()
+
+  const invalidate = () => {
+    qc.invalidateQueries({ queryKey: ticketQueries.detail(ticket.id).queryKey })
+    qc.invalidateQueries({ queryKey: ['tickets', 'list'] })
+  }
+
+  const takeMutation = useMutation({
+    mutationFn: () => takeTicketFn({ data: { ticketId: ticket.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Assigned to you')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const returnMutation = useMutation({
+    mutationFn: () => returnTicketFn({ data: { ticketId: ticket.id } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Returned to team')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const deleteMutation = useMutation({
+    mutationFn: () => softDeleteTicketFn({ data: { ticketId: ticket.id } }),
+    onSuccess: () => {
+      toast.success('Ticket deleted')
+      router.navigate({ to: '/admin/tickets' })
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const isMine = ticket.assigneePrincipalId === currentPrincipalId
+
+  return (
+    <div className="flex items-center gap-3 border-b border-border/50 px-4 py-2">
+      <Button asChild variant="ghost" size="sm">
+        <Link to="/admin/tickets">
+          <ArrowLeftIcon className="h-4 w-4 mr-1" />
+          Queue
+        </Link>
+      </Button>
+      <div className="flex-1 min-w-0">
+        <h1 className="text-sm font-semibold truncate">{ticket.subject}</h1>
+        <div className="flex items-center gap-2 text-xs text-muted-foreground mt-0.5">
+          <TicketChannelIcon channel={ticket.channel as TicketChannel} className="h-3.5 w-3.5" />
+          <TicketPriorityChip priority={ticket.priority as TicketPriority} />
+          <span>{VISIBILITY_LABELS[ticket.visibilityScope] ?? ticket.visibilityScope}</span>
+          <span>•</span>
+          <span>
+            updated <TimeAgo date={ticket.updatedAt} />
+          </span>
+        </div>
+      </div>
+
+      {isMine ? (
+        <Button
+          size="sm"
+          variant="outline"
+          onClick={() => returnMutation.mutate()}
+          disabled={returnMutation.isPending}
+        >
+          Return
+        </Button>
+      ) : (
+        <Button size="sm" onClick={() => takeMutation.mutate()} disabled={takeMutation.isPending}>
+          Take
+        </Button>
+      )}
+
+      <TicketSubscriptionMenu ticketId={ticket.id} />
+
+      <AlertDialog>
+        <AlertDialogTrigger asChild>
+          <Button size="sm" variant="ghost" aria-label="Delete ticket">
+            <TrashIcon className="h-4 w-4" />
+          </Button>
+        </AlertDialogTrigger>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Delete ticket?</AlertDialogTitle>
+            <AlertDialogDescription>
+              This soft-deletes the ticket. It will be hidden from queues but retained in audit
+              history.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Cancel</AlertDialogCancel>
+            <AlertDialogAction onClick={() => deleteMutation.mutate()}>Delete</AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-linked-issues.tsx b/apps/web/src/components/admin/tickets/ticket-linked-issues.tsx
new file mode 100644
index 000000000..30cd37e1a
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-linked-issues.tsx
@@ -0,0 +1,84 @@
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import type { TicketId } from '@quackback/ids'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { manualSyncTicketFn } from '@/lib/server/functions/tickets'
+import { Button } from '@/components/ui/button'
+import { ExternalLink, RefreshCw, GitBranch } from 'lucide-react'
+import { toast } from 'sonner'
+
+interface TicketLinkedIssuesProps {
+  ticketId: TicketId
+}
+
+export function TicketLinkedIssues({ ticketId }: TicketLinkedIssuesProps) {
+  const queryClient = useQueryClient()
+  const { data: links, isLoading } = useQuery(ticketQueries.externalLinks(ticketId))
+
+  const syncMutation = useMutation({
+    mutationFn: (params: { integrationId: string; direction: 'push' | 'pull' }) =>
+      manualSyncTicketFn({
+        data: { ticketId, integrationId: params.integrationId, direction: params.direction },
+      }),
+    onSuccess: (result: { success: boolean; error?: string }) => {
+      if (result.success) {
+        toast.success('Sync completed')
+        queryClient.invalidateQueries({ queryKey: ['tickets', 'externalLinks', ticketId] })
+      } else {
+        toast.error(result.error ?? 'Sync failed')
+      }
+    },
+    onError: () => toast.error('Sync failed'),
+  })
+
+  if (isLoading || !links?.length) return null
+
+  return (
+    <div>
+      <div className="text-xs font-semibold text-muted-foreground uppercase tracking-wide mb-1">
+        Linked Issues
+      </div>
+      <div className="space-y-2">
+        {links.map((link) => (
+          <div
+            key={link.id}
+            className="flex items-center gap-2 text-sm rounded-md border px-2 py-1.5"
+          >
+            <GitBranch className="h-3.5 w-3.5 text-muted-foreground shrink-0" />
+            <a
+              href={link.externalUrl ?? '#'}
+              target="_blank"
+              rel="noopener noreferrer"
+              className="flex items-center gap-1 text-foreground hover:underline truncate min-w-0"
+            >
+              <span className="font-mono text-xs">{link.externalDisplayId}</span>
+              <ExternalLink className="h-3 w-3 text-muted-foreground shrink-0" />
+            </a>
+            <span className="text-[10px] text-muted-foreground uppercase shrink-0">
+              {link.syncDirection === 'outbound'
+                ? '→'
+                : link.syncDirection === 'inbound'
+                  ? '←'
+                  : '↔'}
+            </span>
+            <Button
+              variant="ghost"
+              size="icon"
+              className="h-6 w-6 ml-auto shrink-0"
+              disabled={syncMutation.isPending || !link.integrationId}
+              onClick={() =>
+                link.integrationId &&
+                syncMutation.mutate({
+                  integrationId: link.integrationId,
+                  direction: 'push',
+                })
+              }
+              title="Sync to GitHub"
+            >
+              <RefreshCw className={`h-3 w-3 ${syncMutation.isPending ? 'animate-spin' : ''}`} />
+            </Button>
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-participants-list.tsx b/apps/web/src/components/admin/tickets/ticket-participants-list.tsx
new file mode 100644
index 000000000..63ea2a6be
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-participants-list.tsx
@@ -0,0 +1,163 @@
+/**
+ * Right-panel "Participants" tab. Lists current participants and allows adding
+ * a new principal-or-contact participant with a role (watcher / collaborator /
+ * cc). Add row toggles between principal and contact pickers.
+ */
+import { useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import type { TicketId, PrincipalId, ContactId, TicketParticipantId } from '@quackback/ids'
+import { Button } from '@/components/ui/button'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { XMarkIcon } from '@heroicons/react/24/outline'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+import { ContactPicker } from '@/components/admin/shared/contact-picker'
+import { addParticipantFn, removeParticipantFn } from '@/lib/server/functions/tickets'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { toast } from 'sonner'
+
+const ROLES = ['watcher', 'collaborator', 'cc'] as const
+type ParticipantRole = (typeof ROLES)[number]
+
+export interface ParticipantRow {
+  id: TicketParticipantId
+  ticketId: TicketId
+  principalId: PrincipalId | null
+  contactId: ContactId | null
+  role: ParticipantRole | string
+}
+
+export interface TicketParticipantsListProps {
+  ticketId: TicketId
+  participants: ParticipantRow[]
+  principalNames?: Record<string, string>
+  contactNames?: Record<string, string>
+}
+
+export function TicketParticipantsList({
+  ticketId,
+  participants,
+  principalNames,
+  contactNames,
+}: TicketParticipantsListProps) {
+  const qc = useQueryClient()
+  const [kind, setKind] = useState<'principal' | 'contact'>('principal')
+  const [role, setRole] = useState<ParticipantRole>('watcher')
+  const [principalId, setPrincipalId] = useState<PrincipalId | null>(null)
+  const [contactId, setContactId] = useState<ContactId | null>(null)
+
+  const invalidate = () =>
+    qc.invalidateQueries({ queryKey: ticketQueries.participants(ticketId).queryKey })
+
+  const addMutation = useMutation({
+    mutationFn: () =>
+      addParticipantFn({
+        data: {
+          ticketId,
+          role,
+          principalId: kind === 'principal' ? principalId : null,
+          contactId: kind === 'contact' ? contactId : null,
+        },
+      }),
+    onSuccess: () => {
+      setPrincipalId(null)
+      setContactId(null)
+      invalidate()
+      toast.success('Participant added')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const removeMutation = useMutation({
+    mutationFn: (participantId: TicketParticipantId) =>
+      removeParticipantFn({ data: { ticketId, participantId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Participant removed')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const canSubmit =
+    (kind === 'principal' && principalId !== null) || (kind === 'contact' && contactId !== null)
+
+  return (
+    <div className="space-y-3 text-sm">
+      {participants.length === 0 ? (
+        <div className="text-xs text-muted-foreground">No participants.</div>
+      ) : (
+        <ul className="space-y-1">
+          {participants.map((p) => {
+            const label = p.principalId
+              ? (principalNames?.[p.principalId] ?? p.principalId)
+              : p.contactId
+                ? (contactNames?.[p.contactId] ?? p.contactId)
+                : '—'
+            return (
+              <li key={p.id} className="flex items-center justify-between gap-2 text-xs">
+                <span className="truncate">
+                  <span className="font-medium">{label}</span>
+                  <span className="text-muted-foreground ml-1">({p.role})</span>
+                </span>
+                <Button
+                  size="sm"
+                  variant="ghost"
+                  className="h-6 w-6 p-0"
+                  onClick={() => removeMutation.mutate(p.id)}
+                  disabled={removeMutation.isPending}
+                  aria-label="Remove participant"
+                >
+                  <XMarkIcon className="h-3.5 w-3.5" />
+                </Button>
+              </li>
+            )
+          })}
+        </ul>
+      )}
+
+      <div className="rounded border border-border/50 p-2 space-y-2">
+        <div className="flex items-center gap-2">
+          <Select value={kind} onValueChange={(v) => setKind(v as 'principal' | 'contact')}>
+            <SelectTrigger className="h-7 w-28 text-xs">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem value="principal">User</SelectItem>
+              <SelectItem value="contact">Contact</SelectItem>
+            </SelectContent>
+          </Select>
+          <Select value={role} onValueChange={(v) => setRole(v as ParticipantRole)}>
+            <SelectTrigger className="h-7 w-32 text-xs">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              {ROLES.map((r) => (
+                <SelectItem key={r} value={r}>
+                  {r}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </div>
+        {kind === 'principal' ? (
+          <PrincipalPicker value={principalId} onValueChange={setPrincipalId} />
+        ) : (
+          <ContactPicker value={contactId} onValueChange={setContactId} />
+        )}
+        <Button
+          size="sm"
+          className="w-full"
+          disabled={!canSubmit || addMutation.isPending}
+          onClick={() => addMutation.mutate()}
+        >
+          Add participant
+        </Button>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-priority-chip.tsx b/apps/web/src/components/admin/tickets/ticket-priority-chip.tsx
new file mode 100644
index 000000000..b331378b3
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-priority-chip.tsx
@@ -0,0 +1,32 @@
+/**
+ * Color-coded chip for ticket priority.
+ */
+import { cn } from '@/lib/shared/utils'
+
+export type TicketPriority = 'low' | 'normal' | 'high' | 'urgent'
+
+export interface TicketPriorityChipProps {
+  priority: TicketPriority
+  className?: string
+}
+
+const priorityStyles: Record<TicketPriority, string> = {
+  low: 'bg-muted text-muted-foreground',
+  normal: 'bg-neutral-100 text-neutral-700 dark:bg-neutral-800 dark:text-neutral-300',
+  high: 'bg-orange-100 text-orange-800 dark:bg-orange-950 dark:text-orange-200',
+  urgent: 'bg-red-100 text-red-800 dark:bg-red-950 dark:text-red-200',
+}
+
+export function TicketPriorityChip({ priority, className }: TicketPriorityChipProps) {
+  return (
+    <span
+      className={cn(
+        'inline-flex items-center rounded px-1.5 py-0.5 text-[11px] font-medium uppercase tracking-wide',
+        priorityStyles[priority],
+        className
+      )}
+    >
+      {priority}
+    </span>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-properties-panel.tsx b/apps/web/src/components/admin/tickets/ticket-properties-panel.tsx
new file mode 100644
index 000000000..057198530
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-properties-panel.tsx
@@ -0,0 +1,305 @@
+/**
+ * Right-panel "Properties" tab for a ticket. Inline editors for assignee,
+ * status, priority, visibility, inbox, organization, requester contact, and
+ * subject. Every mutation passes `expectedUpdatedAt` from the cached ticket
+ * for optimistic-concurrency.
+ */
+import { useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import type {
+  TicketId,
+  PrincipalId,
+  TicketStatusId,
+  InboxId,
+  OrganizationId,
+  ContactId,
+  TeamId,
+} from '@quackback/ids'
+import { Input } from '@/components/ui/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { Button } from '@/components/ui/button'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+import { StatusPicker } from '@/components/admin/shared/status-picker'
+import { InboxPicker } from '@/components/admin/shared/inbox-picker'
+import { OrgPicker } from '@/components/admin/shared/org-picker'
+import { ContactPicker } from '@/components/admin/shared/contact-picker'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import {
+  assignTicketFn,
+  transitionTicketStatusFn,
+  updateTicketFn,
+} from '@/lib/server/functions/tickets'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { toast } from 'sonner'
+
+export interface TicketPropertiesPanelProps {
+  ticket: {
+    id: TicketId
+    subject: string
+    statusId: TicketStatusId | null
+    priority: string
+    visibilityScope: string
+    primaryTeamId: TeamId | null
+    inboxId: InboxId | null
+    organizationId: OrganizationId | null
+    requesterContactId: ContactId | null
+    assigneePrincipalId: PrincipalId | null
+    updatedAt: Date | string
+  }
+}
+
+const PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+const VISIBILITY = ['team', 'org', 'shared', 'private'] as const
+const VISIBILITY_LABELS: Record<(typeof VISIBILITY)[number], string> = {
+  team: 'Team',
+  org: 'Organization',
+  shared: 'Shared',
+  private: 'Private',
+}
+
+export function TicketPropertiesPanel({ ticket }: TicketPropertiesPanelProps) {
+  const qc = useQueryClient()
+  const [editingSubject, setEditingSubject] = useState(false)
+  const [subjectDraft, setSubjectDraft] = useState(ticket.subject)
+
+  const expectedUpdatedAt = () => {
+    const latest = qc.getQueryData<{ updatedAt: Date | string }>(
+      ticketQueries.detail(ticket.id).queryKey
+    )
+    return new Date(latest?.updatedAt ?? ticket.updatedAt).toISOString()
+  }
+
+  const invalidate = () => {
+    qc.invalidateQueries({ queryKey: ticketQueries.detail(ticket.id).queryKey })
+    qc.invalidateQueries({ queryKey: ['tickets', 'list'] })
+  }
+
+  const onErr = (e: Error) => {
+    if (/conflict|stale/i.test(e.message)) {
+      toast.error('Ticket changed — refresh', {
+        action: { label: 'Refresh', onClick: invalidate },
+      })
+    } else {
+      toast.error(e.message)
+    }
+  }
+
+  const assignMutation = useMutation({
+    mutationFn: (assigneePrincipalId: PrincipalId | null) =>
+      assignTicketFn({
+        data: { ticketId: ticket.id, expectedUpdatedAt: expectedUpdatedAt(), assigneePrincipalId },
+      }),
+    onSuccess: (updated) => {
+      qc.setQueryData(ticketQueries.detail(ticket.id).queryKey, updated)
+      invalidate()
+      toast.success('Assignee updated')
+    },
+    onError: onErr,
+  })
+
+  const statusMutation = useMutation({
+    mutationFn: (statusId: TicketStatusId) =>
+      transitionTicketStatusFn({
+        data: { ticketId: ticket.id, expectedUpdatedAt: expectedUpdatedAt(), statusId },
+      }),
+    onSuccess: (updated) => {
+      qc.setQueryData(ticketQueries.detail(ticket.id).queryKey, updated)
+      invalidate()
+      toast.success('Status updated')
+    },
+    onError: onErr,
+  })
+
+  const updateMutation = useMutation({
+    mutationFn: (patch: Parameters<typeof updateTicketFn>[0]['data']) =>
+      updateTicketFn({ data: { ...patch, expectedUpdatedAt: expectedUpdatedAt() } }),
+    onSuccess: (updated) => {
+      qc.setQueryData(ticketQueries.detail(ticket.id).queryKey, updated)
+      invalidate()
+      toast.success('Ticket updated')
+    },
+    onError: onErr,
+  })
+
+  return (
+    <div className="space-y-4 text-sm">
+      <Section label="Subject">
+        {editingSubject ? (
+          <div className="flex gap-1">
+            <Input
+              value={subjectDraft}
+              onChange={(e) => setSubjectDraft(e.target.value)}
+              className="h-8"
+            />
+            <Button
+              size="sm"
+              onClick={() => {
+                updateMutation.mutate({
+                  ticketId: ticket.id,
+                  expectedUpdatedAt: expectedUpdatedAt(),
+                  subject: subjectDraft,
+                })
+                setEditingSubject(false)
+              }}
+            >
+              Save
+            </Button>
+            <Button
+              size="sm"
+              variant="ghost"
+              onClick={() => {
+                setSubjectDraft(ticket.subject)
+                setEditingSubject(false)
+              }}
+            >
+              Cancel
+            </Button>
+          </div>
+        ) : (
+          <button
+            onClick={() => setEditingSubject(true)}
+            className="text-left w-full hover:underline"
+          >
+            {ticket.subject}
+          </button>
+        )}
+      </Section>
+
+      <Section label="Assignee">
+        <PrincipalPicker
+          value={ticket.assigneePrincipalId}
+          onValueChange={(id) => assignMutation.mutate(id)}
+          allowUnassigned
+        />
+      </Section>
+
+      <Section label="Status">
+        <StatusPicker
+          value={ticket.statusId}
+          onValueChange={(id) => id && statusMutation.mutate(id)}
+        />
+      </Section>
+
+      <Section label="Priority">
+        <Select
+          value={ticket.priority}
+          onValueChange={(v) =>
+            updateMutation.mutate({
+              ticketId: ticket.id,
+              expectedUpdatedAt: expectedUpdatedAt(),
+              priority: v as (typeof PRIORITIES)[number],
+            })
+          }
+        >
+          <SelectTrigger className="h-8">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            {PRIORITIES.map((p) => (
+              <SelectItem key={p} value={p}>
+                {p}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      </Section>
+
+      <Section label="Visibility">
+        <Select
+          value={ticket.visibilityScope}
+          onValueChange={(v) =>
+            updateMutation.mutate({
+              ticketId: ticket.id,
+              expectedUpdatedAt: expectedUpdatedAt(),
+              visibilityScope: v as (typeof VISIBILITY)[number],
+            })
+          }
+        >
+          <SelectTrigger className="h-8">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            {VISIBILITY.map((v) => (
+              <SelectItem key={v} value={v}>
+                {VISIBILITY_LABELS[v]}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      </Section>
+
+      <Section label="Inbox">
+        <InboxPicker
+          value={ticket.inboxId}
+          onValueChange={(id) =>
+            updateMutation.mutate({
+              ticketId: ticket.id,
+              expectedUpdatedAt: expectedUpdatedAt(),
+              inboxId: id ?? null,
+            })
+          }
+          allowClear
+        />
+      </Section>
+
+      <Section label="Primary team">
+        <TeamPicker
+          value={ticket.primaryTeamId}
+          onValueChange={(id) =>
+            updateMutation.mutate({
+              ticketId: ticket.id,
+              expectedUpdatedAt: expectedUpdatedAt(),
+              primaryTeamId: id ?? null,
+            })
+          }
+          allowClear
+        />
+      </Section>
+
+      <Section label="Organization">
+        <OrgPicker
+          value={ticket.organizationId}
+          onValueChange={(id) =>
+            updateMutation.mutate({
+              ticketId: ticket.id,
+              expectedUpdatedAt: expectedUpdatedAt(),
+              organizationId: id ?? null,
+            })
+          }
+          allowClear
+        />
+      </Section>
+
+      <Section label="Requester contact">
+        <ContactPicker
+          value={ticket.requesterContactId}
+          onValueChange={(id) =>
+            updateMutation.mutate({
+              ticketId: ticket.id,
+              expectedUpdatedAt: expectedUpdatedAt(),
+              requesterContactId: id ?? null,
+            })
+          }
+          allowClear
+        />
+      </Section>
+    </div>
+  )
+}
+
+function Section({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <div>
+      <div className="text-xs font-semibold text-muted-foreground uppercase tracking-wide mb-1">
+        {label}
+      </div>
+      {children}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-queue-sidebar.tsx b/apps/web/src/components/admin/tickets/ticket-queue-sidebar.tsx
new file mode 100644
index 000000000..86a5b7d60
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-queue-sidebar.tsx
@@ -0,0 +1,115 @@
+/**
+ * Left-rail sidebar for the tickets queue. Renders saved-view buttons and an
+ * expandable "By inbox" group of inboxes the actor is a member of.
+ */
+import { useState } from 'react'
+import { Link } from '@tanstack/react-router'
+import {
+  InboxIcon,
+  UserIcon,
+  UsersIcon,
+  ShareIcon,
+  QuestionMarkCircleIcon,
+  GlobeAltIcon,
+  ChevronDownIcon,
+  ChevronRightIcon,
+} from '@heroicons/react/24/outline'
+import { useMyInboxes } from '@/lib/client/hooks/use-inboxes-queries'
+import { cn } from '@/lib/shared/utils'
+import type { TicketsSearch } from '@/routes/admin/tickets'
+
+interface SavedView {
+  scope: TicketsSearch['scope']
+  label: string
+  icon: typeof InboxIcon
+}
+
+const SAVED_VIEWS: SavedView[] = [
+  { scope: 'my_assigned', label: 'Assigned to me', icon: UserIcon },
+  { scope: 'my_team', label: 'My team', icon: UsersIcon },
+  { scope: 'shared_with_me', label: 'Shared with me', icon: ShareIcon },
+  { scope: 'unassigned', label: 'Unassigned', icon: QuestionMarkCircleIcon },
+  { scope: 'my_inbox', label: 'My inboxes', icon: InboxIcon },
+  { scope: 'all', label: 'All', icon: GlobeAltIcon },
+]
+
+export interface TicketQueueSidebarProps {
+  activeScope: TicketsSearch['scope']
+  activeInboxId?: string
+}
+
+export function TicketQueueSidebar({ activeScope, activeInboxId }: TicketQueueSidebarProps) {
+  const [inboxesOpen, setInboxesOpen] = useState(true)
+  const myInboxesQuery = useMyInboxes()
+
+  return (
+    <aside className="w-60 shrink-0 border-r border-border/50 bg-background overflow-y-auto py-3">
+      <nav className="px-2 space-y-0.5">
+        {SAVED_VIEWS.map((v) => {
+          const Icon = v.icon
+          const isActive = activeScope === v.scope && !activeInboxId
+          return (
+            <Link
+              key={v.scope}
+              to="/admin/tickets"
+              search={{ scope: v.scope } as TicketsSearch}
+              className={cn(
+                'flex items-center gap-2 rounded px-2 py-1.5 text-sm transition-colors',
+                isActive
+                  ? 'bg-muted text-foreground font-medium'
+                  : 'text-muted-foreground hover:bg-muted/50 hover:text-foreground'
+              )}
+            >
+              <Icon className="h-4 w-4 shrink-0" />
+              <span className="truncate">{v.label}</span>
+            </Link>
+          )
+        })}
+      </nav>
+
+      <div className="mt-4 px-2">
+        <button
+          type="button"
+          onClick={() => setInboxesOpen((v) => !v)}
+          className="flex w-full items-center gap-1 rounded px-2 py-1 text-xs font-semibold uppercase tracking-wide text-muted-foreground hover:text-foreground"
+        >
+          {inboxesOpen ? (
+            <ChevronDownIcon className="h-3 w-3" />
+          ) : (
+            <ChevronRightIcon className="h-3 w-3" />
+          )}
+          By inbox
+        </button>
+        {inboxesOpen && (
+          <div className="mt-1 space-y-0.5">
+            {myInboxesQuery.isLoading && (
+              <div className="px-2 py-1 text-xs text-muted-foreground">Loading…</div>
+            )}
+            {myInboxesQuery.data?.length === 0 && (
+              <div className="px-2 py-1 text-xs text-muted-foreground">No inboxes</div>
+            )}
+            {myInboxesQuery.data?.map((inbox) => {
+              const isActive = activeScope === 'inbox' && activeInboxId === inbox.id
+              return (
+                <Link
+                  key={inbox.id}
+                  to="/admin/tickets"
+                  search={{ scope: 'inbox', inboxId: inbox.id } as TicketsSearch}
+                  className={cn(
+                    'flex items-center gap-2 rounded px-2 py-1.5 text-sm transition-colors',
+                    isActive
+                      ? 'bg-muted text-foreground font-medium'
+                      : 'text-muted-foreground hover:bg-muted/50 hover:text-foreground'
+                  )}
+                >
+                  <InboxIcon className="h-4 w-4 shrink-0" />
+                  <span className="truncate">{inbox.name}</span>
+                </Link>
+              )
+            })}
+          </div>
+        )}
+      </div>
+    </aside>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-queue-table.tsx b/apps/web/src/components/admin/tickets/ticket-queue-table.tsx
new file mode 100644
index 000000000..0a95f8a8f
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-queue-table.tsx
@@ -0,0 +1,317 @@
+/**
+ * Tickets queue table — checkbox bulk-select, status pill, priority chip,
+ * channel icon, last-activity timestamp. Bulk-action toolbar is gated by the
+ * `TICKET_BULK_OPERATE` permission.
+ */
+import { useMemo, useState } from 'react'
+import { Link } from '@tanstack/react-router'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import type { TicketId, InboxId, PrincipalId, TicketStatusId } from '@quackback/ids'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { Checkbox } from '@/components/ui/checkbox'
+import { Button } from '@/components/ui/button'
+import { TimeAgo } from '@/components/ui/time-ago'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from '@/components/ui/alert-dialog'
+import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import { TicketStatusPill, type StatusCategory } from './ticket-status-pill'
+import { TicketPriorityChip, type TicketPriority } from './ticket-priority-chip'
+import { TicketChannelIcon, type TicketChannel } from './ticket-channel-icon'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+import { StatusPicker } from '@/components/admin/shared/status-picker'
+import { InboxPicker } from '@/components/admin/shared/inbox-picker'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  bulkAssignTicketsFn,
+  bulkTransitionTicketsFn,
+  bulkChangeInboxFn,
+} from '@/lib/server/functions/tickets'
+import { toast } from 'sonner'
+
+interface TicketRow {
+  id: string
+  subject: string
+  statusId: string
+  priority: string
+  channel: string
+  lastActivityAt: Date | string
+  assigneePrincipalId: string | null
+}
+
+interface StatusRow {
+  id: string
+  name: string
+  category: StatusCategory
+}
+
+export interface TicketQueueTableProps {
+  rows: TicketRow[]
+  statuses: StatusRow[]
+  invalidateKey: readonly unknown[]
+}
+
+const BULK_CONFIRM_THRESHOLD = 50
+
+export function TicketQueueTable({ rows, statuses, invalidateKey }: TicketQueueTableProps) {
+  const queryClient = useQueryClient()
+  const statusById = useMemo(() => new Map(statuses.map((s) => [s.id, s])), [statuses])
+  const [selected, setSelected] = useState<Set<string>>(new Set())
+
+  const allSelected = rows.length > 0 && selected.size === rows.length
+  const someSelected = selected.size > 0 && selected.size < rows.length
+
+  const toggleAll = () => {
+    if (allSelected) setSelected(new Set())
+    else setSelected(new Set(rows.map((r) => r.id)))
+  }
+  const toggleOne = (id: string) => {
+    setSelected((prev) => {
+      const next = new Set(prev)
+      if (next.has(id)) next.delete(id)
+      else next.add(id)
+      return next
+    })
+  }
+
+  const invalidate = () => queryClient.invalidateQueries({ queryKey: invalidateKey })
+
+  const assignMutation = useMutation({
+    mutationFn: (assigneePrincipalId: PrincipalId) =>
+      bulkAssignTicketsFn({
+        data: {
+          ticketIds: Array.from(selected) as TicketId[],
+          assigneePrincipalId,
+        },
+      }),
+    onSuccess: (res) => {
+      const n = res.succeeded.length
+      toast.success(`Assigned ${n} ticket${n === 1 ? '' : 's'}`)
+      setSelected(new Set())
+      invalidate()
+    },
+    onError: (e: Error) => toast.error(e.message ?? 'Bulk assign failed'),
+  })
+
+  const transitionMutation = useMutation({
+    mutationFn: (statusId: TicketStatusId) =>
+      bulkTransitionTicketsFn({
+        data: {
+          ticketIds: Array.from(selected) as TicketId[],
+          statusId,
+        },
+      }),
+    onSuccess: (res) => {
+      const n = res.succeeded.length
+      toast.success(`Transitioned ${n} ticket${n === 1 ? '' : 's'}`)
+      setSelected(new Set())
+      invalidate()
+    },
+    onError: (e: Error) => toast.error(e.message ?? 'Bulk transition failed'),
+  })
+
+  const changeInboxMutation = useMutation({
+    mutationFn: (inboxId: InboxId | null) =>
+      bulkChangeInboxFn({
+        data: {
+          ticketIds: Array.from(selected) as TicketId[],
+          inboxId,
+        },
+      }),
+    onSuccess: (res) => {
+      const n = res.succeeded.length
+      toast.success(`Moved ${n} ticket${n === 1 ? '' : 's'}`)
+      setSelected(new Set())
+      invalidate()
+    },
+    onError: (e: Error) => toast.error(e.message ?? 'Bulk change inbox failed'),
+  })
+
+  // ---------------------------------------------------------- confirm modal
+  const [pending, setPending] = useState<null | (() => void)>(null)
+  const guard = (action: () => void) => {
+    if (selected.size > BULK_CONFIRM_THRESHOLD) setPending(() => action)
+    else action()
+  }
+
+  if (rows.length === 0) {
+    return (
+      <div className="flex h-full items-center justify-center text-sm text-muted-foreground">
+        No tickets in this view.
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex h-full flex-col">
+      <PermissionGate permission={PERMISSIONS.TICKET_BULK_OPERATE}>
+        {selected.size > 0 && (
+          <div className="flex items-center gap-2 border-b border-border/50 bg-muted/40 px-4 py-2 text-sm">
+            <span className="font-medium">{selected.size} selected</span>
+
+            <Popover>
+              <PopoverTrigger asChild>
+                <Button size="sm" variant="outline">
+                  Assign…
+                </Button>
+              </PopoverTrigger>
+              <PopoverContent align="start" className="p-2 w-72">
+                <PrincipalPicker
+                  value={null}
+                  onValueChange={(id) =>
+                    id && guard(() => assignMutation.mutate(id as PrincipalId))
+                  }
+                  placeholder="Pick assignee…"
+                />
+              </PopoverContent>
+            </Popover>
+
+            <Popover>
+              <PopoverTrigger asChild>
+                <Button size="sm" variant="outline">
+                  Transition…
+                </Button>
+              </PopoverTrigger>
+              <PopoverContent align="start" className="p-2 w-72">
+                <StatusPicker
+                  value={null}
+                  onValueChange={(id) =>
+                    id && guard(() => transitionMutation.mutate(id as TicketStatusId))
+                  }
+                  placeholder="Pick status…"
+                />
+              </PopoverContent>
+            </Popover>
+
+            <Popover>
+              <PopoverTrigger asChild>
+                <Button size="sm" variant="outline">
+                  Change inbox…
+                </Button>
+              </PopoverTrigger>
+              <PopoverContent align="start" className="p-2 w-72">
+                <InboxPicker
+                  value={null}
+                  onValueChange={(id) =>
+                    guard(() => changeInboxMutation.mutate((id as InboxId | null) ?? null))
+                  }
+                  placeholder="Pick inbox…"
+                  allowClear
+                />
+              </PopoverContent>
+            </Popover>
+
+            <Button
+              size="sm"
+              variant="ghost"
+              className="ml-auto"
+              onClick={() => setSelected(new Set())}
+            >
+              Clear
+            </Button>
+          </div>
+        )}
+      </PermissionGate>
+
+      <div className="flex-1 overflow-auto">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead className="w-8">
+                <Checkbox
+                  checked={allSelected ? true : someSelected ? 'indeterminate' : false}
+                  onCheckedChange={toggleAll}
+                  aria-label="Select all"
+                />
+              </TableHead>
+              <TableHead>Subject</TableHead>
+              <TableHead>Status</TableHead>
+              <TableHead>Priority</TableHead>
+              <TableHead className="w-16">Channel</TableHead>
+              <TableHead>Last activity</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {rows.map((t) => {
+              const status = statusById.get(t.statusId)
+              const isSel = selected.has(t.id)
+              return (
+                <TableRow key={t.id} className="hover:bg-muted/30 group">
+                  <TableCell onClick={(e) => e.stopPropagation()}>
+                    <Checkbox
+                      checked={isSel}
+                      onCheckedChange={() => toggleOne(t.id)}
+                      aria-label={`Select ${t.subject}`}
+                    />
+                  </TableCell>
+                  <TableCell className="font-medium">
+                    <Link
+                      to="/admin/tickets/$ticketId"
+                      params={{ ticketId: t.id as TicketId }}
+                      className="hover:underline"
+                    >
+                      {t.subject}
+                    </Link>
+                  </TableCell>
+                  <TableCell>
+                    {status ? (
+                      <TicketStatusPill name={status.name} category={status.category} />
+                    ) : (
+                      <span className="text-xs text-muted-foreground">—</span>
+                    )}
+                  </TableCell>
+                  <TableCell>
+                    <TicketPriorityChip priority={t.priority as TicketPriority} />
+                  </TableCell>
+                  <TableCell>
+                    <TicketChannelIcon channel={t.channel as TicketChannel} />
+                  </TableCell>
+                  <TableCell className="text-xs text-muted-foreground">
+                    <TimeAgo date={t.lastActivityAt} />
+                  </TableCell>
+                </TableRow>
+              )
+            })}
+          </TableBody>
+        </Table>
+      </div>
+
+      <AlertDialog open={pending !== null} onOpenChange={(v) => !v && setPending(null)}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Confirm bulk action</AlertDialogTitle>
+            <AlertDialogDescription>
+              You are about to apply this action to {selected.size} tickets. Continue?
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel onClick={() => setPending(null)}>Cancel</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={() => {
+                pending?.()
+                setPending(null)
+              }}
+            >
+              Apply
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-shares-panel.tsx b/apps/web/src/components/admin/tickets/ticket-shares-panel.tsx
new file mode 100644
index 000000000..11019684b
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-shares-panel.tsx
@@ -0,0 +1,127 @@
+/**
+ * Right-panel "Shares" tab. Lists current cross-team shares of the ticket and
+ * lets a user with `ticket.share_cross_team` add or revoke shares.
+ */
+import { useState } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import type { TicketId, TeamId, TicketShareId } from '@quackback/ids'
+import { Button } from '@/components/ui/button'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { XMarkIcon } from '@heroicons/react/24/outline'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import { shareTicketFn, revokeShareFn } from '@/lib/server/functions/tickets'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { toast } from 'sonner'
+
+const ACCESS_LEVELS = ['read', 'comment', 'full'] as const
+type AccessLevel = (typeof ACCESS_LEVELS)[number]
+
+export interface ShareRow {
+  id: TicketShareId
+  ticketId: TicketId
+  teamId: TeamId
+  accessLevel: AccessLevel | string
+}
+
+export interface TicketSharesPanelProps {
+  ticketId: TicketId
+  shares: ShareRow[]
+  teamNames?: Record<string, string>
+  canShare: boolean
+}
+
+export function TicketSharesPanel({
+  ticketId,
+  shares,
+  teamNames,
+  canShare,
+}: TicketSharesPanelProps) {
+  const qc = useQueryClient()
+  const [teamId, setTeamId] = useState<TeamId | null>(null)
+  const [accessLevel, setAccessLevel] = useState<AccessLevel>('read')
+
+  const invalidate = () =>
+    qc.invalidateQueries({ queryKey: ticketQueries.shares(ticketId).queryKey })
+
+  const addMutation = useMutation({
+    mutationFn: () => shareTicketFn({ data: { ticketId, teamId: teamId!, accessLevel } }),
+    onSuccess: () => {
+      setTeamId(null)
+      invalidate()
+      toast.success('Ticket shared')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const revokeMutation = useMutation({
+    mutationFn: (shareId: TicketShareId) => revokeShareFn({ data: { shareId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Share revoked')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  return (
+    <div className="space-y-3 text-sm">
+      {shares.length === 0 ? (
+        <div className="text-xs text-muted-foreground">Not shared with any teams.</div>
+      ) : (
+        <ul className="space-y-1">
+          {shares.map((s) => (
+            <li key={s.id} className="flex items-center justify-between gap-2 text-xs">
+              <span className="truncate">
+                <span className="font-medium">{teamNames?.[s.teamId] ?? s.teamId}</span>
+                <span className="text-muted-foreground ml-1">({s.accessLevel})</span>
+              </span>
+              {canShare && (
+                <Button
+                  size="sm"
+                  variant="ghost"
+                  className="h-6 w-6 p-0"
+                  aria-label="Revoke share"
+                  onClick={() => revokeMutation.mutate(s.id)}
+                  disabled={revokeMutation.isPending}
+                >
+                  <XMarkIcon className="h-3.5 w-3.5" />
+                </Button>
+              )}
+            </li>
+          ))}
+        </ul>
+      )}
+
+      {canShare && (
+        <div className="rounded border border-border/50 p-2 space-y-2">
+          <TeamPicker value={teamId} onValueChange={setTeamId} placeholder="Pick team…" />
+          <Select value={accessLevel} onValueChange={(v) => setAccessLevel(v as AccessLevel)}>
+            <SelectTrigger className="h-7 w-full text-xs">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              {ACCESS_LEVELS.map((l) => (
+                <SelectItem key={l} value={l}>
+                  {l}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+          <Button
+            size="sm"
+            className="w-full"
+            disabled={!teamId || addMutation.isPending}
+            onClick={() => addMutation.mutate()}
+          >
+            Share
+          </Button>
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-sla-panel.tsx b/apps/web/src/components/admin/tickets/ticket-sla-panel.tsx
new file mode 100644
index 000000000..931555903
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-sla-panel.tsx
@@ -0,0 +1,49 @@
+/**
+ * Right-panel "SLA" tab. Read-only summary of the ticket's active SLA clocks,
+ * each rendered with `<SlaClockChip />`. Policy management lives in admin
+ * settings; we only display state here.
+ */
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { TicketId } from '@quackback/ids'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { SlaClockChip, type SlaClockKind, type SlaClockState } from './sla-clock-chip'
+
+export interface TicketSlaPanelProps {
+  ticketId: TicketId
+}
+
+const KIND_LABELS: Record<string, string> = {
+  first_response: 'First response',
+  next_response: 'Next response',
+  resolution: 'Resolution',
+}
+
+export function TicketSlaPanel({ ticketId }: TicketSlaPanelProps) {
+  const { data } = useSuspenseQuery(ticketQueries.slaClocks(ticketId))
+
+  if (data.length === 0) {
+    return <div className="text-xs text-muted-foreground py-2">No SLA clocks on this ticket.</div>
+  }
+
+  return (
+    <div className="space-y-2 text-sm">
+      {data.map((clock) => (
+        <div
+          key={clock.id}
+          className="flex items-center justify-between rounded border border-border/50 px-2 py-1.5"
+        >
+          <span className="text-xs font-medium">{KIND_LABELS[clock.kind] ?? clock.kind}</span>
+          <SlaClockChip
+            clock={{
+              kind: clock.kind as SlaClockKind,
+              state: clock.state as SlaClockState,
+              dueAt: clock.dueAt,
+              breachedAt: clock.breachedAt,
+              metAt: clock.metAt,
+            }}
+          />
+        </div>
+      ))}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-status-pill.tsx b/apps/web/src/components/admin/tickets/ticket-status-pill.tsx
new file mode 100644
index 000000000..c5873b4eb
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-status-pill.tsx
@@ -0,0 +1,35 @@
+/**
+ * Color-coded status pill for tickets. Uses statusCategory to pick the colour
+ * ramp; the displayed label comes from the status's `name` field.
+ */
+import { cn } from '@/lib/shared/utils'
+
+export type StatusCategory = 'open' | 'pending' | 'on_hold' | 'solved' | 'closed'
+
+export interface TicketStatusPillProps {
+  name: string
+  category: StatusCategory
+  className?: string
+}
+
+const categoryStyles: Record<StatusCategory, string> = {
+  open: 'bg-blue-100 text-blue-800 dark:bg-blue-950 dark:text-blue-200',
+  pending: 'bg-amber-100 text-amber-800 dark:bg-amber-950 dark:text-amber-200',
+  on_hold: 'bg-slate-100 text-slate-800 dark:bg-slate-800 dark:text-slate-200',
+  solved: 'bg-emerald-100 text-emerald-800 dark:bg-emerald-950 dark:text-emerald-200',
+  closed: 'bg-neutral-100 text-neutral-700 dark:bg-neutral-800 dark:text-neutral-300',
+}
+
+export function TicketStatusPill({ name, category, className }: TicketStatusPillProps) {
+  return (
+    <span
+      className={cn(
+        'inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium',
+        categoryStyles[category],
+        className
+      )}
+    >
+      {name}
+    </span>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-subscription-menu.tsx b/apps/web/src/components/admin/tickets/ticket-subscription-menu.tsx
new file mode 100644
index 000000000..9341f9295
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-subscription-menu.tsx
@@ -0,0 +1,210 @@
+/**
+ * Per-ticket subscription dropdown rendered in the ticket detail header.
+ * Lets the current principal subscribe / unsubscribe / toggle the 6 event
+ * preferences / mute (1h, 1d, 1w, until unmute).
+ */
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { BellIcon, BellSlashIcon, BellAlertIcon } from '@heroicons/react/24/outline'
+import { BellIcon as BellIconSolid } from '@heroicons/react/24/solid'
+import { toast } from 'sonner'
+import type { TicketId } from '@quackback/ids'
+import { Button } from '@/components/ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuSub,
+  DropdownMenuSubContent,
+  DropdownMenuSubTrigger,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu'
+import {
+  getMyTicketSubscriptionFn,
+  subscribeToTicketFn,
+  unsubscribeFromTicketFn,
+  updateTicketSubscriptionPrefsFn,
+  muteTicketFn,
+  unmuteTicketFn,
+} from '@/lib/server/functions/notifications'
+
+const PREF_FLAGS = [
+  { key: 'notifyThreads', label: 'New replies' },
+  { key: 'notifyStatus', label: 'Status changes' },
+  { key: 'notifyAssignment', label: 'Assignment changes' },
+  { key: 'notifyParticipants', label: 'Participant changes' },
+  { key: 'notifyShares', label: 'Share grants' },
+  { key: 'notifySla', label: 'SLA warnings & breaches' },
+] as const
+
+type PrefKey = (typeof PREF_FLAGS)[number]['key']
+
+const MUTE_DURATIONS: Array<{ label: string; ms: number | null }> = [
+  { label: 'Mute for 1 hour', ms: 60 * 60 * 1000 },
+  { label: 'Mute for 1 day', ms: 24 * 60 * 60 * 1000 },
+  { label: 'Mute for 1 week', ms: 7 * 24 * 60 * 60 * 1000 },
+  { label: 'Mute until I unmute', ms: null },
+]
+
+export interface TicketSubscriptionMenuProps {
+  ticketId: TicketId
+}
+
+export function TicketSubscriptionMenu({ ticketId }: TicketSubscriptionMenuProps) {
+  const qc = useQueryClient()
+  const queryKey = ['tickets', 'my-subscription', ticketId] as const
+
+  const { data: sub, isLoading } = useQuery({
+    queryKey,
+    queryFn: () => getMyTicketSubscriptionFn({ data: { ticketId } }),
+  })
+
+  const invalidate = () => qc.invalidateQueries({ queryKey })
+
+  const subscribeMutation = useMutation({
+    mutationFn: () => subscribeToTicketFn({ data: { ticketId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Subscribed')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const unsubscribeMutation = useMutation({
+    mutationFn: () => unsubscribeFromTicketFn({ data: { ticketId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Unsubscribed')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const updatePrefsMutation = useMutation({
+    mutationFn: (patch: Partial<Record<PrefKey, boolean>>) =>
+      updateTicketSubscriptionPrefsFn({ data: { ticketId, patch } }),
+    onSuccess: () => invalidate(),
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const muteMutation = useMutation({
+    mutationFn: (untilIso?: string) =>
+      muteTicketFn({ data: untilIso ? { ticketId, untilIso } : { ticketId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Muted')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const unmuteMutation = useMutation({
+    mutationFn: () => unmuteTicketFn({ data: { ticketId } }),
+    onSuccess: () => {
+      invalidate()
+      toast.success('Unmuted')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const isSubscribed = !!sub
+  const mutedUntil = sub?.mutedUntil ? new Date(sub.mutedUntil) : null
+  const isMuted = !!mutedUntil && mutedUntil.getTime() > Date.now()
+
+  let Icon = BellIcon
+  let iconClass = 'text-muted-foreground'
+  let ariaLabel = 'Subscribe to ticket'
+  if (isMuted) {
+    Icon = BellSlashIcon
+    iconClass = 'text-amber-500'
+    ariaLabel = 'Subscription menu (muted)'
+  } else if (isSubscribed) {
+    Icon = BellIconSolid
+    iconClass = 'text-primary'
+    ariaLabel = 'Subscription menu (subscribed)'
+  }
+
+  const busy =
+    isLoading ||
+    subscribeMutation.isPending ||
+    unsubscribeMutation.isPending ||
+    updatePrefsMutation.isPending ||
+    muteMutation.isPending ||
+    unmuteMutation.isPending
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button size="sm" variant="ghost" aria-label={ariaLabel} disabled={busy}>
+          <Icon className={`h-4 w-4 ${iconClass}`} />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="w-56">
+        <DropdownMenuLabel>Notifications</DropdownMenuLabel>
+        <DropdownMenuSeparator />
+        {!isSubscribed ? (
+          <DropdownMenuItem onSelect={() => subscribeMutation.mutate()}>
+            <BellIcon className="h-4 w-4 mr-2" />
+            Subscribe
+          </DropdownMenuItem>
+        ) : (
+          <>
+            <DropdownMenuItem onSelect={() => unsubscribeMutation.mutate()}>
+              <BellSlashIcon className="h-4 w-4 mr-2" />
+              Unsubscribe
+            </DropdownMenuItem>
+            <DropdownMenuSub>
+              <DropdownMenuSubTrigger>
+                <BellAlertIcon className="h-4 w-4 mr-2" />
+                Customize prefs
+              </DropdownMenuSubTrigger>
+              <DropdownMenuSubContent className="w-56">
+                {PREF_FLAGS.map((f) => (
+                  <DropdownMenuCheckboxItem
+                    key={f.key}
+                    checked={!!sub?.[f.key]}
+                    onCheckedChange={(checked) =>
+                      updatePrefsMutation.mutate({ [f.key]: !!checked })
+                    }
+                    onSelect={(e) => e.preventDefault()}
+                  >
+                    {f.label}
+                  </DropdownMenuCheckboxItem>
+                ))}
+              </DropdownMenuSubContent>
+            </DropdownMenuSub>
+            <DropdownMenuSub>
+              <DropdownMenuSubTrigger>
+                <BellSlashIcon className="h-4 w-4 mr-2" />
+                Mute
+              </DropdownMenuSubTrigger>
+              <DropdownMenuSubContent>
+                {MUTE_DURATIONS.map((d) => (
+                  <DropdownMenuItem
+                    key={d.label}
+                    onSelect={() =>
+                      muteMutation.mutate(
+                        d.ms === null ? undefined : new Date(Date.now() + d.ms).toISOString()
+                      )
+                    }
+                  >
+                    {d.label}
+                  </DropdownMenuItem>
+                ))}
+              </DropdownMenuSubContent>
+            </DropdownMenuSub>
+            {isMuted && (
+              <>
+                <DropdownMenuSeparator />
+                <DropdownMenuItem onSelect={() => unmuteMutation.mutate()}>
+                  <BellIcon className="h-4 w-4 mr-2" />
+                  Unmute
+                </DropdownMenuItem>
+              </>
+            )}
+          </>
+        )}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-thread-composer.tsx b/apps/web/src/components/admin/tickets/ticket-thread-composer.tsx
new file mode 100644
index 000000000..d8bf88e3c
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-thread-composer.tsx
@@ -0,0 +1,250 @@
+/**
+ * Composer for posting a new thread on a ticket. Audience tabs (Public /
+ * Internal / Shared with team) are gated by the actor's permissions for this
+ * ticket. The shared-team tab requires picking a team via `<TeamPicker />`.
+ */
+import { useState, useMemo, useRef } from 'react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import type { JSONContent } from '@tiptap/react'
+import type { TicketId, TeamId, TicketThreadId } from '@quackback/ids'
+import { Button } from '@/components/ui/button'
+import { Tabs, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { RichTextEditor } from '@/components/ui/rich-text-editor'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import { addThreadFn } from '@/lib/server/functions/tickets'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { toast } from 'sonner'
+import { cn } from '@/lib/shared/utils'
+import { X, Upload } from 'lucide-react'
+import { useImageUpload } from '@/lib/client/hooks/use-image-upload'
+
+export type ComposerAudience = 'public' | 'internal' | 'shared_team'
+
+export interface TicketThreadComposerProps {
+  ticketId: TicketId
+  /** Permission flags resolved by the parent (uses canReplyPublic etc). */
+  canPublic: boolean
+  canInternal: boolean
+  canShared: boolean
+  onPosted?: () => void
+}
+
+function plainTextFromJson(json: JSONContent | null): string {
+  if (!json) return ''
+  let out = ''
+  const walk = (node: JSONContent) => {
+    if (node.type === 'text' && typeof node.text === 'string') out += node.text
+    if (node.content) node.content.forEach(walk)
+    if (node.type === 'paragraph' || node.type === 'heading') out += '\n'
+  }
+  walk(json)
+  return out.trim()
+}
+
+export function TicketThreadComposer({
+  ticketId,
+  canPublic,
+  canInternal,
+  canShared,
+  onPosted,
+}: TicketThreadComposerProps) {
+  const qc = useQueryClient()
+  const { upload: uploadImage } = useImageUpload({ prefix: 'uploads' })
+  const fileInputRef = useRef<HTMLInputElement>(null)
+  const allowedTabs = useMemo(() => {
+    const tabs: ComposerAudience[] = []
+    if (canPublic) tabs.push('public')
+    if (canInternal) tabs.push('internal')
+    if (canShared) tabs.push('shared_team')
+    return tabs
+  }, [canPublic, canInternal, canShared])
+
+  const [audience, setAudience] = useState<ComposerAudience>(allowedTabs[0] ?? 'internal')
+  const [body, setBody] = useState<JSONContent | null>(null)
+  const [bodyText, setBodyText] = useState('')
+  const [sharedTeamId, setSharedTeamId] = useState<TeamId | null>(null)
+  const [selectedFiles, setSelectedFiles] = useState<File[]>([])
+
+  const postMutation = useMutation({
+    mutationFn: async () => {
+      const thread = await addThreadFn({
+        data: {
+          ticketId,
+          audience,
+          bodyJson: body as unknown as { type: 'doc'; content?: unknown[] } | null,
+          bodyText: bodyText || plainTextFromJson(body),
+          sharedWithTeamId: audience === 'shared_team' ? sharedTeamId : null,
+        },
+      })
+
+      // Upload files if any
+      if (selectedFiles.length > 0 && thread?.id) {
+        const threadId = thread.id as TicketThreadId
+        for (const file of selectedFiles) {
+          try {
+            const formData = new FormData()
+            formData.append('file', file)
+            const res = await fetch(`/api/v1/tickets/${ticketId}/threads/${threadId}/attachments`, {
+              method: 'POST',
+              body: formData,
+            })
+            if (!res.ok) {
+              const error = await res.text()
+              throw new Error(`Upload failed: ${error}`)
+            }
+          } catch (e) {
+            const msg = e instanceof Error ? e.message : 'Upload failed'
+            toast.error(`Failed to upload ${file.name}: ${msg}`)
+          }
+        }
+        // Invalidate attachments query for this thread
+        qc.invalidateQueries({ queryKey: ticketQueries.attachments(ticketId, threadId).queryKey })
+      }
+
+      return thread
+    },
+    onSuccess: () => {
+      setBody(null)
+      setBodyText('')
+      setSelectedFiles([])
+      qc.invalidateQueries({ queryKey: ticketQueries.threads(ticketId).queryKey })
+      qc.invalidateQueries({ queryKey: ticketQueries.detail(ticketId).queryKey })
+      qc.invalidateQueries({ queryKey: ['tickets', 'list'] })
+      onPosted?.()
+      toast.success('Reply posted')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  if (allowedTabs.length === 0) {
+    return (
+      <div className="border-t border-border/50 px-4 py-3 text-xs text-muted-foreground">
+        You don&apos;t have permission to reply on this ticket.
+      </div>
+    )
+  }
+
+  const isEmpty = !bodyText.trim() && (!body || plainTextFromJson(body).length === 0)
+  const sharedNeedsTeam = audience === 'shared_team' && !sharedTeamId
+
+  return (
+    <div className="border-t border-border/50 bg-background p-3">
+      <Tabs
+        value={audience}
+        onValueChange={(v) => setAudience(v as ComposerAudience)}
+        className="mb-2"
+      >
+        <TabsList>
+          {canPublic && <TabsTrigger value="public">Public reply</TabsTrigger>}
+          {canInternal && <TabsTrigger value="internal">Internal note</TabsTrigger>}
+          {canShared && <TabsTrigger value="shared_team">Share with team</TabsTrigger>}
+        </TabsList>
+      </Tabs>
+
+      {audience === 'shared_team' && (
+        <div className="mb-2">
+          <TeamPicker
+            value={sharedTeamId}
+            onValueChange={setSharedTeamId}
+            placeholder="Pick team to share with…"
+          />
+        </div>
+      )}
+
+      <div
+        className={cn(
+          'rounded border',
+          audience === 'internal' && 'border-amber-300/60',
+          audience === 'shared_team' && 'border-purple-300/60'
+        )}
+      >
+        <RichTextEditor
+          value={body ?? undefined}
+          onChange={(json, _html, markdown) => {
+            setBody(json)
+            setBodyText(markdown)
+          }}
+          placeholder={
+            audience === 'public'
+              ? 'Reply to customer…'
+              : audience === 'internal'
+                ? 'Internal note (only agents can see this)…'
+                : 'Visible to your team and the picked team…'
+          }
+          minHeight="100px"
+          features={{
+            headings: false,
+            codeBlocks: true,
+            blockquotes: true,
+            dividers: false,
+            images: true,
+            taskLists: false,
+            tables: false,
+            embeds: false,
+            slashMenu: false,
+          }}
+          onImageUpload={uploadImage}
+        />
+      </div>
+
+      {/* File picker and list */}
+      <input
+        ref={fileInputRef}
+        type="file"
+        multiple
+        className="hidden"
+        onChange={(e) => {
+          if (e.target.files) {
+            setSelectedFiles(Array.from(e.target.files))
+          }
+        }}
+      />
+
+      {selectedFiles.length > 0 && (
+        <div className="mt-2 space-y-2">
+          <div className="text-xs font-medium text-muted-foreground">
+            Attachments ({selectedFiles.length})
+          </div>
+          <div className="space-y-1">
+            {selectedFiles.map((file) => (
+              <div
+                key={file.name}
+                className="flex items-center justify-between rounded bg-muted/50 px-2 py-1 text-xs"
+              >
+                <span className="truncate">{file.name}</span>
+                <button
+                  type="button"
+                  onClick={() =>
+                    setSelectedFiles((prev) => prev.filter((f) => f.name !== file.name))
+                  }
+                  className="ml-2 hover:text-red-500"
+                >
+                  <X className="h-3 w-3" />
+                </button>
+              </div>
+            ))}
+          </div>
+        </div>
+      )}
+
+      <div className="flex items-center justify-between mt-2 gap-2">
+        <Button
+          size="sm"
+          variant="outline"
+          type="button"
+          onClick={() => fileInputRef.current?.click()}
+        >
+          <Upload className="h-4 w-4 mr-1" />
+          Attach files
+        </Button>
+        <Button
+          size="sm"
+          onClick={() => postMutation.mutate()}
+          disabled={isEmpty || sharedNeedsTeam || postMutation.isPending}
+        >
+          {postMutation.isPending ? 'Posting…' : 'Post'}
+        </Button>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/admin/tickets/ticket-thread-feed.tsx b/apps/web/src/components/admin/tickets/ticket-thread-feed.tsx
new file mode 100644
index 000000000..c032fe675
--- /dev/null
+++ b/apps/web/src/components/admin/tickets/ticket-thread-feed.tsx
@@ -0,0 +1,284 @@
+/**
+ * Thread feed for the ticket-detail page. Renders threads in chronological
+ * order with audience-aware bubble styling: public = neutral card, internal =
+ * yellow tinted, shared_team = purple tinted with the team label.
+ */
+import { useCallback, useState } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import type { JSONContent } from '@tiptap/react'
+import type { TicketId, TeamId, PrincipalId, TicketThreadId } from '@quackback/ids'
+import { cn } from '@/lib/shared/utils'
+import { TimeAgo } from '@/components/ui/time-ago'
+import {
+  RichTextContent,
+  RichTextEditor,
+  isRichTextContent,
+} from '@/components/ui/rich-text-editor'
+import { Button } from '@/components/ui/button'
+import { Pencil } from 'lucide-react'
+import { TicketAttachments } from '@/components/tickets/ticket-attachments'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { useImageUpload } from '@/lib/client/hooks/use-image-upload'
+
+export interface ThreadRow {
+  id: TicketThreadId
+  ticketId: TicketId
+  principalId: PrincipalId | null
+  audience: 'public' | 'internal' | 'shared_team'
+  bodyJson: unknown
+  bodyText: string
+  sharedWithTeamId: TeamId | null
+  createdAt: Date | string
+  editedAt: Date | string | null
+}
+
+export interface TicketThreadFeedProps {
+  threads: ThreadRow[]
+  /** Optional fallback ticketId for attachment lookups when thread rows omit it. */
+  fallbackTicketId?: TicketId
+  /** Optional map of teamId → teamName for nicer "Shared with X" labels. */
+  teamNames?: Record<string, string>
+  /** Optional map of principalId → display name for author labels. */
+  principalNames?: Record<string, string>
+  /** Optional initial-description block (rendered before first thread). */
+  description?: { text: string | null; json: unknown } | null
+  /** Callback to save an edited description. When provided, the description is editable. */
+  onDescriptionUpdate?: (json: JSONContent | null, text: string | null) => void
+  /** Whether a description update is currently saving. */
+  isDescriptionSaving?: boolean
+}
+
+const DESCRIPTION_EDITOR_FEATURES = {
+  headings: false,
+  codeBlocks: true,
+  blockquotes: true,
+  dividers: false,
+  images: true,
+  taskLists: false,
+  tables: false,
+  embeds: false,
+  slashMenu: false,
+} as const
+
+function plainTextFromJson(json: JSONContent | null): string {
+  if (!json) return ''
+  let out = ''
+  const walk = (node: JSONContent) => {
+    if (node.type === 'text' && typeof node.text === 'string') out += node.text
+    if (node.content) node.content.forEach(walk)
+    if (node.type === 'paragraph' || node.type === 'heading') out += '\n'
+  }
+  walk(json)
+  return out.trim()
+}
+
+function textToDoc(text: string): JSONContent {
+  return {
+    type: 'doc',
+    content: text.split('\n').map((line) => ({
+      type: 'paragraph',
+      content: line ? [{ type: 'text', text: line }] : undefined,
+    })),
+  }
+}
+
+function hasMeaningfulJsonContent(content: unknown): content is JSONContent {
+  if (!isRichTextContent(content)) return false
+  const visit = (node: JSONContent): boolean => {
+    if (node.type === 'text') return typeof node.text === 'string' && node.text.trim().length > 0
+    if (node.type === 'image' || node.type === 'quackbackEmbed' || node.type === 'horizontalRule') {
+      return true
+    }
+    return node.content?.some(visit) ?? false
+  }
+  return visit(content)
+}
+
+function hasDescriptionContent(
+  description: { text: string | null; json: unknown } | null | undefined
+) {
+  return Boolean(
+    description &&
+    ((description.text?.trim() ?? '').length > 0 || hasMeaningfulJsonContent(description.json))
+  )
+}
+
+const audienceStyles: Record<ThreadRow['audience'], string> = {
+  public: 'border-border/50 bg-background',
+  internal: 'border-amber-300/60 bg-amber-50/60 dark:border-amber-900/40 dark:bg-amber-950/20',
+  shared_team:
+    'border-purple-300/60 bg-purple-50/60 dark:border-purple-900/40 dark:bg-purple-950/20',
+}
+
+const audienceLabels: Record<ThreadRow['audience'], string> = {
+  public: 'Public',
+  internal: 'Internal note',
+  shared_team: 'Shared with team',
+}
+
+export function TicketThreadFeed({
+  threads,
+  fallbackTicketId,
+  teamNames,
+  principalNames,
+  description,
+  onDescriptionUpdate,
+  isDescriptionSaving,
+}: TicketThreadFeedProps) {
+  const { upload: uploadImage } = useImageUpload({ prefix: 'uploads' })
+  const hasDesc = hasDescriptionContent(description)
+  const [editingDescription, setEditingDescription] = useState(false)
+  const [descDraft, setDescDraft] = useState<JSONContent | null>(null)
+  const [descDraftText, setDescDraftText] = useState('')
+
+  const startEditingDescription = useCallback(() => {
+    const currentText = description?.text ?? ''
+    const currentJson = isRichTextContent(description?.json)
+      ? (description!.json as JSONContent)
+      : null
+    setDescDraft(currentJson ?? (currentText ? textToDoc(currentText) : null))
+    setDescDraftText(currentText)
+    setEditingDescription(true)
+  }, [description])
+
+  const cancelEditingDescription = useCallback(() => {
+    setEditingDescription(false)
+    setDescDraft(null)
+    setDescDraftText('')
+  }, [])
+
+  const saveDescription = useCallback(() => {
+    const nextText = descDraftText.trim() || plainTextFromJson(descDraft)
+    const nextJson = hasMeaningfulJsonContent(descDraft) ? descDraft : null
+    onDescriptionUpdate?.(nextJson, nextText || null)
+    setEditingDescription(false)
+  }, [descDraft, descDraftText, onDescriptionUpdate])
+
+  if (threads.length === 0 && !hasDesc) {
+    if (!onDescriptionUpdate) {
+      return <div className="text-sm text-muted-foreground py-6 text-center">No replies yet.</div>
+    }
+  }
+  return (
+    <div className="space-y-3">
+      {editingDescription ? (
+        <article className="rounded-md border border-border/50 bg-muted/20 p-3">
+          <div className="mb-2 text-xs font-medium text-muted-foreground">Description</div>
+          <div className="rounded border bg-background">
+            <RichTextEditor
+              value={descDraft ?? undefined}
+              onChange={(json, _html, markdown) => {
+                setDescDraft(json)
+                setDescDraftText(markdown)
+              }}
+              placeholder="Add a description..."
+              minHeight="100px"
+              features={DESCRIPTION_EDITOR_FEATURES}
+              onImageUpload={uploadImage}
+            />
+          </div>
+          <div className="mt-2 flex items-center justify-end gap-1">
+            <Button
+              size="sm"
+              variant="ghost"
+              onClick={cancelEditingDescription}
+              disabled={isDescriptionSaving}
+            >
+              Cancel
+            </Button>
+            <Button size="sm" onClick={saveDescription} disabled={isDescriptionSaving}>
+              {isDescriptionSaving ? 'Saving...' : 'Save'}
+            </Button>
+          </div>
+        </article>
+      ) : hasDesc ? (
+        <article className="group rounded-md border border-border/50 bg-muted/20 p-3">
+          <header className="mb-1 flex items-center justify-between gap-2 text-xs font-medium text-muted-foreground">
+            <span>Description</span>
+            {onDescriptionUpdate && (
+              <Button
+                size="sm"
+                variant="ghost"
+                className="h-6 px-2 text-xs opacity-100 transition-opacity md:opacity-0 md:group-hover:opacity-100 md:focus-visible:opacity-100"
+                onClick={startEditingDescription}
+              >
+                <Pencil className="mr-1 size-3" />
+                Edit
+              </Button>
+            )}
+          </header>
+          {hasMeaningfulJsonContent(description!.json) ? (
+            <RichTextContent content={description!.json} className="prose-sm" />
+          ) : (
+            <div className="text-sm whitespace-pre-wrap">{description!.text}</div>
+          )}
+        </article>
+      ) : onDescriptionUpdate ? (
+        <button
+          type="button"
+          onClick={startEditingDescription}
+          className="w-full rounded-md border border-dashed border-border/50 bg-muted/10 p-3 text-left text-sm text-muted-foreground transition-colors hover:bg-muted/30"
+        >
+          Add a description...
+        </button>
+      ) : null}
+      {threads.map((th) => {
+        const teamLabel =
+          th.audience === 'shared_team' && th.sharedWithTeamId
+            ? (teamNames?.[th.sharedWithTeamId] ?? th.sharedWithTeamId)
+            : null
+        const author = th.principalId ? (principalNames?.[th.principalId] ?? 'Unknown') : 'System'
+        return (
+          <article key={th.id} className={cn('rounded-md border p-3', audienceStyles[th.audience])}>
+            <header className="flex items-center justify-between text-xs mb-2">
+              <div className="flex items-center gap-2">
+                <span className="font-medium">{author}</span>
+                <span className="text-muted-foreground">
+                  · <TimeAgo date={th.createdAt} />
+                  {th.editedAt && <span className="ml-1 italic">(edited)</span>}
+                </span>
+              </div>
+              <span className="text-[11px] uppercase tracking-wide text-muted-foreground">
+                {audienceLabels[th.audience]}
+                {teamLabel && <span className="ml-1 normal-case">· {teamLabel}</span>}
+              </span>
+            </header>
+            {isRichTextContent(th.bodyJson) ? (
+              <RichTextContent content={th.bodyJson} className="prose-sm" />
+            ) : (
+              <div className="text-sm whitespace-pre-wrap">{th.bodyText}</div>
+            )}
+            <ThreadAttachmentsLoader
+              ticketId={(th.ticketId ?? fallbackTicketId) as TicketId}
+              threadId={th.id}
+            />
+          </article>
+        )
+      })}
+    </div>
+  )
+}
+
+function ThreadAttachmentsLoader({
+  ticketId,
+  threadId,
+}: {
+  ticketId: TicketId
+  threadId: TicketThreadId
+}) {
+  const {
+    data: attachments,
+    isLoading,
+    isError,
+  } = useQuery(ticketQueries.attachments(ticketId, threadId))
+
+  if (isError || (!isLoading && (!attachments || attachments.length === 0))) {
+    return null
+  }
+
+  return (
+    <div className="mt-3 pt-3 border-t border-border/50">
+      <TicketAttachments attachments={attachments ?? []} isLoading={isLoading} />
+    </div>
+  )
+}
diff --git a/apps/web/src/components/auth/auth-dialog.tsx b/apps/web/src/components/auth/auth-dialog.tsx
index b254fa324..f0371f4a5 100644
--- a/apps/web/src/components/auth/auth-dialog.tsx
+++ b/apps/web/src/components/auth/auth-dialog.tsx
@@ -78,6 +78,7 @@ export function AuthDialog({ authConfig, workspaceName }: AuthDialogProps) {
           workspaceName={workspaceName}
           callbackUrl={callbackUrl}
           onModeSwitch={setMode}
+          onSuccess={onAuthSuccess}
           onContextChange={setFormContext}
         />
       </DialogContent>
diff --git a/apps/web/src/components/auth/portal-auth-form-inline.tsx b/apps/web/src/components/auth/portal-auth-form-inline.tsx
index fd243d405..508603278 100644
--- a/apps/web/src/components/auth/portal-auth-form-inline.tsx
+++ b/apps/web/src/components/auth/portal-auth-form-inline.tsx
@@ -66,6 +66,15 @@ interface PortalAuthFormInlineProps {
   workspaceName?: string
   callbackUrl?: string
   onModeSwitch?: (mode: 'login' | 'signup') => void
+  /**
+   * Called immediately when authentication completes in this window.
+   *
+   * Same-window auth still posts to the BroadcastChannel for any other tabs,
+   * but BroadcastChannel delivery within a single window is racy (especially
+   * with browser extensions like password managers in the mix), so we also
+   * notify our hosting dialog directly to guarantee it closes.
+   */
+  onSuccess?: () => void
   /** Lets the surrounding dialog adapt its header to the form's step. */
   onContextChange?: (ctx: { step: AuthFormStep; email: string }) => void
 }
@@ -148,6 +157,7 @@ export function PortalAuthFormInline({
   workspaceName,
   callbackUrl,
   onModeSwitch,
+  onSuccess,
   onContextChange,
 }: PortalAuthFormInlineProps) {
   const intl = useIntl()
@@ -398,6 +408,7 @@ export function PortalAuthFormInline({
         return
       }
       postAuthSuccess()
+      onSuccess?.()
     } catch (err) {
       setError(
         err instanceof Error
diff --git a/apps/web/src/components/notifications/__tests__/notification-item.test.tsx b/apps/web/src/components/notifications/__tests__/notification-item.test.tsx
new file mode 100644
index 000000000..6c2361847
--- /dev/null
+++ b/apps/web/src/components/notifications/__tests__/notification-item.test.tsx
@@ -0,0 +1,162 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { NotificationItem } from '../notification-item'
+
+const mocks = vi.hoisted(() => ({
+  pathname: '/admin/dashboard',
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    to,
+    params,
+    search,
+    onClick,
+  }: {
+    children: ReactNode
+    to: string
+    params?: Record<string, string>
+    search?: Record<string, string>
+    onClick?: () => void
+  }) => (
+    <a
+      href={`${to}:${JSON.stringify(params ?? {})}:${JSON.stringify(search ?? {})}`}
+      onClick={(event) => {
+        event.preventDefault()
+        onClick?.()
+      }}
+    >
+      {children}
+    </a>
+  ),
+  useRouterState: ({ select }: { select: (state: { location: { pathname: string } }) => string }) =>
+    select({ location: { pathname: mocks.pathname } }),
+}))
+
+vi.mock('date-fns', () => ({
+  formatDistanceToNow: () => '2 minutes ago',
+}))
+
+vi.mock('../notification-type-config', () => ({
+  getNotificationTypeConfig: (type: string) => ({
+    bgClass: `bg-${type}`,
+    iconClass: `text-${type}`,
+    icon: ({ className }: { className?: string }) => <span className={className}>icon</span>,
+  }),
+}))
+
+function notification(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'notification_1',
+    type: 'ticket_assigned',
+    title: 'Assigned to you',
+    body: 'A ticket needs attention',
+    readAt: null,
+    createdAt: '2026-06-20T10:00:00.000Z',
+    ticketId: null,
+    postId: null,
+    post: null,
+    conversationId: null,
+    ...overrides,
+  } as never
+}
+
+beforeEach(() => {
+  mocks.pathname = '/admin/dashboard'
+})
+
+describe('NotificationItem', () => {
+  it('links ticket notifications and marks unread items as read', () => {
+    const onMarkAsRead = vi.fn()
+    const onClick = vi.fn()
+    render(
+      <NotificationItem
+        notification={notification({ ticketId: 'ticket_1' })}
+        onMarkAsRead={onMarkAsRead}
+        onClick={onClick}
+      />
+    )
+
+    const link = screen.getByRole('link', { name: /Assigned to you/ })
+    expect(link).toHaveAttribute('href', expect.stringContaining('/admin/tickets/$ticketId'))
+    expect(link).toHaveAttribute('href', expect.stringContaining('ticket_1'))
+    expect(screen.getByText('A ticket needs attention')).toBeInTheDocument()
+    expect(screen.getByText('2 minutes ago')).toBeInTheDocument()
+
+    fireEvent.click(link)
+    expect(onMarkAsRead).toHaveBeenCalledWith('notification_1')
+    expect(onClick).toHaveBeenCalled()
+  })
+
+  it('links post and chat mention notifications', () => {
+    const { rerender } = render(
+      <NotificationItem
+        notification={notification({
+          type: 'post_mentioned',
+          postId: 'post_1',
+          post: { boardSlug: 'roadmap', title: 'Public roadmap' },
+          readAt: '2026-06-20T11:00:00.000Z',
+        })}
+      />
+    )
+
+    expect(screen.getByRole('link', { name: /Assigned to you/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('/b/$slug/posts/$postId')
+    )
+
+    rerender(
+      <NotificationItem
+        notification={notification({
+          type: 'chat_mention',
+          title: 'Mentioned in chat',
+          conversationId: 'conversation_1',
+        })}
+      />
+    )
+
+    expect(screen.getByRole('link', { name: /Mentioned in chat/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('/admin/inbox')
+    )
+    expect(screen.getByRole('link', { name: /Mentioned in chat/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('conversation_1')
+    )
+  })
+
+  it('uses admin/public fallback links and full variant click handling', () => {
+    const onMarkAsRead = vi.fn()
+    const { rerender } = render(<NotificationItem notification={notification()} />)
+
+    expect(screen.getByRole('link', { name: /Assigned to you/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('/admin/notifications')
+    )
+
+    mocks.pathname = '/roadmap'
+    rerender(<NotificationItem notification={notification({ title: 'Public notice' })} />)
+    expect(screen.getByRole('link', { name: /Public notice/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('/notifications')
+    )
+
+    rerender(
+      <NotificationItem
+        notification={notification({
+          title: 'Full notice',
+          post: { boardSlug: 'roadmap', title: 'Roadmap source' },
+        })}
+        onMarkAsRead={onMarkAsRead}
+        variant="full"
+      />
+    )
+
+    expect(screen.getByText('Roadmap source')).toBeInTheDocument()
+    fireEvent.click(screen.getByText('Full notice').closest('div') as HTMLElement)
+    expect(onMarkAsRead).toHaveBeenCalledWith('notification_1')
+  })
+})
diff --git a/apps/web/src/components/notifications/notification-item.tsx b/apps/web/src/components/notifications/notification-item.tsx
index d45ec72d3..3eebfc3ab 100644
--- a/apps/web/src/components/notifications/notification-item.tsx
+++ b/apps/web/src/components/notifications/notification-item.tsx
@@ -52,6 +52,18 @@ export function NotificationItem({
     />
   )
 
+  if (notification.ticketId) {
+    return (
+      <Link
+        to="/admin/tickets/$ticketId"
+        params={{ ticketId: notification.ticketId }}
+        onClick={handleClick}
+      >
+        {content}
+      </Link>
+    )
+  }
+
   if (notification.post && notification.postId) {
     return (
       <Link
diff --git a/apps/web/src/components/notifications/notification-type-config.ts b/apps/web/src/components/notifications/notification-type-config.ts
index b453035cc..cc77c8219 100644
--- a/apps/web/src/components/notifications/notification-type-config.ts
+++ b/apps/web/src/components/notifications/notification-type-config.ts
@@ -5,6 +5,13 @@ import {
   SparklesIcon,
   NewspaperIcon,
   BellIcon,
+  ClockIcon,
+  ExclamationTriangleIcon,
+  UserPlusIcon,
+  UserMinusIcon,
+  ArrowPathIcon,
+  ShareIcon,
+  NoSymbolIcon,
 } from '@heroicons/react/24/solid'
 import type { NotificationType } from '@/lib/shared/types'
 
@@ -35,6 +42,56 @@ export const notificationTypeConfigs: Record<NotificationType, NotificationTypeC
     iconClass: 'text-green-500',
     bgClass: 'bg-green-500/10',
   },
+  ticket_sla_warning: {
+    icon: ClockIcon,
+    iconClass: 'text-amber-500',
+    bgClass: 'bg-amber-500/10',
+  },
+  ticket_sla_breach: {
+    icon: ExclamationTriangleIcon,
+    iconClass: 'text-red-500',
+    bgClass: 'bg-red-500/10',
+  },
+  ticket_assigned: {
+    icon: UserPlusIcon,
+    iconClass: 'text-blue-500',
+    bgClass: 'bg-blue-500/10',
+  },
+  ticket_unassigned: {
+    icon: UserMinusIcon,
+    iconClass: 'text-slate-500',
+    bgClass: 'bg-slate-500/10',
+  },
+  ticket_thread_added: {
+    icon: ChatBubbleLeftEllipsisIcon,
+    iconClass: 'text-indigo-500',
+    bgClass: 'bg-indigo-500/10',
+  },
+  ticket_status_changed: {
+    icon: ArrowPathIcon,
+    iconClass: 'text-emerald-500',
+    bgClass: 'bg-emerald-500/10',
+  },
+  ticket_participant_added: {
+    icon: UserPlusIcon,
+    iconClass: 'text-cyan-500',
+    bgClass: 'bg-cyan-500/10',
+  },
+  ticket_participant_removed: {
+    icon: UserMinusIcon,
+    iconClass: 'text-zinc-500',
+    bgClass: 'bg-zinc-500/10',
+  },
+  ticket_shared: {
+    icon: ShareIcon,
+    iconClass: 'text-fuchsia-500',
+    bgClass: 'bg-fuchsia-500/10',
+  },
+  ticket_unshared: {
+    icon: NoSymbolIcon,
+    iconClass: 'text-stone-500',
+    bgClass: 'bg-stone-500/10',
+  },
   chat_message: {
     icon: ChatBubbleLeftRightIcon,
     iconClass: 'text-teal-500',
diff --git a/apps/web/src/components/public/tickets/__tests__/portal-ticket-components.test.tsx b/apps/web/src/components/public/tickets/__tests__/portal-ticket-components.test.tsx
new file mode 100644
index 000000000..f159ce806
--- /dev/null
+++ b/apps/web/src/components/public/tickets/__tests__/portal-ticket-components.test.tsx
@@ -0,0 +1,93 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { PortalTicketDetailHeader } from '../portal-ticket-detail-header'
+import { PortalTicketRowItem } from '../portal-ticket-row'
+import { PortalTicketStatusFilter } from '../portal-ticket-status-filter'
+
+const mocks = vi.hoisted(() => ({
+  navigate: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  Link: ({
+    children,
+    to,
+    params,
+  }: {
+    children: ReactNode
+    to: string
+    params?: Record<string, string>
+    className?: string
+  }) => <a href={`${to}:${JSON.stringify(params ?? {})}`}>{children}</a>,
+  useNavigate: () => mocks.navigate,
+}))
+
+vi.mock('date-fns', () => ({
+  format: () => 'Jun 20, 2026',
+  formatDistanceToNow: () => '5 minutes ago',
+}))
+
+vi.mock('react-intl', () => ({
+  FormattedMessage: ({ defaultMessage }: { id: string; defaultMessage: string }) => (
+    <>{defaultMessage}</>
+  ),
+  useIntl: () => ({
+    formatMessage: (descriptor: { defaultMessage: string }, values?: Record<string, string>) =>
+      descriptor.defaultMessage
+        .replace('{date}', values?.date ?? '')
+        .replace('{when}', values?.when ?? ''),
+  }),
+}))
+
+describe('portal ticket components', () => {
+  it('renders detail header and list row metadata', () => {
+    render(
+      <>
+        <PortalTicketDetailHeader
+          subject="Cannot access account"
+          statusName="Open"
+          statusCategory="open"
+          createdAt={new Date('2026-06-20T10:00:00.000Z')}
+          lastActivityAt={new Date('2026-06-20T10:05:00.000Z')}
+        />
+        <PortalTicketRowItem
+          ticket={
+            {
+              id: 'ticket_1',
+              subject: 'Billing question',
+              statusName: 'Pending',
+              statusCategory: 'pending',
+              lastActivityAt: new Date('2026-06-20T10:05:00.000Z'),
+            } as never
+          }
+        />
+      </>
+    )
+
+    expect(screen.getByRole('heading', { name: 'Cannot access account' })).toBeInTheDocument()
+    expect(screen.getByText(/Opened Jun 20, 2026/)).toBeInTheDocument()
+    expect(screen.getByText(/Last update 5 minutes ago/)).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /Billing question/ })).toHaveAttribute(
+      'href',
+      expect.stringContaining('ticket_1')
+    )
+    expect(screen.getByText('Updated 5 minutes ago')).toBeInTheDocument()
+    expect(screen.getByText('Open')).toBeInTheDocument()
+    expect(screen.getByText('Pending')).toBeInTheDocument()
+  })
+
+  it('navigates ticket status filters', () => {
+    render(<PortalTicketStatusFilter value="pending" />)
+
+    expect(screen.getByRole('group', { name: 'Filter tickets by status' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Pending' })).toHaveAttribute('aria-pressed', 'true')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Closed' }))
+    expect(mocks.navigate).toHaveBeenCalledWith({ search: { status: 'closed' } })
+
+    fireEvent.click(screen.getByRole('button', { name: 'All' }))
+    expect(mocks.navigate).toHaveBeenCalledWith({ search: { status: 'all' } })
+  })
+})
diff --git a/apps/web/src/components/public/tickets/__tests__/portal-ticket-reply-composer.test.tsx b/apps/web/src/components/public/tickets/__tests__/portal-ticket-reply-composer.test.tsx
new file mode 100644
index 000000000..ec5917ac4
--- /dev/null
+++ b/apps/web/src/components/public/tickets/__tests__/portal-ticket-reply-composer.test.tsx
@@ -0,0 +1,303 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { PortalTicketReplyComposer } from '../portal-ticket-reply-composer'
+
+type ReplyPayload = {
+  bodyJson: unknown
+  bodyText: string
+}
+
+type FetchResponse = {
+  ok: boolean
+  text: () => Promise<string>
+}
+
+const mocks = vi.hoisted(() => ({
+  invalidateQueries: vi.fn(),
+  ensureQueryData: vi.fn(),
+  mutateAsync: vi.fn(),
+  uploadImage: vi.fn(),
+  fetch: vi.fn(),
+  replyPending: false,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+    ensureQueryData: mocks.ensureQueryData,
+  }),
+}))
+
+vi.mock('react-intl', () => ({
+  FormattedMessage: ({ defaultMessage }: { id: string; defaultMessage: string }) => (
+    <>{defaultMessage}</>
+  ),
+  useIntl: () => ({
+    formatMessage: ({ defaultMessage }: { id: string; defaultMessage: string }) => defaultMessage,
+  }),
+}))
+
+vi.mock('@/components/ui/rich-text-editor', () => ({
+  RichTextEditor: ({
+    value,
+    placeholder,
+    onChange,
+    onImageUpload,
+  }: {
+    value?: unknown
+    onChange: (json: unknown) => void
+    placeholder: string
+    minHeight?: string
+    features?: Record<string, boolean>
+    onImageUpload?: (file: File) => Promise<unknown>
+  }) => (
+    <div>
+      <div>{placeholder}</div>
+      <div>editor-value:{value ? 'set' : 'empty'}</div>
+      <button
+        type="button"
+        onClick={() =>
+          onChange({
+            type: 'doc',
+            content: [
+              {
+                type: 'paragraph',
+                content: [{ type: 'text', text: 'Hello support' }],
+              },
+            ],
+          })
+        }
+      >
+        Set reply text
+      </button>
+      <button
+        type="button"
+        onClick={() =>
+          onChange({
+            type: 'doc',
+            content: [{ type: 'heading', content: [] }],
+          })
+        }
+      >
+        Set empty heading
+      </button>
+      <button
+        type="button"
+        onClick={() => onImageUpload?.(new File(['image'], 'inline.png', { type: 'image/png' }))}
+      >
+        Upload inline image
+      </button>
+    </div>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+    'aria-busy': ariaBusy,
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    size?: string
+    variant?: string
+    'aria-busy'?: boolean
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick} aria-busy={ariaBusy}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('lucide-react', () => ({
+  Upload: () => <span aria-hidden="true">upload</span>,
+  X: () => <span aria-hidden="true">remove</span>,
+}))
+
+vi.mock('@/lib/client/queries/portal-tickets', () => ({
+  useReplyToMyTicket: () => ({
+    mutateAsync: mocks.mutateAsync,
+    isPending: mocks.replyPending,
+  }),
+  portalTicketQueries: {
+    detail: (ticketId: string) => ({
+      queryKey: ['portal-ticket', 'detail', ticketId],
+    }),
+  },
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    attachments: (ticketId: string, threadId: string) => ({
+      queryKey: ['ticket-attachments', ticketId, threadId],
+    }),
+  },
+}))
+
+vi.mock('@/lib/client/hooks/use-image-upload', () => ({
+  usePortalImageUpload: () => ({
+    upload: mocks.uploadImage,
+  }),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.replyPending = false
+  mocks.mutateAsync.mockResolvedValue(undefined)
+  mocks.uploadImage.mockResolvedValue({ url: 'https://example.com/inline.png' })
+  mocks.ensureQueryData.mockResolvedValue({
+    threads: [{ id: 'thread_created' }],
+  })
+  mocks.fetch.mockResolvedValue({
+    ok: true,
+    text: async () => '',
+  } satisfies FetchResponse)
+  vi.stubGlobal('fetch', mocks.fetch)
+})
+
+describe('PortalTicketReplyComposer', () => {
+  it('renders the closed ticket state without reply controls', () => {
+    render(<PortalTicketReplyComposer ticketId={'ticket_1' as never} isClosed />)
+
+    expect(
+      screen.getByText('This ticket is closed. Open a new one to follow up.')
+    ).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Send reply' })).not.toBeInTheDocument()
+  })
+
+  it('keeps send disabled for empty editor content and shows pending state', () => {
+    const { rerender } = render(
+      <PortalTicketReplyComposer ticketId={'ticket_1' as never} isClosed={false} />
+    )
+
+    expect(screen.getByRole('button', { name: 'Send reply' })).toBeDisabled()
+    fireEvent.click(screen.getByRole('button', { name: 'Set empty heading' }))
+    expect(screen.getByRole('button', { name: 'Send reply' })).toBeDisabled()
+
+    mocks.replyPending = true
+    fireEvent.click(screen.getByRole('button', { name: 'Set reply text' }))
+    rerender(<PortalTicketReplyComposer ticketId={'ticket_1' as never} isClosed={false} />)
+
+    expect(screen.getByRole('button', { name: 'Sending…' })).toBeDisabled()
+    expect(screen.getByRole('button', { name: 'Sending…' })).toHaveAttribute('aria-busy', 'true')
+  })
+
+  it('submits a rich-text reply, uploads inline images and resets after success', async () => {
+    render(<PortalTicketReplyComposer ticketId={'ticket_1' as never} isClosed={false} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Upload inline image' }))
+    expect(mocks.uploadImage).toHaveBeenCalledTimes(1)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Set reply text' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Send reply' }))
+
+    await waitFor(() => {
+      expect(mocks.mutateAsync).toHaveBeenCalledWith({
+        bodyJson: {
+          type: 'doc',
+          content: [
+            {
+              type: 'paragraph',
+              content: [{ type: 'text', text: 'Hello support' }],
+            },
+          ],
+        },
+        bodyText: 'Hello support',
+      } satisfies ReplyPayload)
+    })
+    expect(screen.getByText('editor-value:empty')).toBeInTheDocument()
+  })
+
+  it('uploads selected attachments to the created thread and invalidates attachment queries', async () => {
+    mocks.fetch
+      .mockResolvedValueOnce({
+        ok: true,
+        text: async () => '',
+      } satisfies FetchResponse)
+      .mockResolvedValueOnce({
+        ok: false,
+        text: async () => 'upload failed',
+      } satisfies FetchResponse)
+
+    const { container } = render(
+      <PortalTicketReplyComposer ticketId={'ticket_1' as never} isClosed={false} />
+    )
+
+    const input = container.querySelector('input[type="file"]')
+    expect(input).not.toBeNull()
+    fireEvent.change(input!, {
+      target: {
+        files: [
+          new File(['one'], 'one.png', { type: 'image/png' }),
+          new File(['two'], 'two.png', { type: 'image/png' }),
+        ],
+      },
+    })
+    expect(screen.getByText('Attachments (2)')).toBeInTheDocument()
+    expect(screen.getByText('one.png')).toBeInTheDocument()
+    expect(screen.getByText('two.png')).toBeInTheDocument()
+
+    fireEvent.click(screen.getAllByRole('button', { name: '' })[0])
+    expect(screen.queryByText('one.png')).not.toBeInTheDocument()
+    expect(screen.getByText('Attachments (1)')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Set reply text' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Send reply' }))
+
+    await waitFor(() => {
+      expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+        queryKey: ['portal-ticket', 'detail', 'ticket_1'],
+      })
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['portal-ticket', 'detail', 'ticket_1'],
+    })
+    expect(mocks.fetch).toHaveBeenCalledWith(
+      '/api/v1/tickets/ticket_1/threads/thread_created/attachments',
+      expect.objectContaining({
+        method: 'POST',
+        body: expect.any(FormData),
+      })
+    )
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['ticket-attachments', 'ticket_1', 'thread_created'],
+    })
+  })
+
+  it('keeps reply failures and best-effort upload failures from escaping the composer', async () => {
+    mocks.mutateAsync.mockRejectedValueOnce(new Error('Reply denied'))
+    const { rerender } = render(
+      <PortalTicketReplyComposer ticketId={'ticket_1' as never} isClosed={false} />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Set reply text' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Send reply' }))
+
+    await waitFor(() => {
+      expect(mocks.mutateAsync).toHaveBeenCalled()
+    })
+    expect(screen.getByText('editor-value:set')).toBeInTheDocument()
+
+    mocks.mutateAsync.mockResolvedValue(undefined)
+    mocks.fetch.mockRejectedValueOnce(new Error('Upload failed'))
+    const input = document.querySelector('input[type="file"]')
+    fireEvent.change(input!, {
+      target: {
+        files: [new File(['one'], 'one.png', { type: 'image/png' })],
+      },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Send reply' }))
+
+    await waitFor(() => {
+      expect(mocks.fetch).toHaveBeenCalled()
+    })
+    rerender(<PortalTicketReplyComposer ticketId={'ticket_1' as never} isClosed={false} />)
+    expect(screen.getByText('editor-value:empty')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/public/tickets/__tests__/portal-ticket-thread-feed.test.tsx b/apps/web/src/components/public/tickets/__tests__/portal-ticket-thread-feed.test.tsx
new file mode 100644
index 000000000..5c8b9ace7
--- /dev/null
+++ b/apps/web/src/components/public/tickets/__tests__/portal-ticket-thread-feed.test.tsx
@@ -0,0 +1,281 @@
+// @vitest-environment happy-dom
+import type { ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { PortalTicketThreadFeed, type PortalThread } from '../portal-ticket-thread-feed'
+
+type AttachmentState = {
+  data?: Array<{ id: string; filename: string }>
+  isLoading?: boolean
+  isError?: boolean
+}
+
+const mocks = vi.hoisted(() => ({
+  uploadImage: vi.fn(),
+  attachmentsByThread: {} as Record<string, AttachmentState>,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQuery: (options: { queryKey: readonly unknown[] }) => {
+    const threadId = String(options.queryKey[2])
+    const state = mocks.attachmentsByThread[threadId] ?? {}
+    return {
+      data: state.data,
+      isLoading: state.isLoading ?? false,
+      isError: state.isError ?? false,
+    }
+  },
+}))
+
+vi.mock('react-intl', () => ({
+  FormattedMessage: ({ defaultMessage }: { id: string; defaultMessage: string }) => (
+    <>{defaultMessage}</>
+  ),
+  useIntl: () => ({
+    formatMessage: ({ defaultMessage }: { id: string; defaultMessage: string }) => defaultMessage,
+  }),
+}))
+
+vi.mock('date-fns', () => ({
+  formatDistanceToNow: (date: Date) => `distance:${date.toISOString()}`,
+}))
+
+vi.mock('@/components/ui/rich-text-editor', () => ({
+  RichTextContent: ({ content, className }: { content: { type: string }; className?: string }) => (
+    <div data-class-name={className}>rich:{content.type}</div>
+  ),
+  RichTextEditor: ({
+    placeholder,
+    onChange,
+    onImageUpload,
+  }: {
+    value?: unknown
+    onChange: (json: { type: string }, html: string, markdown: string) => void
+    placeholder: string
+    minHeight?: string
+    features?: Record<string, boolean>
+    onImageUpload?: (file: File) => Promise<unknown>
+  }) => (
+    <div>
+      <div>{placeholder}</div>
+      <button
+        type="button"
+        onClick={() => onChange({ type: 'doc' }, '<p>Updated</p>', 'Updated markdown')}
+      >
+        Change draft
+      </button>
+      <button
+        type="button"
+        onClick={() => onImageUpload?.(new File(['image'], 'image.png', { type: 'image/png' }))}
+      >
+        Upload image
+      </button>
+    </div>
+  ),
+  isRichTextContent: (value: unknown) =>
+    typeof value === 'object' &&
+    value !== null &&
+    'type' in value &&
+    (value as { type?: unknown }).type === 'doc',
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    disabled,
+    onClick,
+    type = 'button',
+  }: {
+    children: ReactNode
+    disabled?: boolean
+    onClick?: () => void
+    type?: 'button' | 'submit' | 'reset'
+    size?: string
+    variant?: string
+    className?: string
+  }) => (
+    <button type={type} disabled={disabled} onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('lucide-react', () => ({
+  Pencil: () => <span aria-hidden="true">pencil</span>,
+}))
+
+vi.mock('@/components/tickets/ticket-attachments', () => ({
+  TicketAttachments: ({
+    attachments,
+    isLoading,
+  }: {
+    attachments: Array<{ id: string; filename: string }>
+    isLoading: boolean
+  }) => (
+    <div>
+      {isLoading
+        ? 'Loading attachments'
+        : `Attachments:${attachments.map((a) => a.filename).join(',')}`}
+    </div>
+  ),
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    attachments: (ticketId: string, threadId: string) => ({
+      queryKey: ['ticket-attachments', ticketId, threadId],
+    }),
+  },
+}))
+
+vi.mock('@/lib/client/hooks/use-image-upload', () => ({
+  usePortalImageUpload: () => ({
+    upload: mocks.uploadImage,
+  }),
+}))
+
+function thread(overrides: Partial<PortalThread>): PortalThread {
+  return {
+    id: 'thread_1' as never,
+    ticketId: 'ticket_1' as never,
+    principalId: 'principal_viewer' as never,
+    bodyJson: null,
+    bodyText: 'Plain reply',
+    createdAt: new Date('2026-06-18T12:00:00.000Z'),
+    editedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.attachmentsByThread = {}
+  mocks.uploadImage.mockResolvedValue({ url: 'https://example.com/image.png' })
+})
+
+describe('PortalTicketThreadFeed', () => {
+  it('renders a no-replies empty state when there is no description or edit callback', () => {
+    render(<PortalTicketThreadFeed threads={[]} principalNames={{}} viewerPrincipalId={null} />)
+
+    expect(screen.getByText('No replies yet.')).toBeInTheDocument()
+  })
+
+  it('adds and edits the ticket description using rich-text drafts', () => {
+    const onDescriptionUpdate = vi.fn()
+    const { rerender } = render(
+      <PortalTicketThreadFeed
+        threads={[]}
+        principalNames={{}}
+        viewerPrincipalId={'principal_viewer' as never}
+        description={null}
+        onDescriptionUpdate={onDescriptionUpdate}
+      />
+    )
+
+    fireEvent.click(screen.getByText('+ Add a description…'))
+    expect(screen.getByText('Add a description…')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'Change draft' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Upload image' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(onDescriptionUpdate).toHaveBeenCalledWith({ type: 'doc' }, 'Updated markdown')
+    expect(mocks.uploadImage).toHaveBeenCalledTimes(1)
+
+    onDescriptionUpdate.mockClear()
+    rerender(
+      <PortalTicketThreadFeed
+        threads={[]}
+        principalNames={{}}
+        viewerPrincipalId={'principal_viewer' as never}
+        description={{ text: 'Existing plain description', json: null }}
+        onDescriptionUpdate={onDescriptionUpdate}
+      />
+    )
+
+    expect(screen.getByText('Existing plain description')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: /Edit/ }))
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+    expect(screen.getByText('Existing plain description')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: /Edit/ }))
+    fireEvent.click(screen.getByRole('button', { name: 'Change draft' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }))
+    expect(onDescriptionUpdate).toHaveBeenCalledWith({ type: 'doc' }, 'Updated markdown')
+  })
+
+  it('renders rich descriptions and disables save actions while a description is saving', () => {
+    render(
+      <PortalTicketThreadFeed
+        threads={[]}
+        principalNames={{}}
+        viewerPrincipalId={'principal_viewer' as never}
+        description={{ text: null, json: { type: 'doc' } }}
+        onDescriptionUpdate={vi.fn()}
+        isDescriptionSaving
+      />
+    )
+
+    expect(screen.getByText('rich:doc')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: /Edit/ }))
+
+    expect(screen.getByRole('button', { name: 'Cancel' })).toBeDisabled()
+    expect(screen.getByRole('button', { name: 'Saving…' })).toBeDisabled()
+  })
+
+  it('labels viewer and support replies, shows edited state and loads attachments', () => {
+    mocks.attachmentsByThread = {
+      thread_viewer: {
+        data: [{ id: 'attachment_1', filename: 'screen.png' }],
+      },
+      thread_support: {
+        data: [],
+      },
+      thread_loading: {
+        isLoading: true,
+      },
+      thread_error: {
+        isError: true,
+      },
+    }
+
+    render(
+      <PortalTicketThreadFeed
+        threads={[
+          thread({
+            id: 'thread_viewer' as never,
+            principalId: 'principal_viewer' as never,
+            bodyJson: { type: 'doc' },
+            bodyText: 'Viewer reply',
+          }),
+          thread({
+            id: 'thread_support' as never,
+            principalId: 'principal_staff' as never,
+            bodyText: 'Staff reply',
+            editedAt: new Date('2026-06-18T12:30:00.000Z'),
+          }),
+          thread({
+            id: 'thread_loading' as never,
+            principalId: null,
+            bodyText: 'Masked support reply',
+          }),
+          thread({
+            id: 'thread_error' as never,
+            principalId: null,
+            bodyText: 'No attachment render',
+          }),
+        ]}
+        principalNames={{ principal_viewer: 'Viewer Name', principal_staff: 'Staff Name' }}
+        viewerPrincipalId={'principal_viewer' as never}
+      />
+    )
+
+    expect(screen.getByLabelText('Reply from You')).toBeInTheDocument()
+    expect(screen.getAllByLabelText('Reply from Support team')).toHaveLength(3)
+    expect(screen.getByText('rich:doc')).toBeInTheDocument()
+    expect(screen.getByText('Staff reply')).toBeInTheDocument()
+    expect(screen.getByText('(edited)')).toBeInTheDocument()
+    expect(screen.getAllByText(/distance:2026-06-18T12:00:00.000Z/)).toHaveLength(4)
+    expect(screen.getByText('Attachments:screen.png')).toBeInTheDocument()
+    expect(screen.getByText('Loading attachments')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/public/tickets/portal-ticket-detail-header.tsx b/apps/web/src/components/public/tickets/portal-ticket-detail-header.tsx
new file mode 100644
index 000000000..51785229f
--- /dev/null
+++ b/apps/web/src/components/public/tickets/portal-ticket-detail-header.tsx
@@ -0,0 +1,41 @@
+import { format, formatDistanceToNow } from 'date-fns'
+import { useIntl } from 'react-intl'
+import { TicketStatusPill } from '@/components/admin/tickets/ticket-status-pill'
+import type { PortalStatusCategory } from '@/lib/client/queries/portal-tickets'
+
+export interface PortalTicketDetailHeaderProps {
+  subject: string
+  statusName: string
+  statusCategory: PortalStatusCategory
+  createdAt: Date
+  lastActivityAt: Date
+}
+
+export function PortalTicketDetailHeader({
+  subject,
+  statusName,
+  statusCategory,
+  createdAt,
+  lastActivityAt,
+}: PortalTicketDetailHeaderProps) {
+  const intl = useIntl()
+  return (
+    <header className="space-y-2">
+      <div className="flex flex-wrap items-start justify-between gap-3">
+        <h1 className="text-2xl font-semibold tracking-tight text-foreground">{subject}</h1>
+        <TicketStatusPill name={statusName} category={statusCategory} />
+      </div>
+      <p className="text-xs text-muted-foreground">
+        {intl.formatMessage(
+          { id: 'portal.tickets.detail.openedAt', defaultMessage: 'Opened {date}' },
+          { date: format(createdAt, 'PP') }
+        )}
+        {' · '}
+        {intl.formatMessage(
+          { id: 'portal.tickets.detail.lastUpdate', defaultMessage: 'Last update {when}' },
+          { when: formatDistanceToNow(lastActivityAt, { addSuffix: true }) }
+        )}
+      </p>
+    </header>
+  )
+}
diff --git a/apps/web/src/components/public/tickets/portal-ticket-reply-composer.tsx b/apps/web/src/components/public/tickets/portal-ticket-reply-composer.tsx
new file mode 100644
index 000000000..13a44f6e4
--- /dev/null
+++ b/apps/web/src/components/public/tickets/portal-ticket-reply-composer.tsx
@@ -0,0 +1,196 @@
+import { useState, useMemo, useRef } from 'react'
+import type { JSONContent } from '@tiptap/react'
+import { FormattedMessage, useIntl } from 'react-intl'
+import { Button } from '@/components/ui/button'
+import { RichTextEditor } from '@/components/ui/rich-text-editor'
+import { useReplyToMyTicket } from '@/lib/client/queries/portal-tickets'
+import type { TicketId, TicketThreadId } from '@quackback/ids'
+import { X, Upload } from 'lucide-react'
+import { useQueryClient } from '@tanstack/react-query'
+import { portalTicketQueries } from '@/lib/client/queries/portal-tickets'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { usePortalImageUpload } from '@/lib/client/hooks/use-image-upload'
+
+export interface PortalTicketReplyComposerProps {
+  ticketId: TicketId
+  /** When true, the composer is rendered in a disabled "ticket closed" state. */
+  isClosed: boolean
+}
+
+function plainTextFromJson(json: JSONContent | null): string {
+  if (!json) return ''
+  let out = ''
+  const walk = (node: JSONContent) => {
+    if (node.type === 'text' && typeof node.text === 'string') out += node.text
+    if (node.content) node.content.forEach(walk)
+    if (node.type === 'paragraph' || node.type === 'heading') out += '\n'
+  }
+  walk(json)
+  return out.trim()
+}
+
+export function PortalTicketReplyComposer({ ticketId, isClosed }: PortalTicketReplyComposerProps) {
+  const intl = useIntl()
+  const qc = useQueryClient()
+  const { upload: uploadImage } = usePortalImageUpload()
+  const fileInputRef = useRef<HTMLInputElement>(null)
+  const [body, setBody] = useState<JSONContent | null>(null)
+  const [selectedFiles, setSelectedFiles] = useState<File[]>([])
+  const reply = useReplyToMyTicket(ticketId)
+
+  const placeholder = intl.formatMessage({
+    id: 'portal.tickets.composer.placeholder',
+    defaultMessage: 'Type your reply…',
+  })
+
+  const text = useMemo(() => plainTextFromJson(body), [body])
+  const isEmpty = text.length === 0
+
+  const handleReply = async () => {
+    try {
+      // Post the reply
+      await reply.mutateAsync({ bodyJson: body, bodyText: text })
+
+      // Upload files if any and we have a thread
+      // For portal, we need to get the new threadId from the API
+      // Since the mutation doesn't return it, we'll fetch the latest thread
+      if (selectedFiles.length > 0) {
+        // Refetch threads to get the newly created one
+        await qc.invalidateQueries({ queryKey: portalTicketQueries.detail(ticketId).queryKey })
+        const updatedData = await qc.ensureQueryData(portalTicketQueries.detail(ticketId))
+        const newThread = updatedData.threads?.[updatedData.threads.length - 1]
+
+        if (newThread?.id) {
+          const threadId = newThread.id as TicketThreadId
+          for (const file of selectedFiles) {
+            try {
+              const formData = new FormData()
+              formData.append('file', file)
+              const res = await fetch(
+                `/api/v1/tickets/${ticketId}/threads/${threadId}/attachments`,
+                {
+                  method: 'POST',
+                  body: formData,
+                }
+              )
+              if (!res.ok) {
+                await res.text()
+              } else {
+                // Invalidate attachments query
+                qc.invalidateQueries({
+                  queryKey: ticketQueries.attachments(ticketId, threadId).queryKey,
+                })
+              }
+            } catch {
+              // Best-effort upload: reply is already created.
+            }
+          }
+        }
+      }
+
+      setBody(null)
+      setSelectedFiles([])
+    } catch {
+      // Error handling is done by the mutation
+    }
+  }
+
+  if (isClosed) {
+    return (
+      <div className="rounded-md border border-dashed border-border/60 bg-muted/30 p-4 text-sm text-muted-foreground">
+        <FormattedMessage
+          id="portal.tickets.composer.closed"
+          defaultMessage="This ticket is closed. Open a new one to follow up."
+        />
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-2 rounded-md border border-border/60 bg-background p-3">
+      <RichTextEditor
+        value={body ?? undefined}
+        onChange={(json) => setBody(json)}
+        placeholder={placeholder}
+        minHeight="100px"
+        features={{
+          headings: false,
+          codeBlocks: true,
+          blockquotes: true,
+          dividers: false,
+          images: true,
+          taskLists: false,
+          tables: false,
+          embeds: false,
+          slashMenu: false,
+        }}
+        onImageUpload={uploadImage}
+      />
+
+      {/* File picker and list */}
+      <input
+        ref={fileInputRef}
+        type="file"
+        multiple
+        className="hidden"
+        onChange={(e) => {
+          if (e.target.files) {
+            setSelectedFiles(Array.from(e.target.files))
+          }
+        }}
+      />
+
+      {selectedFiles.length > 0 && (
+        <div className="space-y-2">
+          <div className="text-xs font-medium text-muted-foreground">
+            Attachments ({selectedFiles.length})
+          </div>
+          <div className="space-y-1">
+            {selectedFiles.map((file) => (
+              <div
+                key={file.name}
+                className="flex items-center justify-between rounded bg-muted/50 px-2 py-1 text-xs"
+              >
+                <span className="truncate">{file.name}</span>
+                <button
+                  type="button"
+                  onClick={() =>
+                    setSelectedFiles((prev) => prev.filter((f) => f.name !== file.name))
+                  }
+                  className="ml-2 hover:text-red-500"
+                >
+                  <X className="h-3 w-3" />
+                </button>
+              </div>
+            ))}
+          </div>
+        </div>
+      )}
+
+      <div className="flex items-center justify-between gap-2">
+        <Button
+          size="sm"
+          variant="outline"
+          type="button"
+          onClick={() => fileInputRef.current?.click()}
+        >
+          <Upload className="h-4 w-4 mr-1" />
+          Attach files
+        </Button>
+        <Button
+          type="button"
+          size="sm"
+          disabled={isEmpty || reply.isPending}
+          onClick={handleReply}
+          aria-busy={reply.isPending}
+        >
+          {reply.isPending ? (
+            <FormattedMessage id="portal.tickets.composer.sending" defaultMessage="Sending…" />
+          ) : (
+            <FormattedMessage id="portal.tickets.composer.send" defaultMessage="Send reply" />
+          )}
+        </Button>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/public/tickets/portal-ticket-row.tsx b/apps/web/src/components/public/tickets/portal-ticket-row.tsx
new file mode 100644
index 000000000..cb5b477fd
--- /dev/null
+++ b/apps/web/src/components/public/tickets/portal-ticket-row.tsx
@@ -0,0 +1,38 @@
+import { Link } from '@tanstack/react-router'
+import { formatDistanceToNow } from 'date-fns'
+import { useIntl } from 'react-intl'
+import { TicketStatusPill } from '@/components/admin/tickets/ticket-status-pill'
+import type { PortalTicketRow } from '@/lib/client/queries/portal-tickets'
+
+export interface PortalTicketRowProps {
+  ticket: PortalTicketRow
+}
+
+export function PortalTicketRowItem({ ticket }: PortalTicketRowProps) {
+  const intl = useIntl()
+  const updated = formatDistanceToNow(ticket.lastActivityAt, { addSuffix: true })
+  return (
+    <Link
+      to="/tickets/$ticketId"
+      params={{ ticketId: ticket.id }}
+      className="block rounded-md border border-border/50 bg-background px-4 py-3 transition hover:border-border hover:bg-muted/30"
+    >
+      <div className="flex items-start justify-between gap-3">
+        <div className="min-w-0 flex-1">
+          <h3 className="truncate text-sm font-medium text-foreground">{ticket.subject}</h3>
+          <p className="mt-1 text-xs text-muted-foreground">
+            {intl.formatMessage(
+              { id: 'portal.tickets.row.updated', defaultMessage: 'Updated {when}' },
+              { when: updated }
+            )}
+          </p>
+        </div>
+        <TicketStatusPill
+          name={ticket.statusName}
+          category={ticket.statusCategory}
+          className="shrink-0"
+        />
+      </div>
+    </Link>
+  )
+}
diff --git a/apps/web/src/components/public/tickets/portal-ticket-status-filter.tsx b/apps/web/src/components/public/tickets/portal-ticket-status-filter.tsx
new file mode 100644
index 000000000..922c07223
--- /dev/null
+++ b/apps/web/src/components/public/tickets/portal-ticket-status-filter.tsx
@@ -0,0 +1,44 @@
+import { useNavigate } from '@tanstack/react-router'
+import { FormattedMessage } from 'react-intl'
+import { cn } from '@/lib/shared/utils'
+
+export type StatusFilterValue = 'open' | 'pending' | 'solved' | 'closed' | 'all'
+
+const FILTERS: ReadonlyArray<{ value: StatusFilterValue; messageId: string; label: string }> = [
+  { value: 'open', messageId: 'portal.tickets.filter.open', label: 'Open' },
+  { value: 'pending', messageId: 'portal.tickets.filter.pending', label: 'Pending' },
+  { value: 'solved', messageId: 'portal.tickets.filter.solved', label: 'Solved' },
+  { value: 'closed', messageId: 'portal.tickets.filter.closed', label: 'Closed' },
+  { value: 'all', messageId: 'portal.tickets.filter.all', label: 'All' },
+]
+
+export interface PortalTicketStatusFilterProps {
+  value: StatusFilterValue
+}
+
+export function PortalTicketStatusFilter({ value }: PortalTicketStatusFilterProps) {
+  const navigate = useNavigate({ from: '/tickets/' })
+  return (
+    <div role="group" aria-label="Filter tickets by status" className="flex flex-wrap gap-2">
+      {FILTERS.map((f) => {
+        const active = f.value === value
+        return (
+          <button
+            key={f.value}
+            type="button"
+            aria-pressed={active}
+            onClick={() => navigate({ search: { status: f.value } })}
+            className={cn(
+              'inline-flex items-center rounded-full border px-3 py-1 text-xs font-medium transition',
+              active
+                ? 'border-foreground bg-foreground text-background'
+                : 'border-border bg-background text-muted-foreground hover:border-foreground/40 hover:text-foreground'
+            )}
+          >
+            <FormattedMessage id={f.messageId} defaultMessage={f.label} />
+          </button>
+        )
+      })}
+    </div>
+  )
+}
diff --git a/apps/web/src/components/public/tickets/portal-ticket-thread-feed.tsx b/apps/web/src/components/public/tickets/portal-ticket-thread-feed.tsx
new file mode 100644
index 000000000..58561669f
--- /dev/null
+++ b/apps/web/src/components/public/tickets/portal-ticket-thread-feed.tsx
@@ -0,0 +1,248 @@
+import { useState, useCallback } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import { formatDistanceToNow } from 'date-fns'
+import { FormattedMessage, useIntl } from 'react-intl'
+import type { JSONContent } from '@tiptap/react'
+import type { TicketId, TicketThreadId, PrincipalId } from '@quackback/ids'
+import {
+  RichTextContent,
+  RichTextEditor,
+  isRichTextContent,
+} from '@/components/ui/rich-text-editor'
+import { Button } from '@/components/ui/button'
+import { Pencil } from 'lucide-react'
+import { TicketAttachments } from '@/components/tickets/ticket-attachments'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { usePortalImageUpload } from '@/lib/client/hooks/use-image-upload'
+
+export interface PortalThread {
+  id: TicketThreadId
+  ticketId: TicketId
+  principalId: PrincipalId | null
+  bodyJson: unknown
+  bodyText: string
+  createdAt: Date
+  editedAt: Date | null
+}
+
+export interface PortalTicketThreadFeedProps {
+  threads: PortalThread[]
+  /** Map of principalId → display name (the viewer's own name; staff names are masked). */
+  principalNames: Record<string, string>
+  /** The viewer's own principalId — their messages are labelled "You". */
+  viewerPrincipalId: PrincipalId | null
+  /** Optional initial-description block, rendered above threads. */
+  description?: { text: string | null; json: unknown } | null
+  /** Callback to save an edited description. When provided, the description is editable. */
+  onDescriptionUpdate?: (json: JSONContent | null, text: string | null) => void
+  /** Whether a description update is currently saving. */
+  isDescriptionSaving?: boolean
+}
+
+function authorLabel(
+  principalId: string | null,
+  principalNames: Record<string, string>,
+  viewerPrincipalId: string | null,
+  intl: ReturnType<typeof useIntl>
+): string {
+  if (!principalId) {
+    return intl.formatMessage({
+      id: 'portal.tickets.detail.supportTeam',
+      defaultMessage: 'Support team',
+    })
+  }
+  if (principalId === viewerPrincipalId) {
+    return intl.formatMessage({ id: 'portal.tickets.detail.you', defaultMessage: 'You' })
+  }
+  // Any other principal is staff — collapse to the unified "Support team" label.
+  // (The principalNames map is kept so future variants can use it without
+  // a new round-trip.)
+  void principalNames
+  return intl.formatMessage({
+    id: 'portal.tickets.detail.supportTeam',
+    defaultMessage: 'Support team',
+  })
+}
+
+export function PortalTicketThreadFeed({
+  threads,
+  principalNames,
+  viewerPrincipalId,
+  description,
+  onDescriptionUpdate,
+  isDescriptionSaving,
+}: PortalTicketThreadFeedProps) {
+  const intl = useIntl()
+  const { upload: uploadImage } = usePortalImageUpload()
+  const hasDesc = description && (description.text || isRichTextContent(description.json))
+  const [editingDescription, setEditingDescription] = useState(false)
+  const [descDraft, setDescDraft] = useState<JSONContent | null>(null)
+  const [descDraftText, setDescDraftText] = useState('')
+
+  const startEditing = useCallback(() => {
+    setDescDraft(isRichTextContent(description?.json) ? (description!.json as JSONContent) : null)
+    setDescDraftText(description?.text ?? '')
+    setEditingDescription(true)
+  }, [description])
+
+  const cancelEditing = useCallback(() => {
+    setEditingDescription(false)
+    setDescDraft(null)
+    setDescDraftText('')
+  }, [])
+
+  const saveDescription = useCallback(() => {
+    onDescriptionUpdate?.(descDraft, descDraftText || null)
+    setEditingDescription(false)
+  }, [onDescriptionUpdate, descDraft, descDraftText])
+
+  if (!hasDesc && threads.length === 0 && !onDescriptionUpdate) {
+    return (
+      <div className="py-6 text-center text-sm text-muted-foreground">
+        <FormattedMessage id="portal.tickets.detail.noReplies" defaultMessage="No replies yet." />
+      </div>
+    )
+  }
+  return (
+    <div className="space-y-3">
+      {editingDescription ? (
+        <article className="rounded-md border border-border/50 bg-muted/20 p-3">
+          <header className="mb-2 text-xs text-muted-foreground">
+            <FormattedMessage id="portal.tickets.detail.description" defaultMessage="Description" />
+          </header>
+          <div className="rounded border">
+            <RichTextEditor
+              value={descDraft ?? undefined}
+              onChange={(json, _html, markdown) => {
+                setDescDraft(json)
+                setDescDraftText(markdown)
+              }}
+              placeholder={intl.formatMessage({
+                id: 'portal.tickets.detail.descriptionPlaceholder',
+                defaultMessage: 'Add a description…',
+              })}
+              minHeight="80px"
+              features={{
+                headings: false,
+                codeBlocks: true,
+                blockquotes: true,
+                dividers: false,
+                images: true,
+                taskLists: false,
+                tables: false,
+                embeds: false,
+                slashMenu: false,
+              }}
+              onImageUpload={uploadImage}
+            />
+          </div>
+          <div className="flex items-center gap-1 mt-2 justify-end">
+            <Button
+              size="sm"
+              variant="ghost"
+              onClick={cancelEditing}
+              disabled={isDescriptionSaving}
+            >
+              <FormattedMessage id="portal.tickets.detail.cancel" defaultMessage="Cancel" />
+            </Button>
+            <Button size="sm" onClick={saveDescription} disabled={isDescriptionSaving}>
+              {isDescriptionSaving ? (
+                <FormattedMessage id="portal.tickets.detail.saving" defaultMessage="Saving…" />
+              ) : (
+                <FormattedMessage id="portal.tickets.detail.save" defaultMessage="Save" />
+              )}
+            </Button>
+          </div>
+        </article>
+      ) : hasDesc ? (
+        <article className="group relative rounded-md border border-border/50 bg-muted/20 p-3">
+          <header className="flex items-center justify-between mb-2 text-xs text-muted-foreground">
+            <FormattedMessage id="portal.tickets.detail.description" defaultMessage="Description" />
+            {onDescriptionUpdate && (
+              <Button
+                size="sm"
+                variant="ghost"
+                className="h-6 px-2 text-xs opacity-0 group-hover:opacity-100 transition-opacity"
+                onClick={startEditing}
+              >
+                <Pencil className="size-3 mr-1" />
+                <FormattedMessage id="portal.tickets.detail.edit" defaultMessage="Edit" />
+              </Button>
+            )}
+          </header>
+          {isRichTextContent(description!.json) ? (
+            <RichTextContent content={description!.json} className="prose-sm" />
+          ) : (
+            <div className="whitespace-pre-wrap text-sm">{description!.text}</div>
+          )}
+        </article>
+      ) : onDescriptionUpdate ? (
+        <button
+          onClick={startEditing}
+          className="w-full rounded-md border border-dashed border-border/50 bg-muted/10 p-3 text-sm text-muted-foreground hover:bg-muted/30 transition-colors text-left"
+        >
+          <FormattedMessage
+            id="portal.tickets.detail.addDescription"
+            defaultMessage="+ Add a description…"
+          />
+        </button>
+      ) : null}
+      {threads.map((th) => {
+        const author = authorLabel(th.principalId, principalNames, viewerPrincipalId, intl)
+        const isViewer = th.principalId === viewerPrincipalId
+        return (
+          <article
+            key={th.id}
+            className="rounded-md border border-border/50 bg-background p-3"
+            aria-label={`Reply from ${author}`}
+          >
+            <header className="mb-2 flex items-center gap-2 text-xs">
+              <span className={isViewer ? 'font-medium text-foreground' : 'font-medium'}>
+                {author}
+              </span>
+              <span className="text-muted-foreground">
+                · {formatDistanceToNow(th.createdAt, { addSuffix: true })}
+                {th.editedAt && (
+                  <span className="ml-1 italic">
+                    (
+                    <FormattedMessage id="portal.tickets.detail.edited" defaultMessage="edited" />)
+                  </span>
+                )}
+              </span>
+            </header>
+            {isRichTextContent(th.bodyJson) ? (
+              <RichTextContent content={th.bodyJson} className="prose-sm" />
+            ) : (
+              <div className="whitespace-pre-wrap text-sm">{th.bodyText}</div>
+            )}
+            <PortalThreadAttachmentsLoader ticketId={th.ticketId} threadId={th.id} />
+          </article>
+        )
+      })}
+    </div>
+  )
+}
+
+function PortalThreadAttachmentsLoader({
+  ticketId,
+  threadId,
+}: {
+  ticketId: TicketId
+  threadId: TicketThreadId
+}) {
+  const {
+    data: attachments,
+    isLoading,
+    isError,
+  } = useQuery(ticketQueries.attachments(ticketId, threadId))
+
+  if (isError || (!isLoading && (!attachments || attachments.length === 0))) {
+    return null
+  }
+
+  return (
+    <div className="mt-3 pt-3 border-t border-border/50">
+      <TicketAttachments attachments={attachments ?? []} isLoading={isLoading} />
+    </div>
+  )
+}
diff --git a/apps/web/src/components/tickets/__tests__/ticket-attachments.test.tsx b/apps/web/src/components/tickets/__tests__/ticket-attachments.test.tsx
new file mode 100644
index 000000000..3d9011ae2
--- /dev/null
+++ b/apps/web/src/components/tickets/__tests__/ticket-attachments.test.tsx
@@ -0,0 +1,144 @@
+// @vitest-environment happy-dom
+import { IntlProvider } from 'react-intl'
+import { describe, expect, it } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { TicketAttachments } from '../ticket-attachments'
+
+type Attachment = Parameters<typeof TicketAttachments>[0]['attachments'][number]
+
+function attachment(overrides: Partial<Attachment>): Attachment {
+  return {
+    id: 'att_1',
+    filename: 'report.txt',
+    mimeType: 'text/plain',
+    sizeBytes: 0,
+    publicUrl: 'https://cdn.example.com/report.txt',
+    createdAt: '2026-06-20T10:00:00.000Z',
+    ...overrides,
+  }
+}
+
+function renderAttachments(attachments: Attachment[], isLoading = false) {
+  return render(
+    <IntlProvider locale="en" defaultLocale="en" messages={{}}>
+      <TicketAttachments attachments={attachments} isLoading={isLoading} />
+    </IntlProvider>
+  )
+}
+
+describe('TicketAttachments', () => {
+  it('renders loading and empty states without attachment cards', () => {
+    const { rerender, container } = render(
+      <IntlProvider locale="en" defaultLocale="en" messages={{}}>
+        <TicketAttachments attachments={[]} isLoading />
+      </IntlProvider>
+    )
+
+    expect(screen.getByText('Loading attachments...')).toBeInTheDocument()
+
+    rerender(
+      <IntlProvider locale="en" defaultLocale="en" messages={{}}>
+        <TicketAttachments attachments={[]} />
+      </IntlProvider>
+    )
+    expect(container).toBeEmptyDOMElement()
+  })
+
+  it('renders file metadata, download links and preview controls only for previewable files', () => {
+    renderAttachments([
+      attachment({
+        id: 'image',
+        filename: 'screenshot.png',
+        mimeType: 'image/png',
+        sizeBytes: 2048,
+        publicUrl: 'https://cdn.example.com/screenshot.png',
+      }),
+      attachment({
+        id: 'pdf',
+        filename: 'invoice.pdf',
+        mimeType: 'application/pdf',
+        sizeBytes: 1048576,
+        publicUrl: 'https://cdn.example.com/invoice.pdf',
+      }),
+      attachment({
+        id: 'audio',
+        filename: 'call.mp3',
+        mimeType: 'audio/mpeg',
+        sizeBytes: 0,
+        publicUrl: 'https://cdn.example.com/call.mp3',
+      }),
+      attachment({
+        id: 'zip',
+        filename: 'archive.zip',
+        mimeType: 'application/zip',
+        sizeBytes: 512,
+        publicUrl: null,
+      }),
+    ])
+
+    expect(screen.getByText('Attachments (4)')).toBeInTheDocument()
+    expect(screen.getByText('screenshot.png')).toBeInTheDocument()
+    expect(screen.getByText('2 KB')).toBeInTheDocument()
+    expect(screen.getByText('invoice.pdf')).toBeInTheDocument()
+    expect(screen.getByText('1 MB')).toBeInTheDocument()
+    expect(screen.getByText('call.mp3')).toBeInTheDocument()
+    expect(screen.getByText('0 B')).toBeInTheDocument()
+    expect(screen.getByText('archive.zip')).toBeInTheDocument()
+    expect(screen.getAllByRole('button', { name: /Preview/ })).toHaveLength(2)
+    const downloadLinks = screen.getAllByRole('link', { name: /Download/ })
+    expect(downloadLinks).toHaveLength(3)
+    expect(downloadLinks[0]).toHaveAttribute('download', 'screenshot.png')
+  })
+
+  it('toggles image, video, pdf and fallback previews', () => {
+    const { container } = renderAttachments([
+      attachment({
+        id: 'image',
+        filename: 'screenshot.png',
+        mimeType: 'image/png',
+        publicUrl: 'https://cdn.example.com/screenshot.png',
+      }),
+      attachment({
+        id: 'video',
+        filename: 'demo.mp4',
+        mimeType: 'video/mp4',
+        publicUrl: 'https://cdn.example.com/demo.mp4',
+      }),
+      attachment({
+        id: 'pdf',
+        filename: 'invoice.pdf',
+        mimeType: 'application/pdf',
+        publicUrl: 'about:blank',
+      }),
+      attachment({
+        id: 'csv',
+        filename: 'export.csv',
+        mimeType: 'text/csv',
+        publicUrl: 'https://cdn.example.com/export.csv',
+      }),
+    ])
+
+    const previewButtons = screen.getAllByRole('button', { name: /Preview/ })
+
+    fireEvent.click(previewButtons[0])
+    expect(screen.getByAltText('screenshot.png')).toHaveAttribute(
+      'src',
+      'https://cdn.example.com/screenshot.png'
+    )
+
+    fireEvent.click(previewButtons[0])
+    expect(screen.queryByAltText('screenshot.png')).not.toBeInTheDocument()
+
+    fireEvent.click(previewButtons[1])
+    expect(container.querySelector('video[src="https://cdn.example.com/demo.mp4"]')).not.toBeNull()
+
+    fireEvent.click(previewButtons[2])
+    expect(container.querySelector('iframe[title="invoice.pdf"]')).toHaveAttribute(
+      'src',
+      'about:blank#toolbar=0'
+    )
+
+    fireEvent.click(previewButtons[3])
+    expect(screen.getByText('Preview not available')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/components/tickets/ticket-attachments.tsx b/apps/web/src/components/tickets/ticket-attachments.tsx
new file mode 100644
index 000000000..28490853c
--- /dev/null
+++ b/apps/web/src/components/tickets/ticket-attachments.tsx
@@ -0,0 +1,160 @@
+import { useState } from 'react'
+import { FormattedMessage } from 'react-intl'
+import { Download, Eye, Loader2 } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+
+interface Attachment {
+  id: string
+  filename: string
+  mimeType: string
+  sizeBytes: number
+  publicUrl: string | null
+  createdAt: string
+}
+
+interface TicketAttachmentsProps {
+  attachments: Attachment[]
+  isLoading?: boolean
+}
+
+function formatFileSize(bytes: number): string {
+  if (bytes === 0) return '0 B'
+  const k = 1024
+  const sizes = ['B', 'KB', 'MB', 'GB']
+  const i = Math.floor(Math.log(bytes) / Math.log(k))
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i]
+}
+
+function getFileIcon(mimeType: string) {
+  if (mimeType.startsWith('image/')) return '🖼️'
+  if (mimeType.startsWith('video/')) return '🎬'
+  if (mimeType.startsWith('audio/')) return '🎵'
+  if (mimeType === 'application/pdf') return '📄'
+  if (
+    mimeType.includes('word') ||
+    mimeType.includes('document') ||
+    mimeType === 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
+  ) {
+    return '📝'
+  }
+  if (
+    mimeType.includes('spreadsheet') ||
+    mimeType === 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+  ) {
+    return '📊'
+  }
+  if (mimeType.includes('zip') || mimeType.includes('compressed')) return '📦'
+  return '📎'
+}
+
+function canPreview(mimeType: string): boolean {
+  return (
+    mimeType.startsWith('image/') ||
+    mimeType.startsWith('video/') ||
+    mimeType === 'application/pdf' ||
+    mimeType === 'text/plain' ||
+    mimeType === 'text/csv'
+  )
+}
+
+export function TicketAttachments({ attachments, isLoading }: TicketAttachmentsProps) {
+  const [previewId, setPreviewId] = useState<string | null>(null)
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center gap-2 text-sm text-muted-foreground">
+        <Loader2 className="h-4 w-4 animate-spin" />
+        <FormattedMessage
+          id="tickets.attachments.loading"
+          defaultMessage="Loading attachments..."
+        />
+      </div>
+    )
+  }
+
+  if (!attachments || attachments.length === 0) {
+    return null
+  }
+
+  return (
+    <div className="space-y-3">
+      <h4 className="text-sm font-medium">
+        <FormattedMessage
+          id="tickets.attachments.title"
+          defaultMessage="Attachments ({count})"
+          values={{ count: attachments.length }}
+        />
+      </h4>
+
+      <div className="grid gap-2 sm:grid-cols-2 lg:grid-cols-3">
+        {attachments.map((attachment) => (
+          <div
+            key={attachment.id}
+            className="flex flex-col gap-2 rounded-lg border border-border/50 bg-muted/30 p-3 hover:bg-muted/50 transition-colors"
+          >
+            <div className="flex items-start gap-2">
+              <span className="text-2xl flex-shrink-0">{getFileIcon(attachment.mimeType)}</span>
+              <div className="flex-1 min-w-0">
+                <p className="text-sm font-medium truncate" title={attachment.filename}>
+                  {attachment.filename}
+                </p>
+                <p className="text-xs text-muted-foreground">
+                  {formatFileSize(attachment.sizeBytes)}
+                </p>
+              </div>
+            </div>
+
+            <div className="flex items-center gap-1">
+              {attachment.publicUrl && canPreview(attachment.mimeType) && (
+                <Button
+                  size="sm"
+                  variant="ghost"
+                  className="h-7 px-2 text-xs"
+                  onClick={() => setPreviewId(previewId === attachment.id ? null : attachment.id)}
+                >
+                  <Eye className="h-3 w-3 mr-1" />
+                  <FormattedMessage id="tickets.attachments.preview" defaultMessage="Preview" />
+                </Button>
+              )}
+              {attachment.publicUrl && (
+                <Button size="sm" variant="ghost" className="h-7 px-2 text-xs" asChild>
+                  <a href={attachment.publicUrl} download={attachment.filename}>
+                    <Download className="h-3 w-3 mr-1" />
+                    <FormattedMessage id="tickets.attachments.download" defaultMessage="Download" />
+                  </a>
+                </Button>
+              )}
+            </div>
+
+            {previewId === attachment.id && attachment.publicUrl && (
+              <div className="mt-2 rounded border border-border/50 bg-background p-2 overflow-hidden">
+                {attachment.mimeType.startsWith('image/') ? (
+                  <img
+                    src={attachment.publicUrl}
+                    alt={attachment.filename}
+                    className="max-h-48 w-full object-contain rounded"
+                  />
+                ) : attachment.mimeType.startsWith('video/') ? (
+                  <video src={attachment.publicUrl} controls className="max-h-48 w-full rounded" />
+                ) : attachment.mimeType === 'application/pdf' ? (
+                  <iframe
+                    src={`${attachment.publicUrl}#toolbar=0`}
+                    className="h-48 w-full rounded"
+                    title={attachment.filename}
+                  />
+                ) : (
+                  <div className="text-xs text-muted-foreground p-2 bg-muted/50 rounded text-center">
+                    <FormattedMessage
+                      id="tickets.attachments.preview.unavailable"
+                      defaultMessage="Preview not available"
+                    />
+                  </div>
+                )}
+              </div>
+            )}
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/components/tickets/ticket-create-editor-features.ts b/apps/web/src/components/tickets/ticket-create-editor-features.ts
new file mode 100644
index 000000000..f5013983b
--- /dev/null
+++ b/apps/web/src/components/tickets/ticket-create-editor-features.ts
@@ -0,0 +1,20 @@
+import type { EditorFeatures } from '@/components/ui/rich-text-editor'
+
+/**
+ * Shared editor capabilities for ticket creation across portal/admin/widget.
+ * Keeps the same core authoring experience everywhere while allowing image uploads.
+ */
+export const TICKET_CREATE_EDITOR_FEATURES: EditorFeatures = {
+  headings: true,
+  images: true,
+  codeBlocks: true,
+  bubbleMenu: true,
+  slashMenu: true,
+  taskLists: true,
+  blockquotes: true,
+  tables: false,
+  dividers: true,
+  embeds: false,
+  quackbackEmbeds: true,
+  emojiPicker: true,
+}
diff --git a/apps/web/src/lib/README.md b/apps/web/src/lib/README.md
index 312fc9718..16f5ce028 100644
--- a/apps/web/src/lib/README.md
+++ b/apps/web/src/lib/README.md
@@ -92,3 +92,7 @@ server/domains/posts/
 - **Mutations**: All in `client/mutations/`, named by domain
 - **Services**: Max 400 lines, split by responsibility
 - **Hooks**: Max 300 lines, queries only (no mutations)
+- **Server functions**: Use `GET` only when input is safe to appear in URLs
+  (public slugs, locale, pagination, resource IDs). Use `POST` for sensitive
+  or private input such as tokens, secrets, emails, credentials, free-text
+  searches, and private filter objects.
diff --git a/apps/web/src/lib/client/hooks/__tests__/teams-webhooks-subs-hooks.diffcov.test.ts b/apps/web/src/lib/client/hooks/__tests__/teams-webhooks-subs-hooks.diffcov.test.ts
new file mode 100644
index 000000000..12e94317a
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/__tests__/teams-webhooks-subs-hooks.diffcov.test.ts
@@ -0,0 +1,132 @@
+/**
+ * Differential-coverage tests for the teams / webhook-deliveries / ticket-
+ * subscription query hooks and the integration mutation hooks. react-query is
+ * stubbed to capture each hook's options so the queryFn / getNextPageParam /
+ * mutationFn / onSettled closures execute (including the null-id disabled keys).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => {
+  const fn = vi.fn((..._a: unknown[]) => Promise.resolve('ok'))
+  const svcFns = (...names: string[]) =>
+    Object.fromEntries(names.map((n) => [n, (...a: unknown[]) => fn(n, ...a)]))
+  return {
+    queryOpts: [] as Array<Record<string, unknown>>,
+    infiniteOpts: [] as Array<Record<string, unknown>>,
+    mutationOpts: [] as Array<Record<string, unknown>>,
+    invalidate: vi.fn(),
+    fn,
+    svcFns,
+  }
+})
+
+vi.mock('@tanstack/react-query', () => ({
+  useQuery: (o: Record<string, unknown>) => {
+    m.queryOpts.push(o)
+    return {}
+  },
+  useInfiniteQuery: (o: Record<string, unknown>) => {
+    m.infiniteOpts.push(o)
+    return {}
+  },
+  useMutation: (o: Record<string, unknown>) => {
+    m.mutationOpts.push(o)
+    return {}
+  },
+  useQueryClient: () => ({ invalidateQueries: m.invalidate }),
+}))
+vi.mock('@/lib/server/functions/teams', () =>
+  m.svcFns('listTeamsFn', 'getTeamFn', 'listTeamMembersFn')
+)
+vi.mock('@/lib/server/functions/webhook-deliveries', () => m.svcFns('listWebhookDeliveriesFn'))
+vi.mock('@/lib/server/functions/notifications', () => m.svcFns('listTicketSubscriptionsFn'))
+vi.mock('@/lib/server/functions/integrations', () =>
+  m.svcFns(
+    'updateIntegrationFn',
+    'deleteIntegrationFn',
+    'addNotificationChannelFn',
+    'updateNotificationChannelFn',
+    'removeNotificationChannelFn',
+    'addMonitoredChannelFn',
+    'updateMonitoredChannelFn',
+    'removeMonitoredChannelFn',
+    'upsertUserMappingFn',
+    'deleteUserMappingFn'
+  )
+)
+
+import { useTeams, useTeam, useTeamMembers } from '../use-teams-queries'
+import { useWebhookDeliveries } from '../use-webhook-deliveries-queries'
+import { useTicketSubscriptions } from '../use-ticket-subscriptions-queries'
+import * as integ from '../../mutations/integrations'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.queryOpts = []
+  m.infiniteOpts = []
+  m.mutationOpts = []
+})
+
+describe('teams query hooks', () => {
+  it('builds list/detail/members queries (with + without an id)', async () => {
+    useTeams({ includeArchived: true, enabled: false })
+    useTeam('team_1' as never)
+    useTeam(null)
+    useTeamMembers('team_1' as never)
+    useTeamMembers(undefined)
+    // run every captured queryFn closure
+    for (const o of m.queryOpts) await (o.queryFn as () => unknown)()
+    const disabled = m.queryOpts.filter((o) => o.enabled === false)
+    expect(disabled.length).toBeGreaterThanOrEqual(2) // null team + null members
+    expect(m.fn).toHaveBeenCalledWith('listTeamsFn', expect.anything())
+  })
+})
+
+describe('webhook deliveries hook', () => {
+  it('builds an infinite query, runs queryFn + getNextPageParam, and the null key', async () => {
+    useWebhookDeliveries('wh_1' as never, { status: 'failed_retryable' })
+    useWebhookDeliveries(null)
+    const opts = m.infiniteOpts[0]!
+    await (opts.queryFn as (c: { pageParam: unknown }) => unknown)({
+      pageParam: { cursorAttemptedAt: 't', cursorId: 'd' },
+    })
+    await (opts.queryFn as (c: { pageParam: unknown }) => unknown)({ pageParam: null })
+    const gnp = opts.getNextPageParam as (l: unknown) => unknown
+    expect(gnp({ nextCursor: 'c2' })).toBe('c2')
+    expect(gnp({})).toBeUndefined()
+    expect(m.infiniteOpts[1]!.enabled).toBe(false)
+  })
+})
+
+describe('ticket subscriptions hook', () => {
+  it('builds the query with + without a ticket id', async () => {
+    useTicketSubscriptions('ticket_1' as never)
+    useTicketSubscriptions(null)
+    await (m.queryOpts[0]!.queryFn as () => unknown)()
+    expect(m.queryOpts[1]!.enabled).toBe(false)
+  })
+})
+
+describe('integration mutation hooks', () => {
+  it('every mutation runs its mutationFn + onSettled invalidation', async () => {
+    const hooks = [
+      integ.useUpdateIntegration,
+      integ.useDeleteIntegration,
+      integ.useAddNotificationChannel,
+      integ.useUpdateNotificationChannel,
+      integ.useRemoveNotificationChannel,
+      integ.useAddMonitoredChannel,
+      integ.useUpdateMonitoredChannel,
+      integ.useRemoveMonitoredChannel,
+      integ.useUpsertUserMapping,
+      integ.useDeleteUserMapping,
+    ]
+    for (const h of hooks) h()
+    expect(m.mutationOpts).toHaveLength(10)
+    for (const o of m.mutationOpts) {
+      await (o.mutationFn as (i: unknown) => unknown)({})
+      ;(o.onSettled as () => void)()
+    }
+    expect(m.invalidate).toHaveBeenCalledTimes(10)
+  })
+})
diff --git a/apps/web/src/lib/client/hooks/__tests__/use-ticket-create-with-attachments.diffcov.test.tsx b/apps/web/src/lib/client/hooks/__tests__/use-ticket-create-with-attachments.diffcov.test.tsx
new file mode 100644
index 000000000..3cd510907
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/__tests__/use-ticket-create-with-attachments.diffcov.test.tsx
@@ -0,0 +1,218 @@
+// @vitest-environment happy-dom
+
+import { renderHook, act } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  useTicketCreateWithAttachments,
+  type FileToAttach,
+} from '../use-ticket-create-with-attachments'
+
+const TICKET = { id: 'ticket_1' as never, title: 'demo' }
+const THREAD = { id: 'thread_1' as never }
+
+function makeFile(name: string): File {
+  return new File(['content'], name, { type: 'text/plain' })
+}
+
+function makeAttachments(...names: string[]): FileToAttach[] {
+  return names.map((name, i) => ({ file: makeFile(name), id: `f${i}` }))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('useTicketCreateWithAttachments', () => {
+  it('starts with a clean, idle state', () => {
+    const { result } = renderHook(() =>
+      useTicketCreateWithAttachments({
+        createFn: vi.fn(),
+        createThreadFn: vi.fn(),
+        uploadFileFn: vi.fn(),
+        files: [],
+      })
+    )
+    expect(result.current.state).toEqual({
+      isUploading: false,
+      uploadProgress: {},
+      uploadErrors: {},
+      successCount: 0,
+      failureCount: 0,
+      isDone: false,
+    })
+  })
+
+  it('creates the ticket and finishes immediately when there are no files', async () => {
+    const createFn = vi.fn().mockResolvedValue(TICKET)
+    const createThreadFn = vi.fn()
+    const uploadFileFn = vi.fn()
+    const { result } = renderHook(() =>
+      useTicketCreateWithAttachments({
+        createFn,
+        createThreadFn,
+        uploadFileFn,
+        files: [],
+      })
+    )
+
+    let returned: unknown
+    await act(async () => {
+      returned = await result.current.execute()
+    })
+
+    expect(returned).toBe(TICKET)
+    expect(createFn).toHaveBeenCalledTimes(1)
+    expect(createThreadFn).not.toHaveBeenCalled()
+    expect(uploadFileFn).not.toHaveBeenCalled()
+    expect(result.current.state.isUploading).toBe(false)
+    expect(result.current.state.isDone).toBe(true)
+    expect(result.current.state.successCount).toBe(0)
+    expect(result.current.state.failureCount).toBe(0)
+  })
+
+  it('uploads files, tracking both per-file success and per-file failure', async () => {
+    const createFn = vi.fn().mockResolvedValue(TICKET)
+    const createThreadFn = vi.fn().mockResolvedValue(THREAD)
+    const uploadFileFn = vi
+      .fn()
+      .mockResolvedValueOnce({ success: true })
+      .mockResolvedValueOnce({ success: false, error: 'too big' })
+    const onFileUploadComplete = vi.fn()
+    const files = makeAttachments('ok.txt', 'bad.txt')
+
+    const { result } = renderHook(() =>
+      useTicketCreateWithAttachments({
+        createFn,
+        createThreadFn,
+        uploadFileFn,
+        files,
+        onFileUploadComplete,
+      })
+    )
+
+    let returned: unknown
+    await act(async () => {
+      returned = await result.current.execute()
+    })
+
+    expect(returned).toBe(TICKET)
+    expect(createThreadFn).toHaveBeenCalledWith(TICKET.id)
+    expect(uploadFileFn).toHaveBeenCalledTimes(2)
+    expect(result.current.state.successCount).toBe(1)
+    expect(result.current.state.failureCount).toBe(1)
+    expect(result.current.state.uploadErrors).toEqual({ f1: 'too big' })
+    expect(result.current.state.isUploading).toBe(false)
+    expect(result.current.state.isDone).toBe(true)
+    expect(onFileUploadComplete).toHaveBeenCalledWith({
+      id: 'f0',
+      success: true,
+      error: undefined,
+    })
+    expect(onFileUploadComplete).toHaveBeenCalledWith({
+      id: 'f1',
+      success: false,
+      error: 'too big',
+    })
+  })
+
+  it('captures a thrown upload error in the per-file catch branch', async () => {
+    const createFn = vi.fn().mockResolvedValue(TICKET)
+    const createThreadFn = vi.fn().mockResolvedValue(THREAD)
+    const uploadFileFn = vi.fn().mockRejectedValue(new Error('network down'))
+    const onFileUploadComplete = vi.fn()
+    const files = makeAttachments('one.txt')
+
+    const { result } = renderHook(() =>
+      useTicketCreateWithAttachments({
+        createFn,
+        createThreadFn,
+        uploadFileFn,
+        files,
+        onFileUploadComplete,
+      })
+    )
+
+    await act(async () => {
+      await result.current.execute()
+    })
+
+    expect(result.current.state.failureCount).toBe(1)
+    expect(result.current.state.uploadErrors).toEqual({ f0: 'network down' })
+    expect(onFileUploadComplete).toHaveBeenCalledWith({
+      id: 'f0',
+      success: false,
+      error: 'network down',
+    })
+  })
+
+  it('falls back to "Unknown error" when a non-Error is thrown during upload', async () => {
+    const createFn = vi.fn().mockResolvedValue(TICKET)
+    const createThreadFn = vi.fn().mockResolvedValue(THREAD)
+    const uploadFileFn = vi.fn().mockRejectedValue('boom')
+    const files = makeAttachments('one.txt')
+
+    const { result } = renderHook(() =>
+      useTicketCreateWithAttachments({
+        createFn,
+        createThreadFn,
+        uploadFileFn,
+        files,
+      })
+    )
+
+    await act(async () => {
+      await result.current.execute()
+    })
+
+    expect(result.current.state.uploadErrors).toEqual({ f0: 'Unknown error' })
+  })
+
+  it('surfaces a ticket-creation failure via the outer catch branch', async () => {
+    const createFn = vi.fn().mockRejectedValue(new Error('create failed'))
+    const { result } = renderHook(() =>
+      useTicketCreateWithAttachments({
+        createFn,
+        createThreadFn: vi.fn(),
+        uploadFileFn: vi.fn(),
+        files: makeAttachments('one.txt'),
+      })
+    )
+
+    let caught: unknown
+    await act(async () => {
+      await result.current.execute().catch((e: unknown) => {
+        caught = e
+      })
+    })
+    expect((caught as Error).message).toBe('create failed')
+
+    expect(result.current.state.isUploading).toBe(false)
+    expect(result.current.state.isDone).toBe(true)
+    expect(result.current.state.failureCount).toBe(1)
+    expect(result.current.state.uploadErrors).toEqual({ general: 'create failed' })
+  })
+
+  it('uses the generic message when a non-Error is thrown during ticket creation', async () => {
+    const createFn = vi.fn().mockRejectedValue('nope')
+    const { result } = renderHook(() =>
+      useTicketCreateWithAttachments({
+        createFn,
+        createThreadFn: vi.fn(),
+        uploadFileFn: vi.fn(),
+        files: [],
+      })
+    )
+
+    let caught: unknown
+    await act(async () => {
+      await result.current.execute().catch((e: unknown) => {
+        caught = e
+      })
+    })
+    expect(caught).toBe('nope')
+
+    expect(result.current.state.uploadErrors).toEqual({
+      general: 'Failed to create ticket',
+    })
+  })
+})
diff --git a/apps/web/src/lib/client/hooks/__tests__/use-tickets-queries.diffcov.test.ts b/apps/web/src/lib/client/hooks/__tests__/use-tickets-queries.diffcov.test.ts
new file mode 100644
index 000000000..0e0eeef81
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/__tests__/use-tickets-queries.diffcov.test.ts
@@ -0,0 +1,190 @@
+// @vitest-environment happy-dom
+
+import { renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ticketsKeys,
+  useTicket,
+  useTicketParticipants,
+  useTicketShares,
+  useTicketStatuses,
+  useTicketThreads,
+  useTickets,
+} from '../use-tickets-queries'
+
+type QueryOptions = {
+  queryKey: readonly unknown[]
+  queryFn: () => unknown
+  enabled?: boolean
+  staleTime?: number
+  refetchInterval?: number
+}
+
+const mocks = vi.hoisted(() => ({
+  queryOptions: [] as QueryOptions[],
+  queryResult: { data: undefined as unknown, isLoading: false },
+  listTicketsFn: vi.fn(),
+  getTicketFn: vi.fn(),
+  listThreadsFn: vi.fn(),
+  listSharesFn: vi.fn(),
+  listParticipantsFn: vi.fn(),
+  listTicketStatusesFn: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQuery: (options: QueryOptions) => {
+    mocks.queryOptions.push(options)
+    return mocks.queryResult
+  },
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  listTicketsFn: (input: unknown) => mocks.listTicketsFn(input),
+  getTicketFn: (input: unknown) => mocks.getTicketFn(input),
+  listThreadsFn: (input: unknown) => mocks.listThreadsFn(input),
+  listSharesFn: (input: unknown) => mocks.listSharesFn(input),
+  listParticipantsFn: (input: unknown) => mocks.listParticipantsFn(input),
+  listTicketStatusesFn: () => mocks.listTicketStatusesFn(),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.queryOptions = []
+  mocks.queryResult = { data: undefined, isLoading: false }
+})
+
+describe('ticketsKeys', () => {
+  it('builds the stable query-key hierarchy', () => {
+    expect(ticketsKeys.all).toEqual(['tickets'])
+    expect(ticketsKeys.lists()).toEqual(['tickets', 'list'])
+    expect(ticketsKeys.list({ scope: 'all' })).toEqual(['tickets', 'list', { scope: 'all' }])
+    expect(ticketsKeys.detail('ticket_1' as never)).toEqual(['tickets', 'detail', 'ticket_1'])
+    expect(ticketsKeys.threads('ticket_1' as never)).toEqual(['tickets', 'threads', 'ticket_1'])
+    expect(ticketsKeys.shares('ticket_1' as never)).toEqual(['tickets', 'shares', 'ticket_1'])
+    expect(ticketsKeys.participants('ticket_1' as never)).toEqual([
+      'tickets',
+      'participants',
+      'ticket_1',
+    ])
+    expect(ticketsKeys.statuses()).toEqual(['tickets', 'statuses'])
+  })
+})
+
+describe('useTickets', () => {
+  it('builds the list query with defaults', () => {
+    renderHook(() => useTickets({ scope: 'all' }))
+    const query = mocks.queryOptions.at(-1)!
+    expect(query.queryKey).toEqual(ticketsKeys.list({ scope: 'all' }))
+    expect(query.enabled).toBe(true)
+    expect(query.staleTime).toBe(10_000)
+    expect(query.refetchInterval).toBe(15_000)
+    query.queryFn()
+    expect(mocks.listTicketsFn).toHaveBeenCalledWith({ data: { scope: 'all' } })
+  })
+
+  it('honours explicit enabled and refetchInterval overrides', () => {
+    renderHook(() =>
+      useTickets({ scope: 'my_assigned' }, { enabled: false, refetchInterval: 5_000 })
+    )
+    const query = mocks.queryOptions.at(-1)!
+    expect(query.enabled).toBe(false)
+    expect(query.refetchInterval).toBe(5_000)
+  })
+})
+
+describe('useTicket', () => {
+  it('builds the detail query when an id is present', () => {
+    renderHook(() => useTicket('ticket_1' as never))
+    const query = mocks.queryOptions.at(-1)!
+    expect(query.queryKey).toEqual(ticketsKeys.detail('ticket_1' as never))
+    expect(query.enabled).toBe(true)
+    query.queryFn()
+    expect(mocks.getTicketFn).toHaveBeenCalledWith({ data: { ticketId: 'ticket_1' } })
+  })
+
+  it('disables and uses the none key when id is missing', () => {
+    renderHook(() => useTicket(null))
+    expect(mocks.queryOptions.at(-1)).toMatchObject({
+      queryKey: ['tickets', 'detail', 'none'],
+      enabled: false,
+    })
+  })
+})
+
+describe('useTicketThreads', () => {
+  it('builds the threads query when an id is present', () => {
+    renderHook(() => useTicketThreads('ticket_1' as never))
+    const query = mocks.queryOptions.at(-1)!
+    expect(query.queryKey).toEqual(ticketsKeys.threads('ticket_1' as never))
+    expect(query.enabled).toBe(true)
+    query.queryFn()
+    expect(mocks.listThreadsFn).toHaveBeenCalledWith({ data: { ticketId: 'ticket_1' } })
+  })
+
+  it('disables and uses the none key when id is missing', () => {
+    renderHook(() => useTicketThreads(undefined))
+    expect(mocks.queryOptions.at(-1)).toMatchObject({
+      queryKey: ['tickets', 'threads', 'none'],
+      enabled: false,
+    })
+  })
+})
+
+describe('useTicketShares', () => {
+  it('builds the shares query when an id is present', () => {
+    renderHook(() => useTicketShares('ticket_1' as never))
+    const query = mocks.queryOptions.at(-1)!
+    expect(query.queryKey).toEqual(ticketsKeys.shares('ticket_1' as never))
+    expect(query.enabled).toBe(true)
+    expect(query.staleTime).toBe(30_000)
+    query.queryFn()
+    expect(mocks.listSharesFn).toHaveBeenCalledWith({ data: { ticketId: 'ticket_1' } })
+  })
+
+  it('disables and uses the none key when id is missing', () => {
+    renderHook(() => useTicketShares(null))
+    expect(mocks.queryOptions.at(-1)).toMatchObject({
+      queryKey: ['tickets', 'shares', 'none'],
+      enabled: false,
+    })
+  })
+})
+
+describe('useTicketParticipants', () => {
+  it('builds the participants query when an id is present', () => {
+    renderHook(() => useTicketParticipants('ticket_1' as never))
+    const query = mocks.queryOptions.at(-1)!
+    expect(query.queryKey).toEqual(ticketsKeys.participants('ticket_1' as never))
+    expect(query.enabled).toBe(true)
+    expect(query.staleTime).toBe(30_000)
+    query.queryFn()
+    expect(mocks.listParticipantsFn).toHaveBeenCalledWith({
+      data: { ticketId: 'ticket_1' },
+    })
+  })
+
+  it('disables and uses the none key when id is missing', () => {
+    renderHook(() => useTicketParticipants(undefined))
+    expect(mocks.queryOptions.at(-1)).toMatchObject({
+      queryKey: ['tickets', 'participants', 'none'],
+      enabled: false,
+    })
+  })
+})
+
+describe('useTicketStatuses', () => {
+  it('builds the statuses query enabled by default', () => {
+    renderHook(() => useTicketStatuses())
+    const query = mocks.queryOptions.at(-1)!
+    expect(query.queryKey).toEqual(ticketsKeys.statuses())
+    expect(query.enabled).toBe(true)
+    expect(query.staleTime).toBe(5 * 60_000)
+    query.queryFn()
+    expect(mocks.listTicketStatusesFn).toHaveBeenCalled()
+  })
+
+  it('honours the disabled flag', () => {
+    renderHook(() => useTicketStatuses(false))
+    expect(mocks.queryOptions.at(-1)).toMatchObject({ enabled: false })
+  })
+})
diff --git a/apps/web/src/lib/client/hooks/use-audit-queries.ts b/apps/web/src/lib/client/hooks/use-audit-queries.ts
new file mode 100644
index 000000000..7eedd82fa
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-audit-queries.ts
@@ -0,0 +1,44 @@
+/**
+ * Audit log query hooks (read-only). Uses cursor pagination via
+ * `useInfiniteQuery` for the timeline view.
+ */
+import { useInfiniteQuery, useQuery } from '@tanstack/react-query'
+import { listAuditEventsPagedFn } from '@/lib/server/functions/audit'
+
+export interface AuditFilters {
+  principalId?: string
+  action?: string
+  actionPrefix?: string
+  targetType?: string
+  targetId?: string
+  source?: 'web' | 'api' | 'integration' | 'system' | 'mcp'
+  from?: string
+  to?: string
+}
+
+export const auditKeys = {
+  all: ['audit'] as const,
+  list: (filters: AuditFilters) => [...auditKeys.all, 'list', filters] as const,
+}
+
+export function useAuditEventsInfinite(filters: AuditFilters, enabled = true) {
+  return useInfiniteQuery({
+    queryKey: auditKeys.list(filters),
+    initialPageParam: undefined as string | undefined,
+    queryFn: ({ pageParam }) =>
+      listAuditEventsPagedFn({ data: { ...filters, cursor: pageParam, limit: 50 } }),
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    getNextPageParam: (last: any) => last?.nextCursor ?? undefined,
+    enabled,
+    staleTime: 30_000,
+  })
+}
+
+export function useAuditEvents(filters: AuditFilters, enabled = true) {
+  return useQuery({
+    queryKey: [...auditKeys.list(filters), 'first'],
+    queryFn: () => listAuditEventsPagedFn({ data: { ...filters, limit: 50 } }),
+    enabled,
+    staleTime: 30_000,
+  })
+}
diff --git a/apps/web/src/lib/client/hooks/use-authz-queries.ts b/apps/web/src/lib/client/hooks/use-authz-queries.ts
new file mode 100644
index 000000000..6a9c269fd
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-authz-queries.ts
@@ -0,0 +1,49 @@
+/**
+ * Authz / permissions client hook.
+ *
+ * Caches the actor's full permission set workspace-wide for the session;
+ * consumed by `<PermissionGate />`, sidebar nav filtering, and per-control
+ * disable logic.
+ */
+import { useQuery } from '@tanstack/react-query'
+import type { TeamId } from '@quackback/ids'
+import { getMyPermissionsFn } from '@/lib/server/functions/authz'
+import type { MyPermissionsResult } from '@/lib/server/functions/authz'
+import type { PermissionKey } from '@/lib/server/domains/authz'
+
+export const authzKeys = {
+  all: ['authz'] as const,
+  me: () => [...authzKeys.all, 'me'] as const,
+}
+
+export function useMyPermissions(enabled = true): ReturnType<typeof useQuery<MyPermissionsResult>> {
+  return useQuery({
+    queryKey: authzKeys.me(),
+    queryFn: () => getMyPermissionsFn(),
+    enabled,
+    staleTime: 60_000,
+  })
+}
+
+/**
+ * Convenience selector — returns true if the actor holds `permission` either
+ * workspace-wide or via any team-scoped grant.
+ *
+ * Falls back to `false` while the underlying query is loading; UI should
+ * skeleton/disable rather than render. Pass `loadingFallback` to override.
+ */
+export function useHasPermission(
+  permission: PermissionKey,
+  options: { teamId?: TeamId | null; loadingFallback?: boolean } = {}
+): boolean {
+  const { data, isLoading } = useMyPermissions()
+  if (isLoading) return options.loadingFallback ?? false
+  if (!data) return false
+  if (data.workspacePermissions.includes(permission)) return true
+  if (options.teamId) {
+    const team = data.teamPermissions.find((t) => t.teamId === options.teamId)
+    return !!team && team.permissions.includes(permission)
+  }
+  // Permission may be granted by any team scope.
+  return data.teamPermissions.some((t) => t.permissions.includes(permission))
+}
diff --git a/apps/web/src/lib/client/hooks/use-inboxes-queries.ts b/apps/web/src/lib/client/hooks/use-inboxes-queries.ts
new file mode 100644
index 000000000..b93a8942f
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-inboxes-queries.ts
@@ -0,0 +1,67 @@
+/**
+ * Inboxes query hooks.
+ */
+import { useQuery } from '@tanstack/react-query'
+import type { InboxId } from '@quackback/ids'
+import {
+  listInboxesFn,
+  getInboxFn,
+  listInboxChannelsFn,
+  listInboxMembershipsFn,
+  listMyInboxesFn,
+} from '@/lib/server/functions/inboxes'
+
+export const inboxesKeys = {
+  all: ['inboxes'] as const,
+  lists: () => [...inboxesKeys.all, 'list'] as const,
+  list: (filters: { includeArchived?: boolean }) => [...inboxesKeys.lists(), filters] as const,
+  myList: () => [...inboxesKeys.all, 'mine'] as const,
+  detail: (id: InboxId) => [...inboxesKeys.all, 'detail', id] as const,
+  channels: (id: InboxId) => [...inboxesKeys.all, 'channels', id] as const,
+  memberships: (id: InboxId) => [...inboxesKeys.all, 'memberships', id] as const,
+}
+
+export function useInboxes(opts: { includeArchived?: boolean; enabled?: boolean } = {}) {
+  return useQuery({
+    queryKey: inboxesKeys.list({ includeArchived: opts.includeArchived }),
+    queryFn: () => listInboxesFn({ data: { includeArchived: opts.includeArchived } }),
+    enabled: opts.enabled ?? true,
+    staleTime: 60_000,
+  })
+}
+
+export function useMyInboxes(enabled = true) {
+  return useQuery({
+    queryKey: inboxesKeys.myList(),
+    queryFn: () => listMyInboxesFn(),
+    enabled,
+    staleTime: 60_000,
+  })
+}
+
+export function useInbox(inboxId: InboxId | null | undefined) {
+  return useQuery({
+    queryKey: inboxId ? inboxesKeys.detail(inboxId) : ['inboxes', 'detail', 'none'],
+    queryFn: () => getInboxFn({ data: { inboxId: inboxId! } }),
+    enabled: !!inboxId,
+    staleTime: 60_000,
+  })
+}
+
+export function useInboxChannels(inboxId: InboxId | null | undefined) {
+  return useQuery({
+    queryKey: inboxId ? inboxesKeys.channels(inboxId) : ['inboxes', 'channels', 'none'],
+    queryFn: () => listInboxChannelsFn({ data: { inboxId: inboxId! } }),
+    enabled: !!inboxId,
+    staleTime: 30_000,
+  })
+}
+
+export function useInboxMemberships(inboxId: InboxId | null | undefined) {
+  return useQuery({
+    queryKey: inboxId ? inboxesKeys.memberships(inboxId) : ['inboxes', 'memberships', 'none'],
+    queryFn: () => listInboxMembershipsFn({ data: { inboxId: inboxId! } }),
+    enabled: !!inboxId,
+    staleTime: 30_000,
+  })
+}
diff --git a/apps/web/src/lib/client/hooks/use-notifications-queries.ts b/apps/web/src/lib/client/hooks/use-notifications-queries.ts
index 86e6dccec..961962e50 100644
--- a/apps/web/src/lib/client/hooks/use-notifications-queries.ts
+++ b/apps/web/src/lib/client/hooks/use-notifications-queries.ts
@@ -33,6 +33,7 @@ export interface SerializedNotification {
   body: string | null
   postId: string | null
   commentId: string | null
+  ticketId: string | null
   /** Target conversation for chat notifications (from metadata); null otherwise. */
   conversationId: string | null
   readAt: string | null
diff --git a/apps/web/src/lib/client/hooks/use-orgs-contacts-queries.ts b/apps/web/src/lib/client/hooks/use-orgs-contacts-queries.ts
new file mode 100644
index 000000000..99c2b70a8
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-orgs-contacts-queries.ts
@@ -0,0 +1,87 @@
+/**
+ * Organizations + contacts query hooks.
+ */
+import { useQuery } from '@tanstack/react-query'
+import type { OrganizationId, ContactId } from '@quackback/ids'
+import { listOrganizationsFn, getOrganizationFn } from '@/lib/server/functions/organizations'
+import {
+  searchContactsFn,
+  listContactsForOrganizationFn,
+  getContactFn,
+  listLinksForContactFn,
+} from '@/lib/server/functions/contacts'
+
+export const orgsKeys = {
+  all: ['orgs'] as const,
+  lists: () => [...orgsKeys.all, 'list'] as const,
+  list: (filters: { query?: string; includeArchived?: boolean }) =>
+    [...orgsKeys.lists(), filters] as const,
+  detail: (id: OrganizationId) => [...orgsKeys.all, 'detail', id] as const,
+}
+
+export const contactsKeys = {
+  all: ['contacts'] as const,
+  search: (q: string) => [...contactsKeys.all, 'search', q] as const,
+  byOrg: (id: OrganizationId) => [...contactsKeys.all, 'byOrg', id] as const,
+  detail: (id: ContactId) => [...contactsKeys.all, 'detail', id] as const,
+  links: (id: ContactId) => [...contactsKeys.all, 'links', id] as const,
+}
+
+export function useOrganizations(
+  opts: { query?: string; includeArchived?: boolean; enabled?: boolean } = {}
+) {
+  return useQuery({
+    queryKey: orgsKeys.list({ query: opts.query, includeArchived: opts.includeArchived }),
+    queryFn: () =>
+      listOrganizationsFn({
+        data: { search: opts.query, includeArchived: opts.includeArchived },
+      }),
+    enabled: opts.enabled ?? true,
+    staleTime: 30_000,
+  })
+}
+
+export function useOrganization(id: OrganizationId | null | undefined) {
+  return useQuery({
+    queryKey: id ? orgsKeys.detail(id) : ['orgs', 'detail', 'none'],
+    queryFn: () => getOrganizationFn({ data: { organizationId: id! } }),
+    enabled: !!id,
+    staleTime: 60_000,
+  })
+}
+
+export function useContactSearch(query: string, enabled = true) {
+  return useQuery({
+    queryKey: contactsKeys.search(query),
+    queryFn: () => searchContactsFn({ data: { query } }),
+    enabled,
+    staleTime: 30_000,
+  })
+}
+
+export function useContactsForOrganization(orgId: OrganizationId | null | undefined) {
+  return useQuery({
+    queryKey: orgId ? contactsKeys.byOrg(orgId) : ['contacts', 'byOrg', 'none'],
+    queryFn: () => listContactsForOrganizationFn({ data: { organizationId: orgId! } }),
+    enabled: !!orgId,
+    staleTime: 30_000,
+  })
+}
+
+export function useContact(id: ContactId | null | undefined) {
+  return useQuery({
+    queryKey: id ? contactsKeys.detail(id) : ['contacts', 'detail', 'none'],
+    queryFn: () => getContactFn({ data: { contactId: id! } }),
+    enabled: !!id,
+    staleTime: 60_000,
+  })
+}
+
+export function useContactLinks(id: ContactId | null | undefined) {
+  return useQuery({
+    queryKey: id ? contactsKeys.links(id) : ['contacts', 'links', 'none'],
+    queryFn: () => listLinksForContactFn({ data: { contactId: id! } }),
+    enabled: !!id,
+    staleTime: 30_000,
+  })
+}
diff --git a/apps/web/src/lib/client/hooks/use-routing-queries.ts b/apps/web/src/lib/client/hooks/use-routing-queries.ts
new file mode 100644
index 000000000..c37ca2690
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-routing-queries.ts
@@ -0,0 +1,37 @@
+/**
+ * Routing rules query hooks.
+ */
+import { useQuery } from '@tanstack/react-query'
+import type { RoutingRuleId, InboxId } from '@quackback/ids'
+import { listRoutingRulesFn, getRoutingRuleFn } from '@/lib/server/functions/routing'
+
+type InboxScope = InboxId | 'workspace' | undefined
+
+export const routingKeys = {
+  all: ['routing'] as const,
+  list: (filters: { inboxIdScope?: InboxScope; enabledOnly?: boolean }) =>
+    [...routingKeys.all, 'list', filters] as const,
+  detail: (id: RoutingRuleId) => [...routingKeys.all, 'detail', id] as const,
+}
+
+export function useRoutingRules(
+  filters: { inboxIdScope?: InboxScope; enabledOnly?: boolean } = {}
+) {
+  return useQuery({
+    queryKey: routingKeys.list(filters),
+    queryFn: () =>
+      listRoutingRulesFn({
+        data: { inboxIdScope: filters.inboxIdScope, enabledOnly: filters.enabledOnly },
+      }),
+    staleTime: 30_000,
+  })
+}
+
+export function useRoutingRule(id: RoutingRuleId | null | undefined) {
+  return useQuery({
+    queryKey: id ? routingKeys.detail(id) : ['routing', 'detail', 'none'],
+    queryFn: () => getRoutingRuleFn({ data: { ruleId: id! } }),
+    enabled: !!id,
+    staleTime: 60_000,
+  })
+}
diff --git a/apps/web/src/lib/client/hooks/use-sla-queries.ts b/apps/web/src/lib/client/hooks/use-sla-queries.ts
new file mode 100644
index 000000000..c08dbb6c0
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-sla-queries.ts
@@ -0,0 +1,96 @@
+/**
+ * SLA + business-hours + escalations + ticket-clocks query hooks.
+ */
+import { useQuery } from '@tanstack/react-query'
+import type { SlaPolicyId, BusinessHoursId, TicketId } from '@quackback/ids'
+import {
+  listBusinessHoursFn,
+  getBusinessHoursFn,
+  listSlaPoliciesFn,
+  getSlaPolicyFn,
+  listEscalationRulesFn,
+  getTicketSlaClocksFn,
+  listBreachingClocksFn,
+} from '@/lib/server/functions/sla'
+
+export const slaKeys = {
+  all: ['sla'] as const,
+  policies: (includeArchived?: boolean) =>
+    [...slaKeys.all, 'policies', { includeArchived }] as const,
+  policy: (id: SlaPolicyId) => [...slaKeys.all, 'policy', id] as const,
+  escalations: (id: SlaPolicyId) => [...slaKeys.all, 'escalations', id] as const,
+  ticketClocks: (ticketId: TicketId) => [...slaKeys.all, 'ticketClocks', ticketId] as const,
+  breaching: () => [...slaKeys.all, 'breaching'] as const,
+}
+
+export const businessHoursKeys = {
+  all: ['businessHours'] as const,
+  list: (includeArchived?: boolean) =>
+    [...businessHoursKeys.all, 'list', { includeArchived }] as const,
+  detail: (id: BusinessHoursId) => [...businessHoursKeys.all, 'detail', id] as const,
+}
+
+export function useSlaPolicies(opts: { includeArchived?: boolean; enabled?: boolean } = {}) {
+  return useQuery({
+    queryKey: slaKeys.policies(opts.includeArchived),
+    queryFn: () => listSlaPoliciesFn({ data: { includeArchived: opts.includeArchived } }),
+    enabled: opts.enabled ?? true,
+    staleTime: 60_000,
+  })
+}
+
+export function useSlaPolicy(id: SlaPolicyId | null | undefined) {
+  return useQuery({
+    queryKey: id ? slaKeys.policy(id) : ['sla', 'policy', 'none'],
+    queryFn: () => getSlaPolicyFn({ data: { id: id! } }),
+    enabled: !!id,
+    staleTime: 60_000,
+  })
+}
+
+export function useEscalationRules(policyId: SlaPolicyId | null | undefined) {
+  return useQuery({
+    queryKey: policyId ? slaKeys.escalations(policyId) : ['sla', 'escalations', 'none'],
+    queryFn: () => listEscalationRulesFn({ data: { policyId: policyId! } }),
+    enabled: !!policyId,
+    staleTime: 30_000,
+  })
+}
+
+export function useTicketSlaClocks(ticketId: TicketId | null | undefined) {
+  return useQuery({
+    queryKey: ticketId ? slaKeys.ticketClocks(ticketId) : ['sla', 'ticketClocks', 'none'],
+    queryFn: () => getTicketSlaClocksFn({ data: { ticketId: ticketId! } }),
+    enabled: !!ticketId,
+    staleTime: 15_000,
+    refetchInterval: 30_000,
+  })
+}
+
+export function useBreachingClocks(enabled = true) {
+  return useQuery({
+    queryKey: slaKeys.breaching(),
+    queryFn: () => listBreachingClocksFn({ data: {} }),
+    enabled,
+    staleTime: 30_000,
+    refetchInterval: 60_000,
+  })
+}
+
+export function useBusinessHoursList(opts: { includeArchived?: boolean; enabled?: boolean } = {}) {
+  return useQuery({
+    queryKey: businessHoursKeys.list(opts.includeArchived),
+    queryFn: () => listBusinessHoursFn({ data: { includeArchived: opts.includeArchived } }),
+    enabled: opts.enabled ?? true,
+    staleTime: 60_000,
+  })
+}
+
+export function useBusinessHours(id: BusinessHoursId | null | undefined) {
+  return useQuery({
+    queryKey: id ? businessHoursKeys.detail(id) : ['businessHours', 'detail', 'none'],
+    queryFn: () => getBusinessHoursFn({ data: { id: id! } }),
+    enabled: !!id,
+    staleTime: 60_000,
+  })
+}
diff --git a/apps/web/src/lib/client/hooks/use-teams-queries.ts b/apps/web/src/lib/client/hooks/use-teams-queries.ts
new file mode 100644
index 000000000..7b3afba07
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-teams-queries.ts
@@ -0,0 +1,41 @@
+/**
+ * Teams query hooks — `useTeams()`, `useTeam()`, `useTeamMembers()`.
+ */
+import { useQuery } from '@tanstack/react-query'
+import type { TeamId } from '@quackback/ids'
+import { listTeamsFn, getTeamFn, listTeamMembersFn } from '@/lib/server/functions/teams'
+
+export const teamsKeys = {
+  all: ['teams'] as const,
+  lists: () => [...teamsKeys.all, 'list'] as const,
+  list: (filters: { includeArchived?: boolean }) => [...teamsKeys.lists(), filters] as const,
+  detail: (id: TeamId) => [...teamsKeys.all, 'detail', id] as const,
+  members: (id: TeamId) => [...teamsKeys.all, 'members', id] as const,
+}
+
+export function useTeams(opts: { includeArchived?: boolean; enabled?: boolean } = {}) {
+  return useQuery({
+    queryKey: teamsKeys.list({ includeArchived: opts.includeArchived }),
+    queryFn: () => listTeamsFn({ data: { includeArchived: opts.includeArchived } }),
+    enabled: opts.enabled ?? true,
+    staleTime: 60_000,
+  })
+}
+
+export function useTeam(teamId: TeamId | null | undefined) {
+  return useQuery({
+    queryKey: teamId ? teamsKeys.detail(teamId) : ['teams', 'detail', 'none'],
+    queryFn: () => getTeamFn({ data: { teamId: teamId! } }),
+    enabled: !!teamId,
+    staleTime: 60_000,
+  })
+}
+
+export function useTeamMembers(teamId: TeamId | null | undefined) {
+  return useQuery({
+    queryKey: teamId ? teamsKeys.members(teamId) : ['teams', 'members', 'none'],
+    queryFn: () => listTeamMembersFn({ data: { teamId: teamId! } }),
+    enabled: !!teamId,
+    staleTime: 30_000,
+  })
+}
diff --git a/apps/web/src/lib/client/hooks/use-ticket-create-with-attachments.ts b/apps/web/src/lib/client/hooks/use-ticket-create-with-attachments.ts
new file mode 100644
index 000000000..fe6763e15
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-ticket-create-with-attachments.ts
@@ -0,0 +1,172 @@
+/**
+ * Shared client hook for ticket creation with file attachments.
+ *
+ * Orchestrates a two-step process:
+ * 1. Create the ticket via the provided mutation
+ * 2. If files are selected, create an initial thread and upload them
+ *
+ * Handles partial failures gracefully: if ticket creation succeeds but file
+ * uploads fail, the ticket is preserved and the user sees per-file errors
+ * with retry options.
+ */
+
+import { useState, useCallback } from 'react'
+import type { TicketId, TicketThreadId } from '@quackback/ids'
+
+export interface FileToAttach {
+  file: File
+  id: string // unique client-side ID for tracking
+}
+
+export interface AttachmentUploadResult {
+  id: string // matches FileToAttach.id
+  success: boolean
+  error?: string
+}
+
+export interface TicketCreateWithAttachmentsState {
+  isUploading: boolean
+  uploadProgress: Record<string, { loaded: number; total: number }> // by FileToAttach.id
+  uploadErrors: Record<string, string> // by FileToAttach.id
+  successCount: number
+  failureCount: number
+  isDone: boolean
+}
+
+interface TicketCreateOptions<T extends { id: TicketId }> {
+  /**
+   * Mutation function that creates the ticket.
+   * Should return { id: TicketId, ... }
+   */
+  createFn: () => Promise<T>
+  /**
+   * Function to create the initial thread for the ticket.
+   * Called with (ticketId) and should return { id: TicketThreadId }
+   */
+  createThreadFn: (ticketId: TicketId) => Promise<{ id: TicketThreadId }>
+  /**
+   * Function to upload a single file to a thread.
+   * Called with (ticketId, threadId, file) and should return { success: boolean, error?: string }
+   */
+  uploadFileFn: (
+    ticketId: TicketId,
+    threadId: TicketThreadId,
+    file: File
+  ) => Promise<{ success: boolean; error?: string }>
+  /**
+   * Files to attach after ticket creation.
+   */
+  files: FileToAttach[]
+  /**
+   * Optional callback on each file upload completion.
+   */
+  onFileUploadComplete?: (result: AttachmentUploadResult) => void
+}
+
+export function useTicketCreateWithAttachments<T extends { id: TicketId }>({
+  createFn,
+  createThreadFn,
+  uploadFileFn,
+  files,
+  onFileUploadComplete,
+}: TicketCreateOptions<T>) {
+  const [state, setState] = useState<TicketCreateWithAttachmentsState>({
+    isUploading: false,
+    uploadProgress: {},
+    uploadErrors: {},
+    successCount: 0,
+    failureCount: 0,
+    isDone: false,
+  })
+
+  const execute = useCallback(async (): Promise<T | null> => {
+    try {
+      setState((prev) => ({
+        ...prev,
+        isUploading: true,
+        uploadErrors: {},
+        uploadProgress: {},
+        successCount: 0,
+        failureCount: 0,
+        isDone: false,
+      }))
+
+      // Step 1: Create the ticket
+      const ticket = await createFn()
+
+      // If no files, we're done
+      if (files.length === 0) {
+        setState((prev) => ({
+          ...prev,
+          isUploading: false,
+          isDone: true,
+        }))
+        return ticket
+      }
+
+      // Step 2: Ensure there's an initial thread
+      const { id: threadId } = await createThreadFn(ticket.id)
+
+      // Step 3: Upload files in parallel with progress tracking
+      const uploadPromises = files.map(async ({ file, id: fileId }) => {
+        try {
+          const result = await uploadFileFn(ticket.id, threadId, file)
+          const uploadResult: AttachmentUploadResult = {
+            id: fileId,
+            success: result.success,
+            error: result.error,
+          }
+          setState((prev) => ({
+            ...prev,
+            successCount: result.success ? prev.successCount + 1 : prev.successCount,
+            failureCount: !result.success ? prev.failureCount + 1 : prev.failureCount,
+            uploadErrors: result.error
+              ? { ...prev.uploadErrors, [fileId]: result.error }
+              : { ...prev.uploadErrors },
+          }))
+          onFileUploadComplete?.(uploadResult)
+          return uploadResult
+        } catch (err) {
+          const error = err instanceof Error ? err.message : 'Unknown error'
+          const uploadResult: AttachmentUploadResult = {
+            id: fileId,
+            success: false,
+            error,
+          }
+          setState((prev) => ({
+            ...prev,
+            failureCount: prev.failureCount + 1,
+            uploadErrors: { ...prev.uploadErrors, [fileId]: error },
+          }))
+          onFileUploadComplete?.(uploadResult)
+          return uploadResult
+        }
+      })
+
+      await Promise.all(uploadPromises)
+
+      setState((prev) => ({
+        ...prev,
+        isUploading: false,
+        isDone: true,
+      }))
+
+      return ticket
+    } catch (err) {
+      const error = err instanceof Error ? err.message : 'Failed to create ticket'
+      setState((prev) => ({
+        ...prev,
+        isUploading: false,
+        isDone: true,
+        uploadErrors: { general: error },
+        failureCount: prev.failureCount + 1,
+      }))
+      throw err
+    }
+  }, [createFn, createThreadFn, uploadFileFn, files, onFileUploadComplete])
+
+  return {
+    state,
+    execute,
+  }
+}
diff --git a/apps/web/src/lib/client/hooks/use-ticket-subscriptions-queries.ts b/apps/web/src/lib/client/hooks/use-ticket-subscriptions-queries.ts
new file mode 100644
index 000000000..9052db614
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-ticket-subscriptions-queries.ts
@@ -0,0 +1,24 @@
+/**
+ * Ticket subscription query hooks (per-ticket subscriber list).
+ * The current actor's subscription state is derived from `listTicketSubscriptionsFn`
+ * by filtering on `principalId` client-side until a one-row read fn is added.
+ */
+import { useQuery } from '@tanstack/react-query'
+import type { TicketId } from '@quackback/ids'
+import { listTicketSubscriptionsFn } from '@/lib/server/functions/notifications'
+
+export const ticketSubscriptionsKeys = {
+  all: ['ticketSubscriptions'] as const,
+  forTicket: (ticketId: TicketId) => [...ticketSubscriptionsKeys.all, ticketId] as const,
+}
+
+export function useTicketSubscriptions(ticketId: TicketId | null | undefined) {
+  return useQuery({
+    queryKey: ticketId
+      ? ticketSubscriptionsKeys.forTicket(ticketId)
+      : ['ticketSubscriptions', 'none'],
+    queryFn: () => listTicketSubscriptionsFn({ data: { ticketId: ticketId! } }),
+    enabled: !!ticketId,
+    staleTime: 30_000,
+  })
+}
diff --git a/apps/web/src/lib/client/hooks/use-tickets-queries.ts b/apps/web/src/lib/client/hooks/use-tickets-queries.ts
new file mode 100644
index 000000000..005ef4c1a
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-tickets-queries.ts
@@ -0,0 +1,103 @@
+/**
+ * Tickets query hooks. Mutations live in the corresponding components and
+ * call the server-fns directly with `useMutation` to keep payload typing tight.
+ */
+import { useQuery } from '@tanstack/react-query'
+import type { TicketId } from '@quackback/ids'
+import {
+  listTicketsFn,
+  getTicketFn,
+  listThreadsFn,
+  listSharesFn,
+  listParticipantsFn,
+  listTicketStatusesFn,
+} from '@/lib/server/functions/tickets'
+
+export const ticketsKeys = {
+  all: ['tickets'] as const,
+  lists: () => [...ticketsKeys.all, 'list'] as const,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  list: (filters: Record<string, any>) => [...ticketsKeys.lists(), filters] as const,
+  detail: (id: TicketId) => [...ticketsKeys.all, 'detail', id] as const,
+  threads: (id: TicketId) => [...ticketsKeys.all, 'threads', id] as const,
+  shares: (id: TicketId) => [...ticketsKeys.all, 'shares', id] as const,
+  participants: (id: TicketId) => [...ticketsKeys.all, 'participants', id] as const,
+  statuses: () => [...ticketsKeys.all, 'statuses'] as const,
+}
+
+export type TicketScope =
+  | 'all'
+  | 'my_assigned'
+  | 'my_team'
+  | 'shared_with_me'
+  | 'unassigned'
+  | 'my_inbox'
+  | 'inbox'
+
+export interface TicketListFilters {
+  scope: TicketScope
+  statusCategory?: 'open' | 'pending' | 'on_hold' | 'solved' | 'closed'
+  search?: string
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  [k: string]: any
+}
+
+export function useTickets(
+  filters: TicketListFilters,
+  options: { enabled?: boolean; refetchInterval?: number } = {}
+) {
+  return useQuery({
+    queryKey: ticketsKeys.list(filters),
+    queryFn: () => listTicketsFn({ data: filters }),
+    enabled: options.enabled ?? true,
+    staleTime: 10_000,
+    refetchInterval: options.refetchInterval ?? 15_000,
+  })
+}
+
+export function useTicket(ticketId: TicketId | null | undefined) {
+  return useQuery({
+    queryKey: ticketId ? ticketsKeys.detail(ticketId) : ['tickets', 'detail', 'none'],
+    queryFn: () => getTicketFn({ data: { ticketId: ticketId! } }),
+    enabled: !!ticketId,
+    staleTime: 10_000,
+    refetchInterval: 15_000,
+  })
+}
+
+export function useTicketThreads(ticketId: TicketId | null | undefined) {
+  return useQuery({
+    queryKey: ticketId ? ticketsKeys.threads(ticketId) : ['tickets', 'threads', 'none'],
+    queryFn: () => listThreadsFn({ data: { ticketId: ticketId! } }),
+    enabled: !!ticketId,
+    staleTime: 10_000,
+    refetchInterval: 15_000,
+  })
+}
+
+export function useTicketShares(ticketId: TicketId | null | undefined) {
+  return useQuery({
+    queryKey: ticketId ? ticketsKeys.shares(ticketId) : ['tickets', 'shares', 'none'],
+    queryFn: () => listSharesFn({ data: { ticketId: ticketId! } }),
+    enabled: !!ticketId,
+    staleTime: 30_000,
+  })
+}
+
+export function useTicketParticipants(ticketId: TicketId | null | undefined) {
+  return useQuery({
+    queryKey: ticketId ? ticketsKeys.participants(ticketId) : ['tickets', 'participants', 'none'],
+    queryFn: () => listParticipantsFn({ data: { ticketId: ticketId! } }),
+    enabled: !!ticketId,
+    staleTime: 30_000,
+  })
+}
+
+export function useTicketStatuses(enabled = true) {
+  return useQuery({
+    queryKey: ticketsKeys.statuses(),
+    queryFn: () => listTicketStatusesFn(),
+    enabled,
+    staleTime: 5 * 60_000,
+  })
+}
diff --git a/apps/web/src/lib/client/hooks/use-webhook-deliveries-queries.ts b/apps/web/src/lib/client/hooks/use-webhook-deliveries-queries.ts
new file mode 100644
index 000000000..c0deefb9d
--- /dev/null
+++ b/apps/web/src/lib/client/hooks/use-webhook-deliveries-queries.ts
@@ -0,0 +1,40 @@
+/**
+ * Webhook deliveries query hook (admin-only inspector).
+ */
+import { useInfiniteQuery } from '@tanstack/react-query'
+import type { WebhookId } from '@quackback/ids'
+import { listWebhookDeliveriesFn } from '@/lib/server/functions/webhook-deliveries'
+
+type DeliveryStatus = 'queued' | 'success' | 'failed_retryable' | 'failed_terminal' | 'blocked_ssrf'
+
+export const webhookDeliveriesKeys = {
+  all: ['webhookDeliveries'] as const,
+  list: (webhookId: WebhookId, status?: DeliveryStatus) =>
+    [...webhookDeliveriesKeys.all, webhookId, status ?? 'all'] as const,
+}
+
+export function useWebhookDeliveries(
+  webhookId: WebhookId | null | undefined,
+  options: { status?: DeliveryStatus; enabled?: boolean } = {}
+) {
+  return useInfiniteQuery({
+    queryKey: webhookId
+      ? webhookDeliveriesKeys.list(webhookId, options.status)
+      : ['webhookDeliveries', 'none'],
+    initialPageParam: null as { cursorAttemptedAt: string; cursorId: string } | null,
+    queryFn: ({ pageParam }) =>
+      listWebhookDeliveriesFn({
+        data: {
+          webhookId: webhookId!,
+          status: options.status,
+          cursorAttemptedAt: pageParam?.cursorAttemptedAt,
+          cursorId: pageParam?.cursorId,
+          limit: 50,
+        },
+      }),
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    getNextPageParam: (last: any) => last?.nextCursor ?? undefined,
+    enabled: !!webhookId && (options.enabled ?? true),
+    staleTime: 15_000,
+  })
+}
diff --git a/apps/web/src/lib/client/queries/__tests__/contacts.diffcov.test.ts b/apps/web/src/lib/client/queries/__tests__/contacts.diffcov.test.ts
new file mode 100644
index 000000000..48c9590f3
--- /dev/null
+++ b/apps/web/src/lib/client/queries/__tests__/contacts.diffcov.test.ts
@@ -0,0 +1,150 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ContactId, OrganizationId } from '@quackback/ids'
+
+const mocks = vi.hoisted(() => ({
+  searchContactsFn: vi.fn(),
+  listContactsForOrganizationFn: vi.fn(),
+  getContactFn: vi.fn(),
+  listLinksForContactFn: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/contacts', () => ({
+  searchContactsFn: (input: unknown) => mocks.searchContactsFn(input),
+  listContactsForOrganizationFn: (input: unknown) => mocks.listContactsForOrganizationFn(input),
+  getContactFn: (input: unknown) => mocks.getContactFn(input),
+  listLinksForContactFn: (input: unknown) => mocks.listLinksForContactFn(input),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  queryOptions: (options: unknown) => options,
+}))
+
+import { contactQueries } from '../contacts'
+
+const orgId = 'organization_1' as OrganizationId
+const contactId = 'contact_1' as ContactId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('contactQueries.all', () => {
+  it('exposes the root key', () => {
+    expect(contactQueries.all).toEqual(['contacts'])
+  })
+})
+
+describe('contactQueries.search', () => {
+  it('defaults to an empty filter object and omits blank query/email', async () => {
+    const options = contactQueries.search()
+    expect(options.queryKey).toEqual(['contacts', 'search', {}])
+    expect(options.staleTime).toBe(30_000)
+
+    mocks.searchContactsFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.searchContactsFn).toHaveBeenCalledWith({
+      data: {
+        query: undefined,
+        email: undefined,
+        organizationId: undefined,
+        includeArchived: undefined,
+        limit: 100,
+      },
+    })
+  })
+
+  it('trims and forwards a populated query, email and organization filter', async () => {
+    const filters = {
+      query: '  alice  ',
+      email: '  a@b.com  ',
+      organizationId: orgId,
+      includeArchived: true,
+    }
+    const options = contactQueries.search(filters)
+    expect(options.queryKey).toEqual(['contacts', 'search', filters])
+
+    mocks.searchContactsFn.mockResolvedValueOnce([{ id: contactId }])
+    await options.queryFn!({} as never)
+
+    expect(mocks.searchContactsFn).toHaveBeenCalledWith({
+      data: {
+        query: 'alice',
+        email: 'a@b.com',
+        organizationId: orgId,
+        includeArchived: true,
+        limit: 100,
+      },
+    })
+  })
+
+  it('collapses whitespace-only query/email to undefined', async () => {
+    const options = contactQueries.search({ query: '   ', email: '   ' })
+
+    mocks.searchContactsFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.searchContactsFn).toHaveBeenCalledWith({
+      data: {
+        query: undefined,
+        email: undefined,
+        organizationId: undefined,
+        includeArchived: undefined,
+        limit: 100,
+      },
+    })
+  })
+})
+
+describe('contactQueries.byOrg', () => {
+  it('builds the org-scoped query with default filters', async () => {
+    const options = contactQueries.byOrg(orgId)
+    expect(options.queryKey).toEqual(['contacts', 'byOrg', orgId, {}])
+    expect(options.staleTime).toBe(30_000)
+
+    mocks.listContactsForOrganizationFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listContactsForOrganizationFn).toHaveBeenCalledWith({
+      data: { organizationId: orgId, includeArchived: undefined, limit: 200 },
+    })
+  })
+
+  it('forwards includeArchived when provided', async () => {
+    const options = contactQueries.byOrg(orgId, { includeArchived: true })
+    expect(options.queryKey).toEqual(['contacts', 'byOrg', orgId, { includeArchived: true }])
+
+    mocks.listContactsForOrganizationFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listContactsForOrganizationFn).toHaveBeenCalledWith({
+      data: { organizationId: orgId, includeArchived: true, limit: 200 },
+    })
+  })
+})
+
+describe('contactQueries.detail', () => {
+  it('builds the detail query and calls getContactFn', async () => {
+    const options = contactQueries.detail(contactId)
+    expect(options.queryKey).toEqual(['contacts', 'detail', contactId])
+    expect(options.staleTime).toBe(30_000)
+
+    mocks.getContactFn.mockResolvedValueOnce({ id: contactId })
+    await options.queryFn!({} as never)
+
+    expect(mocks.getContactFn).toHaveBeenCalledWith({ data: { contactId } })
+  })
+})
+
+describe('contactQueries.links', () => {
+  it('builds the links query and calls listLinksForContactFn', async () => {
+    const options = contactQueries.links(contactId)
+    expect(options.queryKey).toEqual(['contacts', 'links', contactId])
+    expect(options.staleTime).toBe(30_000)
+
+    mocks.listLinksForContactFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listLinksForContactFn).toHaveBeenCalledWith({ data: { contactId } })
+  })
+})
diff --git a/apps/web/src/lib/client/queries/__tests__/inboxes.diffcov.test.ts b/apps/web/src/lib/client/queries/__tests__/inboxes.diffcov.test.ts
new file mode 100644
index 000000000..ef199f1d8
--- /dev/null
+++ b/apps/web/src/lib/client/queries/__tests__/inboxes.diffcov.test.ts
@@ -0,0 +1,87 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { InboxId } from '@quackback/ids'
+
+const mocks = vi.hoisted(() => ({
+  listInboxesFn: vi.fn(),
+  getInboxFn: vi.fn(),
+  listInboxChannelsFn: vi.fn(),
+  listInboxMembershipsFn: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/inboxes', () => ({
+  listInboxesFn: (input: unknown) => mocks.listInboxesFn(input),
+  getInboxFn: (input: unknown) => mocks.getInboxFn(input),
+  listInboxChannelsFn: (input: unknown) => mocks.listInboxChannelsFn(input),
+  listInboxMembershipsFn: (input: unknown) => mocks.listInboxMembershipsFn(input),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  queryOptions: (options: unknown) => options,
+}))
+
+import { inboxQueries } from '../inboxes'
+
+const inboxId = 'inbox_1' as InboxId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('inboxQueries.list', () => {
+  it('defaults to an empty params object and forwards it', async () => {
+    const options = inboxQueries.list()
+    expect(options.queryKey).toEqual(['inboxes', 'list', {}])
+    expect(options.staleTime).toBe(30_000)
+
+    mocks.listInboxesFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listInboxesFn).toHaveBeenCalledWith({ data: {} })
+  })
+
+  it('forwards includeArchived when provided', async () => {
+    const options = inboxQueries.list({ includeArchived: true })
+    expect(options.queryKey).toEqual(['inboxes', 'list', { includeArchived: true }])
+
+    mocks.listInboxesFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listInboxesFn).toHaveBeenCalledWith({ data: { includeArchived: true } })
+  })
+})
+
+describe('inboxQueries.detail', () => {
+  it('builds the detail query and calls getInboxFn', async () => {
+    const options = inboxQueries.detail(inboxId)
+    expect(options.queryKey).toEqual(['inboxes', 'detail', inboxId])
+
+    mocks.getInboxFn.mockResolvedValueOnce({ id: inboxId })
+    await options.queryFn!({} as never)
+
+    expect(mocks.getInboxFn).toHaveBeenCalledWith({ data: { inboxId } })
+  })
+})
+
+describe('inboxQueries.channels', () => {
+  it('builds the channels query and calls listInboxChannelsFn', async () => {
+    const options = inboxQueries.channels(inboxId)
+    expect(options.queryKey).toEqual(['inboxes', 'channels', inboxId])
+
+    mocks.listInboxChannelsFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listInboxChannelsFn).toHaveBeenCalledWith({ data: { inboxId } })
+  })
+})
+
+describe('inboxQueries.memberships', () => {
+  it('builds the memberships query and calls listInboxMembershipsFn', async () => {
+    const options = inboxQueries.memberships(inboxId)
+    expect(options.queryKey).toEqual(['inboxes', 'memberships', inboxId])
+
+    mocks.listInboxMembershipsFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listInboxMembershipsFn).toHaveBeenCalledWith({ data: { inboxId } })
+  })
+})
diff --git a/apps/web/src/lib/client/queries/__tests__/organizations.diffcov.test.ts b/apps/web/src/lib/client/queries/__tests__/organizations.diffcov.test.ts
new file mode 100644
index 000000000..60e421704
--- /dev/null
+++ b/apps/web/src/lib/client/queries/__tests__/organizations.diffcov.test.ts
@@ -0,0 +1,81 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { OrganizationId } from '@quackback/ids'
+
+const mocks = vi.hoisted(() => ({
+  listOrganizationsFn: vi.fn(),
+  getOrganizationFn: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/organizations', () => ({
+  listOrganizationsFn: (input: unknown) => mocks.listOrganizationsFn(input),
+  getOrganizationFn: (input: unknown) => mocks.getOrganizationFn(input),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  queryOptions: (options: unknown) => options,
+}))
+
+import { organizationQueries } from '../organizations'
+
+const organizationId = 'org_1' as OrganizationId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('organizationQueries.all', () => {
+  it('exposes the root key', () => {
+    expect(organizationQueries.all).toEqual(['organizations'])
+  })
+})
+
+describe('organizationQueries.list', () => {
+  it('defaults to empty filters and omits a blank search', async () => {
+    const options = organizationQueries.list()
+    expect(options.queryKey).toEqual(['organizations', 'list', {}])
+    expect(options.staleTime).toBe(30_000)
+
+    mocks.listOrganizationsFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listOrganizationsFn).toHaveBeenCalledWith({
+      data: { search: undefined, includeArchived: undefined, limit: 200 },
+    })
+  })
+
+  it('collapses a whitespace-only search to undefined', async () => {
+    const options = organizationQueries.list({ search: '   ' })
+
+    mocks.listOrganizationsFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listOrganizationsFn).toHaveBeenCalledWith({
+      data: { search: undefined, includeArchived: undefined, limit: 200 },
+    })
+  })
+
+  it('trims a populated search and forwards includeArchived', async () => {
+    const filters = { search: '  acme  ', includeArchived: true }
+    const options = organizationQueries.list(filters)
+    expect(options.queryKey).toEqual(['organizations', 'list', filters])
+
+    mocks.listOrganizationsFn.mockResolvedValueOnce([{ id: organizationId }])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listOrganizationsFn).toHaveBeenCalledWith({
+      data: { search: 'acme', includeArchived: true, limit: 200 },
+    })
+  })
+})
+
+describe('organizationQueries.detail', () => {
+  it('builds the detail query and calls getOrganizationFn', async () => {
+    const options = organizationQueries.detail(organizationId)
+    expect(options.queryKey).toEqual(['organizations', 'detail', organizationId])
+
+    mocks.getOrganizationFn.mockResolvedValueOnce({ id: organizationId })
+    await options.queryFn!({} as never)
+
+    expect(mocks.getOrganizationFn).toHaveBeenCalledWith({ data: { organizationId } })
+  })
+})
diff --git a/apps/web/src/lib/client/queries/__tests__/portal-tickets.diffcov.test.ts b/apps/web/src/lib/client/queries/__tests__/portal-tickets.diffcov.test.ts
new file mode 100644
index 000000000..f761368e2
--- /dev/null
+++ b/apps/web/src/lib/client/queries/__tests__/portal-tickets.diffcov.test.ts
@@ -0,0 +1,269 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TicketId } from '@quackback/ids'
+
+const mocks = vi.hoisted(() => ({
+  listMyTicketsFn: vi.fn(),
+  getMyTicketFn: vi.fn(),
+  replyToMyTicketFn: vi.fn(),
+  createMyTicketFn: vi.fn(),
+  invalidateQueries: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/portal-tickets', () => ({
+  listMyTicketsFn: (input: unknown) => mocks.listMyTicketsFn(input),
+  getMyTicketFn: (input: unknown) => mocks.getMyTicketFn(input),
+  replyToMyTicketFn: (input: unknown) => mocks.replyToMyTicketFn(input),
+  createMyTicketFn: (input: unknown) => mocks.createMyTicketFn(input),
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: (...args: unknown[]) => mocks.toastSuccess(...args),
+    error: (...args: unknown[]) => mocks.toastError(...args),
+  },
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  queryOptions: (options: unknown) => options,
+  useMutation: (options: unknown) => options,
+  useQueryClient: () => ({ invalidateQueries: mocks.invalidateQueries }),
+}))
+
+import { portalTicketQueries, useReplyToMyTicket, useCreateMyTicket } from '../portal-tickets'
+
+const ticketId = 'ticket_abc' as TicketId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('portalTicketQueries.list', () => {
+  it('uses the "all" key when no statusCategory is given and maps rows into Date instances', async () => {
+    const options = portalTicketQueries.list()
+    expect(options.queryKey).toEqual(['portal', 'tickets', 'list', 'all'])
+
+    mocks.listMyTicketsFn.mockResolvedValueOnce({
+      rows: [
+        {
+          id: ticketId,
+          subject: 'Need help',
+          statusName: 'Open',
+          statusCategory: 'open',
+          statusColor: '#fff',
+          lastActivityAt: '2026-01-02T00:00:00.000Z',
+          createdAt: '2026-01-01T00:00:00.000Z',
+        },
+      ],
+      total: 1,
+    })
+
+    const result = (await options.queryFn!({} as never)) as {
+      rows: Array<{ lastActivityAt: Date; createdAt: Date; statusColor: string | null }>
+      total: number
+    }
+
+    expect(mocks.listMyTicketsFn).toHaveBeenCalledWith({
+      data: { statusCategory: undefined },
+    })
+    expect(result.total).toBe(1)
+    expect(result.rows[0].lastActivityAt).toBeInstanceOf(Date)
+    expect(result.rows[0].createdAt).toBeInstanceOf(Date)
+    expect(result.rows[0].statusColor).toBe('#fff')
+  })
+
+  it('passes the provided statusCategory through to the key and the server fn', async () => {
+    const options = portalTicketQueries.list({ statusCategory: 'solved' })
+    expect(options.queryKey).toEqual(['portal', 'tickets', 'list', 'solved'])
+
+    mocks.listMyTicketsFn.mockResolvedValueOnce({ rows: [], total: 0 })
+
+    const result = (await options.queryFn!({} as never)) as { rows: unknown[]; total: number }
+
+    expect(mocks.listMyTicketsFn).toHaveBeenCalledWith({
+      data: { statusCategory: 'solved' },
+    })
+    expect(result.rows).toEqual([])
+    expect(result.total).toBe(0)
+  })
+})
+
+describe('portalTicketQueries.detail', () => {
+  it('revives ticket and thread dates, including a non-null editedAt', async () => {
+    const options = portalTicketQueries.detail(ticketId)
+    expect(options.queryKey).toEqual(['portal', 'tickets', 'detail', ticketId])
+
+    mocks.getMyTicketFn.mockResolvedValueOnce({
+      ticket: {
+        id: ticketId,
+        subject: 'Hello',
+        createdAt: '2026-01-01T00:00:00.000Z',
+        lastActivityAt: '2026-01-03T00:00:00.000Z',
+      },
+      threads: [
+        {
+          id: 'thread_1',
+          createdAt: '2026-01-02T00:00:00.000Z',
+          editedAt: '2026-01-02T01:00:00.000Z',
+        },
+      ],
+      principalNames: { p1: 'Alice' },
+      viewerPrincipalId: 'p1',
+      viewerRelationship: 'requester',
+    })
+
+    const result = (await options.queryFn!({} as never)) as {
+      ticket: { createdAt: Date; lastActivityAt: Date }
+      threads: Array<{ ticketId: TicketId; createdAt: Date; editedAt: Date | null }>
+      principalNames: Record<string, string>
+      viewerPrincipalId: string
+      viewerRelationship: string
+    }
+
+    expect(mocks.getMyTicketFn).toHaveBeenCalledWith({ data: { ticketId } })
+    expect(result.ticket.createdAt).toBeInstanceOf(Date)
+    expect(result.ticket.lastActivityAt).toBeInstanceOf(Date)
+    expect(result.threads[0].ticketId).toBe(ticketId)
+    expect(result.threads[0].createdAt).toBeInstanceOf(Date)
+    expect(result.threads[0].editedAt).toBeInstanceOf(Date)
+    expect(result.principalNames).toEqual({ p1: 'Alice' })
+    expect(result.viewerPrincipalId).toBe('p1')
+    expect(result.viewerRelationship).toBe('requester')
+  })
+
+  it('keeps editedAt null when the thread was never edited', async () => {
+    const options = portalTicketQueries.detail(ticketId)
+
+    mocks.getMyTicketFn.mockResolvedValueOnce({
+      ticket: {
+        id: ticketId,
+        createdAt: '2026-01-01T00:00:00.000Z',
+        lastActivityAt: '2026-01-03T00:00:00.000Z',
+      },
+      threads: [{ id: 'thread_2', createdAt: '2026-01-02T00:00:00.000Z', editedAt: null }],
+      principalNames: {},
+      viewerPrincipalId: 'p1',
+      viewerRelationship: 'requester',
+    })
+
+    const result = (await options.queryFn!({} as never)) as {
+      threads: Array<{ editedAt: Date | null }>
+    }
+
+    expect(result.threads[0].editedAt).toBeNull()
+  })
+})
+
+describe('useReplyToMyTicket', () => {
+  it('forwards normalized payload, invalidates caches and toasts on success', async () => {
+    const mutation = useReplyToMyTicket(ticketId) as unknown as {
+      mutationFn: (input: { bodyJson?: unknown; bodyText?: string | null }) => unknown
+      onSuccess: () => void
+      onError: (e: Error) => void
+    }
+
+    mocks.replyToMyTicketFn.mockResolvedValueOnce({ ok: true })
+    await mutation.mutationFn({ bodyJson: { type: 'doc' }, bodyText: 'hi' })
+    expect(mocks.replyToMyTicketFn).toHaveBeenCalledWith({
+      data: { ticketId, bodyJson: { type: 'doc' }, bodyText: 'hi' },
+    })
+
+    mutation.onSuccess()
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['portal', 'tickets', 'detail', ticketId],
+    })
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['portal', 'tickets', 'list'],
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Reply sent')
+  })
+
+  it('defaults missing body fields to null', async () => {
+    const mutation = useReplyToMyTicket(ticketId) as unknown as {
+      mutationFn: (input: { bodyJson?: unknown; bodyText?: string | null }) => unknown
+    }
+    mocks.replyToMyTicketFn.mockResolvedValueOnce({ ok: true })
+    await mutation.mutationFn({})
+    expect(mocks.replyToMyTicketFn).toHaveBeenCalledWith({
+      data: { ticketId, bodyJson: null, bodyText: null },
+    })
+  })
+
+  it('shows the error message on failure', () => {
+    const mutation = useReplyToMyTicket(ticketId) as unknown as { onError: (e: Error) => void }
+    mutation.onError(new Error('boom'))
+    expect(mocks.toastError).toHaveBeenCalledWith('boom')
+  })
+
+  it('falls back to a generic message when the error has no message', () => {
+    const mutation = useReplyToMyTicket(ticketId) as unknown as { onError: (e: Error) => void }
+    mutation.onError(new Error(''))
+    expect(mocks.toastError).toHaveBeenCalledWith('Failed to send reply')
+  })
+})
+
+describe('useCreateMyTicket', () => {
+  it('forwards normalized payload, invalidates the list and toasts on success', async () => {
+    const mutation = useCreateMyTicket() as unknown as {
+      mutationFn: (input: {
+        subject: string
+        descriptionJson?: unknown
+        descriptionText?: string | null
+        priority?: 'low' | 'normal' | 'high' | 'urgent'
+      }) => unknown
+      onSuccess: () => void
+      onError: (e: Error) => void
+    }
+
+    mocks.createMyTicketFn.mockResolvedValueOnce({ id: ticketId })
+    await mutation.mutationFn({
+      subject: 'Subject',
+      descriptionJson: { type: 'doc' },
+      descriptionText: 'desc',
+      priority: 'high',
+    })
+    expect(mocks.createMyTicketFn).toHaveBeenCalledWith({
+      data: {
+        subject: 'Subject',
+        descriptionJson: { type: 'doc' },
+        descriptionText: 'desc',
+        priority: 'high',
+      },
+    })
+
+    mutation.onSuccess()
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['portal', 'tickets', 'list'],
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Ticket created')
+  })
+
+  it('defaults missing description fields to null', async () => {
+    const mutation = useCreateMyTicket() as unknown as {
+      mutationFn: (input: { subject: string }) => unknown
+    }
+    mocks.createMyTicketFn.mockResolvedValueOnce({ id: ticketId })
+    await mutation.mutationFn({ subject: 'Only subject' })
+    expect(mocks.createMyTicketFn).toHaveBeenCalledWith({
+      data: {
+        subject: 'Only subject',
+        descriptionJson: null,
+        descriptionText: null,
+        priority: undefined,
+      },
+    })
+  })
+
+  it('shows the error message on failure', () => {
+    const mutation = useCreateMyTicket() as unknown as { onError: (e: Error) => void }
+    mutation.onError(new Error('nope'))
+    expect(mocks.toastError).toHaveBeenCalledWith('nope')
+  })
+
+  it('falls back to a generic message when the error has no message', () => {
+    const mutation = useCreateMyTicket() as unknown as { onError: (e: Error) => void }
+    mutation.onError(new Error(''))
+    expect(mocks.toastError).toHaveBeenCalledWith('Failed to create ticket')
+  })
+})
diff --git a/apps/web/src/lib/client/queries/__tests__/sla.diffcov.test.ts b/apps/web/src/lib/client/queries/__tests__/sla.diffcov.test.ts
new file mode 100644
index 000000000..27a3b4280
--- /dev/null
+++ b/apps/web/src/lib/client/queries/__tests__/sla.diffcov.test.ts
@@ -0,0 +1,73 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { SlaPolicyId } from '@quackback/ids'
+
+const mocks = vi.hoisted(() => ({
+  listSlaPoliciesFn: vi.fn(),
+  getSlaPolicyFn: vi.fn(),
+  listEscalationRulesFn: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/sla', () => ({
+  listSlaPoliciesFn: (input: unknown) => mocks.listSlaPoliciesFn(input),
+  getSlaPolicyFn: (input: unknown) => mocks.getSlaPolicyFn(input),
+  listEscalationRulesFn: (input: unknown) => mocks.listEscalationRulesFn(input),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  queryOptions: (options: unknown) => options,
+}))
+
+import { slaQueries } from '../sla'
+
+const policyId = 'sla_pol_1' as SlaPolicyId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('slaQueries.policies', () => {
+  it('defaults to an empty params object and forwards it', async () => {
+    const options = slaQueries.policies()
+    expect(options.queryKey).toEqual(['sla', 'policies', {}])
+    expect(options.staleTime).toBe(30_000)
+
+    mocks.listSlaPoliciesFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listSlaPoliciesFn).toHaveBeenCalledWith({ data: {} })
+  })
+
+  it('forwards includeArchived when provided', async () => {
+    const options = slaQueries.policies({ includeArchived: true })
+    expect(options.queryKey).toEqual(['sla', 'policies', { includeArchived: true }])
+
+    mocks.listSlaPoliciesFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listSlaPoliciesFn).toHaveBeenCalledWith({ data: { includeArchived: true } })
+  })
+})
+
+describe('slaQueries.policy', () => {
+  it('builds the policy query and calls getSlaPolicyFn', async () => {
+    const options = slaQueries.policy(policyId)
+    expect(options.queryKey).toEqual(['sla', 'policy', policyId])
+
+    mocks.getSlaPolicyFn.mockResolvedValueOnce({ id: policyId })
+    await options.queryFn!({} as never)
+
+    expect(mocks.getSlaPolicyFn).toHaveBeenCalledWith({ data: { id: policyId } })
+  })
+})
+
+describe('slaQueries.escalations', () => {
+  it('builds the escalations query and calls listEscalationRulesFn', async () => {
+    const options = slaQueries.escalations(policyId)
+    expect(options.queryKey).toEqual(['sla', 'escalations', policyId])
+
+    mocks.listEscalationRulesFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listEscalationRulesFn).toHaveBeenCalledWith({ data: { policyId } })
+  })
+})
diff --git a/apps/web/src/lib/client/queries/__tests__/teams.diffcov.test.ts b/apps/web/src/lib/client/queries/__tests__/teams.diffcov.test.ts
new file mode 100644
index 000000000..b069c36c8
--- /dev/null
+++ b/apps/web/src/lib/client/queries/__tests__/teams.diffcov.test.ts
@@ -0,0 +1,79 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TeamId } from '@quackback/ids'
+
+const mocks = vi.hoisted(() => ({
+  listTeamsFn: vi.fn(),
+  getTeamFn: vi.fn(),
+  listTeamMembersFn: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/teams', () => ({
+  listTeamsFn: (input: unknown) => mocks.listTeamsFn(input),
+  getTeamFn: (input: unknown) => mocks.getTeamFn(input),
+  listTeamMembersFn: (input: unknown) => mocks.listTeamMembersFn(input),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  queryOptions: (options: unknown) => options,
+}))
+
+import { teamQueries } from '../teams'
+
+const teamId = 'team_1' as TeamId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('teamQueries.all', () => {
+  it('exposes the root key', () => {
+    expect(teamQueries.all).toEqual(['teams'])
+  })
+})
+
+describe('teamQueries.list', () => {
+  it('defaults to empty filters and forwards an undefined includeArchived', async () => {
+    const options = teamQueries.list()
+    expect(options.queryKey).toEqual(['teams', 'list', {}])
+    expect(options.staleTime).toBe(30_000)
+
+    mocks.listTeamsFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listTeamsFn).toHaveBeenCalledWith({ data: { includeArchived: undefined } })
+  })
+
+  it('forwards includeArchived when provided', async () => {
+    const options = teamQueries.list({ includeArchived: true })
+    expect(options.queryKey).toEqual(['teams', 'list', { includeArchived: true }])
+
+    mocks.listTeamsFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listTeamsFn).toHaveBeenCalledWith({ data: { includeArchived: true } })
+  })
+})
+
+describe('teamQueries.detail', () => {
+  it('builds the detail query and calls getTeamFn', async () => {
+    const options = teamQueries.detail(teamId)
+    expect(options.queryKey).toEqual(['teams', 'detail', teamId])
+
+    mocks.getTeamFn.mockResolvedValueOnce({ id: teamId })
+    await options.queryFn!({} as never)
+
+    expect(mocks.getTeamFn).toHaveBeenCalledWith({ data: { teamId } })
+  })
+})
+
+describe('teamQueries.members', () => {
+  it('builds the members query and calls listTeamMembersFn', async () => {
+    const options = teamQueries.members(teamId)
+    expect(options.queryKey).toEqual(['teams', 'members', teamId])
+
+    mocks.listTeamMembersFn.mockResolvedValueOnce([])
+    await options.queryFn!({} as never)
+
+    expect(mocks.listTeamMembersFn).toHaveBeenCalledWith({ data: { teamId } })
+  })
+})
diff --git a/apps/web/src/lib/client/queries/__tests__/webhook-deliveries.diffcov.test.ts b/apps/web/src/lib/client/queries/__tests__/webhook-deliveries.diffcov.test.ts
new file mode 100644
index 000000000..6d7762c62
--- /dev/null
+++ b/apps/web/src/lib/client/queries/__tests__/webhook-deliveries.diffcov.test.ts
@@ -0,0 +1,82 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { WebhookId } from '@quackback/ids'
+
+const mocks = vi.hoisted(() => ({
+  listWebhookDeliveriesFn: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/webhook-deliveries', () => ({
+  listWebhookDeliveriesFn: (input: unknown) => mocks.listWebhookDeliveriesFn(input),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  infiniteQueryOptions: (options: unknown) => options,
+}))
+
+import { webhookDeliveryQueries } from '../webhook-deliveries'
+
+const webhookId = 'webhook_1' as WebhookId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('webhookDeliveryQueries.all', () => {
+  it('exposes the root key', () => {
+    expect(webhookDeliveryQueries.all).toEqual(['webhook-deliveries'])
+  })
+})
+
+describe('webhookDeliveryQueries.list', () => {
+  it('defaults to empty filters and forwards an undefined cursor', async () => {
+    const options = webhookDeliveryQueries.list(webhookId)
+    expect(options.queryKey).toEqual(['webhook-deliveries', 'list', webhookId, {}])
+    expect(options.staleTime).toBe(15_000)
+
+    mocks.listWebhookDeliveriesFn.mockResolvedValueOnce({ rows: [], nextCursor: null })
+    await options.queryFn!({ pageParam: undefined } as never)
+
+    expect(mocks.listWebhookDeliveriesFn).toHaveBeenCalledWith({
+      data: {
+        webhookId,
+        limit: 50,
+        status: undefined,
+        cursorAttemptedAt: undefined,
+        cursorId: undefined,
+      },
+    })
+  })
+
+  it('forwards the status filter and a populated cursor', async () => {
+    const filters = { status: 'failed_terminal' as const }
+    const options = webhookDeliveryQueries.list(webhookId, filters)
+    expect(options.queryKey).toEqual(['webhook-deliveries', 'list', webhookId, filters])
+
+    mocks.listWebhookDeliveriesFn.mockResolvedValueOnce({ rows: [], nextCursor: null })
+    await options.queryFn!({
+      pageParam: { cursorAttemptedAt: '2026-01-01T00:00:00.000Z', cursorId: 'd1' },
+    } as never)
+
+    expect(mocks.listWebhookDeliveriesFn).toHaveBeenCalledWith({
+      data: {
+        webhookId,
+        limit: 50,
+        status: 'failed_terminal',
+        cursorAttemptedAt: '2026-01-01T00:00:00.000Z',
+        cursorId: 'd1',
+      },
+    })
+  })
+
+  it('reads the next cursor and falls back to undefined when null', () => {
+    const options = webhookDeliveryQueries.list(webhookId)
+    const cursor = { cursorAttemptedAt: '2026-01-02T00:00:00.000Z', cursorId: 'd2' }
+
+    expect(
+      (options.getNextPageParam as (p: unknown) => unknown)({ nextCursor: cursor } as never)
+    ).toEqual(cursor)
+    expect(
+      (options.getNextPageParam as (p: unknown) => unknown)({ nextCursor: null } as never)
+    ).toBeUndefined()
+  })
+})
diff --git a/apps/web/src/lib/client/queries/audit.ts b/apps/web/src/lib/client/queries/audit.ts
new file mode 100644
index 000000000..61e4e3ec0
--- /dev/null
+++ b/apps/web/src/lib/client/queries/audit.ts
@@ -0,0 +1,85 @@
+/**
+ * Audit log queries — cursor-paged unified event feed + distinct-actions list.
+ */
+import { infiniteQueryOptions, queryOptions } from '@tanstack/react-query'
+import type { PrincipalId } from '@quackback/ids'
+import { listUnifiedAuditEventsFn, getUnifiedAuditActionsFn } from '@/lib/server/functions/audit'
+
+export type AuditSourceFilter = 'web' | 'api' | 'integration' | 'system' | 'mcp'
+export type AuditOriginFilter = 'workspace' | 'security'
+export type AuditTimeRange = '7d' | '30d' | '90d' | 'all' | 'custom'
+
+export interface AuditFilters {
+  origin?: AuditOriginFilter
+  principalId?: PrincipalId | null
+  actorEmail?: string
+  /** Exact match on action/event type. Mutually exclusive with `actionPrefix`. */
+  action?: string
+  /** Prefix match (`like 'foo%'`) on action/event type. */
+  actionPrefix?: string
+  targetType?: string
+  targetId?: string
+  source?: AuditSourceFilter
+  /** ISO datetime — inclusive lower bound. */
+  fromIso?: string
+  /** ISO datetime — inclusive upper bound. */
+  toIso?: string
+}
+
+export const DEFAULT_AUDIT_TIME_RANGE: AuditTimeRange = '30d'
+export const DEFAULT_EXCLUDED_SECURITY_ACTIONS = ['portal.widget_handshake.consumed'] as const
+
+const STALE = 15_000
+const ACTIONS_STALE = 5 * 60_000
+
+export function rangeToFromIso(range: AuditTimeRange): string | undefined {
+  if (range === 'all' || range === 'custom') return undefined
+  const days = range === '7d' ? 7 : range === '30d' ? 30 : 90
+  const minuteMs = 60 * 1000
+  const now = Math.floor(Date.now() / minuteMs) * minuteMs
+  return new Date(now - days * 24 * 60 * 60 * 1000).toISOString()
+}
+
+export function defaultAuditFilters(): AuditFilters {
+  return {
+    fromIso: rangeToFromIso(DEFAULT_AUDIT_TIME_RANGE),
+  }
+}
+
+export const auditQueries = {
+  all: ['audit'] as const,
+  list: (filters: AuditFilters = {}) =>
+    infiniteQueryOptions({
+      queryKey: ['audit', 'list', filters] as const,
+      queryFn: ({ pageParam }) =>
+        listUnifiedAuditEventsFn({
+          data: {
+            origin: filters.origin,
+            principalId: filters.principalId ?? undefined,
+            actorEmail: filters.actorEmail,
+            action: filters.action,
+            actionPrefix: filters.actionPrefix,
+            targetType: filters.targetType,
+            targetId: filters.targetId,
+            source: filters.source,
+            from: filters.fromIso,
+            to: filters.toIso,
+            cursor: (pageParam as string | undefined) ?? undefined,
+            limit: 50,
+            excludeSecurityActions:
+              filters.action || filters.actionPrefix
+                ? undefined
+                : [...DEFAULT_EXCLUDED_SECURITY_ACTIONS],
+          },
+        }),
+      initialPageParam: undefined as string | undefined,
+      getNextPageParam: (last) => (last as { nextCursor?: string | null }).nextCursor ?? undefined,
+      staleTime: STALE,
+    }),
+  actions: () =>
+    queryOptions({
+      queryKey: ['audit', 'actions'] as const,
+      queryFn: () => getUnifiedAuditActionsFn(),
+      staleTime: ACTIONS_STALE,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/business-hours.ts b/apps/web/src/lib/client/queries/business-hours.ts
new file mode 100644
index 000000000..8b2ecfffe
--- /dev/null
+++ b/apps/web/src/lib/client/queries/business-hours.ts
@@ -0,0 +1,21 @@
+/**
+ * Query factory for business-hours admin reads.
+ */
+import { queryOptions } from '@tanstack/react-query'
+import type { BusinessHoursId } from '@quackback/ids'
+import { listBusinessHoursFn, getBusinessHoursFn } from '@/lib/server/functions/sla'
+
+export const businessHoursQueries = {
+  list: (params: { includeArchived?: boolean } = {}) =>
+    queryOptions({
+      queryKey: ['business-hours', 'list', params] as const,
+      queryFn: () => listBusinessHoursFn({ data: params }),
+      staleTime: 30_000,
+    }),
+  detail: (id: BusinessHoursId) =>
+    queryOptions({
+      queryKey: ['business-hours', 'detail', id] as const,
+      queryFn: () => getBusinessHoursFn({ data: { id } }),
+      staleTime: 30_000,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/contacts.ts b/apps/web/src/lib/client/queries/contacts.ts
new file mode 100644
index 000000000..28667656e
--- /dev/null
+++ b/apps/web/src/lib/client/queries/contacts.ts
@@ -0,0 +1,64 @@
+/**
+ * Contact queries — search, byOrg, detail, links.
+ */
+import { queryOptions } from '@tanstack/react-query'
+import type { ContactId, OrganizationId } from '@quackback/ids'
+import {
+  searchContactsFn,
+  listContactsForOrganizationFn,
+  getContactFn,
+  listLinksForContactFn,
+} from '@/lib/server/functions/contacts'
+
+const STALE = 30_000
+
+export const contactQueries = {
+  all: ['contacts'] as const,
+  search: (
+    filters: {
+      query?: string
+      email?: string
+      organizationId?: OrganizationId
+      includeArchived?: boolean
+    } = {}
+  ) =>
+    queryOptions({
+      queryKey: ['contacts', 'search', filters] as const,
+      queryFn: () =>
+        searchContactsFn({
+          data: {
+            query: filters.query?.trim() || undefined,
+            email: filters.email?.trim() || undefined,
+            organizationId: filters.organizationId,
+            includeArchived: filters.includeArchived,
+            limit: 100,
+          },
+        }),
+      staleTime: STALE,
+    }),
+  byOrg: (organizationId: OrganizationId, filters: { includeArchived?: boolean } = {}) =>
+    queryOptions({
+      queryKey: ['contacts', 'byOrg', organizationId, filters] as const,
+      queryFn: () =>
+        listContactsForOrganizationFn({
+          data: {
+            organizationId,
+            includeArchived: filters.includeArchived,
+            limit: 200,
+          },
+        }),
+      staleTime: STALE,
+    }),
+  detail: (contactId: ContactId) =>
+    queryOptions({
+      queryKey: ['contacts', 'detail', contactId] as const,
+      queryFn: () => getContactFn({ data: { contactId } }),
+      staleTime: STALE,
+    }),
+  links: (contactId: ContactId) =>
+    queryOptions({
+      queryKey: ['contacts', 'links', contactId] as const,
+      queryFn: () => listLinksForContactFn({ data: { contactId } }),
+      staleTime: STALE,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/inboxes.ts b/apps/web/src/lib/client/queries/inboxes.ts
new file mode 100644
index 000000000..ec10e2b01
--- /dev/null
+++ b/apps/web/src/lib/client/queries/inboxes.ts
@@ -0,0 +1,40 @@
+/**
+ * TanStack Query factory for inbox admin reads. Mirrors `ticketQueries`:
+ * route loaders pre-fetch via `ensureQueryData`; components read via
+ * `useSuspenseQuery`.
+ */
+import { queryOptions } from '@tanstack/react-query'
+import type { InboxId } from '@quackback/ids'
+import {
+  listInboxesFn,
+  getInboxFn,
+  listInboxChannelsFn,
+  listInboxMembershipsFn,
+} from '@/lib/server/functions/inboxes'
+
+export const inboxQueries = {
+  list: (params: { includeArchived?: boolean } = {}) =>
+    queryOptions({
+      queryKey: ['inboxes', 'list', params] as const,
+      queryFn: () => listInboxesFn({ data: params }),
+      staleTime: 30_000,
+    }),
+  detail: (inboxId: InboxId) =>
+    queryOptions({
+      queryKey: ['inboxes', 'detail', inboxId] as const,
+      queryFn: () => getInboxFn({ data: { inboxId } }),
+      staleTime: 30_000,
+    }),
+  channels: (inboxId: InboxId) =>
+    queryOptions({
+      queryKey: ['inboxes', 'channels', inboxId] as const,
+      queryFn: () => listInboxChannelsFn({ data: { inboxId } }),
+      staleTime: 30_000,
+    }),
+  memberships: (inboxId: InboxId) =>
+    queryOptions({
+      queryKey: ['inboxes', 'memberships', inboxId] as const,
+      queryFn: () => listInboxMembershipsFn({ data: { inboxId } }),
+      staleTime: 30_000,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/organizations.ts b/apps/web/src/lib/client/queries/organizations.ts
new file mode 100644
index 000000000..c0ed22181
--- /dev/null
+++ b/apps/web/src/lib/client/queries/organizations.ts
@@ -0,0 +1,31 @@
+/**
+ * Organization queries — list (with search) + detail.
+ */
+import { queryOptions } from '@tanstack/react-query'
+import type { OrganizationId } from '@quackback/ids'
+import { listOrganizationsFn, getOrganizationFn } from '@/lib/server/functions/organizations'
+
+const STALE = 30_000
+
+export const organizationQueries = {
+  all: ['organizations'] as const,
+  list: (filters: { search?: string; includeArchived?: boolean } = {}) =>
+    queryOptions({
+      queryKey: ['organizations', 'list', filters] as const,
+      queryFn: () =>
+        listOrganizationsFn({
+          data: {
+            search: filters.search?.trim() || undefined,
+            includeArchived: filters.includeArchived,
+            limit: 200,
+          },
+        }),
+      staleTime: STALE,
+    }),
+  detail: (organizationId: OrganizationId) =>
+    queryOptions({
+      queryKey: ['organizations', 'detail', organizationId] as const,
+      queryFn: () => getOrganizationFn({ data: { organizationId } }),
+      staleTime: STALE,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/portal-tickets.ts b/apps/web/src/lib/client/queries/portal-tickets.ts
new file mode 100644
index 000000000..bdc428c6c
--- /dev/null
+++ b/apps/web/src/lib/client/queries/portal-tickets.ts
@@ -0,0 +1,131 @@
+import { queryOptions, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import {
+  listMyTicketsFn,
+  getMyTicketFn,
+  replyToMyTicketFn,
+  createMyTicketFn,
+} from '@/lib/server/functions/portal-tickets'
+import type { TicketId } from '@quackback/ids'
+import type { JSONContent } from '@tiptap/react'
+
+export type PortalStatusCategory = 'open' | 'pending' | 'on_hold' | 'solved' | 'closed'
+
+export interface PortalTicketRow {
+  id: TicketId
+  subject: string
+  statusName: string
+  statusCategory: PortalStatusCategory
+  statusColor: string | null
+  lastActivityAt: Date
+  createdAt: Date
+}
+
+/**
+ * Query factories for the portal tickets surface.
+ *
+ * Keys are flat tuples so list invalidation can use a prefix match. Server
+ * responses use ISO date strings; we revive into `Date` here so components
+ * can call `formatDistanceToNow` directly.
+ */
+export const portalTicketQueries = {
+  list: (params: { statusCategory?: PortalStatusCategory } = {}) =>
+    queryOptions({
+      queryKey: ['portal', 'tickets', 'list', params.statusCategory ?? 'all'] as const,
+      queryFn: async () => {
+        const data = await listMyTicketsFn({
+          data: { statusCategory: params.statusCategory },
+        })
+        return {
+          rows: data.rows.map(
+            (r): PortalTicketRow => ({
+              id: r.id,
+              subject: r.subject,
+              statusName: r.statusName,
+              statusCategory: r.statusCategory,
+              statusColor: r.statusColor,
+              lastActivityAt: new Date(r.lastActivityAt),
+              createdAt: new Date(r.createdAt),
+            })
+          ),
+          total: data.total,
+        }
+      },
+    }),
+
+  detail: (ticketId: TicketId) =>
+    queryOptions({
+      queryKey: ['portal', 'tickets', 'detail', ticketId] as const,
+      queryFn: async () => {
+        const data = await getMyTicketFn({ data: { ticketId } })
+        return {
+          ticket: {
+            ...data.ticket,
+            createdAt: new Date(data.ticket.createdAt),
+            lastActivityAt: new Date(data.ticket.lastActivityAt),
+          },
+          threads: data.threads.map((t) => ({
+            ...t,
+            ticketId,
+            createdAt: new Date(t.createdAt),
+            editedAt: t.editedAt ? new Date(t.editedAt) : null,
+          })),
+          principalNames: data.principalNames,
+          viewerPrincipalId: data.viewerPrincipalId,
+          viewerRelationship: data.viewerRelationship,
+        }
+      },
+    }),
+}
+
+/**
+ * Reply mutation. Invalidates both the affected detail key and the entire
+ * tickets-list namespace so any visible status filter refreshes.
+ */
+export function useReplyToMyTicket(ticketId: TicketId) {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (input: { bodyJson?: unknown; bodyText?: string | null }) =>
+      replyToMyTicketFn({
+        data: {
+          ticketId,
+          bodyJson: (input.bodyJson ?? null) as { type: 'doc'; content?: unknown[] } | null,
+          bodyText: input.bodyText ?? null,
+        },
+      }),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['portal', 'tickets', 'detail', ticketId] })
+      qc.invalidateQueries({ queryKey: ['portal', 'tickets', 'list'] })
+      toast.success('Reply sent')
+    },
+    onError: (e: Error) => toast.error(e.message || 'Failed to send reply'),
+  })
+}
+
+export function useCreateMyTicket() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (input: {
+      subject: string
+      descriptionJson?: JSONContent | null
+      descriptionText?: string | null
+      priority?: 'low' | 'normal' | 'high' | 'urgent'
+    }) =>
+      createMyTicketFn({
+        data: {
+          subject: input.subject,
+          descriptionJson: (input.descriptionJson ?? null) as {
+            type: 'doc'
+            content?: unknown[]
+          } | null,
+          descriptionText: input.descriptionText ?? null,
+          priority: input.priority,
+        },
+      }),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['portal', 'tickets', 'list'] })
+      toast.success('Ticket created')
+    },
+    onError: (e: Error) => toast.error(e.message || 'Failed to create ticket'),
+  })
+}
diff --git a/apps/web/src/lib/client/queries/routing-rules.ts b/apps/web/src/lib/client/queries/routing-rules.ts
new file mode 100644
index 000000000..4b148af55
--- /dev/null
+++ b/apps/web/src/lib/client/queries/routing-rules.ts
@@ -0,0 +1,23 @@
+/**
+ * TanStack Query factory for routing-rule admin reads. Mirrors `inboxQueries`:
+ * route loaders pre-fetch via `ensureQueryData`; components read via
+ * `useSuspenseQuery`.
+ */
+import { queryOptions } from '@tanstack/react-query'
+import type { InboxId, RoutingRuleId } from '@quackback/ids'
+import { listRoutingRulesFn, getRoutingRuleFn } from '@/lib/server/functions/routing'
+
+export const routingRuleQueries = {
+  list: (params: { inboxIdScope?: InboxId | 'workspace'; enabledOnly?: boolean } = {}) =>
+    queryOptions({
+      queryKey: ['routing-rules', 'list', params] as const,
+      queryFn: () => listRoutingRulesFn({ data: params }),
+      staleTime: 30_000,
+    }),
+  detail: (ruleId: RoutingRuleId) =>
+    queryOptions({
+      queryKey: ['routing-rules', 'detail', ruleId] as const,
+      queryFn: () => getRoutingRuleFn({ data: { ruleId } }),
+      staleTime: 30_000,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/sla.ts b/apps/web/src/lib/client/queries/sla.ts
new file mode 100644
index 000000000..90bdd09fe
--- /dev/null
+++ b/apps/web/src/lib/client/queries/sla.ts
@@ -0,0 +1,31 @@
+/**
+ * Query factory for SLA admin reads.
+ */
+import { queryOptions } from '@tanstack/react-query'
+import type { SlaPolicyId } from '@quackback/ids'
+import {
+  listSlaPoliciesFn,
+  getSlaPolicyFn,
+  listEscalationRulesFn,
+} from '@/lib/server/functions/sla'
+
+export const slaQueries = {
+  policies: (params: { includeArchived?: boolean } = {}) =>
+    queryOptions({
+      queryKey: ['sla', 'policies', params] as const,
+      queryFn: () => listSlaPoliciesFn({ data: params }),
+      staleTime: 30_000,
+    }),
+  policy: (id: SlaPolicyId) =>
+    queryOptions({
+      queryKey: ['sla', 'policy', id] as const,
+      queryFn: () => getSlaPolicyFn({ data: { id } }),
+      staleTime: 30_000,
+    }),
+  escalations: (policyId: SlaPolicyId) =>
+    queryOptions({
+      queryKey: ['sla', 'escalations', policyId] as const,
+      queryFn: () => listEscalationRulesFn({ data: { policyId } }),
+      staleTime: 30_000,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/teams.ts b/apps/web/src/lib/client/queries/teams.ts
new file mode 100644
index 000000000..4cf566772
--- /dev/null
+++ b/apps/web/src/lib/client/queries/teams.ts
@@ -0,0 +1,30 @@
+/**
+ * Team query factory — list / detail / members. Mirrors `inboxQueries`.
+ */
+import { queryOptions } from '@tanstack/react-query'
+import type { TeamId } from '@quackback/ids'
+import { listTeamsFn, getTeamFn, listTeamMembersFn } from '@/lib/server/functions/teams'
+
+const STALE = 30_000
+
+export const teamQueries = {
+  all: ['teams'] as const,
+  list: (filters: { includeArchived?: boolean } = {}) =>
+    queryOptions({
+      queryKey: ['teams', 'list', filters] as const,
+      queryFn: () => listTeamsFn({ data: { includeArchived: filters.includeArchived } }),
+      staleTime: STALE,
+    }),
+  detail: (teamId: TeamId) =>
+    queryOptions({
+      queryKey: ['teams', 'detail', teamId] as const,
+      queryFn: () => getTeamFn({ data: { teamId } }),
+      staleTime: STALE,
+    }),
+  members: (teamId: TeamId) =>
+    queryOptions({
+      queryKey: ['teams', 'members', teamId] as const,
+      queryFn: () => listTeamMembersFn({ data: { teamId } }),
+      staleTime: STALE,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/tickets.ts b/apps/web/src/lib/client/queries/tickets.ts
new file mode 100644
index 000000000..a098ccadd
--- /dev/null
+++ b/apps/web/src/lib/client/queries/tickets.ts
@@ -0,0 +1,138 @@
+/**
+ * TanStack Query factory for ticket-related reads.
+ *
+ * Mirrors the pattern in `queries/admin.ts`: queries return
+ * `queryOptions(...)` objects so callers can pass them directly into
+ * `useQuery` / `useSuspenseQuery` and `queryClient.ensureQueryData(...)`.
+ */
+import { queryOptions } from '@tanstack/react-query'
+import type { TicketId, TicketThreadId } from '@quackback/ids'
+import {
+  listTicketsFn,
+  getTicketFn,
+  listThreadsFn,
+  listParticipantsFn,
+  listSharesFn,
+  listTicketStatusesFn,
+  listTicketActivityFn,
+} from '@/lib/server/functions/tickets'
+import { getTicketSlaClocksFn } from '@/lib/server/functions/sla'
+import { listMyInboxesFn } from '@/lib/server/functions/inboxes'
+
+export type QueueScope =
+  | 'all'
+  | 'my_assigned'
+  | 'my_team'
+  | 'shared_with_me'
+  | 'unassigned'
+  | 'my_inbox'
+  | 'inbox'
+
+export type StatusCategory = 'open' | 'pending' | 'on_hold' | 'solved' | 'closed'
+
+export interface TicketQueueParams {
+  scope: QueueScope
+  statusCategory?: StatusCategory
+  search?: string
+  inboxId?: string | null
+  limit?: number
+  offset?: number
+  sort?: 'last_activity_desc' | 'created_desc' | 'created_asc'
+}
+
+export const ticketQueries = {
+  list: (params: TicketQueueParams) =>
+    queryOptions({
+      queryKey: ['tickets', 'list', params] as const,
+      queryFn: () => listTicketsFn({ data: params }),
+      staleTime: 10_000,
+    }),
+  detail: (ticketId: TicketId) =>
+    queryOptions({
+      queryKey: ['tickets', 'detail', ticketId] as const,
+      queryFn: () => getTicketFn({ data: { ticketId } }),
+      staleTime: 1_000,
+    }),
+  threads: (ticketId: TicketId) =>
+    queryOptions({
+      queryKey: ['tickets', 'threads', ticketId] as const,
+      queryFn: () => listThreadsFn({ data: { ticketId } }),
+      staleTime: 5_000,
+    }),
+  participants: (ticketId: TicketId) =>
+    queryOptions({
+      queryKey: ['tickets', 'participants', ticketId] as const,
+      queryFn: () => listParticipantsFn({ data: { ticketId } }),
+      staleTime: 30_000,
+    }),
+  shares: (ticketId: TicketId) =>
+    queryOptions({
+      queryKey: ['tickets', 'shares', ticketId] as const,
+      queryFn: () => listSharesFn({ data: { ticketId } }),
+      staleTime: 30_000,
+    }),
+  statuses: () =>
+    queryOptions({
+      queryKey: ['tickets', 'statuses'] as const,
+      queryFn: () => listTicketStatusesFn(),
+      staleTime: 5 * 60_000,
+    }),
+  slaClocks: (ticketId: TicketId, includeAll = false) =>
+    queryOptions({
+      queryKey: ['tickets', 'slaClocks', ticketId, includeAll] as const,
+      queryFn: () => getTicketSlaClocksFn({ data: { ticketId, includeAll } }),
+      staleTime: 15_000,
+      refetchInterval: 30_000,
+    }),
+  activity: (ticketId: TicketId, opts: { limit?: number; before?: string } = {}) =>
+    queryOptions({
+      queryKey: ['tickets', 'activity', ticketId, opts] as const,
+      queryFn: () => listTicketActivityFn({ data: { ticketId, ...opts } }),
+      staleTime: 10_000,
+    }),
+  myInboxes: () =>
+    queryOptions({
+      queryKey: ['tickets', 'myInboxes'] as const,
+      queryFn: () => listMyInboxesFn(),
+      staleTime: 60_000,
+    }),
+  /** External links (GitHub issues etc.) for a ticket. TODO: wire to server function in Phase 8. */
+  externalLinks: (ticketId: TicketId) =>
+    queryOptions({
+      queryKey: ['tickets', 'externalLinks', ticketId] as const,
+      queryFn: () =>
+        Promise.resolve(
+          [] as Array<{
+            id: string
+            integrationId: string | null
+            integrationType: string
+            externalId: string
+            externalDisplayId: string | null
+            externalUrl: string | null
+            syncDirection: string
+          }>
+        ),
+      staleTime: 30_000,
+    }),
+  /** Attachments for a specific thread. */
+  attachments: (ticketId: TicketId, threadId: TicketThreadId) =>
+    queryOptions({
+      queryKey: ['tickets', 'attachments', ticketId, threadId] as const,
+      queryFn: async () => {
+        const res = await fetch(`/api/v1/tickets/${ticketId}/threads/${threadId}/attachments`)
+        if (!res.ok) {
+          throw new Error(`Failed to load attachments: ${res.statusText}`)
+        }
+        const data = await res.json()
+        return (data.data ?? (Array.isArray(data) ? data : [])) as Array<{
+          id: string
+          filename: string
+          mimeType: string
+          sizeBytes: number
+          publicUrl: string | null
+          createdAt: string
+        }>
+      },
+      staleTime: 30_000,
+    }),
+}
diff --git a/apps/web/src/lib/client/queries/webhook-deliveries.ts b/apps/web/src/lib/client/queries/webhook-deliveries.ts
new file mode 100644
index 000000000..3419f58ac
--- /dev/null
+++ b/apps/web/src/lib/client/queries/webhook-deliveries.ts
@@ -0,0 +1,48 @@
+/**
+ * Webhook delivery queries — cursor-paged delivery feed for the inspector
+ * drawer. Backend cursor shape is `{cursorAttemptedAt, cursorId}` (or null).
+ */
+import { infiniteQueryOptions } from '@tanstack/react-query'
+import type { WebhookId } from '@quackback/ids'
+import { listWebhookDeliveriesFn } from '@/lib/server/functions/webhook-deliveries'
+
+export type WebhookDeliveryStatusFilter =
+  | 'queued'
+  | 'success'
+  | 'failed_retryable'
+  | 'failed_terminal'
+  | 'blocked_ssrf'
+
+interface ListFilters {
+  status?: WebhookDeliveryStatusFilter
+}
+
+interface CursorParam {
+  cursorAttemptedAt: string
+  cursorId: string
+}
+
+const STALE = 15_000
+
+export const webhookDeliveryQueries = {
+  all: ['webhook-deliveries'] as const,
+  list: (webhookId: WebhookId, filters: ListFilters = {}) =>
+    infiniteQueryOptions({
+      queryKey: ['webhook-deliveries', 'list', webhookId, filters] as const,
+      queryFn: ({ pageParam }) => {
+        const cursor = pageParam as CursorParam | undefined
+        return listWebhookDeliveriesFn({
+          data: {
+            webhookId,
+            limit: 50,
+            status: filters.status,
+            cursorAttemptedAt: cursor?.cursorAttemptedAt,
+            cursorId: cursor?.cursorId,
+          },
+        })
+      },
+      initialPageParam: undefined as CursorParam | undefined,
+      getNextPageParam: (last) => (last.nextCursor as CursorParam | null) ?? undefined,
+      staleTime: STALE,
+    }),
+}
diff --git a/apps/web/src/lib/client/utils/__tests__/handle-ticket-conflict.diffcov.test.ts b/apps/web/src/lib/client/utils/__tests__/handle-ticket-conflict.diffcov.test.ts
new file mode 100644
index 000000000..8d100e5a2
--- /dev/null
+++ b/apps/web/src/lib/client/utils/__tests__/handle-ticket-conflict.diffcov.test.ts
@@ -0,0 +1,41 @@
+/**
+ * Differential-coverage tests for handle-ticket-conflict — the conflict
+ * detection branches (code / message regex / neither) and the refresh action.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({ toastError: vi.fn(), invalidate: vi.fn() }))
+
+vi.mock('sonner', () => ({ toast: { error: (...a: unknown[]) => m.toastError(...a) } }))
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    detail: (id: string) => ({ queryKey: ['tickets', 'detail', id] }),
+    threads: (id: string) => ({ queryKey: ['tickets', 'threads', id] }),
+    activity: (id: string) => ({ queryKey: ['tickets', 'activity', id] }),
+  },
+}))
+
+import { handleTicketConflict } from '../handle-ticket-conflict'
+
+const qc = { invalidateQueries: (...a: unknown[]) => m.invalidate(...a) } as never
+
+beforeEach(() => vi.clearAllMocks())
+
+describe('handleTicketConflict', () => {
+  it('surfaces a refresh toast on a coded conflict and wires the refresh action', () => {
+    handleTicketConflict(Object.assign(new Error('boom'), { code: 'CONFLICT' }), qc, 't1' as never)
+    const opts = m.toastError.mock.calls[0][1] as { action: { onClick: () => void } }
+    opts.action.onClick()
+    expect(m.invalidate).toHaveBeenCalledTimes(3)
+  })
+  it('detects TICKET_CONFLICT code and message-regex conflicts', () => {
+    handleTicketConflict({ code: 'TICKET_CONFLICT' }, qc, 't1' as never)
+    handleTicketConflict(new Error('row is stale, refresh'), qc, 't1' as never)
+    expect(m.toastError).toHaveBeenCalledTimes(2)
+  })
+  it('falls through to a plain error toast for non-conflicts (incl. non-Error values)', () => {
+    handleTicketConflict(new Error('something else'), qc, 't1' as never)
+    handleTicketConflict('a raw string', qc, 't1' as never)
+    expect(m.toastError).toHaveBeenLastCalledWith('a raw string')
+  })
+})
diff --git a/apps/web/src/lib/client/utils/handle-ticket-conflict.ts b/apps/web/src/lib/client/utils/handle-ticket-conflict.ts
new file mode 100644
index 000000000..e9272c99a
--- /dev/null
+++ b/apps/web/src/lib/client/utils/handle-ticket-conflict.ts
@@ -0,0 +1,35 @@
+/**
+ * Helper that translates ticket-mutation errors into UX-friendly toasts. When
+ * the server reports a `ConflictError` (stale `expectedUpdatedAt`), we surface
+ * a "Refresh" action that re-fetches the ticket detail. Other errors fall
+ * through to a plain error toast.
+ */
+import { toast } from 'sonner'
+import type { QueryClient } from '@tanstack/react-query'
+import type { TicketId } from '@quackback/ids'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+
+export function handleTicketConflict(error: unknown, qc: QueryClient, ticketId: TicketId): void {
+  const message = error instanceof Error ? error.message : String(error)
+  const code = (error as { code?: string } | null)?.code
+  const isConflict =
+    code === 'TICKET_CONFLICT' ||
+    code === 'CONFLICT' ||
+    /conflict|stale|version|expectedupdatedat/i.test(message)
+
+  const refresh = () => {
+    qc.invalidateQueries({ queryKey: ticketQueries.detail(ticketId).queryKey })
+    qc.invalidateQueries({ queryKey: ticketQueries.threads(ticketId).queryKey })
+    qc.invalidateQueries({ queryKey: ticketQueries.activity(ticketId).queryKey })
+  }
+
+  if (isConflict) {
+    toast.error('Ticket was changed by someone else.', {
+      description: 'Refresh to get the latest version.',
+      action: { label: 'Refresh', onClick: refresh },
+    })
+    return
+  }
+
+  toast.error(message)
+}
diff --git a/apps/web/src/lib/client/widget/__tests__/tickets-api-reopen.gap.test.ts b/apps/web/src/lib/client/widget/__tests__/tickets-api-reopen.gap.test.ts
new file mode 100644
index 000000000..a0595085b
--- /dev/null
+++ b/apps/web/src/lib/client/widget/__tests__/tickets-api-reopen.gap.test.ts
@@ -0,0 +1,27 @@
+/**
+ * Differential-coverage test for reopenWidgetTicket — POSTs to the reopen
+ * endpoint via widgetFetch.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+vi.mock('@/lib/client/widget-auth', () => ({ getWidgetAuthHeaders: () => ({}) }))
+
+import { reopenWidgetTicket } from '../tickets-api'
+
+beforeEach(() => vi.restoreAllMocks())
+afterEach(() => vi.restoreAllMocks())
+
+describe('reopenWidgetTicket', () => {
+  it('POSTs to the ticket reopen endpoint', async () => {
+    const fetchSpy = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ data: { id: 't1', status: 'open' } }), { status: 200 })
+      )
+    await reopenWidgetTicket('t1')
+    expect(fetchSpy).toHaveBeenCalledWith(
+      '/api/widget/tickets/t1/reopen',
+      expect.objectContaining({ method: 'POST' })
+    )
+  })
+})
diff --git a/apps/web/src/lib/client/widget/__tests__/tickets-api.test.ts b/apps/web/src/lib/client/widget/__tests__/tickets-api.test.ts
new file mode 100644
index 000000000..48e4c3c8e
--- /dev/null
+++ b/apps/web/src/lib/client/widget/__tests__/tickets-api.test.ts
@@ -0,0 +1,161 @@
+// @vitest-environment happy-dom
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+// Mock the auth-headers helper before importing the module under test.
+vi.mock('@/lib/client/widget-auth', () => ({
+  getWidgetAuthHeaders: () => ({ Authorization: 'Bearer test-token' }),
+}))
+
+import {
+  createWidgetTicket,
+  getWidgetTicket,
+  listWidgetTickets,
+  replyToWidgetTicket,
+  resolveWidgetTicket,
+  updateWidgetTicketDescription,
+  WidgetTicketError,
+} from '../tickets-api'
+
+const originalFetch = globalThis.fetch
+
+function mockFetch(impl: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>) {
+  globalThis.fetch = vi.fn(impl) as unknown as typeof fetch
+}
+
+beforeEach(() => {
+  vi.restoreAllMocks()
+})
+
+afterEach(() => {
+  globalThis.fetch = originalFetch
+})
+
+describe('widget tickets-api', () => {
+  it('listWidgetTickets injects bearer + parses data', async () => {
+    let capturedUrl = ''
+    let capturedHeaders: Record<string, string> = {}
+    mockFetch(async (input, init) => {
+      capturedUrl = String(input)
+      capturedHeaders = init?.headers as Record<string, string>
+      return new Response(
+        JSON.stringify({ data: { rows: [{ id: 't1', subject: 'Hi' }], total: 1 } }),
+        { status: 200, headers: { 'content-type': 'application/json' } }
+      )
+    })
+    const out = await listWidgetTickets({ statusCategory: 'open', limit: 10 })
+    expect(out.total).toBe(1)
+    expect(out.rows[0].subject).toBe('Hi')
+    expect(capturedUrl).toContain('/api/widget/tickets?')
+    expect(capturedUrl).toContain('statusCategory=open')
+    expect(capturedUrl).toContain('limit=10')
+    expect(capturedHeaders.Authorization).toBe('Bearer test-token')
+  })
+
+  it('getWidgetTicket encodes the path segment', async () => {
+    let capturedUrl = ''
+    mockFetch(async (input) => {
+      capturedUrl = String(input)
+      return new Response(JSON.stringify({ data: { ticket: { id: 't1' } } }), { status: 200 })
+    })
+    await getWidgetTicket('ticket_abc/with space')
+    expect(capturedUrl).toBe('/api/widget/tickets/ticket_abc%2Fwith%20space')
+  })
+
+  it('createWidgetTicket sends JSON body with content-type', async () => {
+    let capturedHeaders: Record<string, string> = {}
+    let capturedBody = ''
+    mockFetch(async (_input, init) => {
+      capturedHeaders = init?.headers as Record<string, string>
+      capturedBody = init?.body as string
+      return new Response(JSON.stringify({ data: { id: 't1', subject: 'S' } }), { status: 200 })
+    })
+    await createWidgetTicket({ subject: 'S', bodyText: 'B', priority: 'high' })
+    expect(capturedHeaders['Content-Type']).toBe('application/json')
+    expect(capturedHeaders.Authorization).toBe('Bearer test-token')
+    const parsed = JSON.parse(capturedBody)
+    expect(parsed).toEqual({ subject: 'S', bodyText: 'B', priority: 'high' })
+  })
+
+  it('replyToWidgetTicket POSTs bodyText to /replies', async () => {
+    let capturedUrl = ''
+    let capturedBody = ''
+    mockFetch(async (input, init) => {
+      capturedUrl = String(input)
+      capturedBody = init?.body as string
+      return new Response(JSON.stringify({ data: { id: 'th1' } }), { status: 200 })
+    })
+    await replyToWidgetTicket('t_1', 'hello')
+    expect(capturedUrl).toBe('/api/widget/tickets/t_1/replies')
+    expect(JSON.parse(capturedBody)).toEqual({ bodyText: 'hello' })
+  })
+
+  it('updateWidgetTicketDescription PATCHes description with optimistic timestamp', async () => {
+    let capturedUrl = ''
+    let capturedMethod = ''
+    let capturedBody = ''
+    mockFetch(async (input, init) => {
+      capturedUrl = String(input)
+      capturedMethod = init?.method ?? ''
+      capturedBody = init?.body as string
+      return new Response(
+        JSON.stringify({ data: { id: 't_1', updatedAt: '2026-01-01T00:00:01Z' } }),
+        {
+          status: 200,
+        }
+      )
+    })
+    await updateWidgetTicketDescription('t_1', {
+      expectedUpdatedAt: '2026-01-01T00:00:00Z',
+      descriptionJson: { type: 'doc', content: [] },
+      descriptionText: 'updated',
+    })
+    expect(capturedUrl).toBe('/api/widget/tickets/t_1')
+    expect(capturedMethod).toBe('PATCH')
+    expect(JSON.parse(capturedBody)).toEqual({
+      expectedUpdatedAt: '2026-01-01T00:00:00Z',
+      descriptionJson: { type: 'doc', content: [] },
+      descriptionText: 'updated',
+    })
+  })
+
+  it('resolveWidgetTicket POSTs to /resolve and returns alreadyResolved', async () => {
+    mockFetch(
+      async () =>
+        new Response(
+          JSON.stringify({
+            data: { id: 't1', statusId: 's1', statusCategory: 'solved', alreadyResolved: true },
+          }),
+          { status: 200 }
+        )
+    )
+    const out = await resolveWidgetTicket('t1')
+    expect(out.alreadyResolved).toBe(true)
+  })
+
+  it('throws typed WidgetTicketError on non-2xx', async () => {
+    mockFetch(
+      async () =>
+        new Response(JSON.stringify({ code: 'IDENTITY_REQUIRED', message: 'need identity' }), {
+          status: 403,
+        })
+    )
+    await expect(listWidgetTickets()).rejects.toMatchObject({
+      name: 'WidgetTicketError',
+      code: 'IDENTITY_REQUIRED',
+      status: 403,
+      message: 'need identity',
+    })
+  })
+
+  it('uses fallback error code when body has no envelope', async () => {
+    mockFetch(async () => new Response('{}', { status: 500 }))
+    try {
+      await listWidgetTickets()
+      throw new Error('should have thrown')
+    } catch (err) {
+      expect(err).toBeInstanceOf(WidgetTicketError)
+      expect((err as WidgetTicketError).code).toBe('UNKNOWN')
+      expect((err as WidgetTicketError).status).toBe(500)
+    }
+  })
+})
diff --git a/apps/web/src/lib/client/widget/tickets-api.ts b/apps/web/src/lib/client/widget/tickets-api.ts
new file mode 100644
index 000000000..de2fa4e71
--- /dev/null
+++ b/apps/web/src/lib/client/widget/tickets-api.ts
@@ -0,0 +1,242 @@
+/**
+ * Client-side fetch wrappers for the widget ticket endpoints introduced in
+ * Phase 2. Handles Bearer token injection and maps the `{ code, message }`
+ * error envelope to a typed `WidgetTicketError`.
+ */
+import { getWidgetAuthHeaders } from '@/lib/client/widget-auth'
+import type { TicketId, TicketStatusId, PrincipalId } from '@quackback/ids'
+
+export type StatusCategory = 'open' | 'pending' | 'on_hold' | 'solved' | 'closed'
+export type WidgetSupportPriority = 'low' | 'normal' | 'high' | 'urgent'
+
+export interface WidgetSupportCategory {
+  categoryKey: string
+  label: string
+  description?: string
+  icon?: string
+  defaultPriority?: WidgetSupportPriority
+  allowedPriorities?: WidgetSupportPriority[]
+  visible?: boolean
+  display?: {
+    showPrioritySelector?: boolean
+    showAttachments?: boolean
+    showResolveAction?: boolean
+    showReopenAction?: boolean
+    emptyStateTitle?: string
+    emptyStateDescription?: string
+  }
+}
+
+export interface WidgetTicketRow {
+  id: TicketId
+  subject: string
+  statusId: TicketStatusId
+  statusCategory: StatusCategory
+  statusName: string
+  statusColor: string | null
+  lastActivityAt: string
+  createdAt: string
+}
+
+export interface WidgetTicketDetail {
+  id: TicketId
+  subject: string
+  descriptionJson: unknown | null
+  descriptionText: string | null
+  statusId: TicketStatusId
+  statusCategory: StatusCategory
+  statusName: string
+  statusColor: string | null
+  createdAt: string
+  lastActivityAt: string
+  updatedAt: string
+}
+
+export interface WidgetTicketThread {
+  id: string
+  principalId: PrincipalId | null
+  audience: 'public'
+  bodyJson: unknown | null
+  bodyText: string | null
+  createdAt: string
+  editedAt: string | null
+}
+
+export interface WidgetTicketDetailResponse {
+  ticket: WidgetTicketDetail
+  threads: WidgetTicketThread[]
+  principalNames: Record<string, string>
+  viewerPrincipalId: PrincipalId | null
+}
+
+export interface WidgetTicketCreateInput {
+  subject: string
+  bodyJson?: { type: 'doc'; content?: unknown[] } | null
+  bodyText?: string | null
+  priority?: WidgetSupportPriority
+  categoryKey?: string
+}
+
+export interface WidgetTicketDescriptionUpdateInput {
+  expectedUpdatedAt: string
+  descriptionJson: { type: 'doc'; content?: unknown[] } | null
+  descriptionText: string | null
+}
+
+export interface WidgetTicketDescriptionUpdateResponse {
+  id: TicketId
+  updatedAt: string
+}
+
+export interface WidgetTicketCreateResponse {
+  id: TicketId
+  subject: string
+  statusId: TicketStatusId
+  statusCategory: StatusCategory
+  statusName: string
+  statusColor: string | null
+  createdAt: string
+  lastActivityAt: string
+  initialThreadId?: string
+}
+
+export interface WidgetTicketReplyResponse {
+  id: string
+  ticketId: TicketId
+  audience: 'public'
+  createdAt: string
+}
+
+export interface WidgetTicketResolveResponse {
+  id: TicketId
+  statusId: TicketStatusId
+  statusCategory: StatusCategory | 'closed'
+  alreadyResolved: boolean
+  updatedAt?: string
+}
+
+export interface WidgetTicketReopenResponse {
+  id: TicketId
+  statusId: TicketStatusId
+  statusCategory: StatusCategory
+  alreadyOpen: boolean
+  updatedAt?: string
+}
+
+export class WidgetTicketError extends Error {
+  readonly code: string
+  readonly status: number
+  constructor(code: string, message: string, status: number) {
+    super(message)
+    this.name = 'WidgetTicketError'
+    this.code = code
+    this.status = status
+  }
+}
+
+async function widgetFetch<T>(
+  url: string,
+  init: RequestInit & { jsonBody?: unknown } = {}
+): Promise<T> {
+  const { jsonBody, headers, ...rest } = init
+  const finalHeaders: Record<string, string> = {
+    Accept: 'application/json',
+    ...getWidgetAuthHeaders(),
+    ...(jsonBody !== undefined ? { 'Content-Type': 'application/json' } : {}),
+    ...((headers as Record<string, string> | undefined) ?? {}),
+  }
+  const res = await fetch(url, {
+    ...rest,
+    headers: finalHeaders,
+    body: jsonBody !== undefined ? JSON.stringify(jsonBody) : (init.body ?? undefined),
+  })
+  let payload: unknown = null
+  try {
+    payload = await res.json()
+  } catch {
+    // empty
+  }
+  if (!res.ok) {
+    const env = (payload ?? {}) as {
+      error?: { code?: string; message?: string }
+      code?: string
+      message?: string
+    }
+    const code = env.error?.code ?? env.code ?? 'UNKNOWN'
+    const message = env.error?.message ?? env.message ?? `Request failed with ${res.status}`
+    throw new WidgetTicketError(code, message, res.status)
+  }
+  const env = (payload ?? {}) as { data?: T }
+  if (env.data === undefined) {
+    throw new WidgetTicketError('UNKNOWN', 'Malformed response', res.status)
+  }
+  return env.data
+}
+
+export interface ListWidgetTicketsParams {
+  statusCategory?: StatusCategory
+  limit?: number
+  offset?: number
+}
+
+export async function listWidgetTickets(
+  params: ListWidgetTicketsParams = {}
+): Promise<{ rows: WidgetTicketRow[]; total: number }> {
+  const search = new URLSearchParams()
+  if (params.statusCategory) search.set('statusCategory', params.statusCategory)
+  if (params.limit != null) search.set('limit', String(params.limit))
+  if (params.offset != null) search.set('offset', String(params.offset))
+  const qs = search.toString()
+  return widgetFetch(`/api/widget/tickets${qs ? `?${qs}` : ''}`)
+}
+
+export async function getWidgetTicket(
+  ticketId: TicketId | string
+): Promise<WidgetTicketDetailResponse> {
+  return widgetFetch(`/api/widget/tickets/${encodeURIComponent(ticketId)}`)
+}
+
+export async function createWidgetTicket(
+  input: WidgetTicketCreateInput
+): Promise<WidgetTicketCreateResponse> {
+  return widgetFetch(`/api/widget/tickets`, {
+    method: 'POST',
+    jsonBody: input,
+  })
+}
+
+export async function replyToWidgetTicket(
+  ticketId: TicketId | string,
+  bodyText: string
+): Promise<WidgetTicketReplyResponse> {
+  return widgetFetch(`/api/widget/tickets/${encodeURIComponent(ticketId)}/replies`, {
+    method: 'POST',
+    jsonBody: { bodyText },
+  })
+}
+
+export async function updateWidgetTicketDescription(
+  ticketId: TicketId | string,
+  input: WidgetTicketDescriptionUpdateInput
+): Promise<WidgetTicketDescriptionUpdateResponse> {
+  return widgetFetch(`/api/widget/tickets/${encodeURIComponent(ticketId)}`, {
+    method: 'PATCH',
+    jsonBody: input,
+  })
+}
+
+export async function resolveWidgetTicket(
+  ticketId: TicketId | string
+): Promise<WidgetTicketResolveResponse> {
+  return widgetFetch(`/api/widget/tickets/${encodeURIComponent(ticketId)}/resolve`, {
+    method: 'POST',
+  })
+}
+
+export async function reopenWidgetTicket(
+  ticketId: TicketId | string
+): Promise<WidgetTicketReopenResponse> {
+  return widgetFetch(`/api/widget/tickets/${encodeURIComponent(ticketId)}/reopen`, {
+    method: 'POST',
+  })
+}
diff --git a/apps/web/src/lib/server/audit/__tests__/log.test.ts b/apps/web/src/lib/server/audit/__tests__/log.test.ts
index 92d93e3ae..b6006653c 100644
--- a/apps/web/src/lib/server/audit/__tests__/log.test.ts
+++ b/apps/web/src/lib/server/audit/__tests__/log.test.ts
@@ -211,6 +211,9 @@ describe('actorFromAuth', () => {
       user: { id: 'user_admin1' as never, email: 'admin@example.com', name: 'A', image: null },
       principal: { id: 'principal_admin1' as never, role: 'admin', type: 'user' },
       settings: { id: 'workspace_1' as never, slug: 's', name: 'n', logoKey: null },
+      ipAddress: null,
+      userAgent: null,
+      source: 'web',
     })
 
     expect(actor).toEqual({
diff --git a/apps/web/src/lib/server/audit/log.ts b/apps/web/src/lib/server/audit/log.ts
index 16637966b..48ddd0a9b 100644
--- a/apps/web/src/lib/server/audit/log.ts
+++ b/apps/web/src/lib/server/audit/log.ts
@@ -68,6 +68,8 @@ export type AuditEventType =
   | 'moderation.default.changed'
   | 'portal.visibility.changed'
   | 'portal.allowed_domains.changed'
+  | 'portal_tabs.config_changed'
+  | 'portal_tabs.segment_override_changed'
   | 'post.moderation.approved'
   | 'post.moderation.rejected'
   | 'post.moderation.held'
@@ -90,6 +92,9 @@ export type AuditEventType =
   | 'team.invite.expired'
   // v1 portal segment allowlist
   | 'portal.allowed_segments.changed'
+  // v1 support surface access policies
+  | 'widget.chat_access.changed'
+  | 'portal.support_access.changed'
   // v1 portal widget sign-in toggle
   | 'portal.widget_signin.changed'
   // v1 widget OTT handoff
diff --git a/apps/web/src/lib/server/auth/__tests__/email-signin.test.ts b/apps/web/src/lib/server/auth/__tests__/email-signin.test.ts
index 003b36a79..7df80a61d 100644
--- a/apps/web/src/lib/server/auth/__tests__/email-signin.test.ts
+++ b/apps/web/src/lib/server/auth/__tests__/email-signin.test.ts
@@ -30,7 +30,10 @@ vi.mock('@quackback/email', () => ({
 
 vi.mock('@/lib/server/storage/s3', () => ({ getEmailSafeUrl: () => null }))
 
-vi.mock('@/lib/server/config', () => ({ config: { baseUrl: 'https://acme.quackback.io' } }))
+vi.mock('@/lib/server/config', () => ({
+  config: { baseUrl: 'https://acme.quackback.io' },
+  getBaseUrl: () => 'https://acme.quackback.io',
+}))
 
 import { requestEmailSignin } from '../email-signin'
 
diff --git a/apps/web/src/lib/server/auth/__tests__/link-contact.test.ts b/apps/web/src/lib/server/auth/__tests__/link-contact.test.ts
new file mode 100644
index 000000000..b15a1384e
--- /dev/null
+++ b/apps/web/src/lib/server/auth/__tests__/link-contact.test.ts
@@ -0,0 +1,116 @@
+/**
+ * Unit tests for `linkContactForUser` — the auth-hook helper that links a
+ * portal user to a CRM contact based on their verified email.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { UserId } from '@quackback/ids'
+
+const findOrCreateByEmailMock = vi.fn()
+const linkContactToUserMock = vi.fn()
+
+vi.mock('@/lib/server/domains/organizations/contact.service', () => ({
+  findOrCreateByEmail: (...args: unknown[]) => findOrCreateByEmailMock(...args),
+  linkContactToUser: (...args: unknown[]) => linkContactToUserMock(...args),
+}))
+
+import { linkContactForUser } from '../link-contact'
+
+const USER_ID = 'user_123' as UserId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  findOrCreateByEmailMock.mockReset().mockResolvedValue({ id: 'contact_x' })
+  linkContactToUserMock.mockReset().mockResolvedValue({ id: 'cu_link_x' })
+})
+
+describe('linkContactForUser', () => {
+  it('skips when user is anonymous', async () => {
+    await linkContactForUser({
+      userId: USER_ID,
+      email: '[email protected]',
+      emailVerified: true,
+      anonymous: true,
+    })
+    expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('skips when email is null', async () => {
+    await linkContactForUser({
+      userId: USER_ID,
+      email: null,
+      emailVerified: true,
+      anonymous: false,
+    })
+    expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('skips when email is undefined', async () => {
+    await linkContactForUser({
+      userId: USER_ID,
+      email: undefined,
+      emailVerified: true,
+      anonymous: false,
+    })
+    expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('skips when email is not verified', async () => {
+    await linkContactForUser({
+      userId: USER_ID,
+      email: '[email protected]',
+      emailVerified: false,
+      anonymous: false,
+    })
+    expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('links when email is verified — calls both services with system actor', async () => {
+    await linkContactForUser({
+      userId: USER_ID,
+      email: '[email protected]',
+      emailVerified: true,
+      anonymous: false,
+    })
+    expect(findOrCreateByEmailMock).toHaveBeenCalledTimes(1)
+    expect(findOrCreateByEmailMock).toHaveBeenCalledWith({ email: '[email protected]' })
+    expect(linkContactToUserMock).toHaveBeenCalledTimes(1)
+    expect(linkContactToUserMock).toHaveBeenCalledWith({
+      contactId: 'contact_x',
+      userId: USER_ID,
+      linkedByPrincipalId: null,
+    })
+  })
+
+  it('is idempotent — repeated calls reissue the same idempotent service calls', async () => {
+    const input = {
+      userId: USER_ID,
+      email: '[email protected]',
+      emailVerified: true,
+      anonymous: false,
+    }
+    await linkContactForUser(input)
+    await linkContactForUser(input)
+    expect(findOrCreateByEmailMock).toHaveBeenCalledTimes(2)
+    expect(linkContactToUserMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('swallows errors and logs them so signup is not broken', async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+    findOrCreateByEmailMock.mockRejectedValueOnce(new Error('db down'))
+    await expect(
+      linkContactForUser({
+        userId: USER_ID,
+        email: '[email protected]',
+        emailVerified: true,
+        anonymous: false,
+      })
+    ).resolves.toBeUndefined()
+    expect(errorSpy).toHaveBeenCalledTimes(1)
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+    errorSpy.mockRestore()
+  })
+})
diff --git a/apps/web/src/lib/server/auth/__tests__/widget-link-contact.test.ts b/apps/web/src/lib/server/auth/__tests__/widget-link-contact.test.ts
new file mode 100644
index 000000000..97919d40c
--- /dev/null
+++ b/apps/web/src/lib/server/auth/__tests__/widget-link-contact.test.ts
@@ -0,0 +1,103 @@
+/**
+ * Unit tests for `linkContactForWidgetUser` — the widget-side variant of the
+ * portal `linkContactForUser` hook. Gated on a verified ssoToken (rather than
+ * `emailVerified`) because widget identify never sets `emailVerified`.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { UserId } from '@quackback/ids'
+
+const findOrCreateByEmailMock = vi.fn()
+const linkContactToUserMock = vi.fn()
+
+vi.mock('@/lib/server/domains/organizations/contact.service', () => ({
+  findOrCreateByEmail: (...args: unknown[]) => findOrCreateByEmailMock(...args),
+  linkContactToUser: (...args: unknown[]) => linkContactToUserMock(...args),
+}))
+
+import { linkContactForWidgetUser } from '../link-contact'
+
+const USER_ID = 'user_123' as UserId
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  findOrCreateByEmailMock.mockReset().mockResolvedValue({ id: 'contact_x' })
+  linkContactToUserMock.mockReset().mockResolvedValue({ id: 'cu_link_x' })
+})
+
+describe('linkContactForWidgetUser', () => {
+  it('skips and returns null contactId when not verified', async () => {
+    const result = await linkContactForWidgetUser({
+      userId: USER_ID,
+      email: '[email protected]',
+      verified: false,
+    })
+    expect(result).toEqual({ contactId: null })
+    expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('skips when email is null (verified but no email)', async () => {
+    const result = await linkContactForWidgetUser({
+      userId: USER_ID,
+      email: null,
+      verified: true,
+    })
+    expect(result).toEqual({ contactId: null })
+    expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('skips when email is undefined', async () => {
+    const result = await linkContactForWidgetUser({
+      userId: USER_ID,
+      email: undefined,
+      verified: true,
+    })
+    expect(result).toEqual({ contactId: null })
+    expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('links and returns contactId when verified with email', async () => {
+    const result = await linkContactForWidgetUser({
+      userId: USER_ID,
+      email: '[email protected]',
+      verified: true,
+    })
+    expect(result).toEqual({ contactId: 'contact_x' })
+    expect(findOrCreateByEmailMock).toHaveBeenCalledTimes(1)
+    expect(findOrCreateByEmailMock).toHaveBeenCalledWith({ email: '[email protected]' })
+    expect(linkContactToUserMock).toHaveBeenCalledTimes(1)
+    expect(linkContactToUserMock).toHaveBeenCalledWith({
+      contactId: 'contact_x',
+      userId: USER_ID,
+      linkedByPrincipalId: null,
+    })
+  })
+
+  it('is idempotent — repeated calls reissue the same idempotent service calls', async () => {
+    const input = {
+      userId: USER_ID,
+      email: '[email protected]',
+      verified: true,
+    }
+    await linkContactForWidgetUser(input)
+    await linkContactForWidgetUser(input)
+    expect(findOrCreateByEmailMock).toHaveBeenCalledTimes(2)
+    expect(linkContactToUserMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('swallows errors, logs them and returns null contactId so identify is not broken', async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+    findOrCreateByEmailMock.mockRejectedValueOnce(new Error('db down'))
+    const result = await linkContactForWidgetUser({
+      userId: USER_ID,
+      email: '[email protected]',
+      verified: true,
+    })
+    expect(result).toEqual({ contactId: null })
+    expect(errorSpy).toHaveBeenCalledTimes(1)
+    expect(linkContactToUserMock).not.toHaveBeenCalled()
+    errorSpy.mockRestore()
+  })
+})
diff --git a/apps/web/src/lib/server/auth/email-signin.ts b/apps/web/src/lib/server/auth/email-signin.ts
index 1f196e59c..300058753 100644
--- a/apps/web/src/lib/server/auth/email-signin.ts
+++ b/apps/web/src/lib/server/auth/email-signin.ts
@@ -1,6 +1,6 @@
 import { getAuth, getOTP } from './index'
 import { mintMagicLinkUrl } from './magic-link-mint'
-import { config } from '@/lib/server/config'
+import { resolvePublicBaseUrl } from '@/lib/server/public-url'
 import { logger } from '@/lib/server/logger'
 
 const log = logger.child({ component: 'auth-email-signin' })
@@ -17,9 +17,10 @@ export async function requestEmailSignin(opts: {
   callbackURL: string
 }): Promise<void> {
   const auth = await getAuth()
+  const portalUrl = resolvePublicBaseUrl()
   const headers = new Headers({
-    Origin: config.baseUrl,
-    Host: new URL(config.baseUrl).host,
+    Origin: portalUrl,
+    Host: new URL(portalUrl).host,
   })
 
   const { db } = await import('@/lib/server/db')
@@ -42,7 +43,7 @@ export async function requestEmailSignin(opts: {
       email: opts.email,
       callbackPath: opts.callbackURL,
       errorCallbackPath,
-      portalUrl: config.baseUrl,
+      portalUrl,
     }),
     auth.api.sendVerificationOTP({
       body: { email: opts.email, type: 'sign-in' },
diff --git a/apps/web/src/lib/server/auth/index.ts b/apps/web/src/lib/server/auth/index.ts
index 0c6d7bd02..3ca44601e 100644
--- a/apps/web/src/lib/server/auth/index.ts
+++ b/apps/web/src/lib/server/auth/index.ts
@@ -13,8 +13,10 @@ import {
 import { oauthProvider } from '@better-auth/oauth-provider'
 import { tanstackStartCookies } from 'better-auth/tanstack-start'
 import { generateId } from '@quackback/ids'
+import { MCP_SCOPES } from '@/lib/server/mcp/types'
 import { config } from '@/lib/server/config'
 import { logger } from '@/lib/server/logger'
+import { rewriteUrlToPublicBaseUrl } from '@/lib/server/public-url'
 import type { GenericOAuthConfig } from './build-oauth-configs'
 import { isSignInMethodEnabled } from '@/lib/shared/signin-methods'
 
@@ -279,7 +281,11 @@ async function createAuth() {
         const { getEmailSafeUrl } = await import('@/lib/server/storage/s3')
         const settings = await db.query.settings.findFirst({ columns: { logoKey: true } })
         const logoUrl = getEmailSafeUrl(settings?.logoKey) ?? undefined
-        await sendPasswordResetEmail({ to: user.email, resetLink: url, logoUrl })
+        await sendPasswordResetEmail({
+          to: user.email,
+          resetLink: rewriteUrlToPublicBaseUrl(url),
+          logoUrl,
+        })
       },
       resetPasswordTokenExpiresIn: 60 * 60 * 24, // 24 hours
     },
@@ -328,6 +334,7 @@ async function createAuth() {
           after: async (user) => {
             // Cast user.id to the branded TypeID type for database operations
             const userId = user.id as ReturnType<typeof generateId<'user'>>
+            const isAnonymous = (user as Record<string, unknown>).isAnonymous === true
 
             // Check if member already exists (in case of race conditions)
             const existingPrincipal = await db.query.principal.findFirst({
@@ -335,7 +342,6 @@ async function createAuth() {
             })
 
             if (!existingPrincipal) {
-              const isAnonymous = (user as Record<string, unknown>).isAnonymous === true
               await db.insert(principalTable).values({
                 id: generateId('principal'),
                 userId,
@@ -358,6 +364,32 @@ async function createAuth() {
                 'created principal record'
               )
             }
+
+            // Link the new user to a CRM contact when their email is verified.
+            // Best-effort: failures are swallowed inside `linkContactForUser`.
+            const { linkContactForUser } = await import('./link-contact')
+            await linkContactForUser({
+              userId,
+              email: user.email ?? null,
+              emailVerified: user.emailVerified === true,
+              anonymous: isAnonymous,
+            })
+          },
+        },
+        update: {
+          after: async (user) => {
+            // Mirror the create hook: re-evaluate the contact link whenever
+            // a user row changes (most importantly when `emailVerified` flips
+            // from false → true after the OTP / magic-link round-trip).
+            const userId = user.id as ReturnType<typeof generateId<'user'>>
+            const isAnonymous = (user as Record<string, unknown>).isAnonymous === true
+            const { linkContactForUser } = await import('./link-contact')
+            await linkContactForUser({
+              userId,
+              email: user.email ?? null,
+              emailVerified: user.emailVerified === true,
+              anonymous: isAnonymous,
+            })
           },
         },
       },
@@ -413,34 +445,18 @@ async function createAuth() {
         allowDynamicClientRegistration: true,
         allowUnauthenticatedClientRegistration: true,
 
-        // Quackback-specific scopes
-        scopes: [
-          'openid',
-          'profile',
-          'email',
-          'offline_access',
-          'read:feedback',
-          'write:feedback',
-          'write:changelog',
-          'read:article',
-          'write:article',
-          'read:chat',
-          'write:chat',
-        ],
+        // Quackback-specific scopes (OIDC + the full MCP scope catalogue).
+        scopes: ['openid', 'profile', 'email', 'offline_access', ...MCP_SCOPES],
 
-        // Default scopes for dynamically registered clients
+        // Default scopes for dynamically registered clients. Mirrors the full
+        // catalogue minus `manage:admin`, which is sensitive (role/API-key/
+        // webhook management) and must be granted explicitly via consent.
         clientRegistrationDefaultScopes: [
           'openid',
           'profile',
           'email',
-          'read:feedback',
           'offline_access',
-          'write:feedback',
-          'write:changelog',
-          'read:article',
-          'write:article',
-          'read:chat',
-          'write:chat',
+          ...MCP_SCOPES.filter((s) => s !== 'manage:admin'),
         ],
 
         // MCP endpoint is a valid token audience
diff --git a/apps/web/src/lib/server/auth/link-contact.ts b/apps/web/src/lib/server/auth/link-contact.ts
new file mode 100644
index 000000000..dd7408649
--- /dev/null
+++ b/apps/web/src/lib/server/auth/link-contact.ts
@@ -0,0 +1,88 @@
+/**
+ * Auto-link a portal user to a CRM contact based on their verified email.
+ *
+ * Called from better-auth's `databaseHooks.user.create.after` and
+ * `user.update.after`. Idempotent and best-effort — failures are logged
+ * but never thrown so a transient DB hiccup cannot break signup or session
+ * mutation.
+ *
+ * Gated on `emailVerified === true` so we only ever associate identities
+ * the user has demonstrably proven they own.
+ */
+import type { ContactId, UserId } from '@quackback/ids'
+
+export interface LinkContactForUserInput {
+  userId: UserId
+  email: string | null | undefined
+  emailVerified: boolean
+  /** Anonymous (widget-only) users have no real email and must be skipped. */
+  anonymous: boolean
+}
+
+export async function linkContactForUser(input: LinkContactForUserInput): Promise<void> {
+  if (input.anonymous) return
+  if (!input.email) return
+  if (!input.emailVerified) return
+
+  try {
+    const { findOrCreateByEmail, linkContactToUser } =
+      await import('@/lib/server/domains/organizations/contact.service')
+    const contact = await findOrCreateByEmail({ email: input.email })
+    await linkContactToUser({
+      contactId: contact.id,
+      userId: input.userId,
+      linkedByPrincipalId: null,
+    })
+  } catch (err) {
+    console.error('[auth:link-contact] failed to link user to contact', {
+      userId: input.userId,
+      error: err instanceof Error ? err.message : err,
+    })
+  }
+}
+
+export interface LinkContactForWidgetUserInput {
+  userId: UserId
+  email: string | null | undefined
+  /**
+   * True only when the identify call carried a verified `ssoToken` (HS256 JWT
+   * signed with the workspace widget secret). Unverified identifies carry an
+   * attacker-spoofable email and must NOT auto-link to a contact, mirroring
+   * the portal's `emailVerified` gate.
+   */
+  verified: boolean
+}
+
+/**
+ * Auto-link a widget user to a CRM contact when their identity has been
+ * cryptographically verified via `ssoToken`. Used by `POST /api/widget/identify`
+ * so subsequent widget requests can resolve a `contactId` and authorise
+ * ticket list/detail/reply operations.
+ *
+ * Best-effort and idempotent — failures are logged and never thrown so a
+ * transient DB hiccup cannot break widget identify.
+ */
+export async function linkContactForWidgetUser(
+  input: LinkContactForWidgetUserInput
+): Promise<{ contactId: ContactId | null }> {
+  if (!input.verified) return { contactId: null }
+  if (!input.email) return { contactId: null }
+
+  try {
+    const { findOrCreateByEmail, linkContactToUser } =
+      await import('@/lib/server/domains/organizations/contact.service')
+    const contact = await findOrCreateByEmail({ email: input.email })
+    await linkContactToUser({
+      contactId: contact.id,
+      userId: input.userId,
+      linkedByPrincipalId: null,
+    })
+    return { contactId: contact.id as ContactId }
+  } catch (err) {
+    console.error('[auth:link-contact] failed to link widget user to contact', {
+      userId: input.userId,
+      error: err instanceof Error ? err.message : err,
+    })
+    return { contactId: null }
+  }
+}
diff --git a/apps/web/src/lib/server/db.ts b/apps/web/src/lib/server/db.ts
index 6cdadcc0e..5740118e3 100644
--- a/apps/web/src/lib/server/db.ts
+++ b/apps/web/src/lib/server/db.ts
@@ -176,11 +176,18 @@ export {
   postExternalLinks,
   postExternalLinksRelations,
   // Schema tables - changelog
+  changelogCategories,
+  changelogCategoriesRelations,
   changelogEntries,
   changelogEntriesRelations,
   changelogEntryPosts,
   changelogEntryPostsRelations,
+  changelogProducts,
+  changelogProductsRelations,
+  changelogSegmentVisibility,
+  changelogSegmentVisibilityRelations,
   // Schema tables - live chat
+  type ChangelogVisibilityConfig,
   conversations,
   conversationsRelations,
   chatMessages,
@@ -224,6 +231,8 @@ export {
   segmentsRelations,
   userSegments,
   userSegmentsRelations,
+  portalTabSegmentOverrides,
+  portalTabSegmentOverridesRelations,
   type SegmentRules,
   type SegmentCondition,
   type SegmentRuleOperator,
@@ -266,16 +275,121 @@ export {
   helpCenterArticlesRelations,
   helpCenterArticleFeedback,
   helpCenterArticleFeedbackRelations,
+  // Schema tables - ticketing (Phase 1: RBAC + teams + audit)
+  teams,
+  teamsRelations,
+  teamMemberships,
+  teamMembershipsRelations,
+  roles,
+  permissions,
+  rolePermissions,
+  principalRoleAssignments,
+  auditEvents,
+  // Schema tables - ticketing (Phase 2: organizations & contacts)
+  organizations,
+  organizationsRelations,
+  contacts,
+  contactsRelations,
+  contactUserLinks,
+  contactUserLinksRelations,
+  // Schema tables - ticketing (Phase 3: ticket core)
+  ticketStatuses,
+  DEFAULT_TICKET_STATUSES,
+  TICKET_STATUS_CATEGORIES,
+  tickets,
+  ticketsRelations,
+  ticketThreads,
+  ticketThreadsRelations,
+  ticketAttachments,
+  ticketAttachmentsRelations,
+  ticketParticipants,
+  ticketParticipantsRelations,
+  ticketShares,
+  ticketSharesRelations,
+  ticketActivity,
+  ticketActivityRelations,
+  TICKET_PRIORITIES,
+  TICKET_CHANNELS,
+  TICKET_VISIBILITY_SCOPES,
+  TICKET_THREAD_AUDIENCES,
+  TICKET_PARTICIPANT_ROLES,
+  TICKET_SHARE_LEVELS,
+  // Schema tables - ticketing (Phase 4: inboxes, channels, routing)
+  inboxes,
+  inboxesRelations,
+  inboxChannels,
+  inboxChannelsRelations,
+  inboxMemberships,
+  inboxMembershipsRelations,
+  routingRules,
+  routingRulesRelations,
+  INBOX_CHANNEL_KINDS,
+  INBOX_MEMBERSHIP_ROLES,
+  // Schema tables - ticketing (Phase 5: SLA + escalations)
+  businessHours,
+  businessHoursRelations,
+  slaPolicies,
+  slaPoliciesRelations,
+  slaTargets,
+  slaTargetsRelations,
+  ticketSlaClocks,
+  ticketSlaClocksRelations,
+  escalationRules,
+  escalationRulesRelations,
+  slaEscalationLog,
+  slaEscalationLogRelations,
+  SLA_TARGET_KINDS,
+  SLA_CLOCK_STATES,
+  SLA_POLICY_SCOPES,
+  ESCALATION_RECIPIENT_TYPES,
+  ESCALATION_CHANNELS,
+  // Schema tables - ticketing (Phase 7: subscriptions + webhook delivery log)
+  ticketSubscriptions,
+  ticketSubscriptionsRelations,
+  webhookDeliveries,
+  webhookDeliveriesRelations,
+  // Schema tables - ticket external links & user mappings (GitHub sync)
+  ticketExternalLinks,
+  ticketExternalLinksRelations,
+  ticketThreadExternalLinks,
+  ticketThreadExternalLinksRelations,
+  integrationUserMappings,
+  integrationUserMappingsRelations,
+  // Schema tables - integration sync log (observability)
+  integrationSyncLog,
+  integrationSyncLogRelations,
   // Schema tables - push devices
   pushDevices,
+  // Schema tables - widget profiles
+  widgetApplications,
+  widgetApplicationsRelations,
+  widgetEnvironmentProfiles,
+  widgetEnvironmentProfilesRelations,
   // Types/constants
   REACTION_EMOJIS,
   USE_CASE_TYPES,
 } from '@quackback/db'
 
 // Re-export schema types not covered by @quackback/db/types
-export type { ServiceMetadata } from '@quackback/db'
-export type { IdentityProviderAttributeMapping } from '@quackback/db'
+export type {
+  ServiceMetadata,
+  AuditSource,
+  InboxChannelKind,
+  InboxMembershipRole,
+  OrgMetadata,
+  TicketPriority,
+  TicketVisibilityScope,
+  TicketStatusCategory,
+  WidgetProfileChangelogMode,
+  WidgetProfileConfigOverrides,
+  WidgetProfileContentFilters,
+  WidgetProfileSupportCategory,
+  WidgetProfileSupportConfig,
+  WidgetProfileSupportDisplayRules,
+  WidgetProfileTicketListScope,
+  WidgetProfileTicketPriority,
+  IdentityProviderAttributeMapping
+} from '@quackback/db'
 
 // Re-export types (for client components that need types without side effects)
 export * from '@quackback/db/types'
diff --git a/apps/web/src/lib/server/domains/api/schemas/principals.ts b/apps/web/src/lib/server/domains/api/schemas/principals.ts
new file mode 100644
index 000000000..99a38c62d
--- /dev/null
+++ b/apps/web/src/lib/server/domains/api/schemas/principals.ts
@@ -0,0 +1,77 @@
+/**
+ * Team principal schema registrations.
+ */
+import 'zod-openapi'
+import { z } from 'zod'
+import { asSchema, registerPath, TypeIdSchema } from '../openapi'
+import { TimestampSchema, ValidationErrorSchema } from './common'
+
+const TeamPrincipalSchema = z.object({
+  id: TypeIdSchema,
+  userId: z.string(),
+  name: z.string().nullable(),
+  email: z.string().email().nullable(),
+  image: z.string().nullable(),
+  role: z.enum(['admin', 'member']),
+  createdAt: TimestampSchema,
+})
+
+registerPath('/principals', {
+  get: {
+    tags: ['Principals'],
+    summary: 'List team principals',
+    description: 'Lists human team members with admin or member roles.',
+    responses: {
+      200: {
+        description: 'Team principals',
+        content: {
+          'application/json': {
+            schema: asSchema(z.object({ data: z.array(TeamPrincipalSchema) })),
+          },
+        },
+      },
+    },
+  },
+})
+
+registerPath('/principals/{principalId}', {
+  get: {
+    tags: ['Principals'],
+    summary: 'Get a team principal',
+    parameters: [
+      { name: 'principalId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: { 200: { description: 'Team principal' } },
+  },
+  patch: {
+    tags: ['Principals'],
+    summary: 'Update a team principal role',
+    parameters: [
+      { name: 'principalId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(z.object({ role: z.enum(['admin', 'member']) })),
+        },
+      },
+    },
+    responses: {
+      200: { description: 'Updated team principal' },
+      400: {
+        description: 'Validation error',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+    },
+  },
+  delete: {
+    tags: ['Principals'],
+    summary: 'Remove a team principal',
+    description: 'Converts the team member to a portal user.',
+    parameters: [
+      { name: 'principalId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: { 204: { description: 'Removed' } },
+  },
+})
diff --git a/apps/web/src/lib/server/domains/api/schemas/roles.ts b/apps/web/src/lib/server/domains/api/schemas/roles.ts
new file mode 100644
index 000000000..12c5190f8
--- /dev/null
+++ b/apps/web/src/lib/server/domains/api/schemas/roles.ts
@@ -0,0 +1,245 @@
+/**
+ * RBAC schema registrations: roles + permissions, the permission catalogue, and
+ * principal role assignments.
+ *
+ * All endpoints are gated by the `admin.manage_roles` scope/permission: the API
+ * key must carry the scope AND the calling principal must hold the permission.
+ */
+import 'zod-openapi'
+import { z } from 'zod'
+import {
+  registerPath,
+  TypeIdSchema,
+  createItemResponseSchema,
+  createPaginatedResponseSchema,
+  asSchema,
+} from '../openapi'
+import { TimestampSchema, UnauthorizedErrorSchema } from './common'
+
+const RoleSchema = z.object({
+  id: TypeIdSchema.meta({ example: 'role_01h455vb4pex5vsknk084sn02q' }),
+  key: z.string(),
+  name: z.string(),
+  description: z.string().nullable(),
+  isSystem: z.boolean(),
+  permissionCount: z.number().optional(),
+  createdAt: TimestampSchema,
+  updatedAt: TimestampSchema,
+})
+
+const RoleWithPermissionsSchema = RoleSchema.extend({
+  permissionKeys: z.array(z.string()),
+})
+
+const RoleAssignmentSchema = z.object({
+  id: TypeIdSchema.meta({ example: 'role_asgn_01h455vb4pex5vsknk084sn02q' }),
+  principalId: TypeIdSchema,
+  roleId: TypeIdSchema,
+  teamId: TypeIdSchema.nullable(),
+})
+
+registerPath('/roles', {
+  get: {
+    tags: ['RBAC'],
+    summary: 'List roles (with permission counts)',
+    description: 'Requires the `admin.manage_roles` scope/permission.',
+    responses: {
+      200: {
+        description: 'Roles',
+        content: {
+          'application/json': { schema: createPaginatedResponseSchema(RoleSchema, 'Roles') },
+        },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: UnauthorizedErrorSchema } },
+      },
+      403: { description: 'admin.manage_roles permission required' },
+    },
+  },
+  post: {
+    tags: ['RBAC'],
+    summary: 'Create a custom role',
+    description: 'Requires the `admin.manage_roles` scope/permission.',
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              key: z.string().min(1).max(64),
+              name: z.string().min(1).max(200),
+              description: z.string().max(1000).nullable().optional(),
+              permissionKeys: z.array(z.string()).max(200).optional(),
+            })
+          ),
+        },
+      },
+    },
+    responses: {
+      201: {
+        description: 'Role created',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(RoleWithPermissionsSchema, 'Role'),
+          },
+        },
+      },
+    },
+  },
+})
+
+registerPath('/roles/{roleId}', {
+  get: {
+    tags: ['RBAC'],
+    summary: 'Get a role with its permissions',
+    parameters: [{ name: 'roleId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Role',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(RoleWithPermissionsSchema, 'Role'),
+          },
+        },
+      },
+    },
+  },
+  patch: {
+    tags: ['RBAC'],
+    summary: 'Rename / re-describe a role',
+    parameters: [{ name: 'roleId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              name: z.string().min(1).max(200),
+              description: z.string().max(1000).nullable().optional(),
+            })
+          ),
+        },
+      },
+    },
+    responses: { 200: { description: 'Updated' } },
+  },
+  delete: {
+    tags: ['RBAC'],
+    summary: 'Delete a custom role (system roles are rejected)',
+    parameters: [{ name: 'roleId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: { 204: { description: 'Deleted' } },
+  },
+})
+
+registerPath('/roles/{roleId}/permissions', {
+  put: {
+    tags: ['RBAC'],
+    summary: "Replace a role's permission set",
+    parameters: [{ name: 'roleId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(z.object({ permissionKeys: z.array(z.string()).max(200) })),
+        },
+      },
+    },
+    responses: {
+      200: {
+        description: 'Updated',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(RoleWithPermissionsSchema, 'Role'),
+          },
+        },
+      },
+    },
+  },
+})
+
+registerPath('/permissions', {
+  get: {
+    tags: ['RBAC'],
+    summary: 'List the RBAC permission catalogue',
+    description:
+      'Reference data: every permission key plus the category → keys grouping. Requires the `admin.manage_roles` scope/permission.',
+    responses: {
+      200: {
+        description: 'Permission catalogue',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(
+              z.object({
+                permissions: z.array(z.string()),
+                categories: z.record(z.string(), z.array(z.string())),
+              }),
+              'Catalogue'
+            ),
+          },
+        },
+      },
+    },
+  },
+})
+
+registerPath('/principals/{principalId}/roles', {
+  get: {
+    tags: ['RBAC'],
+    summary: "List a principal's role assignments",
+    parameters: [
+      { name: 'principalId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: {
+      200: {
+        description: 'Assignments',
+        content: {
+          'application/json': {
+            schema: createPaginatedResponseSchema(RoleAssignmentSchema, 'Assignments'),
+          },
+        },
+      },
+    },
+  },
+  post: {
+    tags: ['RBAC'],
+    summary: 'Assign a role to a principal (optionally team-scoped)',
+    parameters: [
+      { name: 'principalId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              roleId: TypeIdSchema,
+              teamId: TypeIdSchema.nullable().optional(),
+            })
+          ),
+        },
+      },
+    },
+    responses: {
+      201: {
+        description: 'Assigned',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(RoleAssignmentSchema, 'Assignment'),
+          },
+        },
+      },
+    },
+  },
+})
+
+registerPath('/role-assignments/{assignmentId}', {
+  delete: {
+    tags: ['RBAC'],
+    summary: 'Revoke a role assignment',
+    parameters: [
+      { name: 'assignmentId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: { 204: { description: 'Revoked' } },
+  },
+})
diff --git a/apps/web/src/lib/server/domains/api/schemas/teams.ts b/apps/web/src/lib/server/domains/api/schemas/teams.ts
new file mode 100644
index 000000000..9d38dd6c1
--- /dev/null
+++ b/apps/web/src/lib/server/domains/api/schemas/teams.ts
@@ -0,0 +1,210 @@
+/**
+ * Teams schema registrations: teams CRUD, archive/unarchive, and membership.
+ *
+ * Config-plane resource, scope-gated with the `team.*` permissions: the API key
+ * must carry the scope AND the calling principal must hold the permission.
+ */
+import 'zod-openapi'
+import { z } from 'zod'
+import {
+  registerPath,
+  TypeIdSchema,
+  createItemResponseSchema,
+  createPaginatedResponseSchema,
+  asSchema,
+} from '../openapi'
+import { TimestampSchema, NullableTimestampSchema, UnauthorizedErrorSchema } from './common'
+
+const TeamSchema = z.object({
+  id: TypeIdSchema.meta({ example: 'team_01h455vb4pex5vsknk084sn02q' }),
+  slug: z.string(),
+  name: z.string(),
+  description: z.string().nullable(),
+  shortLabel: z.string().nullable(),
+  color: z.string().nullable(),
+  archivedAt: NullableTimestampSchema,
+  createdAt: TimestampSchema,
+  updatedAt: TimestampSchema,
+})
+
+const TeamMemberSchema = z.object({
+  teamId: TypeIdSchema,
+  principalId: TypeIdSchema,
+  role: z.enum(['lead', 'member']),
+  createdAt: TimestampSchema,
+})
+
+registerPath('/teams', {
+  get: {
+    tags: ['Teams'],
+    summary: 'List teams',
+    description:
+      'Requires the `team.view` scope/permission. Pass `?includeArchived=true` to include archived teams.',
+    parameters: [
+      {
+        name: 'includeArchived',
+        in: 'query',
+        schema: asSchema(z.enum(['true', 'false']).optional()),
+      },
+    ],
+    responses: {
+      200: {
+        description: 'Teams',
+        content: {
+          'application/json': { schema: createPaginatedResponseSchema(TeamSchema, 'Teams') },
+        },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: UnauthorizedErrorSchema } },
+      },
+      403: { description: 'team.view permission required' },
+    },
+  },
+  post: {
+    tags: ['Teams'],
+    summary: 'Create a team',
+    description: 'Requires the `team.manage` scope/permission.',
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              slug: z.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/),
+              name: z.string().min(1).max(200),
+              description: z.string().max(1000).nullable().optional(),
+              shortLabel: z.string().max(40).nullable().optional(),
+              color: z.string().max(16).nullable().optional(),
+            })
+          ),
+        },
+      },
+    },
+    responses: {
+      201: {
+        description: 'Team created',
+        content: { 'application/json': { schema: createItemResponseSchema(TeamSchema, 'Team') } },
+      },
+      403: { description: 'team.manage permission required' },
+    },
+  },
+})
+
+registerPath('/teams/{teamId}', {
+  get: {
+    tags: ['Teams'],
+    summary: 'Get a team',
+    parameters: [{ name: 'teamId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Team',
+        content: { 'application/json': { schema: createItemResponseSchema(TeamSchema, 'Team') } },
+      },
+      404: { description: 'Team not found' },
+    },
+  },
+  patch: {
+    tags: ['Teams'],
+    summary: 'Update a team',
+    description: 'Requires the `team.manage` scope/permission.',
+    parameters: [{ name: 'teamId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              name: z.string().min(1).max(200).optional(),
+              description: z.string().max(1000).nullable().optional(),
+              shortLabel: z.string().max(40).nullable().optional(),
+              color: z.string().max(16).nullable().optional(),
+            })
+          ),
+        },
+      },
+    },
+    responses: { 200: { description: 'Updated' } },
+  },
+  delete: {
+    tags: ['Teams'],
+    summary: 'Archive a team (use POST /unarchive to restore)',
+    description: 'Requires the `team.manage` scope/permission.',
+    parameters: [{ name: 'teamId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: { 204: { description: 'Archived' } },
+  },
+})
+
+registerPath('/teams/{teamId}/unarchive', {
+  post: {
+    tags: ['Teams'],
+    summary: 'Restore an archived team',
+    description: 'Requires the `team.manage` scope/permission.',
+    parameters: [{ name: 'teamId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Restored',
+        content: { 'application/json': { schema: createItemResponseSchema(TeamSchema, 'Team') } },
+      },
+      404: { description: 'Team not found' },
+    },
+  },
+})
+
+registerPath('/teams/{teamId}/members', {
+  get: {
+    tags: ['Teams'],
+    summary: 'List team members',
+    parameters: [{ name: 'teamId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Members',
+        content: {
+          'application/json': {
+            schema: createPaginatedResponseSchema(TeamMemberSchema, 'Members'),
+          },
+        },
+      },
+    },
+  },
+  post: {
+    tags: ['Teams'],
+    summary: 'Add or update a team member',
+    description: 'Requires the `team.manage` scope/permission.',
+    parameters: [{ name: 'teamId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              principalId: TypeIdSchema,
+              role: z.enum(['lead', 'member']).optional(),
+            })
+          ),
+        },
+      },
+    },
+    responses: {
+      201: {
+        description: 'Member added',
+        content: {
+          'application/json': { schema: createItemResponseSchema(TeamMemberSchema, 'Member') },
+        },
+      },
+    },
+  },
+})
+
+registerPath('/teams/{teamId}/members/{principalId}', {
+  delete: {
+    tags: ['Teams'],
+    summary: 'Remove a team member',
+    description: 'Requires the `team.manage` scope/permission.',
+    parameters: [
+      { name: 'teamId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'principalId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: { 204: { description: 'Removed' } },
+  },
+})
diff --git a/apps/web/src/lib/server/domains/api/schemas/ticket-statuses.ts b/apps/web/src/lib/server/domains/api/schemas/ticket-statuses.ts
new file mode 100644
index 000000000..177e4b514
--- /dev/null
+++ b/apps/web/src/lib/server/domains/api/schemas/ticket-statuses.ts
@@ -0,0 +1,192 @@
+/**
+ * Ticket-statuses API schema registrations.
+ *
+ * The workflow status catalogue used by `/api/v1/tickets/:id/transition`.
+ * Distinct from `/statuses`, which covers feedback-board post statuses.
+ */
+import 'zod-openapi'
+import { z } from 'zod'
+import {
+  registerPath,
+  TypeIdSchema,
+  createItemResponseSchema,
+  createPaginatedResponseSchema,
+  asSchema,
+} from '../openapi'
+import {
+  TimestampSchema,
+  NullableTimestampSchema,
+  HexColorSchema,
+  SlugSchema,
+  UnauthorizedErrorSchema,
+  NotFoundErrorSchema,
+  ValidationErrorSchema,
+} from './common'
+
+const STATUS_CATEGORIES = ['open', 'pending', 'on_hold', 'solved', 'closed'] as const
+
+const TicketStatusSchema = z
+  .object({
+    id: TypeIdSchema.meta({ example: 'ticket_status_01h455vb4pex5vsknk084sn02q' }),
+    name: z.string(),
+    slug: SlugSchema,
+    color: HexColorSchema.nullable(),
+    category: z.enum(STATUS_CATEGORIES),
+    position: z.number().int(),
+    isDefault: z.boolean(),
+    isSystem: z.boolean().meta({ description: 'System statuses cannot be archived' }),
+    createdAt: TimestampSchema,
+    deletedAt: NullableTimestampSchema,
+  })
+  .meta({ description: 'Ticket workflow status (workflow state)' })
+
+const CreateTicketStatusSchema = z
+  .object({
+    name: z.string().min(1).max(50),
+    slug: z
+      .string()
+      .min(1)
+      .max(50)
+      .regex(/^[a-z0-9_-]+$/, 'slug must match [a-z0-9_-]+'),
+    color: HexColorSchema.optional(),
+    category: z.enum(STATUS_CATEGORIES),
+    position: z.number().int().min(0).optional(),
+    isDefault: z.boolean().optional(),
+  })
+  .meta({ description: 'Create ticket-status request body' })
+
+const UpdateTicketStatusSchema = z
+  .object({
+    name: z.string().min(1).max(50).optional(),
+    color: HexColorSchema.optional(),
+    category: z.enum(STATUS_CATEGORIES).optional(),
+    position: z.number().int().min(0).optional(),
+    isDefault: z.boolean().optional(),
+  })
+  .meta({ description: 'Update ticket-status request body' })
+
+registerPath('/ticket-statuses', {
+  get: {
+    tags: ['Ticket Statuses'],
+    summary: 'List ticket statuses',
+    description: 'Returns the workspace ticket-status catalogue, ordered by position.',
+    parameters: [
+      {
+        name: 'includeDeleted',
+        in: 'query',
+        required: false,
+        schema: { type: 'boolean' },
+        description: 'Include archived statuses',
+      },
+    ],
+    responses: {
+      200: {
+        description: 'List of ticket statuses',
+        content: {
+          'application/json': {
+            schema: createPaginatedResponseSchema(TicketStatusSchema, 'Statuses'),
+          },
+        },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: UnauthorizedErrorSchema } },
+      },
+    },
+  },
+  post: {
+    tags: ['Ticket Statuses'],
+    summary: 'Create a ticket status (admin)',
+    requestBody: {
+      required: true,
+      content: { 'application/json': { schema: asSchema(CreateTicketStatusSchema) } },
+    },
+    responses: {
+      201: {
+        description: 'Status created',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(TicketStatusSchema, 'Status'),
+          },
+        },
+      },
+      400: {
+        description: 'Validation error',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: UnauthorizedErrorSchema } },
+      },
+      409: { description: 'Slug already in use' },
+    },
+  },
+})
+
+registerPath('/ticket-statuses/{statusId}', {
+  get: {
+    tags: ['Ticket Statuses'],
+    summary: 'Get a ticket status',
+    parameters: [{ name: 'statusId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Status',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(TicketStatusSchema, 'Status'),
+          },
+        },
+      },
+      404: {
+        description: 'Status not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+  patch: {
+    tags: ['Ticket Statuses'],
+    summary: 'Update a ticket status (admin)',
+    parameters: [{ name: 'statusId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: { 'application/json': { schema: asSchema(UpdateTicketStatusSchema) } },
+    },
+    responses: {
+      200: {
+        description: 'Status updated',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(TicketStatusSchema, 'Status'),
+          },
+        },
+      },
+      400: {
+        description: 'Validation error',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+      404: {
+        description: 'Status not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+  delete: {
+    tags: ['Ticket Statuses'],
+    summary: 'Archive a ticket status (admin)',
+    description:
+      'Soft-archives the status (sets `deletedAt`). Returns 409 if any active ticket still references the status, and rejects with 400 for system statuses.',
+    parameters: [{ name: 'statusId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      204: { description: 'Archived' },
+      400: {
+        description: 'System status — cannot archive',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+      404: {
+        description: 'Status not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+      409: { description: 'Status is still referenced by active tickets' },
+    },
+  },
+})
diff --git a/apps/web/src/lib/server/domains/api/schemas/tickets.ts b/apps/web/src/lib/server/domains/api/schemas/tickets.ts
new file mode 100644
index 000000000..b08f598e7
--- /dev/null
+++ b/apps/web/src/lib/server/domains/api/schemas/tickets.ts
@@ -0,0 +1,913 @@
+/**
+ * Tickets API schema registrations (Phase 3-7).
+ *
+ * Covers the public ticket-management surface: queue list, CRUD, threads,
+ * participants, share, take/return, bulk ops, and SLA read.
+ */
+import 'zod-openapi'
+import { z } from 'zod'
+import {
+  registerPath,
+  TypeIdSchema,
+  createItemResponseSchema,
+  createPaginatedResponseSchema,
+  asSchema,
+} from '../openapi'
+import {
+  TimestampSchema,
+  NullableTimestampSchema,
+  UnauthorizedErrorSchema,
+  NotFoundErrorSchema,
+  ValidationErrorSchema,
+} from './common'
+
+const TICKET_PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+const TICKET_CHANNELS = ['portal', 'email', 'api', 'widget'] as const
+const TICKET_VISIBILITY = ['team', 'org', 'shared', 'private'] as const
+const STATUS_CATEGORIES = ['open', 'pending', 'on_hold', 'solved', 'closed'] as const
+const SCOPES = [
+  'all',
+  'my_assigned',
+  'my_team',
+  'shared_with_me',
+  'unassigned',
+  'my_inbox',
+  'inbox',
+] as const
+
+const TicketSchema = z
+  .object({
+    id: TypeIdSchema.meta({ example: 'ticket_01h455vb4pex5vsknk084sn02q' }),
+    subject: z.string(),
+    descriptionText: z.string().nullable(),
+    priority: z.enum(TICKET_PRIORITIES),
+    channel: z.enum(TICKET_CHANNELS),
+    visibilityScope: z.enum(TICKET_VISIBILITY),
+    statusId: TypeIdSchema.nullable(),
+    primaryTeamId: TypeIdSchema.nullable(),
+    assigneePrincipalId: TypeIdSchema.nullable(),
+    assigneeTeamId: TypeIdSchema.nullable(),
+    requesterPrincipalId: TypeIdSchema.nullable(),
+    requesterContactId: TypeIdSchema.nullable(),
+    organizationId: TypeIdSchema.nullable(),
+    inboxId: TypeIdSchema.nullable(),
+    slaPolicyId: TypeIdSchema.nullable(),
+    firstResponseAt: NullableTimestampSchema,
+    resolvedAt: NullableTimestampSchema,
+    reopenedAt: NullableTimestampSchema,
+    closedAt: NullableTimestampSchema,
+    lastActivityAt: NullableTimestampSchema,
+    createdAt: TimestampSchema,
+    updatedAt: TimestampSchema,
+  })
+  .meta({ description: 'Ticket header record' })
+
+const CreateTicketSchema = z
+  .object({
+    subject: z.string().min(1).max(500),
+    descriptionJson: z.unknown().nullable().optional(),
+    descriptionText: z.string().max(100_000).nullable().optional(),
+    priority: z.enum(TICKET_PRIORITIES).optional(),
+    channel: z.enum(TICKET_CHANNELS).optional(),
+    visibilityScope: z.enum(TICKET_VISIBILITY).optional(),
+    statusId: TypeIdSchema.nullable().optional(),
+    primaryTeamId: TypeIdSchema.nullable().optional(),
+    assigneePrincipalId: TypeIdSchema.nullable().optional(),
+    assigneeTeamId: TypeIdSchema.nullable().optional(),
+    requesterPrincipalId: TypeIdSchema.nullable().optional(),
+    requesterContactId: TypeIdSchema.nullable().optional(),
+    organizationId: TypeIdSchema.nullable().optional(),
+    inboxId: TypeIdSchema.nullable().optional(),
+  })
+  .meta({ description: 'Create ticket request body' })
+
+const PatchTicketSchema = z
+  .object({
+    expectedUpdatedAt: TimestampSchema,
+    subject: z.string().min(1).max(500).optional(),
+    priority: z.enum(TICKET_PRIORITIES).optional(),
+    visibilityScope: z.enum(TICKET_VISIBILITY).optional(),
+    primaryTeamId: TypeIdSchema.nullable().optional(),
+    organizationId: TypeIdSchema.nullable().optional(),
+    requesterContactId: TypeIdSchema.nullable().optional(),
+  })
+  .meta({ description: 'Patch ticket request body (optimistic concurrency)' })
+
+const ThreadSchema = z
+  .object({
+    id: TypeIdSchema.meta({ example: 'ticket_thread_01h455vb4pex5vsknk084sn02q' }),
+    ticketId: TypeIdSchema,
+    principalId: TypeIdSchema.nullable(),
+    audience: z.enum(['public', 'internal', 'shared_team']),
+    sharedWithTeamId: TypeIdSchema.nullable(),
+    bodyText: z.string().nullable(),
+    bodyJson: z.unknown().nullable(),
+    createdAt: TimestampSchema,
+    editedAt: NullableTimestampSchema,
+  })
+  .meta({ description: 'Ticket thread (message)' })
+
+const AddThreadSchema = z
+  .object({
+    audience: z.enum(['public', 'internal', 'shared_team']),
+    bodyJson: z.unknown().nullable().optional(),
+    bodyText: z.string().max(100_000).nullable().optional(),
+    sharedWithTeamId: TypeIdSchema.nullable().optional(),
+  })
+  .meta({ description: 'Add thread to ticket request body' })
+
+const ParticipantSchema = z
+  .object({
+    id: TypeIdSchema,
+    ticketId: TypeIdSchema,
+    principalId: TypeIdSchema.nullable(),
+    contactId: TypeIdSchema.nullable(),
+    role: z.enum(['watcher', 'collaborator', 'cc']),
+    createdAt: TimestampSchema,
+  })
+  .meta({ description: 'Ticket participant' })
+
+const ShareSchema = z
+  .object({
+    id: TypeIdSchema,
+    ticketId: TypeIdSchema,
+    teamId: TypeIdSchema,
+    accessLevel: z.enum(['read', 'comment', 'full']),
+    grantedByPrincipalId: TypeIdSchema.nullable(),
+    grantedAt: TimestampSchema,
+    revokedAt: NullableTimestampSchema,
+  })
+  .meta({ description: 'Cross-team share grant' })
+
+const SlaClockSchema = z
+  .object({
+    id: TypeIdSchema,
+    ticketId: TypeIdSchema,
+    kind: z.enum(['first_response', 'next_response', 'resolution']),
+    state: z.enum(['running', 'paused', 'met', 'breached', 'cancelled']),
+    startedAt: TimestampSchema,
+    dueAt: TimestampSchema,
+    pausedAt: NullableTimestampSchema,
+    breachedAt: NullableTimestampSchema,
+    metAt: NullableTimestampSchema,
+  })
+  .meta({ description: 'Per-ticket SLA clock' })
+
+const BulkResultSchema = z
+  .object({
+    succeeded: z.array(TypeIdSchema),
+    failed: z.array(z.object({ ticketId: TypeIdSchema, reason: z.string() })),
+  })
+  .meta({ description: 'Best-effort bulk operation result' })
+
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+
+registerPath('/tickets', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'List tickets in scope',
+    description: 'Returns tickets visible to the caller, filtered by scope.',
+    parameters: [
+      { name: 'scope', in: 'query', schema: asSchema(z.enum(SCOPES).default('my_team')) },
+      {
+        name: 'statusCategory',
+        in: 'query',
+        schema: asSchema(z.enum(STATUS_CATEGORIES).optional()),
+      },
+      { name: 'inboxId', in: 'query', schema: asSchema(z.string().optional()) },
+      { name: 'search', in: 'query', schema: asSchema(z.string().optional()) },
+      { name: 'cursor', in: 'query', schema: asSchema(z.string().optional()) },
+      {
+        name: 'limit',
+        in: 'query',
+        schema: asSchema(z.coerce.number().min(1).max(200).optional()),
+      },
+    ],
+    responses: {
+      200: {
+        description: 'Ticket queue',
+        content: {
+          'application/json': {
+            schema: createPaginatedResponseSchema(TicketSchema, 'Tickets'),
+          },
+        },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: UnauthorizedErrorSchema } },
+      },
+    },
+  },
+  post: {
+    tags: ['Tickets'],
+    summary: 'Create a ticket',
+    requestBody: {
+      required: true,
+      content: { 'application/json': { schema: asSchema(CreateTicketSchema) } },
+    },
+    responses: {
+      201: {
+        description: 'Ticket created',
+        content: {
+          'application/json': { schema: createItemResponseSchema(TicketSchema, 'Ticket') },
+        },
+      },
+      400: {
+        description: 'Validation error',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/{ticketId}', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'Get a ticket',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Ticket',
+        content: {
+          'application/json': { schema: createItemResponseSchema(TicketSchema, 'Ticket') },
+        },
+      },
+      404: {
+        description: 'Not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+  patch: {
+    tags: ['Tickets'],
+    summary: 'Update ticket header (optimistic concurrency)',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: { 'application/json': { schema: asSchema(PatchTicketSchema) } },
+    },
+    responses: {
+      200: {
+        description: 'Updated ticket',
+        content: {
+          'application/json': { schema: createItemResponseSchema(TicketSchema, 'Ticket') },
+        },
+      },
+      409: { description: 'Conflict (stale expectedUpdatedAt)' },
+    },
+  },
+  delete: {
+    tags: ['Tickets'],
+    summary: 'Soft-delete a ticket',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: { 204: { description: 'Deleted' } },
+  },
+})
+
+registerPath('/tickets/{ticketId}/threads', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'List threads on a ticket (audience-filtered)',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Threads',
+        content: {
+          'application/json': { schema: createPaginatedResponseSchema(ThreadSchema, 'Threads') },
+        },
+      },
+    },
+  },
+  post: {
+    tags: ['Tickets'],
+    summary: 'Add a thread (public reply / internal note / shared note)',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: { 'application/json': { schema: asSchema(AddThreadSchema) } },
+    },
+    responses: {
+      201: {
+        description: 'Thread created',
+        content: {
+          'application/json': { schema: createItemResponseSchema(ThreadSchema, 'Thread') },
+        },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/{ticketId}/participants', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'List participants',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Participants',
+        content: {
+          'application/json': {
+            schema: createPaginatedResponseSchema(ParticipantSchema, 'Participants'),
+          },
+        },
+      },
+    },
+  },
+  post: {
+    tags: ['Tickets'],
+    summary: 'Add a participant',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              role: z.enum(['watcher', 'collaborator', 'cc']),
+              principalId: TypeIdSchema.optional(),
+              contactId: TypeIdSchema.optional(),
+            })
+          ),
+        },
+      },
+    },
+    responses: { 201: { description: 'Participant added' } },
+  },
+})
+
+registerPath('/tickets/{ticketId}/shares', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'List share grants',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Shares',
+        content: {
+          'application/json': { schema: createPaginatedResponseSchema(ShareSchema, 'Shares') },
+        },
+      },
+    },
+  },
+  post: {
+    tags: ['Tickets'],
+    summary: 'Share ticket with another team',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              teamId: TypeIdSchema,
+              accessLevel: z.enum(['read', 'comment', 'full']).default('read'),
+            })
+          ),
+        },
+      },
+    },
+    responses: { 201: { description: 'Share created' } },
+  },
+})
+
+registerPath('/tickets/{ticketId}/take', {
+  post: {
+    tags: ['Tickets'],
+    summary: 'Take (self-assign) a ticket',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(z.object({ expectedUpdatedAt: TimestampSchema })),
+        },
+      },
+    },
+    responses: { 200: { description: 'Ticket taken' } },
+  },
+})
+
+registerPath('/tickets/{ticketId}/return', {
+  post: {
+    tags: ['Tickets'],
+    summary: 'Return (un-self-assign) a ticket',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: { 200: { description: 'Ticket returned' } },
+  },
+})
+
+registerPath('/tickets/{ticketId}/sla', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'Get active SLA clocks for a ticket',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Clocks',
+        content: {
+          'application/json': { schema: createPaginatedResponseSchema(SlaClockSchema, 'Clocks') },
+        },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/bulk/assign', {
+  post: {
+    tags: ['Tickets'],
+    summary: 'Bulk-assign tickets (best-effort)',
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              ticketIds: z.array(TypeIdSchema).min(1).max(500),
+              assigneePrincipalId: TypeIdSchema.nullable(),
+            })
+          ),
+        },
+      },
+    },
+    responses: {
+      200: {
+        description: 'Per-ticket result',
+        content: { 'application/json': { schema: BulkResultSchema } },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/bulk/transition', {
+  post: {
+    tags: ['Tickets'],
+    summary: 'Bulk-transition ticket statuses (best-effort)',
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              ticketIds: z.array(TypeIdSchema).min(1).max(500),
+              statusId: TypeIdSchema,
+            })
+          ),
+        },
+      },
+    },
+    responses: { 200: { description: 'Per-ticket result' } },
+  },
+})
+
+registerPath('/tickets/bulk/change-inbox', {
+  post: {
+    tags: ['Tickets'],
+    summary: 'Bulk-move tickets to a different inbox (best-effort)',
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              ticketIds: z.array(TypeIdSchema).min(1).max(500),
+              inboxId: TypeIdSchema.nullable(),
+            })
+          ),
+        },
+      },
+    },
+    responses: { 200: { description: 'Per-ticket result' } },
+  },
+})
+
+// ---------------------------------------------------------------------------
+// Phase 1 additions: restore, activity, thread edit/delete, attachments
+// ---------------------------------------------------------------------------
+
+const ActivityRowSchema = z
+  .object({
+    id: TypeIdSchema,
+    ticketId: TypeIdSchema,
+    principalId: TypeIdSchema.nullable(),
+    type: z.string().meta({
+      description: 'Event type, e.g. ticket.created, ticket.status_changed, thread.added',
+    }),
+    metadata: z.unknown(),
+    createdAt: TimestampSchema,
+    actorName: z.string().nullable(),
+    actorAvatarUrl: z.string().nullable(),
+  })
+  .meta({ description: 'Single ticket-activity event' })
+
+const ActivityResponseSchema = z
+  .object({
+    data: z.object({
+      activity: z.array(ActivityRowSchema),
+      nextCursor: z
+        .string()
+        .nullable()
+        .meta({ description: 'ISO timestamp cursor for the next page; null when none' }),
+    }),
+  })
+  .meta({ description: 'Ticket activity timeline response' })
+
+const ThreadEditSchema = z
+  .object({
+    bodyJson: z.unknown().nullable().optional(),
+    bodyText: z.string().max(100_000).nullable().optional(),
+  })
+  .meta({ description: 'Edit thread body — author only. Provide bodyJson or bodyText.' })
+
+const AttachmentSchema = z
+  .object({
+    id: TypeIdSchema.meta({ example: 'ticket_att_01h455vb4pex5vsknk084sn02q' }),
+    threadId: TypeIdSchema,
+    uploadedByPrincipalId: TypeIdSchema.nullable(),
+    filename: z.string(),
+    mimeType: z.string(),
+    sizeBytes: z.number().int(),
+    storageKey: z.string(),
+    publicUrl: z.string().nullable(),
+    createdAt: TimestampSchema,
+  })
+  .meta({ description: 'Ticket attachment metadata' })
+
+registerPath('/tickets/{ticketId}/restore', {
+  post: {
+    tags: ['Tickets'],
+    summary: 'Restore a soft-deleted ticket (admin)',
+    description:
+      'Pairs with `DELETE /tickets/{ticketId}`. Admin-only. Returns 409 if the ticket is not deleted.',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    responses: {
+      200: {
+        description: 'Ticket restored',
+        content: {
+          'application/json': { schema: createItemResponseSchema(TicketSchema, 'Ticket') },
+        },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: UnauthorizedErrorSchema } },
+      },
+      404: {
+        description: 'Ticket not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+      409: { description: 'Ticket is not deleted' },
+    },
+  },
+})
+
+registerPath('/tickets/{ticketId}/activity', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'List ticket activity (timeline)',
+    description:
+      'Reverse-chronological feed of all activity events on the ticket. Use `before` (ISO timestamp) for pagination.',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      {
+        name: 'before',
+        in: 'query',
+        required: false,
+        schema: { type: 'string', format: 'date-time' },
+        description: 'Return rows strictly older than this timestamp',
+      },
+      {
+        name: 'limit',
+        in: 'query',
+        required: false,
+        schema: { type: 'integer', minimum: 1, maximum: 200 },
+        description: 'Default 50, max 200',
+      },
+    ],
+    responses: {
+      200: {
+        description: 'Activity timeline page',
+        content: { 'application/json': { schema: asSchema(ActivityResponseSchema) } },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: UnauthorizedErrorSchema } },
+      },
+      404: {
+        description: 'Ticket not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/{ticketId}/threads/{threadId}', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'Get a single thread',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'threadId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: {
+      200: {
+        description: 'Thread detail',
+        content: {
+          'application/json': { schema: createItemResponseSchema(ThreadSchema, 'Thread') },
+        },
+      },
+      404: {
+        description: 'Ticket or thread not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+  patch: {
+    tags: ['Tickets'],
+    summary: 'Edit a thread (author only)',
+    description: 'Only the original author may edit. Stamps `editedAt` and `editedByPrincipalId`.',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'threadId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    requestBody: {
+      required: true,
+      content: { 'application/json': { schema: asSchema(ThreadEditSchema) } },
+    },
+    responses: {
+      200: {
+        description: 'Thread updated',
+        content: {
+          'application/json': { schema: createItemResponseSchema(ThreadSchema, 'Thread') },
+        },
+      },
+      400: {
+        description: 'Validation error',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+      403: { description: 'Not the author' },
+      404: {
+        description: 'Ticket or thread not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+  delete: {
+    tags: ['Tickets'],
+    summary: 'Soft-delete a thread',
+    description:
+      'Author or any caller with `ticket.edit_fields` may soft-delete. The row is marked `deletedAt`.',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'threadId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: {
+      204: { description: 'Deleted' },
+      403: { description: 'Not the author and lacks ticket.edit_fields' },
+      404: {
+        description: 'Ticket or thread not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/{ticketId}/threads/{threadId}/attachments', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'List attachments on a thread',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'threadId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: {
+      200: {
+        description: 'Attachments',
+        content: {
+          'application/json': {
+            schema: createPaginatedResponseSchema(AttachmentSchema, 'Attachments'),
+          },
+        },
+      },
+      404: {
+        description: 'Ticket or thread not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+  post: {
+    tags: ['Tickets'],
+    summary: 'Upload an attachment to a thread (multipart)',
+    description:
+      'multipart/form-data with a `file` field. Image MIME types only (jpeg/png/gif/webp/avif), 5 MB cap.',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'threadId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    requestBody: {
+      required: true,
+      content: {
+        'multipart/form-data': {
+          schema: {
+            type: 'object',
+            properties: {
+              file: { type: 'string', format: 'binary' },
+            },
+            required: ['file'],
+          },
+        },
+      },
+    },
+    responses: {
+      201: {
+        description: 'Attachment created',
+        content: {
+          'application/json': {
+            schema: createItemResponseSchema(AttachmentSchema, 'Attachment'),
+          },
+        },
+      },
+      400: {
+        description: 'Invalid upload',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+      404: {
+        description: 'Ticket or thread not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/{ticketId}/threads/{threadId}/attachments/{attachmentId}', {
+  get: {
+    tags: ['Tickets'],
+    summary: 'Get a single attachment',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'threadId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'attachmentId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: {
+      200: {
+        description: 'Attachment detail',
+        content: {
+          'application/json': { schema: createItemResponseSchema(AttachmentSchema, 'Attachment') },
+        },
+      },
+      404: {
+        description: 'Ticket / thread / attachment not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+  delete: {
+    tags: ['Tickets'],
+    summary: 'Delete an attachment',
+    description:
+      'Removes the metadata row. Allowed for the original uploader or any caller with `ticket.edit_fields`.',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'threadId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'attachmentId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: {
+      204: { description: 'Deleted' },
+      403: { description: 'Not the uploader and lacks ticket.edit_fields' },
+      404: {
+        description: 'Ticket / thread / attachment not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+})
+
+// ---------------------------------------------------------------------------
+// Assign & Transition
+// ---------------------------------------------------------------------------
+
+registerPath('/tickets/{ticketId}/assign', {
+  post: {
+    tags: ['Tickets'],
+    summary: 'Assign a ticket',
+    description:
+      'Assign to an agent (assigneePrincipalId) and/or a team (assigneeTeamId). Requires `ticket.assign_any` or `ticket.assign_self` if assigning to self.',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              expectedUpdatedAt: z.string().datetime(),
+              assigneePrincipalId: TypeIdSchema.nullable().optional(),
+              assigneeTeamId: TypeIdSchema.nullable().optional(),
+            })
+          ),
+        },
+      },
+    },
+    responses: {
+      200: {
+        description: 'Ticket assigned',
+        content: {
+          'application/json': { schema: createItemResponseSchema(TicketSchema, 'Ticket') },
+        },
+      },
+      400: {
+        description: 'Validation error',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+      403: { description: 'Insufficient permissions' },
+      404: {
+        description: 'Ticket not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/{ticketId}/transition', {
+  post: {
+    tags: ['Tickets'],
+    summary: 'Transition ticket status',
+    description:
+      'Move the ticket to a new status. Sets lifecycle timestamps based on the destination category. Requires `ticket.edit_fields`.',
+    parameters: [{ name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) }],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: asSchema(
+            z.object({
+              expectedUpdatedAt: z.string().datetime(),
+              statusId: TypeIdSchema,
+            })
+          ),
+        },
+      },
+    },
+    responses: {
+      200: {
+        description: 'Ticket transitioned',
+        content: {
+          'application/json': { schema: createItemResponseSchema(TicketSchema, 'Ticket') },
+        },
+      },
+      400: {
+        description: 'Validation error',
+        content: { 'application/json': { schema: ValidationErrorSchema } },
+      },
+      403: { description: 'ticket.edit_fields required' },
+      404: {
+        description: 'Ticket not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+})
+
+// ---------------------------------------------------------------------------
+// Sub-resource deletions
+// ---------------------------------------------------------------------------
+
+registerPath('/tickets/{ticketId}/shares/{shareId}', {
+  delete: {
+    tags: ['Tickets'],
+    summary: 'Revoke a share',
+    description: 'Revoke a cross-team share grant. Requires `ticket.share_cross_team`.',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'shareId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: {
+      204: { description: 'Share revoked' },
+      403: { description: 'ticket.share_cross_team required' },
+      404: {
+        description: 'Ticket or share not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+})
+
+registerPath('/tickets/{ticketId}/participants/{participantId}', {
+  delete: {
+    tags: ['Tickets'],
+    summary: 'Remove a participant',
+    description:
+      'Remove a watcher/collaborator/CC from the ticket. Requires `ticket.manage_participants`.',
+    parameters: [
+      { name: 'ticketId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+      { name: 'participantId', in: 'path', required: true, schema: asSchema(TypeIdSchema) },
+    ],
+    responses: {
+      204: { description: 'Participant removed' },
+      403: { description: 'ticket.manage_participants required' },
+      404: {
+        description: 'Ticket or participant not found',
+        content: { 'application/json': { schema: NotFoundErrorSchema } },
+      },
+    },
+  },
+})
diff --git a/apps/web/src/lib/server/domains/audit/__tests__/audit-unified.test.ts b/apps/web/src/lib/server/domains/audit/__tests__/audit-unified.test.ts
new file mode 100644
index 000000000..d7d03f5c1
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/__tests__/audit-unified.test.ts
@@ -0,0 +1,494 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  workspaceLimitMock: vi.fn(),
+  securityLimitMock: vi.fn(),
+  workspaceActionsLimitMock: vi.fn(),
+  securityActionsLimitMock: vi.fn(),
+  workspaceWhereMock: vi.fn(),
+  securityWhereMock: vi.fn(),
+  workspaceOrderByMock: vi.fn(),
+  securityOrderByMock: vi.fn(),
+  workspaceLeftJoinMock: vi.fn(),
+  selectMock: vi.fn(),
+  selectDistinctMock: vi.fn(),
+  andMock: vi.fn(),
+  descMock: vi.fn(),
+  eqMock: vi.fn(),
+  gteMock: vi.fn(),
+  ilikeMock: vi.fn(),
+  likeMock: vi.fn(),
+  ltMock: vi.fn(),
+  lteMock: vi.fn(),
+  notInArrayMock: vi.fn(),
+  orMock: vi.fn(),
+}))
+
+function tableChain(kind: 'workspace' | 'security') {
+  const chain = {
+    leftJoin: (...args: unknown[]) => {
+      hoisted.workspaceLeftJoinMock(...args)
+      return chain
+    },
+    where: (condition: unknown) => {
+      if (kind === 'workspace') hoisted.workspaceWhereMock(condition)
+      else hoisted.securityWhereMock(condition)
+      return chain
+    },
+    orderBy: (...args: unknown[]) => {
+      if (kind === 'workspace') hoisted.workspaceOrderByMock(...args)
+      else hoisted.securityOrderByMock(...args)
+      return chain
+    },
+    limit: (limit: number) =>
+      kind === 'workspace' ? hoisted.workspaceLimitMock(limit) : hoisted.securityLimitMock(limit),
+  }
+  return chain
+}
+
+function distinctChain(kind: 'workspace' | 'security') {
+  const chain = {
+    orderBy: () => chain,
+    limit: (limit: number) =>
+      kind === 'workspace'
+        ? hoisted.workspaceActionsLimitMock(limit)
+        : hoisted.securityActionsLimitMock(limit),
+  }
+  return chain
+}
+
+vi.mock('@/lib/server/db', () => ({
+  and: (...args: unknown[]) => hoisted.andMock(...args),
+  auditEvents: {
+    _table: 'workspace',
+    id: 'auditEvents.id',
+    createdAt: 'auditEvents.createdAt',
+    principalId: 'auditEvents.principalId',
+    action: 'auditEvents.action',
+    targetType: 'auditEvents.targetType',
+    targetId: 'auditEvents.targetId',
+    diff: 'auditEvents.diff',
+    source: 'auditEvents.source',
+    ipAddress: 'auditEvents.ipAddress',
+    userAgent: 'auditEvents.userAgent',
+  },
+  auditLog: {
+    _table: 'security',
+    id: 'auditLog.id',
+    occurredAt: 'auditLog.occurredAt',
+    actorUserId: 'auditLog.actorUserId',
+    actorEmail: 'auditLog.actorEmail',
+    actorRole: 'auditLog.actorRole',
+    actorIp: 'auditLog.actorIp',
+    actorUserAgent: 'auditLog.actorUserAgent',
+    eventType: 'auditLog.eventType',
+    eventOutcome: 'auditLog.eventOutcome',
+    targetType: 'auditLog.targetType',
+    targetId: 'auditLog.targetId',
+    beforeValue: 'auditLog.beforeValue',
+    afterValue: 'auditLog.afterValue',
+    metadata: 'auditLog.metadata',
+    requestId: 'auditLog.requestId',
+    actorType: 'auditLog.actorType',
+    authMethod: 'auditLog.authMethod',
+  },
+  db: {
+    select: (...args: unknown[]) => hoisted.selectMock(...args),
+    selectDistinct: (...args: unknown[]) => hoisted.selectDistinctMock(...args),
+  },
+  desc: (...args: unknown[]) => hoisted.descMock(...args),
+  eq: (...args: unknown[]) => hoisted.eqMock(...args),
+  gte: (...args: unknown[]) => hoisted.gteMock(...args),
+  ilike: (...args: unknown[]) => hoisted.ilikeMock(...args),
+  like: (...args: unknown[]) => hoisted.likeMock(...args),
+  lt: (...args: unknown[]) => hoisted.ltMock(...args),
+  lte: (...args: unknown[]) => hoisted.lteMock(...args),
+  notInArray: (...args: unknown[]) => hoisted.notInArrayMock(...args),
+  or: (...args: unknown[]) => hoisted.orMock(...args),
+  principal: {
+    id: 'principal.id',
+    userId: 'principal.userId',
+    displayName: 'principal.displayName',
+    role: 'principal.role',
+    type: 'principal.type',
+  },
+  user: {
+    id: 'user.id',
+    email: 'user.email',
+    name: 'user.name',
+  },
+}))
+
+import {
+  decodeUnifiedAuditCursor,
+  encodeUnifiedAuditCursor,
+  listUnifiedAuditActions,
+  listUnifiedAuditEvents,
+  pageUnifiedAuditRows,
+  type UnifiedAuditEventRow,
+} from '../audit.unified'
+
+function row(overrides: Partial<UnifiedAuditEventRow>): UnifiedAuditEventRow {
+  return {
+    id: 'audit_default',
+    origin: 'workspace',
+    occurredAt: new Date('2026-06-01T12:00:00.000Z'),
+    principalId: null,
+    actorUserId: null,
+    actorEmail: null,
+    actorDisplayName: null,
+    actorRole: null,
+    actorType: null,
+    authMethod: null,
+    action: 'ticket.created',
+    outcome: null,
+    source: 'web',
+    targetType: 'ticket',
+    targetId: 'ticket_1',
+    requestId: null,
+    ipAddress: null,
+    userAgent: null,
+    diff: {},
+    metadata: null,
+    ...overrides,
+  }
+}
+
+function workspaceDbRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'audit_workspace',
+    createdAt: new Date('2026-06-01T12:00:00.000Z'),
+    principalId: 'principal_1',
+    action: 'ticket.created',
+    targetType: 'ticket',
+    targetId: 'ticket_1',
+    diff: { after: { title: 'Hello' } },
+    source: 'web',
+    ipAddress: '203.0.113.10',
+    userAgent: 'vitest',
+    actorUserId: 'user_1',
+    actorEmail: 'agent@example.com',
+    actorDisplayName: null,
+    actorRole: 'admin',
+    actorType: 'user',
+    userName: 'Agent User',
+    ...overrides,
+  }
+}
+
+function securityDbRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'audit_security',
+    occurredAt: new Date('2026-06-01T12:01:00.000Z'),
+    actorUserId: 'user_2',
+    actorEmail: 'security@example.com',
+    actorRole: 'admin',
+    actorIp: '203.0.113.11',
+    actorUserAgent: 'vitest-security',
+    eventType: 'auth.signin.success',
+    eventOutcome: 'success',
+    targetType: 'user',
+    targetId: 'user_2',
+    beforeValue: { enabled: false },
+    afterValue: { enabled: true },
+    metadata: { provider: 'sso' },
+    requestId: 'req_123',
+    actorType: 'user',
+    authMethod: 'sso',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  hoisted.andMock.mockImplementation((...parts: unknown[]) => ['and', ...parts])
+  hoisted.descMock.mockImplementation((column: unknown) => ['desc', column])
+  hoisted.eqMock.mockImplementation((left: unknown, right: unknown) => ['eq', left, right])
+  hoisted.gteMock.mockImplementation((left: unknown, right: unknown) => ['gte', left, right])
+  hoisted.ilikeMock.mockImplementation((left: unknown, right: unknown) => ['ilike', left, right])
+  hoisted.likeMock.mockImplementation((left: unknown, right: unknown) => ['like', left, right])
+  hoisted.ltMock.mockImplementation((left: unknown, right: unknown) => ['lt', left, right])
+  hoisted.lteMock.mockImplementation((left: unknown, right: unknown) => ['lte', left, right])
+  hoisted.notInArrayMock.mockImplementation((left: unknown, right: unknown) => [
+    'notInArray',
+    left,
+    right,
+  ])
+  hoisted.orMock.mockImplementation((...parts: unknown[]) => ['or', ...parts])
+  hoisted.selectMock.mockReturnValue({
+    from: (table: { _table?: 'workspace' | 'security' }) => tableChain(table._table ?? 'workspace'),
+  })
+  hoisted.selectDistinctMock.mockReturnValue({
+    from: (table: { _table?: 'workspace' | 'security' }) =>
+      distinctChain(table._table ?? 'workspace'),
+  })
+  hoisted.workspaceLimitMock.mockResolvedValue([])
+  hoisted.securityLimitMock.mockResolvedValue([])
+  hoisted.workspaceActionsLimitMock.mockResolvedValue([])
+  hoisted.securityActionsLimitMock.mockResolvedValue([])
+})
+
+describe('pageUnifiedAuditRows', () => {
+  it('sorts mixed workspace and security rows by timestamp, origin, then id', () => {
+    const page = pageUnifiedAuditRows(
+      [
+        row({
+          id: 'audit_a',
+          origin: 'security',
+          occurredAt: new Date('2026-06-01T12:00:00.000Z'),
+          action: 'auth.signin.success',
+        }),
+        row({
+          id: 'audit_b',
+          origin: 'workspace',
+          occurredAt: new Date('2026-06-01T12:00:00.000Z'),
+          action: 'ticket.updated',
+        }),
+        row({
+          id: 'audit_c',
+          origin: 'workspace',
+          occurredAt: new Date('2026-06-01T12:01:00.000Z'),
+          action: 'role.granted',
+        }),
+      ],
+      { limit: 10 }
+    )
+
+    expect(page.items.map((item) => `${item.origin}:${item.id}`)).toEqual([
+      'workspace:audit_c',
+      'workspace:audit_b',
+      'security:audit_a',
+    ])
+  })
+
+  it('paginates without duplicates when the cursor lands between origins at the same timestamp', () => {
+    const rows = [
+      row({
+        id: 'audit_c',
+        origin: 'workspace',
+        occurredAt: new Date('2026-06-01T12:00:00.000Z'),
+      }),
+      row({
+        id: 'audit_b',
+        origin: 'workspace',
+        occurredAt: new Date('2026-06-01T12:00:00.000Z'),
+      }),
+      row({
+        id: 'audit_z',
+        origin: 'security',
+        occurredAt: new Date('2026-06-01T12:00:00.000Z'),
+      }),
+    ]
+
+    const first = pageUnifiedAuditRows(rows, { limit: 2 })
+    const second = pageUnifiedAuditRows(rows, { limit: 2, cursor: first.nextCursor ?? undefined })
+
+    expect(first.items.map((item) => `${item.origin}:${item.id}`)).toEqual([
+      'workspace:audit_c',
+      'workspace:audit_b',
+    ])
+    expect(second.items.map((item) => `${item.origin}:${item.id}`)).toEqual(['security:audit_z'])
+  })
+
+  it('preserves security observability fields in paged rows', () => {
+    const security = row({
+      id: 'audit_security',
+      origin: 'security',
+      action: 'auth.signin.success',
+      outcome: 'success',
+      requestId: 'req_abc123',
+      actorType: 'user',
+      authMethod: 'sso',
+      metadata: { method: 'sso' },
+    })
+
+    const page = pageUnifiedAuditRows([security], {
+      cursor: encodeUnifiedAuditCursor(
+        row({
+          id: 'audit_newer',
+          origin: 'workspace',
+          occurredAt: new Date('2026-06-01T12:01:00.000Z'),
+        })
+      ),
+    })
+
+    expect(page.items[0]).toMatchObject({
+      requestId: 'req_abc123',
+      actorType: 'user',
+      authMethod: 'sso',
+      metadata: { method: 'sso' },
+    })
+  })
+
+  it('decodes missing, malformed, and valid cursors defensively', () => {
+    expect(decodeUnifiedAuditCursor(undefined)).toBeNull()
+    expect(decodeUnifiedAuditCursor('not-valid-base64-json')).toBeNull()
+    expect(
+      decodeUnifiedAuditCursor(
+        Buffer.from(JSON.stringify({ t: 'bad', o: 'workspace', i: 'x' })).toString('base64url')
+      )
+    ).toBeNull()
+
+    const cursor = encodeUnifiedAuditCursor(
+      row({ id: 'audit_cursor', occurredAt: new Date('2026-06-01T12:02:00.000Z') })
+    )
+    expect(decodeUnifiedAuditCursor(cursor)).toEqual({
+      t: new Date('2026-06-01T12:02:00.000Z').getTime(),
+      o: 'workspace',
+      i: 'audit_cursor',
+    })
+  })
+})
+
+describe('listUnifiedAuditEvents', () => {
+  it('queries workspace and security audit stores, normalizes rows, and applies shared filters', async () => {
+    hoisted.workspaceLimitMock.mockResolvedValue([
+      workspaceDbRow({ actorDisplayName: null, userName: 'Workspace Agent' }),
+    ])
+    hoisted.securityLimitMock.mockResolvedValue([securityDbRow()])
+    const cursor = encodeUnifiedAuditCursor(
+      row({
+        id: 'audit_cursor',
+        origin: 'security',
+        occurredAt: new Date('2026-06-01T12:02:00.000Z'),
+      })
+    )
+
+    const page = await listUnifiedAuditEvents({
+      actionPrefix: 'ticket.',
+      targetType: 'ticket',
+      targetId: 'ticket_1',
+      actorEmail: ' Agent ',
+      from: new Date('2026-06-01T00:00:00.000Z'),
+      to: new Date('2026-06-02T00:00:00.000Z'),
+      cursor,
+      limit: 500,
+    })
+
+    expect(page.items).toHaveLength(2)
+    expect(page.items[0]).toMatchObject({
+      id: 'audit_security',
+      origin: 'security',
+      action: 'auth.signin.success',
+      outcome: 'success',
+      requestId: 'req_123',
+      ipAddress: '203.0.113.11',
+      userAgent: 'vitest-security',
+      diff: {
+        before: { enabled: false },
+        after: { enabled: true },
+        context: {
+          metadata: { provider: 'sso' },
+          requestId: 'req_123',
+          actorType: 'user',
+          authMethod: 'sso',
+        },
+      },
+    })
+    expect(page.items[1]).toMatchObject({
+      id: 'audit_workspace',
+      origin: 'workspace',
+      actorDisplayName: 'Workspace Agent',
+      source: 'web',
+      diff: { after: { title: 'Hello' } },
+    })
+    expect(hoisted.workspaceLimitMock).toHaveBeenCalledWith(201)
+    expect(hoisted.securityLimitMock).toHaveBeenCalledWith(201)
+    expect(hoisted.ilikeMock).toHaveBeenCalledWith('user.email', '%Agent%')
+    expect(hoisted.ilikeMock).toHaveBeenCalledWith('auditLog.actorEmail', '%Agent%')
+    expect(hoisted.workspaceWhereMock).toHaveBeenCalledWith(expect.arrayContaining(['and']))
+    expect(hoisted.securityWhereMock).toHaveBeenCalledWith(expect.arrayContaining(['and']))
+    expect(hoisted.workspaceLeftJoinMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('queries only workspace rows when workspace-only filters cannot apply to security audit', async () => {
+    const workspace = workspaceDbRow({
+      id: 'audit_workspace_only',
+      actorDisplayName: 'Direct Name',
+      userName: 'Fallback Name',
+    })
+    hoisted.workspaceLimitMock.mockResolvedValue([workspace])
+
+    const page = await listUnifiedAuditEvents({
+      principalId: 'principal_1' as never,
+      source: 'api',
+      action: 'ticket.updated',
+      limit: 0,
+    })
+
+    expect(page.items).toHaveLength(1)
+    expect(page.items[0]).toMatchObject({
+      id: 'audit_workspace_only',
+      actorDisplayName: 'Direct Name',
+      source: 'web',
+    })
+    expect(hoisted.workspaceLimitMock).toHaveBeenCalledWith(2)
+    expect(hoisted.securityLimitMock).not.toHaveBeenCalled()
+    expect(hoisted.eqMock).toHaveBeenCalledWith('auditEvents.principalId', 'principal_1')
+    expect(hoisted.eqMock).toHaveBeenCalledWith('auditEvents.source', 'api')
+  })
+
+  it('queries only security rows with exclusions and cursor ordering from a workspace cursor', async () => {
+    hoisted.securityLimitMock.mockResolvedValue([
+      securityDbRow({
+        id: 'audit_security_contextless',
+        beforeValue: null,
+        afterValue: undefined,
+        metadata: null,
+        requestId: null,
+        actorType: null,
+        authMethod: null,
+      }),
+    ])
+    const cursor = encodeUnifiedAuditCursor(
+      row({
+        id: 'audit_workspace_cursor',
+        origin: 'workspace',
+        occurredAt: new Date('2026-06-01T12:02:00.000Z'),
+      })
+    )
+
+    const page = await listUnifiedAuditEvents({
+      origin: 'security',
+      excludeSecurityActions: ['auth.session.refresh'],
+      cursor,
+    })
+
+    expect(page.items).toHaveLength(1)
+    expect(page.items[0]).toMatchObject({
+      id: 'audit_security_contextless',
+      origin: 'security',
+      diff: {},
+      metadata: null,
+    })
+    expect(hoisted.workspaceLimitMock).not.toHaveBeenCalled()
+    expect(hoisted.notInArrayMock).toHaveBeenCalledWith('auditLog.eventType', [
+      'auth.session.refresh',
+    ])
+    expect(hoisted.lteMock).toHaveBeenCalledWith(
+      'auditLog.occurredAt',
+      new Date('2026-06-01T12:02:00.000Z')
+    )
+  })
+})
+
+describe('listUnifiedAuditActions', () => {
+  it('merges and sorts distinct action names across stores', async () => {
+    hoisted.workspaceActionsLimitMock.mockResolvedValue([
+      { action: 'ticket.updated' },
+      { action: 'role.assigned' },
+    ])
+    hoisted.securityActionsLimitMock.mockResolvedValue([
+      { action: 'auth.signin.success' },
+      { action: 'ticket.updated' },
+    ])
+
+    await expect(listUnifiedAuditActions()).resolves.toEqual([
+      'auth.signin.success',
+      'role.assigned',
+      'ticket.updated',
+    ])
+    expect(hoisted.workspaceActionsLimitMock).toHaveBeenCalledWith(200)
+    expect(hoisted.securityActionsLimitMock).toHaveBeenCalledWith(200)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/audit/__tests__/audit.context.diffcov.test.ts b/apps/web/src/lib/server/domains/audit/__tests__/audit.context.diffcov.test.ts
new file mode 100644
index 000000000..ff48e6552
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/__tests__/audit.context.diffcov.test.ts
@@ -0,0 +1,59 @@
+/**
+ * Differential-coverage tests for audit.context — every branch of
+ * buildAuditContext: null auth, the AuthContext (principal) shape, and the
+ * ApiAuthContext (principalId) shape, each with present and defaulted fields.
+ */
+import { describe, it, expect } from 'vitest'
+import { buildAuditContext } from '../audit.context'
+
+describe('buildAuditContext', () => {
+  it('returns system attribution for null/undefined auth', () => {
+    expect(buildAuditContext(null)).toEqual({
+      principalId: null,
+      ipAddress: null,
+      userAgent: null,
+      source: 'system',
+    })
+    expect(buildAuditContext(undefined)).toMatchObject({ source: 'system' })
+  })
+
+  it('maps an AuthContext with all fields present', () => {
+    expect(
+      buildAuditContext({
+        principal: { id: 'p1' as never },
+        ipAddress: '1.2.3.4',
+        userAgent: 'agent',
+        source: 'api',
+      } as never)
+    ).toEqual({ principalId: 'p1', ipAddress: '1.2.3.4', userAgent: 'agent', source: 'api' })
+  })
+
+  it('defaults an AuthContext with missing fields (web source)', () => {
+    expect(buildAuditContext({ principal: { id: 'p1' as never } } as never)).toEqual({
+      principalId: 'p1',
+      ipAddress: null,
+      userAgent: null,
+      source: 'web',
+    })
+  })
+
+  it('maps an ApiAuthContext with all fields present', () => {
+    expect(
+      buildAuditContext({
+        principalId: 'p2' as never,
+        ipAddress: '5.6.7.8',
+        userAgent: 'ua',
+        source: 'web' as never,
+      })
+    ).toEqual({ principalId: 'p2', ipAddress: '5.6.7.8', userAgent: 'ua', source: 'web' })
+  })
+
+  it('defaults an ApiAuthContext with missing fields (api source)', () => {
+    expect(buildAuditContext({ principalId: 'p2' as never } as never)).toEqual({
+      principalId: 'p2',
+      ipAddress: null,
+      userAgent: null,
+      source: 'api',
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/audit/__tests__/audit.queries.diffcov.test.ts b/apps/web/src/lib/server/domains/audit/__tests__/audit.queries.diffcov.test.ts
new file mode 100644
index 000000000..4e8772788
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/__tests__/audit.queries.diffcov.test.ts
@@ -0,0 +1,126 @@
+/**
+ * Differential-coverage tests for audit.queries — cursor encode/decode,
+ * the full filter-condition matrix, cursor pagination (hasMore / nextCursor),
+ * and distinct-action listing.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  limitMock: vi.fn(),
+  distinctLimitMock: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => {
+  const selectChain = {
+    from: () => ({
+      where: () => ({ orderBy: () => ({ limit: m.limitMock }) }),
+    }),
+  }
+  const distinctChain = {
+    from: () => ({ orderBy: () => ({ limit: m.distinctLimitMock }) }),
+  }
+  const col = (name: string) => name
+  return {
+    db: {
+      select: vi.fn(() => selectChain),
+      selectDistinct: vi.fn(() => distinctChain),
+    },
+    auditEvents: {
+      id: col('id'),
+      createdAt: col('createdAt'),
+      principalId: col('principalId'),
+      action: col('action'),
+      targetType: col('targetType'),
+      targetId: col('targetId'),
+      diff: col('diff'),
+      source: col('source'),
+      ipAddress: col('ipAddress'),
+      userAgent: col('userAgent'),
+    },
+    and: vi.fn((...a) => ({ and: a })),
+    or: vi.fn((...a) => ({ or: a })),
+    eq: vi.fn((a, b) => ({ eq: [a, b] })),
+    gte: vi.fn((a, b) => ({ gte: [a, b] })),
+    lte: vi.fn((a, b) => ({ lte: [a, b] })),
+    lt: vi.fn((a, b) => ({ lt: [a, b] })),
+    like: vi.fn((a, b) => ({ like: [a, b] })),
+    desc: vi.fn((a) => a),
+    asc: vi.fn((a) => a),
+    sql: vi.fn(),
+  }
+})
+
+import { encodeCursor, decodeCursor, listAuditEvents, listDistinctActions } from '../audit.queries'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.limitMock.mockResolvedValue([])
+  m.distinctLimitMock.mockResolvedValue([])
+})
+
+describe('cursor encode/decode', () => {
+  it('round-trips a cursor', () => {
+    const cursor = encodeCursor(new Date('2026-01-02T03:04:05Z'), 'evt_1')
+    const decoded = decodeCursor(cursor)
+    expect(decoded).toEqual({ t: new Date('2026-01-02T03:04:05Z').getTime(), i: 'evt_1' })
+  })
+
+  it('returns null on malformed base64/json', () => {
+    expect(decodeCursor('!!!not-base64-json!!!')).toBeNull()
+  })
+
+  it('returns null when the payload has the wrong shape', () => {
+    const bad = Buffer.from(JSON.stringify({ t: 'x', i: 5 }), 'utf8').toString('base64url')
+    expect(decodeCursor(bad)).toBeNull()
+  })
+})
+
+describe('listAuditEvents', () => {
+  it('applies every filter plus a valid cursor and clamps the limit', async () => {
+    const cursor = encodeCursor(new Date('2026-01-01T00:00:00Z'), 'evt_cursor')
+    m.limitMock.mockResolvedValueOnce([])
+    const res = await listAuditEvents({
+      principalId: 'p1' as never,
+      action: 'ticket.created',
+      actionPrefix: 'ticket.',
+      targetType: 'ticket',
+      targetId: 't1',
+      source: 'api' as never,
+      from: new Date('2025-01-01'),
+      to: new Date('2026-12-31'),
+      cursor,
+      limit: 9999,
+    })
+    expect(res).toEqual({ items: [], nextCursor: null })
+  })
+
+  it('ignores an undecodable cursor', async () => {
+    const res = await listAuditEvents({ cursor: 'garbage', limit: -5 })
+    expect(res.nextCursor).toBeNull()
+  })
+
+  it('returns nextCursor when there are more rows than the limit', async () => {
+    const rows = [
+      { id: 'a', createdAt: new Date('2026-03-03') },
+      { id: 'b', createdAt: new Date('2026-02-02') },
+      { id: 'c', createdAt: new Date('2026-01-01') },
+    ]
+    m.limitMock.mockResolvedValueOnce(rows)
+    const res = await listAuditEvents({ limit: 2 })
+    expect(res.items).toHaveLength(2)
+    expect(res.nextCursor).toEqual(encodeCursor(new Date('2026-02-02'), 'b'))
+  })
+
+  it('runs with no filters (where undefined)', async () => {
+    m.limitMock.mockResolvedValueOnce([{ id: 'a', createdAt: new Date('2026-01-01') }])
+    const res = await listAuditEvents()
+    expect(res.nextCursor).toBeNull()
+  })
+})
+
+describe('listDistinctActions', () => {
+  it('maps rows to action strings', async () => {
+    m.distinctLimitMock.mockResolvedValueOnce([{ action: 'a.x' }, { action: 'b.y' }])
+    expect(await listDistinctActions()).toEqual(['a.x', 'b.y'])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/audit/__tests__/audit.service.diffcov.test.ts b/apps/web/src/lib/server/domains/audit/__tests__/audit.service.diffcov.test.ts
new file mode 100644
index 000000000..30a8e1eb1
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/__tests__/audit.service.diffcov.test.ts
@@ -0,0 +1,105 @@
+/**
+ * Differential-coverage tests for audit.service — recordEvent default fill-in,
+ * the missing-row and error fallbacks, and the listEvents filter matrix.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  returning: vi.fn(),
+  limit: vi.fn(),
+  insertValues: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    insert: vi.fn(() => ({
+      values: (v: unknown) => {
+        m.insertValues(v)
+        return { returning: m.returning }
+      },
+    })),
+    select: vi.fn(() => ({
+      from: () => ({ where: () => ({ orderBy: () => ({ limit: m.limit }) }) }),
+    })),
+  },
+  auditEvents: {
+    id: 'ae.id',
+    principalId: 'ae.principalId',
+    action: 'ae.action',
+    targetType: 'ae.targetType',
+    targetId: 'ae.targetId',
+    createdAt: 'ae.createdAt',
+  },
+  desc: vi.fn((a) => a),
+  eq: vi.fn((a, b) => ({ eq: [a, b] })),
+  and: vi.fn((...a) => ({ and: a })),
+  gte: vi.fn((a, b) => ({ gte: [a, b] })),
+  lte: vi.fn((a, b) => ({ lte: [a, b] })),
+}))
+
+import { recordEvent, listEvents } from '../audit.service'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.returning.mockResolvedValue([{ id: 'audit_1' }])
+  m.limit.mockResolvedValue([])
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+})
+
+describe('recordEvent', () => {
+  it('records with default fill-ins and returns the id', async () => {
+    const id = await recordEvent({ action: 'ticket.created', targetType: 'ticket' })
+    expect(id).toBe('audit_1')
+    expect(m.insertValues).toHaveBeenCalledWith(
+      expect.objectContaining({ principalId: null, source: 'web', diff: {} })
+    )
+  })
+
+  it('records with all fields provided', async () => {
+    await recordEvent({
+      principalId: 'p1' as never,
+      action: 'role.granted',
+      targetType: 'role',
+      targetId: 'r1',
+      diff: { context: {} } as never,
+      source: 'api' as never,
+      ipAddress: '1.2.3.4',
+      userAgent: 'agent',
+    })
+    expect(m.insertValues).toHaveBeenCalledWith(
+      expect.objectContaining({ source: 'api', ipAddress: '1.2.3.4' })
+    )
+  })
+
+  it('returns null when no row comes back', async () => {
+    m.returning.mockResolvedValueOnce([])
+    expect(await recordEvent({ action: 'a', targetType: 't' })).toBeNull()
+  })
+
+  it('swallows insert errors and returns null', async () => {
+    m.returning.mockRejectedValueOnce(new Error('db down'))
+    expect(await recordEvent({ action: 'a', targetType: 't' })).toBeNull()
+    expect(console.error).toHaveBeenCalled()
+  })
+})
+
+describe('listEvents', () => {
+  it('applies every filter and clamps the limit', async () => {
+    m.limit.mockResolvedValueOnce([{ id: 'audit_1' }])
+    const res = await listEvents({
+      principalId: 'p1' as never,
+      action: 'ticket.created',
+      targetType: 'ticket',
+      targetId: 't1',
+      since: new Date('2025-01-01'),
+      until: new Date('2026-01-01'),
+      limit: 99999,
+    })
+    expect(res).toEqual([{ id: 'audit_1' }])
+  })
+
+  it('runs with no filters (where undefined, default limit)', async () => {
+    const res = await listEvents()
+    expect(res).toEqual([])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/audit/__tests__/audit.unified.diffcov.test.ts b/apps/web/src/lib/server/domains/audit/__tests__/audit.unified.diffcov.test.ts
new file mode 100644
index 000000000..84923f39c
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/__tests__/audit.unified.diffcov.test.ts
@@ -0,0 +1,251 @@
+/**
+ * Differential-coverage tests for audit.unified — cursor encode/decode,
+ * row comparison + in-memory paging, the workspace/security query gating
+ * (origin/principal/source), cursor-condition ordering, security diff shaping,
+ * and the distinct-actions union.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => {
+  const chain: Record<string, unknown> = {}
+  for (const k of ['from', 'leftJoin', 'where', 'orderBy']) chain[k] = () => chain
+  chain.limit = () => Promise.resolve(m.selectResult())
+  return { chain, selectResult: vi.fn(), distinctResult: vi.fn() }
+})
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: () => m.chain,
+    selectDistinct: () => ({
+      from: () => ({ orderBy: () => ({ limit: () => m.distinctResult() }) }),
+    }),
+  },
+  and: vi.fn((...a) => ({ and: a })),
+  or: vi.fn((...a) => ({ or: a })),
+  eq: vi.fn(),
+  gte: vi.fn(),
+  lte: vi.fn(),
+  lt: vi.fn(),
+  like: vi.fn(),
+  ilike: vi.fn(),
+  notInArray: vi.fn(),
+  desc: vi.fn(),
+  auditEvents: {
+    id: 'ae.id',
+    action: 'ae.action',
+    createdAt: 'ae.createdAt',
+    principalId: 'ae.principalId',
+    targetType: 'ae.targetType',
+    targetId: 'ae.targetId',
+    source: 'ae.source',
+  },
+  auditLog: {
+    id: 'al.id',
+    eventType: 'al.eventType',
+    occurredAt: 'al.occurredAt',
+    targetType: 'al.targetType',
+    targetId: 'al.targetId',
+    actorEmail: 'al.actorEmail',
+  },
+  principal: { id: 'pr.id', userId: 'pr.userId' },
+  user: { id: 'u.id', email: 'u.email' },
+}))
+
+import {
+  encodeUnifiedAuditCursor,
+  decodeUnifiedAuditCursor,
+  compareUnifiedAuditRows,
+  pageUnifiedAuditRows,
+  listUnifiedAuditEvents,
+  listUnifiedAuditActions,
+} from '../audit.unified'
+
+const row = (over: Record<string, unknown> = {}) => ({
+  id: 'r1',
+  origin: 'workspace' as const,
+  occurredAt: new Date('2026-03-03'),
+  principalId: null,
+  actorUserId: null,
+  actorEmail: null,
+  actorDisplayName: null,
+  actorRole: null,
+  actorType: null,
+  authMethod: null,
+  action: 'a',
+  outcome: null,
+  source: null,
+  targetType: null,
+  targetId: null,
+  requestId: null,
+  ipAddress: null,
+  userAgent: null,
+  diff: null,
+  metadata: null,
+  ...over,
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.selectResult.mockReturnValue([])
+  m.distinctResult.mockResolvedValue([])
+})
+
+describe('cursor encode/decode', () => {
+  it('round-trips', () => {
+    const c = encodeUnifiedAuditCursor({
+      occurredAt: new Date('2026-01-01'),
+      origin: 'security',
+      id: 'x',
+    })
+    expect(decodeUnifiedAuditCursor(c)).toEqual({
+      t: new Date('2026-01-01').getTime(),
+      o: 'security',
+      i: 'x',
+    })
+  })
+  it('returns null for undefined / malformed / wrong-shape cursors', () => {
+    expect(decodeUnifiedAuditCursor(undefined)).toBeNull()
+    expect(decodeUnifiedAuditCursor('!!notbase64json')).toBeNull()
+    const bad = Buffer.from(JSON.stringify({ t: 'x', o: 'nope', i: 1 }), 'utf8').toString(
+      'base64url'
+    )
+    expect(decodeUnifiedAuditCursor(bad)).toBeNull()
+  })
+})
+
+describe('compareUnifiedAuditRows + paging', () => {
+  it('orders by time, then origin, then id', () => {
+    const older = row({ occurredAt: new Date('2026-01-01') })
+    const newer = row({ occurredAt: new Date('2026-02-02') })
+    expect(compareUnifiedAuditRows(newer, older)).toBeLessThan(0)
+    const wsp = row({ origin: 'workspace' })
+    const sec = row({ origin: 'security' })
+    expect(compareUnifiedAuditRows(wsp, sec)).toBeLessThan(0)
+    expect(compareUnifiedAuditRows(row({ id: 'b' }), row({ id: 'a' }))).toBeLessThan(0)
+  })
+  it('pages: sorts, slices to limit, and emits a next cursor', () => {
+    const page = pageUnifiedAuditRows(
+      [
+        row({ id: 'a', occurredAt: new Date('2026-03-03') }),
+        row({ id: 'b', occurredAt: new Date('2026-02-02') }),
+        row({ id: 'c', occurredAt: new Date('2026-01-01') }),
+      ],
+      { limit: 2 }
+    )
+    expect(page.items).toHaveLength(2)
+    expect(page.nextCursor).not.toBeNull()
+  })
+  it('pages with a cursor (keeps only rows after the cursor position)', () => {
+    // Descending feed: the cursor is the last (oldest) row of the previous
+    // page, so page 2 keeps rows OLDER than it.
+    const cursor = encodeUnifiedAuditCursor({
+      occurredAt: new Date('2026-02-15'),
+      origin: 'workspace',
+      id: 'b',
+    })
+    const page = pageUnifiedAuditRows(
+      [
+        row({ id: 'a', occurredAt: new Date('2026-03-03') }),
+        row({ id: 'z', occurredAt: new Date('2026-01-01') }),
+      ],
+      { cursor }
+    )
+    expect(page.items.map((r) => r.id)).toEqual(['z'])
+  })
+})
+
+describe('listUnifiedAuditEvents query gating', () => {
+  it('queries only workspace when origin=workspace and maps rows', async () => {
+    m.selectResult.mockReturnValueOnce([
+      {
+        id: 'w1',
+        createdAt: new Date('2026-03-03'),
+        principalId: 'p1',
+        action: 'ticket.created',
+        targetType: 't',
+        targetId: 'x',
+        diff: {},
+        source: 'web',
+        ipAddress: null,
+        userAgent: null,
+        actorUserId: 'u1',
+        actorEmail: 'a@x.test',
+        actorDisplayName: null,
+        actorRole: 'agent',
+        actorType: 'user',
+        userName: 'Fallback',
+      },
+    ])
+    const page = await listUnifiedAuditEvents({
+      origin: 'workspace',
+      action: 'ticket.created',
+      actorEmail: ' a ',
+      from: new Date('2025-01-01'),
+      to: new Date('2026-12-31'),
+      targetType: 't',
+      targetId: 'x',
+    })
+    expect(page.items[0].actorDisplayName).toBe('Fallback')
+  })
+  it('skips the security store when a principal filter is set', async () => {
+    await listUnifiedAuditEvents({ principalId: 'p1' as never })
+    // both branches still produce a valid page
+    expect(m.selectResult).toHaveBeenCalled()
+  })
+  it('queries only security when origin=security and shapes the diff + cursor', async () => {
+    const cursor = encodeUnifiedAuditCursor({
+      occurredAt: new Date('2026-02-15'),
+      origin: 'workspace',
+      id: 'b',
+    })
+    m.selectResult.mockReturnValueOnce([
+      {
+        id: 's1',
+        occurredAt: new Date('2026-01-01'),
+        actorUserId: 'u1',
+        actorEmail: 'a@x.test',
+        actorRole: 'admin',
+        actorIp: '1.1.1.1',
+        actorUserAgent: 'ua',
+        eventType: 'auth.login',
+        eventOutcome: 'success',
+        targetType: null,
+        targetId: null,
+        beforeValue: { x: 1 },
+        afterValue: { x: 2 },
+        metadata: { k: 'v' },
+        requestId: 'req_1',
+        actorType: 'user',
+        authMethod: 'password',
+      },
+    ])
+    const page = await listUnifiedAuditEvents({
+      origin: 'security',
+      actionPrefix: 'auth.',
+      excludeSecurityActions: ['noise'],
+      cursor,
+    })
+    expect(page.items[0].diff).toMatchObject({
+      before: { x: 1 },
+      after: { x: 2 },
+      context: { requestId: 'req_1' },
+    })
+  })
+  it('queries both stores by default (cursor ordering across origins)', async () => {
+    const cursor = encodeUnifiedAuditCursor({
+      occurredAt: new Date('2026-02-15'),
+      origin: 'security',
+      id: 'b',
+    })
+    await listUnifiedAuditEvents({ cursor })
+    expect(m.selectResult).toHaveBeenCalledTimes(2)
+  })
+})
+
+describe('listUnifiedAuditActions', () => {
+  it('unions + sorts distinct actions from both stores', async () => {
+    m.distinctResult.mockResolvedValueOnce([{ action: 'b' }, { action: 'a' }])
+    m.distinctResult.mockResolvedValueOnce([{ action: 'a' }, { action: 'c' }])
+    expect(await listUnifiedAuditActions()).toEqual(['a', 'b', 'c'])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/audit/audit.context.ts b/apps/web/src/lib/server/domains/audit/audit.context.ts
new file mode 100644
index 000000000..7fa0f3a4c
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/audit.context.ts
@@ -0,0 +1,45 @@
+/**
+ * Build a partial audit context (principal + IP/UA + source) from any
+ * AuthContext-like value. Lets write paths emit `recordEvent` without
+ * each caller manually re-reading request headers.
+ */
+
+import type { AuthContext } from '@/lib/server/functions/auth-helpers'
+import type { ApiAuthContext } from '@/lib/server/domains/api/auth'
+import type { PrincipalId } from '@quackback/ids'
+import type { AuditSource } from '@/lib/server/db'
+
+export interface AuditAttribution {
+  principalId: PrincipalId | null
+  ipAddress: string | null
+  userAgent: string | null
+  source: AuditSource
+}
+
+export type AuditAuthLike =
+  | (Pick<AuthContext, 'principal' | 'ipAddress' | 'userAgent' | 'source'> & {
+      principal: { id: PrincipalId }
+    })
+  | Pick<ApiAuthContext, 'principalId' | 'ipAddress' | 'userAgent' | 'source'>
+  | null
+  | undefined
+
+export function buildAuditContext(auth: AuditAuthLike): AuditAttribution {
+  if (!auth) {
+    return { principalId: null, ipAddress: null, userAgent: null, source: 'system' }
+  }
+  if ('principal' in auth) {
+    return {
+      principalId: auth.principal.id,
+      ipAddress: auth.ipAddress ?? null,
+      userAgent: auth.userAgent ?? null,
+      source: auth.source ?? 'web',
+    }
+  }
+  return {
+    principalId: auth.principalId,
+    ipAddress: auth.ipAddress ?? null,
+    userAgent: auth.userAgent ?? null,
+    source: auth.source ?? 'api',
+  }
+}
diff --git a/apps/web/src/lib/server/domains/audit/audit.queries.ts b/apps/web/src/lib/server/domains/audit/audit.queries.ts
new file mode 100644
index 000000000..14409a81e
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/audit.queries.ts
@@ -0,0 +1,144 @@
+/**
+ * Read-side queries for audit_events. The write path lives in
+ * `audit.service.ts` (`recordEvent`); this module provides filtered listing
+ * with cursor-based pagination for both server functions and the public
+ * REST endpoint.
+ */
+
+import { db, auditEvents, and, or, eq, gte, lte, lt, like, desc, sql, asc } from '@/lib/server/db'
+import type { PrincipalId } from '@quackback/ids'
+import type { AuditSource } from '@/lib/server/db'
+
+export interface ListAuditEventsInput {
+  principalId?: PrincipalId
+  action?: string
+  /** Match all actions starting with this dotted prefix (e.g. "ticket."). */
+  actionPrefix?: string
+  targetType?: string
+  targetId?: string
+  source?: AuditSource
+  /** Inclusive lower bound on createdAt. */
+  from?: Date
+  /** Inclusive upper bound on createdAt. */
+  to?: Date
+  /** Opaque cursor returned by a previous call (`encodeCursor`). */
+  cursor?: string
+  /** Page size; clamped to [1, 200], default 50. */
+  limit?: number
+}
+
+export interface ListAuditEventsPage {
+  items: Awaited<ReturnType<typeof db.select>> extends never ? never : AuditEventRow[]
+  nextCursor: string | null
+}
+
+type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue }
+
+export type AuditEventRow = {
+  id: string
+  createdAt: Date
+  principalId: string | null
+  action: string
+  targetType: string
+  targetId: string | null
+  diff: JsonValue
+  source: AuditSource
+  ipAddress: string | null
+  userAgent: string | null
+}
+
+interface CursorPayload {
+  t: number // createdAt epoch ms
+  i: string // event id
+}
+
+export function encodeCursor(createdAt: Date, id: string): string {
+  const payload: CursorPayload = { t: createdAt.getTime(), i: id }
+  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url')
+}
+
+export function decodeCursor(cursor: string): CursorPayload | null {
+  try {
+    const json = Buffer.from(cursor, 'base64url').toString('utf8')
+    const obj = JSON.parse(json) as Partial<CursorPayload>
+    if (typeof obj.t !== 'number' || typeof obj.i !== 'string') return null
+    return { t: obj.t, i: obj.i }
+  } catch {
+    return null
+  }
+}
+
+export async function listAuditEvents(
+  input: ListAuditEventsInput = {}
+): Promise<{ items: AuditEventRow[]; nextCursor: string | null }> {
+  const limit = Math.min(Math.max(input.limit ?? 50, 1), 200)
+  const conds = []
+  if (input.principalId) conds.push(eq(auditEvents.principalId, input.principalId))
+  if (input.action) conds.push(eq(auditEvents.action, input.action))
+  if (input.actionPrefix) conds.push(like(auditEvents.action, `${input.actionPrefix}%`))
+  if (input.targetType) conds.push(eq(auditEvents.targetType, input.targetType))
+  if (input.targetId) conds.push(eq(auditEvents.targetId, input.targetId))
+  if (input.source) conds.push(eq(auditEvents.source, input.source))
+  if (input.from) conds.push(gte(auditEvents.createdAt, input.from))
+  if (input.to) conds.push(lte(auditEvents.createdAt, input.to))
+
+  if (input.cursor) {
+    const c = decodeCursor(input.cursor)
+    if (c) {
+      const cursorAt = new Date(c.t)
+      // Strict (createdAt, id) lexicographic less-than to match
+      // ORDER BY created_at DESC, id DESC.
+      conds.push(
+        or(
+          lt(auditEvents.createdAt, cursorAt),
+          and(eq(auditEvents.createdAt, cursorAt), lt(auditEvents.id, c.i as never))
+        )!
+      )
+    }
+  }
+
+  const where = conds.length > 0 ? and(...conds) : undefined
+  const rows = await db
+    .select({
+      id: auditEvents.id,
+      createdAt: auditEvents.createdAt,
+      principalId: auditEvents.principalId,
+      action: auditEvents.action,
+      targetType: auditEvents.targetType,
+      targetId: auditEvents.targetId,
+      diff: auditEvents.diff,
+      source: auditEvents.source,
+      ipAddress: auditEvents.ipAddress,
+      userAgent: auditEvents.userAgent,
+    })
+    .from(auditEvents)
+    .where(where)
+    .orderBy(desc(auditEvents.createdAt), desc(auditEvents.id))
+    .limit(limit + 1)
+
+  const hasMore = rows.length > limit
+  const items = (hasMore ? rows.slice(0, limit) : rows) as unknown as AuditEventRow[]
+  const nextCursor =
+    hasMore && items.length > 0
+      ? encodeCursor(items[items.length - 1].createdAt, String(items[items.length - 1].id))
+      : null
+
+  // Touch sql to keep the import used by future filters.
+  void sql
+
+  return { items, nextCursor }
+}
+
+/**
+ * Distinct action keys present in the audit log, ascending. Used by the
+ * admin audit page to populate the action combobox without needing the
+ * caller to know the dotted-key vocabulary up front.
+ */
+export async function listDistinctActions(): Promise<string[]> {
+  const rows = await db
+    .selectDistinct({ action: auditEvents.action })
+    .from(auditEvents)
+    .orderBy(asc(auditEvents.action))
+    .limit(200)
+  return rows.map((r) => r.action)
+}
diff --git a/apps/web/src/lib/server/domains/audit/audit.service.ts b/apps/web/src/lib/server/domains/audit/audit.service.ts
new file mode 100644
index 000000000..271f41fcd
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/audit.service.ts
@@ -0,0 +1,82 @@
+/**
+ * Audit domain — append-only workspace audit log.
+ *
+ * `recordEvent` is the single write entry-point and is intentionally
+ * fire-and-forget-friendly: the caller's transaction does NOT need to wait
+ * for the insert. We log errors instead of propagating them, because losing
+ * an audit row should never crash a write path.
+ *
+ * For test/debug determinism, callers that need synchronous behaviour can
+ * `await recordEvent(...)`.
+ */
+
+import { db, auditEvents, desc, eq, and, gte, lte } from '@/lib/server/db'
+import type { PrincipalId, AuditEventId } from '@quackback/ids'
+import type { AuditDiff, AuditSource } from '@/lib/server/db'
+
+export interface RecordEventInput {
+  /** Actor performing the action; null for system-initiated. */
+  principalId?: PrincipalId | null
+  /** Dotted action name (e.g. "role.granted", "ticket.shared"). */
+  action: string
+  /** Type of the resource the action targets. */
+  targetType: string
+  /** TypeID of the resource (stored as text). */
+  targetId?: string | null
+  diff?: AuditDiff
+  source?: AuditSource
+  ipAddress?: string | null
+  userAgent?: string | null
+}
+
+export async function recordEvent(input: RecordEventInput): Promise<AuditEventId | null> {
+  try {
+    const [row] = await db
+      .insert(auditEvents)
+      .values({
+        principalId: input.principalId ?? null,
+        action: input.action,
+        targetType: input.targetType,
+        targetId: input.targetId ?? null,
+        diff: input.diff ?? {},
+        source: input.source ?? 'web',
+        ipAddress: input.ipAddress ?? null,
+        userAgent: input.userAgent ?? null,
+      })
+      .returning({ id: auditEvents.id })
+    return (row?.id as AuditEventId | undefined) ?? null
+  } catch (error) {
+    console.error('[domain:audit] failed to record event', { action: input.action, error })
+    return null
+  }
+}
+
+export interface ListEventsFilter {
+  principalId?: PrincipalId
+  action?: string
+  targetType?: string
+  targetId?: string
+  /** Inclusive lower bound. */
+  since?: Date
+  /** Inclusive upper bound. */
+  until?: Date
+  limit?: number
+}
+
+export async function listEvents(filter: ListEventsFilter = {}) {
+  const conditions = []
+  if (filter.principalId) conditions.push(eq(auditEvents.principalId, filter.principalId))
+  if (filter.action) conditions.push(eq(auditEvents.action, filter.action))
+  if (filter.targetType) conditions.push(eq(auditEvents.targetType, filter.targetType))
+  if (filter.targetId) conditions.push(eq(auditEvents.targetId, filter.targetId))
+  if (filter.since) conditions.push(gte(auditEvents.createdAt, filter.since))
+  if (filter.until) conditions.push(lte(auditEvents.createdAt, filter.until))
+
+  const where = conditions.length > 0 ? and(...conditions) : undefined
+  return db
+    .select()
+    .from(auditEvents)
+    .where(where)
+    .orderBy(desc(auditEvents.createdAt))
+    .limit(Math.min(filter.limit ?? 100, 500))
+}
diff --git a/apps/web/src/lib/server/domains/audit/audit.unified.ts b/apps/web/src/lib/server/domains/audit/audit.unified.ts
new file mode 100644
index 000000000..177219429
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/audit.unified.ts
@@ -0,0 +1,414 @@
+/**
+ * Read-side union of the two append-only audit stores:
+ * - audit_events: workspace operational audit rows
+ * - audit_log: security/auth/admin audit rows
+ *
+ * Writers stay separate. This module only normalizes both shapes for the
+ * canonical admin audit page.
+ */
+import type { AnyColumn, SQL } from 'drizzle-orm'
+import type { PrincipalId } from '@quackback/ids'
+import type { AuditSource } from '@/lib/server/db'
+import {
+  and,
+  auditEvents,
+  auditLog,
+  db,
+  desc,
+  eq,
+  gte,
+  ilike,
+  like,
+  lt,
+  lte,
+  notInArray,
+  or,
+  principal,
+  user,
+} from '@/lib/server/db'
+
+export type UnifiedAuditOrigin = 'workspace' | 'security'
+
+type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue }
+export type UnifiedAuditDiff = { [k: string]: JsonValue }
+
+export interface UnifiedAuditEventRow {
+  id: string
+  origin: UnifiedAuditOrigin
+  occurredAt: Date
+  principalId: string | null
+  actorUserId: string | null
+  actorEmail: string | null
+  actorDisplayName: string | null
+  actorRole: string | null
+  actorType: string | null
+  authMethod: string | null
+  action: string
+  outcome: 'success' | 'failure' | null
+  source: AuditSource | null
+  targetType: string | null
+  targetId: string | null
+  requestId: string | null
+  ipAddress: string | null
+  userAgent: string | null
+  diff: JsonValue
+  metadata: JsonValue
+}
+
+export interface ListUnifiedAuditEventsInput {
+  origin?: UnifiedAuditOrigin
+  principalId?: PrincipalId
+  actorEmail?: string
+  action?: string
+  actionPrefix?: string
+  targetType?: string
+  targetId?: string
+  source?: AuditSource
+  from?: Date
+  to?: Date
+  cursor?: string
+  limit?: number
+  excludeSecurityActions?: string[]
+}
+
+export interface ListUnifiedAuditEventsPage {
+  items: UnifiedAuditEventRow[]
+  nextCursor: string | null
+}
+
+interface UnifiedCursorPayload {
+  t: number
+  o: UnifiedAuditOrigin
+  i: string
+}
+
+const ORIGIN_ORDER: Record<UnifiedAuditOrigin, number> = {
+  workspace: 0,
+  security: 1,
+}
+
+const DEFAULT_LIMIT = 50
+const MAX_LIMIT = 200
+
+export function encodeUnifiedAuditCursor(
+  row: Pick<UnifiedAuditEventRow, 'occurredAt' | 'origin' | 'id'>
+): string {
+  const payload: UnifiedCursorPayload = {
+    t: row.occurredAt.getTime(),
+    o: row.origin,
+    i: row.id,
+  }
+  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url')
+}
+
+export function decodeUnifiedAuditCursor(cursor: string | undefined): UnifiedCursorPayload | null {
+  if (!cursor) return null
+  try {
+    const json = Buffer.from(cursor, 'base64url').toString('utf8')
+    const obj = JSON.parse(json) as Partial<UnifiedCursorPayload>
+    if (
+      typeof obj.t !== 'number' ||
+      typeof obj.i !== 'string' ||
+      (obj.o !== 'workspace' && obj.o !== 'security')
+    ) {
+      return null
+    }
+    return { t: obj.t, o: obj.o, i: obj.i }
+  } catch {
+    return null
+  }
+}
+
+export function compareUnifiedAuditRows(
+  a: Pick<UnifiedAuditEventRow, 'occurredAt' | 'origin' | 'id'>,
+  b: Pick<UnifiedAuditEventRow, 'occurredAt' | 'origin' | 'id'>
+): number {
+  const timeDiff = b.occurredAt.getTime() - a.occurredAt.getTime()
+  if (timeDiff !== 0) return timeDiff
+
+  const originDiff = ORIGIN_ORDER[a.origin] - ORIGIN_ORDER[b.origin]
+  if (originDiff !== 0) return originDiff
+
+  return b.id.localeCompare(a.id)
+}
+
+function cursorRow(
+  cursor: UnifiedCursorPayload
+): Pick<UnifiedAuditEventRow, 'occurredAt' | 'origin' | 'id'> {
+  return {
+    occurredAt: new Date(cursor.t),
+    origin: cursor.o,
+    id: cursor.i,
+  }
+}
+
+function isAfterCursor(row: UnifiedAuditEventRow, cursor: UnifiedCursorPayload | null): boolean {
+  return !cursor || compareUnifiedAuditRows(row, cursorRow(cursor)) > 0
+}
+
+export function pageUnifiedAuditRows(
+  rows: UnifiedAuditEventRow[],
+  opts: { limit?: number; cursor?: string } = {}
+): ListUnifiedAuditEventsPage {
+  const limit = Math.min(Math.max(opts.limit ?? DEFAULT_LIMIT, 1), MAX_LIMIT)
+  const cursor = decodeUnifiedAuditCursor(opts.cursor)
+  const sorted = rows.filter((row) => isAfterCursor(row, cursor)).sort(compareUnifiedAuditRows)
+  const items = sorted.slice(0, limit)
+  const hasMore = sorted.length > limit
+  const nextCursor =
+    hasMore && items.length > 0 ? encodeUnifiedAuditCursor(items[items.length - 1]) : null
+
+  return { items, nextCursor }
+}
+
+function buildCursorCondition(
+  origin: UnifiedAuditOrigin,
+  occurredAtColumn: AnyColumn,
+  idColumn: AnyColumn,
+  cursor: UnifiedCursorPayload | null
+): SQL | undefined {
+  if (!cursor) return undefined
+
+  const at = new Date(cursor.t)
+  const orderDiff = ORIGIN_ORDER[origin] - ORIGIN_ORDER[cursor.o]
+
+  if (orderDiff > 0) {
+    return lte(occurredAtColumn, at)
+  }
+  if (orderDiff < 0) {
+    return lt(occurredAtColumn, at)
+  }
+
+  return or(lt(occurredAtColumn, at), and(eq(occurredAtColumn, at), lt(idColumn, cursor.i)))!
+}
+
+function cleanNeedle(value: string | undefined): string | undefined {
+  const trimmed = value?.trim()
+  return trimmed ? `%${trimmed}%` : undefined
+}
+
+function shouldQueryWorkspace(input: ListUnifiedAuditEventsInput): boolean {
+  return input.origin !== 'security'
+}
+
+function shouldQuerySecurity(input: ListUnifiedAuditEventsInput): boolean {
+  if (input.origin === 'workspace') return false
+  if (input.principalId) return false
+  if (input.source) return false
+  return true
+}
+
+function compactContext(
+  entries: Record<string, JsonValue | undefined>
+): Record<string, JsonValue> | undefined {
+  const context = Object.fromEntries(
+    Object.entries(entries).filter(([, value]) => value !== null && value !== undefined)
+  ) as Record<string, JsonValue>
+  return Object.keys(context).length > 0 ? context : undefined
+}
+
+function securityDiff(row: {
+  beforeValue: unknown
+  afterValue: unknown
+  metadata: unknown
+  requestId: string | null
+  actorType: string | null
+  authMethod: string | null
+}): JsonValue {
+  const diff: UnifiedAuditDiff = {}
+  if (row.beforeValue !== null && row.beforeValue !== undefined) {
+    diff.before = row.beforeValue as JsonValue
+  }
+  if (row.afterValue !== null && row.afterValue !== undefined) {
+    diff.after = row.afterValue as JsonValue
+  }
+  const context = compactContext({
+    metadata: row.metadata as JsonValue,
+    requestId: row.requestId,
+    actorType: row.actorType,
+    authMethod: row.authMethod,
+  })
+  if (context) diff.context = context
+  return diff
+}
+
+export async function listUnifiedAuditEvents(
+  input: ListUnifiedAuditEventsInput = {}
+): Promise<ListUnifiedAuditEventsPage> {
+  const limit = Math.min(Math.max(input.limit ?? DEFAULT_LIMIT, 1), MAX_LIMIT)
+  const cursor = decodeUnifiedAuditCursor(input.cursor)
+  const actorEmailNeedle = cleanNeedle(input.actorEmail)
+  const pageSize = limit + 1
+
+  const queries: Array<Promise<UnifiedAuditEventRow[]>> = []
+
+  if (shouldQueryWorkspace(input)) {
+    const conds: SQL[] = []
+    if (input.principalId) conds.push(eq(auditEvents.principalId, input.principalId))
+    if (input.action) conds.push(eq(auditEvents.action, input.action))
+    if (input.actionPrefix) conds.push(like(auditEvents.action, `${input.actionPrefix}%`))
+    if (input.targetType) conds.push(eq(auditEvents.targetType, input.targetType))
+    if (input.targetId) conds.push(eq(auditEvents.targetId, input.targetId))
+    if (input.source) conds.push(eq(auditEvents.source, input.source))
+    if (input.from) conds.push(gte(auditEvents.createdAt, input.from))
+    if (input.to) conds.push(lte(auditEvents.createdAt, input.to))
+    if (actorEmailNeedle) conds.push(ilike(user.email, actorEmailNeedle))
+    const cursorCond = buildCursorCondition(
+      'workspace',
+      auditEvents.createdAt,
+      auditEvents.id,
+      cursor
+    )
+    if (cursorCond) conds.push(cursorCond)
+
+    const where = conds.length > 0 ? and(...conds) : undefined
+
+    queries.push(
+      db
+        .select({
+          id: auditEvents.id,
+          createdAt: auditEvents.createdAt,
+          principalId: auditEvents.principalId,
+          action: auditEvents.action,
+          targetType: auditEvents.targetType,
+          targetId: auditEvents.targetId,
+          diff: auditEvents.diff,
+          source: auditEvents.source,
+          ipAddress: auditEvents.ipAddress,
+          userAgent: auditEvents.userAgent,
+          actorUserId: principal.userId,
+          actorEmail: user.email,
+          actorDisplayName: principal.displayName,
+          actorRole: principal.role,
+          actorType: principal.type,
+          userName: user.name,
+        })
+        .from(auditEvents)
+        .leftJoin(principal, eq(auditEvents.principalId, principal.id))
+        .leftJoin(user, eq(principal.userId, user.id))
+        .where(where)
+        .orderBy(desc(auditEvents.createdAt), desc(auditEvents.id))
+        .limit(pageSize)
+        .then((rows) =>
+          rows.map((row) => ({
+            id: row.id,
+            origin: 'workspace' as const,
+            occurredAt: row.createdAt,
+            principalId: row.principalId,
+            actorUserId: row.actorUserId,
+            actorEmail: row.actorEmail,
+            actorDisplayName: row.actorDisplayName ?? row.userName ?? null,
+            actorRole: row.actorRole,
+            actorType: row.actorType,
+            authMethod: null,
+            action: row.action,
+            outcome: null,
+            source: row.source,
+            targetType: row.targetType,
+            targetId: row.targetId,
+            requestId: null,
+            ipAddress: row.ipAddress,
+            userAgent: row.userAgent,
+            diff: row.diff as JsonValue,
+            metadata: null,
+          }))
+        )
+    )
+  }
+
+  if (shouldQuerySecurity(input)) {
+    const conds: SQL[] = []
+    if (input.action) conds.push(eq(auditLog.eventType, input.action))
+    if (input.actionPrefix) conds.push(like(auditLog.eventType, `${input.actionPrefix}%`))
+    if (input.targetType) conds.push(eq(auditLog.targetType, input.targetType))
+    if (input.targetId) conds.push(eq(auditLog.targetId, input.targetId))
+    if (input.from) conds.push(gte(auditLog.occurredAt, input.from))
+    if (input.to) conds.push(lte(auditLog.occurredAt, input.to))
+    if (actorEmailNeedle) conds.push(ilike(auditLog.actorEmail, actorEmailNeedle))
+    if (
+      !input.action &&
+      !input.actionPrefix &&
+      input.excludeSecurityActions &&
+      input.excludeSecurityActions.length > 0
+    ) {
+      conds.push(notInArray(auditLog.eventType, input.excludeSecurityActions))
+    }
+    const cursorCond = buildCursorCondition('security', auditLog.occurredAt, auditLog.id, cursor)
+    if (cursorCond) conds.push(cursorCond)
+
+    const where = conds.length > 0 ? and(...conds) : undefined
+
+    queries.push(
+      db
+        .select({
+          id: auditLog.id,
+          occurredAt: auditLog.occurredAt,
+          actorUserId: auditLog.actorUserId,
+          actorEmail: auditLog.actorEmail,
+          actorRole: auditLog.actorRole,
+          actorIp: auditLog.actorIp,
+          actorUserAgent: auditLog.actorUserAgent,
+          eventType: auditLog.eventType,
+          eventOutcome: auditLog.eventOutcome,
+          targetType: auditLog.targetType,
+          targetId: auditLog.targetId,
+          beforeValue: auditLog.beforeValue,
+          afterValue: auditLog.afterValue,
+          metadata: auditLog.metadata,
+          requestId: auditLog.requestId,
+          actorType: auditLog.actorType,
+          authMethod: auditLog.authMethod,
+        })
+        .from(auditLog)
+        .where(where)
+        .orderBy(desc(auditLog.occurredAt), desc(auditLog.id))
+        .limit(pageSize)
+        .then((rows) =>
+          rows.map((row) => ({
+            id: row.id,
+            origin: 'security' as const,
+            occurredAt: row.occurredAt,
+            principalId: null,
+            actorUserId: row.actorUserId,
+            actorEmail: row.actorEmail,
+            actorDisplayName: null,
+            actorRole: row.actorRole,
+            actorType: row.actorType,
+            authMethod: row.authMethod,
+            action: row.eventType,
+            outcome: row.eventOutcome as 'success' | 'failure',
+            source: null,
+            targetType: row.targetType,
+            targetId: row.targetId,
+            requestId: row.requestId,
+            ipAddress: row.actorIp,
+            userAgent: row.actorUserAgent,
+            diff: securityDiff(row),
+            metadata: (row.metadata as JsonValue) ?? null,
+          }))
+        )
+    )
+  }
+
+  return pageUnifiedAuditRows((await Promise.all(queries)).flat(), {
+    limit,
+    cursor: input.cursor,
+  })
+}
+
+export async function listUnifiedAuditActions(): Promise<string[]> {
+  const [workspaceRows, securityRows] = await Promise.all([
+    db
+      .selectDistinct({ action: auditEvents.action })
+      .from(auditEvents)
+      .orderBy(auditEvents.action)
+      .limit(200),
+    db
+      .selectDistinct({ action: auditLog.eventType })
+      .from(auditLog)
+      .orderBy(auditLog.eventType)
+      .limit(200),
+  ])
+
+  return Array.from(new Set([...workspaceRows, ...securityRows].map((row) => row.action))).sort()
+}
diff --git a/apps/web/src/lib/server/domains/audit/index.ts b/apps/web/src/lib/server/domains/audit/index.ts
new file mode 100644
index 000000000..a1a90478d
--- /dev/null
+++ b/apps/web/src/lib/server/domains/audit/index.ts
@@ -0,0 +1,15 @@
+export {
+  recordEvent,
+  listEvents,
+  type RecordEventInput,
+  type ListEventsFilter,
+} from './audit.service'
+export {
+  listAuditEvents,
+  listDistinctActions,
+  encodeCursor,
+  decodeCursor,
+  type ListAuditEventsInput,
+  type AuditEventRow,
+} from './audit.queries'
+export { buildAuditContext, type AuditAttribution, type AuditAuthLike } from './audit.context'
diff --git a/apps/web/src/lib/server/domains/authz/__tests__/authz.service-db.test.ts b/apps/web/src/lib/server/domains/authz/__tests__/authz.service-db.test.ts
new file mode 100644
index 000000000..50f26eda1
--- /dev/null
+++ b/apps/web/src/lib/server/domains/authz/__tests__/authz.service-db.test.ts
@@ -0,0 +1,158 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PrincipalId, TeamId } from '@quackback/ids'
+
+const hoisted = vi.hoisted(() => ({
+  mockTeamMembershipsFindMany: vi.fn(),
+  mockPrincipalRoleAssignmentsFindMany: vi.fn(),
+  mockPrincipalFindFirst: vi.fn(),
+  mockSelect: vi.fn(),
+  mockEq: vi.fn(),
+  mockInArray: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      teamMemberships: {
+        findMany: (...args: unknown[]) => hoisted.mockTeamMembershipsFindMany(...args),
+      },
+      principalRoleAssignments: {
+        findMany: (...args: unknown[]) => hoisted.mockPrincipalRoleAssignmentsFindMany(...args),
+      },
+      principal: {
+        findFirst: (...args: unknown[]) => hoisted.mockPrincipalFindFirst(...args),
+      },
+    },
+    select: (...args: unknown[]) => hoisted.mockSelect(...args),
+  },
+  principal: {
+    id: 'principal.id',
+  },
+  principalRoleAssignments: {
+    principalId: 'principalRoleAssignments.principalId',
+  },
+  rolePermissions: {
+    roleId: 'rolePermissions.roleId',
+    permissionId: 'rolePermissions.permissionId',
+  },
+  permissions: {
+    id: 'permissions.id',
+    key: 'permissions.key',
+  },
+  teamMemberships: {
+    principalId: 'teamMemberships.principalId',
+  },
+  eq: (...args: unknown[]) => hoisted.mockEq(...args),
+  inArray: (...args: unknown[]) => hoisted.mockInArray(...args),
+}))
+
+const { assertPermission, loadPermissionSet } = await import('../authz.service')
+const { PERMISSIONS } = await import('../authz.permissions')
+
+type SelectChain = {
+  from: ReturnType<typeof vi.fn>
+  innerJoin: ReturnType<typeof vi.fn>
+  where: ReturnType<typeof vi.fn>
+  then: Promise<unknown[]>['then']
+  catch: Promise<unknown[]>['catch']
+  finally: Promise<unknown[]>['finally']
+}
+
+function makeSelectChain(rows: unknown[]): SelectChain {
+  const promise = Promise.resolve(rows)
+  const chain = {
+    from: vi.fn(() => chain),
+    innerJoin: vi.fn(() => chain),
+    where: vi.fn(() => chain),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  } as SelectChain
+  return chain
+}
+
+const PRINCIPAL = 'principal_authz' as PrincipalId
+const TEAM_A = 'team_a' as TeamId
+const TEAM_B = 'team_b' as TeamId
+
+beforeEach(() => {
+  hoisted.mockTeamMembershipsFindMany.mockReset()
+  hoisted.mockPrincipalRoleAssignmentsFindMany.mockReset()
+  hoisted.mockPrincipalFindFirst.mockReset()
+  hoisted.mockSelect.mockReset()
+  hoisted.mockEq.mockReset()
+  hoisted.mockInArray.mockReset()
+  hoisted.mockEq.mockImplementation((...args: unknown[]) => ['eq', ...args])
+  hoisted.mockInArray.mockImplementation((...args: unknown[]) => ['inArray', ...args])
+  hoisted.mockTeamMembershipsFindMany.mockResolvedValue([])
+})
+
+describe('loadPermissionSet', () => {
+  it('builds workspace and team-scoped grants from role assignments', async () => {
+    hoisted.mockTeamMembershipsFindMany.mockResolvedValue([{ teamId: TEAM_A }, { teamId: TEAM_B }])
+    hoisted.mockPrincipalRoleAssignmentsFindMany.mockResolvedValue([
+      { roleId: 'role_workspace', teamId: null },
+      { roleId: 'role_team', teamId: TEAM_A },
+      { roleId: 'role_empty', teamId: TEAM_B },
+      { roleId: 'role_team', teamId: TEAM_A },
+    ])
+    hoisted.mockSelect.mockReturnValueOnce(
+      makeSelectChain([
+        { roleId: 'role_workspace', key: PERMISSIONS.TICKET_VIEW_ALL },
+        { roleId: 'role_team', key: PERMISSIONS.TICKET_REPLY_PUBLIC },
+        { roleId: 'role_team', key: PERMISSIONS.TICKET_COMMENT_INTERNAL },
+      ])
+    )
+
+    const set = await loadPermissionSet(PRINCIPAL)
+
+    expect(set.principalId).toBe(PRINCIPAL)
+    expect(set.teamIds).toEqual([TEAM_A, TEAM_B])
+    expect([...set.workspacePermissions]).toEqual([PERMISSIONS.TICKET_VIEW_ALL])
+    expect([...(set.teamPermissions.get(TEAM_A) ?? [])]).toEqual([
+      PERMISSIONS.TICKET_REPLY_PUBLIC,
+      PERMISSIONS.TICKET_COMMENT_INTERNAL,
+    ])
+    expect([...(set.teamPermissions.get(TEAM_B) ?? [])]).toEqual([])
+    expect(hoisted.mockInArray).toHaveBeenCalledWith('rolePermissions.roleId', [
+      'role_workspace',
+      'role_team',
+      'role_empty',
+    ])
+  })
+
+  it('falls back to legacy admin, member, and customer role mappings when no assignments exist', async () => {
+    hoisted.mockPrincipalRoleAssignmentsFindMany.mockResolvedValue([])
+    hoisted.mockPrincipalFindFirst.mockResolvedValueOnce({ role: 'admin' })
+    let set = await loadPermissionSet(PRINCIPAL)
+    expect(set.workspacePermissions.has(PERMISSIONS.TICKET_VIEW_TEAM)).toBe(true)
+
+    hoisted.mockPrincipalFindFirst.mockResolvedValueOnce({ role: 'member' })
+    set = await loadPermissionSet(PRINCIPAL)
+    expect(set.workspacePermissions.has(PERMISSIONS.TICKET_REPLY_PUBLIC)).toBe(true)
+    expect(set.workspacePermissions.has(PERMISSIONS.TICKET_VIEW_ALL)).toBe(false)
+
+    hoisted.mockPrincipalFindFirst.mockResolvedValueOnce(undefined)
+    set = await loadPermissionSet(PRINCIPAL)
+    expect(set.workspacePermissions.size).toBe(0)
+  })
+})
+
+describe('assertPermission', () => {
+  it('allows matching permissions and throws a structured error when missing', () => {
+    const set = {
+      principalId: PRINCIPAL,
+      workspacePermissions: new Set([PERMISSIONS.TICKET_VIEW_ALL]),
+      teamPermissions: new Map([[TEAM_A, new Set([PERMISSIONS.TICKET_REPLY_PUBLIC])]]),
+      teamIds: [TEAM_A],
+    }
+
+    expect(() => assertPermission(set, PERMISSIONS.TICKET_VIEW_ALL)).not.toThrow()
+    expect(() =>
+      assertPermission(set, PERMISSIONS.TICKET_REPLY_PUBLIC, { primaryTeamId: TEAM_A })
+    ).not.toThrow()
+    expect(() =>
+      assertPermission(set, PERMISSIONS.TICKET_REPLY_PUBLIC, { primaryTeamId: TEAM_B })
+    ).toThrow(/Missing required permission/)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/authz/__tests__/authz.test.ts b/apps/web/src/lib/server/domains/authz/__tests__/authz.test.ts
new file mode 100644
index 000000000..024cb9aaa
--- /dev/null
+++ b/apps/web/src/lib/server/domains/authz/__tests__/authz.test.ts
@@ -0,0 +1,221 @@
+/**
+ * Pure-logic tests for the authz scope evaluator and permission helpers.
+ *
+ * These tests do not touch the database — they exercise the pure functions
+ * exported from `authz.scopes.ts` and `authz.service.ts` so we can verify the
+ * full role × action × scope matrix without a live workspace.
+ */
+import { describe, it, expect } from 'vitest'
+import type { PermissionSet } from '../authz.service'
+import { evaluateTicketView, hasPermission, hasPermissionForResource } from '../authz.service'
+import { matchesAssignedScope, matchesSharedScope, matchesTeamScope } from '../authz.scopes'
+import { PERMISSIONS, SYSTEM_ROLE_PERMISSIONS, SYSTEM_ROLES } from '../authz.permissions'
+import type { PrincipalId, TeamId } from '@quackback/ids'
+
+const PRINCIPAL_A = 'principal_aaaaaaaaaaaaaaaaaaaaaaaaaa' as PrincipalId
+const PRINCIPAL_B = 'principal_bbbbbbbbbbbbbbbbbbbbbbbbbb' as PrincipalId
+const TEAM_X = 'team_xxxxxxxxxxxxxxxxxxxxxxxxxx' as TeamId
+const TEAM_Y = 'team_yyyyyyyyyyyyyyyyyyyyyyyyyy' as TeamId
+const TEAM_Z = 'team_zzzzzzzzzzzzzzzzzzzzzzzzzz' as TeamId
+
+function buildSet(args: {
+  principalId?: PrincipalId
+  workspace?: readonly (typeof PERMISSIONS)[keyof typeof PERMISSIONS][]
+  team?: Record<TeamId, readonly (typeof PERMISSIONS)[keyof typeof PERMISSIONS][]>
+  teamIds?: readonly TeamId[]
+}): PermissionSet {
+  const teamPermissions = new Map(
+    Object.entries(args.team ?? {}).map(([k, v]) => [k as TeamId, new Set(v)])
+  )
+  return {
+    principalId: args.principalId ?? PRINCIPAL_A,
+    workspacePermissions: new Set(args.workspace ?? []),
+    teamPermissions,
+    teamIds: args.teamIds ?? [],
+  }
+}
+
+describe('authz scope helpers', () => {
+  it('matches assigned scope when principal is the assignee', () => {
+    expect(
+      matchesAssignedScope(
+        { principalId: PRINCIPAL_A, teamIds: [] },
+        { assigneePrincipalId: PRINCIPAL_A }
+      ).inScope
+    ).toBe(true)
+  })
+
+  it('does not match assigned scope for a different principal', () => {
+    expect(
+      matchesAssignedScope(
+        { principalId: PRINCIPAL_A, teamIds: [] },
+        { assigneePrincipalId: PRINCIPAL_B }
+      ).inScope
+    ).toBe(false)
+  })
+
+  it('matches team scope by primary or assignee team', () => {
+    expect(
+      matchesTeamScope({ principalId: PRINCIPAL_A, teamIds: [TEAM_X] }, { primaryTeamId: TEAM_X })
+        .inScope
+    ).toBe(true)
+    expect(
+      matchesTeamScope({ principalId: PRINCIPAL_A, teamIds: [TEAM_X] }, { assigneeTeamId: TEAM_X })
+        .inScope
+    ).toBe(true)
+    expect(
+      matchesTeamScope({ principalId: PRINCIPAL_A, teamIds: [TEAM_X] }, { primaryTeamId: TEAM_Y })
+        .inScope
+    ).toBe(false)
+  })
+
+  it('matches shared scope when one of the actor teams is in shared list', () => {
+    expect(
+      matchesSharedScope(
+        { principalId: PRINCIPAL_A, teamIds: [TEAM_X, TEAM_Y] },
+        { sharedTeamIds: [TEAM_Y, TEAM_Z] }
+      ).inScope
+    ).toBe(true)
+  })
+
+  it('shared scope returns none when no overlap', () => {
+    expect(
+      matchesSharedScope(
+        { principalId: PRINCIPAL_A, teamIds: [TEAM_X] },
+        { sharedTeamIds: [TEAM_Y] }
+      ).inScope
+    ).toBe(false)
+  })
+})
+
+describe('hasPermission / hasPermissionForResource', () => {
+  it('workspace-wide grants always match regardless of resource', () => {
+    const set = buildSet({ workspace: [PERMISSIONS.TICKET_REPLY_PUBLIC] })
+    expect(hasPermission(set, PERMISSIONS.TICKET_REPLY_PUBLIC)).toBe(true)
+    expect(
+      hasPermissionForResource(set, PERMISSIONS.TICKET_REPLY_PUBLIC, {
+        primaryTeamId: TEAM_Y,
+      })
+    ).toBe(true)
+  })
+
+  it('team-scoped grants only match resources within the granted team', () => {
+    const set = buildSet({
+      team: { [TEAM_X]: [PERMISSIONS.TICKET_REPLY_PUBLIC] },
+      teamIds: [TEAM_X],
+    })
+    expect(
+      hasPermissionForResource(set, PERMISSIONS.TICKET_REPLY_PUBLIC, {
+        primaryTeamId: TEAM_X,
+      })
+    ).toBe(true)
+    expect(
+      hasPermissionForResource(set, PERMISSIONS.TICKET_REPLY_PUBLIC, {
+        primaryTeamId: TEAM_Y,
+      })
+    ).toBe(false)
+  })
+
+  it('team-scoped grants apply to shared-with team', () => {
+    const set = buildSet({
+      team: { [TEAM_X]: [PERMISSIONS.TICKET_REPLY_PUBLIC] },
+    })
+    expect(
+      hasPermissionForResource(set, PERMISSIONS.TICKET_REPLY_PUBLIC, {
+        sharedTeamIds: [TEAM_X],
+      })
+    ).toBe(true)
+  })
+
+  it('returns false when the permission is absent everywhere', () => {
+    const set = buildSet({})
+    expect(hasPermission(set, PERMISSIONS.TICKET_REPLY_PUBLIC)).toBe(false)
+  })
+})
+
+describe('evaluateTicketView (broadest → narrowest)', () => {
+  it('view_all wins regardless of resource', () => {
+    const set = buildSet({ workspace: [PERMISSIONS.TICKET_VIEW_ALL] })
+    const m = evaluateTicketView(set, { primaryTeamId: TEAM_Y })
+    expect(m.inScope).toBe(true)
+    expect(m.reason).toBe('all')
+  })
+
+  it('view_team matches when actor is on the owning team', () => {
+    const set = buildSet({
+      workspace: [PERMISSIONS.TICKET_VIEW_TEAM],
+      teamIds: [TEAM_X],
+    })
+    const m = evaluateTicketView(set, { primaryTeamId: TEAM_X })
+    expect(m).toEqual({ inScope: true, reason: 'team' })
+  })
+
+  it('view_team does not match a foreign team without view_shared', () => {
+    const set = buildSet({
+      workspace: [PERMISSIONS.TICKET_VIEW_TEAM],
+      teamIds: [TEAM_X],
+    })
+    const m = evaluateTicketView(set, { primaryTeamId: TEAM_Y })
+    expect(m.inScope).toBe(false)
+  })
+
+  it('view_shared matches when ticket is shared with one of actor teams', () => {
+    const set = buildSet({
+      workspace: [PERMISSIONS.TICKET_VIEW_SHARED],
+      teamIds: [TEAM_X],
+    })
+    const m = evaluateTicketView(set, {
+      primaryTeamId: TEAM_Y,
+      sharedTeamIds: [TEAM_X],
+    })
+    expect(m).toEqual({ inScope: true, reason: 'shared' })
+  })
+
+  it('view_assigned matches only when principal is the assignee', () => {
+    const set = buildSet({
+      workspace: [PERMISSIONS.TICKET_VIEW_ASSIGNED],
+      principalId: PRINCIPAL_A,
+    })
+    expect(evaluateTicketView(set, { assigneePrincipalId: PRINCIPAL_A })).toEqual({
+      inScope: true,
+      reason: 'assigned',
+    })
+    expect(evaluateTicketView(set, { assigneePrincipalId: PRINCIPAL_B })).toEqual({
+      inScope: false,
+      reason: 'none',
+    })
+  })
+
+  it('returns inScope=false with reason=none when no permission applies', () => {
+    const set = buildSet({})
+    const m = evaluateTicketView(set, { primaryTeamId: TEAM_X })
+    expect(m).toEqual({ inScope: false, reason: 'none' })
+  })
+})
+
+describe('system role bundles', () => {
+  it('owner holds every permission', () => {
+    const owner = SYSTEM_ROLE_PERMISSIONS[SYSTEM_ROLES.OWNER]
+    for (const p of Object.values(PERMISSIONS)) {
+      expect(owner).toContain(p)
+    }
+  })
+
+  it('agent does NOT have view_all or assign_any', () => {
+    const agent = SYSTEM_ROLE_PERMISSIONS[SYSTEM_ROLES.AGENT]
+    expect(agent).not.toContain(PERMISSIONS.TICKET_VIEW_ALL)
+    expect(agent).not.toContain(PERMISSIONS.TICKET_ASSIGN_ANY)
+    expect(agent).not.toContain(PERMISSIONS.TICKET_SHARE_CROSS_TEAM)
+    expect(agent).not.toContain(PERMISSIONS.AUDIT_VIEW)
+  })
+
+  it('collaborator has internal-comment but no public reply', () => {
+    const c = SYSTEM_ROLE_PERMISSIONS[SYSTEM_ROLES.COLLABORATOR]
+    expect(c).toContain(PERMISSIONS.TICKET_COMMENT_INTERNAL)
+    expect(c).not.toContain(PERMISSIONS.TICKET_REPLY_PUBLIC)
+  })
+
+  it('customer has no internal-side permissions', () => {
+    expect(SYSTEM_ROLE_PERMISSIONS[SYSTEM_ROLES.CUSTOMER]).toHaveLength(0)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/authz/__tests__/role.service.test.ts b/apps/web/src/lib/server/domains/authz/__tests__/role.service.test.ts
new file mode 100644
index 000000000..afa713147
--- /dev/null
+++ b/apps/web/src/lib/server/domains/authz/__tests__/role.service.test.ts
@@ -0,0 +1,484 @@
+/**
+ * role.service — authorization guardrails for the custom-roles admin surface.
+ *
+ * These are security-critical invariants: built-in (system) roles must be
+ * tamper-proof, unknown permission keys must be rejected, roles in use must not
+ * be deletable out from under their assignments, and every mutation must emit
+ * an audit event. The DB layer is mocked (the lazy `db` Proxy is overridden);
+ * assertions focus on the decision/branch behaviour and the audit side-effects,
+ * not on SQL.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { ConflictError, ForbiddenError, NotFoundError } from '@/lib/shared/errors'
+
+// All state referenced by vi.mock factories must be hoisted (factories run at
+// import time, before plain top-level consts initialize).
+const h = vi.hoisted(() => {
+  const state = {
+    // FIFO queue of rows each `db.select(...)` chain resolves to, in call order.
+    selectResults: [] as unknown[][],
+    insertReturning: [] as unknown[],
+  }
+  const recordEventMock = vi.fn()
+  function makeSelectChain() {
+    const result = state.selectResults.shift() ?? []
+    const chain: Record<string, unknown> = {}
+    const self = () => chain
+    chain.from = self
+    chain.where = self
+    chain.innerJoin = self
+    chain.leftJoin = self
+    chain.orderBy = self
+    chain.groupBy = () => Promise.resolve(result)
+    chain.limit = () => Promise.resolve(result)
+    // Awaiting the chain directly (no .limit/.groupBy) also resolves to result.
+    chain.then = (resolve: (v: unknown) => unknown) => resolve(result)
+    return chain
+  }
+  const writeOk = { where: () => Promise.resolve(undefined) }
+  const insertChain = {
+    values: () => ({ returning: () => Promise.resolve(state.insertReturning) }),
+  }
+  const dbMock = {
+    select: () => makeSelectChain(),
+    update: () => ({ set: () => writeOk }),
+    delete: () => writeOk,
+    insert: () => insertChain,
+    transaction: async (fn: (tx: unknown) => Promise<unknown>) =>
+      fn({ insert: () => insertChain, delete: () => writeOk, select: () => makeSelectChain() }),
+  }
+  return { state, recordEventMock, dbMock }
+})
+
+vi.mock('@/lib/server/domains/audit/audit.service', () => ({
+  recordEvent: (...a: unknown[]) => h.recordEventMock(...a),
+}))
+
+vi.mock('@/lib/server/db', async (importOriginal) => ({
+  // Real module gives the schema tables + drizzle operators (pure, ignored by
+  // the mock chain); we override only the lazy `db` Proxy.
+  ...(await importOriginal<typeof import('@/lib/server/db')>()),
+  db: h.dbMock,
+}))
+
+const recordEventMock = h.recordEventMock
+
+import {
+  listRoles,
+  getRoleWithPermissions,
+  createRole,
+  updateRole,
+  deleteRole,
+  setRolePermissions,
+  listAssignmentsForPrincipal,
+  assignRole,
+  revokeRoleAssignment,
+} from '../role.service'
+import type { RoleId, PrincipalId, RoleAssignmentId } from '@quackback/ids'
+import { PERMISSIONS } from '../authz.permissions'
+
+const ACTOR = 'principal_admin' as PrincipalId
+const SYSTEM_ROLE = {
+  id: 'role_admin',
+  key: 'admin',
+  name: 'Administrator',
+  description: null,
+  isSystem: true,
+  createdAt: new Date('2026-01-01'),
+  updatedAt: new Date('2026-01-01'),
+}
+const CUSTOM_ROLE = {
+  ...SYSTEM_ROLE,
+  id: 'role_custom',
+  key: 'support',
+  name: 'Support',
+  isSystem: false,
+}
+
+beforeEach(() => {
+  h.state.selectResults = []
+  h.state.insertReturning = []
+  recordEventMock.mockReset()
+})
+
+describe('role.service — system-role protection (tamper-proof built-ins)', () => {
+  it('updateRole rejects a system role with ForbiddenError and writes no audit', async () => {
+    h.state.selectResults = [[SYSTEM_ROLE]] // role lookup
+    await expect(
+      updateRole({ id: 'role_admin' as RoleId, name: 'Hacked', actorPrincipalId: ACTOR })
+    ).rejects.toBeInstanceOf(ForbiddenError)
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('deleteRole rejects a system role with ForbiddenError', async () => {
+    h.state.selectResults = [[SYSTEM_ROLE]]
+    await expect(
+      deleteRole({ id: 'role_admin' as RoleId, actorPrincipalId: ACTOR })
+    ).rejects.toBeInstanceOf(ForbiddenError)
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('setRolePermissions rejects a system role with ForbiddenError', async () => {
+    h.state.selectResults = [[SYSTEM_ROLE]]
+    await expect(
+      setRolePermissions({
+        roleId: 'role_admin' as RoleId,
+        permissionKeys: [],
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toBeInstanceOf(ForbiddenError)
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('role.service — not-found handling (default-deny on missing rows)', () => {
+  it('getRoleWithPermissions throws NotFoundError when the role is absent', async () => {
+    h.state.selectResults = [[]]
+    await expect(getRoleWithPermissions('role_missing' as RoleId)).rejects.toBeInstanceOf(
+      NotFoundError
+    )
+  })
+
+  it('setRolePermissions throws NotFoundError when the role is absent', async () => {
+    h.state.selectResults = [[]]
+    await expect(
+      setRolePermissions({
+        roleId: 'role_missing' as RoleId,
+        permissionKeys: [],
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toBeInstanceOf(NotFoundError)
+  })
+
+  it('updateRole throws NotFoundError when the role is absent', async () => {
+    h.state.selectResults = [[]]
+    await expect(
+      updateRole({ id: 'role_missing' as RoleId, name: 'X', actorPrincipalId: ACTOR })
+    ).rejects.toBeInstanceOf(NotFoundError)
+  })
+
+  it('revokeRoleAssignment throws NotFoundError when the assignment is absent', async () => {
+    h.state.selectResults = [[]]
+    await expect(
+      revokeRoleAssignment({
+        assignmentId: 'roleassign_missing' as RoleAssignmentId,
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toBeInstanceOf(NotFoundError)
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('role.service — conflict + validation guards', () => {
+  it('createRole rejects a duplicate key with ConflictError (no audit)', async () => {
+    h.state.selectResults = [[{ id: 'role_existing' }]] // key lookup finds an existing role
+    await expect(
+      createRole({
+        key: 'support',
+        name: 'Support',
+        permissionKeys: [],
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toBeInstanceOf(ConflictError)
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('createRole rejects an unknown permission key before touching the DB', async () => {
+    await expect(
+      createRole({
+        key: 'support',
+        name: 'Support',
+        permissionKeys: ['totally.bogus.permission' as never],
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toBeInstanceOf(ConflictError)
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('deleteRole refuses to delete a custom role that still has assignments', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE], [{ n: 3 }]] // role lookup, then assignment count
+    await expect(
+      deleteRole({ id: 'role_custom' as RoleId, actorPrincipalId: ACTOR })
+    ).rejects.toBeInstanceOf(ConflictError)
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('assignRole refuses a duplicate assignment for the same scope', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE], [{ id: 'roleassign_existing' }]] // role lookup, dup check
+    await expect(
+      assignRole({
+        principalId: 'principal_user' as PrincipalId,
+        roleId: 'role_custom' as RoleId,
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toBeInstanceOf(ConflictError)
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('role.service — successful mutations record an audit event', () => {
+  it('listRoles returns system roles first with permission and assignment counts', async () => {
+    h.state.selectResults = [
+      [SYSTEM_ROLE, CUSTOM_ROLE],
+      [{ roleId: 'role_admin', n: 4 }],
+      [{ roleId: 'role_custom', n: '2' }],
+    ]
+
+    const rows = await listRoles()
+
+    expect(rows).toEqual([
+      expect.objectContaining({
+        id: 'role_admin',
+        key: 'admin',
+        permissionCount: 4,
+        assignmentCount: 0,
+      }),
+      expect.objectContaining({
+        id: 'role_custom',
+        key: 'support',
+        permissionCount: 0,
+        assignmentCount: 2,
+      }),
+    ])
+  })
+
+  it('listRoles returns an empty list without count queries when no roles exist', async () => {
+    h.state.selectResults = [[]]
+
+    await expect(listRoles()).resolves.toEqual([])
+    expect(h.state.selectResults).toEqual([])
+  })
+
+  it('getRoleWithPermissions returns the role with permission keys', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE], [{ key: PERMISSIONS.TICKET_VIEW_TEAM }]]
+
+    await expect(getRoleWithPermissions('role_custom' as RoleId)).resolves.toMatchObject({
+      id: 'role_custom',
+      key: 'support',
+      permissionKeys: [PERMISSIONS.TICKET_VIEW_TEAM],
+    })
+  })
+
+  it('createRole inserts and records role.created', async () => {
+    h.state.selectResults = [[]] // key lookup: no existing role
+    h.state.insertReturning = [{ id: 'role_new' }]
+    const id = await createRole({
+      key: 'triage',
+      name: 'Triage',
+      permissionKeys: [],
+      actorPrincipalId: ACTOR,
+    })
+    expect(id).toBe('role_new')
+    expect(recordEventMock).toHaveBeenCalledTimes(1)
+    expect(recordEventMock.mock.calls[0][0]).toMatchObject({
+      action: 'role.created',
+      targetType: 'role',
+      targetId: 'role_new',
+      principalId: ACTOR,
+    })
+  })
+
+  it('createRole stores permission grants when permission keys are provided', async () => {
+    h.state.selectResults = [
+      [],
+      [{ id: 'perm_ticket_view_team', key: PERMISSIONS.TICKET_VIEW_TEAM }],
+    ]
+    h.state.insertReturning = [{ id: 'role_new' }]
+
+    await expect(
+      createRole({
+        key: 'triage',
+        name: 'Triage',
+        description: 'Can triage tickets',
+        permissionKeys: [PERMISSIONS.TICKET_VIEW_TEAM],
+        actorPrincipalId: ACTOR,
+      })
+    ).resolves.toBe('role_new')
+
+    expect(recordEventMock.mock.calls[0][0]).toMatchObject({
+      action: 'role.created',
+      diff: { after: { permissions: [PERMISSIONS.TICKET_VIEW_TEAM] } },
+    })
+  })
+
+  it('createRole fails if the inserted role is not returned', async () => {
+    h.state.selectResults = [[]]
+    h.state.insertReturning = []
+
+    await expect(
+      createRole({
+        key: 'triage',
+        name: 'Triage',
+        permissionKeys: [],
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toThrow('Failed to insert role')
+  })
+
+  it('updateRole on a custom role records role.updated with a before/after diff', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE]]
+    await updateRole({ id: 'role_custom' as RoleId, name: 'Renamed', actorPrincipalId: ACTOR })
+    expect(recordEventMock).toHaveBeenCalledTimes(1)
+    const ev = recordEventMock.mock.calls[0][0]
+    expect(ev).toMatchObject({ action: 'role.updated', targetId: 'role_custom' })
+    expect(ev.diff.before.name).toBe('Support')
+    expect(ev.diff.after.name).toBe('Renamed')
+  })
+
+  it('setRolePermissions replaces grants and records before/after permissions', async () => {
+    h.state.selectResults = [
+      [CUSTOM_ROLE],
+      [{ key: PERMISSIONS.TICKET_VIEW_TEAM }],
+      [{ id: 'perm_reply', key: PERMISSIONS.TICKET_REPLY_PUBLIC }],
+    ]
+
+    await setRolePermissions({
+      roleId: 'role_custom' as RoleId,
+      permissionKeys: [PERMISSIONS.TICKET_REPLY_PUBLIC],
+      actorPrincipalId: ACTOR,
+    })
+
+    expect(recordEventMock.mock.calls[0][0]).toMatchObject({
+      action: 'role.permissions_set',
+      targetId: 'role_custom',
+      diff: {
+        before: { permissions: [PERMISSIONS.TICKET_VIEW_TEAM] },
+        after: { permissions: [PERMISSIONS.TICKET_REPLY_PUBLIC] },
+      },
+    })
+  })
+
+  it('setRolePermissions reports permissions missing from the DB', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE], [], []]
+
+    await expect(
+      setRolePermissions({
+        roleId: 'role_custom' as RoleId,
+        permissionKeys: [PERMISSIONS.TICKET_REPLY_PUBLIC],
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toMatchObject({ code: 'PERMISSIONS_MISSING' })
+    expect(recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('deleteRole removes an unassigned custom role and records role.deleted', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE], [{ n: 0 }]] // role lookup, zero assignments
+    await deleteRole({ id: 'role_custom' as RoleId, actorPrincipalId: ACTOR })
+    expect(recordEventMock).toHaveBeenCalledTimes(1)
+    expect(recordEventMock.mock.calls[0][0]).toMatchObject({
+      action: 'role.deleted',
+      targetId: 'role_custom',
+    })
+  })
+
+  it('assignRole grants a new assignment and records role_assignment.granted', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE], []] // role lookup, no existing dup
+    h.state.insertReturning = [{ id: 'roleassign_new' }]
+    const id = await assignRole({
+      principalId: 'principal_user' as PrincipalId,
+      roleId: 'role_custom' as RoleId,
+      actorPrincipalId: ACTOR,
+    })
+    expect(id).toBe('roleassign_new')
+    expect(recordEventMock.mock.calls[0][0]).toMatchObject({
+      action: 'role_assignment.granted',
+      targetType: 'principal',
+      targetId: 'principal_user',
+    })
+  })
+
+  it('assignRole grants team-scoped assignments and records the team scope', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE], []]
+    h.state.insertReturning = [{ id: 'roleassign_team' }]
+
+    const id = await assignRole({
+      principalId: 'principal_user' as PrincipalId,
+      roleId: 'role_custom' as RoleId,
+      teamId: 'team_support' as never,
+      actorPrincipalId: ACTOR,
+    })
+
+    expect(id).toBe('roleassign_team')
+    expect(recordEventMock.mock.calls[0][0]).toMatchObject({
+      action: 'role_assignment.granted',
+      diff: { after: { role: 'support', teamId: 'team_support' } },
+    })
+  })
+
+  it('assignRole fails if the inserted assignment is not returned', async () => {
+    h.state.selectResults = [[CUSTOM_ROLE], []]
+    h.state.insertReturning = []
+
+    await expect(
+      assignRole({
+        principalId: 'principal_user' as PrincipalId,
+        roleId: 'role_custom' as RoleId,
+        actorPrincipalId: ACTOR,
+      })
+    ).rejects.toThrow('Failed to insert role assignment')
+  })
+
+  it('listAssignmentsForPrincipal hydrates role and optional team details', async () => {
+    const createdAt = new Date('2026-01-02T00:00:00.000Z')
+    h.state.selectResults = [
+      [
+        {
+          id: 'roleassign_1',
+          roleId: 'role_custom',
+          roleKey: 'support',
+          roleName: 'Support',
+          roleIsSystem: false,
+          teamId: 'team_support',
+          teamName: 'Support team',
+          grantedByPrincipalId: ACTOR,
+          createdAt,
+        },
+        {
+          id: 'roleassign_2',
+          roleId: 'role_admin',
+          roleKey: 'admin',
+          roleName: 'Admin',
+          roleIsSystem: true,
+          teamId: null,
+          teamName: null,
+          grantedByPrincipalId: null,
+          createdAt,
+        },
+      ],
+    ]
+
+    await expect(listAssignmentsForPrincipal('principal_user' as PrincipalId)).resolves.toEqual([
+      {
+        id: 'roleassign_1',
+        role: { id: 'role_custom', key: 'support', name: 'Support', isSystem: false },
+        teamId: 'team_support',
+        teamName: 'Support team',
+        grantedByPrincipalId: ACTOR,
+        createdAt,
+      },
+      {
+        id: 'roleassign_2',
+        role: { id: 'role_admin', key: 'admin', name: 'Admin', isSystem: true },
+        teamId: null,
+        teamName: null,
+        grantedByPrincipalId: null,
+        createdAt,
+      },
+    ])
+  })
+
+  it('revokeRoleAssignment deletes and records role_assignment.revoked', async () => {
+    h.state.selectResults = [
+      [{ principalId: 'principal_user', roleId: 'role_custom', teamId: null, roleKey: 'support' }],
+    ]
+    await revokeRoleAssignment({
+      assignmentId: 'roleassign_1' as RoleAssignmentId,
+      actorPrincipalId: ACTOR,
+    })
+    expect(recordEventMock.mock.calls[0][0]).toMatchObject({
+      action: 'role_assignment.revoked',
+      targetType: 'principal',
+      targetId: 'principal_user',
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/authz/authz.permissions.ts b/apps/web/src/lib/server/domains/authz/authz.permissions.ts
new file mode 100644
index 000000000..d4bdd0656
--- /dev/null
+++ b/apps/web/src/lib/server/domains/authz/authz.permissions.ts
@@ -0,0 +1,232 @@
+/**
+ * Permission catalogue for the ticketing module (and the broader workspace).
+ *
+ * Permissions are dotted machine names. A role bundle is a set of permissions.
+ * A grant (`principal_role_assignments`) attaches a role to a principal,
+ * optionally scoped to a team — see `authz.scopes.ts` for how that scope
+ * narrows action evaluation.
+ *
+ * Adding a permission here is purely a TypeScript change; the migration that
+ * seeds the system roles will reconcile the rows on next deploy.
+ */
+
+export const PERMISSIONS = {
+  // Ticket access (record-level)
+  TICKET_VIEW_ALL: 'ticket.view_all',
+  TICKET_VIEW_TEAM: 'ticket.view_team',
+  TICKET_VIEW_ASSIGNED: 'ticket.view_assigned',
+  TICKET_VIEW_SHARED: 'ticket.view_shared',
+
+  // Ticket actions
+  TICKET_REPLY_PUBLIC: 'ticket.reply_public',
+  TICKET_COMMENT_INTERNAL: 'ticket.comment_internal',
+  TICKET_EDIT_FIELDS: 'ticket.edit_fields',
+  TICKET_ASSIGN_SELF: 'ticket.assign_self',
+  TICKET_ASSIGN_ANY: 'ticket.assign_any',
+  TICKET_SHARE_CROSS_TEAM: 'ticket.share_cross_team',
+  TICKET_MANAGE_PARTICIPANTS: 'ticket.manage_participants',
+
+  // Organization & contact
+  ORG_VIEW: 'org.view',
+  ORG_MANAGE: 'org.manage',
+
+  // SLA
+  SLA_VIEW: 'sla.view',
+  SLA_MANAGE: 'sla.manage',
+  BUSINESS_HOURS_MANAGE: 'business_hours.manage',
+  ESCALATION_RULE_MANAGE: 'escalation.rule_manage',
+
+  // Audit
+  AUDIT_VIEW: 'audit.view',
+
+  // Inboxes & routing (Phase 4)
+  INBOX_VIEW: 'inbox.view',
+  INBOX_MANAGE: 'inbox.manage',
+  INBOX_CHANNEL_MANAGE: 'inbox.channel_manage',
+  ROUTING_RULE_MANAGE: 'routing.rule_manage',
+  TICKET_BULK_OPERATE: 'ticket.bulk_operate',
+
+  // Admin
+  ADMIN_MANAGE_USERS: 'admin.manage_users',
+  ADMIN_MANAGE_ROLES: 'admin.manage_roles',
+  ADMIN_MANAGE_API_KEYS: 'admin.manage_api_keys',
+  ADMIN_MANAGE_SETTINGS: 'admin.manage_settings',
+
+  // Teams (workspace structure)
+  TEAM_VIEW: 'team.view',
+  TEAM_MANAGE: 'team.manage',
+
+  // Audience & segmentation
+  SEGMENT_VIEW: 'segment.view',
+  SEGMENT_MANAGE: 'segment.manage',
+  USER_ATTRIBUTE_VIEW: 'user_attribute.view',
+  USER_ATTRIBUTE_MANAGE: 'user_attribute.manage',
+
+  // Portal & widget configuration
+  PORTAL_MANAGE: 'portal.manage',
+  WIDGET_VIEW: 'widget.view',
+  WIDGET_MANAGE: 'widget.manage',
+
+  // Conversations / live chat
+  CHAT_VIEW: 'chat.view',
+  CHAT_MANAGE: 'chat.manage',
+
+  // Content moderation
+  MODERATION_VIEW: 'moderation.view',
+  MODERATION_MANAGE: 'moderation.manage',
+} as const
+
+export type PermissionKey = (typeof PERMISSIONS)[keyof typeof PERMISSIONS]
+
+export const ALL_PERMISSIONS: readonly PermissionKey[] = Object.values(PERMISSIONS)
+
+/**
+ * Permissions grouped by UI category. Used by the permissions admin page
+ * and by the seed migration to populate the `permissions.category` column.
+ */
+export const PERMISSION_CATEGORIES: Record<string, readonly PermissionKey[]> = {
+  ticket: [
+    PERMISSIONS.TICKET_VIEW_ALL,
+    PERMISSIONS.TICKET_VIEW_TEAM,
+    PERMISSIONS.TICKET_VIEW_ASSIGNED,
+    PERMISSIONS.TICKET_VIEW_SHARED,
+    PERMISSIONS.TICKET_REPLY_PUBLIC,
+    PERMISSIONS.TICKET_COMMENT_INTERNAL,
+    PERMISSIONS.TICKET_EDIT_FIELDS,
+    PERMISSIONS.TICKET_ASSIGN_SELF,
+    PERMISSIONS.TICKET_ASSIGN_ANY,
+    PERMISSIONS.TICKET_SHARE_CROSS_TEAM,
+    PERMISSIONS.TICKET_MANAGE_PARTICIPANTS,
+  ],
+  org: [PERMISSIONS.ORG_VIEW, PERMISSIONS.ORG_MANAGE],
+  sla: [
+    PERMISSIONS.SLA_VIEW,
+    PERMISSIONS.SLA_MANAGE,
+    PERMISSIONS.BUSINESS_HOURS_MANAGE,
+    PERMISSIONS.ESCALATION_RULE_MANAGE,
+  ],
+  audit: [PERMISSIONS.AUDIT_VIEW],
+  inbox: [
+    PERMISSIONS.INBOX_VIEW,
+    PERMISSIONS.INBOX_MANAGE,
+    PERMISSIONS.INBOX_CHANNEL_MANAGE,
+    PERMISSIONS.ROUTING_RULE_MANAGE,
+    PERMISSIONS.TICKET_BULK_OPERATE,
+  ],
+  admin: [
+    PERMISSIONS.ADMIN_MANAGE_USERS,
+    PERMISSIONS.ADMIN_MANAGE_ROLES,
+    PERMISSIONS.ADMIN_MANAGE_API_KEYS,
+    PERMISSIONS.ADMIN_MANAGE_SETTINGS,
+  ],
+  team: [PERMISSIONS.TEAM_VIEW, PERMISSIONS.TEAM_MANAGE],
+  audience: [
+    PERMISSIONS.SEGMENT_VIEW,
+    PERMISSIONS.SEGMENT_MANAGE,
+    PERMISSIONS.USER_ATTRIBUTE_VIEW,
+    PERMISSIONS.USER_ATTRIBUTE_MANAGE,
+  ],
+  portal: [PERMISSIONS.PORTAL_MANAGE, PERMISSIONS.WIDGET_VIEW, PERMISSIONS.WIDGET_MANAGE],
+  chat: [PERMISSIONS.CHAT_VIEW, PERMISSIONS.CHAT_MANAGE],
+  moderation: [PERMISSIONS.MODERATION_VIEW, PERMISSIONS.MODERATION_MANAGE],
+}
+
+/**
+ * System role bundles. Seeded by migration; can be cloned/edited from the UI
+ * but not deleted (see `roles.is_system`).
+ *
+ * The legacy `principal.role` cache maps as follows:
+ *   - principal.role === 'admin'  → SYSTEM_ROLES.OWNER
+ *   - principal.role === 'member' → SYSTEM_ROLES.AGENT (default landing role
+ *                                    for existing team members; admins can
+ *                                    promote to SUPERVISOR)
+ *   - principal.role === 'user'   → SYSTEM_ROLES.CUSTOMER
+ */
+export const SYSTEM_ROLES = {
+  OWNER: 'owner',
+  SUPERVISOR: 'supervisor',
+  AGENT: 'agent',
+  COLLABORATOR: 'collaborator',
+  CUSTOMER: 'customer',
+} as const
+
+export type SystemRoleKey = (typeof SYSTEM_ROLES)[keyof typeof SYSTEM_ROLES]
+
+/**
+ * Which permissions each system role bundle includes.
+ * Owner has every permission (computed dynamically to stay in sync with
+ * `PERMISSIONS`).
+ */
+export const SYSTEM_ROLE_PERMISSIONS: Record<SystemRoleKey, readonly PermissionKey[]> = {
+  [SYSTEM_ROLES.OWNER]: ALL_PERMISSIONS,
+
+  [SYSTEM_ROLES.SUPERVISOR]: [
+    PERMISSIONS.TICKET_VIEW_ALL,
+    PERMISSIONS.TICKET_VIEW_TEAM,
+    PERMISSIONS.TICKET_VIEW_ASSIGNED,
+    PERMISSIONS.TICKET_VIEW_SHARED,
+    PERMISSIONS.TICKET_REPLY_PUBLIC,
+    PERMISSIONS.TICKET_COMMENT_INTERNAL,
+    PERMISSIONS.TICKET_EDIT_FIELDS,
+    PERMISSIONS.TICKET_ASSIGN_SELF,
+    PERMISSIONS.TICKET_ASSIGN_ANY,
+    PERMISSIONS.TICKET_SHARE_CROSS_TEAM,
+    PERMISSIONS.TICKET_MANAGE_PARTICIPANTS,
+    PERMISSIONS.ORG_VIEW,
+    PERMISSIONS.ORG_MANAGE,
+    PERMISSIONS.SLA_VIEW,
+    PERMISSIONS.SLA_MANAGE,
+    PERMISSIONS.BUSINESS_HOURS_MANAGE,
+    PERMISSIONS.ESCALATION_RULE_MANAGE,
+    PERMISSIONS.AUDIT_VIEW,
+    PERMISSIONS.INBOX_VIEW,
+    PERMISSIONS.INBOX_MANAGE,
+    PERMISSIONS.INBOX_CHANNEL_MANAGE,
+    PERMISSIONS.ROUTING_RULE_MANAGE,
+    PERMISSIONS.TICKET_BULK_OPERATE,
+    // Workspace structure + operational config (admin.* stays owner-only)
+    PERMISSIONS.TEAM_VIEW,
+    PERMISSIONS.TEAM_MANAGE,
+    PERMISSIONS.SEGMENT_VIEW,
+    PERMISSIONS.SEGMENT_MANAGE,
+    PERMISSIONS.USER_ATTRIBUTE_VIEW,
+    PERMISSIONS.USER_ATTRIBUTE_MANAGE,
+    PERMISSIONS.PORTAL_MANAGE,
+    PERMISSIONS.WIDGET_VIEW,
+    PERMISSIONS.WIDGET_MANAGE,
+    PERMISSIONS.CHAT_VIEW,
+    PERMISSIONS.CHAT_MANAGE,
+    PERMISSIONS.MODERATION_VIEW,
+    PERMISSIONS.MODERATION_MANAGE,
+  ],
+
+  [SYSTEM_ROLES.AGENT]: [
+    PERMISSIONS.TICKET_VIEW_TEAM,
+    PERMISSIONS.TICKET_VIEW_ASSIGNED,
+    PERMISSIONS.TICKET_VIEW_SHARED,
+    PERMISSIONS.TICKET_REPLY_PUBLIC,
+    PERMISSIONS.TICKET_COMMENT_INTERNAL,
+    PERMISSIONS.TICKET_EDIT_FIELDS,
+    PERMISSIONS.TICKET_ASSIGN_SELF,
+    PERMISSIONS.ORG_VIEW,
+    PERMISSIONS.SLA_VIEW,
+    PERMISSIONS.INBOX_VIEW,
+    PERMISSIONS.TICKET_BULK_OPERATE,
+    // Front-line agents handle conversations and need read context
+    PERMISSIONS.CHAT_VIEW,
+    PERMISSIONS.CHAT_MANAGE,
+    PERMISSIONS.TEAM_VIEW,
+    PERMISSIONS.SEGMENT_VIEW,
+  ],
+
+  [SYSTEM_ROLES.COLLABORATOR]: [
+    PERMISSIONS.TICKET_VIEW_SHARED,
+    PERMISSIONS.TICKET_VIEW_ASSIGNED,
+    PERMISSIONS.TICKET_COMMENT_INTERNAL,
+    PERMISSIONS.ORG_VIEW,
+  ],
+
+  // Customer role intentionally has no internal-side permissions; portal-side
+  // access is handled by the existing portal session helpers.
+  [SYSTEM_ROLES.CUSTOMER]: [],
+}
diff --git a/apps/web/src/lib/server/domains/authz/authz.scopes.ts b/apps/web/src/lib/server/domains/authz/authz.scopes.ts
new file mode 100644
index 000000000..853c9a778
--- /dev/null
+++ b/apps/web/src/lib/server/domains/authz/authz.scopes.ts
@@ -0,0 +1,72 @@
+/**
+ * Scope evaluation helpers.
+ *
+ * Many ticketing permissions come in pairs (e.g. `ticket.view_all` vs
+ * `ticket.view_team`). The authz service first checks whether the principal
+ * holds *any* permission in the family; if they only hold a narrower variant,
+ * the scope evaluator decides whether the specific resource falls inside that
+ * narrower scope.
+ *
+ * A `ResourceScope` describes the resource being acted on. For tickets that's
+ * the owning team, the assignee, any teams the ticket is shared with, and any
+ * organization the requester belongs to.
+ */
+
+import type { PrincipalId, TeamId } from '@quackback/ids'
+
+export interface ResourceScope {
+  /** Team that primarily owns the resource (e.g. ticket.primary_team_id). */
+  primaryTeamId?: TeamId | null
+  /** Principal currently assigned (e.g. ticket.assignee_principal_id). */
+  assigneePrincipalId?: PrincipalId | null
+  /** Team currently assigned (e.g. ticket.assignee_team_id). */
+  assigneeTeamId?: TeamId | null
+  /** Teams the resource is explicitly shared with. */
+  sharedTeamIds?: readonly TeamId[]
+}
+
+export interface ActorScope {
+  principalId: PrincipalId
+  /** Teams the actor belongs to (any role). */
+  teamIds: readonly TeamId[]
+}
+
+/**
+ * Result of a single scope check: whether the actor's narrower permission
+ * applies to this resource.
+ */
+export interface ScopeMatch {
+  /** True if the resource is within the actor's allowed scope. */
+  inScope: boolean
+  /** Why — useful for debugging and for the redaction UX copy. */
+  reason: 'assigned' | 'team' | 'shared' | 'all' | 'none'
+}
+
+export function matchesAssignedScope(actor: ActorScope, resource: ResourceScope): ScopeMatch {
+  if (resource.assigneePrincipalId && resource.assigneePrincipalId === actor.principalId) {
+    return { inScope: true, reason: 'assigned' }
+  }
+  return { inScope: false, reason: 'none' }
+}
+
+export function matchesTeamScope(actor: ActorScope, resource: ResourceScope): ScopeMatch {
+  if (resource.primaryTeamId && actor.teamIds.includes(resource.primaryTeamId)) {
+    return { inScope: true, reason: 'team' }
+  }
+  if (resource.assigneeTeamId && actor.teamIds.includes(resource.assigneeTeamId)) {
+    return { inScope: true, reason: 'team' }
+  }
+  return { inScope: false, reason: 'none' }
+}
+
+export function matchesSharedScope(actor: ActorScope, resource: ResourceScope): ScopeMatch {
+  if (!resource.sharedTeamIds?.length) {
+    return { inScope: false, reason: 'none' }
+  }
+  for (const shared of resource.sharedTeamIds) {
+    if (actor.teamIds.includes(shared)) {
+      return { inScope: true, reason: 'shared' }
+    }
+  }
+  return { inScope: false, reason: 'none' }
+}
diff --git a/apps/web/src/lib/server/domains/authz/authz.service.ts b/apps/web/src/lib/server/domains/authz/authz.service.ts
new file mode 100644
index 000000000..677871f8b
--- /dev/null
+++ b/apps/web/src/lib/server/domains/authz/authz.service.ts
@@ -0,0 +1,230 @@
+/**
+ * AuthzService — load + evaluate permissions for a principal.
+ *
+ * Source of truth: `principal_role_assignments` → `role_permissions` →
+ * `permissions`. The legacy `principal.role` column remains a denormalised
+ * cache so existing call sites keep working.
+ *
+ * Per-request caching is intentionally NOT done here (the layer is stateless);
+ * `auth-helpers.ts` calls `loadPermissionSet` once when building `AuthContext`
+ * and stashes the result on the context object passed down the request.
+ */
+
+import {
+  db,
+  eq,
+  inArray,
+  principal,
+  principalRoleAssignments,
+  rolePermissions,
+  permissions as permissionsTable,
+  teamMemberships,
+} from '@/lib/server/db'
+import type { PrincipalId, TeamId } from '@quackback/ids'
+import { ForbiddenError } from '@/lib/shared/errors'
+import {
+  PERMISSIONS,
+  SYSTEM_ROLE_PERMISSIONS,
+  SYSTEM_ROLES,
+  type PermissionKey,
+} from './authz.permissions'
+import {
+  matchesAssignedScope,
+  matchesSharedScope,
+  matchesTeamScope,
+  type ActorScope,
+  type ResourceScope,
+  type ScopeMatch,
+} from './authz.scopes'
+
+/**
+ * Permission set held by a principal, indexed for fast lookup.
+ */
+export interface PermissionSet {
+  principalId: PrincipalId
+  /** All permissions held workspace-wide (team_id IS NULL grants). */
+  workspacePermissions: ReadonlySet<PermissionKey>
+  /** Map team_id → set of permissions granted by team-scoped role assignments. */
+  teamPermissions: ReadonlyMap<TeamId, ReadonlySet<PermissionKey>>
+  /** Teams the principal is a member of (independent of permission grants). */
+  teamIds: readonly TeamId[]
+}
+
+/**
+ * Build the permission set for a principal.
+ *
+ * Falls back to the legacy `principal.role` column when no role assignments
+ * exist yet (i.e. before the seed migration has run on a given workspace).
+ * This keeps the system safe to deploy in any order: ship code first, run
+ * migration later.
+ */
+export async function loadPermissionSet(principalId: PrincipalId): Promise<PermissionSet> {
+  // Team memberships are needed regardless of the grant lookup outcome.
+  const memberships = await db.query.teamMemberships.findMany({
+    where: eq(teamMemberships.principalId, principalId),
+    columns: { teamId: true },
+  })
+  const teamIds = memberships.map((m) => m.teamId as TeamId)
+
+  // Load every grant for this principal plus the permissions attached to each
+  // role. We do this in two queries (assignments → role IDs → permissions) to
+  // keep the query plans simple and indexable.
+  const assignments = await db.query.principalRoleAssignments.findMany({
+    where: eq(principalRoleAssignments.principalId, principalId),
+    columns: { roleId: true, teamId: true },
+  })
+
+  if (assignments.length === 0) {
+    return legacyFallback(principalId, teamIds)
+  }
+
+  const roleIds = Array.from(new Set(assignments.map((a) => a.roleId)))
+  const grants = await db
+    .select({
+      roleId: rolePermissions.roleId,
+      key: permissionsTable.key,
+    })
+    .from(rolePermissions)
+    .innerJoin(permissionsTable, eq(rolePermissions.permissionId, permissionsTable.id))
+    .where(inArray(rolePermissions.roleId, roleIds))
+
+  const permissionsByRole = new Map<string, PermissionKey[]>()
+  for (const grant of grants) {
+    const existing = permissionsByRole.get(grant.roleId) ?? []
+    existing.push(grant.key as PermissionKey)
+    permissionsByRole.set(grant.roleId, existing)
+  }
+
+  const workspacePermissions = new Set<PermissionKey>()
+  const teamPermissions = new Map<TeamId, Set<PermissionKey>>()
+
+  for (const assignment of assignments) {
+    const perms = permissionsByRole.get(assignment.roleId) ?? []
+    if (assignment.teamId == null) {
+      for (const p of perms) workspacePermissions.add(p)
+    } else {
+      const teamId = assignment.teamId as TeamId
+      const bucket = teamPermissions.get(teamId) ?? new Set<PermissionKey>()
+      for (const p of perms) bucket.add(p)
+      teamPermissions.set(teamId, bucket)
+    }
+  }
+
+  return {
+    principalId,
+    workspacePermissions,
+    teamPermissions: new Map(
+      Array.from(teamPermissions.entries()).map(([k, v]) => [k, v as ReadonlySet<PermissionKey>])
+    ),
+    teamIds,
+  }
+}
+
+/**
+ * Pre-migration fallback: synthesise a permission set from `principal.role`.
+ */
+async function legacyFallback(
+  principalId: PrincipalId,
+  teamIds: readonly TeamId[]
+): Promise<PermissionSet> {
+  const record = await db.query.principal.findFirst({
+    where: eq(principal.id, principalId),
+    columns: { role: true },
+  })
+  const legacyRole = record?.role ?? 'user'
+  const mapped =
+    legacyRole === 'admin'
+      ? SYSTEM_ROLE_PERMISSIONS[SYSTEM_ROLES.OWNER]
+      : legacyRole === 'member'
+        ? SYSTEM_ROLE_PERMISSIONS[SYSTEM_ROLES.AGENT]
+        : SYSTEM_ROLE_PERMISSIONS[SYSTEM_ROLES.CUSTOMER]
+  return {
+    principalId,
+    workspacePermissions: new Set(mapped),
+    teamPermissions: new Map(),
+    teamIds,
+  }
+}
+
+/**
+ * Return true if the principal holds `permission` in *some* scope.
+ *
+ * Use `hasPermissionForResource` for the common ticketing case where the
+ * permission must apply to a specific resource.
+ */
+export function hasPermission(set: PermissionSet, permission: PermissionKey): boolean {
+  if (set.workspacePermissions.has(permission)) return true
+  for (const perms of set.teamPermissions.values()) {
+    if (perms.has(permission)) return true
+  }
+  return false
+}
+
+/**
+ * Return true if the principal holds `permission` *for the given resource*.
+ *
+ * Workspace-wide grants always match. Team-scoped grants only match when the
+ * resource lives in (or is shared with) one of the granted teams.
+ */
+export function hasPermissionForResource(
+  set: PermissionSet,
+  permission: PermissionKey,
+  resource: ResourceScope
+): boolean {
+  if (set.workspacePermissions.has(permission)) return true
+  for (const [teamId, perms] of set.teamPermissions.entries()) {
+    if (!perms.has(permission)) continue
+    if (resource.primaryTeamId === teamId) return true
+    if (resource.assigneeTeamId === teamId) return true
+    if (resource.sharedTeamIds?.includes(teamId)) return true
+  }
+  return false
+}
+
+/**
+ * Decide whether the principal can *view* a ticket-shaped resource, returning
+ * the matching scope so the UI can render an accurate visibility chip.
+ *
+ * Tries permissions from broadest to narrowest:
+ *   1. ticket.view_all            → reason 'all'
+ *   2. ticket.view_team           → reason 'team'
+ *   3. ticket.view_shared         → reason 'shared'
+ *   4. ticket.view_assigned       → reason 'assigned'
+ */
+export function evaluateTicketView(set: PermissionSet, resource: ResourceScope): ScopeMatch {
+  const actor: ActorScope = { principalId: set.principalId, teamIds: set.teamIds }
+
+  if (hasPermission(set, PERMISSIONS.TICKET_VIEW_ALL)) {
+    return { inScope: true, reason: 'all' }
+  }
+  if (hasPermissionForResource(set, PERMISSIONS.TICKET_VIEW_TEAM, resource)) {
+    const m = matchesTeamScope(actor, resource)
+    if (m.inScope) return m
+  }
+  if (hasPermissionForResource(set, PERMISSIONS.TICKET_VIEW_SHARED, resource)) {
+    const m = matchesSharedScope(actor, resource)
+    if (m.inScope) return m
+  }
+  if (hasPermissionForResource(set, PERMISSIONS.TICKET_VIEW_ASSIGNED, resource)) {
+    const m = matchesAssignedScope(actor, resource)
+    if (m.inScope) return m
+  }
+  return { inScope: false, reason: 'none' }
+}
+
+/**
+ * Throw a `ForbiddenError` if the principal lacks the permission.
+ * For resource-scoped checks, pass `resource`.
+ */
+export function assertPermission(
+  set: PermissionSet,
+  permission: PermissionKey,
+  resource?: ResourceScope
+): void {
+  const ok = resource
+    ? hasPermissionForResource(set, permission, resource)
+    : hasPermission(set, permission)
+  if (!ok) {
+    throw new ForbiddenError('PERMISSION_DENIED', `Missing required permission: ${permission}`)
+  }
+}
diff --git a/apps/web/src/lib/server/domains/authz/index.ts b/apps/web/src/lib/server/domains/authz/index.ts
new file mode 100644
index 000000000..dd154c839
--- /dev/null
+++ b/apps/web/src/lib/server/domains/authz/index.ts
@@ -0,0 +1,32 @@
+/**
+ * Ticketing / CRM RBAC authorization layer.
+ *
+ * Covers: tickets, teams, inboxes, SLA policies, contacts, organizations,
+ * and workspace admin operations.
+ *
+ * Design: 30+ dotted permission keys (e.g. `ticket.view_all`) organized into
+ * categories, assigned to 5 system roles (owner, supervisor, agent,
+ * collaborator, customer), with team-scope narrowing for view permissions.
+ *
+ * Legacy fallback: when no `principal_role_assignments` exist for a principal,
+ * the system maps `principal.role` → system role:
+ *   admin → owner, member → agent, user → customer.
+ *
+ * For feedback portal authorization (boards, posts, comments, chat), use
+ * `@/lib/server/policy` instead — it uses a simpler tier-based access model.
+ *
+ * Service functions are server-only; types and the permission catalogue are
+ * safe to import from client code (e.g. for UI capability checks).
+ */
+
+export {
+  PERMISSIONS,
+  PERMISSION_CATEGORIES,
+  ALL_PERMISSIONS,
+  SYSTEM_ROLES,
+  SYSTEM_ROLE_PERMISSIONS,
+  type PermissionKey,
+  type SystemRoleKey,
+} from './authz.permissions'
+
+export type { ActorScope, ResourceScope, ScopeMatch } from './authz.scopes'
diff --git a/apps/web/src/lib/server/domains/authz/role.service.ts b/apps/web/src/lib/server/domains/authz/role.service.ts
new file mode 100644
index 000000000..d3ee8306f
--- /dev/null
+++ b/apps/web/src/lib/server/domains/authz/role.service.ts
@@ -0,0 +1,471 @@
+/**
+ * Role service — CRUD for role bundles + permission assignments + grants.
+ *
+ * System roles (`isSystem=true`) are seeded by migration and are read-only
+ * from the UI: they cannot be renamed, have their permissions changed, or be
+ * deleted. They CAN be granted/revoked freely.
+ *
+ * All write paths emit an audit event via `recordEvent`.
+ */
+import {
+  db,
+  eq,
+  and,
+  inArray,
+  count,
+  desc,
+  roles,
+  permissions as permissionsTable,
+  rolePermissions,
+  principalRoleAssignments,
+  teams,
+} from '@/lib/server/db'
+import type { PermissionId, PrincipalId, RoleId, RoleAssignmentId, TeamId } from '@quackback/ids'
+import { ConflictError, ForbiddenError, NotFoundError } from '@/lib/shared/errors'
+import { recordEvent } from '@/lib/server/domains/audit/audit.service'
+import {
+  dispatchRoleCreated,
+  dispatchRoleUpdated,
+  dispatchRoleDeleted,
+  dispatchRoleAssignmentCreated,
+  dispatchRoleAssignmentRevoked,
+} from '@/lib/server/events/dispatch'
+import { ALL_PERMISSIONS, type PermissionKey } from './authz.permissions'
+
+const ROLE_ACTOR = { type: 'service' as const, displayName: 'authz-system' }
+
+export interface RoleListItem {
+  id: RoleId
+  key: string
+  name: string
+  description: string | null
+  isSystem: boolean
+  permissionCount: number
+  assignmentCount: number
+}
+
+export interface RoleWithPermissions {
+  id: RoleId
+  key: string
+  name: string
+  description: string | null
+  isSystem: boolean
+  permissionKeys: PermissionKey[]
+  createdAt: Date
+  updatedAt: Date
+}
+
+export interface PrincipalRoleAssignmentRow {
+  id: RoleAssignmentId
+  role: { id: RoleId; key: string; name: string; isSystem: boolean }
+  teamId: TeamId | null
+  teamName: string | null
+  grantedByPrincipalId: PrincipalId | null
+  createdAt: Date
+}
+
+export async function listRoles(): Promise<RoleListItem[]> {
+  const rows = await db.select().from(roles).orderBy(desc(roles.isSystem), roles.name)
+  if (rows.length === 0) return []
+
+  const ids = rows.map((r) => r.id)
+  const permCounts = await db
+    .select({ roleId: rolePermissions.roleId, n: count(rolePermissions.id) })
+    .from(rolePermissions)
+    .where(inArray(rolePermissions.roleId, ids))
+    .groupBy(rolePermissions.roleId)
+  const asgnCounts = await db
+    .select({ roleId: principalRoleAssignments.roleId, n: count(principalRoleAssignments.id) })
+    .from(principalRoleAssignments)
+    .where(inArray(principalRoleAssignments.roleId, ids))
+    .groupBy(principalRoleAssignments.roleId)
+
+  const permMap = new Map(permCounts.map((r) => [r.roleId, Number(r.n)]))
+  const asgnMap = new Map(asgnCounts.map((r) => [r.roleId, Number(r.n)]))
+
+  return rows.map((r) => ({
+    id: r.id as RoleId,
+    key: r.key,
+    name: r.name,
+    description: r.description,
+    isSystem: r.isSystem,
+    permissionCount: permMap.get(r.id) ?? 0,
+    assignmentCount: asgnMap.get(r.id) ?? 0,
+  }))
+}
+
+export async function getRoleWithPermissions(roleId: RoleId): Promise<RoleWithPermissions> {
+  const [role] = await db.select().from(roles).where(eq(roles.id, roleId)).limit(1)
+  if (!role) throw new NotFoundError('ROLE_NOT_FOUND', 'Role not found')
+
+  const grants = await db
+    .select({ key: permissionsTable.key })
+    .from(rolePermissions)
+    .innerJoin(permissionsTable, eq(rolePermissions.permissionId, permissionsTable.id))
+    .where(eq(rolePermissions.roleId, roleId))
+
+  return {
+    id: role.id as RoleId,
+    key: role.key,
+    name: role.name,
+    description: role.description,
+    isSystem: role.isSystem,
+    permissionKeys: grants.map((g) => g.key as PermissionKey),
+    createdAt: role.createdAt,
+    updatedAt: role.updatedAt,
+  }
+}
+
+interface CreateRoleInput {
+  key: string
+  name: string
+  description?: string | null
+  permissionKeys: PermissionKey[]
+  actorPrincipalId: PrincipalId
+}
+
+export async function createRole(input: CreateRoleInput): Promise<RoleId> {
+  validatePermissionKeys(input.permissionKeys)
+
+  const [existing] = await db
+    .select({ id: roles.id })
+    .from(roles)
+    .where(eq(roles.key, input.key))
+    .limit(1)
+  if (existing) throw new ConflictError('ROLE_KEY_EXISTS', 'Role key already exists')
+
+  const newId = await db.transaction(async (tx) => {
+    const [inserted] = await tx
+      .insert(roles)
+      .values({
+        key: input.key,
+        name: input.name,
+        description: input.description ?? null,
+        isSystem: false,
+      })
+      .returning({ id: roles.id })
+    if (!inserted) throw new Error('Failed to insert role')
+
+    if (input.permissionKeys.length > 0) {
+      const permIds = await loadPermissionIdsTx(tx, input.permissionKeys)
+      await tx.insert(rolePermissions).values(
+        permIds.map((permissionId) => ({
+          roleId: inserted.id as RoleId,
+          permissionId,
+        }))
+      )
+    }
+    return inserted.id as RoleId
+  })
+
+  await recordEvent({
+    principalId: input.actorPrincipalId,
+    action: 'role.created',
+    targetType: 'role',
+    targetId: newId,
+    diff: {
+      after: {
+        key: input.key,
+        name: input.name,
+        permissions: input.permissionKeys,
+      },
+    },
+  })
+
+  void dispatchRoleCreated(ROLE_ACTOR, {
+    id: newId,
+    key: input.key,
+    name: input.name,
+    isSystem: false,
+  }).catch(() => {})
+
+  return newId
+}
+
+interface UpdateRoleInput {
+  id: RoleId
+  name: string
+  description?: string | null
+  actorPrincipalId: PrincipalId
+}
+
+export async function updateRole(input: UpdateRoleInput): Promise<void> {
+  const [role] = await db.select().from(roles).where(eq(roles.id, input.id)).limit(1)
+  if (!role) throw new NotFoundError('ROLE_NOT_FOUND', 'Role not found')
+  if (role.isSystem) throw new ForbiddenError('ROLE_SYSTEM', 'System roles cannot be edited')
+
+  await db
+    .update(roles)
+    .set({ name: input.name, description: input.description ?? null })
+    .where(eq(roles.id, input.id))
+
+  await recordEvent({
+    principalId: input.actorPrincipalId,
+    action: 'role.updated',
+    targetType: 'role',
+    targetId: input.id,
+    diff: {
+      before: { name: role.name, description: role.description },
+      after: { name: input.name, description: input.description ?? null },
+    },
+  })
+
+  const changedFields = ['name']
+  if (input.description !== undefined) changedFields.push('description')
+  void dispatchRoleUpdated(
+    ROLE_ACTOR,
+    {
+      id: role.id as RoleId,
+      key: role.key,
+      name: input.name,
+      isSystem: role.isSystem,
+    },
+    changedFields
+  ).catch(() => {})
+}
+
+export async function deleteRole(input: {
+  id: RoleId
+  actorPrincipalId: PrincipalId
+}): Promise<void> {
+  const [role] = await db.select().from(roles).where(eq(roles.id, input.id)).limit(1)
+  if (!role) throw new NotFoundError('ROLE_NOT_FOUND', 'Role not found')
+  if (role.isSystem) throw new ForbiddenError('ROLE_SYSTEM', 'System roles cannot be deleted')
+
+  const [{ n }] = await db
+    .select({ n: count(principalRoleAssignments.id) })
+    .from(principalRoleAssignments)
+    .where(eq(principalRoleAssignments.roleId, input.id))
+  if (Number(n) > 0) {
+    throw new ConflictError(
+      'ROLE_HAS_ASSIGNMENTS',
+      'Revoke all assignments before deleting this role'
+    )
+  }
+
+  await db.delete(roles).where(eq(roles.id, input.id))
+
+  await recordEvent({
+    principalId: input.actorPrincipalId,
+    action: 'role.deleted',
+    targetType: 'role',
+    targetId: input.id,
+    diff: { before: { key: role.key, name: role.name } },
+  })
+
+  void dispatchRoleDeleted(ROLE_ACTOR, {
+    id: role.id as RoleId,
+    key: role.key,
+    name: role.name,
+    isSystem: role.isSystem,
+  }).catch(() => {})
+}
+
+interface SetRolePermissionsInput {
+  roleId: RoleId
+  permissionKeys: PermissionKey[]
+  actorPrincipalId: PrincipalId
+}
+
+export async function setRolePermissions(input: SetRolePermissionsInput): Promise<void> {
+  validatePermissionKeys(input.permissionKeys)
+
+  const [role] = await db.select().from(roles).where(eq(roles.id, input.roleId)).limit(1)
+  if (!role) throw new NotFoundError('ROLE_NOT_FOUND', 'Role not found')
+  if (role.isSystem)
+    throw new ForbiddenError('ROLE_SYSTEM', 'System role permissions cannot be changed')
+
+  const existing = await db
+    .select({ key: permissionsTable.key })
+    .from(rolePermissions)
+    .innerJoin(permissionsTable, eq(rolePermissions.permissionId, permissionsTable.id))
+    .where(eq(rolePermissions.roleId, input.roleId))
+  const before = existing.map((g) => g.key as PermissionKey)
+
+  await db.transaction(async (tx) => {
+    await tx.delete(rolePermissions).where(eq(rolePermissions.roleId, input.roleId))
+    if (input.permissionKeys.length > 0) {
+      const permIds = await loadPermissionIdsTx(tx, input.permissionKeys)
+      await tx
+        .insert(rolePermissions)
+        .values(permIds.map((permissionId) => ({ roleId: input.roleId, permissionId })))
+    }
+  })
+
+  await recordEvent({
+    principalId: input.actorPrincipalId,
+    action: 'role.permissions_set',
+    targetType: 'role',
+    targetId: input.roleId,
+    diff: {
+      before: { permissions: before },
+      after: { permissions: input.permissionKeys },
+    },
+  })
+}
+
+export async function listAssignmentsForPrincipal(
+  principalId: PrincipalId
+): Promise<PrincipalRoleAssignmentRow[]> {
+  const rows = await db
+    .select({
+      id: principalRoleAssignments.id,
+      teamId: principalRoleAssignments.teamId,
+      grantedByPrincipalId: principalRoleAssignments.grantedByPrincipalId,
+      createdAt: principalRoleAssignments.createdAt,
+      roleId: roles.id,
+      roleKey: roles.key,
+      roleName: roles.name,
+      roleIsSystem: roles.isSystem,
+      teamName: teams.name,
+    })
+    .from(principalRoleAssignments)
+    .innerJoin(roles, eq(principalRoleAssignments.roleId, roles.id))
+    .leftJoin(teams, eq(principalRoleAssignments.teamId, teams.id))
+    .where(eq(principalRoleAssignments.principalId, principalId))
+    .orderBy(desc(principalRoleAssignments.createdAt))
+
+  return rows.map((r) => ({
+    id: r.id as RoleAssignmentId,
+    role: {
+      id: r.roleId as RoleId,
+      key: r.roleKey,
+      name: r.roleName,
+      isSystem: r.roleIsSystem,
+    },
+    teamId: (r.teamId as TeamId | null) ?? null,
+    teamName: r.teamName ?? null,
+    grantedByPrincipalId: (r.grantedByPrincipalId as PrincipalId | null) ?? null,
+    createdAt: r.createdAt,
+  }))
+}
+
+interface AssignRoleInput {
+  principalId: PrincipalId
+  roleId: RoleId
+  teamId?: TeamId | null
+  actorPrincipalId: PrincipalId
+}
+
+export async function assignRole(input: AssignRoleInput): Promise<RoleAssignmentId> {
+  const [role] = await db.select().from(roles).where(eq(roles.id, input.roleId)).limit(1)
+  if (!role) throw new NotFoundError('ROLE_NOT_FOUND', 'Role not found')
+
+  const teamId = input.teamId ?? null
+  const dupeWhere = teamId
+    ? and(
+        eq(principalRoleAssignments.principalId, input.principalId),
+        eq(principalRoleAssignments.roleId, input.roleId),
+        eq(principalRoleAssignments.teamId, teamId)
+      )
+    : and(
+        eq(principalRoleAssignments.principalId, input.principalId),
+        eq(principalRoleAssignments.roleId, input.roleId)
+      )
+  const [existing] = await db
+    .select({ id: principalRoleAssignments.id })
+    .from(principalRoleAssignments)
+    .where(dupeWhere)
+    .limit(1)
+  if (existing)
+    throw new ConflictError('ROLE_ALREADY_ASSIGNED', 'Role already assigned for this scope')
+
+  const [inserted] = await db
+    .insert(principalRoleAssignments)
+    .values({
+      principalId: input.principalId,
+      roleId: input.roleId,
+      teamId,
+      grantedByPrincipalId: input.actorPrincipalId,
+    })
+    .returning({ id: principalRoleAssignments.id })
+  if (!inserted) throw new Error('Failed to insert role assignment')
+
+  await recordEvent({
+    principalId: input.actorPrincipalId,
+    action: 'role_assignment.granted',
+    targetType: 'principal',
+    targetId: input.principalId,
+    diff: {
+      after: { role: role.key, teamId },
+    },
+  })
+
+  void dispatchRoleAssignmentCreated(ROLE_ACTOR, {
+    id: inserted.id as RoleAssignmentId,
+    roleId: input.roleId,
+    roleKey: role.key,
+    principalId: input.principalId,
+    teamId,
+  }).catch(() => {})
+
+  return inserted.id as RoleAssignmentId
+}
+
+export async function revokeRoleAssignment(input: {
+  assignmentId: RoleAssignmentId
+  actorPrincipalId: PrincipalId
+}): Promise<void> {
+  const [row] = await db
+    .select({
+      principalId: principalRoleAssignments.principalId,
+      roleId: principalRoleAssignments.roleId,
+      teamId: principalRoleAssignments.teamId,
+      roleKey: roles.key,
+    })
+    .from(principalRoleAssignments)
+    .innerJoin(roles, eq(principalRoleAssignments.roleId, roles.id))
+    .where(eq(principalRoleAssignments.id, input.assignmentId))
+    .limit(1)
+  if (!row) throw new NotFoundError('ASSIGNMENT_NOT_FOUND', 'Role assignment not found')
+
+  await db
+    .delete(principalRoleAssignments)
+    .where(eq(principalRoleAssignments.id, input.assignmentId))
+
+  await recordEvent({
+    principalId: input.actorPrincipalId,
+    action: 'role_assignment.revoked',
+    targetType: 'principal',
+    targetId: row.principalId as string,
+    diff: {
+      before: { role: row.roleKey, teamId: row.teamId },
+    },
+  })
+
+  void dispatchRoleAssignmentRevoked(ROLE_ACTOR, {
+    id: input.assignmentId,
+    roleId: row.roleId as RoleId,
+    roleKey: row.roleKey,
+    principalId: row.principalId as PrincipalId,
+    teamId: (row.teamId as TeamId | null) ?? null,
+  }).catch(() => {})
+}
+
+// --- helpers --------------------------------------------------------------
+
+function validatePermissionKeys(keys: PermissionKey[]) {
+  const valid = new Set<string>(ALL_PERMISSIONS)
+  for (const k of keys) {
+    if (!valid.has(k)) throw new ConflictError('UNKNOWN_PERMISSION', `Unknown permission: ${k}`)
+  }
+}
+
+async function loadPermissionIdsTx(
+  tx: Parameters<Parameters<typeof db.transaction>[0]>[0],
+  keys: PermissionKey[]
+): Promise<PermissionId[]> {
+  const rows = await tx
+    .select({ id: permissionsTable.id, key: permissionsTable.key })
+    .from(permissionsTable)
+    .where(inArray(permissionsTable.key, keys as string[]))
+  if (rows.length !== keys.length) {
+    const found = new Set(rows.map((r) => r.key))
+    const missing = keys.filter((k) => !found.has(k))
+    throw new ConflictError(
+      'PERMISSIONS_MISSING',
+      `Permissions missing from DB (run migrations?): ${missing.join(', ')}`
+    )
+  }
+  return rows.map((r) => r.id as PermissionId)
+}
diff --git a/apps/web/src/lib/server/domains/customers/__tests__/customer-people.service.test.ts b/apps/web/src/lib/server/domains/customers/__tests__/customer-people.service.test.ts
new file mode 100644
index 000000000..136d262c0
--- /dev/null
+++ b/apps/web/src/lib/server/domains/customers/__tests__/customer-people.service.test.ts
@@ -0,0 +1,468 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { CustomerPersonListItem } from '../customer-people.service'
+
+const mocks = vi.hoisted(() => ({
+  dbSelect: vi.fn(),
+  searchContacts: vi.fn(),
+  eq: vi.fn(),
+  and: vi.fn(),
+  or: vi.fn(),
+  inArray: vi.fn(),
+  isNull: vi.fn(),
+  asc: vi.fn(),
+  desc: vi.fn(),
+  sql: vi.fn(),
+  realEmail: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: (...args: unknown[]) => mocks.dbSelect(...args),
+  },
+  eq: (...args: unknown[]) => mocks.eq(...args),
+  and: (...args: unknown[]) => mocks.and(...args),
+  or: (...args: unknown[]) => mocks.or(...args),
+  inArray: (...args: unknown[]) => mocks.inArray(...args),
+  isNull: (...args: unknown[]) => mocks.isNull(...args),
+  asc: (...args: unknown[]) => mocks.asc(...args),
+  desc: (...args: unknown[]) => mocks.desc(...args),
+  sql: (...args: unknown[]) => mocks.sql(...args),
+  contacts: {
+    id: 'contacts.id',
+    archivedAt: 'contacts.archivedAt',
+  },
+  organizations: {
+    id: 'organizations.id',
+    name: 'organizations.name',
+  },
+  contactUserLinks: {
+    contactId: 'contactUserLinks.contactId',
+    userId: 'contactUserLinks.userId',
+  },
+  principal: {
+    id: 'principal.id',
+    userId: 'principal.userId',
+    role: 'principal.role',
+    type: 'principal.type',
+    createdAt: 'principal.createdAt',
+  },
+  user: {
+    id: 'user.id',
+    name: 'user.name',
+    email: 'user.email',
+    image: 'user.image',
+    emailVerified: 'user.emailVerified',
+  },
+  posts: {
+    id: 'posts.id',
+    principalId: 'posts.principalId',
+    deletedAt: 'posts.deletedAt',
+  },
+  comments: {
+    id: 'comments.id',
+    principalId: 'comments.principalId',
+    deletedAt: 'comments.deletedAt',
+  },
+  votes: {
+    id: 'votes.id',
+    principalId: 'votes.principalId',
+  },
+  tickets: {
+    id: 'tickets.id',
+    requesterContactId: 'tickets.requesterContactId',
+    requesterPrincipalId: 'tickets.requesterPrincipalId',
+    deletedAt: 'tickets.deletedAt',
+  },
+  userSegments: {
+    principalId: 'userSegments.principalId',
+    segmentId: 'userSegments.segmentId',
+  },
+  segments: {
+    id: 'segments.id',
+    name: 'segments.name',
+    color: 'segments.color',
+    type: 'segments.type',
+    deletedAt: 'segments.deletedAt',
+  },
+}))
+
+vi.mock('../../organizations/contact.service', () => ({
+  searchContacts: (...args: unknown[]) => mocks.searchContacts(...args),
+}))
+
+vi.mock('@/lib/shared/anonymous-email', () => ({
+  realEmail: (...args: unknown[]) => mocks.realEmail(...args),
+}))
+
+interface SelectChain {
+  from: ReturnType<typeof vi.fn>
+  innerJoin: ReturnType<typeof vi.fn>
+  leftJoin: ReturnType<typeof vi.fn>
+  where: ReturnType<typeof vi.fn>
+  orderBy: ReturnType<typeof vi.fn>
+  limit: ReturnType<typeof vi.fn>
+  offset: ReturnType<typeof vi.fn>
+  groupBy: ReturnType<typeof vi.fn>
+  as: ReturnType<typeof vi.fn>
+  then: Promise<ReadonlyArray<Record<string, unknown>>>['then']
+  catch: Promise<ReadonlyArray<Record<string, unknown>>>['catch']
+  finally: Promise<ReadonlyArray<Record<string, unknown>>>['finally']
+}
+
+function selectRows(rows: ReadonlyArray<Record<string, unknown>>): SelectChain {
+  const promise = Promise.resolve(rows)
+  const chain = {
+    from: vi.fn(() => chain),
+    innerJoin: vi.fn(() => chain),
+    leftJoin: vi.fn(() => chain),
+    where: vi.fn(() => chain),
+    orderBy: vi.fn(() => chain),
+    limit: vi.fn(() => chain),
+    offset: vi.fn(() => chain),
+    groupBy: vi.fn(() => chain),
+    as: vi.fn((alias: string) => ({
+      principalId: `${alias}.principalId`,
+      postCount: `${alias}.postCount`,
+      commentCount: `${alias}.commentCount`,
+      voteCount: `${alias}.voteCount`,
+    })),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  }
+  return chain
+}
+
+function queueSelects(...rowSets: Array<ReadonlyArray<Record<string, unknown>>>) {
+  const chains = rowSets.map((rows) => selectRows(rows))
+  for (const chain of chains) {
+    mocks.dbSelect.mockReturnValueOnce(chain)
+  }
+  return chains
+}
+
+function portalRow(input: {
+  principalId: string
+  userId: string
+  name: string | null
+  email: string | null
+  image?: string | null
+  emailVerified?: boolean
+  postCount?: number
+  commentCount?: number
+  voteCount?: number
+}) {
+  return {
+    principalId: input.principalId,
+    userId: input.userId,
+    name: input.name,
+    email: input.email,
+    image: input.image ?? null,
+    emailVerified: input.emailVerified ?? false,
+    joinedAt: new Date('2026-06-01T00:00:00.000Z'),
+    postCount: input.postCount ?? 0,
+    commentCount: input.commentCount ?? 0,
+    voteCount: input.voteCount ?? 0,
+  }
+}
+
+function segmentRow(principalId: string, id: string, name: string) {
+  return {
+    principalId,
+    segmentId: id,
+    segmentName: name,
+    segmentColor: '#2563eb',
+    segmentType: 'manual',
+  }
+}
+
+function itemById(items: CustomerPersonListItem[], id: string) {
+  const item = items.find((candidate) => candidate.id === id)
+  expect(item).toBeDefined()
+  return item as CustomerPersonListItem
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.sql.mockReturnValue({ as: vi.fn((alias: string) => alias) })
+  mocks.and.mockImplementation((...args: unknown[]) => ({ and: args }))
+  mocks.or.mockImplementation((...args: unknown[]) => ({ or: args }))
+  mocks.eq.mockImplementation((...args: unknown[]) => ({ eq: args }))
+  mocks.inArray.mockImplementation((...args: unknown[]) => ({ inArray: args }))
+  mocks.isNull.mockImplementation((arg: unknown) => ({ isNull: arg }))
+  mocks.asc.mockImplementation((arg: unknown) => ({ asc: arg }))
+  mocks.desc.mockImplementation((arg: unknown) => ({ desc: arg }))
+  mocks.realEmail.mockImplementation((email: string | null | undefined) =>
+    email?.startsWith('temp-') ? null : (email ?? null)
+  )
+})
+
+describe('listCustomerPeople', () => {
+  it('lists portal-only people when CRM contacts are excluded', async () => {
+    queueSelects(
+      [{ userId: 'user_b' }, { userId: 'user_a' }],
+      [],
+      [],
+      [],
+      [
+        portalRow({
+          principalId: 'principal_b',
+          userId: 'user_b',
+          name: 'Beta User',
+          email: 'temp-user_b@anon.quackback.io',
+          postCount: 2,
+          commentCount: 1,
+          voteCount: 4,
+        }),
+        portalRow({
+          principalId: 'principal_a',
+          userId: 'user_a',
+          name: 'Alpha User',
+          email: 'alpha@example.com',
+          emailVerified: true,
+          postCount: 5,
+        }),
+      ],
+      [
+        segmentRow('principal_b', 'segment_beta', 'Beta'),
+        segmentRow('principal_a', 'segment_alpha', 'Alpha'),
+      ],
+      [
+        { principalId: 'principal_b', count: 3 },
+        { principalId: 'principal_a', count: 7 },
+      ]
+    )
+
+    const { listCustomerPeople } = await import('../customer-people.service')
+    const result = await listCustomerPeople({
+      includeCrm: false,
+      limit: 500,
+      offset: -10,
+    })
+
+    expect(mocks.searchContacts).not.toHaveBeenCalled()
+    expect(result.total).toBe(2)
+    expect(result.hasMore).toBe(false)
+    expect(result.items.map((item) => item.id)).toEqual(['user:principal_a', 'user:principal_b'])
+
+    const alpha = itemById(result.items, 'user:principal_a')
+    expect(alpha).toMatchObject({
+      kind: 'portal_user',
+      name: 'Alpha User',
+      email: 'alpha@example.com',
+      hasPortalUser: true,
+      emailVerified: true,
+      postCount: 5,
+      ticketCount: 7,
+    })
+    expect(alpha.segments).toEqual([
+      { id: 'segment_alpha', name: 'Alpha', color: '#2563eb', type: 'manual' },
+    ])
+
+    const beta = itemById(result.items, 'user:principal_b')
+    expect(beta.email).toBeNull()
+    expect(beta.ticketCount).toBe(3)
+  })
+
+  it('merges CRM contacts, linked portal users, organizations, segments, and ticket counts', async () => {
+    mocks.searchContacts.mockResolvedValue([
+      {
+        id: 'contact_search',
+        name: 'Search Contact',
+        email: 'search@example.com',
+        avatarUrl: null,
+        organizationId: null,
+        title: 'Champion',
+        phone: null,
+        externalId: null,
+        archivedAt: null,
+      },
+    ])
+
+    queueSelects(
+      [{ userId: 'user_linked' }, { userId: 'user_only' }],
+      [],
+      [],
+      [],
+      [
+        portalRow({
+          principalId: 'principal_linked',
+          userId: 'user_linked',
+          name: 'Linked Portal',
+          email: 'linked@example.com',
+          emailVerified: true,
+          postCount: 2,
+        }),
+        portalRow({
+          principalId: 'principal_only',
+          userId: 'user_only',
+          name: 'Portal Only',
+          email: 'portal@example.com',
+          commentCount: 3,
+        }),
+      ],
+      [
+        segmentRow('principal_linked', 'segment_enterprise', 'Enterprise'),
+        segmentRow('principal_only', 'segment_beta', 'Beta'),
+      ],
+      [{ contactId: 'contact_linked', userId: 'user_linked' }],
+      [
+        {
+          id: 'contact_linked',
+          name: 'Linked Contact',
+          email: null,
+          avatarUrl: null,
+          organizationId: 'org_1',
+          title: 'Buyer',
+          phone: '+1 555',
+          externalId: 'crm_1',
+          archivedAt: null,
+        },
+      ],
+      [{ contactId: 'contact_linked', userId: 'user_linked' }],
+      [],
+      [],
+      [],
+      [
+        portalRow({
+          principalId: 'principal_linked',
+          userId: 'user_linked',
+          name: 'Linked Portal',
+          email: 'linked@example.com',
+          emailVerified: true,
+          postCount: 2,
+        }),
+      ],
+      [segmentRow('principal_linked', 'segment_enterprise', 'Enterprise')],
+      [{ id: 'org_1', name: 'Acme Inc.' }],
+      [
+        { contactId: 'contact_linked', count: 2 },
+        { contactId: 'contact_search', count: 6 },
+      ],
+      [
+        { principalId: 'principal_linked', count: 5 },
+        { principalId: 'principal_only', count: 3 },
+      ]
+    )
+
+    const { listCustomerPeople } = await import('../customer-people.service')
+    const result = await listCustomerPeople({ search: 'portal' })
+
+    expect(mocks.searchContacts).toHaveBeenCalledWith({
+      query: 'portal',
+      includeArchived: undefined,
+      limit: 100,
+      offset: 0,
+    })
+    expect(result.items.map((item) => item.id)).toEqual([
+      'contact:contact_linked',
+      'user:principal_only',
+      'contact:contact_search',
+    ])
+
+    const linked = itemById(result.items, 'contact:contact_linked')
+    expect(linked).toMatchObject({
+      kind: 'linked',
+      contactId: 'contact_linked',
+      name: 'Linked Contact',
+      email: 'linked@example.com',
+      organizationId: 'org_1',
+      organizationName: 'Acme Inc.',
+      title: 'Buyer',
+      phone: '+1 555',
+      externalId: 'crm_1',
+      hasPortalUser: true,
+      emailVerified: true,
+      postCount: 2,
+      ticketCount: 7,
+    })
+    expect(linked.principalIds).toEqual(['principal_linked'])
+    expect(linked.segments).toEqual([
+      { id: 'segment_enterprise', name: 'Enterprise', color: '#2563eb', type: 'manual' },
+    ])
+
+    const portalOnly = itemById(result.items, 'user:principal_only')
+    expect(portalOnly.kind).toBe('portal_user')
+    expect(portalOnly.ticketCount).toBe(3)
+
+    const crmOnly = itemById(result.items, 'contact:contact_search')
+    expect(crmOnly).toMatchObject({
+      kind: 'contact',
+      hasPortalUser: false,
+      ticketCount: 6,
+    })
+  })
+
+  it('filters contact rows by linked portal-user segments and skips ticket counts when disabled', async () => {
+    mocks.searchContacts.mockResolvedValue([
+      {
+        id: 'contact_linked',
+        name: 'Linked Contact',
+        email: 'linked-contact@example.com',
+        avatarUrl: null,
+        organizationId: null,
+        title: null,
+        phone: null,
+        externalId: null,
+        archivedAt: null,
+      },
+      {
+        id: 'contact_without_segment',
+        name: 'No Segment',
+        email: 'no-segment@example.com',
+        avatarUrl: null,
+        organizationId: null,
+        title: null,
+        phone: null,
+        externalId: null,
+        archivedAt: null,
+      },
+    ])
+
+    queueSelects(
+      [],
+      [{ userId: 'user_linked' }],
+      [],
+      [],
+      [],
+      [
+        portalRow({
+          principalId: 'principal_linked',
+          userId: 'user_linked',
+          name: 'Linked Portal',
+          email: 'linked@example.com',
+        }),
+      ],
+      [segmentRow('principal_linked', 'segment_enterprise', 'Enterprise')],
+      [{ contactId: 'contact_linked', userId: 'user_linked' }],
+      [{ contactId: 'contact_linked', userId: 'user_linked' }],
+      [],
+      [],
+      [],
+      [
+        portalRow({
+          principalId: 'principal_linked',
+          userId: 'user_linked',
+          name: 'Linked Portal',
+          email: 'linked@example.com',
+        }),
+      ],
+      [segmentRow('principal_linked', 'segment_enterprise', 'Enterprise')]
+    )
+
+    const { listCustomerPeople } = await import('../customer-people.service')
+    const result = await listCustomerPeople({
+      segmentIds: ['segment_enterprise' as never],
+      includeTicketCounts: false,
+    })
+
+    expect(result.items.map((item) => item.id)).toEqual(['contact:contact_linked'])
+    expect(result.items[0]).toMatchObject({
+      kind: 'linked',
+      ticketCount: 0,
+      segments: [
+        { id: 'segment_enterprise', name: 'Enterprise', color: '#2563eb', type: 'manual' },
+      ],
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/customers/customer-people.service.ts b/apps/web/src/lib/server/domains/customers/customer-people.service.ts
new file mode 100644
index 000000000..5d4d67e0a
--- /dev/null
+++ b/apps/web/src/lib/server/domains/customers/customer-people.service.ts
@@ -0,0 +1,507 @@
+import {
+  db,
+  eq,
+  and,
+  or,
+  inArray,
+  isNull,
+  sql,
+  asc,
+  desc,
+  contacts,
+  organizations,
+  contactUserLinks,
+  principal,
+  user,
+  posts,
+  comments,
+  votes,
+  tickets,
+  userSegments,
+  segments,
+} from '@/lib/server/db'
+import type { SQL } from 'drizzle-orm'
+import type { ContactId, OrganizationId, PrincipalId, SegmentId, UserId } from '@quackback/ids'
+import type { UserSegmentSummary } from '../users/user.types'
+import { searchContacts } from '../organizations/contact.service'
+import { realEmail } from '@/lib/shared/anonymous-email'
+
+export interface CustomerPersonListParams {
+  search?: string
+  includeArchived?: boolean
+  segmentIds?: SegmentId[]
+  includeCrm?: boolean
+  includeTicketCounts?: boolean
+  limit?: number
+  offset?: number
+}
+
+export type CustomerPersonKind = 'linked' | 'contact' | 'portal_user'
+
+export interface CustomerPersonLinkedUser {
+  principalId: PrincipalId
+  userId: UserId
+  name: string | null
+  email: string | null
+  image: string | null
+  emailVerified: boolean
+  joinedAt: Date
+}
+
+export interface CustomerPersonListItem {
+  id: string
+  kind: CustomerPersonKind
+  contactId: ContactId | null
+  principalIds: PrincipalId[]
+  userIds: UserId[]
+  name: string | null
+  email: string | null
+  avatarUrl: string | null
+  organizationId: OrganizationId | null
+  organizationName: string | null
+  title: string | null
+  phone: string | null
+  externalId: string | null
+  archivedAt: Date | null
+  hasPortalUser: boolean
+  emailVerified: boolean
+  linkedUsers: CustomerPersonLinkedUser[]
+  segments: UserSegmentSummary[]
+  postCount: number
+  commentCount: number
+  voteCount: number
+  ticketCount: number
+}
+
+export interface CustomerPersonListResult {
+  items: CustomerPersonListItem[]
+  total: number
+  hasMore: boolean
+}
+
+interface PortalSummary extends CustomerPersonLinkedUser {
+  postCount: number
+  commentCount: number
+  voteCount: number
+  segments: UserSegmentSummary[]
+}
+
+async function fetchSegmentsForPrincipals(
+  principalIds: PrincipalId[]
+): Promise<Map<string, UserSegmentSummary[]>> {
+  if (principalIds.length === 0) return new Map()
+
+  const rows = await db
+    .select({
+      principalId: userSegments.principalId,
+      segmentId: segments.id,
+      segmentName: segments.name,
+      segmentColor: segments.color,
+      segmentType: segments.type,
+    })
+    .from(userSegments)
+    .innerJoin(segments, eq(userSegments.segmentId, segments.id))
+    .where(and(inArray(userSegments.principalId, principalIds), isNull(segments.deletedAt)))
+    .orderBy(asc(segments.name))
+
+  const map = new Map<string, UserSegmentSummary[]>()
+  for (const row of rows) {
+    const list = map.get(row.principalId) ?? []
+    list.push({
+      id: row.segmentId as SegmentId,
+      name: row.segmentName,
+      color: row.segmentColor,
+      type: row.segmentType as 'manual' | 'dynamic',
+    })
+    map.set(row.principalId, list)
+  }
+  return map
+}
+
+async function fetchPortalSummariesByUserIds(
+  userIds: UserId[]
+): Promise<Map<string, PortalSummary>> {
+  if (userIds.length === 0) return new Map()
+
+  const postCounts = db
+    .select({
+      principalId: posts.principalId,
+      postCount: sql<number>`count(*)::int`.as('post_count'),
+    })
+    .from(posts)
+    .where(isNull(posts.deletedAt))
+    .groupBy(posts.principalId)
+    .as('post_counts')
+
+  const commentCounts = db
+    .select({
+      principalId: comments.principalId,
+      commentCount: sql<number>`count(*)::int`.as('comment_count'),
+    })
+    .from(comments)
+    .where(isNull(comments.deletedAt))
+    .groupBy(comments.principalId)
+    .as('comment_counts')
+
+  const voteCounts = db
+    .select({
+      principalId: votes.principalId,
+      voteCount: sql<number>`count(*)::int`.as('vote_count'),
+    })
+    .from(votes)
+    .groupBy(votes.principalId)
+    .as('vote_counts')
+
+  const rows = await db
+    .select({
+      principalId: principal.id,
+      userId: user.id,
+      name: user.name,
+      email: user.email,
+      image: user.image,
+      emailVerified: user.emailVerified,
+      joinedAt: principal.createdAt,
+      postCount: sql<number>`COALESCE(${postCounts.postCount}, 0)`,
+      commentCount: sql<number>`COALESCE(${commentCounts.commentCount}, 0)`,
+      voteCount: sql<number>`COALESCE(${voteCounts.voteCount}, 0)`,
+    })
+    .from(principal)
+    .innerJoin(user, eq(principal.userId, user.id))
+    .leftJoin(postCounts, eq(postCounts.principalId, principal.id))
+    .leftJoin(commentCounts, eq(commentCounts.principalId, principal.id))
+    .leftJoin(voteCounts, eq(voteCounts.principalId, principal.id))
+    .where(
+      and(
+        eq(principal.role, 'user'),
+        eq(principal.type, 'user'),
+        inArray(user.id, userIds as UserId[])
+      )
+    )
+
+  const segmentMap = await fetchSegmentsForPrincipals(
+    rows.map((row) => row.principalId as PrincipalId)
+  )
+  return new Map(
+    rows.map((row) => [
+      row.userId,
+      {
+        principalId: row.principalId as PrincipalId,
+        userId: row.userId as UserId,
+        name: row.name,
+        email: realEmail(row.email),
+        image: row.image,
+        emailVerified: row.emailVerified,
+        joinedAt: row.joinedAt,
+        postCount: Number(row.postCount),
+        commentCount: Number(row.commentCount),
+        voteCount: Number(row.voteCount),
+        segments: segmentMap.get(row.principalId) ?? [],
+      },
+    ])
+  )
+}
+
+async function fetchPortalMatches(params: CustomerPersonListParams): Promise<PortalSummary[]> {
+  const conditions: SQL[] = [eq(principal.role, 'user'), eq(principal.type, 'user')]
+  if (params.search?.trim()) {
+    const q = `%${params.search.trim()}%`
+    conditions.push(or(sql`${user.name} ILIKE ${q}`, sql`${user.email} ILIKE ${q}`)!)
+  }
+  if (params.segmentIds?.length) {
+    conditions.push(
+      inArray(
+        principal.id,
+        db
+          .select({ principalId: userSegments.principalId })
+          .from(userSegments)
+          .where(inArray(userSegments.segmentId, params.segmentIds))
+      )
+    )
+  }
+
+  const rows = await db
+    .select({ userId: user.id })
+    .from(principal)
+    .innerJoin(user, eq(principal.userId, user.id))
+    .where(and(...conditions))
+    .orderBy(desc(principal.createdAt))
+    .limit(Math.min(params.limit ?? 100, 200))
+    .offset(Math.max(params.offset ?? 0, 0))
+
+  const summaries = await fetchPortalSummariesByUserIds(rows.map((row) => row.userId as UserId))
+  return rows.map((row) => summaries.get(row.userId)).filter((row): row is PortalSummary => !!row)
+}
+
+async function fetchContactsByIds(contactIds: ContactId[]) {
+  if (contactIds.length === 0) return []
+  return db.select().from(contacts).where(inArray(contacts.id, contactIds))
+}
+
+async function fetchOrganizationNames(
+  organizationIds: OrganizationId[]
+): Promise<Map<string, string>> {
+  if (organizationIds.length === 0) return new Map()
+  const rows = await db
+    .select({ id: organizations.id, name: organizations.name })
+    .from(organizations)
+    .where(inArray(organizations.id, organizationIds))
+  return new Map(rows.map((row) => [row.id, row.name]))
+}
+
+async function fetchTicketCounts(input: {
+  contactIds: ContactId[]
+  principalIds: PrincipalId[]
+}): Promise<{ byContact: Map<string, number>; byPrincipal: Map<string, number> }> {
+  const byContact = new Map<string, number>()
+  const byPrincipal = new Map<string, number>()
+
+  if (input.contactIds.length > 0) {
+    const rows = await db
+      .select({
+        contactId: tickets.requesterContactId,
+        count: sql<number>`count(distinct ${tickets.id})::int`,
+      })
+      .from(tickets)
+      .where(and(inArray(tickets.requesterContactId, input.contactIds), isNull(tickets.deletedAt)))
+      .groupBy(tickets.requesterContactId)
+    for (const row of rows) {
+      if (row.contactId) byContact.set(row.contactId, Number(row.count))
+    }
+  }
+
+  if (input.principalIds.length > 0) {
+    const principalTicketConditions: SQL[] = [
+      inArray(tickets.requesterPrincipalId, input.principalIds),
+      isNull(tickets.deletedAt),
+    ]
+    if (input.contactIds.length > 0) {
+      principalTicketConditions.push(isNull(tickets.requesterContactId))
+    }
+    const rows = await db
+      .select({
+        principalId: tickets.requesterPrincipalId,
+        count: sql<number>`count(distinct ${tickets.id})::int`,
+      })
+      .from(tickets)
+      .where(and(...principalTicketConditions))
+      .groupBy(tickets.requesterPrincipalId)
+    for (const row of rows) {
+      if (row.principalId) byPrincipal.set(row.principalId, Number(row.count))
+    }
+  }
+
+  return { byContact, byPrincipal }
+}
+
+function uniqueSegments(users: PortalSummary[]): UserSegmentSummary[] {
+  const map = new Map<string, UserSegmentSummary>()
+  for (const portalUser of users) {
+    for (const segment of portalUser.segments) map.set(segment.id, segment)
+  }
+  return Array.from(map.values()).sort((a, b) => a.name.localeCompare(b.name))
+}
+
+function matchesSegmentFilter(users: PortalSummary[], segmentIds?: SegmentId[]): boolean {
+  if (!segmentIds?.length) return true
+  const wanted = new Set(segmentIds)
+  return users.some((portalUser) =>
+    portalUser.segments.some((segment) => wanted.has(segment.id as SegmentId))
+  )
+}
+
+export async function listCustomerPeople(
+  params: CustomerPersonListParams = {}
+): Promise<CustomerPersonListResult> {
+  const limit = Math.min(params.limit ?? 100, 200)
+  const offset = Math.max(params.offset ?? 0, 0)
+
+  if (params.includeCrm === false) {
+    const portalMatches = await fetchPortalMatches({ ...params, limit, offset })
+    const principalIds = portalMatches.map((portalUser) => portalUser.principalId as PrincipalId)
+    const ticketCounts =
+      params.includeTicketCounts === false
+        ? { byContact: new Map<string, number>(), byPrincipal: new Map<string, number>() }
+        : await fetchTicketCounts({ contactIds: [], principalIds })
+    const items = portalMatches
+      .map((row) => ({
+        id: `user:${row.principalId}`,
+        kind: 'portal_user' as const,
+        contactId: null,
+        principalIds: [row.principalId],
+        userIds: [row.userId],
+        name: row.name,
+        email: row.email,
+        avatarUrl: row.image,
+        organizationId: null,
+        organizationName: null,
+        title: null,
+        phone: null,
+        externalId: null,
+        archivedAt: null,
+        hasPortalUser: true,
+        emailVerified: row.emailVerified,
+        linkedUsers: [row],
+        segments: row.segments,
+        postCount: row.postCount,
+        commentCount: row.commentCount,
+        voteCount: row.voteCount,
+        ticketCount: ticketCounts.byPrincipal.get(row.principalId) ?? 0,
+      }))
+      .sort((a, b) => (a.name ?? a.email ?? a.id).localeCompare(b.name ?? b.email ?? b.id))
+
+    return {
+      items,
+      total: items.length,
+      hasMore: false,
+    }
+  }
+
+  const [contactMatches, portalMatches] = await Promise.all([
+    searchContacts({
+      query: params.search,
+      includeArchived: params.includeArchived,
+      limit,
+      offset,
+    }),
+    fetchPortalMatches({ ...params, limit, offset }),
+  ])
+
+  const portalUserIds = portalMatches.map((row) => row.userId)
+  const linksForPortalMatches =
+    portalUserIds.length > 0
+      ? await db
+          .select({ contactId: contactUserLinks.contactId, userId: contactUserLinks.userId })
+          .from(contactUserLinks)
+          .where(inArray(contactUserLinks.userId, portalUserIds))
+      : []
+
+  const contactIdSet = new Set<ContactId>(contactMatches.map((contact) => contact.id as ContactId))
+  for (const link of linksForPortalMatches) contactIdSet.add(link.contactId as ContactId)
+
+  const contactRowsById = new Map(contactMatches.map((contact) => [contact.id, contact]))
+  const missingContactIds = Array.from(contactIdSet).filter((id) => !contactRowsById.has(id))
+  for (const contact of await fetchContactsByIds(missingContactIds)) {
+    if (!params.includeArchived && contact.archivedAt) continue
+    contactRowsById.set(contact.id, contact)
+  }
+
+  const contactIds = Array.from(contactRowsById.keys()) as ContactId[]
+  const contactLinks =
+    contactIds.length > 0
+      ? await db
+          .select({ contactId: contactUserLinks.contactId, userId: contactUserLinks.userId })
+          .from(contactUserLinks)
+          .where(inArray(contactUserLinks.contactId, contactIds))
+      : []
+
+  const linkedUserIds = Array.from(new Set(contactLinks.map((link) => link.userId as UserId)))
+  const linkedSummaries = await fetchPortalSummariesByUserIds(linkedUserIds)
+  const portalByUserId = new Map<string, PortalSummary>()
+  for (const row of portalMatches) portalByUserId.set(row.userId, row)
+  for (const row of linkedSummaries.values()) portalByUserId.set(row.userId, row)
+
+  const linksByContact = new Map<string, PortalSummary[]>()
+  const linkedPortalUserIds = new Set<string>()
+  for (const link of contactLinks) {
+    const portalUser = portalByUserId.get(link.userId)
+    if (!portalUser) continue
+    linkedPortalUserIds.add(link.userId)
+    const list = linksByContact.get(link.contactId) ?? []
+    list.push(portalUser)
+    linksByContact.set(link.contactId, list)
+  }
+
+  const organizationIds = Array.from(
+    new Set(
+      Array.from(contactRowsById.values())
+        .map((contact) => contact.organizationId)
+        .filter((id): id is OrganizationId => !!id)
+    )
+  )
+  const organizationNames = await fetchOrganizationNames(organizationIds)
+
+  const principalIds = Array.from(
+    new Set([...portalByUserId.values()].map((portalUser) => portalUser.principalId as PrincipalId))
+  )
+  const ticketCounts =
+    params.includeTicketCounts === false
+      ? { byContact: new Map<string, number>(), byPrincipal: new Map<string, number>() }
+      : await fetchTicketCounts({ contactIds, principalIds })
+
+  const contactRows: CustomerPersonListItem[] = Array.from(contactRowsById.values())
+    .map((contact) => {
+      const linkedUsers = linksByContact.get(contact.id) ?? []
+      const principalIds = linkedUsers.map((row) => row.principalId)
+      const firstPortalUser = linkedUsers[0]
+      const kind: CustomerPersonKind = linkedUsers.length > 0 ? 'linked' : 'contact'
+      return {
+        id: `contact:${contact.id}`,
+        kind,
+        contactId: contact.id as ContactId,
+        principalIds,
+        userIds: linkedUsers.map((row) => row.userId),
+        name: contact.name ?? firstPortalUser?.name ?? null,
+        email: contact.email ?? firstPortalUser?.email ?? null,
+        avatarUrl: contact.avatarUrl ?? firstPortalUser?.image ?? null,
+        organizationId: (contact.organizationId as OrganizationId | null) ?? null,
+        organizationName: contact.organizationId
+          ? (organizationNames.get(contact.organizationId) ?? null)
+          : null,
+        title: contact.title,
+        phone: contact.phone,
+        externalId: contact.externalId,
+        archivedAt: contact.archivedAt,
+        hasPortalUser: linkedUsers.length > 0,
+        emailVerified: linkedUsers.some((row) => row.emailVerified),
+        linkedUsers,
+        segments: uniqueSegments(linkedUsers),
+        postCount: linkedUsers.reduce((sum, row) => sum + row.postCount, 0),
+        commentCount: linkedUsers.reduce((sum, row) => sum + row.commentCount, 0),
+        voteCount: linkedUsers.reduce((sum, row) => sum + row.voteCount, 0),
+        ticketCount:
+          (ticketCounts.byContact.get(contact.id) ?? 0) +
+          principalIds.reduce((sum, id) => sum + (ticketCounts.byPrincipal.get(id) ?? 0), 0),
+      }
+    })
+    .filter((row) => {
+      if (!params.segmentIds?.length) return true
+      return matchesSegmentFilter(row.linkedUsers, params.segmentIds)
+    })
+
+  const portalOnlyRows: CustomerPersonListItem[] = portalMatches
+    .filter((row) => !linkedPortalUserIds.has(row.userId))
+    .map((row) => ({
+      id: `user:${row.principalId}`,
+      kind: 'portal_user',
+      contactId: null,
+      principalIds: [row.principalId],
+      userIds: [row.userId],
+      name: row.name,
+      email: row.email,
+      avatarUrl: row.image,
+      organizationId: null,
+      organizationName: null,
+      title: null,
+      phone: null,
+      externalId: null,
+      archivedAt: null,
+      hasPortalUser: true,
+      emailVerified: row.emailVerified,
+      linkedUsers: [row],
+      segments: row.segments,
+      postCount: row.postCount,
+      commentCount: row.commentCount,
+      voteCount: row.voteCount,
+      ticketCount: ticketCounts.byPrincipal.get(row.principalId) ?? 0,
+    }))
+
+  const items = [...contactRows, ...portalOnlyRows].sort((a, b) =>
+    (a.name ?? a.email ?? a.id).localeCompare(b.name ?? b.email ?? b.id)
+  )
+
+  return {
+    items,
+    total: items.length,
+    hasMore: false,
+  }
+}
diff --git a/apps/web/src/lib/server/domains/customers/index.ts b/apps/web/src/lib/server/domains/customers/index.ts
new file mode 100644
index 000000000..b40515b77
--- /dev/null
+++ b/apps/web/src/lib/server/domains/customers/index.ts
@@ -0,0 +1 @@
+export * from './customer-people.service'
diff --git a/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.channels-memberships.test.ts b/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.channels-memberships.test.ts
new file mode 100644
index 000000000..176c77c80
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.channels-memberships.test.ts
@@ -0,0 +1,412 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  findChannelMock: vi.fn(),
+  findMembershipMock: vi.fn(),
+  insertValuesMock: vi.fn(),
+  insertReturningMock: vi.fn(),
+  updateSetMock: vi.fn(),
+  updateWhereMock: vi.fn(),
+  updateReturningMock: vi.fn(),
+  deleteWhereMock: vi.fn(),
+  selectFromMock: vi.fn(),
+  selectWhereMock: vi.fn(),
+  selectOrderByMock: vi.fn(),
+  selectInnerJoinMock: vi.fn(),
+  selectJoinWhereMock: vi.fn(),
+  selectJoinOrderByMock: vi.fn(),
+  insertMock: vi.fn(),
+  updateMock: vi.fn(),
+  deleteMock: vi.fn(),
+  selectMock: vi.fn(),
+  eqMock: vi.fn(),
+  andMock: vi.fn(),
+  isNullMock: vi.fn(),
+  ascMock: vi.fn(),
+  dispatchInboxChannelCreatedMock: vi.fn(),
+  dispatchInboxChannelUpdatedMock: vi.fn(),
+  dispatchInboxChannelArchivedMock: vi.fn(),
+  dispatchInboxMembershipAddedMock: vi.fn(),
+  dispatchInboxMembershipUpdatedMock: vi.fn(),
+  dispatchInboxMembershipRemovedMock: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      inboxChannels: { findFirst: hoisted.findChannelMock },
+      inboxMemberships: { findFirst: hoisted.findMembershipMock },
+    },
+    insert: (...args: unknown[]) => hoisted.insertMock(...args),
+    update: (...args: unknown[]) => hoisted.updateMock(...args),
+    delete: (...args: unknown[]) => hoisted.deleteMock(...args),
+    select: (...args: unknown[]) => hoisted.selectMock(...args),
+  },
+  eq: (...args: unknown[]) => hoisted.eqMock(...args),
+  and: (...args: unknown[]) => hoisted.andMock(...args),
+  isNull: (...args: unknown[]) => hoisted.isNullMock(...args),
+  asc: (...args: unknown[]) => hoisted.ascMock(...args),
+  inboxChannels: {
+    id: 'inboxChannels.id',
+    inboxId: 'inboxChannels.inboxId',
+    kind: 'inboxChannels.kind',
+    label: 'inboxChannels.label',
+    externalId: 'inboxChannels.externalId',
+    enabled: 'inboxChannels.enabled',
+    archivedAt: 'inboxChannels.archivedAt',
+    createdAt: 'inboxChannels.createdAt',
+  },
+  inboxMemberships: {
+    id: 'inboxMemberships.id',
+    inboxId: 'inboxMemberships.inboxId',
+    principalId: 'inboxMemberships.principalId',
+    role: 'inboxMemberships.role',
+    createdAt: 'inboxMemberships.createdAt',
+  },
+  inboxes: {
+    id: 'inboxes.id',
+    name: 'inboxes.name',
+  },
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchInboxChannelCreated: (...args: unknown[]) =>
+    hoisted.dispatchInboxChannelCreatedMock(...args),
+  dispatchInboxChannelUpdated: (...args: unknown[]) =>
+    hoisted.dispatchInboxChannelUpdatedMock(...args),
+  dispatchInboxChannelArchived: (...args: unknown[]) =>
+    hoisted.dispatchInboxChannelArchivedMock(...args),
+  dispatchInboxMembershipAdded: (...args: unknown[]) =>
+    hoisted.dispatchInboxMembershipAddedMock(...args),
+  dispatchInboxMembershipUpdated: (...args: unknown[]) =>
+    hoisted.dispatchInboxMembershipUpdatedMock(...args),
+  dispatchInboxMembershipRemoved: (...args: unknown[]) =>
+    hoisted.dispatchInboxMembershipRemovedMock(...args),
+}))
+
+const { addInboxChannel, updateInboxChannel, archiveInboxChannel, getInboxChannelByExternalId } =
+  await import('../inbox.channels')
+const {
+  addInboxMembership,
+  updateInboxMembershipRole,
+  removeInboxMembership,
+  listMembershipsForInbox,
+  listInboxesForPrincipal,
+  listInboxRowsForPrincipal,
+} = await import('../inbox.memberships')
+
+function channel(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'channel_1',
+    inboxId: 'inbox_1',
+    kind: 'email',
+    label: 'Support email',
+    config: {},
+    externalId: null,
+    enabled: true,
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function membership(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'membership_1',
+    inboxId: 'inbox_1',
+    principalId: 'principal_1',
+    role: 'agent',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.eqMock.mockImplementation((left: unknown, right: unknown) => ['eq', left, right])
+  hoisted.andMock.mockImplementation((...parts: unknown[]) => ['and', ...parts])
+  hoisted.isNullMock.mockImplementation((value: unknown) => ['isNull', value])
+  hoisted.ascMock.mockImplementation((value: unknown) => ['asc', value])
+  hoisted.insertMock.mockReturnValue({
+    values: (values: unknown) => {
+      hoisted.insertValuesMock(values)
+      return { returning: hoisted.insertReturningMock }
+    },
+  })
+  hoisted.updateMock.mockReturnValue({
+    set: (patch: unknown) => {
+      hoisted.updateSetMock(patch)
+      return {
+        where: (condition: unknown) => {
+          hoisted.updateWhereMock(condition)
+          return { returning: hoisted.updateReturningMock }
+        },
+      }
+    },
+  })
+  hoisted.deleteMock.mockReturnValue({
+    where: (...args: unknown[]) => hoisted.deleteWhereMock(...args),
+  })
+  hoisted.selectMock.mockImplementation((shape?: unknown) => {
+    if (shape) {
+      return {
+        from: (table: unknown) => {
+          hoisted.selectFromMock(table)
+          return {
+            innerJoin: (...args: unknown[]) => {
+              hoisted.selectInnerJoinMock(...args)
+              return {
+                where: (condition: unknown) => {
+                  hoisted.selectJoinWhereMock(condition)
+                  return { orderBy: (...args: unknown[]) => hoisted.selectJoinOrderByMock(...args) }
+                },
+              }
+            },
+          }
+        },
+      }
+    }
+    return {
+      from: (table: unknown) => {
+        hoisted.selectFromMock(table)
+        return {
+          where: (condition: unknown) => {
+            hoisted.selectWhereMock(condition)
+            return { orderBy: (...args: unknown[]) => hoisted.selectOrderByMock(...args) }
+          },
+        }
+      },
+    }
+  })
+  hoisted.dispatchInboxChannelCreatedMock.mockResolvedValue(undefined)
+  hoisted.dispatchInboxChannelUpdatedMock.mockResolvedValue(undefined)
+  hoisted.dispatchInboxChannelArchivedMock.mockResolvedValue(undefined)
+  hoisted.dispatchInboxMembershipAddedMock.mockResolvedValue(undefined)
+  hoisted.dispatchInboxMembershipUpdatedMock.mockResolvedValue(undefined)
+  hoisted.dispatchInboxMembershipRemovedMock.mockResolvedValue(undefined)
+})
+
+describe('inbox channel service', () => {
+  it('validates required channel input and duplicate external ids', async () => {
+    await expect(
+      addInboxChannel({ inboxId: '' as never, kind: 'email' as never, label: 'Email' })
+    ).rejects.toMatchObject({ code: 'INBOX_REQUIRED' })
+    await expect(
+      addInboxChannel({ inboxId: 'inbox_1' as never, kind: 'email' as never, label: '  ' })
+    ).rejects.toMatchObject({ code: 'CHANNEL_LABEL_REQUIRED' })
+    await expect(
+      addInboxChannel({
+        inboxId: 'inbox_1' as never,
+        kind: 'email' as never,
+        label: 'x'.repeat(201),
+      })
+    ).rejects.toMatchObject({ code: 'CHANNEL_LABEL_TOO_LONG' })
+
+    hoisted.findChannelMock.mockResolvedValue(channel({ externalId: 'support@example.com' }))
+    await expect(
+      addInboxChannel({
+        inboxId: 'inbox_1' as never,
+        kind: 'email' as never,
+        label: 'Email',
+        externalId: 'support@example.com',
+      })
+    ).rejects.toMatchObject({ code: 'CHANNEL_EXTERNAL_ID_TAKEN' })
+  })
+
+  it('creates a channel with defaults and dispatches an event snapshot', async () => {
+    const created = channel({ label: 'Email', externalId: 'support@example.com' })
+    hoisted.findChannelMock.mockResolvedValue(undefined)
+    hoisted.insertReturningMock.mockResolvedValue([created])
+
+    await expect(
+      addInboxChannel({
+        inboxId: 'inbox_1' as never,
+        kind: 'email' as never,
+        label: '  Email  ',
+        externalId: 'support@example.com',
+      })
+    ).resolves.toBe(created)
+
+    expect(hoisted.insertValuesMock).toHaveBeenCalledWith({
+      inboxId: 'inbox_1',
+      kind: 'email',
+      label: 'Email',
+      config: {},
+      externalId: 'support@example.com',
+      enabled: true,
+    })
+    expect(hoisted.dispatchInboxChannelCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'service', displayName: 'inbox-channel-system' }),
+      expect.objectContaining({
+        id: 'channel_1',
+        inboxId: 'inbox_1',
+        kind: 'email',
+        label: 'Email',
+        externalId: 'support@example.com',
+        enabled: true,
+        archivedAt: null,
+      })
+    )
+  })
+
+  it('updates, no-ops, validates, and archives channels', async () => {
+    const existing = channel()
+    const updated = channel({ label: 'VIP email', config: { address: 'vip@example.com' } })
+    hoisted.findChannelMock.mockResolvedValueOnce(undefined)
+    await expect(updateInboxChannel('missing' as never, { label: 'Nope' })).rejects.toMatchObject({
+      code: 'CHANNEL_NOT_FOUND',
+    })
+
+    hoisted.findChannelMock.mockResolvedValueOnce(existing)
+    await expect(updateInboxChannel('channel_1' as never, {})).resolves.toBe(existing)
+    expect(hoisted.updateSetMock).not.toHaveBeenCalled()
+
+    hoisted.findChannelMock.mockResolvedValueOnce(existing)
+    await expect(updateInboxChannel('channel_1' as never, { label: '   ' })).rejects.toMatchObject({
+      code: 'CHANNEL_LABEL_REQUIRED',
+    })
+
+    hoisted.findChannelMock.mockResolvedValueOnce(existing)
+    hoisted.updateReturningMock.mockResolvedValueOnce([updated])
+    await expect(
+      updateInboxChannel('channel_1' as never, {
+        label: ' VIP email ',
+        config: { address: 'vip@example.com' },
+        externalId: null,
+        enabled: false,
+      })
+    ).resolves.toBe(updated)
+    expect(hoisted.updateSetMock).toHaveBeenCalledWith({
+      label: 'VIP email',
+      config: { address: 'vip@example.com' },
+      externalId: null,
+      enabled: false,
+    })
+    expect(hoisted.dispatchInboxChannelUpdatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ displayName: 'inbox-channel-system' }),
+      expect.objectContaining({ label: 'VIP email' }),
+      ['label', 'config', 'externalId', 'enabled']
+    )
+
+    const archived = channel({ archivedAt: new Date('2026-01-01T00:00:00.000Z') })
+    hoisted.findChannelMock.mockResolvedValueOnce(archived)
+    await expect(archiveInboxChannel('channel_1' as never)).resolves.toBe(archived)
+
+    hoisted.findChannelMock.mockResolvedValueOnce(existing)
+    hoisted.updateReturningMock.mockResolvedValueOnce([archived])
+    await expect(archiveInboxChannel('channel_1' as never)).resolves.toBe(archived)
+    expect(hoisted.updateSetMock).toHaveBeenLastCalledWith({
+      archivedAt: expect.any(Date),
+      enabled: false,
+    })
+    expect(hoisted.dispatchInboxChannelArchivedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ displayName: 'inbox-channel-system' }),
+      expect.objectContaining({ id: 'channel_1' })
+    )
+  })
+
+  it('looks up channels by active external id', async () => {
+    const row = channel({ externalId: 'support@example.com' })
+    hoisted.findChannelMock.mockResolvedValue(row)
+
+    await expect(
+      getInboxChannelByExternalId('email' as never, 'support@example.com')
+    ).resolves.toBe(row)
+
+    expect(hoisted.findChannelMock).toHaveBeenCalledWith({
+      where: expect.arrayContaining(['and']),
+    })
+  })
+})
+
+describe('inbox membership service', () => {
+  it('validates required membership input and returns existing memberships idempotently', async () => {
+    await expect(
+      addInboxMembership({ inboxId: '' as never, principalId: 'principal_1' as never })
+    ).rejects.toMatchObject({ code: 'INBOX_REQUIRED' })
+    await expect(
+      addInboxMembership({ inboxId: 'inbox_1' as never, principalId: '' as never })
+    ).rejects.toMatchObject({ code: 'PRINCIPAL_REQUIRED' })
+
+    const existing = membership({ role: 'owner' })
+    hoisted.findMembershipMock.mockResolvedValue(existing)
+    await expect(
+      addInboxMembership({ inboxId: 'inbox_1' as never, principalId: 'principal_1' as never })
+    ).resolves.toBe(existing)
+    expect(hoisted.insertValuesMock).not.toHaveBeenCalled()
+  })
+
+  it('creates, updates, no-ops, and removes memberships with dispatch snapshots', async () => {
+    const created = membership({ role: 'agent' })
+    hoisted.findMembershipMock.mockResolvedValueOnce(undefined)
+    hoisted.insertReturningMock.mockResolvedValueOnce([created])
+
+    await expect(
+      addInboxMembership({ inboxId: 'inbox_1' as never, principalId: 'principal_1' as never })
+    ).resolves.toBe(created)
+    expect(hoisted.insertValuesMock).toHaveBeenCalledWith({
+      inboxId: 'inbox_1',
+      principalId: 'principal_1',
+      role: 'agent',
+    })
+    expect(hoisted.dispatchInboxMembershipAddedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ displayName: 'inbox-membership-system' }),
+      expect.objectContaining({ id: 'membership_1', role: 'agent' })
+    )
+
+    hoisted.findMembershipMock.mockResolvedValueOnce(undefined)
+    await expect(
+      updateInboxMembershipRole('missing' as never, 'owner' as never)
+    ).rejects.toMatchObject({ code: 'INBOX_MEMBERSHIP_NOT_FOUND' })
+
+    hoisted.findMembershipMock.mockResolvedValueOnce(created)
+    await expect(
+      updateInboxMembershipRole('membership_1' as never, 'agent' as never)
+    ).resolves.toBe(created)
+
+    const updated = membership({ role: 'owner' })
+    hoisted.findMembershipMock.mockResolvedValueOnce(created)
+    hoisted.updateReturningMock.mockResolvedValueOnce([updated])
+    await expect(
+      updateInboxMembershipRole('membership_1' as never, 'owner' as never)
+    ).resolves.toBe(updated)
+    expect(hoisted.updateSetMock).toHaveBeenCalledWith({ role: 'owner' })
+    expect(hoisted.dispatchInboxMembershipUpdatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ displayName: 'inbox-membership-system' }),
+      expect.objectContaining({ role: 'owner' }),
+      'agent'
+    )
+
+    hoisted.findMembershipMock.mockResolvedValueOnce(updated)
+    await removeInboxMembership('membership_1' as never)
+    expect(hoisted.deleteWhereMock).toHaveBeenCalled()
+    expect(hoisted.dispatchInboxMembershipRemovedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ displayName: 'inbox-membership-system' }),
+      expect.objectContaining({ id: 'membership_1', role: 'owner' })
+    )
+
+    vi.clearAllMocks()
+    hoisted.deleteMock.mockReturnValue({
+      where: (...args: unknown[]) => hoisted.deleteWhereMock(...args),
+    })
+    hoisted.findMembershipMock.mockResolvedValueOnce(undefined)
+    await removeInboxMembership('missing' as never)
+    expect(hoisted.deleteWhereMock).toHaveBeenCalled()
+    expect(hoisted.dispatchInboxMembershipRemovedMock).not.toHaveBeenCalled()
+  })
+
+  it('lists memberships and joined inbox rows in stable order', async () => {
+    const rows = [membership()]
+    const inboxRows = [{ inbox: { id: 'inbox_1', name: 'Support' } }]
+    hoisted.selectOrderByMock.mockResolvedValue(rows)
+    hoisted.selectJoinOrderByMock.mockResolvedValue(inboxRows)
+
+    await expect(listMembershipsForInbox('inbox_1' as never)).resolves.toEqual(rows)
+    await expect(listInboxesForPrincipal('principal_1' as never)).resolves.toEqual(rows)
+    await expect(listInboxRowsForPrincipal('principal_1' as never)).resolves.toEqual([
+      { id: 'inbox_1', name: 'Support' },
+    ])
+
+    expect(hoisted.selectWhereMock).toHaveBeenCalledTimes(2)
+    expect(hoisted.selectInnerJoinMock).toHaveBeenCalled()
+    expect(hoisted.selectJoinWhereMock).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.channels.gap.test.ts b/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.channels.gap.test.ts
new file mode 100644
index 000000000..7b12a8bb3
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.channels.gap.test.ts
@@ -0,0 +1,103 @@
+/**
+ * Differential-coverage tests for inbox.channels residuals — listChannelsForInbox,
+ * the externalId duplicate guard in addInboxChannel, and the already-archived
+ * early return in archiveInboxChannel.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const h = vi.hoisted(() => ({
+  findFirst: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  selectRows: vi.fn(),
+  dispatch: vi.fn(() => Promise.resolve()),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: { inboxChannels: { findFirst: h.findFirst } },
+    insert: () => ({ values: () => ({ returning: () => h.insertReturning() }) }),
+    update: () => ({ set: () => ({ where: () => ({ returning: () => h.updateReturning() }) }) }),
+    select: () => ({ from: () => ({ where: () => ({ orderBy: () => h.selectRows() }) }) }),
+  },
+  eq: (...a: unknown[]) => ['eq', ...a],
+  and: (...a: unknown[]) => ['and', ...a],
+  isNull: (...a: unknown[]) => ['isNull', ...a],
+  asc: (...a: unknown[]) => ['asc', ...a],
+  inboxChannels: {
+    id: 'id',
+    inboxId: 'inboxId',
+    kind: 'kind',
+    externalId: 'externalId',
+    archivedAt: 'archivedAt',
+    createdAt: 'createdAt',
+  },
+}))
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchInboxChannelCreated: h.dispatch,
+  dispatchInboxChannelUpdated: h.dispatch,
+  dispatchInboxChannelArchived: h.dispatch,
+}))
+vi.mock('@/lib/shared/utils/date', () => ({
+  toIsoStringOrNull: (v: unknown) => (v ? 'iso' : null),
+}))
+
+import { addInboxChannel, archiveInboxChannel, listChannelsForInbox } from '../inbox.channels'
+import type { InboxId, InboxChannelId } from '@quackback/ids'
+
+const row = (over: Record<string, unknown> = {}) => ({
+  id: 'ch_1',
+  inboxId: 'inbox_1',
+  kind: 'email',
+  label: 'L',
+  config: {},
+  externalId: null,
+  enabled: true,
+  archivedAt: null,
+  ...over,
+})
+
+beforeEach(() => vi.clearAllMocks())
+
+describe('listChannelsForInbox', () => {
+  it('selects channels for the inbox ordered by creation', async () => {
+    h.selectRows.mockResolvedValueOnce([row(), row({ id: 'ch_2' })])
+    const res = await listChannelsForInbox('inbox_1' as InboxId)
+    expect(res).toHaveLength(2)
+  })
+})
+
+describe('addInboxChannel externalId guard', () => {
+  it('creates a channel with an externalId when there is no duplicate', async () => {
+    h.findFirst.mockResolvedValueOnce(undefined)
+    h.insertReturning.mockResolvedValueOnce([row({ externalId: 'ext-1' })])
+    const created = await addInboxChannel({
+      inboxId: 'inbox_1' as InboxId,
+      kind: 'email',
+      label: 'Support',
+      externalId: 'ext-1',
+    })
+    expect(created.externalId).toBe('ext-1')
+  })
+
+  it('rejects a duplicate externalId', async () => {
+    h.findFirst.mockResolvedValueOnce(row({ externalId: 'ext-1' }))
+    await expect(
+      addInboxChannel({
+        inboxId: 'inbox_1' as InboxId,
+        kind: 'email',
+        label: 'Support',
+        externalId: 'ext-1',
+      })
+    ).rejects.toThrow(/already exists/i)
+  })
+})
+
+describe('archiveInboxChannel', () => {
+  it('returns the existing channel unchanged when it is already archived', async () => {
+    h.findFirst.mockResolvedValueOnce(row({ archivedAt: new Date('2026-01-01') }))
+    const res = await archiveInboxChannel('ch_1' as InboxChannelId)
+    expect(res.id).toBe('ch_1')
+    expect(h.updateReturning).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.service.diffcov.test.ts b/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.service.diffcov.test.ts
new file mode 100644
index 000000000..a63f9741f
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.service.diffcov.test.ts
@@ -0,0 +1,240 @@
+/**
+ * Differential-coverage tests for inbox.service — create/update/archive/
+ * unarchive with their validation, no-op, and not-found branches, the
+ * event-dispatch actor (principal vs service) + failure swallow, and the
+ * listInboxes filter matrix.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  inboxesFindFirst: vi.fn(),
+  txInsertReturning: vi.fn(),
+  membershipValues: vi.fn(),
+  updateReturning: vi.fn(),
+  selectOffset: vi.fn(),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({
+    type: 'principal',
+    displayName: 'inbox-system',
+  })),
+  dispatchCreated: vi.fn(),
+  dispatchUpdated: vi.fn(),
+  dispatchArchived: vi.fn(),
+  dispatchUnarchived: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => {
+  const tx = {
+    insert: (_table: unknown) => ({
+      values: (v: unknown) => {
+        // membership insert is awaited (no returning); inbox insert uses returning
+        return {
+          returning: m.txInsertReturning,
+          then: (r: (x: unknown) => void) => r(m.membershipValues(v)),
+        }
+      },
+    }),
+  }
+  return {
+    db: {
+      query: { inboxes: { findFirst: m.inboxesFindFirst } },
+      transaction: async (cb: (t: typeof tx) => unknown) => cb(tx),
+      update: () => ({ set: () => ({ where: () => ({ returning: m.updateReturning }) }) }),
+      select: () => ({
+        from: () => ({
+          where: () => ({ orderBy: () => ({ limit: () => ({ offset: m.selectOffset }) }) }),
+        }),
+      }),
+    },
+    eq: vi.fn(),
+    and: vi.fn(),
+    isNull: vi.fn(),
+    ilike: vi.fn(),
+    or: vi.fn((...a) => ({ or: a })),
+    asc: vi.fn(),
+    inboxes: {
+      id: 'i.id',
+      slug: 'i.slug',
+      name: 'i.name',
+      primaryTeamId: 'i.primaryTeamId',
+      archivedAt: 'i.archivedAt',
+    },
+    inboxMemberships: {},
+  }
+})
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchInboxCreated: (...a: unknown[]) => m.dispatchCreated(...a),
+  dispatchInboxUpdated: (...a: unknown[]) => m.dispatchUpdated(...a),
+  dispatchInboxArchived: (...a: unknown[]) => m.dispatchArchived(...a),
+  dispatchInboxUnarchived: (...a: unknown[]) => m.dispatchUnarchived(...a),
+}))
+
+import {
+  createInbox,
+  updateInbox,
+  archiveInbox,
+  unarchiveInbox,
+  getInbox,
+  getInboxBySlug,
+  listInboxes,
+} from '../inbox.service'
+
+const actorP = { principalId: 'p1' as never, userId: 'u1' as never }
+const actorS = { principalId: null }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.inboxesFindFirst.mockResolvedValue(undefined)
+  m.txInsertReturning.mockResolvedValue([{ id: 'inbox_1', name: 'A' }])
+  m.membershipValues.mockReturnValue(undefined)
+  m.updateReturning.mockResolvedValue([{ id: 'inbox_1', name: 'A' }])
+  m.selectOffset.mockResolvedValue([{ id: 'inbox_1' }])
+  m.dispatchCreated.mockResolvedValue(undefined)
+  m.dispatchUpdated.mockResolvedValue(undefined)
+  m.dispatchArchived.mockResolvedValue(undefined)
+  m.dispatchUnarchived.mockResolvedValue(undefined)
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('createInbox', () => {
+  it('rejects an empty name', async () => {
+    await expect(createInbox({ name: '  ', slug: 'a' }, actorS)).rejects.toThrow('name is required')
+  })
+
+  it('rejects an over-long name', async () => {
+    await expect(createInbox({ name: 'x'.repeat(201), slug: 'a' }, actorS)).rejects.toThrow(
+      'exceeds'
+    )
+  })
+
+  it('rejects an empty/invalid/too-long slug', async () => {
+    await expect(createInbox({ name: 'n', slug: '' }, actorS)).rejects.toThrow('slug is required')
+    await expect(createInbox({ name: 'n', slug: 'Bad Slug!' }, actorS)).rejects.toThrow('lowercase')
+    await expect(createInbox({ name: 'n', slug: 'a'.repeat(101) }, actorS)).rejects.toThrow(
+      'exceeds'
+    )
+  })
+
+  it('rejects a duplicate slug', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'dup' })
+    await expect(createInbox({ name: 'n', slug: 'sales' }, actorS)).rejects.toThrow(
+      'already exists'
+    )
+  })
+
+  it('creates with an owner membership and a principal actor', async () => {
+    const res = await createInbox({ name: 'Sales', slug: 'sales' }, actorP)
+    expect(res).toEqual({ id: 'inbox_1', name: 'A' })
+    expect(m.membershipValues).toHaveBeenCalled()
+    expect(m.buildEventActor).toHaveBeenCalled()
+    expect(m.dispatchCreated).toHaveBeenCalled()
+  })
+
+  it('creates with a service actor (no membership) and swallows dispatch failure', async () => {
+    m.dispatchCreated.mockRejectedValueOnce(new Error('boom'))
+    await createInbox(
+      { name: 'Sales', slug: 'sales', description: 'd', primaryTeamId: 'team_1' as never },
+      actorS
+    )
+    expect(m.membershipValues).not.toHaveBeenCalled()
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
+
+describe('updateInbox', () => {
+  it('throws when the inbox is missing', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(updateInbox('inbox_x' as never, { name: 'n' }, actorS)).rejects.toThrow(
+      'not found'
+    )
+  })
+
+  it('validates the new name', async () => {
+    m.inboxesFindFirst.mockResolvedValue({ id: 'inbox_1' })
+    await expect(updateInbox('inbox_1' as never, { name: '  ' }, actorS)).rejects.toThrow(
+      'name is required'
+    )
+    await expect(
+      updateInbox('inbox_1' as never, { name: 'x'.repeat(201) }, actorS)
+    ).rejects.toThrow('exceeds')
+  })
+
+  it('returns existing unchanged when patch is empty', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_1', name: 'keep' })
+    const res = await updateInbox('inbox_1' as never, {}, actorS)
+    expect(res).toEqual({ id: 'inbox_1', name: 'keep' })
+    expect(m.updateReturning).not.toHaveBeenCalled()
+  })
+
+  it('applies all provided fields and dispatches updated', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_1' })
+    await updateInbox(
+      'inbox_1' as never,
+      {
+        name: 'New',
+        description: null,
+        primaryTeamId: null,
+        defaultVisibilityScope: 'workspace' as never,
+        defaultPriority: 'high' as never,
+        defaultStatusId: 'st_1' as never,
+        color: '#fff',
+        icon: 'x',
+      },
+      actorP
+    )
+    expect(m.dispatchUpdated).toHaveBeenCalled()
+  })
+})
+
+describe('archive / unarchive', () => {
+  it('archive: not found, already archived, and success', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(archiveInbox('x' as never, actorS)).rejects.toThrow('not found')
+
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_1', archivedAt: new Date() })
+    expect((await archiveInbox('inbox_1' as never, actorS)).id).toBe('inbox_1')
+
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_1', archivedAt: null })
+    await archiveInbox('inbox_1' as never, actorS)
+    expect(m.dispatchArchived).toHaveBeenCalled()
+  })
+
+  it('unarchive: not found, not archived, and success', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(unarchiveInbox('x' as never, actorS)).rejects.toThrow('not found')
+
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_1', archivedAt: null })
+    await unarchiveInbox('inbox_1' as never, actorS)
+    expect(m.dispatchUnarchived).not.toHaveBeenCalled()
+
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_1', archivedAt: new Date() })
+    await unarchiveInbox('inbox_1' as never, actorS)
+    expect(m.dispatchUnarchived).toHaveBeenCalled()
+  })
+})
+
+describe('getters + listInboxes', () => {
+  it('getInbox and getInboxBySlug query findFirst', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_1' })
+    expect(await getInbox('inbox_1' as never)).toEqual({ id: 'inbox_1' })
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_2' })
+    expect(await getInboxBySlug('Sales')).toEqual({ id: 'inbox_2' })
+  })
+
+  it('lists with all filters', async () => {
+    const res = await listInboxes({
+      includeArchived: true,
+      primaryTeamId: 'team_1' as never,
+      search: 'sup',
+      limit: 10,
+      offset: 5,
+    })
+    expect(res).toEqual([{ id: 'inbox_1' }])
+  })
+
+  it('lists with defaults (active only, no filters)', async () => {
+    const res = await listInboxes()
+    expect(res).toEqual([{ id: 'inbox_1' }])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.service.events.test.ts b/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.service.events.test.ts
new file mode 100644
index 000000000..81bb865b1
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/__tests__/inbox.service.events.test.ts
@@ -0,0 +1,231 @@
+/**
+ * Phase 6: webhook dispatch from inbox CRUD.
+ *
+ * Verifies that `createInbox`, `updateInbox`, `archiveInbox`, and
+ * `unarchiveInbox` fire the matching configuration-plane dispatchers, that
+ * `*.updated` carries the changed field list, that no-op updates skip the
+ * dispatch, and that a failing dispatcher is swallowed (warn-only) so the
+ * inbox write itself stays the source of truth.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const inboxFindFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+const insertInboxValuesMock = vi.fn()
+const insertMembershipValuesMock = vi.fn()
+const updateReturningMock = vi.fn()
+const insertMock = vi.fn()
+const transactionMock = vi.fn()
+
+const dispatchInboxCreatedMock = vi.fn()
+const dispatchInboxUpdatedMock = vi.fn()
+const dispatchInboxArchivedMock = vi.fn()
+const dispatchInboxUnarchivedMock = vi.fn()
+// Phase-6 housekeeping guard: archiving an inbox must NOT cascade per-ticket
+// dispatches. We register the ticket dispatchers here so we can assert they
+// stay untouched.
+const dispatchTicketUpdatedMock = vi.fn()
+const dispatchTicketStatusChangedMock = vi.fn()
+const buildEventActorMock = vi.fn((input: { principalId: string; userId?: string }) => ({
+  type: 'user' as const,
+  principalId: input.principalId,
+  userId: input.userId,
+  displayName: 'inbox-system',
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      inboxes: { findFirst: inboxFindFirstMock },
+    },
+    insert: insertMock,
+    transaction: transactionMock,
+    update: vi.fn(() => ({
+      set: vi.fn().mockReturnThis(),
+      where: vi.fn().mockReturnThis(),
+      returning: updateReturningMock,
+    })),
+    select: vi.fn(),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  ilike: vi.fn(),
+  or: vi.fn(),
+  asc: vi.fn(),
+  inboxes: { _name: 'inboxes', id: 'id', slug: 'slug', archivedAt: 'archivedAt' },
+  inboxMemberships: { _name: 'inboxMemberships' },
+}))
+
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E }
+})
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchInboxCreated: (...a: unknown[]) => dispatchInboxCreatedMock(...a),
+  dispatchInboxUpdated: (...a: unknown[]) => dispatchInboxUpdatedMock(...a),
+  dispatchInboxArchived: (...a: unknown[]) => dispatchInboxArchivedMock(...a),
+  dispatchInboxUnarchived: (...a: unknown[]) => dispatchInboxUnarchivedMock(...a),
+  dispatchTicketUpdated: (...a: unknown[]) => dispatchTicketUpdatedMock(...a),
+  dispatchTicketStatusChanged: (...a: unknown[]) => dispatchTicketStatusChangedMock(...a),
+  buildEventActor: (...a: unknown[]) =>
+    buildEventActorMock(...(a as [{ principalId: string; userId?: string }])),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  insertMock.mockImplementation((table) => {
+    const valuesMock =
+      table?._name === 'inboxMemberships' ? insertMembershipValuesMock : insertInboxValuesMock
+    return {
+      values: vi.fn((values) => {
+        valuesMock(values)
+        return { returning: insertReturningMock }
+      }),
+    }
+  })
+  transactionMock.mockImplementation((callback) => callback({ insert: insertMock }))
+})
+
+const ACTOR = { principalId: 'principal_a' as never, userId: 'user_a' as never }
+
+const SAMPLE_INBOX = {
+  id: 'inbox_1',
+  name: 'Support',
+  slug: 'support',
+  description: null,
+  primaryTeamId: null,
+  defaultVisibilityScope: 'team',
+  defaultPriority: 'normal',
+  defaultStatusId: null,
+  color: null,
+  icon: null,
+  archivedAt: null,
+  createdAt: new Date('2025-01-01T00:00:00Z'),
+  updatedAt: new Date('2025-01-01T00:00:00Z'),
+}
+
+describe('inbox.service events (Phase 6)', () => {
+  it('dispatches inbox.created on create', async () => {
+    inboxFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_INBOX])
+
+    const { createInbox } = await import('../inbox.service')
+    const result = await createInbox({ name: 'Support', slug: 'support' }, ACTOR)
+
+    expect(result).toEqual(SAMPLE_INBOX)
+    expect(insertMembershipValuesMock).toHaveBeenCalledTimes(1)
+    expect(insertMembershipValuesMock).toHaveBeenCalledWith({
+      inboxId: 'inbox_1',
+      principalId: 'principal_a',
+      role: 'owner',
+    })
+    expect(dispatchInboxCreatedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchInboxCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'user', principalId: 'principal_a' }),
+      SAMPLE_INBOX
+    )
+  })
+
+  it('skips inbox.updated when patch is empty', async () => {
+    inboxFindFirstMock.mockResolvedValue(SAMPLE_INBOX)
+
+    const { updateInbox } = await import('../inbox.service')
+    const result = await updateInbox('inbox_1' as never, {}, ACTOR)
+
+    expect(result).toEqual(SAMPLE_INBOX)
+    expect(dispatchInboxUpdatedMock).not.toHaveBeenCalled()
+  })
+
+  it('dispatches inbox.updated with changedFields', async () => {
+    inboxFindFirstMock.mockResolvedValue(SAMPLE_INBOX)
+    const updated = { ...SAMPLE_INBOX, name: 'Renamed' }
+    updateReturningMock.mockResolvedValue([updated])
+
+    const { updateInbox } = await import('../inbox.service')
+    await updateInbox('inbox_1' as never, { name: 'Renamed' }, ACTOR)
+
+    expect(dispatchInboxUpdatedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchInboxUpdatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'user' }),
+      updated,
+      ['name']
+    )
+  })
+
+  it('dispatches inbox.archived on archive', async () => {
+    inboxFindFirstMock.mockResolvedValue(SAMPLE_INBOX)
+    const archived = { ...SAMPLE_INBOX, archivedAt: new Date('2025-02-01') }
+    updateReturningMock.mockResolvedValue([archived])
+
+    const { archiveInbox } = await import('../inbox.service')
+    await archiveInbox('inbox_1' as never, ACTOR)
+
+    expect(dispatchInboxArchivedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchInboxArchivedMock).toHaveBeenCalledWith(expect.any(Object), archived)
+  })
+
+  // Phase-6 housekeeping: locks in the decision that archiveInbox fires only
+  // `inbox.archived` and never cascades per-ticket events. Subscribers wanting
+  // ticket-level awareness must subscribe to ticket.* events separately.
+  it('archiveInbox does NOT fire any ticket.* events', async () => {
+    inboxFindFirstMock.mockResolvedValue(SAMPLE_INBOX)
+    const archived = { ...SAMPLE_INBOX, archivedAt: new Date('2025-02-01') }
+    updateReturningMock.mockResolvedValue([archived])
+
+    const { archiveInbox } = await import('../inbox.service')
+    await archiveInbox('inbox_1' as never, ACTOR)
+
+    expect(dispatchInboxArchivedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchTicketUpdatedMock).not.toHaveBeenCalled()
+    expect(dispatchTicketStatusChangedMock).not.toHaveBeenCalled()
+  })
+
+  it('dispatches inbox.unarchived on unarchive', async () => {
+    const archivedInbox = { ...SAMPLE_INBOX, archivedAt: new Date('2025-02-01') }
+    inboxFindFirstMock.mockResolvedValue(archivedInbox)
+    const restored = { ...SAMPLE_INBOX, archivedAt: null }
+    updateReturningMock.mockResolvedValue([restored])
+
+    const { unarchiveInbox } = await import('../inbox.service')
+    await unarchiveInbox('inbox_1' as never, ACTOR)
+
+    expect(dispatchInboxUnarchivedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchInboxUnarchivedMock).toHaveBeenCalledWith(expect.any(Object), restored)
+  })
+
+  it('uses service actor when principalId is null', async () => {
+    inboxFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_INBOX])
+
+    const { createInbox } = await import('../inbox.service')
+    await createInbox({ name: 'Support', slug: 'support' }, { principalId: null })
+
+    expect(insertMembershipValuesMock).not.toHaveBeenCalled()
+    expect(dispatchInboxCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'service', displayName: 'inbox-system' }),
+      SAMPLE_INBOX
+    )
+  })
+
+  it('swallows dispatcher errors (write is source of truth)', async () => {
+    inboxFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_INBOX])
+    dispatchInboxCreatedMock.mockRejectedValueOnce(new Error('hook boom'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const { createInbox } = await import('../inbox.service')
+    const result = await createInbox({ name: 'Support', slug: 'support' }, ACTOR)
+
+    expect(result).toEqual(SAMPLE_INBOX)
+    expect(warnSpy).toHaveBeenCalled()
+    warnSpy.mockRestore()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/inboxes/__tests__/routing.engine.diffcov.test.ts b/apps/web/src/lib/server/domains/inboxes/__tests__/routing.engine.diffcov.test.ts
new file mode 100644
index 000000000..eb566686e
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/__tests__/routing.engine.diffcov.test.ts
@@ -0,0 +1,248 @@
+/**
+ * Differential-coverage tests for routing.engine — the pure evaluator
+ * (field extraction, every operator, all/any match, every action type) and the
+ * db-aware route() fallback chain (matched rule, candidate inbox, default
+ * inbox, derived primary team). Real zod schemas; only db is stubbed.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({ selectOrderBy: vi.fn(), inboxesFindFirst: vi.fn() }))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: () => ({ from: () => ({ where: () => ({ orderBy: () => m.selectOrderBy() }) }) }),
+    query: { inboxes: { findFirst: m.inboxesFindFirst } },
+  },
+  eq: vi.fn(),
+  asc: vi.fn(),
+  isNull: vi.fn(),
+  inboxes: { id: 'i.id', archivedAt: 'i.archivedAt', createdAt: 'i.createdAt' },
+  routingRules: { enabled: 'rr.enabled', priority: 'rr.priority', createdAt: 'rr.createdAt' },
+  // Constants the routing.types zod schema enumerates.
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  TICKET_VISIBILITY_SCOPES: ['team', 'workspace', 'private'],
+  INBOX_CHANNEL_KINDS: ['support', 'email', 'chat', 'api', 'contact_form'],
+}))
+
+import { evalRuleSet, applyActions, evaluateRules, route } from '../routing.engine'
+import type { RoutingInput } from '../routing.types'
+
+const input: RoutingInput = {
+  subject: 'Login broken',
+  descriptionText: 'cannot log in',
+  channel: 'email' as never,
+  priority: 'high' as never,
+  organizationDomain: 'acme.com',
+  requesterEmail: 'a@acme.com',
+  inboxChannelKind: 'support' as never,
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.selectOrderBy.mockResolvedValue([])
+  m.inboxesFindFirst.mockResolvedValue(undefined)
+})
+
+describe('evalRuleSet', () => {
+  it('is false for an empty condition set', () => {
+    expect(evalRuleSet(input, { match: 'all', conditions: [] } as never)).toBe(false)
+  })
+  it("match='all' requires every condition", () => {
+    expect(
+      evalRuleSet(input, {
+        match: 'all',
+        conditions: [
+          { field: 'subject', op: 'contains', value: 'login' },
+          { field: 'channel', op: 'eq', value: 'EMAIL' },
+        ],
+      } as never)
+    ).toBe(true)
+    expect(
+      evalRuleSet(input, {
+        match: 'all',
+        conditions: [{ field: 'subject', op: 'eq', value: 'nope' }],
+      } as never)
+    ).toBe(false)
+  })
+  it("match='any' requires one condition and covers all operators/fields", () => {
+    expect(
+      evalRuleSet(input, {
+        match: 'any',
+        conditions: [
+          { field: 'descriptionText', op: 'matches', value: 'log\\s?in' },
+          { field: 'priority', op: 'in', value: ['low', 'high'] },
+          { field: 'organizationDomain', op: 'eq', value: 'acme.com' },
+          { field: 'requesterEmail', op: 'contains', value: 'acme' },
+          { field: 'inboxChannelKind', op: 'eq', value: 'support' },
+        ],
+      } as never)
+    ).toBe(true)
+  })
+  it('handles null field values, bad regex, non-string/array values, and unknown ops', () => {
+    const empty = {} as never
+    expect(
+      evalRuleSet(empty, {
+        match: 'any',
+        conditions: [
+          { field: 'subject', op: 'eq', value: 'x' }, // actual null -> false
+          { field: 'subject', op: 'matches', value: '(' }, // (set actual via other input below)
+        ],
+      } as never)
+    ).toBe(false)
+    // bad regex + non-string + non-array + unknown op, all -> false
+    expect(
+      evalRuleSet(input, {
+        match: 'all',
+        conditions: [
+          { field: 'subject', op: 'matches', value: '(' }, // invalid regex -> false
+        ],
+      } as never)
+    ).toBe(false)
+    expect(
+      evalRuleSet(input, {
+        match: 'all',
+        conditions: [
+          { field: 'subject', op: 'eq', value: 123 }, // non-string -> false
+        ],
+      } as never)
+    ).toBe(false)
+    expect(
+      evalRuleSet(input, {
+        match: 'all',
+        conditions: [
+          { field: 'subject', op: 'in', value: 'x' }, // non-array -> false
+        ],
+      } as never)
+    ).toBe(false)
+    expect(
+      evalRuleSet(input, {
+        match: 'all',
+        conditions: [
+          { field: 'subject', op: 'weird' }, // unknown op -> false
+        ],
+      } as never)
+    ).toBe(false)
+    expect(
+      evalRuleSet(input, {
+        match: 'all',
+        conditions: [
+          { field: 'unknownField', op: 'eq', value: 'x' }, // unknown field -> null -> false
+        ],
+      } as never)
+    ).toBe(false)
+  })
+})
+
+describe('applyActions', () => {
+  it('applies every action type', () => {
+    const decision = applyActions(
+      [
+        { type: 'assignToInbox', value: 'inbox_1' },
+        { type: 'assignToTeam', value: 'team_1' },
+        { type: 'assignToPrincipal', value: 'p_1' },
+        { type: 'setPriority', value: 'urgent' },
+        { type: 'setVisibility', value: 'team' },
+        { type: 'addParticipant', value: 'p_2' },
+        { type: 'addParticipant', value: 'p_3' },
+        { type: 'unknown' } as never,
+      ] as never,
+      'rule_1'
+    )
+    expect(decision).toMatchObject({
+      matchedRuleId: 'rule_1',
+      inboxId: 'inbox_1',
+      primaryTeamId: 'team_1',
+      assigneeTeamId: 'team_1',
+      assigneePrincipalId: 'p_1',
+      priority: 'urgent',
+      visibilityScope: 'team',
+      addParticipants: ['p_2', 'p_3'],
+    })
+  })
+})
+
+describe('evaluateRules', () => {
+  const rule = (over: Record<string, unknown> = {}) => ({
+    id: 'rule_1',
+    enabled: true,
+    conditions: {
+      match: 'all',
+      conditions: [{ field: 'subject', op: 'contains', value: 'login' }],
+    },
+    actions: [{ type: 'assignToInbox', value: 'inbox_1' }],
+    ...over,
+  })
+  it('skips disabled and malformed rules, returns the first match', () => {
+    const res = evaluateRules(
+      [
+        rule({ enabled: false }),
+        rule({ id: 'bad_conditions', conditions: { nope: true } }),
+        rule({ id: 'bad_actions', actions: 'not-an-array' }),
+        rule({
+          id: 'match',
+          conditions: {
+            match: 'all',
+            conditions: [{ field: 'subject', op: 'eq', value: 'Login broken' }],
+          },
+        }),
+      ] as never,
+      input
+    )
+    expect(res).toMatchObject({ matchedRuleId: 'match', inboxId: 'inbox_1' })
+  })
+  it('returns null when nothing matches', () => {
+    expect(
+      evaluateRules(
+        [
+          rule({
+            conditions: {
+              match: 'all',
+              conditions: [{ field: 'subject', op: 'eq', value: 'zzz' }],
+            },
+          }),
+        ] as never,
+        input
+      )
+    ).toBeNull()
+  })
+})
+
+describe('route', () => {
+  it('uses a matching rule (inbox + team) without fallback', async () => {
+    m.selectOrderBy.mockResolvedValueOnce([
+      {
+        id: 'rule_1',
+        enabled: true,
+        conditions: {
+          match: 'all',
+          conditions: [{ field: 'subject', op: 'contains', value: 'login' }],
+        },
+        actions: [
+          { type: 'assignToInbox', value: 'inbox_1' },
+          { type: 'assignToTeam', value: 'team_1' },
+        ],
+      },
+    ])
+    const d = await route(input)
+    expect(d).toMatchObject({ inboxId: 'inbox_1', primaryTeamId: 'team_1' })
+    expect(m.inboxesFindFirst).not.toHaveBeenCalled()
+  })
+  it('falls back to the candidate inbox and derives the team', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce({ id: 'inbox_c', primaryTeamId: 'team_c' }) // derive
+    const d = await route({ ...input, subject: 'no match', candidateInboxId: 'inbox_c' } as never)
+    expect(d.inboxId).toBe('inbox_c')
+    expect(d.primaryTeamId).toBe('team_c')
+  })
+  it('falls back to the first active inbox', async () => {
+    m.inboxesFindFirst
+      .mockResolvedValueOnce({ id: 'inbox_default', primaryTeamId: null }) // fallback
+      .mockResolvedValueOnce({ id: 'inbox_default', primaryTeamId: null }) // derive (no team)
+    const d = await route({ ...input, subject: 'no match' } as never)
+    expect(d.inboxId).toBe('inbox_default')
+  })
+  it('leaves inbox undefined when there is no fallback', async () => {
+    m.inboxesFindFirst.mockResolvedValueOnce(undefined) // no fallback inbox
+    const d = await route({ ...input, subject: 'no match' } as never)
+    expect(d.inboxId).toBeUndefined()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/inboxes/__tests__/routing.engine.test.ts b/apps/web/src/lib/server/domains/inboxes/__tests__/routing.engine.test.ts
new file mode 100644
index 000000000..28cdd4c68
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/__tests__/routing.engine.test.ts
@@ -0,0 +1,254 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  selectMock: vi.fn(),
+  selectFromMock: vi.fn(),
+  selectWhereMock: vi.fn(),
+  selectOrderByMock: vi.fn(),
+  findInboxMock: vi.fn(),
+  eqMock: vi.fn(),
+  ascMock: vi.fn(),
+  isNullMock: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: (...args: unknown[]) => hoisted.selectMock(...args),
+    query: {
+      inboxes: { findFirst: (...args: unknown[]) => hoisted.findInboxMock(...args) },
+    },
+  },
+  eq: (...args: unknown[]) => hoisted.eqMock(...args),
+  asc: (...args: unknown[]) => hoisted.ascMock(...args),
+  isNull: (...args: unknown[]) => hoisted.isNullMock(...args),
+  inboxes: {
+    id: 'inboxes.id',
+    archivedAt: 'inboxes.archivedAt',
+    createdAt: 'inboxes.createdAt',
+  },
+  routingRules: {
+    id: 'routingRules.id',
+    enabled: 'routingRules.enabled',
+    priority: 'routingRules.priority',
+    createdAt: 'routingRules.createdAt',
+  },
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  TICKET_VISIBILITY_SCOPES: ['workspace', 'team', 'private'],
+  INBOX_CHANNEL_KINDS: ['email', 'widget', 'api'],
+}))
+
+const { applyActions, evalRuleSet, evaluateRules, route } = await import('../routing.engine')
+
+function rule(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'rule_1',
+    name: 'Rule',
+    enabled: true,
+    priority: 10,
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    conditions: {
+      match: 'all',
+      conditions: [{ field: 'subject', op: 'contains', value: 'urgent' }],
+    },
+    actions: [{ type: 'assignToInbox', value: 'inbox_urgent' }],
+    ...overrides,
+  }
+}
+
+const input = {
+  subject: 'Urgent billing problem',
+  descriptionText: 'The invoice failed twice',
+  channel: 'email' as const,
+  priority: 'high',
+  organizationDomain: 'example.com',
+  requesterEmail: 'owner@example.com',
+  inboxChannelKind: 'email' as const,
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  hoisted.eqMock.mockImplementation((left: unknown, right: unknown) => ['eq', left, right])
+  hoisted.ascMock.mockImplementation((value: unknown) => ['asc', value])
+  hoisted.isNullMock.mockImplementation((value: unknown) => ['isNull', value])
+  hoisted.selectMock.mockReturnValue({
+    from: (table: unknown) => {
+      hoisted.selectFromMock(table)
+      return {
+        where: (condition: unknown) => {
+          hoisted.selectWhereMock(condition)
+          return { orderBy: (...args: unknown[]) => hoisted.selectOrderByMock(...args) }
+        },
+      }
+    },
+  })
+})
+
+describe('routing engine evaluator', () => {
+  it('evaluates all supported condition operators case-insensitively', () => {
+    expect(
+      evalRuleSet(input, {
+        match: 'all',
+        conditions: [
+          { field: 'subject', op: 'contains', value: 'URGENT' },
+          { field: 'channel', op: 'eq', value: 'EMAIL' },
+          { field: 'requesterEmail', op: 'matches', value: '^owner@' },
+          { field: 'priority', op: 'in', value: ['low', 'HIGH'] },
+          { field: 'inboxChannelKind', op: 'eq', value: 'Email' },
+        ],
+      })
+    ).toBe(true)
+  })
+
+  it('returns false for missing fields, empty sets, invalid regex, and non-string payloads', () => {
+    expect(evalRuleSet(input, { match: 'all', conditions: [] })).toBe(false)
+    expect(
+      evalRuleSet(
+        { ...input, organizationDomain: null },
+        { match: 'all', conditions: [{ field: 'organizationDomain', op: 'eq', value: 'example' }] }
+      )
+    ).toBe(false)
+    expect(
+      evalRuleSet(input, {
+        match: 'any',
+        conditions: [
+          { field: 'subject', op: 'matches', value: '[' },
+          { field: 'priority', op: 'in', value: 'high' },
+          { field: 'channel', op: 'eq', value: ['email'] },
+        ],
+      })
+    ).toBe(false)
+  })
+
+  it('applies every action kind into a single routing decision', () => {
+    expect(
+      applyActions(
+        [
+          { type: 'assignToInbox', value: 'inbox_1' },
+          { type: 'assignToTeam', value: 'team_1' },
+          { type: 'assignToPrincipal', value: 'principal_1' },
+          { type: 'setPriority', value: 'urgent' },
+          { type: 'setVisibility', value: 'team' },
+          { type: 'addParticipant', value: 'principal_a' },
+          { type: 'addParticipant', value: 'principal_b' },
+        ],
+        'rule_1'
+      )
+    ).toEqual({
+      matchedRuleId: 'rule_1',
+      inboxId: 'inbox_1',
+      primaryTeamId: 'team_1',
+      assigneeTeamId: 'team_1',
+      assigneePrincipalId: 'principal_1',
+      priority: 'urgent',
+      visibilityScope: 'team',
+      addParticipants: ['principal_a', 'principal_b'],
+    })
+  })
+
+  it('returns the first enabled rule with valid conditions and actions', () => {
+    const decision = evaluateRules(
+      [
+        rule({ id: 'disabled', enabled: false }),
+        rule({ id: 'bad_conditions', conditions: { match: 'all', conditions: [] } }),
+        rule({ id: 'bad_actions', actions: [] }),
+        rule({
+          id: 'rule_matching',
+          actions: [
+            { type: 'assignToInbox', value: 'inbox_2' },
+            { type: 'setPriority', value: 'urgent' },
+          ],
+        }),
+        rule({ id: 'rule_later', actions: [{ type: 'assignToInbox', value: 'inbox_3' }] }),
+      ] as never,
+      input
+    )
+
+    expect(decision).toEqual({
+      matchedRuleId: 'rule_matching',
+      inboxId: 'inbox_2',
+      priority: 'urgent',
+    })
+  })
+
+  it('returns null when no enabled valid rule matches', () => {
+    expect(
+      evaluateRules(
+        [
+          rule({
+            conditions: {
+              match: 'all',
+              conditions: [{ field: 'subject', op: 'contains', value: 'refund-only' }],
+            },
+          }),
+        ] as never,
+        input
+      )
+    ).toBeNull()
+  })
+})
+
+describe('routing engine route helper', () => {
+  it('loads enabled rules, evaluates a match, and derives the inbox primary team', async () => {
+    hoisted.selectOrderByMock.mockResolvedValue([
+      rule({
+        id: 'rule_urgent',
+        actions: [{ type: 'assignToInbox', value: 'inbox_urgent' }],
+      }),
+    ])
+    hoisted.findInboxMock.mockResolvedValue({ id: 'inbox_urgent', primaryTeamId: 'team_support' })
+
+    await expect(route(input)).resolves.toEqual({
+      matchedRuleId: 'rule_urgent',
+      inboxId: 'inbox_urgent',
+      primaryTeamId: 'team_support',
+    })
+
+    expect(hoisted.selectWhereMock).toHaveBeenCalledWith(['eq', 'routingRules.enabled', true])
+    expect(hoisted.findInboxMock).toHaveBeenCalledWith({
+      where: ['eq', 'inboxes.id', 'inbox_urgent'],
+    })
+  })
+
+  it('falls back to candidate inbox and preserves explicit team actions', async () => {
+    hoisted.selectOrderByMock.mockResolvedValue([])
+
+    await expect(
+      route({
+        ...input,
+        candidateInboxId: 'inbox_candidate',
+      })
+    ).resolves.toEqual({ matchedRuleId: null, inboxId: 'inbox_candidate' })
+    expect(hoisted.findInboxMock).toHaveBeenCalledWith({
+      where: ['eq', 'inboxes.id', 'inbox_candidate'],
+    })
+
+    hoisted.selectOrderByMock.mockResolvedValueOnce([
+      rule({
+        actions: [
+          { type: 'assignToInbox', value: 'inbox_rule' },
+          { type: 'assignToTeam', value: 'team_rule' },
+        ],
+      }),
+    ])
+    await expect(route(input)).resolves.toMatchObject({
+      inboxId: 'inbox_rule',
+      primaryTeamId: 'team_rule',
+      assigneeTeamId: 'team_rule',
+    })
+  })
+
+  it('falls back to the first active inbox when no rule or candidate chooses one', async () => {
+    hoisted.selectOrderByMock.mockResolvedValue([])
+    hoisted.findInboxMock.mockResolvedValueOnce({ id: 'inbox_default', primaryTeamId: null })
+
+    await expect(route(input)).resolves.toEqual({
+      matchedRuleId: null,
+      inboxId: 'inbox_default',
+    })
+
+    expect(hoisted.findInboxMock).toHaveBeenCalledWith({
+      where: ['isNull', 'inboxes.archivedAt'],
+      orderBy: ['asc', 'inboxes.createdAt'],
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/inboxes/__tests__/routing.service.test.ts b/apps/web/src/lib/server/domains/inboxes/__tests__/routing.service.test.ts
new file mode 100644
index 000000000..514d83d03
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/__tests__/routing.service.test.ts
@@ -0,0 +1,320 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  findRoutingRuleMock: vi.fn(),
+  insertValuesMock: vi.fn(),
+  insertReturningMock: vi.fn(),
+  updateSetMock: vi.fn(),
+  updateWhereMock: vi.fn(),
+  updateReturningMock: vi.fn(),
+  deleteWhereMock: vi.fn(),
+  selectFromMock: vi.fn(),
+  selectWhereMock: vi.fn(),
+  selectOrderByMock: vi.fn(),
+  insertMock: vi.fn(),
+  updateMock: vi.fn(),
+  deleteMock: vi.fn(),
+  selectMock: vi.fn(),
+  eqMock: vi.fn(),
+  andMock: vi.fn(),
+  ascMock: vi.fn(),
+  sqlMock: vi.fn(),
+  dispatchRoutingRuleCreatedMock: vi.fn(),
+  dispatchRoutingRuleUpdatedMock: vi.fn(),
+  dispatchRoutingRuleDeletedMock: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      routingRules: { findFirst: (...args: unknown[]) => hoisted.findRoutingRuleMock(...args) },
+    },
+    insert: (...args: unknown[]) => hoisted.insertMock(...args),
+    update: (...args: unknown[]) => hoisted.updateMock(...args),
+    delete: (...args: unknown[]) => hoisted.deleteMock(...args),
+    select: (...args: unknown[]) => hoisted.selectMock(...args),
+  },
+  eq: (...args: unknown[]) => hoisted.eqMock(...args),
+  and: (...args: unknown[]) => hoisted.andMock(...args),
+  asc: (...args: unknown[]) => hoisted.ascMock(...args),
+  sql: (...args: unknown[]) => hoisted.sqlMock(...args),
+  routingRules: {
+    id: 'routingRules.id',
+    name: 'routingRules.name',
+    enabled: 'routingRules.enabled',
+    priority: 'routingRules.priority',
+    createdAt: 'routingRules.createdAt',
+    inboxIdScope: 'routingRules.inboxIdScope',
+    matchCount: 'routingRules.matchCount',
+  },
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  TICKET_VISIBILITY_SCOPES: ['workspace', 'team', 'private'],
+  INBOX_CHANNEL_KINDS: ['email', 'widget', 'api'],
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchRoutingRuleCreated: (...args: unknown[]) =>
+    hoisted.dispatchRoutingRuleCreatedMock(...args),
+  dispatchRoutingRuleUpdated: (...args: unknown[]) =>
+    hoisted.dispatchRoutingRuleUpdatedMock(...args),
+  dispatchRoutingRuleDeleted: (...args: unknown[]) =>
+    hoisted.dispatchRoutingRuleDeletedMock(...args),
+}))
+
+const {
+  createRoutingRule,
+  updateRoutingRule,
+  deleteRoutingRule,
+  getRoutingRule,
+  listRoutingRules,
+  reorderRoutingRules,
+  bumpMatchStats,
+} = await import('../routing.service')
+
+function conditions() {
+  return {
+    match: 'all' as const,
+    conditions: [{ field: 'subject' as const, op: 'contains' as const, value: 'urgent' }],
+  }
+}
+
+function actions() {
+  return [{ type: 'assignToInbox', value: 'inbox_urgent' }]
+}
+
+function rule(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'rule_1',
+    name: 'Urgent',
+    description: null,
+    priority: 10,
+    enabled: true,
+    conditions: conditions(),
+    actions: actions(),
+    inboxIdScope: null,
+    matchCount: 0,
+    lastMatchedAt: null,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  hoisted.eqMock.mockImplementation((left: unknown, right: unknown) => ['eq', left, right])
+  hoisted.andMock.mockImplementation((...parts: unknown[]) => ['and', ...parts])
+  hoisted.ascMock.mockImplementation((value: unknown) => ['asc', value])
+  hoisted.sqlMock.mockImplementation((strings: unknown, ...values: unknown[]) => [
+    'sql',
+    strings,
+    ...values,
+  ])
+  hoisted.insertMock.mockReturnValue({
+    values: (values: unknown) => {
+      hoisted.insertValuesMock(values)
+      return { returning: hoisted.insertReturningMock }
+    },
+  })
+  hoisted.updateMock.mockReturnValue({
+    set: (patch: unknown) => {
+      hoisted.updateSetMock(patch)
+      return {
+        where: (condition: unknown) => {
+          hoisted.updateWhereMock(condition)
+          return { returning: hoisted.updateReturningMock }
+        },
+      }
+    },
+  })
+  hoisted.deleteMock.mockReturnValue({
+    where: (...args: unknown[]) => hoisted.deleteWhereMock(...args),
+  })
+  hoisted.selectMock.mockReturnValue({
+    from: (table: unknown) => {
+      hoisted.selectFromMock(table)
+      return {
+        where: (condition: unknown) => {
+          hoisted.selectWhereMock(condition)
+          return { orderBy: (...args: unknown[]) => hoisted.selectOrderByMock(...args) }
+        },
+      }
+    },
+  })
+  hoisted.dispatchRoutingRuleCreatedMock.mockResolvedValue(undefined)
+  hoisted.dispatchRoutingRuleUpdatedMock.mockResolvedValue(undefined)
+  hoisted.dispatchRoutingRuleDeletedMock.mockResolvedValue(undefined)
+})
+
+describe('routing rule service', () => {
+  it('creates a routing rule with defaults, trimmed name, optional scope, and dispatch', async () => {
+    const created = rule({ name: 'Urgent tickets', priority: 100, inboxIdScope: 'inbox_1' })
+    hoisted.insertReturningMock.mockResolvedValue([created])
+
+    await expect(
+      createRoutingRule({
+        name: '  Urgent tickets  ',
+        conditions: conditions(),
+        actions: actions() as never,
+        inboxIdScope: 'inbox_1' as never,
+      })
+    ).resolves.toBe(created)
+
+    expect(hoisted.insertValuesMock).toHaveBeenCalledWith({
+      name: 'Urgent tickets',
+      description: null,
+      priority: 100,
+      enabled: true,
+      conditions: conditions(),
+      actions: actions(),
+      inboxIdScope: 'inbox_1',
+    })
+    expect(hoisted.dispatchRoutingRuleCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'service', displayName: 'routing-system' }),
+      expect.objectContaining({
+        id: 'rule_1',
+        name: 'Urgent tickets',
+        enabled: true,
+        priority: 100,
+        inboxIdScope: 'inbox_1',
+      })
+    )
+  })
+
+  it('rejects invalid create and update payloads before writing', async () => {
+    await expect(
+      createRoutingRule({ name: ' ', conditions: conditions(), actions: actions() as never })
+    ).rejects.toMatchObject({ code: 'ROUTING_NAME_REQUIRED' })
+    await expect(
+      createRoutingRule({
+        name: 'Rule',
+        conditions: { match: 'all', conditions: [] } as never,
+        actions: actions() as never,
+      })
+    ).rejects.toMatchObject({ code: 'ROUTING_CONDITIONS_INVALID' })
+    await expect(
+      createRoutingRule({ name: 'Rule', conditions: conditions(), actions: [] as never })
+    ).rejects.toMatchObject({ code: 'ROUTING_ACTIONS_INVALID' })
+
+    hoisted.findRoutingRuleMock.mockResolvedValueOnce(rule())
+    await expect(updateRoutingRule('rule_1' as never, { name: ' ' })).rejects.toMatchObject({
+      code: 'ROUTING_NAME_REQUIRED',
+    })
+    expect(hoisted.insertValuesMock).not.toHaveBeenCalled()
+  })
+
+  it('updates routing rules, validates condition/action combinations, and dispatches changed fields', async () => {
+    const existing = rule({ actions: [{ type: 'assignToInbox', value: 'inbox_old' }] })
+    const updated = rule({
+      name: 'Escalations',
+      priority: 5,
+      enabled: false,
+      description: 'Only escalations',
+      actions: [{ type: 'assignToTeam', value: 'team_escalations' }],
+      inboxIdScope: 'inbox_1',
+    })
+    hoisted.findRoutingRuleMock.mockResolvedValueOnce(undefined)
+    await expect(updateRoutingRule('missing' as never, { name: 'Nope' })).rejects.toMatchObject({
+      code: 'ROUTING_RULE_NOT_FOUND',
+    })
+
+    hoisted.findRoutingRuleMock.mockResolvedValueOnce(existing)
+    await expect(updateRoutingRule('rule_1' as never, {})).resolves.toBe(existing)
+    expect(hoisted.updateSetMock).not.toHaveBeenCalled()
+
+    hoisted.findRoutingRuleMock.mockResolvedValueOnce(existing)
+    hoisted.updateReturningMock.mockResolvedValueOnce([updated])
+    await expect(
+      updateRoutingRule('rule_1' as never, {
+        name: ' Escalations ',
+        description: 'Only escalations',
+        priority: 5,
+        enabled: false,
+        conditions: {
+          match: 'any',
+          conditions: [{ field: 'descriptionText', op: 'contains', value: 'escalated' }],
+        },
+        actions: [{ type: 'assignToTeam', value: 'team_escalations' }] as never,
+        inboxIdScope: 'inbox_1' as never,
+      })
+    ).resolves.toBe(updated)
+
+    expect(hoisted.updateSetMock).toHaveBeenCalledWith({
+      name: 'Escalations',
+      description: 'Only escalations',
+      priority: 5,
+      enabled: false,
+      conditions: {
+        match: 'any',
+        conditions: [{ field: 'descriptionText', op: 'contains', value: 'escalated' }],
+      },
+      actions: [{ type: 'assignToTeam', value: 'team_escalations' }],
+      inboxIdScope: 'inbox_1',
+    })
+    expect(hoisted.dispatchRoutingRuleUpdatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ displayName: 'routing-system' }),
+      expect.objectContaining({ id: 'rule_1', name: 'Escalations' }),
+      ['name', 'description', 'priority', 'enabled', 'conditions', 'actions', 'inboxIdScope']
+    )
+
+    hoisted.findRoutingRuleMock.mockResolvedValueOnce(existing)
+    await expect(
+      updateRoutingRule('rule_1' as never, {
+        actions: [] as never,
+      })
+    ).rejects.toMatchObject({ code: 'ROUTING_ACTIONS_INVALID' })
+  })
+
+  it('deletes existing rules with dispatch and missing rules without dispatch', async () => {
+    const existing = rule()
+    hoisted.findRoutingRuleMock.mockResolvedValueOnce(existing)
+    await deleteRoutingRule('rule_1' as never)
+    expect(hoisted.deleteWhereMock).toHaveBeenCalledWith(['eq', 'routingRules.id', 'rule_1'])
+    expect(hoisted.dispatchRoutingRuleDeletedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ displayName: 'routing-system' }),
+      expect.objectContaining({ id: 'rule_1' })
+    )
+
+    vi.clearAllMocks()
+    hoisted.findRoutingRuleMock.mockResolvedValueOnce(undefined)
+    await deleteRoutingRule('missing' as never)
+    expect(hoisted.deleteWhereMock).toHaveBeenCalledWith(['eq', 'routingRules.id', 'missing'])
+    expect(hoisted.dispatchRoutingRuleDeletedMock).not.toHaveBeenCalled()
+  })
+
+  it('gets and lists routing rules with optional enabled and scope filters', async () => {
+    const rows = [rule()]
+    hoisted.findRoutingRuleMock.mockResolvedValue(rows[0])
+    hoisted.selectOrderByMock.mockResolvedValue(rows)
+
+    await expect(getRoutingRule('rule_1' as never)).resolves.toBe(rows[0])
+    await expect(listRoutingRules()).resolves.toEqual(rows)
+    expect(hoisted.selectWhereMock).toHaveBeenLastCalledWith(undefined)
+
+    await expect(
+      listRoutingRules({ enabledOnly: true, inboxIdScope: 'workspace' })
+    ).resolves.toEqual(rows)
+    expect(hoisted.selectWhereMock).toHaveBeenLastCalledWith(expect.arrayContaining(['and']))
+    expect(hoisted.sqlMock).toHaveBeenCalled()
+
+    await expect(listRoutingRules({ inboxIdScope: 'inbox_1' as never })).resolves.toEqual(rows)
+    expect(hoisted.selectWhereMock).toHaveBeenLastCalledWith([
+      'and',
+      ['eq', 'routingRules.inboxIdScope', 'inbox_1'],
+    ])
+  })
+
+  it('reorders rules and bumps match stats', async () => {
+    await reorderRoutingRules(['rule_a', 'rule_b', 'rule_c'] as never)
+
+    expect(hoisted.updateSetMock).toHaveBeenNthCalledWith(1, { priority: 10 })
+    expect(hoisted.updateSetMock).toHaveBeenNthCalledWith(2, { priority: 20 })
+    expect(hoisted.updateSetMock).toHaveBeenNthCalledWith(3, { priority: 30 })
+    expect(hoisted.updateWhereMock).toHaveBeenNthCalledWith(3, ['eq', 'routingRules.id', 'rule_c'])
+
+    await bumpMatchStats('rule_1' as never)
+    expect(hoisted.updateSetMock).toHaveBeenLastCalledWith({
+      matchCount: expect.arrayContaining(['sql']),
+      lastMatchedAt: expect.any(Date),
+    })
+    expect(hoisted.updateWhereMock).toHaveBeenLastCalledWith(['eq', 'routingRules.id', 'rule_1'])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/inboxes/inbox.channels.ts b/apps/web/src/lib/server/domains/inboxes/inbox.channels.ts
new file mode 100644
index 000000000..e64a17e27
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/inbox.channels.ts
@@ -0,0 +1,157 @@
+/**
+ * Inbox channels — provider-specific records under an inbox (portal/email/api/widget/webhook).
+ * `config` is opaque per-kind; provider integrations are separate workstreams.
+ */
+import { db, eq, and, isNull, asc, inboxChannels, type InboxChannel } from '@/lib/server/db'
+import type { InboxChannelKind, AuditJsonValue } from '@/lib/server/db'
+import type { InboxId, InboxChannelId } from '@quackback/ids'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+import {
+  dispatchInboxChannelCreated,
+  dispatchInboxChannelUpdated,
+  dispatchInboxChannelArchived,
+  type EventActor,
+} from '@/lib/server/events/dispatch'
+import type { EventInboxChannelRef } from '@/lib/server/events/types'
+import { toIsoStringOrNull } from '@/lib/shared/utils/date'
+
+const LABEL_MAX = 200
+
+const inboxChannelActor: EventActor = { type: 'service', displayName: 'inbox-channel-system' }
+
+function inboxChannelRef(c: InboxChannel): EventInboxChannelRef {
+  return {
+    id: c.id,
+    inboxId: c.inboxId,
+    kind: c.kind,
+    label: c.label,
+    externalId: c.externalId ?? null,
+    enabled: c.enabled,
+    archivedAt: toIsoStringOrNull(c.archivedAt),
+  }
+}
+
+export interface AddInboxChannelInput {
+  inboxId: InboxId
+  kind: InboxChannelKind
+  label: string
+  config?: { [k: string]: AuditJsonValue }
+  externalId?: string | null
+  enabled?: boolean
+}
+
+export async function addInboxChannel(input: AddInboxChannelInput): Promise<InboxChannel> {
+  if (!input.inboxId) throw new ValidationError('INBOX_REQUIRED', 'inboxId required')
+  const label = input.label?.trim()
+  if (!label) throw new ValidationError('CHANNEL_LABEL_REQUIRED', 'label required')
+  if (label.length > LABEL_MAX)
+    throw new ValidationError('CHANNEL_LABEL_TOO_LONG', `label exceeds ${LABEL_MAX} chars`)
+
+  if (input.externalId) {
+    const dup = await db.query.inboxChannels.findFirst({
+      where: and(
+        eq(inboxChannels.kind, input.kind),
+        eq(inboxChannels.externalId, input.externalId),
+        isNull(inboxChannels.archivedAt)
+      ),
+    })
+    if (dup)
+      throw new ConflictError(
+        'CHANNEL_EXTERNAL_ID_TAKEN',
+        `Channel with externalId "${input.externalId}" already exists for kind ${input.kind}`
+      )
+  }
+
+  const [created] = await db
+    .insert(inboxChannels)
+    .values({
+      inboxId: input.inboxId,
+      kind: input.kind,
+      label,
+      config: input.config ?? {},
+      externalId: input.externalId ?? null,
+      enabled: input.enabled ?? true,
+    })
+    .returning()
+  void dispatchInboxChannelCreated(inboxChannelActor, inboxChannelRef(created)).catch(() => {})
+  return created
+}
+
+export interface UpdateInboxChannelInput {
+  label?: string
+  config?: { [k: string]: AuditJsonValue }
+  externalId?: string | null
+  enabled?: boolean
+}
+
+export async function updateInboxChannel(
+  channelId: InboxChannelId,
+  input: UpdateInboxChannelInput
+): Promise<InboxChannel> {
+  const existing = await getInboxChannel(channelId)
+  if (!existing) throw new NotFoundError('CHANNEL_NOT_FOUND', 'Channel not found')
+
+  const patch: Partial<typeof inboxChannels.$inferInsert> = {}
+  if (input.label !== undefined) {
+    const label = input.label.trim()
+    if (!label) throw new ValidationError('CHANNEL_LABEL_REQUIRED', 'label required')
+    patch.label = label
+  }
+  if (input.config !== undefined) patch.config = input.config
+  if (input.externalId !== undefined) patch.externalId = input.externalId
+  if (input.enabled !== undefined) patch.enabled = input.enabled
+
+  if (Object.keys(patch).length === 0) return existing
+
+  const [updated] = await db
+    .update(inboxChannels)
+    .set(patch)
+    .where(eq(inboxChannels.id, channelId))
+    .returning()
+  void dispatchInboxChannelUpdated(
+    inboxChannelActor,
+    inboxChannelRef(updated),
+    Object.keys(patch)
+  ).catch(() => {})
+  return updated
+}
+
+export async function archiveInboxChannel(channelId: InboxChannelId): Promise<InboxChannel> {
+  const existing = await getInboxChannel(channelId)
+  if (!existing) throw new NotFoundError('CHANNEL_NOT_FOUND', 'Channel not found')
+  if (existing.archivedAt) return existing
+  const [updated] = await db
+    .update(inboxChannels)
+    .set({ archivedAt: new Date(), enabled: false })
+    .where(eq(inboxChannels.id, channelId))
+    .returning()
+  void dispatchInboxChannelArchived(inboxChannelActor, inboxChannelRef(updated)).catch(() => {})
+  return updated
+}
+
+export async function getInboxChannel(
+  channelId: InboxChannelId
+): Promise<InboxChannel | undefined> {
+  return db.query.inboxChannels.findFirst({ where: eq(inboxChannels.id, channelId) })
+}
+
+export async function getInboxChannelByExternalId(
+  kind: InboxChannelKind,
+  externalId: string
+): Promise<InboxChannel | undefined> {
+  return db.query.inboxChannels.findFirst({
+    where: and(
+      eq(inboxChannels.kind, kind),
+      eq(inboxChannels.externalId, externalId),
+      isNull(inboxChannels.archivedAt)
+    ),
+  })
+}
+
+export async function listChannelsForInbox(inboxId: InboxId): Promise<InboxChannel[]> {
+  return db
+    .select()
+    .from(inboxChannels)
+    .where(eq(inboxChannels.inboxId, inboxId))
+    .orderBy(asc(inboxChannels.createdAt))
+}
diff --git a/apps/web/src/lib/server/domains/inboxes/inbox.memberships.ts b/apps/web/src/lib/server/domains/inboxes/inbox.memberships.ts
new file mode 100644
index 000000000..450c0b06e
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/inbox.memberships.ts
@@ -0,0 +1,129 @@
+/**
+ * Inbox memberships — N:M between principals and inboxes.
+ * Distinct from team_memberships to allow cross-team staffing.
+ */
+import { db, eq, and, asc, inboxMemberships, inboxes, type InboxMembership } from '@/lib/server/db'
+import type { Inbox } from '@/lib/shared/db-types'
+import type { InboxMembershipRole } from '@/lib/server/db'
+import type { InboxId, InboxMembershipId, PrincipalId } from '@quackback/ids'
+import { NotFoundError, ValidationError } from '@/lib/shared/errors'
+import {
+  dispatchInboxMembershipAdded,
+  dispatchInboxMembershipUpdated,
+  dispatchInboxMembershipRemoved,
+  type EventActor,
+} from '@/lib/server/events/dispatch'
+import type { EventInboxMembershipRef } from '@/lib/server/events/types'
+
+const inboxMembershipActor: EventActor = { type: 'service', displayName: 'inbox-membership-system' }
+
+function inboxMembershipRef(m: InboxMembership): EventInboxMembershipRef {
+  return {
+    id: m.id,
+    inboxId: m.inboxId,
+    principalId: m.principalId,
+    role: m.role,
+  }
+}
+
+export interface AddInboxMembershipInput {
+  inboxId: InboxId
+  principalId: PrincipalId
+  role?: InboxMembershipRole
+}
+
+export async function addInboxMembership(input: AddInboxMembershipInput): Promise<InboxMembership> {
+  if (!input.inboxId) throw new ValidationError('INBOX_REQUIRED', 'inboxId required')
+  if (!input.principalId) throw new ValidationError('PRINCIPAL_REQUIRED', 'principalId required')
+
+  const existing = await db.query.inboxMemberships.findFirst({
+    where: and(
+      eq(inboxMemberships.inboxId, input.inboxId),
+      eq(inboxMemberships.principalId, input.principalId)
+    ),
+  })
+  if (existing) return existing
+
+  const [created] = await db
+    .insert(inboxMemberships)
+    .values({
+      inboxId: input.inboxId,
+      principalId: input.principalId,
+      role: input.role ?? 'agent',
+    })
+    .returning()
+  void dispatchInboxMembershipAdded(inboxMembershipActor, inboxMembershipRef(created)).catch(
+    () => {}
+  )
+  return created
+}
+
+export async function updateInboxMembershipRole(
+  membershipId: InboxMembershipId,
+  role: InboxMembershipRole
+): Promise<InboxMembership> {
+  const existing = await db.query.inboxMemberships.findFirst({
+    where: eq(inboxMemberships.id, membershipId),
+  })
+  if (!existing) throw new NotFoundError('INBOX_MEMBERSHIP_NOT_FOUND', 'Membership not found')
+  if (existing.role === role) return existing
+  const previousRole = existing.role
+  const [updated] = await db
+    .update(inboxMemberships)
+    .set({ role })
+    .where(eq(inboxMemberships.id, membershipId))
+    .returning()
+  void dispatchInboxMembershipUpdated(
+    inboxMembershipActor,
+    inboxMembershipRef(updated),
+    previousRole
+  ).catch(() => {})
+  return updated
+}
+
+export async function removeInboxMembership(membershipId: InboxMembershipId): Promise<void> {
+  const snapshot = await db.query.inboxMemberships.findFirst({
+    where: eq(inboxMemberships.id, membershipId),
+  })
+  await db.delete(inboxMemberships).where(eq(inboxMemberships.id, membershipId))
+  if (snapshot) {
+    void dispatchInboxMembershipRemoved(inboxMembershipActor, inboxMembershipRef(snapshot)).catch(
+      () => {}
+    )
+  }
+}
+
+export async function listMembershipsForInbox(inboxId: InboxId): Promise<InboxMembership[]> {
+  return db
+    .select()
+    .from(inboxMemberships)
+    .where(eq(inboxMemberships.inboxId, inboxId))
+    .orderBy(asc(inboxMemberships.createdAt))
+}
+
+export async function listInboxesForPrincipal(
+  principalId: PrincipalId
+): Promise<InboxMembership[]> {
+  return db
+    .select()
+    .from(inboxMemberships)
+    .where(eq(inboxMemberships.principalId, principalId))
+    .orderBy(asc(inboxMemberships.createdAt))
+}
+
+/**
+ * Same as listInboxesForPrincipal, but joins through to the inboxes table so
+ * the caller gets full inbox rows (name, slug, etc) instead of bare membership
+ * rows. Used by the agent queue sidebar's "By inbox" group.
+ */
+export async function listInboxRowsForPrincipal(principalId: PrincipalId): Promise<Inbox[]> {
+  const rows = await db
+    .select({
+      inbox: inboxes,
+    })
+    .from(inboxMemberships)
+    .innerJoin(inboxes, eq(inboxMemberships.inboxId, inboxes.id))
+    .where(eq(inboxMemberships.principalId, principalId))
+    .orderBy(asc(inboxes.name))
+  return rows.map((r) => r.inbox)
+}
diff --git a/apps/web/src/lib/server/domains/inboxes/inbox.service.ts b/apps/web/src/lib/server/domains/inboxes/inbox.service.ts
new file mode 100644
index 000000000..099a891eb
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/inbox.service.ts
@@ -0,0 +1,245 @@
+/**
+ * Inboxes domain — CRUD for the named queues that own incoming tickets.
+ *
+ * Permission checks are the caller's responsibility; this layer is pure.
+ */
+
+import {
+  db,
+  eq,
+  and,
+  isNull,
+  ilike,
+  or,
+  asc,
+  inboxes,
+  inboxMemberships,
+  type Inbox,
+  type TicketPriority,
+  type TicketVisibilityScope,
+} from '@/lib/server/db'
+import type { InboxId, TeamId, TicketStatusId, PrincipalId, UserId } from '@quackback/ids'
+import type { EventInboxRef } from '@/lib/server/events/types'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+
+/**
+ * Identity of the operator (or system caller) performing the mutation.
+ * Required so configuration-plane webhook events carry a meaningful actor.
+ * For internal/system calls, pass `{ principalId: null }`.
+ */
+export interface InboxActorContext {
+  principalId: PrincipalId | null
+  userId?: UserId | null
+}
+
+async function fireInboxEvent(
+  kind: 'created' | 'updated' | 'archived' | 'unarchived',
+  actor: InboxActorContext,
+  inbox: Inbox,
+  changedFields?: string[]
+): Promise<void> {
+  try {
+    const {
+      buildEventActor,
+      dispatchInboxCreated,
+      dispatchInboxUpdated,
+      dispatchInboxArchived,
+      dispatchInboxUnarchived,
+    } = await import('@/lib/server/events/dispatch')
+    const eventActor = actor.principalId
+      ? buildEventActor({
+          principalId: actor.principalId,
+          userId: actor.userId ?? undefined,
+          displayName: 'inbox-system',
+        })
+      : { type: 'service' as const, displayName: 'inbox-system' }
+    if (kind === 'created')
+      await dispatchInboxCreated(eventActor, inbox as unknown as EventInboxRef)
+    else if (kind === 'updated')
+      await dispatchInboxUpdated(eventActor, inbox as unknown as EventInboxRef, changedFields ?? [])
+    else if (kind === 'archived')
+      await dispatchInboxArchived(eventActor, inbox as unknown as EventInboxRef)
+    else await dispatchInboxUnarchived(eventActor, inbox as unknown as EventInboxRef)
+  } catch (err) {
+    console.warn(`[inboxes] dispatchInbox${kind} failed`, err)
+  }
+}
+
+const NAME_MAX = 200
+const SLUG_MAX = 100
+const SLUG_REGEX = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/
+
+function normalizeSlug(slug: string): string {
+  return slug.trim().toLowerCase()
+}
+
+function validateSlug(slug: string): void {
+  if (!slug) throw new ValidationError('INBOX_SLUG_REQUIRED', 'slug is required')
+  if (slug.length > SLUG_MAX)
+    throw new ValidationError('INBOX_SLUG_TOO_LONG', `slug exceeds ${SLUG_MAX} chars`)
+  if (!SLUG_REGEX.test(slug))
+    throw new ValidationError(
+      'INBOX_SLUG_INVALID',
+      'slug must be lowercase letters/digits separated by - or _'
+    )
+}
+
+export interface CreateInboxInput {
+  name: string
+  slug: string
+  description?: string | null
+  primaryTeamId?: TeamId | null
+  defaultVisibilityScope?: TicketVisibilityScope
+  defaultPriority?: TicketPriority
+  defaultStatusId?: TicketStatusId | null
+  color?: string | null
+  icon?: string | null
+}
+
+export async function createInbox(
+  input: CreateInboxInput,
+  actor: InboxActorContext
+): Promise<Inbox> {
+  const name = input.name?.trim()
+  if (!name) throw new ValidationError('INBOX_NAME_REQUIRED', 'Inbox name is required')
+  if (name.length > NAME_MAX)
+    throw new ValidationError('INBOX_NAME_TOO_LONG', `Inbox name exceeds ${NAME_MAX} chars`)
+
+  const slug = normalizeSlug(input.slug)
+  validateSlug(slug)
+
+  const dup = await db.query.inboxes.findFirst({ where: eq(inboxes.slug, slug) })
+  if (dup) throw new ConflictError('INBOX_SLUG_TAKEN', `Inbox slug "${slug}" already exists`)
+
+  const created = await db.transaction(async (tx) => {
+    const [createdInbox] = await tx
+      .insert(inboxes)
+      .values({
+        name,
+        slug,
+        description: input.description ?? null,
+        primaryTeamId: input.primaryTeamId ?? null,
+        defaultVisibilityScope: input.defaultVisibilityScope ?? 'team',
+        defaultPriority: input.defaultPriority ?? 'normal',
+        defaultStatusId: input.defaultStatusId ?? null,
+        color: input.color ?? null,
+        icon: input.icon ?? null,
+      })
+      .returning()
+
+    if (actor.principalId) {
+      await tx.insert(inboxMemberships).values({
+        inboxId: createdInbox.id,
+        principalId: actor.principalId,
+        role: 'owner',
+      })
+    }
+
+    return createdInbox
+  })
+
+  await fireInboxEvent('created', actor, created)
+  return created
+}
+
+export interface UpdateInboxInput {
+  name?: string
+  description?: string | null
+  primaryTeamId?: TeamId | null
+  defaultVisibilityScope?: TicketVisibilityScope
+  defaultPriority?: TicketPriority
+  defaultStatusId?: TicketStatusId | null
+  color?: string | null
+  icon?: string | null
+}
+
+export async function updateInbox(
+  inboxId: InboxId,
+  input: UpdateInboxInput,
+  actor: InboxActorContext
+): Promise<Inbox> {
+  const existing = await getInbox(inboxId)
+  if (!existing) throw new NotFoundError('INBOX_NOT_FOUND', `Inbox ${inboxId} not found`)
+
+  const patch: Partial<typeof inboxes.$inferInsert> = {}
+  if (input.name !== undefined) {
+    const name = input.name.trim()
+    if (!name) throw new ValidationError('INBOX_NAME_REQUIRED', 'Inbox name is required')
+    if (name.length > NAME_MAX)
+      throw new ValidationError('INBOX_NAME_TOO_LONG', `Inbox name exceeds ${NAME_MAX} chars`)
+    patch.name = name
+  }
+  if (input.description !== undefined) patch.description = input.description
+  if (input.primaryTeamId !== undefined) patch.primaryTeamId = input.primaryTeamId
+  if (input.defaultVisibilityScope !== undefined)
+    patch.defaultVisibilityScope = input.defaultVisibilityScope
+  if (input.defaultPriority !== undefined) patch.defaultPriority = input.defaultPriority
+  if (input.defaultStatusId !== undefined) patch.defaultStatusId = input.defaultStatusId
+  if (input.color !== undefined) patch.color = input.color
+  if (input.icon !== undefined) patch.icon = input.icon
+
+  if (Object.keys(patch).length === 0) return existing
+
+  const [updated] = await db.update(inboxes).set(patch).where(eq(inboxes.id, inboxId)).returning()
+  await fireInboxEvent('updated', actor, updated, Object.keys(patch))
+  return updated
+}
+
+export async function archiveInbox(inboxId: InboxId, actor: InboxActorContext): Promise<Inbox> {
+  const existing = await getInbox(inboxId)
+  if (!existing) throw new NotFoundError('INBOX_NOT_FOUND', `Inbox ${inboxId} not found`)
+  if (existing.archivedAt) return existing
+  const [updated] = await db
+    .update(inboxes)
+    .set({ archivedAt: new Date() })
+    .where(eq(inboxes.id, inboxId))
+    .returning()
+  await fireInboxEvent('archived', actor, updated)
+  return updated
+}
+
+export async function unarchiveInbox(inboxId: InboxId, actor: InboxActorContext): Promise<Inbox> {
+  const existing = await getInbox(inboxId)
+  if (!existing) throw new NotFoundError('INBOX_NOT_FOUND', `Inbox ${inboxId} not found`)
+  if (!existing.archivedAt) return existing
+  const [updated] = await db
+    .update(inboxes)
+    .set({ archivedAt: null })
+    .where(eq(inboxes.id, inboxId))
+    .returning()
+  await fireInboxEvent('unarchived', actor, updated)
+  return updated
+}
+
+export async function getInbox(inboxId: InboxId): Promise<Inbox | undefined> {
+  return db.query.inboxes.findFirst({ where: eq(inboxes.id, inboxId) })
+}
+
+export async function getInboxBySlug(slug: string): Promise<Inbox | undefined> {
+  return db.query.inboxes.findFirst({ where: eq(inboxes.slug, normalizeSlug(slug)) })
+}
+
+export interface ListInboxesParams {
+  search?: string
+  primaryTeamId?: TeamId
+  includeArchived?: boolean
+  limit?: number
+  offset?: number
+}
+
+export async function listInboxes(params: ListInboxesParams = {}): Promise<Inbox[]> {
+  const filters = []
+  if (!params.includeArchived) filters.push(isNull(inboxes.archivedAt))
+  if (params.primaryTeamId) filters.push(eq(inboxes.primaryTeamId, params.primaryTeamId))
+  if (params.search) {
+    const q = `%${params.search}%`
+    filters.push(or(ilike(inboxes.name, q), ilike(inboxes.slug, q))!)
+  }
+  return db
+    .select()
+    .from(inboxes)
+    .where(filters.length ? and(...filters) : undefined)
+    .orderBy(asc(inboxes.name))
+    .limit(params.limit ?? 100)
+    .offset(params.offset ?? 0)
+}
diff --git a/apps/web/src/lib/server/domains/inboxes/index.ts b/apps/web/src/lib/server/domains/inboxes/index.ts
new file mode 100644
index 000000000..20b4a75d3
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/index.ts
@@ -0,0 +1,6 @@
+export * from './inbox.service'
+export * from './inbox.memberships'
+export * from './inbox.channels'
+export * from './routing.types'
+export * from './routing.service'
+export * from './routing.engine'
diff --git a/apps/web/src/lib/server/domains/inboxes/routing.engine.ts b/apps/web/src/lib/server/domains/inboxes/routing.engine.ts
new file mode 100644
index 000000000..4cec8f293
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/routing.engine.ts
@@ -0,0 +1,165 @@
+/**
+ * Routing engine — pure evaluator + DB-aware `route()` helper.
+ * First-match-wins by `(priority asc, createdAt asc)`.
+ */
+import {
+  db,
+  eq,
+  asc,
+  isNull,
+  inboxes as inboxesTable,
+  routingRules as routingRulesTable,
+  type RoutingRule,
+} from '@/lib/server/db'
+import {
+  ruleSetSchema,
+  routingActionsSchema,
+  type RoutingAction,
+  type RoutingCondition,
+  type RoutingInput,
+  type RoutingDecision,
+  type RuleSet,
+} from './routing.types'
+
+function fieldValue(input: RoutingInput, field: RoutingCondition['field']): string | null {
+  switch (field) {
+    case 'subject':
+      return input.subject ?? null
+    case 'descriptionText':
+      return input.descriptionText ?? null
+    case 'channel':
+      return input.channel ?? null
+    case 'priority':
+      return input.priority ?? null
+    case 'organizationDomain':
+      return input.organizationDomain ?? null
+    case 'requesterEmail':
+      return input.requesterEmail ?? null
+    case 'inboxChannelKind':
+      return input.inboxChannelKind ?? null
+    default:
+      return null
+  }
+}
+
+function evalCondition(input: RoutingInput, c: RoutingCondition): boolean {
+  const actual = fieldValue(input, c.field)
+  if (actual == null) return false
+  switch (c.op) {
+    case 'eq':
+      return typeof c.value === 'string' && actual.toLowerCase() === c.value.toLowerCase()
+    case 'contains':
+      return typeof c.value === 'string' && actual.toLowerCase().includes(c.value.toLowerCase())
+    case 'matches':
+      if (typeof c.value !== 'string') return false
+      try {
+        return new RegExp(c.value, 'i').test(actual)
+      } catch {
+        return false
+      }
+    case 'in':
+      if (!Array.isArray(c.value)) return false
+      return c.value.some((v) => v.toLowerCase() === actual.toLowerCase())
+    default:
+      return false
+  }
+}
+
+export function evalRuleSet(input: RoutingInput, set: RuleSet): boolean {
+  if (set.conditions.length === 0) return false
+  if (set.match === 'all') return set.conditions.every((c) => evalCondition(input, c))
+  return set.conditions.some((c) => evalCondition(input, c))
+}
+
+export function applyActions(
+  actions: readonly RoutingAction[],
+  matchedRuleId: string | null
+): RoutingDecision {
+  const decision: RoutingDecision = { matchedRuleId }
+  for (const action of actions) {
+    switch (action.type) {
+      case 'assignToInbox':
+        decision.inboxId = action.value
+        break
+      case 'assignToTeam':
+        decision.primaryTeamId = action.value
+        decision.assigneeTeamId = action.value
+        break
+      case 'assignToPrincipal':
+        decision.assigneePrincipalId = action.value
+        break
+      case 'setPriority':
+        decision.priority = action.value
+        break
+      case 'setVisibility':
+        decision.visibilityScope = action.value
+        break
+      case 'addParticipant':
+        decision.addParticipants ??= []
+        decision.addParticipants.push(action.value)
+        break
+    }
+  }
+  return decision
+}
+
+/**
+ * Pure evaluator: returns the first rule that matches plus a resolved
+ * decision, or null if none matched.
+ */
+export function evaluateRules(
+  rules: readonly RoutingRule[],
+  input: RoutingInput
+): RoutingDecision | null {
+  for (const rule of rules) {
+    if (!rule.enabled) continue
+    const setParse = ruleSetSchema.safeParse(rule.conditions)
+    if (!setParse.success) continue
+    const actionsParse = routingActionsSchema.safeParse(rule.actions)
+    if (!actionsParse.success) continue
+    if (evalRuleSet(input, setParse.data)) {
+      return applyActions(actionsParse.data, rule.id)
+    }
+  }
+  return null
+}
+
+/**
+ * DB-aware route(): loads enabled rules ordered by priority and createdAt,
+ * evaluates them, and falls back to candidateInboxId or the first
+ * non-archived inbox. Also resolves primaryTeamId from the chosen inbox if
+ * the matching rule did not explicitly set it.
+ */
+export async function route(input: RoutingInput): Promise<RoutingDecision> {
+  const rules = await db
+    .select()
+    .from(routingRulesTable)
+    .where(eq(routingRulesTable.enabled, true))
+    .orderBy(asc(routingRulesTable.priority), asc(routingRulesTable.createdAt))
+
+  let decision: RoutingDecision = evaluateRules(rules, input) ?? { matchedRuleId: null }
+
+  // Fallback inbox: caller-provided, then first active inbox (workspace default).
+  if (!decision.inboxId) {
+    if (input.candidateInboxId) {
+      decision = { ...decision, inboxId: input.candidateInboxId }
+    } else {
+      const fallback = await db.query.inboxes.findFirst({
+        where: isNull(inboxesTable.archivedAt),
+        orderBy: asc(inboxesTable.createdAt),
+      })
+      if (fallback) decision = { ...decision, inboxId: fallback.id }
+    }
+  }
+
+  // Derive primaryTeamId from the chosen inbox when not already set by an action.
+  if (decision.inboxId && !decision.primaryTeamId) {
+    const inboxIdValue = decision.inboxId
+    const inbox = await db.query.inboxes.findFirst({
+      where: eq(inboxesTable.id, inboxIdValue as never),
+    })
+    if (inbox?.primaryTeamId) decision.primaryTeamId = inbox.primaryTeamId
+  }
+
+  return decision
+}
diff --git a/apps/web/src/lib/server/domains/inboxes/routing.service.ts b/apps/web/src/lib/server/domains/inboxes/routing.service.ts
new file mode 100644
index 000000000..dc7eef8ff
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/routing.service.ts
@@ -0,0 +1,185 @@
+/**
+ * Routing rule CRUD + reorder + match-stats bookkeeping.
+ */
+import { db, eq, and, asc, sql, routingRules, type RoutingRule } from '@/lib/server/db'
+import type { InboxId, RoutingRuleId } from '@quackback/ids'
+import { NotFoundError, ValidationError } from '@/lib/shared/errors'
+import {
+  ruleSetSchema,
+  routingActionsSchema,
+  type RoutingAction,
+  type RuleSet,
+} from './routing.types'
+import {
+  dispatchRoutingRuleCreated,
+  dispatchRoutingRuleUpdated,
+  dispatchRoutingRuleDeleted,
+  type EventActor,
+} from '@/lib/server/events/dispatch'
+import type { EventRoutingRuleRef } from '@/lib/server/events/types'
+
+const routingRuleActor: EventActor = { type: 'service', displayName: 'routing-system' }
+
+function routingRuleRef(r: RoutingRule): EventRoutingRuleRef {
+  return {
+    id: r.id,
+    name: r.name,
+    enabled: r.enabled,
+    priority: r.priority,
+    inboxIdScope: r.inboxIdScope ?? null,
+  }
+}
+
+export interface CreateRoutingRuleInput {
+  name: string
+  description?: string | null
+  priority?: number
+  enabled?: boolean
+  conditions: RuleSet
+  actions: RoutingAction[]
+  inboxIdScope?: InboxId | null
+}
+
+function validateConditionsActions(conditions: unknown, actions: unknown): void {
+  const cParse = ruleSetSchema.safeParse(conditions)
+  if (!cParse.success)
+    throw new ValidationError(
+      'ROUTING_CONDITIONS_INVALID',
+      cParse.error.issues[0]?.message || 'Invalid conditions'
+    )
+  const aParse = routingActionsSchema.safeParse(actions)
+  if (!aParse.success)
+    throw new ValidationError(
+      'ROUTING_ACTIONS_INVALID',
+      aParse.error.issues[0]?.message || 'Invalid actions'
+    )
+}
+
+export async function createRoutingRule(input: CreateRoutingRuleInput): Promise<RoutingRule> {
+  const name = input.name?.trim()
+  if (!name) throw new ValidationError('ROUTING_NAME_REQUIRED', 'name required')
+  validateConditionsActions(input.conditions, input.actions)
+
+  const [created] = await db
+    .insert(routingRules)
+    .values({
+      name,
+      description: input.description ?? null,
+      priority: input.priority ?? 100,
+      enabled: input.enabled ?? true,
+      conditions: input.conditions,
+      actions: input.actions,
+      inboxIdScope: input.inboxIdScope ?? null,
+    })
+    .returning()
+  void dispatchRoutingRuleCreated(routingRuleActor, routingRuleRef(created)).catch(() => {})
+  return created
+}
+
+export interface UpdateRoutingRuleInput {
+  name?: string
+  description?: string | null
+  priority?: number
+  enabled?: boolean
+  conditions?: RuleSet
+  actions?: RoutingAction[]
+  inboxIdScope?: InboxId | null
+}
+
+export async function updateRoutingRule(
+  ruleId: RoutingRuleId,
+  input: UpdateRoutingRuleInput
+): Promise<RoutingRule> {
+  const existing = await getRoutingRule(ruleId)
+  if (!existing) throw new NotFoundError('ROUTING_RULE_NOT_FOUND', 'Rule not found')
+
+  const patch: Partial<typeof routingRules.$inferInsert> = {}
+  if (input.name !== undefined) {
+    const name = input.name.trim()
+    if (!name) throw new ValidationError('ROUTING_NAME_REQUIRED', 'name required')
+    patch.name = name
+  }
+  if (input.description !== undefined) patch.description = input.description
+  if (input.priority !== undefined) patch.priority = input.priority
+  if (input.enabled !== undefined) patch.enabled = input.enabled
+  if (input.conditions !== undefined) {
+    validateConditionsActions(input.conditions, input.actions ?? existing.actions)
+    patch.conditions = input.conditions
+  }
+  if (input.actions !== undefined) {
+    validateConditionsActions(input.conditions ?? existing.conditions, input.actions)
+    patch.actions = input.actions
+  }
+  if (input.inboxIdScope !== undefined) patch.inboxIdScope = input.inboxIdScope
+
+  if (Object.keys(patch).length === 0) return existing
+
+  const [updated] = await db
+    .update(routingRules)
+    .set(patch)
+    .where(eq(routingRules.id, ruleId))
+    .returning()
+  void dispatchRoutingRuleUpdated(
+    routingRuleActor,
+    routingRuleRef(updated),
+    Object.keys(patch)
+  ).catch(() => {})
+  return updated
+}
+
+export async function deleteRoutingRule(ruleId: RoutingRuleId): Promise<void> {
+  const snapshot = await getRoutingRule(ruleId)
+  await db.delete(routingRules).where(eq(routingRules.id, ruleId))
+  if (snapshot) {
+    void dispatchRoutingRuleDeleted(routingRuleActor, routingRuleRef(snapshot)).catch(() => {})
+  }
+}
+
+export async function getRoutingRule(ruleId: RoutingRuleId): Promise<RoutingRule | undefined> {
+  return db.query.routingRules.findFirst({ where: eq(routingRules.id, ruleId) })
+}
+
+export interface ListRoutingRulesParams {
+  inboxIdScope?: InboxId | 'workspace'
+  enabledOnly?: boolean
+}
+
+export async function listRoutingRules(
+  params: ListRoutingRulesParams = {}
+): Promise<RoutingRule[]> {
+  const filters = []
+  if (params.enabledOnly) filters.push(eq(routingRules.enabled, true))
+  if (params.inboxIdScope === 'workspace') {
+    filters.push(sql`${routingRules.inboxIdScope} IS NULL`)
+  } else if (params.inboxIdScope) {
+    filters.push(eq(routingRules.inboxIdScope, params.inboxIdScope))
+  }
+  return db
+    .select()
+    .from(routingRules)
+    .where(filters.length ? and(...filters) : undefined)
+    .orderBy(asc(routingRules.priority), asc(routingRules.createdAt))
+}
+
+/**
+ * Reorders rules by setting their priority to the position in the input list.
+ * Lower index = lower priority value = higher precedence.
+ */
+export async function reorderRoutingRules(orderedIds: RoutingRuleId[]): Promise<void> {
+  for (let i = 0; i < orderedIds.length; i++) {
+    await db
+      .update(routingRules)
+      .set({ priority: (i + 1) * 10 })
+      .where(eq(routingRules.id, orderedIds[i]))
+  }
+}
+
+export async function bumpMatchStats(ruleId: RoutingRuleId): Promise<void> {
+  await db
+    .update(routingRules)
+    .set({
+      matchCount: sql`${routingRules.matchCount} + 1`,
+      lastMatchedAt: new Date(),
+    })
+    .where(eq(routingRules.id, ruleId))
+}
diff --git a/apps/web/src/lib/server/domains/inboxes/routing.types.ts b/apps/web/src/lib/server/domains/inboxes/routing.types.ts
new file mode 100644
index 000000000..bcdf728db
--- /dev/null
+++ b/apps/web/src/lib/server/domains/inboxes/routing.types.ts
@@ -0,0 +1,84 @@
+/**
+ * Routing rule grammar (v1) — single-level conditions, simple actions.
+ * Conditions are evaluated as `match: 'all' | 'any'` over the array.
+ */
+import { z } from 'zod'
+import { TICKET_PRIORITIES, TICKET_VISIBILITY_SCOPES, INBOX_CHANNEL_KINDS } from '@/lib/server/db'
+import type { TicketChannel } from '@/lib/server/db'
+
+export const ROUTING_CONDITION_FIELDS = [
+  'subject',
+  'descriptionText',
+  'channel',
+  'priority',
+  'organizationDomain',
+  'requesterEmail',
+  'inboxChannelKind',
+] as const
+
+export type RoutingConditionField = (typeof ROUTING_CONDITION_FIELDS)[number]
+
+export const ROUTING_CONDITION_OPS = ['eq', 'contains', 'matches', 'in'] as const
+
+export type RoutingConditionOp = (typeof ROUTING_CONDITION_OPS)[number]
+
+export const routingConditionSchema = z.object({
+  field: z.enum(ROUTING_CONDITION_FIELDS),
+  op: z.enum(ROUTING_CONDITION_OPS),
+  value: z.union([z.string(), z.array(z.string())]),
+})
+export type RoutingCondition = z.infer<typeof routingConditionSchema>
+
+export const ROUTING_ACTION_TYPES = [
+  'assignToInbox',
+  'assignToTeam',
+  'assignToPrincipal',
+  'setPriority',
+  'setVisibility',
+  'addParticipant',
+] as const
+
+export type RoutingActionType = (typeof ROUTING_ACTION_TYPES)[number]
+
+export const routingActionSchema = z.object({
+  type: z.enum(ROUTING_ACTION_TYPES),
+  /** Action-specific payload (an id, an enum value, etc.). */
+  value: z.string().min(1),
+})
+export type RoutingAction = z.infer<typeof routingActionSchema>
+
+export const ruleSetSchema = z.object({
+  match: z.enum(['all', 'any']).default('all'),
+  conditions: z.array(routingConditionSchema).min(1),
+})
+export type RuleSet = z.infer<typeof ruleSetSchema>
+
+export const routingActionsSchema = z.array(routingActionSchema).min(1)
+
+/** Input passed into the routing engine. */
+export interface RoutingInput {
+  subject: string
+  descriptionText?: string | null
+  channel: TicketChannel
+  priority?: string
+  organizationDomain?: string | null
+  requesterEmail?: string | null
+  inboxChannelKind?: (typeof INBOX_CHANNEL_KINDS)[number] | null
+  /** Pre-bound inbox if the caller already chose one. Acts as a fallback. */
+  candidateInboxId?: string | null
+}
+
+export interface RoutingDecision {
+  inboxId?: string | null
+  primaryTeamId?: string | null
+  assigneePrincipalId?: string | null
+  assigneeTeamId?: string | null
+  priority?: string
+  visibilityScope?: string
+  addParticipants?: string[]
+  matchedRuleId?: string | null
+}
+
+/** Lightweight runtime priority/visibility constants re-exported for matching. */
+export const VALID_PRIORITY_VALUES = TICKET_PRIORITIES
+export const VALID_VISIBILITY_VALUES = TICKET_VISIBILITY_SCOPES
diff --git a/apps/web/src/lib/server/domains/notifications/notification.service.ts b/apps/web/src/lib/server/domains/notifications/notification.service.ts
index 4bb0f7211..dce6885fe 100644
--- a/apps/web/src/lib/server/domains/notifications/notification.service.ts
+++ b/apps/web/src/lib/server/domains/notifications/notification.service.ts
@@ -59,6 +59,7 @@ export async function createNotificationsBatch(
         body: input.body ?? null,
         postId: input.postId ?? null,
         commentId: input.commentId ?? null,
+        ticketId: input.ticketId ?? null,
         metadata: input.metadata ?? null,
       }))
     )
@@ -126,6 +127,7 @@ export async function getNotificationsForMember(
       body: inAppNotifications.body,
       postId: inAppNotifications.postId,
       commentId: inAppNotifications.commentId,
+      ticketId: inAppNotifications.ticketId,
       metadata: inAppNotifications.metadata,
       readAt: inAppNotifications.readAt,
       archivedAt: inAppNotifications.archivedAt,
@@ -199,6 +201,7 @@ export async function getNotificationsForMember(
       body: denied ? 'This activity is no longer visible to you.' : row.body,
       postId: row.postId,
       commentId: row.commentId,
+      ticketId: row.ticketId,
       metadata: denied ? null : (row.metadata as Record<string, unknown> | null),
       readAt: row.readAt,
       archivedAt: row.archivedAt,
@@ -292,10 +295,7 @@ export async function archiveNotification(
   principalId: PrincipalId,
   notificationId: NotificationId
 ): Promise<void> {
-  log.debug(
-    { principal_id: principalId, notification_id: notificationId },
-    'archive notification'
-  )
+  log.debug({ principal_id: principalId, notification_id: notificationId }, 'archive notification')
   const existing = await db.query.inAppNotifications.findFirst({
     where: and(
       eq(inAppNotifications.id, notificationId),
diff --git a/apps/web/src/lib/server/domains/notifications/notification.types.ts b/apps/web/src/lib/server/domains/notifications/notification.types.ts
index 60432527f..d8a52938a 100644
--- a/apps/web/src/lib/server/domains/notifications/notification.types.ts
+++ b/apps/web/src/lib/server/domains/notifications/notification.types.ts
@@ -4,7 +4,7 @@
  * Type definitions for in-app notifications
  */
 
-import type { NotificationId, PostId, CommentId, PrincipalId } from '@quackback/ids'
+import type { NotificationId, PostId, CommentId, PrincipalId, TicketId } from '@quackback/ids'
 
 /**
  * Notification event types that can trigger in-app notifications
@@ -14,6 +14,16 @@ export type NotificationType =
   | 'comment_created'
   | 'post_mentioned'
   | 'changelog_published'
+  | 'ticket_sla_warning'
+  | 'ticket_sla_breach'
+  | 'ticket_assigned'
+  | 'ticket_unassigned'
+  | 'ticket_thread_added'
+  | 'ticket_status_changed'
+  | 'ticket_participant_added'
+  | 'ticket_participant_removed'
+  | 'ticket_shared'
+  | 'ticket_unshared'
   | 'chat_message'
   | 'chat_mention'
 
@@ -27,6 +37,7 @@ export interface CreateNotificationInput {
   body?: string
   postId?: PostId
   commentId?: CommentId
+  ticketId?: TicketId
   metadata?: Record<string, unknown>
 }
 
@@ -41,6 +52,7 @@ export interface Notification {
   body: string | null
   postId: PostId | null
   commentId: CommentId | null
+  ticketId: TicketId | null
   metadata: Record<string, unknown> | null
   readAt: Date | null
   archivedAt: Date | null
diff --git a/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.diffcov.test.ts b/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.diffcov.test.ts
new file mode 100644
index 000000000..f0c6c19e1
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.diffcov.test.ts
@@ -0,0 +1,308 @@
+/**
+ * Differential-coverage tests for contact.service — create/update validation +
+ * dup checks, the field-by-field update ternaries and changed-field diffing,
+ * fireContactEvent (actor + kind + failure), auto-linking, search/list filters,
+ * findOrCreateByEmail race recovery, and link/unlink idempotency.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  contactsFindFirst: vi.fn(),
+  linksFindFirst: vi.fn(),
+  linksFindMany: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  deleteReturning: vi.fn(),
+  selectWhere: vi.fn(),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({
+    type: 'principal',
+    displayName: 'contacts-system',
+  })),
+  dCreated: vi.fn(),
+  dUpdated: vi.fn(),
+  dArchived: vi.fn(),
+  dLinked: vi.fn(),
+  dUnlinked: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      contacts: { findFirst: m.contactsFindFirst },
+      contactUserLinks: { findFirst: m.linksFindFirst, findMany: m.linksFindMany },
+    },
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({ set: () => ({ where: () => ({ returning: m.updateReturning }) }) }),
+    delete: () => ({ where: () => ({ returning: m.deleteReturning }) }),
+    select: () => {
+      // `.where()` is both awaited directly (auto-link) and chained through
+      // orderBy/limit/offset (list/search); a thenable tail handles both.
+      const tail: Record<string, unknown> = {
+        orderBy: () => tail,
+        limit: () => tail,
+        offset: () => m.selectWhere(),
+        then: (resolve: (v: unknown) => void) => resolve(m.selectWhere()),
+      }
+      return { from: () => ({ where: () => tail }) }
+    },
+  },
+  eq: vi.fn((a, b) => ({ eq: [a, b] })),
+  and: vi.fn((...a) => ({ and: a })),
+  isNull: vi.fn((a) => ({ isNull: a })),
+  ilike: vi.fn(),
+  or: vi.fn((...a) => ({ or: a })),
+  sql: vi.fn(),
+  asc: vi.fn(),
+  desc: vi.fn(),
+  contacts: {
+    id: 'c.id',
+    email: 'c.email',
+    externalId: 'c.externalId',
+    organizationId: 'c.organizationId',
+    archivedAt: 'c.archivedAt',
+    name: 'c.name',
+    createdAt: 'c.createdAt',
+  },
+  contactUserLinks: { id: 'cul.id', contactId: 'cul.contactId', userId: 'cul.userId' },
+  user: {
+    id: 'u.id',
+    email: 'u.email',
+    emailVerified: 'u.emailVerified',
+    isAnonymous: 'u.isAnonymous',
+  },
+}))
+
+vi.mock('../normalize', () => ({
+  normalizeEmail: (e: unknown) =>
+    typeof e === 'string' && e.includes('@') ? e.trim().toLowerCase() : '',
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchContactCreated: (...a: unknown[]) => m.dCreated(...a),
+  dispatchContactUpdated: (...a: unknown[]) => m.dUpdated(...a),
+  dispatchContactArchived: (...a: unknown[]) => m.dArchived(...a),
+  dispatchContactLinked: (...a: unknown[]) => m.dLinked(...a),
+  dispatchContactUnlinked: (...a: unknown[]) => m.dUnlinked(...a),
+}))
+
+import * as svc from '../contact.service'
+
+const withP = { principalId: 'p1' as never, userId: 'u1' as never }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.contactsFindFirst.mockResolvedValue(undefined)
+  m.linksFindFirst.mockResolvedValue(undefined)
+  m.linksFindMany.mockResolvedValue([{ id: 'link_1' }])
+  m.insertReturning.mockResolvedValue([{ id: 'contact_1', email: 'a@x.test' }])
+  m.updateReturning.mockResolvedValue([{ id: 'contact_1' }])
+  m.deleteReturning.mockResolvedValue([{ id: 'cul_1' }])
+  m.selectWhere.mockResolvedValue([])
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('createContact', () => {
+  it('rejects an invalid email', async () => {
+    await expect(svc.createContact({ email: 'bad' })).rejects.toThrow('email is invalid')
+  })
+  it('requires a name or email', async () => {
+    await expect(svc.createContact({})).rejects.toThrow('at least a name or email')
+  })
+  it('rejects a duplicate email', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'dup' })
+    await expect(svc.createContact({ email: 'a@x.test' })).rejects.toThrow('already exists')
+  })
+  it('rejects a duplicate externalId', async () => {
+    // No email -> the email dup check is skipped; first findFirst is externalId.
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'dup' })
+    await expect(svc.createContact({ name: 'N', externalId: 'ext' })).rejects.toThrow(
+      'externalId already in use'
+    )
+  })
+  it('creates, fires created, and auto-links verified users', async () => {
+    m.selectWhere.mockResolvedValueOnce([{ id: 'u_verified' }])
+    m.contactsFindFirst.mockResolvedValueOnce(undefined) // email dup check
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'contact_1' }) // getContact inside link
+    const c = await svc.createContact({ name: ' N ', email: 'a@x.test' }, withP)
+    expect(c).toEqual({ id: 'contact_1', email: 'a@x.test' })
+    expect(m.dCreated).toHaveBeenCalled()
+    expect(m.dLinked).toHaveBeenCalled() // via auto-link
+  })
+})
+
+describe('updateContact', () => {
+  it('throws when missing', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce(undefined) // getContact
+    await expect(svc.updateContact('c1' as never, { name: 'x' })).rejects.toThrow('not found')
+  })
+  it('rejects an invalid new email', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c1', email: 'old@x.test' })
+    await expect(svc.updateContact('c1' as never, { email: 'bad' })).rejects.toThrow(
+      'email is invalid'
+    )
+  })
+  it('rejects an email taken by another contact', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c1', email: 'old@x.test' }) // getContact
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'other' }) // dup
+    await expect(svc.updateContact('c1' as never, { email: 'new@x.test' })).rejects.toThrow(
+      'already exists'
+    )
+  })
+  it('rejects an externalId taken by another contact', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c1', externalId: 'old' })
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'other' }) // externalId dup
+    await expect(svc.updateContact('c1' as never, { externalId: 'new' })).rejects.toThrow(
+      'externalId already in use'
+    )
+  })
+  it('updates all fields, diffs changes, fires updated, and re-links on email change', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c1', email: 'old@x.test', name: 'old' })
+    m.updateReturning.mockResolvedValueOnce([{ id: 'c1', email: 'new@x.test', name: 'New' }])
+    m.selectWhere.mockResolvedValueOnce([])
+    await svc.updateContact(
+      'c1' as never,
+      {
+        name: ' New ',
+        email: 'new@x.test',
+        phone: '1',
+        title: 't',
+        externalId: 'e',
+        organizationId: 'org_1' as never,
+        avatarUrl: 'a',
+        metadata: {} as never,
+      },
+      withP
+    )
+    expect(m.dUpdated).toHaveBeenCalled()
+  })
+  it('makes no changes when input is empty (uses existing, no event)', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c1', email: 'old@x.test', name: 'old' })
+    m.updateReturning.mockResolvedValueOnce([{ id: 'c1', email: 'old@x.test', name: 'old' }])
+    await svc.updateContact('c1' as never, {})
+    expect(m.dUpdated).not.toHaveBeenCalled()
+  })
+})
+
+describe('archive + getters', () => {
+  it('archives and fires when a row is returned', async () => {
+    await svc.archiveContact('c1' as never, withP)
+    expect(m.dArchived).toHaveBeenCalled()
+  })
+  it('does not fire when archive matched nothing', async () => {
+    m.updateReturning.mockResolvedValueOnce([])
+    await svc.archiveContact('c1' as never)
+    expect(m.dArchived).not.toHaveBeenCalled()
+  })
+  it('getContact returns null when missing', async () => {
+    expect(await svc.getContact('c1' as never)).toBeNull()
+  })
+  it('getContactByEmail returns null for an invalid email and a row otherwise', async () => {
+    expect(await svc.getContactByEmail('bad')).toBeNull()
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c1' })
+    expect(await svc.getContactByEmail('a@x.test')).toEqual({ id: 'c1' })
+  })
+})
+
+describe('search + list', () => {
+  it('listContactsForOrganization with and without archived', async () => {
+    m.selectWhere.mockResolvedValue([{ id: 'c1' }])
+    expect(await svc.listContactsForOrganization('org_1' as never)).toEqual([{ id: 'c1' }])
+    expect(
+      await svc.listContactsForOrganization('org_1' as never, {
+        includeArchived: true,
+        limit: 9999,
+        offset: -1,
+      })
+    ).toEqual([{ id: 'c1' }])
+  })
+  it('searchContacts applies all filters', async () => {
+    m.selectWhere.mockResolvedValueOnce([{ id: 'c1' }])
+    await svc.searchContacts({
+      email: 'a@x.test',
+      organizationId: 'org_1' as never,
+      query: ' jo ',
+      includeArchived: false,
+    })
+    // invalid email is skipped; no filters -> where undefined
+    m.selectWhere.mockResolvedValueOnce([])
+    await svc.searchContacts({ email: 'bad', includeArchived: true })
+  })
+})
+
+describe('findOrCreateByEmail', () => {
+  it('rejects an invalid email', async () => {
+    await expect(svc.findOrCreateByEmail({ email: 'bad' })).rejects.toThrow('is invalid')
+  })
+  it('returns an existing contact', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c_exist' })
+    expect(await svc.findOrCreateByEmail({ email: 'a@x.test' })).toEqual({ id: 'c_exist' })
+  })
+  it('creates a new contact and fires created', async () => {
+    const c = await svc.findOrCreateByEmail({ email: 'a@x.test', name: ' N ' })
+    expect(c).toEqual({ id: 'contact_1', email: 'a@x.test' })
+    expect(m.dCreated).toHaveBeenCalled()
+  })
+  it('recovers from an insert race by re-reading', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce(undefined) // initial getContactByEmail
+    m.insertReturning.mockRejectedValueOnce(new Error('unique violation'))
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c_race' }) // after
+    expect(await svc.findOrCreateByEmail({ email: 'a@x.test' })).toEqual({ id: 'c_race' })
+  })
+  it('rethrows when the race recovery also misses', async () => {
+    m.contactsFindFirst.mockResolvedValueOnce(undefined)
+    m.insertReturning.mockRejectedValueOnce(new Error('boom'))
+    m.contactsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.findOrCreateByEmail({ email: 'a@x.test' })).rejects.toThrow('boom')
+  })
+})
+
+describe('links', () => {
+  it('is idempotent when a link exists', async () => {
+    m.linksFindFirst.mockResolvedValueOnce({ id: 'existing' })
+    expect(
+      await svc.linkContactToUser({ contactId: 'c1' as never, userId: 'u1' as never })
+    ).toEqual({ id: 'existing' })
+    expect(m.insertReturning).not.toHaveBeenCalled()
+  })
+  it('creates a link and fires linked when the contact exists', async () => {
+    m.insertReturning.mockResolvedValueOnce([{ id: 'cul_new' }])
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c1' })
+    await svc.linkContactToUser(
+      { contactId: 'c1' as never, userId: 'u1' as never, linkedByPrincipalId: 'p1' as never },
+      withP
+    )
+    expect(m.dLinked).toHaveBeenCalled()
+  })
+  it('creates a link but skips the event when the contact is gone', async () => {
+    m.insertReturning.mockResolvedValueOnce([{ id: 'cul_new' }])
+    m.contactsFindFirst.mockResolvedValueOnce(undefined)
+    await svc.linkContactToUser({ contactId: 'c1' as never, userId: 'u1' as never })
+    expect(m.dLinked).not.toHaveBeenCalled()
+  })
+  it('unlink: no-op when nothing deleted, fires when deleted', async () => {
+    m.deleteReturning.mockResolvedValueOnce([])
+    await svc.unlinkContactFromUser('c1' as never, 'u1' as never)
+    expect(m.dUnlinked).not.toHaveBeenCalled()
+
+    m.deleteReturning.mockResolvedValueOnce([{ id: 'cul_1' }])
+    m.contactsFindFirst.mockResolvedValueOnce({ id: 'c1' })
+    await svc.unlinkContactFromUser('c1' as never, 'u1' as never)
+    expect(m.dUnlinked).toHaveBeenCalled()
+  })
+  it('unlinkById, listLinksForContact, listLinksForUser', async () => {
+    await svc.unlinkById('cul_1' as never)
+    expect(await svc.listLinksForContact('c1' as never)).toEqual([{ id: 'link_1' }])
+    expect(await svc.listLinksForUser('u1' as never)).toEqual([{ id: 'link_1' }])
+  })
+})
+
+describe('fireContactEvent edge cases', () => {
+  it('uses a service actor and swallows dispatch failures', async () => {
+    m.dCreated.mockRejectedValueOnce(new Error('boom'))
+    m.selectWhere.mockResolvedValueOnce([])
+    await svc.createContact({ name: 'N', email: 'a@x.test' }) // service actor (default)
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.events.test.ts b/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.events.test.ts
new file mode 100644
index 000000000..b12d32614
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.events.test.ts
@@ -0,0 +1,281 @@
+/**
+ * Phase 5: webhook dispatch from contact CRUD.
+ *
+ * Verifies that `createContact`, `updateContact`, `archiveContact`,
+ * `linkContactToUser`, `unlinkContactFromUser`, and `findOrCreateByEmail`
+ * fire the matching CRM dispatchers, that `contact.updated` carries the
+ * computed changedFields list, and that link/unlink only fire on actual
+ * insert / actual delete (not on idempotent hits / no-ops).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const contactFindFirstMock = vi.fn()
+const linkFindFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+const updateReturningMock = vi.fn()
+const deleteReturningMock = vi.fn()
+const selectWhereMock = vi.fn()
+
+const dispatchContactCreatedMock = vi.fn()
+const dispatchContactUpdatedMock = vi.fn()
+const dispatchContactArchivedMock = vi.fn()
+const dispatchContactLinkedMock = vi.fn()
+const dispatchContactUnlinkedMock = vi.fn()
+const buildEventActorMock = vi.fn((input: { principalId: string; userId?: string }) => ({
+  type: 'user' as const,
+  principalId: input.principalId,
+  userId: input.userId,
+  displayName: 'contacts-system',
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      contacts: { findFirst: contactFindFirstMock },
+      contactUserLinks: { findFirst: linkFindFirstMock, findMany: vi.fn() },
+    },
+    insert: vi.fn(() => ({
+      values: vi.fn().mockReturnThis(),
+      returning: insertReturningMock,
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn().mockReturnThis(),
+      where: vi.fn().mockReturnThis(),
+      returning: updateReturningMock,
+    })),
+    delete: vi.fn(() => ({
+      where: vi.fn().mockReturnThis(),
+      returning: deleteReturningMock,
+    })),
+    select: vi.fn(() => ({
+      from: vi.fn(() => ({
+        where: selectWhereMock,
+      })),
+    })),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  or: vi.fn(),
+  ilike: vi.fn(),
+  isNull: vi.fn(),
+  sql: vi.fn(),
+  asc: vi.fn(),
+  desc: vi.fn(),
+  user: {
+    id: 'user.id',
+    email: 'user.email',
+    emailVerified: 'user.email_verified',
+    isAnonymous: 'user.is_anonymous',
+  },
+  contacts: {
+    id: 'contacts.id',
+    email: 'contacts.email',
+    externalId: 'contacts.external_id',
+    organizationId: 'contacts.organization_id',
+    archivedAt: 'contacts.archived_at',
+    name: 'contacts.name',
+  },
+  contactUserLinks: {
+    id: 'contact_user_links.id',
+    contactId: 'contact_user_links.contact_id',
+    userId: 'contact_user_links.user_id',
+  },
+}))
+
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E }
+})
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchContactCreated: (...a: unknown[]) => dispatchContactCreatedMock(...a),
+  dispatchContactUpdated: (...a: unknown[]) => dispatchContactUpdatedMock(...a),
+  dispatchContactArchived: (...a: unknown[]) => dispatchContactArchivedMock(...a),
+  dispatchContactLinked: (...a: unknown[]) => dispatchContactLinkedMock(...a),
+  dispatchContactUnlinked: (...a: unknown[]) => dispatchContactUnlinkedMock(...a),
+  buildEventActor: (...a: unknown[]) =>
+    buildEventActorMock(...(a as [{ principalId: string; userId?: string }])),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  selectWhereMock.mockResolvedValue([])
+})
+
+const ACTOR = { principalId: 'principal_a' as never, userId: 'user_a' as never }
+
+const SAMPLE_CONTACT = {
+  id: 'contact_1',
+  name: 'Alice',
+  email: 'a@b.test',
+  phone: null,
+  title: null,
+  externalId: null,
+  organizationId: null,
+  avatarUrl: null,
+  metadata: {},
+  archivedAt: null,
+  createdAt: new Date('2025-01-01T00:00:00Z'),
+  updatedAt: new Date('2025-01-01T00:00:00Z'),
+}
+
+describe('contact.service events (Phase 5)', () => {
+  it('dispatches contact.created on create', async () => {
+    contactFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_CONTACT])
+
+    const { createContact } = await import('../contact.service')
+    await createContact({ email: 'a@b.test', name: 'Alice' }, ACTOR)
+
+    expect(dispatchContactCreatedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchContactCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'user', principalId: 'principal_a' }),
+      SAMPLE_CONTACT
+    )
+  })
+
+  it('dispatches contact.updated with computed changedFields', async () => {
+    contactFindFirstMock.mockResolvedValue(SAMPLE_CONTACT)
+    const updated = { ...SAMPLE_CONTACT, name: 'Alicia', title: 'Manager' }
+    updateReturningMock.mockResolvedValue([updated])
+
+    const { updateContact } = await import('../contact.service')
+    await updateContact('contact_1' as never, { name: 'Alicia', title: 'Manager' }, ACTOR)
+
+    expect(dispatchContactUpdatedMock).toHaveBeenCalledTimes(1)
+    const [, , changed] = dispatchContactUpdatedMock.mock.calls[0] as [unknown, unknown, string[]]
+    expect(changed.sort()).toEqual(['name', 'title'])
+  })
+
+  it('does not fire contact.updated when nothing changes', async () => {
+    contactFindFirstMock.mockResolvedValue(SAMPLE_CONTACT)
+    updateReturningMock.mockResolvedValue([SAMPLE_CONTACT])
+
+    const { updateContact } = await import('../contact.service')
+    await updateContact('contact_1' as never, { name: SAMPLE_CONTACT.name }, ACTOR)
+
+    expect(dispatchContactUpdatedMock).not.toHaveBeenCalled()
+  })
+
+  it('dispatches contact.archived on archive', async () => {
+    const archived = { ...SAMPLE_CONTACT, archivedAt: new Date('2025-02-01') }
+    updateReturningMock.mockResolvedValue([archived])
+
+    const { archiveContact } = await import('../contact.service')
+    await archiveContact('contact_1' as never, ACTOR)
+
+    expect(dispatchContactArchivedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchContactArchivedMock).toHaveBeenCalledWith(expect.any(Object), archived)
+  })
+
+  it('dispatches contact.linked only when a new link is inserted', async () => {
+    // No existing link → insert → fire
+    linkFindFirstMock.mockResolvedValueOnce(undefined)
+    insertReturningMock.mockResolvedValueOnce([
+      { id: 'cu_link_new', contactId: 'contact_1', userId: 'user_x' },
+    ])
+    contactFindFirstMock.mockResolvedValueOnce(SAMPLE_CONTACT)
+
+    const { linkContactToUser } = await import('../contact.service')
+    await linkContactToUser(
+      {
+        contactId: 'contact_1' as never,
+        userId: 'user_x' as never,
+        linkedByPrincipalId: 'principal_a' as never,
+      },
+      ACTOR
+    )
+
+    expect(dispatchContactLinkedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchContactLinkedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      SAMPLE_CONTACT,
+      'user_x',
+      'principal_a'
+    )
+  })
+
+  it('does NOT dispatch contact.linked on idempotent hit (existing link)', async () => {
+    linkFindFirstMock.mockResolvedValueOnce({
+      id: 'cu_link_existing',
+      contactId: 'contact_1',
+      userId: 'user_x',
+    })
+
+    const { linkContactToUser } = await import('../contact.service')
+    await linkContactToUser({ contactId: 'contact_1' as never, userId: 'user_x' as never }, ACTOR)
+
+    expect(dispatchContactLinkedMock).not.toHaveBeenCalled()
+  })
+
+  it('dispatches contact.unlinked on actual delete', async () => {
+    deleteReturningMock.mockResolvedValueOnce([{ id: 'cu_link_old' }])
+    contactFindFirstMock.mockResolvedValueOnce(SAMPLE_CONTACT)
+
+    const { unlinkContactFromUser } = await import('../contact.service')
+    await unlinkContactFromUser('contact_1' as never, 'user_x' as never, ACTOR)
+
+    expect(dispatchContactUnlinkedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchContactUnlinkedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      SAMPLE_CONTACT,
+      'user_x'
+    )
+  })
+
+  it('does NOT dispatch contact.unlinked when no row was deleted', async () => {
+    deleteReturningMock.mockResolvedValueOnce([])
+
+    const { unlinkContactFromUser } = await import('../contact.service')
+    await unlinkContactFromUser('contact_1' as never, 'user_x' as never, ACTOR)
+
+    expect(dispatchContactUnlinkedMock).not.toHaveBeenCalled()
+  })
+
+  it('findOrCreateByEmail fires contact.created only on miss', async () => {
+    // Hit branch: no fire
+    contactFindFirstMock.mockResolvedValueOnce(SAMPLE_CONTACT)
+    const { findOrCreateByEmail } = await import('../contact.service')
+    await findOrCreateByEmail({ email: 'a@b.test' }, ACTOR)
+    expect(dispatchContactCreatedMock).not.toHaveBeenCalled()
+
+    // Miss branch: fire once
+    contactFindFirstMock.mockResolvedValueOnce(undefined)
+    insertReturningMock.mockResolvedValueOnce([SAMPLE_CONTACT])
+    await findOrCreateByEmail({ email: 'a@b.test' }, ACTOR)
+    expect(dispatchContactCreatedMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('uses service actor when principalId is null', async () => {
+    contactFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_CONTACT])
+
+    const { createContact } = await import('../contact.service')
+    await createContact({ email: 'a@b.test' }, { principalId: null })
+
+    expect(dispatchContactCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'service', displayName: 'contacts-system' }),
+      SAMPLE_CONTACT
+    )
+  })
+
+  it('swallows dispatcher errors', async () => {
+    contactFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_CONTACT])
+    dispatchContactCreatedMock.mockRejectedValueOnce(new Error('hook boom'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const { createContact } = await import('../contact.service')
+    const result = await createContact({ email: 'a@b.test' }, ACTOR)
+
+    expect(result).toEqual(SAMPLE_CONTACT)
+    expect(warnSpy).toHaveBeenCalled()
+    warnSpy.mockRestore()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.test.ts b/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.test.ts
new file mode 100644
index 000000000..757d607ad
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/__tests__/contact.service.test.ts
@@ -0,0 +1,269 @@
+/**
+ * Focused unit tests for contact.service exercising validation, email
+ * normalisation, dedupe, and link idempotency.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const contactFindFirstMock = vi.fn()
+const linkFindFirstMock = vi.fn()
+const linkFindManyMock = vi.fn()
+const insertReturningMock = vi.fn()
+const selectWhereMock = vi.fn()
+const selectFromMock = vi.fn(() => ({ where: selectWhereMock }))
+const selectMock = vi.fn<() => unknown>(() => ({ from: selectFromMock }))
+
+vi.mock('@/lib/server/db', () => {
+  const insertChain = {
+    values: vi.fn().mockReturnThis(),
+    returning: insertReturningMock,
+  }
+  return {
+    db: {
+      query: {
+        contacts: { findFirst: contactFindFirstMock },
+        contactUserLinks: { findFirst: linkFindFirstMock, findMany: linkFindManyMock },
+      },
+      insert: vi.fn(() => insertChain),
+      update: vi.fn(() => ({
+        set: vi.fn().mockReturnThis(),
+        where: vi.fn().mockReturnThis(),
+        returning: vi.fn(),
+      })),
+      delete: vi.fn(() => ({ where: vi.fn() })),
+      select: selectMock,
+    },
+    eq: vi.fn(),
+    and: vi.fn(),
+    or: vi.fn(),
+    ilike: vi.fn(),
+    isNull: vi.fn(),
+    sql: vi.fn(),
+    asc: vi.fn(),
+    desc: vi.fn(),
+    user: {
+      id: 'user.id',
+      email: 'user.email',
+      emailVerified: 'user.email_verified',
+      isAnonymous: 'user.is_anonymous',
+    },
+    contacts: {
+      id: 'contacts.id',
+      email: 'contacts.email',
+      externalId: 'contacts.external_id',
+      organizationId: 'contacts.organization_id',
+      archivedAt: 'contacts.archived_at',
+      name: 'contacts.name',
+    },
+    contactUserLinks: {
+      id: 'contact_user_links.id',
+      contactId: 'contact_user_links.contact_id',
+      userId: 'contact_user_links.user_id',
+    },
+  }
+})
+
+vi.mock('@/lib/shared/errors', () => ({
+  ConflictError: class extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  },
+  NotFoundError: class extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  },
+  ValidationError: class extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  },
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  contactFindFirstMock.mockReset()
+  linkFindFirstMock.mockReset()
+  linkFindManyMock.mockReset()
+  insertReturningMock.mockReset()
+  selectMock.mockClear()
+  selectFromMock.mockClear()
+  selectWhereMock.mockReset()
+})
+
+function makeListChain(rows: unknown[]) {
+  const promise = Promise.resolve(rows)
+  const chain = {
+    from: vi.fn(() => chain),
+    where: vi.fn(() => chain),
+    orderBy: vi.fn(() => chain),
+    limit: vi.fn(() => chain),
+    offset: vi.fn(() => chain),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  }
+  return chain
+}
+
+describe('createContact', () => {
+  it('rejects when neither name nor email is provided', async () => {
+    const { createContact } = await import('../contact.service')
+    await expect(createContact({})).rejects.toThrow(/name or email/i)
+  })
+
+  it('rejects when email is malformed', async () => {
+    const { createContact } = await import('../contact.service')
+    await expect(createContact({ name: 'Bob', email: 'not-an-email' })).rejects.toThrow(/invalid/i)
+  })
+
+  it('throws ConflictError when email already exists', async () => {
+    contactFindFirstMock.mockResolvedValueOnce({ id: 'contact_x', email: 'a@b.com' })
+    const { createContact } = await import('../contact.service')
+    await expect(createContact({ email: 'A@B.com' })).rejects.toThrow(/already exists/i)
+  })
+
+  it('inserts with normalised email on success', async () => {
+    contactFindFirstMock.mockResolvedValue(undefined)
+    selectWhereMock.mockResolvedValueOnce([])
+    insertReturningMock.mockResolvedValueOnce([{ id: 'contact_new', email: 'a@b.com' }])
+    const { createContact } = await import('../contact.service')
+    const result = await createContact({ email: 'A@B.COM' })
+    expect(result.id).toBe('contact_new')
+  })
+
+  it('links matching verified portal users after contact creation', async () => {
+    contactFindFirstMock.mockResolvedValue(undefined)
+    selectWhereMock.mockResolvedValueOnce([{ id: 'user_verified' }])
+    linkFindFirstMock.mockResolvedValueOnce(undefined)
+    insertReturningMock
+      .mockResolvedValueOnce([{ id: 'contact_new', email: 'a@b.com', archivedAt: null }])
+      .mockResolvedValueOnce([
+        { id: 'cu_link_new', contactId: 'contact_new', userId: 'user_verified' },
+      ])
+
+    const { createContact } = await import('../contact.service')
+    await createContact({ email: 'A@B.COM' })
+
+    expect(selectMock).toHaveBeenCalled()
+    expect(selectWhereMock).toHaveBeenCalled()
+    expect(linkFindFirstMock).toHaveBeenCalled()
+    expect(insertReturningMock).toHaveBeenCalledTimes(2)
+  })
+})
+
+describe('findOrCreateByEmail', () => {
+  it('returns existing contact when email matches', async () => {
+    contactFindFirstMock.mockResolvedValueOnce({ id: 'contact_existing', email: 'a@b.com' })
+    const { findOrCreateByEmail } = await import('../contact.service')
+    const result = await findOrCreateByEmail({ email: 'A@B.com' })
+    expect(result.id).toBe('contact_existing')
+  })
+
+  it('creates a new contact when no match', async () => {
+    contactFindFirstMock.mockResolvedValueOnce(undefined)
+    selectWhereMock.mockResolvedValueOnce([])
+    insertReturningMock.mockResolvedValueOnce([{ id: 'contact_new', email: 'a@b.com' }])
+    const { findOrCreateByEmail } = await import('../contact.service')
+    const result = await findOrCreateByEmail({ email: 'a@b.com' })
+    expect(result.id).toBe('contact_new')
+  })
+
+  it('rejects invalid email', async () => {
+    const { findOrCreateByEmail } = await import('../contact.service')
+    await expect(findOrCreateByEmail({ email: 'garbage' })).rejects.toThrow(/invalid/i)
+  })
+})
+
+describe('contact list and search queries', () => {
+  it('lists contacts for an organization with capped limits and clamped offsets', async () => {
+    const rows = [{ id: 'contact_1', organizationId: 'org_1' }]
+    const chain = makeListChain(rows)
+    selectMock.mockReturnValueOnce(chain)
+
+    const { listContactsForOrganization } = await import('../contact.service')
+    await expect(
+      listContactsForOrganization('org_1' as never, { limit: 500, offset: -10 })
+    ).resolves.toEqual(rows)
+
+    expect(chain.limit).toHaveBeenCalledWith(200)
+    expect(chain.offset).toHaveBeenCalledWith(0)
+  })
+
+  it('searches contacts with optional email, organization, text, and archived filters', async () => {
+    const rows = [{ id: 'contact_1', email: 'a@b.com' }]
+    const filteredChain = makeListChain(rows)
+    selectMock.mockReturnValueOnce(filteredChain)
+
+    const { searchContacts } = await import('../contact.service')
+    await expect(
+      searchContacts({
+        email: ' A@B.COM ',
+        organizationId: 'org_1' as never,
+        query: ' Alice ',
+        limit: 150,
+        offset: -1,
+      })
+    ).resolves.toEqual(rows)
+
+    expect(filteredChain.limit).toHaveBeenCalledWith(100)
+    expect(filteredChain.offset).toHaveBeenCalledWith(0)
+
+    const unfilteredChain = makeListChain([])
+    selectMock.mockReturnValueOnce(unfilteredChain)
+    await expect(searchContacts({ includeArchived: true })).resolves.toEqual([])
+    expect(unfilteredChain.where).toHaveBeenCalledWith(undefined)
+  })
+})
+
+describe('linkContactToUser', () => {
+  it('returns existing link when one is present (idempotent)', async () => {
+    linkFindFirstMock.mockResolvedValueOnce({
+      id: 'cu_link_existing',
+      contactId: 'contact_x',
+      userId: 'user_x',
+    })
+    const { linkContactToUser } = await import('../contact.service')
+    const result = await linkContactToUser({
+      contactId: 'contact_x' as never,
+      userId: 'user_x' as never,
+    })
+    expect(result.id).toBe('cu_link_existing')
+  })
+
+  it('creates a new link when none exists', async () => {
+    linkFindFirstMock.mockResolvedValueOnce(undefined)
+    insertReturningMock.mockResolvedValueOnce([
+      { id: 'cu_link_new', contactId: 'contact_x', userId: 'user_x' },
+    ])
+    const { linkContactToUser } = await import('../contact.service')
+    const result = await linkContactToUser({
+      contactId: 'contact_x' as never,
+      userId: 'user_x' as never,
+    })
+    expect(result.id).toBe('cu_link_new')
+  })
+})
+
+describe('contact-user link helpers', () => {
+  it('unlinks by link id and lists links by contact or user', async () => {
+    linkFindManyMock
+      .mockResolvedValueOnce([{ id: 'link_contact', contactId: 'contact_x' }])
+      .mockResolvedValueOnce([{ id: 'link_user', userId: 'user_x' }])
+
+    const { unlinkById, listLinksForContact, listLinksForUser } = await import('../contact.service')
+    await expect(unlinkById('link_1' as never)).resolves.toBeUndefined()
+    await expect(listLinksForContact('contact_x' as never)).resolves.toEqual([
+      { id: 'link_contact', contactId: 'contact_x' },
+    ])
+    await expect(listLinksForUser('user_x' as never)).resolves.toEqual([
+      { id: 'link_user', userId: 'user_x' },
+    ])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/organizations/__tests__/normalize.test.ts b/apps/web/src/lib/server/domains/organizations/__tests__/normalize.test.ts
new file mode 100644
index 000000000..e0a499ed2
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/__tests__/normalize.test.ts
@@ -0,0 +1,67 @@
+import { describe, it, expect } from 'vitest'
+import { normalizeEmail, normalizeDomain, parseDomainFromEmail } from '../normalize'
+
+const at = '@'
+const mk = (local: string, domain: string) => `${local}${at}${domain}`
+
+describe('normalizeEmail', () => {
+  it('lowercases and trims', () => {
+    expect(normalizeEmail('  ' + mk('Foo', 'Acme.COM') + '  ')).toBe(mk('foo', 'acme.com'))
+  })
+  it('returns null for empty/null', () => {
+    expect(normalizeEmail('')).toBe(null)
+    expect(normalizeEmail(null)).toBe(null)
+    expect(normalizeEmail(undefined)).toBe(null)
+  })
+  it('strips mailto: prefix', () => {
+    expect(normalizeEmail('MAILTO:' + mk('a', 'b.com'))).toBe(mk('a', 'b.com'))
+  })
+  it('strips angle brackets', () => {
+    expect(normalizeEmail('<' + mk('a', 'b.com') + '>')).toBe(mk('a', 'b.com'))
+  })
+  it('preserves plus-aliases (does not strip identity)', () => {
+    expect(normalizeEmail(mk('user+work', 'acme.com'))).toBe(mk('user+work', 'acme.com'))
+  })
+  it('rejects malformed addresses', () => {
+    expect(normalizeEmail('not-an-email')).toBe(null)
+    expect(normalizeEmail(at + 'nodomain.com')).toBe(null)
+    expect(normalizeEmail('local' + at)).toBe(null)
+    expect(normalizeEmail(mk('local', 'nope'))).toBe(null)
+  })
+})
+
+describe('normalizeDomain', () => {
+  it('lowercases bare domains', () => {
+    expect(normalizeDomain('ACME.COM')).toBe('acme.com')
+  })
+  it('strips protocol, path, query, port', () => {
+    expect(normalizeDomain('https://acme.com/foo?bar=1')).toBe('acme.com')
+    expect(normalizeDomain('http://acme.com:8080')).toBe('acme.com')
+  })
+  it('strips leading and trailing dots', () => {
+    expect(normalizeDomain('.acme.com.')).toBe('acme.com')
+    expect(normalizeDomain('acme.com..')).toBe('acme.com')
+  })
+  it('rejects bare hostnames without a dot', () => {
+    expect(normalizeDomain('localhost')).toBe(null)
+  })
+  it('rejects empty/invalid characters', () => {
+    expect(normalizeDomain('')).toBe(null)
+    expect(normalizeDomain(null)).toBe(null)
+    expect(normalizeDomain('not a domain')).toBe(null)
+    expect(normalizeDomain('weird' + at + 'chars.com')).toBe(null)
+  })
+})
+
+describe('parseDomainFromEmail', () => {
+  it('returns the domain portion lowercased', () => {
+    expect(parseDomainFromEmail(mk('Foo', 'Acme.COM'))).toBe('acme.com')
+  })
+  it('returns null when the email is invalid', () => {
+    expect(parseDomainFromEmail('garbage')).toBe(null)
+    expect(parseDomainFromEmail(null)).toBe(null)
+  })
+  it('handles plus-aliases without affecting domain extraction', () => {
+    expect(parseDomainFromEmail(mk('user+work', 'acme.com'))).toBe('acme.com')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.diffcov.test.ts b/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.diffcov.test.ts
new file mode 100644
index 000000000..5202e8c78
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.diffcov.test.ts
@@ -0,0 +1,252 @@
+/**
+ * Differential-coverage tests for organization.service — create/update
+ * validation + dup checks, the field-by-field update ternaries + changed-field
+ * diff, fireOrganizationEvent (actor + kind + failure), archive/unarchive,
+ * list filters, and findOrCreateByDomain race recovery.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  orgFindFirst: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  selectWhere: vi.fn(),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({
+    type: 'principal',
+    displayName: 'organizations-system',
+  })),
+  dCreated: vi.fn(),
+  dUpdated: vi.fn(),
+  dArchived: vi.fn(),
+  dUnarchived: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: { organizations: { findFirst: m.orgFindFirst } },
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({ set: () => ({ where: () => ({ returning: m.updateReturning }) }) }),
+    select: () => {
+      const tail: Record<string, unknown> = {
+        orderBy: () => tail,
+        limit: () => tail,
+        offset: () => m.selectWhere(),
+        then: (resolve: (v: unknown) => void) => resolve(m.selectWhere()),
+      }
+      return { from: () => ({ where: () => tail }) }
+    },
+  },
+  eq: vi.fn((a, b) => ({ eq: [a, b] })),
+  and: vi.fn((...a) => ({ and: a })),
+  isNull: vi.fn((a) => ({ isNull: a })),
+  ilike: vi.fn(),
+  or: vi.fn((...a) => ({ or: a })),
+  asc: vi.fn(),
+  desc: vi.fn(),
+  organizations: {
+    id: 'o.id',
+    domain: 'o.domain',
+    externalId: 'o.externalId',
+    name: 'o.name',
+    archivedAt: 'o.archivedAt',
+    createdAt: 'o.createdAt',
+  },
+}))
+
+vi.mock('../normalize', () => ({
+  normalizeDomain: (d: unknown) =>
+    typeof d === 'string' && d.includes('.') ? d.trim().toLowerCase() : '',
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchOrganizationCreated: (...a: unknown[]) => m.dCreated(...a),
+  dispatchOrganizationUpdated: (...a: unknown[]) => m.dUpdated(...a),
+  dispatchOrganizationArchived: (...a: unknown[]) => m.dArchived(...a),
+  dispatchOrganizationUnarchived: (...a: unknown[]) => m.dUnarchived(...a),
+}))
+
+import * as svc from '../organization.service'
+
+const withP = { principalId: 'p1' as never, userId: 'u1' as never }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.orgFindFirst.mockResolvedValue(undefined)
+  m.insertReturning.mockResolvedValue([{ id: 'org_1', name: 'Acme' }])
+  m.updateReturning.mockResolvedValue([{ id: 'org_1' }])
+  m.selectWhere.mockResolvedValue([{ id: 'org_1' }])
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('createOrganization', () => {
+  it('requires a name', async () => {
+    await expect(svc.createOrganization({ name: '  ' })).rejects.toThrow('name is required')
+  })
+  it('rejects an over-long name', async () => {
+    await expect(svc.createOrganization({ name: 'x'.repeat(201) })).rejects.toThrow('exceeds')
+  })
+  it('rejects an invalid domain', async () => {
+    await expect(svc.createOrganization({ name: 'N', domain: 'nodot' })).rejects.toThrow(
+      'domain is invalid'
+    )
+  })
+  it('rejects a duplicate domain', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'dup' })
+    await expect(svc.createOrganization({ name: 'N', domain: 'acme.com' })).rejects.toThrow(
+      'already exists'
+    )
+  })
+  it('rejects a duplicate externalId', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'dup' }) // externalId check (no domain)
+    await expect(svc.createOrganization({ name: 'N', externalId: 'ext' })).rejects.toThrow(
+      'externalId already in use'
+    )
+  })
+  it('creates and fires created (service actor)', async () => {
+    const o = await svc.createOrganization({
+      name: ' Acme ',
+      domain: 'acme.com',
+      website: 'w',
+      notes: 'n',
+    })
+    expect(o).toEqual({ id: 'org_1', name: 'Acme' })
+    expect(m.dCreated).toHaveBeenCalled()
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+  })
+})
+
+describe('updateOrganization', () => {
+  it('throws when missing', async () => {
+    m.orgFindFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.updateOrganization('o1' as never, { name: 'x' })).rejects.toThrow('not found')
+  })
+  it('rejects an invalid domain', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o1', domain: 'old.com' })
+    await expect(svc.updateOrganization('o1' as never, { domain: 'bad' })).rejects.toThrow(
+      'domain is invalid'
+    )
+  })
+  it('rejects a domain taken by another org', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o1', domain: 'old.com' })
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'other' })
+    await expect(svc.updateOrganization('o1' as never, { domain: 'new.com' })).rejects.toThrow(
+      'already exists'
+    )
+  })
+  it('rejects an externalId taken by another org', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o1', externalId: 'old' })
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'other' })
+    await expect(svc.updateOrganization('o1' as never, { externalId: 'new' })).rejects.toThrow(
+      'externalId already in use'
+    )
+  })
+  it('rejects an over-long name', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o1' })
+    await expect(svc.updateOrganization('o1' as never, { name: 'x'.repeat(201) })).rejects.toThrow(
+      'exceeds'
+    )
+  })
+  it('updates all fields, diffs changes, and fires updated', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o1', domain: 'old.com', name: 'old' })
+    m.updateReturning.mockResolvedValueOnce([
+      { id: 'o1', domain: 'new.com', name: 'New', externalId: 'e', website: 'w', notes: 'n' },
+    ])
+    await svc.updateOrganization(
+      'o1' as never,
+      {
+        name: ' New ',
+        domain: 'new.com',
+        externalId: 'e',
+        website: 'w',
+        notes: 'n',
+        metadata: {} as never,
+      },
+      withP
+    )
+    expect(m.dUpdated).toHaveBeenCalled()
+    expect(m.buildEventActor).toHaveBeenCalled()
+  })
+  it('makes no changes for empty input (no event)', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o1', name: 'old', domain: 'old.com' })
+    m.updateReturning.mockResolvedValueOnce([{ id: 'o1', name: 'old', domain: 'old.com' }])
+    await svc.updateOrganization('o1' as never, {})
+    expect(m.dUpdated).not.toHaveBeenCalled()
+  })
+})
+
+describe('archive / unarchive + getters', () => {
+  it('archive fires when a row is returned, not when empty', async () => {
+    await svc.archiveOrganization('o1' as never, withP)
+    expect(m.dArchived).toHaveBeenCalled()
+    m.updateReturning.mockResolvedValueOnce([])
+    await svc.archiveOrganization('o1' as never)
+    expect(m.dArchived).toHaveBeenCalledTimes(1)
+  })
+  it('unarchive fires when a row is returned, not when empty', async () => {
+    await svc.unarchiveOrganization('o1' as never)
+    expect(m.dUnarchived).toHaveBeenCalled()
+    m.updateReturning.mockResolvedValueOnce([])
+    await svc.unarchiveOrganization('o1' as never)
+    expect(m.dUnarchived).toHaveBeenCalledTimes(1)
+  })
+  it('getOrganization returns null when missing', async () => {
+    expect(await svc.getOrganization('o1' as never)).toBeNull()
+  })
+  it('getOrganizationByDomain: null for invalid, row for valid', async () => {
+    expect(await svc.getOrganizationByDomain('bad')).toBeNull()
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o1' })
+    expect(await svc.getOrganizationByDomain('acme.com')).toEqual({ id: 'o1' })
+  })
+})
+
+describe('listOrganizations', () => {
+  it('applies search + active filter and default sort', async () => {
+    expect(
+      await svc.listOrganizations({
+        search: ' acme ',
+        includeArchived: false,
+        limit: 9999,
+        offset: -1,
+      })
+    ).toEqual([{ id: 'org_1' }])
+  })
+  it('runs with no filters (includeArchived true, where undefined)', async () => {
+    expect(await svc.listOrganizations({ includeArchived: true })).toEqual([{ id: 'org_1' }])
+  })
+})
+
+describe('findOrCreateByDomain', () => {
+  it('rejects an invalid domain', async () => {
+    await expect(svc.findOrCreateByDomain('bad')).rejects.toThrow('is invalid')
+  })
+  it('returns an existing org', async () => {
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o_exist' })
+    expect(await svc.findOrCreateByDomain('acme.com')).toEqual({ id: 'o_exist' })
+  })
+  it('creates with a fallback name and fires created', async () => {
+    const o = await svc.findOrCreateByDomain('acme.com', ' Acme Inc ')
+    expect(o).toEqual({ id: 'org_1', name: 'Acme' })
+    expect(m.dCreated).toHaveBeenCalled()
+  })
+  it('recovers from an insert race', async () => {
+    m.orgFindFirst.mockResolvedValueOnce(undefined) // initial lookup
+    m.insertReturning.mockRejectedValueOnce(new Error('unique violation'))
+    m.orgFindFirst.mockResolvedValueOnce({ id: 'o_race' }) // after
+    expect(await svc.findOrCreateByDomain('acme.com')).toEqual({ id: 'o_race' })
+  })
+  it('rethrows when recovery also misses', async () => {
+    m.orgFindFirst.mockResolvedValueOnce(undefined)
+    m.insertReturning.mockRejectedValueOnce(new Error('boom'))
+    m.orgFindFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.findOrCreateByDomain('acme.com')).rejects.toThrow('boom')
+  })
+})
+
+describe('fireOrganizationEvent failure', () => {
+  it('swallows dispatch errors', async () => {
+    m.dCreated.mockRejectedValueOnce(new Error('boom'))
+    await svc.createOrganization({ name: 'N' })
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.events.test.ts b/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.events.test.ts
new file mode 100644
index 000000000..cf0832af9
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.events.test.ts
@@ -0,0 +1,191 @@
+/**
+ * Phase 5: webhook dispatch from organization CRUD.
+ *
+ * Verifies created / updated (with computed changedFields) / archived /
+ * unarchived dispatchers fire from the right service entry points, and
+ * that `findOrCreateByDomain` only fires on miss (not on hit).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const orgFindFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+const updateReturningMock = vi.fn()
+
+const dispatchOrganizationCreatedMock = vi.fn()
+const dispatchOrganizationUpdatedMock = vi.fn()
+const dispatchOrganizationArchivedMock = vi.fn()
+const dispatchOrganizationUnarchivedMock = vi.fn()
+const buildEventActorMock = vi.fn((input: { principalId: string; userId?: string }) => ({
+  type: 'user' as const,
+  principalId: input.principalId,
+  userId: input.userId,
+  displayName: 'organizations-system',
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      organizations: { findFirst: orgFindFirstMock },
+    },
+    insert: vi.fn(() => ({
+      values: vi.fn().mockReturnThis(),
+      returning: insertReturningMock,
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn().mockReturnThis(),
+      where: vi.fn().mockReturnThis(),
+      returning: updateReturningMock,
+    })),
+    select: vi.fn(),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  or: vi.fn(),
+  ilike: vi.fn(),
+  isNull: vi.fn(),
+  asc: vi.fn(),
+  desc: vi.fn(),
+  organizations: {
+    id: 'organizations.id',
+    domain: 'organizations.domain',
+    externalId: 'organizations.external_id',
+    archivedAt: 'organizations.archived_at',
+    name: 'organizations.name',
+  },
+}))
+
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E }
+})
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchOrganizationCreated: (...a: unknown[]) => dispatchOrganizationCreatedMock(...a),
+  dispatchOrganizationUpdated: (...a: unknown[]) => dispatchOrganizationUpdatedMock(...a),
+  dispatchOrganizationArchived: (...a: unknown[]) => dispatchOrganizationArchivedMock(...a),
+  dispatchOrganizationUnarchived: (...a: unknown[]) => dispatchOrganizationUnarchivedMock(...a),
+  buildEventActor: (...a: unknown[]) =>
+    buildEventActorMock(...(a as [{ principalId: string; userId?: string }])),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+const ACTOR = { principalId: 'principal_a' as never, userId: 'user_a' as never }
+
+const SAMPLE_ORG = {
+  id: 'org_1',
+  name: 'Acme',
+  domain: 'acme.com',
+  externalId: null,
+  website: null,
+  notes: null,
+  metadata: {},
+  archivedAt: null,
+  createdAt: new Date('2025-01-01T00:00:00Z'),
+  updatedAt: new Date('2025-01-01T00:00:00Z'),
+}
+
+describe('organization.service events (Phase 5)', () => {
+  it('dispatches organization.created on create', async () => {
+    orgFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_ORG])
+
+    const { createOrganization } = await import('../organization.service')
+    await createOrganization({ name: 'Acme', domain: 'acme.com' }, ACTOR)
+
+    expect(dispatchOrganizationCreatedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchOrganizationCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'user', principalId: 'principal_a' }),
+      SAMPLE_ORG
+    )
+  })
+
+  it('dispatches organization.updated with computed changedFields', async () => {
+    orgFindFirstMock.mockResolvedValue(SAMPLE_ORG)
+    const updated = { ...SAMPLE_ORG, name: 'Acme Inc.', website: 'https://acme.com' }
+    updateReturningMock.mockResolvedValue([updated])
+
+    const { updateOrganization } = await import('../organization.service')
+    await updateOrganization(
+      'org_1' as never,
+      { name: 'Acme Inc.', website: 'https://acme.com' },
+      ACTOR
+    )
+
+    expect(dispatchOrganizationUpdatedMock).toHaveBeenCalledTimes(1)
+    const [, , changed] = dispatchOrganizationUpdatedMock.mock.calls[0] as [
+      unknown,
+      unknown,
+      string[],
+    ]
+    expect(changed.sort()).toEqual(['name', 'website'])
+  })
+
+  it('does not fire organization.updated when nothing changes', async () => {
+    orgFindFirstMock.mockResolvedValue(SAMPLE_ORG)
+    updateReturningMock.mockResolvedValue([SAMPLE_ORG])
+
+    const { updateOrganization } = await import('../organization.service')
+    await updateOrganization('org_1' as never, { name: SAMPLE_ORG.name }, ACTOR)
+
+    expect(dispatchOrganizationUpdatedMock).not.toHaveBeenCalled()
+  })
+
+  it('dispatches organization.archived on archive', async () => {
+    const archived = { ...SAMPLE_ORG, archivedAt: new Date('2025-02-01') }
+    updateReturningMock.mockResolvedValue([archived])
+
+    const { archiveOrganization } = await import('../organization.service')
+    await archiveOrganization('org_1' as never, ACTOR)
+
+    expect(dispatchOrganizationArchivedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchOrganizationArchivedMock).toHaveBeenCalledWith(expect.any(Object), archived)
+  })
+
+  it('dispatches organization.unarchived on unarchive', async () => {
+    const restored = { ...SAMPLE_ORG, archivedAt: null }
+    updateReturningMock.mockResolvedValue([restored])
+
+    const { unarchiveOrganization } = await import('../organization.service')
+    await unarchiveOrganization('org_1' as never, ACTOR)
+
+    expect(dispatchOrganizationUnarchivedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchOrganizationUnarchivedMock).toHaveBeenCalledWith(expect.any(Object), restored)
+    expect(dispatchOrganizationArchivedMock).not.toHaveBeenCalled()
+  })
+
+  it('findOrCreateByDomain fires organization.created only on miss', async () => {
+    // Hit branch: no fire
+    orgFindFirstMock.mockResolvedValueOnce(SAMPLE_ORG)
+    const { findOrCreateByDomain } = await import('../organization.service')
+    await findOrCreateByDomain('acme.com', undefined, ACTOR)
+    expect(dispatchOrganizationCreatedMock).not.toHaveBeenCalled()
+
+    // Miss branch: fire once
+    orgFindFirstMock.mockResolvedValueOnce(undefined)
+    insertReturningMock.mockResolvedValueOnce([SAMPLE_ORG])
+    await findOrCreateByDomain('acme.com', undefined, ACTOR)
+    expect(dispatchOrganizationCreatedMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('uses service actor when principalId is null', async () => {
+    orgFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_ORG])
+
+    const { createOrganization } = await import('../organization.service')
+    await createOrganization({ name: 'Acme' }, { principalId: null })
+
+    expect(dispatchOrganizationCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'service', displayName: 'organizations-system' }),
+      SAMPLE_ORG
+    )
+  })
+})
diff --git a/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.test.ts b/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.test.ts
new file mode 100644
index 000000000..40f9f6ff8
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/__tests__/organization.service.test.ts
@@ -0,0 +1,170 @@
+/**
+ * Focused unit tests for organization.service that exercise validation and
+ * dedupe paths. Heavy-chained query mocks are avoided — those paths are
+ * covered by integration tests later in the rollout.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const findFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+const updateReturningMock = vi.fn()
+const selectMock = vi.fn()
+
+vi.mock('@/lib/server/db', () => {
+  const insertChain = {
+    values: vi.fn().mockReturnThis(),
+    returning: insertReturningMock,
+  }
+  const updateChain = {
+    set: vi.fn().mockReturnThis(),
+    where: vi.fn().mockReturnThis(),
+    returning: updateReturningMock,
+  }
+  return {
+    db: {
+      query: { organizations: { findFirst: findFirstMock } },
+      insert: vi.fn(() => insertChain),
+      update: vi.fn(() => updateChain),
+      select: selectMock,
+    },
+    eq: vi.fn(),
+    and: vi.fn(),
+    or: vi.fn(),
+    ilike: vi.fn(),
+    isNull: vi.fn(),
+    asc: vi.fn(),
+    desc: vi.fn(),
+    organizations: {
+      id: 'organizations.id',
+      domain: 'organizations.domain',
+      externalId: 'organizations.external_id',
+    },
+  }
+})
+
+vi.mock('@/lib/shared/errors', () => ({
+  ConflictError: class extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  },
+  NotFoundError: class extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  },
+  ValidationError: class extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  },
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  findFirstMock.mockReset()
+  insertReturningMock.mockReset()
+  updateReturningMock.mockReset()
+  selectMock.mockReset()
+})
+
+function makeListChain(rows: unknown[]) {
+  const promise = Promise.resolve(rows)
+  const chain = {
+    from: vi.fn(() => chain),
+    where: vi.fn(() => chain),
+    orderBy: vi.fn(() => chain),
+    limit: vi.fn(() => chain),
+    offset: vi.fn(() => chain),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  }
+  return chain
+}
+
+describe('createOrganization', () => {
+  it('throws ValidationError when name is empty', async () => {
+    const { createOrganization } = await import('../organization.service')
+    await expect(createOrganization({ name: '   ' })).rejects.toThrow(/name is required/i)
+  })
+
+  it('throws ValidationError when domain is malformed', async () => {
+    const { createOrganization } = await import('../organization.service')
+    await expect(createOrganization({ name: 'Acme', domain: 'not a domain' })).rejects.toThrow(
+      /domain is invalid/i
+    )
+  })
+
+  it('throws ConflictError when domain already exists', async () => {
+    findFirstMock.mockResolvedValueOnce({ id: 'org_existing', domain: 'acme.com' })
+    const { createOrganization } = await import('../organization.service')
+    await expect(createOrganization({ name: 'Acme', domain: 'ACME.com' })).rejects.toThrow(
+      /already exists/i
+    )
+  })
+
+  it('inserts with normalised domain on success', async () => {
+    findFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValueOnce([{ id: 'org_new', name: 'Acme', domain: 'acme.com' }])
+    const { createOrganization } = await import('../organization.service')
+    const result = await createOrganization({ name: '  Acme  ', domain: 'ACME.COM' })
+    expect(result.id).toBe('org_new')
+  })
+})
+
+describe('findOrCreateByDomain', () => {
+  it('returns the existing organization when one matches', async () => {
+    findFirstMock.mockResolvedValueOnce({ id: 'org_existing', domain: 'acme.com' })
+    const { findOrCreateByDomain } = await import('../organization.service')
+    const result = await findOrCreateByDomain('https://ACME.com/')
+    expect(result.id).toBe('org_existing')
+  })
+
+  it('inserts a new organization when none exists', async () => {
+    findFirstMock.mockResolvedValueOnce(undefined)
+    insertReturningMock.mockResolvedValueOnce([
+      { id: 'org_new', domain: 'acme.com', name: 'acme.com' },
+    ])
+    const { findOrCreateByDomain } = await import('../organization.service')
+    const result = await findOrCreateByDomain('acme.com')
+    expect(result.id).toBe('org_new')
+  })
+
+  it('rejects invalid domain inputs', async () => {
+    const { findOrCreateByDomain } = await import('../organization.service')
+    await expect(findOrCreateByDomain('garbage')).rejects.toThrow(/invalid/i)
+  })
+})
+
+describe('listOrganizations', () => {
+  it('applies search, archived filtering, capped limits, and clamped offsets', async () => {
+    const rows = [{ id: 'org_1', name: 'Acme', domain: 'acme.com' }]
+    const chain = makeListChain(rows)
+    selectMock.mockReturnValueOnce(chain)
+
+    const { listOrganizations } = await import('../organization.service')
+    await expect(listOrganizations({ search: ' acme ', limit: 500, offset: -50 })).resolves.toEqual(
+      rows
+    )
+
+    expect(chain.limit).toHaveBeenCalledWith(200)
+    expect(chain.offset).toHaveBeenCalledWith(0)
+  })
+
+  it('can list archived organizations without a where clause', async () => {
+    const chain = makeListChain([])
+    selectMock.mockReturnValueOnce(chain)
+
+    const { listOrganizations } = await import('../organization.service')
+    await expect(listOrganizations({ includeArchived: true })).resolves.toEqual([])
+
+    expect(chain.where).toHaveBeenCalledWith(undefined)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/organizations/contact.service.ts b/apps/web/src/lib/server/domains/organizations/contact.service.ts
new file mode 100644
index 000000000..9dd5b6f0c
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/contact.service.ts
@@ -0,0 +1,453 @@
+/**
+ * Contacts domain — humans associated with a customer organization.
+ *
+ * Permission checks are the caller's responsibility.
+ */
+
+import {
+  db,
+  eq,
+  and,
+  isNull,
+  ilike,
+  or,
+  sql,
+  asc,
+  desc,
+  contacts,
+  contactUserLinks,
+  user,
+  type Contact,
+  type ContactUserLink,
+} from '@/lib/server/db'
+import type {
+  ContactId,
+  ContactUserLinkId,
+  OrganizationId,
+  PrincipalId,
+  UserId,
+} from '@quackback/ids'
+import type { OrgMetadata } from '@/lib/server/db'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { normalizeEmail } from './normalize'
+
+/**
+ * Identity of the operator (or system caller) performing the mutation.
+ * Required so CRM webhook events carry a meaningful actor. For internal /
+ * system calls (ticket intake, portal-user link), pass `{ principalId: null }`.
+ */
+export interface ContactActorContext {
+  principalId: PrincipalId | null
+  userId?: UserId | null
+}
+
+const SERVICE_ACTOR: ContactActorContext = { principalId: null }
+
+async function fireContactEvent(
+  kind: 'created' | 'updated' | 'archived' | 'linked' | 'unlinked',
+  actor: ContactActorContext,
+  contact: Contact,
+  extra?: { changedFields?: string[]; userId?: UserId; linkedByPrincipalId?: PrincipalId | null }
+): Promise<void> {
+  try {
+    const {
+      buildEventActor,
+      dispatchContactCreated,
+      dispatchContactUpdated,
+      dispatchContactArchived,
+      dispatchContactLinked,
+      dispatchContactUnlinked,
+    } = await import('@/lib/server/events/dispatch')
+    const eventActor = actor.principalId
+      ? buildEventActor({
+          principalId: actor.principalId,
+          userId: actor.userId ?? undefined,
+          displayName: 'contacts-system',
+        })
+      : { type: 'service' as const, displayName: 'contacts-system' }
+    if (kind === 'created') await dispatchContactCreated(eventActor, contact as never)
+    else if (kind === 'updated')
+      await dispatchContactUpdated(eventActor, contact as never, extra?.changedFields ?? [])
+    else if (kind === 'archived') await dispatchContactArchived(eventActor, contact as never)
+    else if (kind === 'linked')
+      await dispatchContactLinked(
+        eventActor,
+        contact as never,
+        String(extra?.userId ?? ''),
+        extra?.linkedByPrincipalId ?? null
+      )
+    else await dispatchContactUnlinked(eventActor, contact as never, String(extra?.userId ?? ''))
+  } catch (err) {
+    console.warn(`[contacts] dispatchContact${kind} failed`, err)
+  }
+}
+
+export interface CreateContactInput {
+  name?: string | null
+  email?: string | null
+  phone?: string | null
+  title?: string | null
+  externalId?: string | null
+  organizationId?: OrganizationId | null
+  avatarUrl?: string | null
+  metadata?: OrgMetadata
+}
+
+export async function createContact(
+  input: CreateContactInput,
+  actor: ContactActorContext = SERVICE_ACTOR
+): Promise<Contact> {
+  const email = input.email ? normalizeEmail(input.email) : null
+  if (input.email && !email) {
+    throw new ValidationError('CONTACT_EMAIL_INVALID', 'Contact email is invalid')
+  }
+  if (!input.name?.trim() && !email) {
+    throw new ValidationError(
+      'CONTACT_NAME_OR_EMAIL_REQUIRED',
+      'Contact must have at least a name or email'
+    )
+  }
+  if (email) {
+    const existing = await db.query.contacts.findFirst({
+      where: and(eq(contacts.email, email), isNull(contacts.archivedAt)),
+    })
+    if (existing) {
+      throw new ConflictError('CONTACT_EMAIL_TAKEN', `Contact with email "${email}" already exists`)
+    }
+  }
+  if (input.externalId) {
+    const existing = await db.query.contacts.findFirst({
+      where: eq(contacts.externalId, input.externalId),
+    })
+    if (existing) {
+      throw new ConflictError('CONTACT_EXTERNAL_ID_TAKEN', 'externalId already in use')
+    }
+  }
+  const [created] = await db
+    .insert(contacts)
+    .values({
+      name: input.name?.trim() ?? null,
+      email,
+      phone: input.phone ?? null,
+      title: input.title ?? null,
+      externalId: input.externalId ?? null,
+      organizationId: input.organizationId ?? null,
+      avatarUrl: input.avatarUrl ?? null,
+      metadata: input.metadata ?? {},
+    })
+    .returning()
+  await fireContactEvent('created', actor, created)
+  await autoLinkVerifiedUsersForContact(created, actor)
+  return created
+}
+
+export interface UpdateContactInput {
+  name?: string | null
+  email?: string | null
+  phone?: string | null
+  title?: string | null
+  externalId?: string | null
+  organizationId?: OrganizationId | null
+  avatarUrl?: string | null
+  metadata?: OrgMetadata
+}
+
+export async function updateContact(
+  contactId: ContactId,
+  input: UpdateContactInput,
+  actor: ContactActorContext = SERVICE_ACTOR
+): Promise<Contact> {
+  const existing = await getContact(contactId)
+  if (!existing) throw new NotFoundError('CONTACT_NOT_FOUND', `Contact ${contactId} not found`)
+
+  let email: string | null | undefined = undefined
+  if (input.email !== undefined) {
+    email = input.email ? normalizeEmail(input.email) : null
+    if (input.email && !email) {
+      throw new ValidationError('CONTACT_EMAIL_INVALID', 'Contact email is invalid')
+    }
+    if (email && email !== existing.email) {
+      const dup = await db.query.contacts.findFirst({
+        where: and(eq(contacts.email, email), isNull(contacts.archivedAt)),
+      })
+      if (dup && dup.id !== contactId) {
+        throw new ConflictError(
+          'CONTACT_EMAIL_TAKEN',
+          `Contact with email "${email}" already exists`
+        )
+      }
+    }
+  }
+
+  if (
+    input.externalId !== undefined &&
+    input.externalId &&
+    input.externalId !== existing.externalId
+  ) {
+    const dup = await db.query.contacts.findFirst({
+      where: eq(contacts.externalId, input.externalId),
+    })
+    if (dup && dup.id !== contactId) {
+      throw new ConflictError('CONTACT_EXTERNAL_ID_TAKEN', 'externalId already in use')
+    }
+  }
+
+  const [updated] = await db
+    .update(contacts)
+    .set({
+      name: input.name !== undefined ? (input.name?.trim() ?? null) : existing.name,
+      email: email !== undefined ? email : existing.email,
+      phone: input.phone !== undefined ? input.phone : existing.phone,
+      title: input.title !== undefined ? input.title : existing.title,
+      externalId: input.externalId !== undefined ? input.externalId : existing.externalId,
+      organizationId:
+        input.organizationId !== undefined ? input.organizationId : existing.organizationId,
+      avatarUrl: input.avatarUrl !== undefined ? input.avatarUrl : existing.avatarUrl,
+      metadata: input.metadata !== undefined ? input.metadata : existing.metadata,
+    })
+    .where(eq(contacts.id, contactId))
+    .returning()
+  // Compute changed fields by comparing input keys whose final value differs
+  // from the previous row. Only fields explicitly present in `input` count.
+  const changedFields: string[] = []
+  for (const key of [
+    'name',
+    'email',
+    'phone',
+    'title',
+    'externalId',
+    'organizationId',
+    'avatarUrl',
+  ] as const) {
+    if (input[key] !== undefined && (existing[key] ?? null) !== (updated[key] ?? null)) {
+      changedFields.push(key)
+    }
+  }
+  if (changedFields.length > 0) await fireContactEvent('updated', actor, updated, { changedFields })
+  if (changedFields.includes('email')) {
+    await autoLinkVerifiedUsersForContact(updated, actor)
+  }
+  return updated
+}
+
+async function autoLinkVerifiedUsersForContact(
+  contact: Contact,
+  actor: ContactActorContext
+): Promise<void> {
+  if (!contact.email || contact.archivedAt) return
+
+  try {
+    const rows = await db
+      .select({ id: user.id })
+      .from(user)
+      .where(
+        and(
+          sql`LOWER(${user.email}) = ${contact.email}`,
+          eq(user.emailVerified, true),
+          eq(user.isAnonymous, false)
+        )
+      )
+
+    for (const row of rows) {
+      await linkContactToUser(
+        {
+          contactId: contact.id as ContactId,
+          userId: row.id as UserId,
+          linkedByPrincipalId: actor.principalId,
+        },
+        actor
+      )
+    }
+  } catch (err) {
+    console.warn('[contacts] auto-link verified users failed', {
+      contactId: contact.id,
+      error: err instanceof Error ? err.message : err,
+    })
+  }
+}
+
+export async function archiveContact(
+  contactId: ContactId,
+  actor: ContactActorContext = SERVICE_ACTOR
+): Promise<void> {
+  const [archived] = await db
+    .update(contacts)
+    .set({ archivedAt: new Date() })
+    .where(eq(contacts.id, contactId))
+    .returning()
+  if (archived) await fireContactEvent('archived', actor, archived)
+}
+
+export async function getContact(contactId: ContactId): Promise<Contact | null> {
+  const row = await db.query.contacts.findFirst({ where: eq(contacts.id, contactId) })
+  return row ?? null
+}
+
+export async function getContactByEmail(email: string): Promise<Contact | null> {
+  const normalized = normalizeEmail(email)
+  if (!normalized) return null
+  const row = await db.query.contacts.findFirst({
+    where: and(eq(contacts.email, normalized), isNull(contacts.archivedAt)),
+  })
+  return row ?? null
+}
+
+export async function listContactsForOrganization(
+  organizationId: OrganizationId,
+  opts: { includeArchived?: boolean; limit?: number; offset?: number } = {}
+): Promise<Contact[]> {
+  const limit = Math.min(opts.limit ?? 50, 200)
+  const offset = Math.max(opts.offset ?? 0, 0)
+  const conditions = [eq(contacts.organizationId, organizationId)]
+  if (!opts.includeArchived) conditions.push(isNull(contacts.archivedAt))
+  return db
+    .select()
+    .from(contacts)
+    .where(and(...conditions))
+    .orderBy(asc(contacts.name), desc(contacts.createdAt))
+    .limit(limit)
+    .offset(offset)
+}
+
+export interface SearchContactsInput {
+  query?: string
+  email?: string
+  organizationId?: OrganizationId
+  includeArchived?: boolean
+  limit?: number
+  offset?: number
+}
+
+export async function searchContacts(input: SearchContactsInput = {}): Promise<Contact[]> {
+  const limit = Math.min(input.limit ?? 25, 100)
+  const offset = Math.max(input.offset ?? 0, 0)
+  const conditions = []
+  if (!input.includeArchived) conditions.push(isNull(contacts.archivedAt))
+  if (input.email) {
+    const normalized = normalizeEmail(input.email)
+    if (normalized) conditions.push(eq(contacts.email, normalized))
+  }
+  if (input.organizationId) conditions.push(eq(contacts.organizationId, input.organizationId))
+  if (input.query?.trim()) {
+    const q = `%${input.query.trim()}%`
+    conditions.push(or(ilike(contacts.name, q), ilike(contacts.email, q)))
+  }
+  const where = conditions.length > 0 ? and(...conditions) : undefined
+  return db
+    .select()
+    .from(contacts)
+    .where(where)
+    .orderBy(asc(contacts.name), desc(contacts.createdAt))
+    .limit(limit)
+    .offset(offset)
+}
+
+export interface FindOrCreateByEmailInput {
+  email: string
+  name?: string | null
+  organizationId?: OrganizationId | null
+}
+
+/**
+ * Concurrency-safe upsert by email. Used by Phase 3 ticket intake.
+ * The partial unique index on `contacts.email` (where archived_at IS NULL)
+ * makes the race recoverable.
+ */
+export async function findOrCreateByEmail(
+  input: FindOrCreateByEmailInput,
+  actor: ContactActorContext = SERVICE_ACTOR
+): Promise<Contact> {
+  const normalized = normalizeEmail(input.email)
+  if (!normalized) {
+    throw new ValidationError('CONTACT_EMAIL_INVALID', `Email "${input.email}" is invalid`)
+  }
+  const existing = await getContactByEmail(normalized)
+  if (existing) return existing
+  try {
+    const [created] = await db
+      .insert(contacts)
+      .values({
+        name: input.name?.trim() ?? null,
+        email: normalized,
+        organizationId: input.organizationId ?? null,
+        metadata: {},
+      })
+      .returning()
+    await fireContactEvent('created', actor, created)
+    return created
+  } catch (err) {
+    const after = await getContactByEmail(normalized)
+    if (after) return after
+    throw err
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Contact ↔ portal user links (N:M)
+// ---------------------------------------------------------------------------
+
+export interface LinkContactToUserInput {
+  contactId: ContactId
+  userId: UserId
+  linkedByPrincipalId?: PrincipalId | null
+}
+
+export async function linkContactToUser(
+  input: LinkContactToUserInput,
+  actor: ContactActorContext = SERVICE_ACTOR
+): Promise<ContactUserLink> {
+  const existing = await db.query.contactUserLinks.findFirst({
+    where: and(
+      eq(contactUserLinks.contactId, input.contactId),
+      eq(contactUserLinks.userId, input.userId)
+    ),
+  })
+  if (existing) return existing
+  const [created] = await db
+    .insert(contactUserLinks)
+    .values({
+      contactId: input.contactId,
+      userId: input.userId,
+      linkedByPrincipalId: input.linkedByPrincipalId ?? null,
+    })
+    .returning()
+  // Fire only on actual insert (not on idempotent hit above).
+  const contact = await getContact(input.contactId)
+  if (contact) {
+    await fireContactEvent('linked', actor, contact, {
+      userId: input.userId,
+      linkedByPrincipalId: input.linkedByPrincipalId ?? null,
+    })
+  }
+  return created
+}
+
+export async function unlinkContactFromUser(
+  contactId: ContactId,
+  userId: UserId,
+  actor: ContactActorContext = SERVICE_ACTOR
+): Promise<void> {
+  const deleted = await db
+    .delete(contactUserLinks)
+    .where(and(eq(contactUserLinks.contactId, contactId), eq(contactUserLinks.userId, userId)))
+    .returning()
+  if (deleted.length === 0) return
+  const contact = await getContact(contactId)
+  if (contact) await fireContactEvent('unlinked', actor, contact, { userId })
+}
+
+export async function unlinkById(linkId: ContactUserLinkId): Promise<void> {
+  await db.delete(contactUserLinks).where(eq(contactUserLinks.id, linkId))
+}
+
+export async function listLinksForContact(contactId: ContactId): Promise<ContactUserLink[]> {
+  return db.query.contactUserLinks.findMany({
+    where: eq(contactUserLinks.contactId, contactId),
+  })
+}
+
+export async function listLinksForUser(userId: UserId): Promise<ContactUserLink[]> {
+  return db.query.contactUserLinks.findMany({
+    where: eq(contactUserLinks.userId, userId),
+  })
+}
diff --git a/apps/web/src/lib/server/domains/organizations/index.ts b/apps/web/src/lib/server/domains/organizations/index.ts
new file mode 100644
index 000000000..349f9c2ad
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/index.ts
@@ -0,0 +1,8 @@
+/**
+ * Organizations & contacts domain — public barrel.
+ * Server-only.
+ */
+
+export * from './normalize'
+export * from './organization.service'
+export * from './contact.service'
diff --git a/apps/web/src/lib/server/domains/organizations/normalize.ts b/apps/web/src/lib/server/domains/organizations/normalize.ts
new file mode 100644
index 000000000..95ad840f9
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/normalize.ts
@@ -0,0 +1,62 @@
+/**
+ * Pure normalisation helpers for emails and domains.
+ *
+ * Kept dependency-free so they can be reused on the client (e.g. dedupe
+ * checks in admin forms) without pulling in the database layer.
+ *
+ * Plus-aliases (e.g. "[email protected]") are intentionally preserved —
+ * stripping them merges identities for users who explicitly chose to
+ * separate them.
+ */
+
+const EMAIL_RE = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/
+
+/**
+ * Lowercases, trims, removes a leading `mailto:` and any surrounding
+ * angle brackets. Returns `null` if the result is empty or fails a
+ * permissive RFC-lite check.
+ */
+export function normalizeEmail(input: string | null | undefined): string | null {
+  if (!input) return null
+  let s = input.trim().toLowerCase()
+  if (!s) return null
+  if (s.startsWith('<') && s.endsWith('>')) s = s.slice(1, -1).trim()
+  if (s.startsWith('mailto:')) s = s.slice('mailto:'.length).trim()
+  if (!EMAIL_RE.test(s)) return null
+  return s
+}
+
+/**
+ * Lowercases and trims a bare domain. Strips an optional protocol prefix
+ * and trailing dot. Returns `null` if the result is empty or has no dot.
+ */
+export function normalizeDomain(input: string | null | undefined): string | null {
+  if (!input) return null
+  let s = input.trim().toLowerCase()
+  if (!s) return null
+  s = s.replace(/^https?:\/\//, '')
+  // Strip path, query, and port if user pasted a URL.
+  s = s.split('/')[0]
+  s = s.split('?')[0]
+  s = s.split('#')[0]
+  s = s.split(':')[0]
+  // Strip trailing dot (FQDN form).
+  while (s.endsWith('.')) s = s.slice(0, -1)
+  // Strip leading dot.
+  while (s.startsWith('.')) s = s.slice(1)
+  if (!s.includes('.')) return null
+  if (!/^[a-z0-9.-]+$/.test(s)) return null
+  return s
+}
+
+/**
+ * Extracts the domain portion of an email address and normalises it.
+ * Returns `null` if the email itself is invalid.
+ */
+export function parseDomainFromEmail(input: string | null | undefined): string | null {
+  const email = normalizeEmail(input)
+  if (!email) return null
+  const at = email.lastIndexOf('@')
+  if (at < 0) return null
+  return normalizeDomain(email.slice(at + 1))
+}
diff --git a/apps/web/src/lib/server/domains/organizations/organization.service.ts b/apps/web/src/lib/server/domains/organizations/organization.service.ts
new file mode 100644
index 000000000..fa139798b
--- /dev/null
+++ b/apps/web/src/lib/server/domains/organizations/organization.service.ts
@@ -0,0 +1,312 @@
+/**
+ * Organizations domain — CRUD for B2B customer companies.
+ *
+ * Permission checks are the caller's responsibility; this layer is a pure
+ * service.
+ *
+ * `findOrCreateByDomain` is the Phase 3 ticket-intake helper: when a new
+ * ticket arrives by email and no contact yet exists, the pipeline
+ * synthesises an organization for the sender's domain and attaches the
+ * contact to it.
+ */
+
+import {
+  db,
+  eq,
+  and,
+  isNull,
+  ilike,
+  or,
+  asc,
+  desc,
+  organizations,
+  type Organization,
+  type OrgMetadata,
+} from '@/lib/server/db'
+import type { OrganizationId, PrincipalId, UserId } from '@quackback/ids'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { normalizeDomain } from './normalize'
+
+/**
+ * Identity of the operator (or system caller) performing the mutation.
+ * For internal/system calls (e.g. ticket-intake `findOrCreateByDomain`),
+ * pass `{ principalId: null }`.
+ */
+export interface OrganizationActorContext {
+  principalId: PrincipalId | null
+  userId?: UserId | null
+}
+
+const SERVICE_ACTOR: OrganizationActorContext = { principalId: null }
+
+async function fireOrganizationEvent(
+  kind: 'created' | 'updated' | 'archived' | 'unarchived',
+  actor: OrganizationActorContext,
+  org: Organization,
+  changedFields?: string[]
+): Promise<void> {
+  try {
+    const {
+      buildEventActor,
+      dispatchOrganizationCreated,
+      dispatchOrganizationUpdated,
+      dispatchOrganizationArchived,
+      dispatchOrganizationUnarchived,
+    } = await import('@/lib/server/events/dispatch')
+    const eventActor = actor.principalId
+      ? buildEventActor({
+          principalId: actor.principalId,
+          userId: actor.userId ?? undefined,
+          displayName: 'organizations-system',
+        })
+      : { type: 'service' as const, displayName: 'organizations-system' }
+    if (kind === 'created') await dispatchOrganizationCreated(eventActor, org as never)
+    else if (kind === 'updated')
+      await dispatchOrganizationUpdated(eventActor, org as never, changedFields ?? [])
+    else if (kind === 'archived') await dispatchOrganizationArchived(eventActor, org as never)
+    else await dispatchOrganizationUnarchived(eventActor, org as never)
+  } catch (err) {
+    console.warn(`[organizations] dispatchOrganization${kind} failed`, err)
+  }
+}
+
+const NAME_MAX = 200
+
+export interface CreateOrganizationInput {
+  name: string
+  domain?: string | null
+  externalId?: string | null
+  website?: string | null
+  notes?: string | null
+  metadata?: OrgMetadata
+}
+
+export async function createOrganization(
+  input: CreateOrganizationInput,
+  actor: OrganizationActorContext = SERVICE_ACTOR
+): Promise<Organization> {
+  const name = input.name?.trim()
+  if (!name) {
+    throw new ValidationError('ORG_NAME_REQUIRED', 'Organization name is required')
+  }
+  if (name.length > NAME_MAX) {
+    throw new ValidationError('ORG_NAME_TOO_LONG', `Organization name exceeds ${NAME_MAX} chars`)
+  }
+
+  const domain = input.domain ? normalizeDomain(input.domain) : null
+  if (input.domain && !domain) {
+    throw new ValidationError('ORG_DOMAIN_INVALID', 'Organization domain is invalid')
+  }
+  if (domain) {
+    const existing = await db.query.organizations.findFirst({
+      where: eq(organizations.domain, domain),
+    })
+    if (existing) {
+      throw new ConflictError(
+        'ORG_DOMAIN_TAKEN',
+        `Organization with domain "${domain}" already exists`
+      )
+    }
+  }
+  if (input.externalId) {
+    const existing = await db.query.organizations.findFirst({
+      where: eq(organizations.externalId, input.externalId),
+    })
+    if (existing) {
+      throw new ConflictError('ORG_EXTERNAL_ID_TAKEN', 'externalId already in use')
+    }
+  }
+
+  const [created] = await db
+    .insert(organizations)
+    .values({
+      name,
+      domain,
+      externalId: input.externalId ?? null,
+      website: input.website ?? null,
+      notes: input.notes ?? null,
+      metadata: input.metadata ?? {},
+    })
+    .returning()
+  await fireOrganizationEvent('created', actor, created)
+  return created
+}
+
+export interface UpdateOrganizationInput {
+  name?: string
+  domain?: string | null
+  externalId?: string | null
+  website?: string | null
+  notes?: string | null
+  metadata?: OrgMetadata
+}
+
+export async function updateOrganization(
+  organizationId: OrganizationId,
+  input: UpdateOrganizationInput,
+  actor: OrganizationActorContext = SERVICE_ACTOR
+): Promise<Organization> {
+  const org = await getOrganization(organizationId)
+  if (!org) throw new NotFoundError('ORG_NOT_FOUND', `Organization ${organizationId} not found`)
+
+  let domain: string | null | undefined = undefined
+  if (input.domain !== undefined) {
+    domain = input.domain ? normalizeDomain(input.domain) : null
+    if (input.domain && !domain) {
+      throw new ValidationError('ORG_DOMAIN_INVALID', 'Organization domain is invalid')
+    }
+    if (domain && domain !== org.domain) {
+      const dup = await db.query.organizations.findFirst({
+        where: eq(organizations.domain, domain),
+      })
+      if (dup && dup.id !== organizationId) {
+        throw new ConflictError(
+          'ORG_DOMAIN_TAKEN',
+          `Organization with domain "${domain}" already exists`
+        )
+      }
+    }
+  }
+
+  if (input.externalId !== undefined && input.externalId && input.externalId !== org.externalId) {
+    const dup = await db.query.organizations.findFirst({
+      where: eq(organizations.externalId, input.externalId),
+    })
+    if (dup && dup.id !== organizationId) {
+      throw new ConflictError('ORG_EXTERNAL_ID_TAKEN', 'externalId already in use')
+    }
+  }
+
+  const name = input.name?.trim()
+  if (name !== undefined && name.length > NAME_MAX) {
+    throw new ValidationError('ORG_NAME_TOO_LONG', `Organization name exceeds ${NAME_MAX} chars`)
+  }
+
+  const [updated] = await db
+    .update(organizations)
+    .set({
+      name: name !== undefined ? name : org.name,
+      domain: domain !== undefined ? domain : org.domain,
+      externalId: input.externalId !== undefined ? input.externalId : org.externalId,
+      website: input.website !== undefined ? input.website : org.website,
+      notes: input.notes !== undefined ? input.notes : org.notes,
+      metadata: input.metadata !== undefined ? input.metadata : org.metadata,
+    })
+    .where(eq(organizations.id, organizationId))
+    .returning()
+  const changedFields: string[] = []
+  for (const key of ['name', 'domain', 'externalId', 'website', 'notes'] as const) {
+    if (input[key] !== undefined && (org[key] ?? null) !== (updated[key] ?? null)) {
+      changedFields.push(key)
+    }
+  }
+  if (changedFields.length > 0)
+    await fireOrganizationEvent('updated', actor, updated, changedFields)
+  return updated
+}
+
+export async function archiveOrganization(
+  organizationId: OrganizationId,
+  actor: OrganizationActorContext = SERVICE_ACTOR
+): Promise<void> {
+  const [archived] = await db
+    .update(organizations)
+    .set({ archivedAt: new Date() })
+    .where(eq(organizations.id, organizationId))
+    .returning()
+  if (archived) await fireOrganizationEvent('archived', actor, archived)
+}
+
+export async function unarchiveOrganization(
+  organizationId: OrganizationId,
+  actor: OrganizationActorContext = SERVICE_ACTOR
+): Promise<void> {
+  const [unarchived] = await db
+    .update(organizations)
+    .set({ archivedAt: null })
+    .where(eq(organizations.id, organizationId))
+    .returning()
+  if (unarchived) await fireOrganizationEvent('unarchived', actor, unarchived)
+}
+
+export async function getOrganization(
+  organizationId: OrganizationId
+): Promise<Organization | null> {
+  const row = await db.query.organizations.findFirst({
+    where: eq(organizations.id, organizationId),
+  })
+  return row ?? null
+}
+
+export async function getOrganizationByDomain(domain: string): Promise<Organization | null> {
+  const normalized = normalizeDomain(domain)
+  if (!normalized) return null
+  const row = await db.query.organizations.findFirst({
+    where: eq(organizations.domain, normalized),
+  })
+  return row ?? null
+}
+
+export interface ListOrganizationsInput {
+  search?: string
+  includeArchived?: boolean
+  limit?: number
+  offset?: number
+}
+
+export async function listOrganizations(
+  input: ListOrganizationsInput = {}
+): Promise<Organization[]> {
+  const limit = Math.min(input.limit ?? 50, 200)
+  const offset = Math.max(input.offset ?? 0, 0)
+  const conditions = []
+  if (!input.includeArchived) conditions.push(isNull(organizations.archivedAt))
+  if (input.search?.trim()) {
+    const q = `%${input.search.trim()}%`
+    conditions.push(or(ilike(organizations.name, q), ilike(organizations.domain, q)))
+  }
+  const where = conditions.length > 0 ? and(...conditions) : undefined
+  return db
+    .select()
+    .from(organizations)
+    .where(where)
+    .orderBy(asc(organizations.name), desc(organizations.createdAt))
+    .limit(limit)
+    .offset(offset)
+}
+
+/**
+ * Concurrency-safe upsert by domain. Used by Phase 3 ticket intake when
+ * routing inbound email — if two requests race on the same domain, the
+ * unique partial index on `organizations.domain` ensures one of them
+ * succeeds and the other reads the existing row.
+ */
+export async function findOrCreateByDomain(
+  domain: string,
+  fallbackName?: string,
+  actor: OrganizationActorContext = SERVICE_ACTOR
+): Promise<Organization> {
+  const normalized = normalizeDomain(domain)
+  if (!normalized) {
+    throw new ValidationError('ORG_DOMAIN_INVALID', `Domain "${domain}" is invalid`)
+  }
+  const existing = await getOrganizationByDomain(normalized)
+  if (existing) return existing
+  try {
+    const [created] = await db
+      .insert(organizations)
+      .values({
+        name: fallbackName?.trim() || normalized,
+        domain: normalized,
+        metadata: {},
+      })
+      .returning()
+    await fireOrganizationEvent('created', actor, created)
+    return created
+  } catch (err) {
+    // Race: another request created the row first.
+    const after = await getOrganizationByDomain(normalized)
+    if (after) return after
+    throw err
+  }
+}
diff --git a/apps/web/src/lib/server/domains/principals/__tests__/anon-sweep-queue.gap.test.ts b/apps/web/src/lib/server/domains/principals/__tests__/anon-sweep-queue.gap.test.ts
new file mode 100644
index 000000000..dc74df2f8
--- /dev/null
+++ b/apps/web/src/lib/server/domains/principals/__tests__/anon-sweep-queue.gap.test.ts
@@ -0,0 +1,83 @@
+/**
+ * Differential-coverage tests for the anon-sweep queue worker — job processing
+ * (with and without reclaimed principals), the redis-ready timeout catch, the
+ * `failed` handler branches, and the init-promise singleton.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  add: vi.fn(() => Promise.resolve()),
+  waitUntilReady: vi.fn(() => Promise.resolve()),
+  close: vi.fn(() => Promise.resolve()),
+  sweep: vi.fn(() => Promise.resolve({ deleted: 0, candidates: 0 })),
+  error: vi.fn(),
+  debug: vi.fn(),
+  processor: undefined as undefined | ((job: unknown) => Promise<void>),
+  failed: undefined as undefined | ((job: unknown, err: Error) => void),
+}))
+
+vi.mock('bullmq', () => ({
+  Queue: class {
+    add = m.add
+    waitUntilReady = m.waitUntilReady
+    close = m.close
+  },
+  Worker: class {
+    constructor(_name: string, processor: (job: unknown) => Promise<void>) {
+      m.processor = processor
+    }
+    on(event: string, cb: (job: unknown, err: Error) => void) {
+      if (event === 'failed') m.failed = cb
+    }
+    close = m.close
+  },
+}))
+vi.mock('@/lib/server/queue/redis-config', () => ({
+  getQueueRedis: () => ({}),
+  REDIS_READY_TIMEOUT_MS: 5000,
+}))
+vi.mock('@/lib/server/logger', () => ({
+  logger: { child: () => ({ error: m.error, info: vi.fn(), debug: m.debug }) },
+}))
+vi.mock('../anon-sweep.service', () => ({ sweepAnonymousPrincipals: m.sweep }))
+
+beforeEach(() => {
+  vi.resetModules()
+  vi.clearAllMocks()
+  m.waitUntilReady.mockResolvedValue(undefined)
+  m.sweep.mockResolvedValue({ deleted: 0, candidates: 0 })
+  m.processor = undefined
+  m.failed = undefined
+})
+
+const load = () => import('../anon-sweep-queue')
+
+describe('anon-sweep queue', () => {
+  it('processes a sweep job, logging only when something was reclaimed', async () => {
+    const { initAnonSweepWorker } = await load()
+    await initAnonSweepWorker()
+    await m.processor!({ data: { type: 'sweep-anonymous' } })
+    expect(m.debug).not.toHaveBeenCalled()
+    m.sweep.mockResolvedValueOnce({ deleted: 2, candidates: 5 })
+    await m.processor!({ data: { type: 'sweep-anonymous' } })
+    expect(m.debug).toHaveBeenCalledTimes(1)
+    await m.processor!({ data: { type: 'other' } })
+    expect(m.sweep).toHaveBeenCalledTimes(2)
+  })
+
+  it('handles the failed-handler branches', async () => {
+    const { initAnonSweepWorker } = await load()
+    await initAnonSweepWorker()
+    m.failed!(null, new Error('x'))
+    m.failed!({ attemptsMade: 3, opts: { attempts: 3 } }, new Error('boom'))
+    m.failed!({ attemptsMade: 1, opts: {} }, new Error('soft'))
+    expect(m.error).toHaveBeenCalledTimes(2)
+  })
+
+  it('closes and rethrows when redis never becomes ready', async () => {
+    m.waitUntilReady.mockRejectedValueOnce(new Error('redis down'))
+    const { initAnonSweepWorker } = await load()
+    await expect(initAnonSweepWorker()).rejects.toThrow('redis down')
+    expect(m.close).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/principals/__tests__/principal-cache.test.ts b/apps/web/src/lib/server/domains/principals/__tests__/principal-cache.test.ts
index 231a32243..b9361f11a 100644
--- a/apps/web/src/lib/server/domains/principals/__tests__/principal-cache.test.ts
+++ b/apps/web/src/lib/server/domains/principals/__tests__/principal-cache.test.ts
@@ -21,6 +21,9 @@ vi.mock('@/lib/server/redis', () => ({
 const mockFindFirst = vi.fn()
 const mockSelect = vi.fn()
 const mockUpdate = vi.fn()
+const mockEq = vi.fn((..._args: unknown[]) => 'eq-condition')
+const mockNe = vi.fn((..._args: unknown[]) => 'not-portal-user-condition')
+const mockAnd = vi.fn((..._args: unknown[]) => 'team-members-condition')
 
 vi.mock('@/lib/server/db', () => ({
   db: {
@@ -29,17 +32,19 @@ vi.mock('@/lib/server/db', () => ({
     update: (...a: unknown[]) => mockUpdate(...a),
   },
   // Drizzle helpers / table identifiers — only need to be defined, not functional.
-  eq: vi.fn(),
-  ne: vi.fn(),
-  and: vi.fn(),
+  eq: mockEq,
+  ne: mockNe,
+  and: mockAnd,
   or: vi.fn(),
   sql: vi.fn(() => ({ as: vi.fn() })),
   ilike: vi.fn(),
-  principal: { id: 'id', userId: 'userId', role: 'role', type: 'type' },
-  user: {},
+  max: vi.fn(() => ({ as: vi.fn(() => 'last_sign_in_at') })),
+  principal: { id: 'id', userId: 'userId', role: 'role', type: 'type', createdAt: 'createdAt' },
+  session: { userId: 'sessionUserId', createdAt: 'sessionCreatedAt' },
+  user: { id: 'userId', name: 'name', email: 'email', image: 'image' },
 }))
 
-const { updateMemberRole, removeTeamMember } = await import('../principal.service')
+const { listTeamMembers, updateMemberRole, removeTeamMember } = await import('../principal.service')
 
 const ACTING = 'principal_acting' as PrincipalId
 const TARGET = 'principal_target' as PrincipalId
@@ -91,6 +96,49 @@ describe('updateMemberRole', () => {
   })
 })
 
+describe('listTeamMembers', () => {
+  it('excludes portal-only users and normalizes last sign-in timestamps', async () => {
+    const createdAt = new Date('2026-06-01T12:00:00.000Z')
+    const lastSignInAt = '2026-06-02T12:00:00.000Z'
+    const rawMembers = [
+      {
+        id: TARGET,
+        userId: TARGET_USER,
+        name: 'Jane Admin',
+        email: 'jane@example.com',
+        image: null,
+        role: 'admin',
+        createdAt,
+        lastSignInAt,
+      },
+    ]
+
+    const subquery = { userId: 'lastSessionUserId', lastSignInAt: 'lastSessionLastSignInAt' }
+    const asSubquery = vi.fn(() => subquery)
+    const groupBy = vi.fn(() => ({ as: asSubquery }))
+    const subqueryFrom = vi.fn(() => ({ groupBy }))
+    const where = vi.fn().mockResolvedValue(rawMembers)
+    const leftJoin = vi.fn(() => ({ where }))
+    const innerJoin = vi.fn(() => ({ leftJoin }))
+    const mainFrom = vi.fn(() => ({ innerJoin }))
+
+    mockSelect.mockReturnValueOnce({ from: subqueryFrom }).mockReturnValueOnce({ from: mainFrom })
+
+    const result = await listTeamMembers()
+
+    expect(mockEq).toHaveBeenCalledWith('type', 'user')
+    expect(mockNe).toHaveBeenCalledWith('role', 'user')
+    expect(mockAnd).toHaveBeenCalledWith('eq-condition', 'not-portal-user-condition')
+    expect(where).toHaveBeenCalledWith('team-members-condition')
+    expect(result).toEqual([
+      {
+        ...rawMembers[0],
+        lastSignInAt: new Date(lastSignInAt),
+      },
+    ])
+  })
+})
+
 describe('removeTeamMember', () => {
   it('invalidates PRINCIPAL_BY_USER for the target user after removal', async () => {
     mockFindFirst.mockResolvedValue({
diff --git a/apps/web/src/lib/server/domains/principals/anon-sweep-queue.ts b/apps/web/src/lib/server/domains/principals/anon-sweep-queue.ts
index d2ff0483f..950c64068 100644
--- a/apps/web/src/lib/server/domains/principals/anon-sweep-queue.ts
+++ b/apps/web/src/lib/server/domains/principals/anon-sweep-queue.ts
@@ -16,12 +16,12 @@ interface AnonSweepJob {
   type: 'sweep-anonymous'
 }
 
-let initPromise: Promise<{ queue: Queue<AnonSweepJob>; worker: Worker<AnonSweepJob> }> | null = null
+let initPromise: Promise<{ queue: Queue; worker: Worker }> | null = null
 
 async function initializeQueue() {
   const connection = getQueueRedis()
 
-  const queue = new Queue<AnonSweepJob>(QUEUE_NAME, {
+  const queue = new Queue(QUEUE_NAME, {
     connection,
     defaultJobOptions: {
       attempts: 3,
@@ -31,13 +31,17 @@ async function initializeQueue() {
     },
   })
 
-  const worker = new Worker<AnonSweepJob>(
+  const worker = new Worker(
     QUEUE_NAME,
     async (job) => {
-      if (job.data.type === 'sweep-anonymous') {
+      const data = job.data as AnonSweepJob
+      if (data.type === 'sweep-anonymous') {
         const result = await sweepAnonymousPrincipals()
         if (result.deleted > 0 || result.candidates > 0) {
-          log.debug({ candidates: result.candidates, deleted: result.deleted }, 'anon-sweep run complete')
+          log.debug(
+            { candidates: result.candidates, deleted: result.deleted },
+            'anon-sweep run complete'
+          )
         }
       }
     },
diff --git a/apps/web/src/lib/server/domains/principals/principal.service.ts b/apps/web/src/lib/server/domains/principals/principal.service.ts
index f811fd7da..6898f9502 100644
--- a/apps/web/src/lib/server/domains/principals/principal.service.ts
+++ b/apps/web/src/lib/server/domains/principals/principal.service.ts
@@ -138,7 +138,7 @@ export async function listTeamMembers(): Promise<TeamMember[]> {
       .from(principal)
       .innerJoin(user, eq(principal.userId, user.id))
       .leftJoin(lastSession, eq(lastSession.userId, user.id))
-      .where(eq(principal.type, 'user'))
+      .where(and(eq(principal.type, 'user'), ne(principal.role, 'user')))
 
     // The `max()` aggregate comes back as a string from postgres-js
     // (Date mapping only fires on plain timestamp column selects);
diff --git a/apps/web/src/lib/server/domains/sla/__tests__/business-hours.calc.diffcov.test.ts b/apps/web/src/lib/server/domains/sla/__tests__/business-hours.calc.diffcov.test.ts
new file mode 100644
index 000000000..c32987fa6
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/__tests__/business-hours.calc.diffcov.test.ts
@@ -0,0 +1,160 @@
+/**
+ * Differential-coverage tests for business-hours.calc — the pure
+ * timezone-aware business-time math: within-hours checks, add/subtract across
+ * range boundaries and day rollovers, elapsed-time accumulation, and the
+ * timezone/range/schedule/holiday validators. No mocks (the module is pure).
+ */
+import { describe, it, expect } from 'vitest'
+import {
+  isWithinBusinessHours,
+  addBusinessMinutes,
+  subtractBusinessMinutes,
+  elapsedBusinessMs,
+  isValidTimezone,
+  validateRange,
+  validateSchedule,
+  validateHolidays,
+} from '../business-hours.calc'
+
+const week = {
+  sun: [],
+  mon: [
+    { start: '09:00', end: '12:00' },
+    { start: '13:00', end: '17:00' },
+  ],
+  tue: [{ start: '09:00', end: '17:00' }],
+  wed: [{ start: '09:00', end: '17:00' }],
+  thu: [{ start: '09:00', end: '17:00' }],
+  fri: [{ start: '09:00', end: '17:00' }],
+  sat: [],
+}
+const hours = {
+  timezone: 'UTC',
+  schedule: week as never,
+  holidays: [{ date: '2026-06-25' }] as never,
+}
+// 2026-06-22 is a Monday (UTC).
+const at = (iso: string) => new Date(`${iso}Z`)
+
+describe('isWithinBusinessHours', () => {
+  it('is always true for 24/7 (null hours)', () => {
+    expect(isWithinBusinessHours(at('2026-06-20T03:00:00'), null)).toBe(true)
+  })
+  it('is true inside an open range', () => {
+    expect(isWithinBusinessHours(at('2026-06-22T10:00:00'), hours)).toBe(true)
+  })
+  it('is false in the lunch gap and on closed days', () => {
+    expect(isWithinBusinessHours(at('2026-06-22T12:30:00'), hours)).toBe(false) // between ranges
+    expect(isWithinBusinessHours(at('2026-06-20T10:00:00'), hours)).toBe(false) // Saturday (no ranges)
+  })
+  it('is false on a holiday', () => {
+    expect(isWithinBusinessHours(at('2026-06-25T10:00:00'), hours)).toBe(false) // Thu holiday
+  })
+})
+
+describe('addBusinessMinutes', () => {
+  it('adds linearly for 24/7', () => {
+    expect(addBusinessMinutes(at('2026-06-22T10:00:00'), 30, null).toISOString()).toBe(
+      at('2026-06-22T10:30:00').toISOString()
+    )
+  })
+  it('returns the start for non-positive minutes', () => {
+    expect(addBusinessMinutes(at('2026-06-22T10:00:00'), 0, hours).toISOString()).toBe(
+      at('2026-06-22T10:00:00').toISOString()
+    )
+  })
+  it('lands inside the same range', () => {
+    expect(addBusinessMinutes(at('2026-06-22T09:00:00'), 60, hours).toISOString()).toBe(
+      at('2026-06-22T10:00:00').toISOString()
+    )
+  })
+  it('rolls across the lunch gap and into the next day', () => {
+    // Mon 11:30 + 120 business min: 30 to 12:00, skip lunch, 90 in 13:00-14:30.
+    expect(addBusinessMinutes(at('2026-06-22T11:30:00'), 120, hours).toISOString()).toBe(
+      at('2026-06-22T14:30:00').toISOString()
+    )
+    // Mon 16:00 + 120: 60 to 17:00, then 60 on Tue 09:00-10:00.
+    expect(addBusinessMinutes(at('2026-06-22T16:00:00'), 120, hours).toISOString()).toBe(
+      at('2026-06-23T10:00:00').toISOString()
+    )
+  })
+  it('starts before opening (effStart clamps to range start)', () => {
+    expect(addBusinessMinutes(at('2026-06-23T06:00:00'), 60, hours).toISOString()).toBe(
+      at('2026-06-23T10:00:00').toISOString()
+    )
+  })
+})
+
+describe('subtractBusinessMinutes', () => {
+  it('subtracts linearly for 24/7 and returns end for non-positive', () => {
+    expect(subtractBusinessMinutes(at('2026-06-22T10:00:00'), 30, null).toISOString()).toBe(
+      at('2026-06-22T09:30:00').toISOString()
+    )
+    expect(subtractBusinessMinutes(at('2026-06-22T10:00:00'), 0, hours).toISOString()).toBe(
+      at('2026-06-22T10:00:00').toISOString()
+    )
+  })
+  it('lands inside the same range', () => {
+    expect(subtractBusinessMinutes(at('2026-06-23T16:00:00'), 60, hours).toISOString()).toBe(
+      at('2026-06-23T15:00:00').toISOString()
+    )
+  })
+  it('walks back across days', () => {
+    // Tue 09:30 - 60: 30 back to Tue 09:00, then 30 on Mon ending 17:00 -> 16:30.
+    expect(subtractBusinessMinutes(at('2026-06-23T09:30:00'), 60, hours).toISOString()).toBe(
+      at('2026-06-22T16:30:00').toISOString()
+    )
+  })
+})
+
+describe('elapsedBusinessMs', () => {
+  it('is 0 when end <= start', () => {
+    expect(elapsedBusinessMs(at('2026-06-22T11:00:00'), at('2026-06-22T10:00:00'), hours)).toBe(0)
+  })
+  it('is the raw diff for 24/7', () => {
+    expect(elapsedBusinessMs(at('2026-06-22T10:00:00'), at('2026-06-22T11:00:00'), null)).toBe(
+      3_600_000
+    )
+  })
+  it('accumulates within a single day, clipping to end', () => {
+    // Mon 10:00 -> 11:00 inside first range = 60 min.
+    expect(elapsedBusinessMs(at('2026-06-22T10:00:00'), at('2026-06-22T11:00:00'), hours)).toBe(
+      60 * 60_000
+    )
+  })
+  it('accumulates across multiple days', () => {
+    // Mon 16:00 -> Tue 10:00: 60 (Mon 16-17) + 60 (Tue 09-10) = 120 min.
+    expect(elapsedBusinessMs(at('2026-06-22T16:00:00'), at('2026-06-23T10:00:00'), hours)).toBe(
+      120 * 60_000
+    )
+  })
+})
+
+describe('validators', () => {
+  it('isValidTimezone accepts IANA and rejects junk', () => {
+    expect(isValidTimezone('UTC')).toBe(true)
+    expect(isValidTimezone('Not/AZone')).toBe(false)
+  })
+  it('validateRange accepts valid and rejects bad format / inverted', () => {
+    expect(() => validateRange({ start: '09:00', end: '17:00' } as never)).not.toThrow()
+    expect(() => validateRange({ start: '9am', end: '5pm' } as never)).toThrow('invalid HH:MM')
+    expect(() => validateRange({ start: '17:00', end: '09:00' } as never)).toThrow('before end')
+  })
+  it('validateSchedule rejects overlapping ranges', () => {
+    expect(() => validateSchedule(week as never)).not.toThrow()
+    expect(() =>
+      validateSchedule({
+        ...week,
+        mon: [
+          { start: '09:00', end: '12:00' },
+          { start: '11:00', end: '13:00' },
+        ],
+      } as never)
+    ).toThrow('overlapping')
+  })
+  it('validateHolidays accepts valid dates and rejects bad ones', () => {
+    expect(() => validateHolidays([{ date: '2026-12-25' }] as never)).not.toThrow()
+    expect(() => validateHolidays([{ date: '2026/12/25' }] as never)).toThrow('invalid holiday')
+    expect(() => validateHolidays([{ date: '2026-13-40' }] as never)).toThrow('invalid holiday')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/sla/__tests__/business-hours.calc.test.ts b/apps/web/src/lib/server/domains/sla/__tests__/business-hours.calc.test.ts
new file mode 100644
index 000000000..1a82d6a05
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/__tests__/business-hours.calc.test.ts
@@ -0,0 +1,285 @@
+import { describe, expect, it } from 'vitest'
+import {
+  addBusinessMinutes,
+  subtractBusinessMinutes,
+  elapsedBusinessMs,
+  isWithinBusinessHours,
+  isValidTimezone,
+  validateRange,
+  validateSchedule,
+  validateHolidays,
+  type BusinessHoursLike,
+} from '../business-hours.calc'
+
+const NINE_TO_FIVE_UTC_WEEKDAYS: BusinessHoursLike = {
+  timezone: 'UTC',
+  schedule: {
+    mon: [{ start: '09:00', end: '17:00' }],
+    tue: [{ start: '09:00', end: '17:00' }],
+    wed: [{ start: '09:00', end: '17:00' }],
+    thu: [{ start: '09:00', end: '17:00' }],
+    fri: [{ start: '09:00', end: '17:00' }],
+    sat: [],
+    sun: [],
+  },
+  holidays: [],
+}
+
+describe('business-hours calc', () => {
+  describe('24/7 short-circuit', () => {
+    it('addBusinessMinutes with null hours adds raw minutes', () => {
+      const start = new Date('2026-01-05T10:00:00Z')
+      const out = addBusinessMinutes(start, 90, null)
+      expect(out.toISOString()).toBe('2026-01-05T11:30:00.000Z')
+    })
+
+    it('subtractBusinessMinutes with null hours subtracts raw minutes', () => {
+      const end = new Date('2026-01-05T10:00:00Z')
+      const out = subtractBusinessMinutes(end, 60, null)
+      expect(out.toISOString()).toBe('2026-01-05T09:00:00.000Z')
+    })
+
+    it('elapsedBusinessMs with null hours is wall-clock diff', () => {
+      const a = new Date('2026-01-05T10:00:00Z')
+      const b = new Date('2026-01-05T10:30:00Z')
+      expect(elapsedBusinessMs(a, b, null)).toBe(30 * 60_000)
+    })
+
+    it('isWithinBusinessHours with null hours is always true', () => {
+      expect(isWithinBusinessHours(new Date(), null)).toBe(true)
+    })
+  })
+
+  describe('addBusinessMinutes (9-5 UTC, weekdays)', () => {
+    it('adds within the same day', () => {
+      // Mon 2026-01-05 10:00 UTC + 60 = 11:00 UTC
+      const start = new Date('2026-01-05T10:00:00Z')
+      const out = addBusinessMinutes(start, 60, NINE_TO_FIVE_UTC_WEEKDAYS)
+      expect(out.toISOString()).toBe('2026-01-05T11:00:00.000Z')
+    })
+
+    it('clamps a pre-business start to opening time', () => {
+      // Mon 2026-01-05 06:00 UTC + 60 = clamps to 09:00, then +60 = 10:00 UTC
+      const start = new Date('2026-01-05T06:00:00Z')
+      const out = addBusinessMinutes(start, 60, NINE_TO_FIVE_UTC_WEEKDAYS)
+      expect(out.toISOString()).toBe('2026-01-05T10:00:00.000Z')
+    })
+
+    it('rolls past end of day to next morning', () => {
+      // Mon 2026-01-05 16:30 UTC + 60 = 30 min Mon (to 17:00) + 30 min Tue from 09:00 = Tue 09:30
+      const start = new Date('2026-01-05T16:30:00Z')
+      const out = addBusinessMinutes(start, 60, NINE_TO_FIVE_UTC_WEEKDAYS)
+      expect(out.toISOString()).toBe('2026-01-06T09:30:00.000Z')
+    })
+
+    it('skips weekends', () => {
+      // Fri 2026-01-09 16:30 UTC + 60 = 30 min Fri (to 17:00) + 30 min Mon 2026-01-12 from 09:00
+      const start = new Date('2026-01-09T16:30:00Z')
+      const out = addBusinessMinutes(start, 60, NINE_TO_FIVE_UTC_WEEKDAYS)
+      expect(out.toISOString()).toBe('2026-01-12T09:30:00.000Z')
+    })
+
+    it('skips holidays', () => {
+      const hours: BusinessHoursLike = {
+        ...NINE_TO_FIVE_UTC_WEEKDAYS,
+        holidays: [{ date: '2026-01-06' }],
+      }
+      // Mon 2026-01-05 16:30 UTC + 60 = 30 min Mon, then skip Tue holiday, +30 min Wed 09:00
+      const start = new Date('2026-01-05T16:30:00Z')
+      const out = addBusinessMinutes(start, 60, hours)
+      expect(out.toISOString()).toBe('2026-01-07T09:30:00.000Z')
+    })
+
+    it('returns input when minutes <= 0', () => {
+      const start = new Date('2026-01-05T10:00:00Z')
+      expect(addBusinessMinutes(start, 0, NINE_TO_FIVE_UTC_WEEKDAYS).getTime()).toBe(
+        start.getTime()
+      )
+    })
+
+    it('falls back to linear time when no business ranges are open for a year', () => {
+      const closed: BusinessHoursLike = {
+        timezone: 'UTC',
+        schedule: { mon: [], tue: [], wed: [], thu: [], fri: [], sat: [], sun: [] },
+        holidays: [],
+      }
+      const start = new Date('2026-01-05T10:00:00Z')
+      const out = addBusinessMinutes(start, 45, closed)
+      expect(out.toISOString()).toBe('2026-01-05T10:45:00.000Z')
+    })
+
+    it('moves to the next open range when the start is after closing time', () => {
+      const start = new Date('2026-01-05T18:00:00Z')
+      const out = addBusinessMinutes(start, 30, NINE_TO_FIVE_UTC_WEEKDAYS)
+      expect(out.toISOString()).toBe('2026-01-06T09:30:00.000Z')
+    })
+  })
+
+  describe('subtractBusinessMinutes', () => {
+    it('subtracts within the same day', () => {
+      const end = new Date('2026-01-05T11:00:00Z')
+      const out = subtractBusinessMinutes(end, 60, NINE_TO_FIVE_UTC_WEEKDAYS)
+      expect(out.toISOString()).toBe('2026-01-05T10:00:00.000Z')
+    })
+
+    it('rolls back to previous business day', () => {
+      // Tue 2026-01-06 09:30 UTC - 60 = 30 min Tue (to 09:00) + 30 min Mon (to 16:30)
+      const end = new Date('2026-01-06T09:30:00Z')
+      const out = subtractBusinessMinutes(end, 60, NINE_TO_FIVE_UTC_WEEKDAYS)
+      expect(out.toISOString()).toBe('2026-01-05T16:30:00.000Z')
+    })
+
+    it('returns input when minutes <= 0', () => {
+      const end = new Date('2026-01-05T11:00:00Z')
+      expect(subtractBusinessMinutes(end, 0, NINE_TO_FIVE_UTC_WEEKDAYS).getTime()).toBe(
+        end.getTime()
+      )
+    })
+
+    it('falls back to linear time when no prior business ranges are open for a year', () => {
+      const closed: BusinessHoursLike = {
+        timezone: 'UTC',
+        schedule: { mon: [], tue: [], wed: [], thu: [], fri: [], sat: [], sun: [] },
+        holidays: [],
+      }
+      const end = new Date('2026-01-05T10:00:00Z')
+      const out = subtractBusinessMinutes(end, 45, closed)
+      expect(out.toISOString()).toBe('2026-01-05T09:15:00.000Z')
+    })
+
+    it('moves to the previous open range when the end is before opening time', () => {
+      const end = new Date('2026-01-06T06:00:00Z')
+      const out = subtractBusinessMinutes(end, 30, NINE_TO_FIVE_UTC_WEEKDAYS)
+      expect(out.toISOString()).toBe('2026-01-05T16:30:00.000Z')
+    })
+  })
+
+  describe('elapsedBusinessMs', () => {
+    it('returns 0 when end <= start', () => {
+      const t = new Date('2026-01-05T10:00:00Z')
+      expect(elapsedBusinessMs(t, t, NINE_TO_FIVE_UTC_WEEKDAYS)).toBe(0)
+    })
+
+    it('counts only minutes within business hours', () => {
+      // Mon 2026-01-05 16:00 UTC → Tue 2026-01-06 10:00 UTC
+      // = 60 min (16:00-17:00 Mon) + 60 min (09:00-10:00 Tue) = 120 min
+      const start = new Date('2026-01-05T16:00:00Z')
+      const end = new Date('2026-01-06T10:00:00Z')
+      expect(elapsedBusinessMs(start, end, NINE_TO_FIVE_UTC_WEEKDAYS)).toBe(120 * 60_000)
+    })
+
+    it('skips weekends in elapsed calc', () => {
+      // Fri 2026-01-09 16:00 UTC → Mon 2026-01-12 10:00 UTC
+      // = 60 min Fri + 60 min Mon = 120 min
+      const start = new Date('2026-01-09T16:00:00Z')
+      const end = new Date('2026-01-12T10:00:00Z')
+      expect(elapsedBusinessMs(start, end, NINE_TO_FIVE_UTC_WEEKDAYS)).toBe(120 * 60_000)
+    })
+
+    it('skips ranges that end before the effective start', () => {
+      const start = new Date('2026-01-05T18:00:00Z')
+      const end = new Date('2026-01-06T08:00:00Z')
+      expect(elapsedBusinessMs(start, end, NINE_TO_FIVE_UTC_WEEKDAYS)).toBe(0)
+    })
+  })
+
+  describe('isWithinBusinessHours', () => {
+    it('true on a weekday at noon', () => {
+      expect(
+        isWithinBusinessHours(new Date('2026-01-05T12:00:00Z'), NINE_TO_FIVE_UTC_WEEKDAYS)
+      ).toBe(true)
+    })
+
+    it('false on a weekend', () => {
+      expect(
+        isWithinBusinessHours(new Date('2026-01-10T12:00:00Z'), NINE_TO_FIVE_UTC_WEEKDAYS)
+      ).toBe(false)
+    })
+
+    it('false outside the daily window', () => {
+      expect(
+        isWithinBusinessHours(new Date('2026-01-05T18:00:00Z'), NINE_TO_FIVE_UTC_WEEKDAYS)
+      ).toBe(false)
+    })
+
+    it('false on a holiday', () => {
+      const hours: BusinessHoursLike = {
+        ...NINE_TO_FIVE_UTC_WEEKDAYS,
+        holidays: [{ date: '2026-01-05' }],
+      }
+      expect(isWithinBusinessHours(new Date('2026-01-05T12:00:00Z'), hours)).toBe(false)
+    })
+  })
+
+  describe('validators', () => {
+    it('isValidTimezone accepts known IANA names', () => {
+      expect(isValidTimezone('UTC')).toBe(true)
+      expect(isValidTimezone('America/New_York')).toBe(true)
+    })
+
+    it('isValidTimezone rejects garbage', () => {
+      expect(isValidTimezone('Not/A/Real/Zone')).toBe(false)
+    })
+
+    it('validateRange rejects start >= end', () => {
+      expect(() => validateRange({ start: '17:00', end: '09:00' })).toThrow()
+      expect(() => validateRange({ start: '09:00', end: '09:00' })).toThrow()
+    })
+
+    it('validateRange rejects malformed HH:MM values', () => {
+      expect(() => validateRange({ start: '9:00', end: '17:00' })).toThrow()
+      expect(() => validateRange({ start: '09:00', end: '24:00' })).toThrow()
+    })
+
+    it('validateSchedule rejects overlapping ranges', () => {
+      expect(() =>
+        validateSchedule({
+          mon: [
+            { start: '09:00', end: '12:00' },
+            { start: '11:00', end: '14:00' },
+          ],
+          tue: [],
+          wed: [],
+          thu: [],
+          fri: [],
+          sat: [],
+          sun: [],
+        })
+      ).toThrow()
+    })
+
+    it('validateSchedule accepts non-overlapping ranges', () => {
+      expect(() =>
+        validateSchedule({
+          mon: [
+            { start: '09:00', end: '12:00' },
+            { start: '13:00', end: '17:00' },
+          ],
+          tue: [],
+          wed: [],
+          thu: [],
+          fri: [],
+          sat: [],
+          sun: [],
+        })
+      ).not.toThrow()
+    })
+
+    it('validateSchedule tolerates missing day arrays as closed days', () => {
+      expect(() =>
+        validateSchedule({
+          mon: [{ start: '09:00', end: '17:00' }],
+        } as unknown as BusinessHoursLike['schedule'])
+      ).not.toThrow()
+    })
+
+    it('validateHolidays rejects malformed dates', () => {
+      expect(() => validateHolidays([{ date: '2026-13-40' }])).toThrow()
+      expect(() => validateHolidays([{ date: 'not-a-date' }])).toThrow()
+    })
+
+    it('validateHolidays accepts ISO dates', () => {
+      expect(() => validateHolidays([{ date: '2026-01-01', label: 'NYD' }])).not.toThrow()
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/sla/__tests__/sla.engine.test.ts b/apps/web/src/lib/server/domains/sla/__tests__/sla.engine.test.ts
new file mode 100644
index 000000000..1de10b95a
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/__tests__/sla.engine.test.ts
@@ -0,0 +1,565 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  mockSelect: vi.fn(),
+  mockUpdate: vi.fn(),
+  mockInsert: vi.fn(),
+  mockBusinessHoursFindFirst: vi.fn(),
+  mockSlaPoliciesFindFirst: vi.fn(),
+  mockTicketSlaClocksFindFirst: vi.fn(),
+  mockWriteActivity: vi.fn(),
+  mockEq: vi.fn(),
+  mockAnd: vi.fn(),
+  mockOr: vi.fn(),
+  mockIsNull: vi.fn(),
+  mockAsc: vi.fn(),
+  mockInArray: vi.fn(),
+  mockSql: vi.fn(),
+  updateSets: [] as Record<string, unknown>[],
+  insertValues: [] as Record<string, unknown>[],
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: (...args: unknown[]) => hoisted.mockSelect(...args),
+    update: (...args: unknown[]) => hoisted.mockUpdate(...args),
+    insert: (...args: unknown[]) => hoisted.mockInsert(...args),
+    query: {
+      businessHours: {
+        findFirst: (...args: unknown[]) => hoisted.mockBusinessHoursFindFirst(...args),
+      },
+      slaPolicies: { findFirst: (...args: unknown[]) => hoisted.mockSlaPoliciesFindFirst(...args) },
+      ticketSlaClocks: {
+        findFirst: (...args: unknown[]) => hoisted.mockTicketSlaClocksFindFirst(...args),
+      },
+    },
+  },
+  businessHours: {
+    _name: 'business_hours',
+    id: 'businessHours.id',
+  },
+  slaPolicies: {
+    _name: 'sla_policies',
+    id: 'slaPolicies.id',
+    enabled: 'slaPolicies.enabled',
+    archivedAt: 'slaPolicies.archivedAt',
+    scope: 'slaPolicies.scope',
+    scopeTeamId: 'slaPolicies.scopeTeamId',
+    scopeInboxId: 'slaPolicies.scopeInboxId',
+    priority: 'slaPolicies.priority',
+    createdAt: 'slaPolicies.createdAt',
+  },
+  slaTargets: {
+    _name: 'sla_targets',
+    policyId: 'slaTargets.policyId',
+  },
+  ticketSlaClocks: {
+    _name: 'ticket_sla_clocks',
+    id: 'ticketSlaClocks.id',
+    ticketId: 'ticketSlaClocks.ticketId',
+    kind: 'ticketSlaClocks.kind',
+    state: 'ticketSlaClocks.state',
+  },
+  tickets: {
+    _name: 'tickets',
+    id: 'tickets.id',
+  },
+  eq: (...args: unknown[]) => hoisted.mockEq(...args),
+  and: (...args: unknown[]) => hoisted.mockAnd(...args),
+  or: (...args: unknown[]) => hoisted.mockOr(...args),
+  isNull: (...args: unknown[]) => hoisted.mockIsNull(...args),
+  asc: (...args: unknown[]) => hoisted.mockAsc(...args),
+  inArray: (...args: unknown[]) => hoisted.mockInArray(...args),
+  sql: (...args: unknown[]) => hoisted.mockSql(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.service', () => ({
+  writeActivity: (...args: unknown[]) => hoisted.mockWriteActivity(...args),
+}))
+
+const engine = await import('../sla.engine')
+
+type ThenableChain = {
+  from: ReturnType<typeof vi.fn>
+  where: ReturnType<typeof vi.fn>
+  orderBy: ReturnType<typeof vi.fn>
+  limit: ReturnType<typeof vi.fn>
+  then: Promise<unknown[]>['then']
+  catch: Promise<unknown[]>['catch']
+  finally: Promise<unknown[]>['finally']
+}
+
+function makeSelectChain(rows: unknown[]): ThenableChain {
+  const promise = Promise.resolve(rows)
+  const chain = {
+    from: vi.fn(() => chain),
+    where: vi.fn(() => chain),
+    orderBy: vi.fn(() => chain),
+    limit: vi.fn(() => chain),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  } as ThenableChain
+  return chain
+}
+
+function makeUpdateChain() {
+  const promise = Promise.resolve(undefined)
+  const chain = {
+    set: vi.fn((value: Record<string, unknown>) => {
+      hoisted.updateSets.push(value)
+      return chain
+    }),
+    where: vi.fn(() => chain),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  }
+  return chain
+}
+
+function makeInsertChain(rows: unknown[]) {
+  return {
+    values: vi.fn((value: Record<string, unknown>) => {
+      hoisted.insertValues.push(value)
+      return {
+        returning: vi.fn().mockResolvedValue(rows),
+      }
+    }),
+  }
+}
+
+function policy(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'sla_workspace',
+    name: 'Workspace SLA',
+    scope: 'workspace',
+    scopeTeamId: null,
+    scopeInboxId: null,
+    priority: 100,
+    appliesToPriorities: [],
+    businessHoursId: null,
+    pauseOnPending: true,
+    pauseOnOnHold: true,
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    ...overrides,
+  }
+}
+
+function target(kind: string, minutes = 30, id = `target_${kind}`) {
+  return { id, policyId: 'sla_1', kind, minutes }
+}
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'ticket_1',
+    inboxId: 'inbox_1',
+    primaryTeamId: 'team_1',
+    priority: 'normal',
+    slaPolicyId: 'sla_1',
+    ...overrides,
+  }
+}
+
+function clock(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'clock_1',
+    ticketId: 'ticket_1',
+    policyId: 'sla_1',
+    targetId: 'target_resolution',
+    kind: 'resolution',
+    state: 'running',
+    targetMinutes: 30,
+    startedAt: new Date('2026-01-01T10:00:00.000Z'),
+    pausedAt: null,
+    accumulatedPausedMs: 0,
+    dueAt: new Date('2026-01-01T10:30:00.000Z'),
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  hoisted.mockSelect.mockReset()
+  hoisted.mockUpdate.mockReset()
+  hoisted.mockInsert.mockReset()
+  hoisted.mockBusinessHoursFindFirst.mockReset()
+  hoisted.mockSlaPoliciesFindFirst.mockReset()
+  hoisted.mockTicketSlaClocksFindFirst.mockReset()
+  hoisted.mockWriteActivity.mockReset()
+  hoisted.mockEq.mockReset()
+  hoisted.mockAnd.mockReset()
+  hoisted.mockOr.mockReset()
+  hoisted.mockIsNull.mockReset()
+  hoisted.mockAsc.mockReset()
+  hoisted.mockInArray.mockReset()
+  hoisted.mockSql.mockReset()
+  hoisted.updateSets.length = 0
+  hoisted.insertValues.length = 0
+  hoisted.mockEq.mockImplementation((...args: unknown[]) => ['eq', ...args])
+  hoisted.mockAnd.mockImplementation((...args: unknown[]) => ['and', ...args])
+  hoisted.mockOr.mockImplementation((...args: unknown[]) => ['or', ...args])
+  hoisted.mockIsNull.mockImplementation((...args: unknown[]) => ['isNull', ...args])
+  hoisted.mockAsc.mockImplementation((...args: unknown[]) => ['asc', ...args])
+  hoisted.mockInArray.mockImplementation((...args: unknown[]) => ['inArray', ...args])
+  hoisted.mockSql.mockImplementation((...args: unknown[]) => ['sql', ...args])
+  hoisted.mockUpdate.mockImplementation(() => makeUpdateChain())
+  hoisted.mockWriteActivity.mockResolvedValue({ id: 'activity_1' })
+})
+
+describe('selectPolicyForTicket', () => {
+  it('prefers matching inbox policies over team and workspace policies after priority filtering', async () => {
+    hoisted.mockSelect.mockReturnValueOnce(
+      makeSelectChain([
+        policy({ id: 'sla_workspace_low_only', appliesToPriorities: ['low'] }),
+        policy({ id: 'sla_team', scope: 'team', scopeTeamId: 'team_1' }),
+        policy({ id: 'sla_inbox', scope: 'inbox', scopeInboxId: 'inbox_1' }),
+      ])
+    )
+
+    const result = await engine.selectPolicyForTicket({
+      inboxId: 'inbox_1' as never,
+      primaryTeamId: 'team_1' as never,
+      priority: 'normal',
+    })
+
+    expect(result?.id).toBe('sla_inbox')
+  })
+
+  it('returns null when no candidate applies and builds false scope predicates for null resources', async () => {
+    hoisted.mockSelect.mockReturnValueOnce(
+      makeSelectChain([policy({ id: 'urgent_only', appliesToPriorities: ['urgent'] })])
+    )
+
+    const result = await engine.selectPolicyForTicket({
+      inboxId: null,
+      primaryTeamId: null,
+      priority: 'normal',
+    })
+
+    expect(result).toBeNull()
+    expect(hoisted.mockSql).toHaveBeenCalled()
+  })
+})
+
+describe('attachClocksOnCreate', () => {
+  it('assigns the selected policy and starts first-response and resolution clocks', async () => {
+    const selectedPolicy = policy({
+      id: 'sla_1',
+      name: 'Selected',
+      scope: 'workspace',
+      businessHoursId: 'bh_1',
+    })
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([selectedPolicy]))
+      .mockReturnValueOnce(
+        makeSelectChain([target('first_response', 10), target('resolution', 60)])
+      )
+    hoisted.mockBusinessHoursFindFirst.mockResolvedValueOnce({
+      timezone: 'UTC',
+      schedule: {
+        mon: [{ start: '09:00', end: '17:00' }],
+        tue: [],
+        wed: [],
+        thu: [],
+        fri: [],
+        sat: [],
+        sun: [],
+      },
+    })
+    hoisted.mockTicketSlaClocksFindFirst.mockResolvedValueOnce(null).mockResolvedValueOnce(null)
+    hoisted.mockInsert
+      .mockReturnValueOnce(makeInsertChain([clock({ id: 'clock_first', kind: 'first_response' })]))
+      .mockReturnValueOnce(makeInsertChain([clock({ id: 'clock_resolution' })]))
+
+    const result = await engine.attachClocksOnCreate(
+      ticket({ slaPolicyId: null }) as never,
+      'principal_agent' as never
+    )
+
+    expect(result.policy?.id).toBe('sla_1')
+    expect(result.started.map((row) => row.id)).toEqual(['clock_first', 'clock_resolution'])
+    expect(hoisted.updateSets).toContainEqual({ slaPolicyId: 'sla_1' })
+    expect(hoisted.mockWriteActivity).toHaveBeenCalledWith(
+      'ticket_1',
+      'principal_agent',
+      'sla.policy_assigned',
+      expect.objectContaining({ policyId: 'sla_1', policyName: 'Selected' })
+    )
+    expect(hoisted.insertValues).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ kind: 'first_response', targetMinutes: 10 }),
+        expect.objectContaining({ kind: 'resolution', targetMinutes: 60 }),
+      ])
+    )
+  })
+
+  it('returns an empty start set when no policy matches', async () => {
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain([]))
+
+    await expect(engine.attachClocksOnCreate(ticket() as never, null)).resolves.toEqual({
+      policy: null,
+      started: [],
+    })
+    expect(hoisted.mockInsert).not.toHaveBeenCalled()
+  })
+
+  it('reuses an already active clock instead of inserting a duplicate', async () => {
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([policy({ id: 'sla_1' })]))
+      .mockReturnValueOnce(makeSelectChain([target('first_response', 10)]))
+    const existingClock = clock({ id: 'clock_existing', kind: 'first_response' })
+    hoisted.mockTicketSlaClocksFindFirst.mockResolvedValueOnce(existingClock)
+
+    const result = await engine.attachClocksOnCreate(ticket() as never, null)
+
+    expect(result.started).toEqual([existingClock])
+    expect(hoisted.mockInsert).not.toHaveBeenCalled()
+  })
+
+  it('falls back to 24/7 clock math when the policy business-hours row is missing', async () => {
+    hoisted.mockSelect
+      .mockReturnValueOnce(
+        makeSelectChain([policy({ id: 'sla_1', businessHoursId: 'bh_missing' })])
+      )
+      .mockReturnValueOnce(makeSelectChain([target('first_response', 20)]))
+    hoisted.mockBusinessHoursFindFirst.mockResolvedValueOnce(null)
+    hoisted.mockTicketSlaClocksFindFirst.mockResolvedValueOnce(null)
+    hoisted.mockInsert.mockReturnValueOnce(
+      makeInsertChain([clock({ id: 'clock_first', kind: 'first_response' })])
+    )
+
+    const result = await engine.attachClocksOnCreate(ticket() as never, null)
+
+    expect(result.started).toHaveLength(1)
+    expect(hoisted.insertValues).toEqual(
+      expect.arrayContaining([expect.objectContaining({ kind: 'first_response' })])
+    )
+  })
+})
+
+describe('reply hooks', () => {
+  it('marks first and next response clocks as met on public agent replies', async () => {
+    hoisted.mockTicketSlaClocksFindFirst
+      .mockResolvedValueOnce(clock({ id: 'clock_first', kind: 'first_response' }))
+      .mockResolvedValueOnce(clock({ id: 'clock_next', kind: 'next_response' }))
+
+    await engine.onPublicAgentReply(ticket() as never, 'principal_agent' as never)
+
+    expect(hoisted.updateSets).toEqual([
+      expect.objectContaining({ state: 'met', metAt: expect.any(Date) }),
+      expect.objectContaining({ state: 'met', metAt: expect.any(Date) }),
+    ])
+    expect(hoisted.mockWriteActivity).toHaveBeenCalledWith(
+      'ticket_1',
+      'principal_agent',
+      'sla.met',
+      { clockId: 'clock_first', kind: 'first_response' }
+    )
+    expect(hoisted.mockWriteActivity).toHaveBeenCalledWith(
+      'ticket_1',
+      'principal_agent',
+      'sla.met',
+      { clockId: 'clock_next', kind: 'next_response' }
+    )
+  })
+
+  it('leaves reply clocks unchanged when no active first or next response clock exists', async () => {
+    hoisted.mockTicketSlaClocksFindFirst.mockResolvedValueOnce(null).mockResolvedValueOnce(null)
+
+    await engine.onPublicAgentReply(ticket() as never, 'principal_agent' as never)
+
+    expect(hoisted.updateSets).toEqual([])
+    expect(hoisted.mockWriteActivity).not.toHaveBeenCalled()
+  })
+
+  it('restarts a next-response clock on customer replies and noops without policy or target', async () => {
+    await engine.onCustomerReply(ticket({ slaPolicyId: null }) as never, null)
+    expect(hoisted.mockSlaPoliciesFindFirst).not.toHaveBeenCalled()
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(null)
+    await engine.onCustomerReply(ticket() as never, null)
+    expect(hoisted.mockSelect).not.toHaveBeenCalled()
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(policy({ id: 'sla_1' }))
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain([]))
+    await engine.onCustomerReply(ticket() as never, null)
+    expect(hoisted.mockInsert).not.toHaveBeenCalled()
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(policy({ id: 'sla_1' }))
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain([target('next_response', 15)]))
+    hoisted.mockTicketSlaClocksFindFirst.mockResolvedValueOnce(null)
+    hoisted.mockInsert.mockReturnValueOnce(
+      makeInsertChain([clock({ id: 'clock_next', kind: 'next_response' })])
+    )
+
+    await engine.onCustomerReply(ticket() as never, 'principal_customer' as never)
+
+    expect(hoisted.updateSets).toContainEqual({ state: 'cancelled' })
+    expect(hoisted.insertValues).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ kind: 'next_response', targetMinutes: 15 }),
+      ])
+    )
+  })
+})
+
+describe('status transition hook', () => {
+  it('pauses running clocks when entering a pausing status', async () => {
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(
+      policy({ id: 'sla_1', pauseOnPending: true })
+    )
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain([clock({ id: 'clock_running' })]))
+
+    await engine.onStatusTransition(
+      ticket() as never,
+      'open',
+      'pending',
+      'principal_agent' as never
+    )
+
+    expect(hoisted.updateSets).toContainEqual(
+      expect.objectContaining({ state: 'paused', pausedAt: expect.any(Date) })
+    )
+    expect(hoisted.mockWriteActivity).toHaveBeenCalledWith(
+      'ticket_1',
+      'principal_agent',
+      'sla.paused',
+      expect.objectContaining({ clockId: 'clock_running', reason: 'pending' })
+    )
+  })
+
+  it('pauses from a null previous category when entering on-hold', async () => {
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(
+      policy({ id: 'sla_1', pauseOnOnHold: true })
+    )
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain([clock({ id: 'clock_hold' })]))
+
+    await engine.onStatusTransition(ticket() as never, null, 'on_hold', null)
+
+    expect(hoisted.updateSets).toContainEqual(
+      expect.objectContaining({ state: 'paused', pausedAt: expect.any(Date) })
+    )
+  })
+
+  it('resumes paused clocks and shifts due dates when leaving a pausing status', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-01-01T10:30:00.000Z'))
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(
+      policy({ id: 'sla_1', pauseOnPending: true })
+    )
+    hoisted.mockSelect.mockReturnValueOnce(
+      makeSelectChain([
+        clock({
+          id: 'clock_paused',
+          state: 'paused',
+          targetMinutes: 60,
+          startedAt: new Date('2026-01-01T09:00:00.000Z'),
+          pausedAt: new Date('2026-01-01T09:30:00.000Z'),
+          accumulatedPausedMs: 1_000,
+        }),
+      ])
+    )
+
+    await engine.onStatusTransition(
+      ticket() as never,
+      'pending',
+      'open',
+      'principal_agent' as never
+    )
+
+    expect(hoisted.updateSets).toContainEqual(
+      expect.objectContaining({
+        state: 'running',
+        pausedAt: null,
+        accumulatedPausedMs: 3_601_000,
+        dueAt: expect.any(Date),
+      })
+    )
+    expect(hoisted.mockWriteActivity).toHaveBeenCalledWith(
+      'ticket_1',
+      'principal_agent',
+      'sla.resumed',
+      expect.objectContaining({ clockId: 'clock_paused', pausedMs: 3_600_000 })
+    )
+    vi.useRealTimers()
+  })
+
+  it('resumes clocks with null pause metadata using minimum remaining time', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-01-01T10:30:00.000Z'))
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(
+      policy({ id: 'sla_1', pauseOnOnHold: true })
+    )
+    hoisted.mockSelect.mockReturnValueOnce(
+      makeSelectChain([
+        clock({
+          id: 'clock_paused_nulls',
+          state: 'paused',
+          targetMinutes: 1,
+          startedAt: new Date('2026-01-01T09:00:00.000Z'),
+          pausedAt: null,
+          accumulatedPausedMs: null,
+        }),
+      ])
+    )
+
+    await engine.onStatusTransition(ticket() as never, 'on_hold', 'open', null)
+
+    expect(hoisted.updateSets).toContainEqual(
+      expect.objectContaining({
+        state: 'running',
+        pausedAt: null,
+        accumulatedPausedMs: 0,
+        dueAt: expect.any(Date),
+      })
+    )
+    vi.useRealTimers()
+  })
+
+  it('marks resolution met on solved, cancels active clocks on closed, and restarts resolution on reopen', async () => {
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(policy({ id: 'sla_1' }))
+    hoisted.mockTicketSlaClocksFindFirst.mockResolvedValueOnce(clock({ id: 'clock_resolution' }))
+    await engine.onStatusTransition(ticket() as never, 'open', 'solved', 'principal_agent' as never)
+    expect(hoisted.updateSets).toContainEqual(
+      expect.objectContaining({ state: 'met', metAt: expect.any(Date) })
+    )
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(policy({ id: 'sla_1' }))
+    hoisted.mockTicketSlaClocksFindFirst.mockResolvedValueOnce(null)
+    await engine.onStatusTransition(ticket() as never, 'open', 'solved', null)
+    expect(hoisted.updateSets.filter((set) => set.state === 'met')).toHaveLength(1)
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(policy({ id: 'sla_1' }))
+    hoisted.mockSelect.mockReturnValueOnce(
+      makeSelectChain([
+        clock({ id: 'clock_first', kind: 'first_response' }),
+        clock({ id: 'clock_next', kind: 'next_response' }),
+      ])
+    )
+    await engine.onStatusTransition(ticket() as never, 'solved', 'closed', null)
+    expect(hoisted.updateSets.filter((set) => set.state === 'cancelled')).toHaveLength(2)
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(policy({ id: 'sla_1' }))
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain([target('resolution', 45)]))
+    hoisted.mockTicketSlaClocksFindFirst.mockResolvedValueOnce(null)
+    hoisted.mockInsert.mockReturnValueOnce(makeInsertChain([clock({ id: 'clock_reopened' })]))
+    await engine.onStatusTransition(ticket() as never, 'solved', 'open', 'principal_agent' as never)
+    expect(hoisted.insertValues).toEqual(
+      expect.arrayContaining([expect.objectContaining({ kind: 'resolution', targetMinutes: 45 })])
+    )
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(policy({ id: 'sla_1' }))
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain([]))
+    await engine.onStatusTransition(ticket() as never, 'closed', 'open', null)
+    expect(hoisted.insertValues.filter((value) => value.kind === 'resolution')).toHaveLength(1)
+  })
+
+  it('noops when the ticket is unbound or the stored policy is missing', async () => {
+    await engine.onStatusTransition(ticket({ slaPolicyId: null }) as never, 'open', 'pending', null)
+    expect(hoisted.mockSlaPoliciesFindFirst).not.toHaveBeenCalled()
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(null)
+    await engine.onStatusTransition(ticket() as never, 'open', 'pending', null)
+    expect(hoisted.mockSelect).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/sla/__tests__/sla.escalations.test.ts b/apps/web/src/lib/server/domains/sla/__tests__/sla.escalations.test.ts
new file mode 100644
index 000000000..1b6b7ec70
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/__tests__/sla.escalations.test.ts
@@ -0,0 +1,462 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  mockSelect: vi.fn(),
+  mockUpdate: vi.fn(),
+  mockInsert: vi.fn(),
+  mockTicketsFindFirst: vi.fn(),
+  mockWriteActivity: vi.fn(),
+  mockNotifyTicketSlaBreach: vi.fn(),
+  mockNotifyTicketSlaWarning: vi.fn(),
+  mockDispatchTicketSlaBreach: vi.fn(),
+  mockDispatchTicketSlaWarning: vi.fn(),
+  mockConsoleLog: vi.fn(),
+  mockConsoleWarn: vi.fn(),
+  mockEq: vi.fn(),
+  mockAnd: vi.fn(),
+  mockLte: vi.fn(),
+  mockIsNull: vi.fn(),
+  mockOr: vi.fn(),
+  mockSql: vi.fn(),
+  insertedLogs: [] as Record<string, unknown>[],
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: (...args: unknown[]) => hoisted.mockSelect(...args),
+    update: (...args: unknown[]) => hoisted.mockUpdate(...args),
+    insert: (...args: unknown[]) => hoisted.mockInsert(...args),
+    query: {
+      tickets: { findFirst: (...args: unknown[]) => hoisted.mockTicketsFindFirst(...args) },
+    },
+  },
+  ticketSlaClocks: {
+    _name: 'ticket_sla_clocks',
+    id: 'ticketSlaClocks.id',
+    ticketId: 'ticketSlaClocks.ticketId',
+    kind: 'ticketSlaClocks.kind',
+    state: 'ticketSlaClocks.state',
+    dueAt: 'ticketSlaClocks.dueAt',
+    policyId: 'ticketSlaClocks.policyId',
+    lastEscalatedAt: 'ticketSlaClocks.lastEscalatedAt',
+  },
+  escalationRules: {
+    _name: 'escalation_rules',
+    enabled: 'escalationRules.enabled',
+  },
+  slaEscalationLog: {
+    _name: 'sla_escalation_log',
+  },
+  tickets: {
+    _name: 'tickets',
+    id: 'tickets.id',
+  },
+  inboxMemberships: {
+    _name: 'inbox_memberships',
+    inboxId: 'inboxMemberships.inboxId',
+    principalId: 'inboxMemberships.principalId',
+  },
+  eq: (...args: unknown[]) => hoisted.mockEq(...args),
+  and: (...args: unknown[]) => hoisted.mockAnd(...args),
+  lte: (...args: unknown[]) => hoisted.mockLte(...args),
+  isNull: (...args: unknown[]) => hoisted.mockIsNull(...args),
+  or: (...args: unknown[]) => hoisted.mockOr(...args),
+  sql: (...args: unknown[]) => hoisted.mockSql(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.service', () => ({
+  writeActivity: (...args: unknown[]) => hoisted.mockWriteActivity(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.notifications', () => ({
+  notifyTicketSlaBreach: (...args: unknown[]) => hoisted.mockNotifyTicketSlaBreach(...args),
+  notifyTicketSlaWarning: (...args: unknown[]) => hoisted.mockNotifyTicketSlaWarning(...args),
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchTicketSlaBreach: (...args: unknown[]) => hoisted.mockDispatchTicketSlaBreach(...args),
+  dispatchTicketSlaWarning: (...args: unknown[]) => hoisted.mockDispatchTicketSlaWarning(...args),
+}))
+
+const { runEscalationTick } = await import('../sla.escalations')
+
+type SelectChain = {
+  from: ReturnType<typeof vi.fn>
+  where: ReturnType<typeof vi.fn>
+  limit: ReturnType<typeof vi.fn>
+  then: Promise<unknown[]>['then']
+  catch: Promise<unknown[]>['catch']
+  finally: Promise<unknown[]>['finally']
+}
+
+function makeSelectChain(rows: unknown[]): SelectChain {
+  const promise = Promise.resolve(rows)
+  const chain = {
+    from: vi.fn(() => chain),
+    where: vi.fn(() => chain),
+    limit: vi.fn(() => chain),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  } as SelectChain
+  return chain
+}
+
+function makeUpdateChain(rows: unknown[]) {
+  return {
+    set: vi.fn().mockReturnThis(),
+    where: vi.fn().mockReturnThis(),
+    returning: vi.fn().mockResolvedValue(rows),
+  }
+}
+
+function makeInsertLogChain() {
+  const promise = Promise.resolve(undefined)
+  return {
+    values: vi.fn((value: Record<string, unknown>) => {
+      hoisted.insertedLogs.push(value)
+      return {
+        then: promise.then.bind(promise),
+        catch: promise.catch.bind(promise),
+        finally: promise.finally.bind(promise),
+      }
+    }),
+  }
+}
+
+function clock(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'clock_1',
+    ticketId: 'ticket_1',
+    policyId: 'sla_1',
+    kind: 'resolution',
+    state: 'running',
+    dueAt: new Date('2026-01-01T10:00:00.000Z'),
+    lastEscalatedAt: null,
+    ...overrides,
+  }
+}
+
+function rule(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'rule_1',
+    policyId: 'sla_1',
+    name: 'Warn owners',
+    leadMinutes: 30,
+    targetKind: 'resolution',
+    recipientType: 'principals',
+    recipientPrincipalIds: ['principal_1'],
+    recipientTeamId: null,
+    channels: ['in_app'],
+    enabled: true,
+    ...overrides,
+  }
+}
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'ticket_1',
+    subject: 'Help',
+    assigneePrincipalId: 'principal_assignee',
+    inboxId: 'inbox_1',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  hoisted.mockSelect.mockReset()
+  hoisted.mockUpdate.mockReset()
+  hoisted.mockInsert.mockReset()
+  hoisted.mockTicketsFindFirst.mockReset()
+  hoisted.mockWriteActivity.mockReset()
+  hoisted.mockNotifyTicketSlaBreach.mockReset()
+  hoisted.mockNotifyTicketSlaWarning.mockReset()
+  hoisted.mockDispatchTicketSlaBreach.mockReset()
+  hoisted.mockDispatchTicketSlaWarning.mockReset()
+  hoisted.mockConsoleLog.mockReset()
+  hoisted.mockConsoleWarn.mockReset()
+  hoisted.mockEq.mockReset()
+  hoisted.mockAnd.mockReset()
+  hoisted.mockLte.mockReset()
+  hoisted.mockIsNull.mockReset()
+  hoisted.mockOr.mockReset()
+  hoisted.mockSql.mockReset()
+  hoisted.insertedLogs.length = 0
+
+  hoisted.mockEq.mockImplementation((...args: unknown[]) => ['eq', ...args])
+  hoisted.mockAnd.mockImplementation((...args: unknown[]) => ['and', ...args])
+  hoisted.mockLte.mockImplementation((...args: unknown[]) => ['lte', ...args])
+  hoisted.mockIsNull.mockImplementation((...args: unknown[]) => ['isNull', ...args])
+  hoisted.mockOr.mockImplementation((...args: unknown[]) => ['or', ...args])
+  hoisted.mockSql.mockImplementation((...args: unknown[]) => ['sql', ...args])
+  hoisted.mockInsert.mockImplementation(() => makeInsertLogChain())
+  hoisted.mockWriteActivity.mockResolvedValue({ id: 'activity_1' })
+  hoisted.mockNotifyTicketSlaBreach.mockResolvedValue(undefined)
+  hoisted.mockNotifyTicketSlaWarning.mockResolvedValue(undefined)
+  hoisted.mockDispatchTicketSlaBreach.mockResolvedValue(undefined)
+  hoisted.mockDispatchTicketSlaWarning.mockResolvedValue(undefined)
+  vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) =>
+    hoisted.mockConsoleLog(...args)
+  )
+  vi.spyOn(console, 'warn').mockImplementation((...args: unknown[]) =>
+    hoisted.mockConsoleWarn(...args)
+  )
+})
+
+describe('runEscalationTick', () => {
+  it('marks due clocks as breached and dispatches breach notifications and webhooks', async () => {
+    const due = clock({
+      id: 'clock_due',
+      kind: 'first_response',
+      dueAt: '2026-01-01T10:00:00.000Z',
+    })
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([due]))
+      .mockReturnValueOnce(makeSelectChain([]))
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([due]))
+    hoisted.mockTicketsFindFirst.mockResolvedValueOnce(ticket({ id: 'ticket_1' }))
+
+    const result = await runEscalationTick({
+      now: new Date('2026-01-01T10:05:00.000Z'),
+      batchSize: 5,
+    })
+
+    expect(result).toEqual({ breached: 1, escalated: 0, considered: 0 })
+    expect(hoisted.mockWriteActivity).toHaveBeenCalledWith('ticket_1', null, 'sla.breached', {
+      clockId: 'clock_due',
+      kind: 'first_response',
+      dueAt: '2026-01-01T10:00:00.000Z',
+    })
+    expect(hoisted.mockNotifyTicketSlaBreach).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 'ticket_1' }),
+      'first_response'
+    )
+    expect(hoisted.mockDispatchTicketSlaBreach).toHaveBeenCalledWith(
+      { type: 'service', displayName: 'sla-engine' },
+      expect.objectContaining({ id: 'ticket_1' }),
+      'first_response'
+    )
+  })
+
+  it('skips breach side effects when the concurrency update loses the race', async () => {
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([clock({ id: 'clock_due' })]))
+      .mockReturnValueOnce(makeSelectChain([]))
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([]))
+
+    await expect(runEscalationTick()).resolves.toEqual({ breached: 0, escalated: 0, considered: 0 })
+    expect(hoisted.mockNotifyTicketSlaBreach).not.toHaveBeenCalled()
+  })
+
+  it('logs principal-recipient escalations, warns via in-app, and defers non-in-app channels', async () => {
+    const candidate = clock({ id: 'clock_warn' })
+    const escalationRule = rule({
+      id: 'rule_principals',
+      name: 'Warn principals',
+      channels: ['in_app', 'email'],
+      recipientPrincipalIds: ['principal_1', 'principal_2'],
+    })
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([]))
+      .mockReturnValueOnce(makeSelectChain([escalationRule]))
+      .mockReturnValueOnce(makeSelectChain([candidate]))
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([candidate]))
+    hoisted.mockTicketsFindFirst.mockResolvedValueOnce(ticket())
+
+    const result = await runEscalationTick({ now: new Date('2026-01-01T09:45:00.000Z') })
+
+    expect(result).toEqual({ breached: 0, escalated: 1, considered: 1 })
+    expect(hoisted.mockNotifyTicketSlaWarning).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 'ticket_1' }),
+      'resolution',
+      'Warn principals',
+      ['principal_1', 'principal_2']
+    )
+    expect(hoisted.mockConsoleLog).toHaveBeenCalledWith(
+      expect.stringContaining('non-in_app channels deferred')
+    )
+    expect(hoisted.insertedLogs).toEqual([
+      expect.objectContaining({
+        clockId: 'clock_warn',
+        ruleId: 'rule_principals',
+        recipientPrincipalIds: ['principal_1', 'principal_2'],
+        channels: ['in_app', 'email'],
+        context: expect.objectContaining({ ticketId: 'ticket_1', leadMinutes: 30 }),
+      }),
+    ])
+    expect(hoisted.mockWriteActivity).toHaveBeenCalledWith(
+      'ticket_1',
+      null,
+      'sla.escalated',
+      expect.objectContaining({ ruleId: 'rule_principals', recipientCount: 2 })
+    )
+  })
+
+  it('supports team recipient fallbacks and default empty channel arrays', async () => {
+    const candidate = clock({ id: 'clock_team' })
+    const teamRule = rule({
+      id: 'rule_team',
+      recipientType: 'team',
+      recipientPrincipalIds: undefined,
+      channels: undefined,
+    })
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([]))
+      .mockReturnValueOnce(makeSelectChain([teamRule]))
+      .mockReturnValueOnce(makeSelectChain([candidate]))
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([candidate]))
+
+    const result = await runEscalationTick()
+
+    expect(result).toEqual({ breached: 0, escalated: 1, considered: 1 })
+    expect(hoisted.mockNotifyTicketSlaWarning).not.toHaveBeenCalled()
+    expect(hoisted.insertedLogs).toEqual([
+      expect.objectContaining({
+        ruleId: 'rule_team',
+        recipientPrincipalIds: [],
+        channels: undefined,
+      }),
+    ])
+  })
+
+  it('resolves assignee and inbox-member escalation recipients', async () => {
+    const assigneeRule = rule({
+      id: 'rule_assignee',
+      recipientType: 'assignee',
+      recipientPrincipalIds: [],
+    })
+    const inboxRule = rule({
+      id: 'rule_inbox',
+      recipientType: 'inbox_members',
+      recipientPrincipalIds: [],
+    })
+    const assigneeClock = clock({ id: 'clock_assignee' })
+    const inboxClock = clock({ id: 'clock_inbox' })
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([]))
+      .mockReturnValueOnce(makeSelectChain([assigneeRule, inboxRule]))
+      .mockReturnValueOnce(makeSelectChain([assigneeClock]))
+      .mockReturnValueOnce(makeSelectChain([inboxClock]))
+      .mockReturnValueOnce(
+        makeSelectChain([{ principalId: 'principal_a' }, { principalId: 'principal_b' }])
+      )
+    hoisted.mockUpdate
+      .mockReturnValueOnce(makeUpdateChain([assigneeClock]))
+      .mockReturnValueOnce(makeUpdateChain([inboxClock]))
+    hoisted.mockTicketsFindFirst
+      .mockResolvedValueOnce(ticket({ assigneePrincipalId: 'principal_assignee' }))
+      .mockResolvedValueOnce(ticket())
+      .mockResolvedValueOnce(ticket({ inboxId: 'inbox_1' }))
+      .mockResolvedValueOnce(ticket())
+
+    const result = await runEscalationTick()
+
+    expect(result.escalated).toBe(2)
+    expect(hoisted.mockNotifyTicketSlaWarning).toHaveBeenCalledWith(
+      expect.any(Object),
+      'resolution',
+      'Warn owners',
+      ['principal_assignee']
+    )
+    expect(hoisted.mockNotifyTicketSlaWarning).toHaveBeenCalledWith(
+      expect.any(Object),
+      'resolution',
+      'Warn owners',
+      ['principal_a', 'principal_b']
+    )
+  })
+
+  it('returns no recipients for unassigned or uninboxed escalation targets', async () => {
+    const assigneeRule = rule({
+      id: 'rule_assignee_empty',
+      recipientType: 'assignee',
+      recipientPrincipalIds: [],
+    })
+    const inboxRule = rule({
+      id: 'rule_inbox_empty',
+      recipientType: 'inbox_members',
+      recipientPrincipalIds: [],
+    })
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([]))
+      .mockReturnValueOnce(makeSelectChain([assigneeRule, inboxRule]))
+      .mockReturnValueOnce(makeSelectChain([clock({ id: 'clock_assignee_empty' })]))
+      .mockReturnValueOnce(makeSelectChain([clock({ id: 'clock_inbox_empty' })]))
+    hoisted.mockUpdate
+      .mockReturnValueOnce(makeUpdateChain([clock({ id: 'clock_assignee_empty' })]))
+      .mockReturnValueOnce(makeUpdateChain([clock({ id: 'clock_inbox_empty' })]))
+    hoisted.mockTicketsFindFirst
+      .mockResolvedValueOnce(ticket({ assigneePrincipalId: null }))
+      .mockResolvedValueOnce(ticket({ inboxId: null }))
+
+    const result = await runEscalationTick()
+
+    expect(result.escalated).toBe(2)
+    expect(hoisted.mockNotifyTicketSlaWarning).not.toHaveBeenCalled()
+    expect(hoisted.insertedLogs.map((entry) => entry.recipientPrincipalIds)).toEqual([[], []])
+  })
+
+  it('counts considered clocks without logging when the escalation anti-spam update loses', async () => {
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([]))
+      .mockReturnValueOnce(makeSelectChain([rule()]))
+      .mockReturnValueOnce(makeSelectChain([clock({ id: 'clock_raced' })]))
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([]))
+
+    const result = await runEscalationTick()
+
+    expect(result).toEqual({ breached: 0, escalated: 0, considered: 1 })
+    expect(hoisted.insertedLogs).toEqual([])
+    expect(hoisted.mockNotifyTicketSlaWarning).not.toHaveBeenCalled()
+  })
+
+  it('swallows notification and webhook dispatch failures after the clock update succeeds', async () => {
+    const due = clock({ id: 'clock_due' })
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([due]))
+      .mockReturnValueOnce(makeSelectChain([]))
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([due]))
+    hoisted.mockTicketsFindFirst.mockResolvedValueOnce(ticket())
+    hoisted.mockNotifyTicketSlaBreach.mockRejectedValueOnce(new Error('mail down'))
+
+    await expect(runEscalationTick()).resolves.toMatchObject({ breached: 1 })
+    expect(hoisted.mockConsoleWarn).toHaveBeenCalledWith(
+      '[sla.escalations] dispatchBreachNotification failed',
+      expect.any(Error)
+    )
+  })
+
+  it('returns quietly when breach or warning notification tickets disappear', async () => {
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([clock({ id: 'clock_due_missing_ticket' })]))
+      .mockReturnValueOnce(makeSelectChain([rule({ id: 'rule_missing_ticket' })]))
+      .mockReturnValueOnce(makeSelectChain([clock({ id: 'clock_warning_missing_ticket' })]))
+    hoisted.mockUpdate
+      .mockReturnValueOnce(makeUpdateChain([clock({ id: 'clock_due_missing_ticket' })]))
+      .mockReturnValueOnce(makeUpdateChain([clock({ id: 'clock_warning_missing_ticket' })]))
+    hoisted.mockTicketsFindFirst.mockResolvedValueOnce(null).mockResolvedValueOnce(null)
+
+    const result = await runEscalationTick()
+
+    expect(result).toEqual({ breached: 1, escalated: 1, considered: 1 })
+    expect(hoisted.mockNotifyTicketSlaBreach).not.toHaveBeenCalled()
+    expect(hoisted.mockNotifyTicketSlaWarning).not.toHaveBeenCalled()
+  })
+
+  it('logs warning webhook failures without failing the escalation tick', async () => {
+    const candidate = clock({ id: 'clock_warn_dispatch_fail' })
+    hoisted.mockSelect
+      .mockReturnValueOnce(makeSelectChain([]))
+      .mockReturnValueOnce(makeSelectChain([rule({ id: 'rule_warn_dispatch_fail' })]))
+      .mockReturnValueOnce(makeSelectChain([candidate]))
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([candidate]))
+    hoisted.mockTicketsFindFirst.mockResolvedValueOnce(ticket())
+    hoisted.mockDispatchTicketSlaWarning.mockRejectedValueOnce(new Error('webhook down'))
+
+    await expect(runEscalationTick()).resolves.toMatchObject({ escalated: 1 })
+    expect(hoisted.mockConsoleWarn).toHaveBeenCalledWith(
+      '[sla.escalations] dispatchTicketSlaWarning failed',
+      expect.any(Error)
+    )
+  })
+})
diff --git a/apps/web/src/lib/server/domains/sla/__tests__/sla.services.test.ts b/apps/web/src/lib/server/domains/sla/__tests__/sla.services.test.ts
new file mode 100644
index 000000000..bf84092e2
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/__tests__/sla.services.test.ts
@@ -0,0 +1,748 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  mockInsert: vi.fn(),
+  mockUpdate: vi.fn(),
+  mockDelete: vi.fn(),
+  mockSelect: vi.fn(),
+  mockTransaction: vi.fn(),
+  mockBusinessHoursFindFirst: vi.fn(),
+  mockSlaPoliciesFindFirst: vi.fn(),
+  mockEscalationRulesFindFirst: vi.fn(),
+  mockDispatchBusinessHoursCreated: vi.fn(),
+  mockDispatchBusinessHoursUpdated: vi.fn(),
+  mockDispatchBusinessHoursArchived: vi.fn(),
+  mockDispatchSlaPolicyCreated: vi.fn(),
+  mockDispatchSlaPolicyUpdated: vi.fn(),
+  mockDispatchSlaPolicyArchived: vi.fn(),
+  mockEq: vi.fn(),
+  mockAnd: vi.fn(),
+  mockIsNull: vi.fn(),
+  mockAsc: vi.fn(),
+  mockLte: vi.fn(),
+  mockInArray: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    insert: (...args: unknown[]) => hoisted.mockInsert(...args),
+    update: (...args: unknown[]) => hoisted.mockUpdate(...args),
+    delete: (...args: unknown[]) => hoisted.mockDelete(...args),
+    select: (...args: unknown[]) => hoisted.mockSelect(...args),
+    transaction: (...args: unknown[]) => hoisted.mockTransaction(...args),
+    query: {
+      businessHours: {
+        findFirst: (...args: unknown[]) => hoisted.mockBusinessHoursFindFirst(...args),
+      },
+      slaPolicies: { findFirst: (...args: unknown[]) => hoisted.mockSlaPoliciesFindFirst(...args) },
+      escalationRules: {
+        findFirst: (...args: unknown[]) => hoisted.mockEscalationRulesFindFirst(...args),
+      },
+    },
+  },
+  businessHours: {
+    _name: 'business_hours',
+    id: 'businessHours.id',
+    name: 'businessHours.name',
+    archivedAt: 'businessHours.archivedAt',
+  },
+  slaPolicies: {
+    _name: 'sla_policies',
+    id: 'slaPolicies.id',
+    priority: 'slaPolicies.priority',
+    createdAt: 'slaPolicies.createdAt',
+    archivedAt: 'slaPolicies.archivedAt',
+  },
+  slaTargets: {
+    _name: 'sla_targets',
+    policyId: 'slaTargets.policyId',
+  },
+  escalationRules: {
+    _name: 'escalation_rules',
+    id: 'escalationRules.id',
+    policyId: 'escalationRules.policyId',
+    leadMinutes: 'escalationRules.leadMinutes',
+  },
+  ticketSlaClocks: {
+    _name: 'ticket_sla_clocks',
+    ticketId: 'ticketSlaClocks.ticketId',
+    state: 'ticketSlaClocks.state',
+    dueAt: 'ticketSlaClocks.dueAt',
+    createdAt: 'ticketSlaClocks.createdAt',
+  },
+  SLA_POLICY_SCOPES: ['workspace', 'team', 'inbox'],
+  SLA_TARGET_KINDS: ['first_response', 'next_response', 'resolution'],
+  ESCALATION_RECIPIENT_TYPES: ['assignee', 'team', 'principals', 'inbox_members'],
+  ESCALATION_CHANNELS: ['in_app', 'email', 'webhook'],
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  eq: (...args: unknown[]) => hoisted.mockEq(...args),
+  and: (...args: unknown[]) => hoisted.mockAnd(...args),
+  isNull: (...args: unknown[]) => hoisted.mockIsNull(...args),
+  asc: (...args: unknown[]) => hoisted.mockAsc(...args),
+  lte: (...args: unknown[]) => hoisted.mockLte(...args),
+  inArray: (...args: unknown[]) => hoisted.mockInArray(...args),
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchBusinessHoursCreated: (...args: unknown[]) =>
+    hoisted.mockDispatchBusinessHoursCreated(...args),
+  dispatchBusinessHoursUpdated: (...args: unknown[]) =>
+    hoisted.mockDispatchBusinessHoursUpdated(...args),
+  dispatchBusinessHoursArchived: (...args: unknown[]) =>
+    hoisted.mockDispatchBusinessHoursArchived(...args),
+  dispatchSlaPolicyCreated: (...args: unknown[]) => hoisted.mockDispatchSlaPolicyCreated(...args),
+  dispatchSlaPolicyUpdated: (...args: unknown[]) => hoisted.mockDispatchSlaPolicyUpdated(...args),
+  dispatchSlaPolicyArchived: (...args: unknown[]) => hoisted.mockDispatchSlaPolicyArchived(...args),
+}))
+
+const businessHoursService = await import('../business-hours.service')
+const policyService = await import('../sla.policies.service')
+const queries = await import('../sla.queries')
+
+type Chain = {
+  from: ReturnType<typeof vi.fn>
+  where: ReturnType<typeof vi.fn>
+  orderBy: ReturnType<typeof vi.fn>
+  limit: ReturnType<typeof vi.fn>
+  then: Promise<unknown[]>['then']
+  catch: Promise<unknown[]>['catch']
+  finally: Promise<unknown[]>['finally']
+}
+
+function makeSelectChain(rows: unknown[]): Chain {
+  const promise = Promise.resolve(rows)
+  const chain = {
+    from: vi.fn(() => chain),
+    where: vi.fn(() => chain),
+    orderBy: vi.fn(() => chain),
+    limit: vi.fn(() => chain),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  } as Chain
+  return chain
+}
+
+function makeInsertChain(rows: unknown[]) {
+  return {
+    values: vi.fn().mockReturnThis(),
+    returning: vi.fn().mockResolvedValue(rows),
+  }
+}
+
+function makeUpdateChain(rows: unknown[]) {
+  return {
+    set: vi.fn().mockReturnThis(),
+    where: vi.fn().mockReturnThis(),
+    returning: vi.fn().mockResolvedValue(rows),
+  }
+}
+
+function makeDeleteChain() {
+  const promise = Promise.resolve(undefined)
+  const chain = {
+    where: vi.fn(() => chain),
+    then: promise.then.bind(promise),
+    catch: promise.catch.bind(promise),
+    finally: promise.finally.bind(promise),
+  }
+  return chain
+}
+
+const schedule = {
+  mon: [{ start: '09:00', end: '17:00' }],
+  tue: [{ start: '09:00', end: '17:00' }],
+  wed: [{ start: '09:00', end: '17:00' }],
+  thu: [{ start: '09:00', end: '17:00' }],
+  fri: [{ start: '09:00', end: '17:00' }],
+  sat: [],
+  sun: [],
+}
+
+function businessHoursRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'bh_1',
+    name: 'Weekdays',
+    timezone: 'UTC',
+    schedule,
+    holidays: [],
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function policyRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'sla_1',
+    name: 'Default SLA',
+    description: null,
+    priority: 100,
+    enabled: true,
+    scope: 'workspace',
+    scopeTeamId: null,
+    scopeInboxId: null,
+    appliesToPriorities: [],
+    businessHoursId: null,
+    pauseOnPending: true,
+    pauseOnOnHold: true,
+    archivedAt: null,
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    ...overrides,
+  }
+}
+
+function escalationRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'esc_1',
+    policyId: 'sla_1',
+    name: 'Warn owners',
+    leadMinutes: 30,
+    targetKind: 'resolution',
+    recipientType: 'principals',
+    recipientTeamId: null,
+    recipientPrincipalIds: ['principal_1'],
+    channels: ['in_app'],
+    enabled: true,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockEq.mockImplementation((...args: unknown[]) => ['eq', ...args])
+  hoisted.mockAnd.mockImplementation((...args: unknown[]) => ['and', ...args])
+  hoisted.mockIsNull.mockImplementation((...args: unknown[]) => ['isNull', ...args])
+  hoisted.mockAsc.mockImplementation((...args: unknown[]) => ['asc', ...args])
+  hoisted.mockLte.mockImplementation((...args: unknown[]) => ['lte', ...args])
+  hoisted.mockInArray.mockImplementation((...args: unknown[]) => ['inArray', ...args])
+  hoisted.mockDispatchBusinessHoursCreated.mockResolvedValue(undefined)
+  hoisted.mockDispatchBusinessHoursUpdated.mockResolvedValue(undefined)
+  hoisted.mockDispatchBusinessHoursArchived.mockResolvedValue(undefined)
+  hoisted.mockDispatchSlaPolicyCreated.mockResolvedValue(undefined)
+  hoisted.mockDispatchSlaPolicyUpdated.mockResolvedValue(undefined)
+  hoisted.mockDispatchSlaPolicyArchived.mockResolvedValue(undefined)
+  hoisted.mockTransaction.mockImplementation(async (fn: (tx: unknown) => unknown) =>
+    fn({
+      delete: hoisted.mockDelete,
+      insert: hoisted.mockInsert,
+    })
+  )
+})
+
+describe('business-hours service', () => {
+  it('creates business hours with normalized name, defaults, and an event ref', async () => {
+    const insertChain = makeInsertChain([businessHoursRow({ name: 'Support hours' })])
+    hoisted.mockInsert.mockReturnValueOnce(insertChain)
+
+    const result = await businessHoursService.createBusinessHours({
+      name: '  Support hours  ',
+      schedule,
+    })
+
+    expect(result.name).toBe('Support hours')
+    expect(insertChain.values).toHaveBeenCalledWith({
+      name: 'Support hours',
+      timezone: 'UTC',
+      schedule,
+      holidays: [],
+    })
+    expect(hoisted.mockDispatchBusinessHoursCreated).toHaveBeenCalledWith(
+      { type: 'service', displayName: 'business-hours-system' },
+      expect.objectContaining({ id: 'bh_1', name: 'Support hours', archivedAt: null })
+    )
+  })
+
+  it('rejects invalid business-hours input before writing', async () => {
+    await expect(
+      businessHoursService.createBusinessHours({ name: ' ', schedule })
+    ).rejects.toMatchObject({ code: 'BUSINESS_HOURS_NAME_REQUIRED' })
+    await expect(
+      businessHoursService.createBusinessHours({ name: 'x'.repeat(201), schedule })
+    ).rejects.toMatchObject({ code: 'BUSINESS_HOURS_NAME_TOO_LONG' })
+    await expect(
+      businessHoursService.createBusinessHours({
+        name: 'Bad tz',
+        timezone: 'Not/AZone',
+        schedule,
+      })
+    ).rejects.toMatchObject({ code: 'BUSINESS_HOURS_TZ_INVALID' })
+    await expect(
+      businessHoursService.createBusinessHours({
+        name: 'Bad schedule',
+        schedule: { ...schedule, mon: [{ start: '17:00', end: '09:00' }] },
+      })
+    ).rejects.toMatchObject({ code: 'BUSINESS_HOURS_SCHEDULE_INVALID' })
+    await expect(
+      businessHoursService.createBusinessHours({
+        name: 'Bad holiday',
+        schedule,
+        holidays: [{ date: '2026-99-99' }],
+      })
+    ).rejects.toMatchObject({ code: 'BUSINESS_HOURS_HOLIDAYS_INVALID' })
+    expect(hoisted.mockInsert).not.toHaveBeenCalled()
+  })
+
+  it('updates only provided business-hours fields and rejects missing or archived rows', async () => {
+    hoisted.mockBusinessHoursFindFirst.mockResolvedValueOnce(null)
+    await expect(
+      businessHoursService.updateBusinessHours('bh_missing' as never, { name: 'Nope' })
+    ).rejects.toMatchObject({ code: 'BUSINESS_HOURS_NOT_FOUND' })
+
+    hoisted.mockBusinessHoursFindFirst.mockResolvedValueOnce(
+      businessHoursRow({ archivedAt: new Date('2026-02-01T00:00:00.000Z') })
+    )
+    await expect(
+      businessHoursService.updateBusinessHours('bh_1' as never, { name: 'Archived' })
+    ).rejects.toMatchObject({ code: 'BUSINESS_HOURS_ARCHIVED' })
+
+    const existing = businessHoursRow()
+    hoisted.mockBusinessHoursFindFirst.mockResolvedValueOnce(existing)
+    await expect(businessHoursService.updateBusinessHours('bh_1' as never, {})).resolves.toBe(
+      existing
+    )
+
+    const updateChain = makeUpdateChain([
+      businessHoursRow({ name: 'Updated', timezone: 'Europe/Berlin' }),
+    ])
+    hoisted.mockBusinessHoursFindFirst.mockResolvedValueOnce(existing)
+    hoisted.mockUpdate.mockReturnValueOnce(updateChain)
+
+    const result = await businessHoursService.updateBusinessHours('bh_1' as never, {
+      name: ' Updated ',
+      timezone: 'Europe/Berlin',
+      schedule: { ...schedule, sat: [{ start: '10:00', end: '12:00' }] },
+      holidays: [{ date: '2026-01-01', label: 'NYD' }],
+    })
+
+    expect(result.name).toBe('Updated')
+    expect(updateChain.set).toHaveBeenCalledWith({
+      name: 'Updated',
+      timezone: 'Europe/Berlin',
+      schedule: { ...schedule, sat: [{ start: '10:00', end: '12:00' }] },
+      holidays: [{ date: '2026-01-01', label: 'NYD' }],
+    })
+    expect(hoisted.mockDispatchBusinessHoursUpdated).toHaveBeenCalledWith(
+      { type: 'service', displayName: 'business-hours-system' },
+      expect.objectContaining({ id: 'bh_1', name: 'Updated' }),
+      ['name', 'timezone', 'schedule', 'holidays']
+    )
+  })
+
+  it('archives, gets, and lists business hours', async () => {
+    const archived = businessHoursRow({ archivedAt: new Date('2026-02-01T00:00:00.000Z') })
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([archived]))
+    await expect(businessHoursService.archiveBusinessHours('bh_1' as never)).resolves.toBe(archived)
+
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([]))
+    await expect(
+      businessHoursService.archiveBusinessHours('bh_missing' as never)
+    ).rejects.toMatchObject({ code: 'BUSINESS_HOURS_NOT_FOUND' })
+
+    hoisted.mockBusinessHoursFindFirst.mockResolvedValueOnce(undefined)
+    await expect(businessHoursService.getBusinessHours('bh_missing' as never)).resolves.toBeNull()
+
+    const rows = [businessHoursRow()]
+    const selectChain = makeSelectChain(rows)
+    hoisted.mockSelect.mockReturnValueOnce(selectChain)
+    await expect(businessHoursService.listBusinessHours()).resolves.toEqual(rows)
+    expect(selectChain.where).toHaveBeenCalledWith(['isNull', 'businessHours.archivedAt'])
+
+    const archivedSelect = makeSelectChain([archived])
+    hoisted.mockSelect.mockReturnValueOnce(archivedSelect)
+    await expect(
+      businessHoursService.listBusinessHours({ includeArchived: true })
+    ).resolves.toEqual([archived])
+    expect(archivedSelect.where).toHaveBeenCalledWith(undefined)
+  })
+})
+
+describe('SLA policy service', () => {
+  it('creates policies with scope validation, defaults, and event refs', async () => {
+    const insertChain = makeInsertChain([
+      policyRow({ name: 'Team SLA', scope: 'team', scopeTeamId: 'team_1' }),
+    ])
+    hoisted.mockInsert.mockReturnValueOnce(insertChain)
+
+    const result = await policyService.createSlaPolicy({
+      name: ' Team SLA ',
+      scope: 'team',
+      scopeTeamId: 'team_1' as never,
+    })
+
+    expect(result.name).toBe('Team SLA')
+    expect(insertChain.values).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'Team SLA',
+        priority: 100,
+        enabled: true,
+        scope: 'team',
+        scopeTeamId: 'team_1',
+        scopeInboxId: null,
+        appliesToPriorities: [],
+        pauseOnPending: true,
+        pauseOnOnHold: true,
+      })
+    )
+    expect(hoisted.mockDispatchSlaPolicyCreated).toHaveBeenCalledWith(
+      { type: 'service', displayName: 'sla-system' },
+      expect.objectContaining({ id: 'sla_1', name: 'Team SLA', scope: 'team' })
+    )
+  })
+
+  it('rejects invalid policy names and scope bindings', async () => {
+    await expect(
+      policyService.createSlaPolicy({ name: '', scope: 'workspace' })
+    ).rejects.toMatchObject({
+      code: 'SLA_POLICY_NAME_REQUIRED',
+    })
+    await expect(
+      policyService.createSlaPolicy({ name: 'x'.repeat(201), scope: 'workspace' })
+    ).rejects.toMatchObject({ code: 'SLA_POLICY_NAME_TOO_LONG' })
+    await expect(
+      policyService.createSlaPolicy({ name: 'Bad', scope: 'bogus' as never })
+    ).rejects.toMatchObject({ code: 'SLA_POLICY_SCOPE_INVALID' })
+    await expect(
+      policyService.createSlaPolicy({ name: 'Team', scope: 'team' })
+    ).rejects.toMatchObject({ code: 'SLA_POLICY_SCOPE_TEAM_REQUIRED' })
+    await expect(
+      policyService.createSlaPolicy({ name: 'Inbox', scope: 'inbox' })
+    ).rejects.toMatchObject({ code: 'SLA_POLICY_SCOPE_INBOX_REQUIRED' })
+    await expect(
+      policyService.createSlaPolicy({
+        name: 'Workspace',
+        scope: 'workspace',
+        scopeTeamId: 'team_1' as never,
+      })
+    ).rejects.toMatchObject({ code: 'SLA_POLICY_SCOPE_WORKSPACE_NO_BIND' })
+    await expect(
+      policyService.createSlaPolicy({
+        name: 'Workspace',
+        scope: 'workspace',
+        scopeInboxId: 'inbox_1' as never,
+      })
+    ).rejects.toMatchObject({ code: 'SLA_POLICY_SCOPE_WORKSPACE_NO_BIND' })
+  })
+
+  it('updates, archives, gets, and lists policies', async () => {
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(null)
+    await expect(
+      policyService.updateSlaPolicy('sla_missing' as never, { name: 'Missing' })
+    ).rejects.toMatchObject({ code: 'SLA_POLICY_NOT_FOUND' })
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(
+      policyRow({ archivedAt: new Date('2026-01-01T00:00:00.000Z') })
+    )
+    await expect(
+      policyService.updateSlaPolicy('sla_1' as never, { enabled: false })
+    ).rejects.toMatchObject({ code: 'SLA_POLICY_ARCHIVED' })
+
+    const existing = policyRow()
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(existing)
+    await expect(policyService.updateSlaPolicy('sla_1' as never, {})).resolves.toBe(existing)
+
+    const updateChain = makeUpdateChain([
+      policyRow({
+        name: 'Updated SLA',
+        description: 'desc',
+        priority: 5,
+        enabled: false,
+        appliesToPriorities: ['urgent'],
+        businessHoursId: 'bh_1',
+        pauseOnPending: false,
+        pauseOnOnHold: false,
+      }),
+    ])
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(existing)
+    hoisted.mockUpdate.mockReturnValueOnce(updateChain)
+
+    await policyService.updateSlaPolicy('sla_1' as never, {
+      name: ' Updated SLA ',
+      description: 'desc',
+      priority: 5,
+      enabled: false,
+      appliesToPriorities: ['urgent'],
+      businessHoursId: 'bh_1' as never,
+      pauseOnPending: false,
+      pauseOnOnHold: false,
+    })
+
+    expect(updateChain.set).toHaveBeenCalledWith({
+      name: 'Updated SLA',
+      description: 'desc',
+      priority: 5,
+      enabled: false,
+      appliesToPriorities: ['urgent'],
+      businessHoursId: 'bh_1',
+      pauseOnPending: false,
+      pauseOnOnHold: false,
+    })
+    expect(hoisted.mockDispatchSlaPolicyUpdated).toHaveBeenCalledWith(
+      { type: 'service', displayName: 'sla-system' },
+      expect.objectContaining({ id: 'sla_1', name: 'Updated SLA' }),
+      [
+        'name',
+        'description',
+        'priority',
+        'enabled',
+        'appliesToPriorities',
+        'businessHoursId',
+        'pauseOnPending',
+        'pauseOnOnHold',
+      ]
+    )
+
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([policyRow({ archivedAt: new Date() })]))
+    await expect(policyService.archiveSlaPolicy('sla_1' as never)).resolves.toMatchObject({
+      id: 'sla_1',
+    })
+    hoisted.mockUpdate.mockReturnValueOnce(makeUpdateChain([]))
+    await expect(policyService.archiveSlaPolicy('sla_missing' as never)).rejects.toMatchObject({
+      code: 'SLA_POLICY_NOT_FOUND',
+    })
+
+    hoisted.mockSlaPoliciesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(policyService.getSlaPolicy('sla_missing' as never)).resolves.toBeNull()
+
+    const selectChain = makeSelectChain([policyRow()])
+    hoisted.mockSelect.mockReturnValueOnce(selectChain)
+    await expect(policyService.listSlaPolicies()).resolves.toHaveLength(1)
+    expect(selectChain.where).toHaveBeenCalledWith(['isNull', 'slaPolicies.archivedAt'])
+
+    const archivedSelect = makeSelectChain([policyRow({ archivedAt: new Date() })])
+    hoisted.mockSelect.mockReturnValueOnce(archivedSelect)
+    await expect(policyService.listSlaPolicies({ includeArchived: true })).resolves.toHaveLength(1)
+    expect(archivedSelect.where).toHaveBeenCalledWith(undefined)
+  })
+
+  it('replaces targets atomically, deduplicating by kind and validating inputs', async () => {
+    await expect(
+      policyService.replaceTargets('sla_1' as never, [{ kind: 'bad' as never, minutes: 10 }])
+    ).rejects.toMatchObject({ code: 'SLA_TARGET_KIND_INVALID' })
+    await expect(
+      policyService.replaceTargets('sla_1' as never, [{ kind: 'resolution', minutes: 0 }])
+    ).rejects.toMatchObject({ code: 'SLA_TARGET_MINUTES_INVALID' })
+
+    const deleteChain = makeDeleteChain()
+    const insertChain = makeInsertChain([
+      { id: 'target_1', kind: 'resolution', minutes: 45 },
+      { id: 'target_2', kind: 'first_response', minutes: 10 },
+    ])
+    hoisted.mockDelete.mockReturnValue(deleteChain)
+    hoisted.mockInsert.mockReturnValueOnce(insertChain)
+
+    const rows = await policyService.replaceTargets('sla_1' as never, [
+      { kind: 'resolution', minutes: 30 },
+      { kind: 'resolution', minutes: 45 },
+      { kind: 'first_response', minutes: 10 },
+    ])
+
+    expect(rows).toHaveLength(2)
+    expect(insertChain.values).toHaveBeenCalledWith([
+      { policyId: 'sla_1', kind: 'resolution', minutes: 45 },
+      { policyId: 'sla_1', kind: 'first_response', minutes: 10 },
+    ])
+
+    hoisted.mockDelete.mockReturnValueOnce(makeDeleteChain())
+    await expect(policyService.replaceTargets('sla_1' as never, [])).resolves.toEqual([])
+  })
+
+  it('lists targets and validates escalation rules', async () => {
+    const targets = [{ id: 'target_1', kind: 'resolution' }]
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain(targets))
+    await expect(policyService.listTargetsForPolicy('sla_1' as never)).resolves.toEqual(targets)
+
+    await expect(
+      policyService.createEscalationRule({
+        policyId: 'sla_1' as never,
+        name: 'Bad target',
+        leadMinutes: 5,
+        targetKind: 'bad' as never,
+        recipientType: 'assignee',
+      })
+    ).rejects.toMatchObject({ code: 'ESCALATION_TARGET_KIND_INVALID' })
+    await expect(
+      policyService.createEscalationRule({
+        policyId: 'sla_1' as never,
+        name: 'Bad recipient',
+        leadMinutes: 5,
+        targetKind: 'resolution',
+        recipientType: 'bad' as never,
+      })
+    ).rejects.toMatchObject({ code: 'ESCALATION_RECIPIENT_TYPE_INVALID' })
+    await expect(
+      policyService.createEscalationRule({
+        policyId: 'sla_1' as never,
+        name: 'Missing team',
+        leadMinutes: 5,
+        targetKind: 'resolution',
+        recipientType: 'team',
+      })
+    ).rejects.toMatchObject({ code: 'ESCALATION_RECIPIENT_TEAM_REQUIRED' })
+    await expect(
+      policyService.createEscalationRule({
+        policyId: 'sla_1' as never,
+        name: 'Missing principals',
+        leadMinutes: 5,
+        targetKind: 'resolution',
+        recipientType: 'principals',
+      })
+    ).rejects.toMatchObject({ code: 'ESCALATION_RECIPIENT_PRINCIPALS_REQUIRED' })
+    await expect(
+      policyService.createEscalationRule({
+        policyId: 'sla_1' as never,
+        name: 'Empty principals',
+        leadMinutes: 5,
+        targetKind: 'resolution',
+        recipientType: 'principals',
+        recipientPrincipalIds: [],
+      })
+    ).rejects.toMatchObject({ code: 'ESCALATION_RECIPIENT_PRINCIPALS_REQUIRED' })
+    await expect(
+      policyService.createEscalationRule({
+        policyId: 'sla_1' as never,
+        name: 'Bad channel',
+        leadMinutes: 5,
+        targetKind: 'resolution',
+        recipientType: 'assignee',
+        channels: ['sms' as never],
+      })
+    ).rejects.toMatchObject({ code: 'ESCALATION_CHANNEL_INVALID' })
+    await expect(
+      policyService.createEscalationRule({
+        policyId: 'sla_1' as never,
+        name: 'Bad lead',
+        leadMinutes: Number.NaN,
+        targetKind: 'resolution',
+        recipientType: 'assignee',
+      })
+    ).rejects.toMatchObject({ code: 'ESCALATION_LEAD_MINUTES_INVALID' })
+  })
+
+  it('creates, updates, deletes, and lists escalation rules', async () => {
+    const insertChain = makeInsertChain([escalationRow({ channels: ['in_app'], enabled: true })])
+    hoisted.mockInsert.mockReturnValueOnce(insertChain)
+    await policyService.createEscalationRule({
+      policyId: 'sla_1' as never,
+      name: ' Warn owners ',
+      leadMinutes: 30,
+      targetKind: 'resolution',
+      recipientType: 'principals',
+      recipientPrincipalIds: ['principal_1' as never],
+    })
+    expect(insertChain.values).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'Warn owners',
+        channels: ['in_app'],
+        enabled: true,
+      })
+    )
+
+    const assigneeInsertChain = makeInsertChain([escalationRow({ recipientType: 'assignee' })])
+    hoisted.mockInsert.mockReturnValueOnce(assigneeInsertChain)
+    await policyService.createEscalationRule({
+      policyId: 'sla_1' as never,
+      name: 'Warn assignee',
+      leadMinutes: 15,
+      targetKind: 'resolution',
+      recipientType: 'assignee',
+    })
+    expect(assigneeInsertChain.values).toHaveBeenCalledWith(
+      expect.objectContaining({
+        recipientPrincipalIds: [],
+        recipientTeamId: null,
+      })
+    )
+
+    hoisted.mockEscalationRulesFindFirst.mockResolvedValueOnce(null)
+    await expect(
+      policyService.updateEscalationRule('esc_missing' as never, { name: 'Missing' })
+    ).rejects.toMatchObject({ code: 'ESCALATION_RULE_NOT_FOUND' })
+
+    const existing = escalationRow()
+    hoisted.mockEscalationRulesFindFirst.mockResolvedValueOnce(existing)
+    await expect(policyService.updateEscalationRule('esc_1' as never, {})).resolves.toBe(existing)
+
+    const updateChain = makeUpdateChain([
+      escalationRow({
+        name: 'Updated',
+        leadMinutes: 10,
+        targetKind: 'first_response',
+        recipientType: 'team',
+        recipientTeamId: 'team_1',
+        recipientPrincipalIds: ['principal_2'],
+        channels: ['email'],
+        enabled: false,
+      }),
+    ])
+    hoisted.mockEscalationRulesFindFirst.mockResolvedValueOnce(existing)
+    hoisted.mockUpdate.mockReturnValueOnce(updateChain)
+
+    await policyService.updateEscalationRule('esc_1' as never, {
+      name: 'Updated',
+      leadMinutes: 10,
+      targetKind: 'first_response',
+      recipientType: 'team',
+      recipientTeamId: 'team_1' as never,
+      recipientPrincipalIds: ['principal_2' as never],
+      channels: ['email'],
+      enabled: false,
+    })
+
+    expect(updateChain.set).toHaveBeenCalledWith({
+      name: 'Updated',
+      leadMinutes: 10,
+      targetKind: 'first_response',
+      recipientType: 'team',
+      recipientTeamId: 'team_1',
+      recipientPrincipalIds: ['principal_2'],
+      channels: ['email'],
+      enabled: false,
+    })
+
+    const deleteChain = makeDeleteChain()
+    hoisted.mockDelete.mockReturnValueOnce(deleteChain)
+    await policyService.deleteEscalationRule('esc_1' as never)
+    expect(deleteChain.where).toHaveBeenCalled()
+
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain([escalationRow()]))
+    await expect(
+      policyService.listEscalationRulesForPolicy('sla_1' as never)
+    ).resolves.toHaveLength(1)
+  })
+})
+
+describe('SLA clock queries', () => {
+  it('returns active, all, and breaching clocks with the expected query shape', async () => {
+    const active = [{ id: 'clock_running', state: 'running' }]
+    const all = [{ id: 'clock_met', state: 'met' }]
+    const breaching = [{ id: 'clock_due', state: 'running' }]
+
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain(active))
+    await expect(queries.getActiveClocksForTicket('ticket_1' as never)).resolves.toEqual(active)
+    expect(hoisted.mockInArray).toHaveBeenCalledWith('ticketSlaClocks.state', [
+      'running',
+      'paused',
+      'breached',
+    ])
+
+    hoisted.mockSelect.mockReturnValueOnce(makeSelectChain(all))
+    await expect(queries.getAllClocksForTicket('ticket_1' as never)).resolves.toEqual(all)
+
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-03-01T12:00:00.000Z'))
+    const selectChain = makeSelectChain(breaching)
+    hoisted.mockSelect.mockReturnValueOnce(selectChain)
+    await expect(queries.listBreachingClocks({ windowMinutes: 15, limit: 25 })).resolves.toEqual(
+      breaching
+    )
+    expect(selectChain.limit).toHaveBeenCalledWith(25)
+    const lteArgs = hoisted.mockLte.mock.calls.at(-1)
+    expect(lteArgs?.[1]).toEqual(new Date('2026-03-01T12:15:00.000Z'))
+    vi.useRealTimers()
+
+    const defaultLimitChain = makeSelectChain([])
+    hoisted.mockSelect.mockReturnValueOnce(defaultLimitChain)
+    await queries.listBreachingClocks()
+    expect(defaultLimitChain.limit).toHaveBeenCalledWith(200)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/sla/business-hours.calc.ts b/apps/web/src/lib/server/domains/sla/business-hours.calc.ts
new file mode 100644
index 000000000..2522e420c
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/business-hours.calc.ts
@@ -0,0 +1,403 @@
+/**
+ * Business-hours math — PURE functions, IANA-timezone aware.
+ *
+ * No external deps; uses `Intl.DateTimeFormat` to extract weekday + HH:MM in
+ * the calendar's timezone for each date we walk past.
+ *
+ * `null` business-hours = 24/7 (no math required, just add/subtract minutes).
+ *
+ * The interface is deliberately small:
+ *   - addBusinessMinutes(start, minutes, hours) → Date
+ *   - subtractBusinessMinutes(end, minutes, hours) → Date
+ *   - isWithinBusinessHours(at, hours) → boolean
+ *   - elapsedBusinessMs(start, end, hours) → number
+ */
+
+import type { BusinessHoursWeek, BusinessHoursRange, BusinessHoursHoliday } from '@/lib/server/db'
+
+export interface BusinessHoursLike {
+  timezone: string
+  schedule: BusinessHoursWeek
+  holidays: BusinessHoursHoliday[]
+}
+
+const DAY_KEYS = ['sun', 'mon', 'tue', 'wed', 'thu', 'fri', 'sat'] as const
+type DayKey = (typeof DAY_KEYS)[number]
+
+const MS_PER_MINUTE = 60_000
+
+interface DateParts {
+  year: number
+  month: number // 1-12
+  day: number // 1-31
+  hour: number // 0-23
+  minute: number // 0-59
+  second: number // 0-59
+  weekday: DayKey
+}
+
+const cachedFormatters = new Map<string, Intl.DateTimeFormat>()
+function getFormatter(tz: string): Intl.DateTimeFormat {
+  let f = cachedFormatters.get(tz)
+  if (!f) {
+    f = new Intl.DateTimeFormat('en-US', {
+      timeZone: tz,
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+      hour: '2-digit',
+      minute: '2-digit',
+      second: '2-digit',
+      weekday: 'short',
+      hour12: false,
+    })
+    cachedFormatters.set(tz, f)
+  }
+  return f
+}
+
+const WEEKDAY_MAP: Record<string, DayKey> = {
+  Sun: 'sun',
+  Mon: 'mon',
+  Tue: 'tue',
+  Wed: 'wed',
+  Thu: 'thu',
+  Fri: 'fri',
+  Sat: 'sat',
+}
+
+function partsAt(date: Date, tz: string): DateParts {
+  const parts = getFormatter(tz).formatToParts(date)
+  const get = (type: Intl.DateTimeFormatPartTypes): string =>
+    parts.find((p) => p.type === type)?.value ?? '0'
+  const weekdayRaw = get('weekday')
+  const weekday = WEEKDAY_MAP[weekdayRaw] ?? 'sun'
+  let hour = parseInt(get('hour'), 10)
+  if (hour === 24) hour = 0 // Intl returns "24" for midnight in some locales
+  return {
+    year: parseInt(get('year'), 10),
+    month: parseInt(get('month'), 10),
+    day: parseInt(get('day'), 10),
+    hour,
+    minute: parseInt(get('minute'), 10),
+    second: parseInt(get('second'), 10),
+    weekday,
+  }
+}
+
+function isoDate(parts: Pick<DateParts, 'year' | 'month' | 'day'>): string {
+  const mm = String(parts.month).padStart(2, '0')
+  const dd = String(parts.day).padStart(2, '0')
+  return `${parts.year}-${mm}-${dd}`
+}
+
+function rangeMinutes(range: BusinessHoursRange): { startMin: number; endMin: number } {
+  return { startMin: parseHHMM(range.start), endMin: parseHHMM(range.end) }
+}
+
+function parseHHMM(s: string): number {
+  const [h, m] = s.split(':').map((v) => parseInt(v, 10))
+  return (h ?? 0) * 60 + (m ?? 0)
+}
+
+function isHoliday(parts: DateParts, holidays: BusinessHoursHoliday[]): boolean {
+  if (holidays.length === 0) return false
+  const today = isoDate(parts)
+  for (const h of holidays) {
+    if (h.date === today) return true
+  }
+  return false
+}
+
+function rangesForDay(parts: DateParts, hours: BusinessHoursLike): BusinessHoursRange[] {
+  if (isHoliday(parts, hours.holidays)) return []
+  const day = parts.weekday
+  return hours.schedule[day] ?? []
+}
+
+/**
+ * Returns true iff `at` falls inside any open range for its day.
+ */
+export function isWithinBusinessHours(at: Date, hours: BusinessHoursLike | null): boolean {
+  if (!hours) return true
+  const parts = partsAt(at, hours.timezone)
+  const ranges = rangesForDay(parts, hours)
+  if (ranges.length === 0) return false
+  const minOfDay = parts.hour * 60 + parts.minute
+  for (const r of ranges) {
+    const { startMin, endMin } = rangeMinutes(r)
+    if (minOfDay >= startMin && minOfDay < endMin) return true
+  }
+  return false
+}
+
+/**
+ * Walk forward from `start` accumulating only minutes that fall inside open
+ * ranges. Returns a Date `minutes` of business-time after `start`.
+ *
+ * For 24/7 (`hours == null`): return `start + minutes`.
+ *
+ * Uses a day-by-day walk capped at 366 days for safety.
+ */
+export function addBusinessMinutes(
+  start: Date,
+  minutes: number,
+  hours: BusinessHoursLike | null
+): Date {
+  if (!hours) return new Date(start.getTime() + minutes * MS_PER_MINUTE)
+  if (minutes <= 0) return new Date(start.getTime())
+
+  let cursor = new Date(start.getTime())
+  let remaining = minutes
+  for (let day = 0; day < 366 && remaining > 0; day++) {
+    const parts = partsAt(cursor, hours.timezone)
+    const ranges = rangesForDay(parts, hours)
+    const minOfDay = day === 0 ? parts.hour * 60 + parts.minute : 0
+
+    for (const r of ranges) {
+      const { startMin, endMin } = rangeMinutes(r)
+      const effStart = Math.max(startMin, minOfDay)
+      if (effStart >= endMin) continue
+      const available = endMin - effStart
+      if (available >= remaining) {
+        // Land inside this range. Compute wall-clock target:
+        const targetMin = effStart + remaining
+        return advanceToWallClock(
+          cursor,
+          hours.timezone,
+          targetMin - (parts.hour * 60 + parts.minute)
+        )
+      }
+      remaining -= available
+    }
+
+    // Move to start of next day in tz
+    cursor = startOfNextDayInTz(cursor, hours.timezone)
+  }
+
+  // Fallback: if we exhausted 366 days (effectively closed forever) just
+  // return start + linear minutes — caller will treat as best-effort.
+  return new Date(start.getTime() + minutes * MS_PER_MINUTE)
+}
+
+/**
+ * Subtract business-minutes (walks backward).
+ */
+export function subtractBusinessMinutes(
+  end: Date,
+  minutes: number,
+  hours: BusinessHoursLike | null
+): Date {
+  if (!hours) return new Date(end.getTime() - minutes * MS_PER_MINUTE)
+  if (minutes <= 0) return new Date(end.getTime())
+
+  let cursor = new Date(end.getTime())
+  let remaining = minutes
+  for (let day = 0; day < 366 && remaining > 0; day++) {
+    const parts = partsAt(cursor, hours.timezone)
+    const ranges = rangesForDay(parts, hours)
+    const minOfDay = day === 0 ? parts.hour * 60 + parts.minute : 24 * 60
+
+    // iterate ranges in reverse
+    for (let i = ranges.length - 1; i >= 0; i--) {
+      const { startMin, endMin } = rangeMinutes(ranges[i])
+      const effEnd = Math.min(endMin, minOfDay)
+      if (effEnd <= startMin) continue
+      const available = effEnd - startMin
+      if (available >= remaining) {
+        const targetMin = effEnd - remaining
+        return advanceToWallClock(
+          cursor,
+          hours.timezone,
+          targetMin - (parts.hour * 60 + parts.minute)
+        )
+      }
+      remaining -= available
+    }
+    cursor = endOfPrevDayInTz(cursor, hours.timezone)
+  }
+  return new Date(end.getTime() - minutes * MS_PER_MINUTE)
+}
+
+/**
+ * Total business-minutes between `start` and `end` (start <= end).
+ * Returns 0 if `start >= end`.
+ */
+export function elapsedBusinessMs(start: Date, end: Date, hours: BusinessHoursLike | null): number {
+  if (end.getTime() <= start.getTime()) return 0
+  if (!hours) return end.getTime() - start.getTime()
+
+  let cursor = new Date(start.getTime())
+  let totalMs = 0
+  for (let day = 0; day < 366; day++) {
+    const parts = partsAt(cursor, hours.timezone)
+    const ranges = rangesForDay(parts, hours)
+    const minOfDay = day === 0 ? parts.hour * 60 + parts.minute : 0
+    const endParts = partsAt(end, hours.timezone)
+    const sameDay =
+      endParts.year === parts.year && endParts.month === parts.month && endParts.day === parts.day
+
+    for (const r of ranges) {
+      const { startMin, endMin } = rangeMinutes(r)
+      const effStart = Math.max(startMin, minOfDay)
+      let effEnd = endMin
+      if (sameDay) {
+        effEnd = Math.min(endMin, endParts.hour * 60 + endParts.minute)
+      }
+      if (effEnd <= effStart) continue
+      totalMs += (effEnd - effStart) * MS_PER_MINUTE
+    }
+
+    if (sameDay) break
+    cursor = startOfNextDayInTz(cursor, hours.timezone)
+    if (cursor.getTime() > end.getTime()) break
+  }
+  return totalMs
+}
+
+// ---------------------------------------------------------------------------
+// timezone helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Given a date and a number of "wall-clock minutes" to add (in the tz), return
+ * a new Date representing that wall-clock instant.
+ *
+ * Implementation: convert the source instant to the tz wall-clock, add the
+ * minutes, then convert back. We approximate by adjusting in real time and
+ * correcting the offset via diff between expected vs actual parts.
+ */
+function advanceToWallClock(source: Date, tz: string, deltaMinutes: number): Date {
+  // First-pass: shift by deltaMinutes in real time.
+  let candidate = new Date(source.getTime() + deltaMinutes * MS_PER_MINUTE)
+  // Correct for any DST jump that occurred in the interval by comparing the
+  // expected wall-clock minute-of-day against the actual one (one iteration is
+  // enough for standard DST shifts).
+  const sourceParts = partsAt(source, tz)
+  const targetMinOfDay = sourceParts.hour * 60 + sourceParts.minute + deltaMinutes
+  // Wrap into [0, 1440) for same-day comparison; otherwise we just trust the shift.
+  if (targetMinOfDay >= 0 && targetMinOfDay < 24 * 60) {
+    const actualParts = partsAt(candidate, tz)
+    const sameDay =
+      actualParts.year === sourceParts.year &&
+      actualParts.month === sourceParts.month &&
+      actualParts.day === sourceParts.day
+    if (sameDay) {
+      const actualMinOfDay = actualParts.hour * 60 + actualParts.minute
+      const drift = targetMinOfDay - actualMinOfDay
+      if (drift !== 0) {
+        candidate = new Date(candidate.getTime() + drift * MS_PER_MINUTE)
+      }
+    }
+  }
+  return candidate
+}
+
+function startOfNextDayInTz(date: Date, tz: string): Date {
+  const parts = partsAt(date, tz)
+  // Move forward by (24h - current wall-clock) approximated, then correct.
+  const minOfDay = parts.hour * 60 + parts.minute
+  const minutesToMidnight = 24 * 60 - minOfDay
+  let candidate = new Date(date.getTime() + minutesToMidnight * MS_PER_MINUTE)
+  // Snap back to 00:00 wall-clock if DST nudged us off.
+  const cParts = partsAt(candidate, tz)
+  const cMin = cParts.hour * 60 + cParts.minute
+  if (cMin !== 0) {
+    if (cMin <= 12 * 60) {
+      candidate = new Date(candidate.getTime() - cMin * MS_PER_MINUTE)
+    } else {
+      candidate = new Date(candidate.getTime() + (24 * 60 - cMin) * MS_PER_MINUTE)
+    }
+  }
+  return candidate
+}
+
+function endOfPrevDayInTz(date: Date, tz: string): Date {
+  const parts = partsAt(date, tz)
+  const minOfDay = parts.hour * 60 + parts.minute
+  // Step back to 23:59 of the previous day in `tz`:
+  // first to 00:00 today, then back 1 minute.
+  let candidate = new Date(date.getTime() - minOfDay * MS_PER_MINUTE)
+  // Snap to 00:00 if DST nudged us off (mirror startOfNextDayInTz).
+  let cParts = partsAt(candidate, tz)
+  let cMin = cParts.hour * 60 + cParts.minute
+  if (cMin !== 0) {
+    if (cMin <= 12 * 60) {
+      candidate = new Date(candidate.getTime() - cMin * MS_PER_MINUTE)
+    } else {
+      candidate = new Date(candidate.getTime() + (24 * 60 - cMin) * MS_PER_MINUTE)
+    }
+  }
+  // Now step back 1 minute so we land at 23:59 of the previous wall-clock day.
+  candidate = new Date(candidate.getTime() - MS_PER_MINUTE)
+  // If DST drift left us off the expected 23:59, nudge.
+  cParts = partsAt(candidate, tz)
+  cMin = cParts.hour * 60 + cParts.minute
+  if (cMin < 23 * 60) {
+    // Spring-forward case: jumped further back; push forward to 23:59.
+    candidate = new Date(candidate.getTime() + (23 * 60 + 59 - cMin) * MS_PER_MINUTE)
+  }
+  return candidate
+}
+
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+
+/**
+ * Verifies an IANA timezone string by attempting to construct a formatter.
+ */
+export function isValidTimezone(tz: string): boolean {
+  try {
+    new Intl.DateTimeFormat('en-US', { timeZone: tz }).format(new Date())
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** Validate a {start, end} range string pair: HH:MM, start < end. */
+export function validateRange(range: BusinessHoursRange): void {
+  const re = /^([01]\d|2[0-3]):[0-5]\d$/
+  if (!re.test(range.start) || !re.test(range.end)) {
+    throw new Error(`invalid HH:MM range: ${range.start}-${range.end}`)
+  }
+  if (parseHHMM(range.start) >= parseHHMM(range.end)) {
+    throw new Error(`range start must be before end: ${range.start}-${range.end}`)
+  }
+}
+
+/** Validate a full week schedule: each day's ranges are sorted + non-overlapping. */
+export function validateSchedule(schedule: BusinessHoursWeek): void {
+  for (const day of DAY_KEYS) {
+    const ranges = schedule[day] ?? []
+    let lastEnd = -1
+    for (const r of ranges) {
+      validateRange(r)
+      const startMin = parseHHMM(r.start)
+      if (startMin < lastEnd) {
+        throw new Error(`overlapping ranges on ${day}`)
+      }
+      lastEnd = parseHHMM(r.end)
+    }
+  }
+}
+
+/**
+ * Validate a list of holidays — each must be a valid `YYYY-MM-DD` string.
+ */
+export function validateHolidays(holidays: BusinessHoursHoliday[]): void {
+  const re = /^(\d{4})-(\d{2})-(\d{2})$/
+  for (const h of holidays) {
+    const m = re.exec(h.date)
+    if (!m) throw new Error(`invalid holiday date: ${h.date}`)
+    const [, y, mo, d] = m
+    const year = Number(y)
+    const month = Number(mo)
+    const day = Number(d)
+    const dt = new Date(Date.UTC(year, month - 1, day))
+    if (dt.getUTCFullYear() !== year || dt.getUTCMonth() !== month - 1 || dt.getUTCDate() !== day) {
+      throw new Error(`invalid holiday date: ${h.date}`)
+    }
+  }
+}
diff --git a/apps/web/src/lib/server/domains/sla/business-hours.service.ts b/apps/web/src/lib/server/domains/sla/business-hours.service.ts
new file mode 100644
index 000000000..b3437e79d
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/business-hours.service.ts
@@ -0,0 +1,161 @@
+/**
+ * Business-hours service — CRUD for the calendars referenced by SLA policies.
+ *
+ * Permission gating is the caller's responsibility.
+ */
+
+import { db, eq, isNull, asc, businessHours, type BusinessHours } from '@/lib/server/db'
+import type { BusinessHoursId } from '@quackback/ids'
+import type { BusinessHoursWeek, BusinessHoursHoliday } from '@/lib/server/db'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { isValidTimezone, validateSchedule, validateHolidays } from './business-hours.calc'
+import {
+  dispatchBusinessHoursCreated,
+  dispatchBusinessHoursUpdated,
+  dispatchBusinessHoursArchived,
+  type EventActor,
+} from '@/lib/server/events/dispatch'
+import type { EventBusinessHoursRef } from '@/lib/server/events/types'
+import { toIsoStringOrNull } from '@/lib/shared/utils/date'
+
+const businessHoursActor: EventActor = { type: 'service', displayName: 'business-hours-system' }
+
+function businessHoursRef(b: BusinessHours): EventBusinessHoursRef {
+  return {
+    id: b.id,
+    name: b.name,
+    timezone: b.timezone,
+    archivedAt: toIsoStringOrNull(b.archivedAt),
+  }
+}
+
+const NAME_MAX = 200
+
+export interface CreateBusinessHoursInput {
+  name: string
+  timezone?: string
+  schedule: BusinessHoursWeek
+  holidays?: BusinessHoursHoliday[]
+}
+
+export interface UpdateBusinessHoursInput {
+  name?: string
+  timezone?: string
+  schedule?: BusinessHoursWeek
+  holidays?: BusinessHoursHoliday[]
+}
+
+function normalizeName(name: string): string {
+  const trimmed = name?.trim()
+  if (!trimmed) throw new ValidationError('BUSINESS_HOURS_NAME_REQUIRED', 'name is required')
+  if (trimmed.length > NAME_MAX) {
+    throw new ValidationError('BUSINESS_HOURS_NAME_TOO_LONG', `name exceeds ${NAME_MAX} chars`)
+  }
+  return trimmed
+}
+
+function validateInput(input: {
+  timezone?: string
+  schedule?: BusinessHoursWeek
+  holidays?: BusinessHoursHoliday[]
+}): void {
+  if (input.timezone != null && !isValidTimezone(input.timezone)) {
+    throw new ValidationError('BUSINESS_HOURS_TZ_INVALID', `invalid timezone: ${input.timezone}`)
+  }
+  if (input.schedule != null) {
+    try {
+      validateSchedule(input.schedule)
+    } catch (err) {
+      throw new ValidationError(
+        'BUSINESS_HOURS_SCHEDULE_INVALID',
+        err instanceof Error ? err.message : 'invalid schedule'
+      )
+    }
+  }
+  if (input.holidays != null) {
+    try {
+      validateHolidays(input.holidays)
+    } catch (err) {
+      throw new ValidationError(
+        'BUSINESS_HOURS_HOLIDAYS_INVALID',
+        err instanceof Error ? err.message : 'invalid holidays'
+      )
+    }
+  }
+}
+
+export async function createBusinessHours(input: CreateBusinessHoursInput): Promise<BusinessHours> {
+  const name = normalizeName(input.name)
+  validateInput(input)
+
+  const [created] = await db
+    .insert(businessHours)
+    .values({
+      name,
+      timezone: input.timezone ?? 'UTC',
+      schedule: input.schedule,
+      holidays: input.holidays ?? [],
+    })
+    .returning()
+  void dispatchBusinessHoursCreated(businessHoursActor, businessHoursRef(created)).catch(() => {})
+  return created
+}
+
+export async function updateBusinessHours(
+  id: BusinessHoursId,
+  input: UpdateBusinessHoursInput
+): Promise<BusinessHours> {
+  const existing = await getBusinessHours(id)
+  if (!existing)
+    throw new NotFoundError('BUSINESS_HOURS_NOT_FOUND', `business_hours ${id} not found`)
+  if (existing.archivedAt) {
+    throw new ConflictError('BUSINESS_HOURS_ARCHIVED', 'cannot update archived business hours')
+  }
+  validateInput(input)
+
+  const patch: Partial<typeof existing> = {}
+  if (input.name !== undefined) patch.name = normalizeName(input.name)
+  if (input.timezone !== undefined) patch.timezone = input.timezone
+  if (input.schedule !== undefined) patch.schedule = input.schedule
+  if (input.holidays !== undefined) patch.holidays = input.holidays
+
+  if (Object.keys(patch).length === 0) return existing
+
+  const [updated] = await db
+    .update(businessHours)
+    .set(patch)
+    .where(eq(businessHours.id, id))
+    .returning()
+  void dispatchBusinessHoursUpdated(
+    businessHoursActor,
+    businessHoursRef(updated),
+    Object.keys(patch)
+  ).catch(() => {})
+  return updated
+}
+
+export async function archiveBusinessHours(id: BusinessHoursId): Promise<BusinessHours> {
+  const [updated] = await db
+    .update(businessHours)
+    .set({ archivedAt: new Date() })
+    .where(eq(businessHours.id, id))
+    .returning()
+  if (!updated)
+    throw new NotFoundError('BUSINESS_HOURS_NOT_FOUND', `business_hours ${id} not found`)
+  void dispatchBusinessHoursArchived(businessHoursActor, businessHoursRef(updated)).catch(() => {})
+  return updated
+}
+
+export async function getBusinessHours(id: BusinessHoursId): Promise<BusinessHours | null> {
+  const row = await db.query.businessHours.findFirst({ where: eq(businessHours.id, id) })
+  return row ?? null
+}
+
+export async function listBusinessHours(
+  opts: {
+    includeArchived?: boolean
+  } = {}
+): Promise<BusinessHours[]> {
+  const where = opts.includeArchived ? undefined : isNull(businessHours.archivedAt)
+  return db.select().from(businessHours).where(where).orderBy(asc(businessHours.name))
+}
diff --git a/apps/web/src/lib/server/domains/sla/index.ts b/apps/web/src/lib/server/domains/sla/index.ts
new file mode 100644
index 000000000..ccdb543ec
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/index.ts
@@ -0,0 +1,10 @@
+/**
+ * SLA + escalations domain — Phase 5.
+ */
+export * from './sla.types'
+export * from './business-hours.calc'
+export * from './business-hours.service'
+export * from './sla.policies.service'
+export * from './sla.engine'
+export * from './sla.queries'
+export * from './sla.escalations'
diff --git a/apps/web/src/lib/server/domains/sla/sla.engine.ts b/apps/web/src/lib/server/domains/sla/sla.engine.ts
new file mode 100644
index 000000000..f66af3294
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/sla.engine.ts
@@ -0,0 +1,429 @@
+/**
+ * SLA engine — selects policies for tickets, attaches/manages clocks.
+ *
+ * Public API used by ticket.service / ticket.threads:
+ *   - selectPolicyForTicket
+ *   - attachClocksOnCreate
+ *   - onPublicAgentReply
+ *   - onCustomerReply
+ *   - onStatusTransition
+ *
+ * All side effects also write a `ticket_activity` row for the timeline.
+ */
+
+import {
+  db,
+  eq,
+  and,
+  or,
+  isNull,
+  asc,
+  inArray,
+  sql,
+  slaPolicies,
+  slaTargets,
+  ticketSlaClocks,
+  businessHours,
+  tickets,
+  type SlaPolicy,
+  type SlaTarget,
+  type TicketSlaClock,
+  type Ticket,
+} from '@/lib/server/db'
+import type { TicketId, SlaPolicyId, PrincipalId, InboxId, TeamId } from '@quackback/ids'
+import type { SlaTargetKind, TicketStatusCategory, TicketPriority } from '@/lib/server/db'
+import {
+  addBusinessMinutes,
+  elapsedBusinessMs,
+  type BusinessHoursLike,
+} from './business-hours.calc'
+import { writeActivity } from '../tickets/ticket.service'
+
+// ---------------------------------------------------------------------------
+// policy selection
+// ---------------------------------------------------------------------------
+
+interface PolicyMatchInput {
+  inboxId: InboxId | null
+  primaryTeamId: TeamId | null
+  priority: TicketPriority
+}
+
+export async function selectPolicyForTicket(input: PolicyMatchInput): Promise<SlaPolicy | null> {
+  // We pull all enabled, non-archived candidates that could match (inbox/team/workspace),
+  // then narrow by appliesToPriorities + scope precedence in JS — table is small.
+  const candidates = await db
+    .select()
+    .from(slaPolicies)
+    .where(
+      and(
+        eq(slaPolicies.enabled, true),
+        isNull(slaPolicies.archivedAt),
+        or(
+          eq(slaPolicies.scope, 'workspace'),
+          input.primaryTeamId != null
+            ? and(eq(slaPolicies.scope, 'team'), eq(slaPolicies.scopeTeamId, input.primaryTeamId))
+            : sql`false`,
+          input.inboxId != null
+            ? and(eq(slaPolicies.scope, 'inbox'), eq(slaPolicies.scopeInboxId, input.inboxId))
+            : sql`false`
+        )
+      )
+    )
+    .orderBy(asc(slaPolicies.priority), asc(slaPolicies.createdAt))
+
+  const matchesPriority = (p: SlaPolicy): boolean => {
+    if (!p.appliesToPriorities || p.appliesToPriorities.length === 0) return true
+    return (p.appliesToPriorities as readonly string[]).includes(input.priority)
+  }
+
+  // Precedence: inbox > team > workspace, then ordering by (priority, createdAt) within each group.
+  const groups: Record<'inbox' | 'team' | 'workspace', SlaPolicy[]> = {
+    inbox: [],
+    team: [],
+    workspace: [],
+  }
+  for (const p of candidates) {
+    if (!matchesPriority(p)) continue
+    groups[p.scope as 'inbox' | 'team' | 'workspace'].push(p)
+  }
+  return groups.inbox[0] ?? groups.team[0] ?? groups.workspace[0] ?? null
+}
+
+// ---------------------------------------------------------------------------
+// clock attachment / lifecycle
+// ---------------------------------------------------------------------------
+
+async function loadBusinessHours(policy: SlaPolicy): Promise<BusinessHoursLike | null> {
+  if (!policy.businessHoursId) return null
+  const row = await db.query.businessHours.findFirst({
+    where: eq(businessHours.id, policy.businessHoursId),
+  })
+  if (!row) return null
+  return {
+    timezone: row.timezone,
+    schedule: row.schedule,
+    holidays: row.holidays ?? [],
+  }
+}
+
+async function loadTargets(policyId: SlaPolicyId): Promise<Map<SlaTargetKind, SlaTarget>> {
+  const rows = await db.select().from(slaTargets).where(eq(slaTargets.policyId, policyId))
+  const map = new Map<SlaTargetKind, SlaTarget>()
+  for (const r of rows) map.set(r.kind as SlaTargetKind, r)
+  return map
+}
+
+async function startClock(opts: {
+  ticket: Ticket
+  policy: SlaPolicy
+  target: SlaTarget
+  hours: BusinessHoursLike | null
+  startedAt: Date
+  actorPrincipalId: PrincipalId | null
+}): Promise<TicketSlaClock | null> {
+  const { ticket, policy, target, hours, startedAt, actorPrincipalId } = opts
+  const dueAt = addBusinessMinutes(startedAt, target.minutes, hours)
+  // Concurrency guard: skip if an active clock for (ticket, kind) already exists.
+  const existing = await db.query.ticketSlaClocks.findFirst({
+    where: and(
+      eq(ticketSlaClocks.ticketId, ticket.id),
+      eq(ticketSlaClocks.kind, target.kind),
+      inArray(ticketSlaClocks.state, ['running', 'paused'])
+    ),
+  })
+  if (existing) return existing
+  const [created] = await db
+    .insert(ticketSlaClocks)
+    .values({
+      ticketId: ticket.id,
+      policyId: policy.id,
+      targetId: target.id,
+      kind: target.kind,
+      state: 'running',
+      targetMinutes: target.minutes,
+      startedAt,
+      dueAt,
+    })
+    .returning()
+  await writeActivity(ticket.id as TicketId, actorPrincipalId, 'sla.clock_started', {
+    clockId: created.id,
+    kind: target.kind,
+    dueAt: dueAt.toISOString(),
+    targetMinutes: target.minutes,
+    policyId: policy.id,
+  })
+  return created
+}
+
+/**
+ * Bind the matching policy + start first_response and resolution clocks.
+ * Best-effort; throws nothing the caller must catch (caller wraps in try/catch).
+ */
+export async function attachClocksOnCreate(
+  ticket: Ticket,
+  actorPrincipalId: PrincipalId | null
+): Promise<{ policy: SlaPolicy | null; started: TicketSlaClock[] }> {
+  const policy = await selectPolicyForTicket({
+    inboxId: (ticket.inboxId as InboxId | null) ?? null,
+    primaryTeamId: (ticket.primaryTeamId as TeamId | null) ?? null,
+    priority: ticket.priority as TicketPriority,
+  })
+  if (!policy) return { policy: null, started: [] }
+
+  // Persist the binding on the ticket header (best-effort — concurrent updates won't conflict here).
+  if (ticket.slaPolicyId !== policy.id) {
+    await db
+      .update(tickets)
+      .set({ slaPolicyId: policy.id as SlaPolicyId })
+      .where(eq(tickets.id, ticket.id))
+  }
+  await writeActivity(ticket.id as TicketId, actorPrincipalId, 'sla.policy_assigned', {
+    policyId: policy.id,
+    policyName: policy.name,
+  })
+
+  const targets = await loadTargets(policy.id as SlaPolicyId)
+  const hours = await loadBusinessHours(policy)
+  const startedAt = new Date()
+
+  const started: TicketSlaClock[] = []
+  for (const kind of ['first_response', 'resolution'] as const) {
+    const t = targets.get(kind)
+    if (!t) continue
+    const clock = await startClock({
+      ticket,
+      policy,
+      target: t,
+      hours,
+      startedAt,
+      actorPrincipalId,
+    })
+    if (clock) started.push(clock)
+  }
+  return { policy, started }
+}
+
+async function loadPolicyAndHours(
+  policyId: SlaPolicyId
+): Promise<{ policy: SlaPolicy; hours: BusinessHoursLike | null } | null> {
+  const policy = await db.query.slaPolicies.findFirst({ where: eq(slaPolicies.id, policyId) })
+  if (!policy) return null
+  const hours = await loadBusinessHours(policy)
+  return { policy, hours }
+}
+
+/**
+ * Mark the first-response clock met and start a next_response clock if the
+ * policy defines one (it's restarted on each customer reply, see `onCustomerReply`).
+ * Idempotent — safe to call repeatedly; only acts when first_response is still running.
+ */
+export async function onPublicAgentReply(
+  ticket: Ticket,
+  actorPrincipalId: PrincipalId | null
+): Promise<void> {
+  const now = new Date()
+  // Mark first_response as met if running.
+  const fr = await db.query.ticketSlaClocks.findFirst({
+    where: and(
+      eq(ticketSlaClocks.ticketId, ticket.id),
+      eq(ticketSlaClocks.kind, 'first_response'),
+      inArray(ticketSlaClocks.state, ['running', 'paused'])
+    ),
+  })
+  if (fr) {
+    await db
+      .update(ticketSlaClocks)
+      .set({ state: 'met', metAt: now })
+      .where(eq(ticketSlaClocks.id, fr.id))
+    await writeActivity(ticket.id as TicketId, actorPrincipalId, 'sla.met', {
+      clockId: fr.id,
+      kind: 'first_response',
+    })
+  }
+  // Mark next_response as met if running (agent answered the customer's last question).
+  const nr = await db.query.ticketSlaClocks.findFirst({
+    where: and(
+      eq(ticketSlaClocks.ticketId, ticket.id),
+      eq(ticketSlaClocks.kind, 'next_response'),
+      inArray(ticketSlaClocks.state, ['running', 'paused'])
+    ),
+  })
+  if (nr) {
+    await db
+      .update(ticketSlaClocks)
+      .set({ state: 'met', metAt: now })
+      .where(eq(ticketSlaClocks.id, nr.id))
+    await writeActivity(ticket.id as TicketId, actorPrincipalId, 'sla.met', {
+      clockId: nr.id,
+      kind: 'next_response',
+    })
+  }
+}
+
+/**
+ * Customer authored a public reply — start (or restart) a next_response clock.
+ */
+export async function onCustomerReply(
+  ticket: Ticket,
+  actorPrincipalId: PrincipalId | null
+): Promise<void> {
+  if (!ticket.slaPolicyId) return
+  const ctx = await loadPolicyAndHours(ticket.slaPolicyId as SlaPolicyId)
+  if (!ctx) return
+  const targets = await loadTargets(ctx.policy.id as SlaPolicyId)
+  const target = targets.get('next_response')
+  if (!target) return
+
+  // Cancel any existing running/paused next_response clock first.
+  await db
+    .update(ticketSlaClocks)
+    .set({ state: 'cancelled' })
+    .where(
+      and(
+        eq(ticketSlaClocks.ticketId, ticket.id),
+        eq(ticketSlaClocks.kind, 'next_response'),
+        inArray(ticketSlaClocks.state, ['running', 'paused'])
+      )
+    )
+
+  await startClock({
+    ticket,
+    policy: ctx.policy,
+    target,
+    hours: ctx.hours,
+    startedAt: new Date(),
+    actorPrincipalId,
+  })
+}
+
+/**
+ * React to a status category transition. Pauses/resumes/cancels clocks per
+ * policy flags; marks resolution clock met on solved.
+ */
+export async function onStatusTransition(
+  ticket: Ticket,
+  fromCategory: TicketStatusCategory | null,
+  toCategory: TicketStatusCategory,
+  actorPrincipalId: PrincipalId | null
+): Promise<void> {
+  if (!ticket.slaPolicyId) return
+  const policy = await db.query.slaPolicies.findFirst({
+    where: eq(slaPolicies.id, ticket.slaPolicyId as SlaPolicyId),
+  })
+  if (!policy) return
+  const hours = await loadBusinessHours(policy)
+  const now = new Date()
+
+  const isPausing = (cat: TicketStatusCategory): boolean =>
+    (cat === 'pending' && policy.pauseOnPending) || (cat === 'on_hold' && policy.pauseOnOnHold)
+
+  const wasPausing = fromCategory ? isPausing(fromCategory) : false
+  const nowPausing = isPausing(toCategory)
+
+  if (!wasPausing && nowPausing) {
+    // Pause all running clocks.
+    const running = await db
+      .select()
+      .from(ticketSlaClocks)
+      .where(and(eq(ticketSlaClocks.ticketId, ticket.id), eq(ticketSlaClocks.state, 'running')))
+    for (const c of running) {
+      await db
+        .update(ticketSlaClocks)
+        .set({ state: 'paused', pausedAt: now })
+        .where(eq(ticketSlaClocks.id, c.id))
+      await writeActivity(ticket.id as TicketId, actorPrincipalId, 'sla.paused', {
+        clockId: c.id,
+        kind: c.kind,
+        reason: toCategory,
+      })
+    }
+  } else if (wasPausing && !nowPausing) {
+    // Resume all paused clocks: shift dueAt by the time we were paused.
+    const paused = await db
+      .select()
+      .from(ticketSlaClocks)
+      .where(and(eq(ticketSlaClocks.ticketId, ticket.id), eq(ticketSlaClocks.state, 'paused')))
+    for (const c of paused) {
+      const pausedFor = c.pausedAt ? now.getTime() - new Date(c.pausedAt).getTime() : 0
+      // Recompute remaining business minutes and re-derive dueAt from now.
+      // Elapsed business-time so far = elapsedBusinessMs(startedAt, pausedAt, hours).
+      const elapsedMs = elapsedBusinessMs(
+        new Date(c.startedAt),
+        c.pausedAt ? new Date(c.pausedAt) : now,
+        hours
+      )
+      const totalMs = c.targetMinutes * 60_000
+      const remainingMinutes = Math.max(1, Math.round((totalMs - elapsedMs) / 60_000))
+      const newDueAt = addBusinessMinutes(now, remainingMinutes, hours)
+      await db
+        .update(ticketSlaClocks)
+        .set({
+          state: 'running',
+          pausedAt: null,
+          accumulatedPausedMs: (c.accumulatedPausedMs ?? 0) + Math.max(0, pausedFor),
+          dueAt: newDueAt,
+        })
+        .where(eq(ticketSlaClocks.id, c.id))
+      await writeActivity(ticket.id as TicketId, actorPrincipalId, 'sla.resumed', {
+        clockId: c.id,
+        kind: c.kind,
+        newDueAt: newDueAt.toISOString(),
+        pausedMs: pausedFor,
+      })
+    }
+  }
+
+  if (toCategory === 'solved') {
+    // Mark resolution as met if still active.
+    const res = await db.query.ticketSlaClocks.findFirst({
+      where: and(
+        eq(ticketSlaClocks.ticketId, ticket.id),
+        eq(ticketSlaClocks.kind, 'resolution'),
+        inArray(ticketSlaClocks.state, ['running', 'paused'])
+      ),
+    })
+    if (res) {
+      await db
+        .update(ticketSlaClocks)
+        .set({ state: 'met', metAt: now })
+        .where(eq(ticketSlaClocks.id, res.id))
+      await writeActivity(ticket.id as TicketId, actorPrincipalId, 'sla.met', {
+        clockId: res.id,
+        kind: 'resolution',
+      })
+    }
+  } else if (toCategory === 'closed') {
+    // Cancel all still-active clocks.
+    const active = await db
+      .select()
+      .from(ticketSlaClocks)
+      .where(
+        and(
+          eq(ticketSlaClocks.ticketId, ticket.id),
+          inArray(ticketSlaClocks.state, ['running', 'paused'])
+        )
+      )
+    for (const c of active) {
+      await db
+        .update(ticketSlaClocks)
+        .set({ state: 'cancelled' })
+        .where(eq(ticketSlaClocks.id, c.id))
+    }
+  } else if (fromCategory && (fromCategory === 'solved' || fromCategory === 'closed')) {
+    // Reopen — toCategory is already narrowed to a non-terminal state here.
+    // Start a fresh resolution clock if policy has the target.
+    const targets = await loadTargets(policy.id as SlaPolicyId)
+    const t = targets.get('resolution')
+    if (t) {
+      await startClock({
+        ticket,
+        policy,
+        target: t,
+        hours,
+        startedAt: now,
+        actorPrincipalId,
+      })
+    }
+  }
+}
diff --git a/apps/web/src/lib/server/domains/sla/sla.escalations.ts b/apps/web/src/lib/server/domains/sla/sla.escalations.ts
new file mode 100644
index 000000000..be258b0bd
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/sla.escalations.ts
@@ -0,0 +1,250 @@
+/**
+ * SLA escalation tick — idempotent worker invoked by an external scheduler.
+ *
+ * Two passes per call:
+ *   1. Mark any running clock whose `dueAt <= now` as 'breached'; emit
+ *      `sla.breached` activity + `ticket_sla_breach` notification (best-effort).
+ *   2. For each enabled escalation rule: find still-running clocks whose
+ *      `(dueAt - leadMinutes * 60s) <= now` AND
+ *      `(lastEscalatedAt IS NULL OR lastEscalatedAt < (dueAt - leadMinutes * 60s))`
+ *      AND `kind = rule.targetKind`. Resolve recipients, dispatch in_app
+ *      notifications, insert `sla_escalation_log`, set `lastEscalatedAt = now`.
+ *
+ * Concurrency: each clock UPDATE uses a `WHERE state=...` filter so two
+ * overlapping ticks won't both flip the same row; only one INSERT ever happens
+ * per (clock, tick window).
+ */
+
+import {
+  db,
+  eq,
+  and,
+  lte,
+  isNull,
+  or,
+  sql,
+  ticketSlaClocks,
+  escalationRules,
+  slaEscalationLog,
+  tickets,
+  inboxMemberships,
+  type TicketSlaClock,
+  type EscalationRule,
+} from '@/lib/server/db'
+import type { TicketId, PrincipalId, InboxId } from '@quackback/ids'
+import { writeActivity } from '../tickets/ticket.service'
+
+export interface RunEscalationTickOptions {
+  now?: Date
+  batchSize?: number
+}
+
+export interface RunEscalationTickResult {
+  breached: number
+  escalated: number
+  considered: number
+}
+
+export async function runEscalationTick(
+  opts: RunEscalationTickOptions = {}
+): Promise<RunEscalationTickResult> {
+  const now = opts.now ?? new Date()
+  const limit = opts.batchSize ?? 200
+  const result: RunEscalationTickResult = { breached: 0, escalated: 0, considered: 0 }
+
+  // ---- 1. Mark breaches ----
+  const dueClocks = await db
+    .select()
+    .from(ticketSlaClocks)
+    .where(and(eq(ticketSlaClocks.state, 'running'), lte(ticketSlaClocks.dueAt, now)))
+    .limit(limit)
+
+  for (const c of dueClocks) {
+    const updated = await db
+      .update(ticketSlaClocks)
+      .set({ state: 'breached', breachedAt: now })
+      .where(and(eq(ticketSlaClocks.id, c.id), eq(ticketSlaClocks.state, 'running')))
+      .returning()
+    if (updated.length === 0) continue
+    result.breached++
+    await writeActivity(c.ticketId as TicketId, null, 'sla.breached', {
+      clockId: c.id,
+      kind: c.kind,
+      dueAt: c.dueAt instanceof Date ? c.dueAt.toISOString() : String(c.dueAt),
+    })
+    // Best-effort breach notification to assignee (if any).
+    await dispatchBreachNotification(c.ticketId as TicketId, c.kind)
+  }
+
+  // ---- 2. Run escalation rules ----
+  const rules = await db.select().from(escalationRules).where(eq(escalationRules.enabled, true))
+
+  for (const rule of rules) {
+    // due_at - lead_minutes * interval '1 min' <= now
+    const candidates = await db
+      .select()
+      .from(ticketSlaClocks)
+      .where(
+        and(
+          eq(ticketSlaClocks.state, 'running'),
+          eq(ticketSlaClocks.kind, rule.targetKind),
+          eq(ticketSlaClocks.policyId, rule.policyId),
+          sql`(${ticketSlaClocks.dueAt} - (${rule.leadMinutes}::int * interval '1 minute')) <= ${now}`,
+          or(
+            isNull(ticketSlaClocks.lastEscalatedAt),
+            sql`${ticketSlaClocks.lastEscalatedAt} < (${ticketSlaClocks.dueAt} - (${rule.leadMinutes}::int * interval '1 minute'))`
+          )
+        )
+      )
+      .limit(limit)
+
+    for (const c of candidates) {
+      result.considered++
+      const updated = await db
+        .update(ticketSlaClocks)
+        .set({ lastEscalatedAt: now })
+        .where(
+          and(
+            eq(ticketSlaClocks.id, c.id),
+            // re-check anti-spam anchor under WHERE to avoid double-fire across ticks
+            or(
+              isNull(ticketSlaClocks.lastEscalatedAt),
+              sql`${ticketSlaClocks.lastEscalatedAt} < (${ticketSlaClocks.dueAt} - (${rule.leadMinutes}::int * interval '1 minute'))`
+            )
+          )
+        )
+        .returning()
+      if (updated.length === 0) continue
+
+      const recipients = await resolveRecipients(rule, c)
+      const channels = (rule.channels ?? []) as readonly string[]
+
+      // Dispatch in_app notifications (best-effort).
+      if (channels.includes('in_app') && recipients.length > 0) {
+        await dispatchEscalationNotifications(c.ticketId as TicketId, c.kind, rule.name, recipients)
+      }
+      // Note: 'email' / 'webhook' channels logged but not yet wired (v1).
+      if (channels.some((ch) => ch !== 'in_app')) {
+        console.log(
+          `[sla.escalations] non-in_app channels deferred for rule ${rule.id} (clock ${c.id})`
+        )
+      }
+
+      await db.insert(slaEscalationLog).values({
+        clockId: c.id,
+        ruleId: rule.id,
+        firedAt: now,
+        recipientPrincipalIds: recipients,
+        channels: rule.channels,
+        context: {
+          kind: c.kind,
+          ticketId: c.ticketId,
+          leadMinutes: rule.leadMinutes,
+        },
+      })
+      await writeActivity(c.ticketId as TicketId, null, 'sla.escalated', {
+        clockId: c.id,
+        kind: c.kind,
+        ruleId: rule.id,
+        ruleName: rule.name,
+        recipientCount: recipients.length,
+      })
+      result.escalated++
+    }
+  }
+
+  return result
+}
+
+// ---------------------------------------------------------------------------
+// recipients
+// ---------------------------------------------------------------------------
+
+async function resolveRecipients(rule: EscalationRule, clock: TicketSlaClock): Promise<string[]> {
+  switch (rule.recipientType) {
+    case 'principals':
+      return [...(rule.recipientPrincipalIds ?? [])]
+    case 'team': {
+      // Team membership lookup — for v1 we trust caller-provided team in rule
+      // and emit notifications targeted at the team via the recipient list.
+      // We include only directly-listed principals; team-fanout is best done
+      // by the notification dispatcher in a future phase.
+      return [...(rule.recipientPrincipalIds ?? [])]
+    }
+    case 'assignee': {
+      const ticket = await db.query.tickets.findFirst({
+        where: eq(tickets.id, clock.ticketId as TicketId),
+      })
+      const id = ticket?.assigneePrincipalId
+      return id ? [id as string] : []
+    }
+    case 'inbox_members': {
+      const ticket = await db.query.tickets.findFirst({
+        where: eq(tickets.id, clock.ticketId as TicketId),
+      })
+      if (!ticket?.inboxId) return []
+      const rows = await db
+        .select({ principalId: inboxMemberships.principalId })
+        .from(inboxMemberships)
+        .where(eq(inboxMemberships.inboxId, ticket.inboxId as InboxId))
+      return rows.map((r) => r.principalId as string)
+    }
+    default:
+      return []
+  }
+}
+
+// ---------------------------------------------------------------------------
+// notifications
+// ---------------------------------------------------------------------------
+
+async function dispatchBreachNotification(ticketId: TicketId, kind: string): Promise<void> {
+  try {
+    const ticket = await db.query.tickets.findFirst({ where: eq(tickets.id, ticketId) })
+    if (!ticket) return
+    const { notifyTicketSlaBreach } = await import('../tickets/ticket.notifications')
+    await notifyTicketSlaBreach(ticket, kind)
+    // Phase 7.5: outbound webhook event.
+    try {
+      const { dispatchTicketSlaBreach } = await import('@/lib/server/events/dispatch')
+      await dispatchTicketSlaBreach(
+        { type: 'service', displayName: 'sla-engine' },
+        ticket as unknown as Record<string, unknown>,
+        kind
+      )
+    } catch (err) {
+      console.warn('[sla.escalations] dispatchTicketSlaBreach failed', err)
+    }
+  } catch (err) {
+    console.warn('[sla.escalations] dispatchBreachNotification failed', err)
+  }
+}
+
+async function dispatchEscalationNotifications(
+  ticketId: TicketId,
+  kind: string,
+  ruleName: string,
+  recipients: string[]
+): Promise<void> {
+  if (recipients.length === 0) return
+  try {
+    const ticket = await db.query.tickets.findFirst({ where: eq(tickets.id, ticketId) })
+    if (!ticket) return
+    const { notifyTicketSlaWarning } = await import('../tickets/ticket.notifications')
+    await notifyTicketSlaWarning(ticket, kind, ruleName, recipients as PrincipalId[])
+    // Phase 7.5: outbound webhook event.
+    try {
+      const { dispatchTicketSlaWarning } = await import('@/lib/server/events/dispatch')
+      await dispatchTicketSlaWarning(
+        { type: 'service', displayName: 'sla-engine' },
+        ticket as unknown as Record<string, unknown>,
+        kind,
+        ruleName
+      )
+    } catch (err) {
+      console.warn('[sla.escalations] dispatchTicketSlaWarning failed', err)
+    }
+  } catch (err) {
+    console.warn('[sla.escalations] dispatchEscalationNotifications failed', err)
+  }
+}
diff --git a/apps/web/src/lib/server/domains/sla/sla.policies.service.ts b/apps/web/src/lib/server/domains/sla/sla.policies.service.ts
new file mode 100644
index 000000000..6004dc055
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/sla.policies.service.ts
@@ -0,0 +1,383 @@
+/**
+ * SLA policies service — CRUD for policies, targets, escalation rules.
+ *
+ * Permission gating is the caller's responsibility.
+ */
+
+import {
+  db,
+  eq,
+  isNull,
+  asc,
+  slaPolicies,
+  slaTargets,
+  escalationRules,
+  type SlaPolicy,
+  type SlaTarget,
+  type EscalationRule,
+} from '@/lib/server/db'
+import type {
+  SlaPolicyId,
+  EscalationRuleId,
+  TeamId,
+  InboxId,
+  BusinessHoursId,
+  PrincipalId,
+} from '@quackback/ids'
+import type {
+  SlaPolicyScope,
+  SlaTargetKind,
+  EscalationRecipientType,
+  EscalationChannel,
+  TicketPriority,
+} from '@/lib/server/db'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+import {
+  SLA_POLICY_SCOPES,
+  SLA_TARGET_KINDS,
+  ESCALATION_RECIPIENT_TYPES,
+  ESCALATION_CHANNELS,
+} from '@/lib/server/db'
+import {
+  dispatchSlaPolicyCreated,
+  dispatchSlaPolicyUpdated,
+  dispatchSlaPolicyArchived,
+  type EventActor,
+} from '@/lib/server/events/dispatch'
+import type { EventSlaPolicyRef } from '@/lib/server/events/types'
+import { toIsoStringOrNull } from '@/lib/shared/utils/date'
+
+const slaPolicyActor: EventActor = { type: 'service', displayName: 'sla-system' }
+
+function slaPolicyRef(p: SlaPolicy): EventSlaPolicyRef {
+  return {
+    id: p.id,
+    name: p.name,
+    scope: p.scope,
+    enabled: p.enabled,
+    priority: p.priority,
+    archivedAt: toIsoStringOrNull(p.archivedAt),
+  }
+}
+
+const NAME_MAX = 200
+
+function normalizeName(name: string): string {
+  const t = name?.trim()
+  if (!t) throw new ValidationError('SLA_POLICY_NAME_REQUIRED', 'name is required')
+  if (t.length > NAME_MAX)
+    throw new ValidationError('SLA_POLICY_NAME_TOO_LONG', `name exceeds ${NAME_MAX} chars`)
+  return t
+}
+
+// ---------------------------------------------------------------------------
+// policies
+// ---------------------------------------------------------------------------
+
+export interface CreateSlaPolicyInput {
+  name: string
+  description?: string | null
+  priority?: number
+  enabled?: boolean
+  scope: SlaPolicyScope
+  scopeTeamId?: TeamId | null
+  scopeInboxId?: InboxId | null
+  appliesToPriorities?: TicketPriority[]
+  businessHoursId?: BusinessHoursId | null
+  pauseOnPending?: boolean
+  pauseOnOnHold?: boolean
+}
+
+function validateScope(input: {
+  scope: SlaPolicyScope
+  scopeTeamId?: TeamId | null
+  scopeInboxId?: InboxId | null
+}): void {
+  if (!SLA_POLICY_SCOPES.includes(input.scope)) {
+    throw new ValidationError('SLA_POLICY_SCOPE_INVALID', 'invalid scope')
+  }
+  if (input.scope === 'team' && !input.scopeTeamId) {
+    throw new ValidationError(
+      'SLA_POLICY_SCOPE_TEAM_REQUIRED',
+      'scopeTeamId required for scope=team'
+    )
+  }
+  if (input.scope === 'inbox' && !input.scopeInboxId) {
+    throw new ValidationError(
+      'SLA_POLICY_SCOPE_INBOX_REQUIRED',
+      'scopeInboxId required for scope=inbox'
+    )
+  }
+  if (input.scope === 'workspace' && (input.scopeTeamId || input.scopeInboxId)) {
+    throw new ValidationError(
+      'SLA_POLICY_SCOPE_WORKSPACE_NO_BIND',
+      'workspace-scoped policy cannot have team/inbox scope'
+    )
+  }
+}
+
+export async function createSlaPolicy(input: CreateSlaPolicyInput): Promise<SlaPolicy> {
+  const name = normalizeName(input.name)
+  validateScope(input)
+  const [created] = await db
+    .insert(slaPolicies)
+    .values({
+      name,
+      description: input.description ?? null,
+      priority: input.priority ?? 100,
+      enabled: input.enabled ?? true,
+      scope: input.scope,
+      scopeTeamId: input.scopeTeamId ?? null,
+      scopeInboxId: input.scopeInboxId ?? null,
+      appliesToPriorities: input.appliesToPriorities ?? [],
+      businessHoursId: input.businessHoursId ?? null,
+      pauseOnPending: input.pauseOnPending ?? true,
+      pauseOnOnHold: input.pauseOnOnHold ?? true,
+    })
+    .returning()
+  void dispatchSlaPolicyCreated(slaPolicyActor, slaPolicyRef(created)).catch(() => {})
+  return created
+}
+
+export interface UpdateSlaPolicyInput {
+  name?: string
+  description?: string | null
+  priority?: number
+  enabled?: boolean
+  appliesToPriorities?: TicketPriority[]
+  businessHoursId?: BusinessHoursId | null
+  pauseOnPending?: boolean
+  pauseOnOnHold?: boolean
+}
+
+export async function updateSlaPolicy(
+  id: SlaPolicyId,
+  input: UpdateSlaPolicyInput
+): Promise<SlaPolicy> {
+  const existing = await getSlaPolicy(id)
+  if (!existing) throw new NotFoundError('SLA_POLICY_NOT_FOUND', `policy ${id} not found`)
+  if (existing.archivedAt) {
+    throw new ConflictError('SLA_POLICY_ARCHIVED', 'cannot update archived policy')
+  }
+  const patch: Partial<typeof existing> = {}
+  if (input.name !== undefined) patch.name = normalizeName(input.name)
+  if (input.description !== undefined) patch.description = input.description
+  if (input.priority !== undefined) patch.priority = input.priority
+  if (input.enabled !== undefined) patch.enabled = input.enabled
+  if (input.appliesToPriorities !== undefined) patch.appliesToPriorities = input.appliesToPriorities
+  if (input.businessHoursId !== undefined) patch.businessHoursId = input.businessHoursId
+  if (input.pauseOnPending !== undefined) patch.pauseOnPending = input.pauseOnPending
+  if (input.pauseOnOnHold !== undefined) patch.pauseOnOnHold = input.pauseOnOnHold
+  if (Object.keys(patch).length === 0) return existing
+  const [updated] = await db
+    .update(slaPolicies)
+    .set(patch)
+    .where(eq(slaPolicies.id, id))
+    .returning()
+  void dispatchSlaPolicyUpdated(slaPolicyActor, slaPolicyRef(updated), Object.keys(patch)).catch(
+    () => {}
+  )
+  return updated
+}
+
+export async function archiveSlaPolicy(id: SlaPolicyId): Promise<SlaPolicy> {
+  const [updated] = await db
+    .update(slaPolicies)
+    .set({ archivedAt: new Date(), enabled: false })
+    .where(eq(slaPolicies.id, id))
+    .returning()
+  if (!updated) throw new NotFoundError('SLA_POLICY_NOT_FOUND', `policy ${id} not found`)
+  void dispatchSlaPolicyArchived(slaPolicyActor, slaPolicyRef(updated)).catch(() => {})
+  return updated
+}
+
+export async function getSlaPolicy(id: SlaPolicyId): Promise<SlaPolicy | null> {
+  const row = await db.query.slaPolicies.findFirst({ where: eq(slaPolicies.id, id) })
+  return row ?? null
+}
+
+export async function listSlaPolicies(
+  opts: { includeArchived?: boolean } = {}
+): Promise<SlaPolicy[]> {
+  const where = opts.includeArchived ? undefined : isNull(slaPolicies.archivedAt)
+  return db
+    .select()
+    .from(slaPolicies)
+    .where(where)
+    .orderBy(asc(slaPolicies.priority), asc(slaPolicies.createdAt))
+}
+
+// ---------------------------------------------------------------------------
+// targets (whole-set replace)
+// ---------------------------------------------------------------------------
+
+export interface SlaTargetInput {
+  kind: SlaTargetKind
+  minutes: number
+}
+
+export async function listTargetsForPolicy(policyId: SlaPolicyId): Promise<SlaTarget[]> {
+  return db.select().from(slaTargets).where(eq(slaTargets.policyId, policyId))
+}
+
+/** Replace the full target set for a policy. Atomic. */
+export async function replaceTargets(
+  policyId: SlaPolicyId,
+  targets: SlaTargetInput[]
+): Promise<SlaTarget[]> {
+  for (const t of targets) {
+    if (!SLA_TARGET_KINDS.includes(t.kind)) {
+      throw new ValidationError('SLA_TARGET_KIND_INVALID', `invalid kind: ${t.kind}`)
+    }
+    if (!Number.isFinite(t.minutes) || t.minutes <= 0) {
+      throw new ValidationError(
+        'SLA_TARGET_MINUTES_INVALID',
+        `minutes must be > 0 (got ${t.minutes})`
+      )
+    }
+  }
+  // Dedup by kind (keep last).
+  const map = new Map<SlaTargetKind, number>()
+  for (const t of targets) map.set(t.kind, t.minutes)
+
+  return db.transaction(async (tx) => {
+    await tx.delete(slaTargets).where(eq(slaTargets.policyId, policyId))
+    if (map.size === 0) return []
+    const rows = await tx
+      .insert(slaTargets)
+      .values(
+        Array.from(map.entries()).map(([kind, minutes]) => ({
+          policyId,
+          kind,
+          minutes,
+        }))
+      )
+      .returning()
+    return rows
+  })
+}
+
+// ---------------------------------------------------------------------------
+// escalation rules
+// ---------------------------------------------------------------------------
+
+export interface CreateEscalationRuleInput {
+  policyId: SlaPolicyId
+  name: string
+  leadMinutes: number
+  targetKind: SlaTargetKind
+  recipientType: EscalationRecipientType
+  recipientTeamId?: TeamId | null
+  recipientPrincipalIds?: PrincipalId[]
+  channels?: EscalationChannel[]
+  enabled?: boolean
+}
+
+function validateEscalation(input: Partial<CreateEscalationRuleInput>): void {
+  if (input.targetKind != null && !SLA_TARGET_KINDS.includes(input.targetKind)) {
+    throw new ValidationError('ESCALATION_TARGET_KIND_INVALID', 'invalid targetKind')
+  }
+  if (input.recipientType != null && !ESCALATION_RECIPIENT_TYPES.includes(input.recipientType)) {
+    throw new ValidationError('ESCALATION_RECIPIENT_TYPE_INVALID', 'invalid recipientType')
+  }
+  if (input.recipientType === 'team' && !input.recipientTeamId) {
+    throw new ValidationError(
+      'ESCALATION_RECIPIENT_TEAM_REQUIRED',
+      'recipientTeamId required for recipientType=team'
+    )
+  }
+  if (input.recipientType === 'principals') {
+    const ids = input.recipientPrincipalIds ?? []
+    if (ids.length === 0) {
+      throw new ValidationError(
+        'ESCALATION_RECIPIENT_PRINCIPALS_REQUIRED',
+        'at least one principal required for recipientType=principals'
+      )
+    }
+  }
+  if (input.channels != null) {
+    for (const c of input.channels) {
+      if (!ESCALATION_CHANNELS.includes(c)) {
+        throw new ValidationError('ESCALATION_CHANNEL_INVALID', `invalid channel: ${c}`)
+      }
+    }
+  }
+  if (input.leadMinutes != null && !Number.isFinite(input.leadMinutes)) {
+    throw new ValidationError('ESCALATION_LEAD_MINUTES_INVALID', 'leadMinutes must be a number')
+  }
+}
+
+export async function createEscalationRule(
+  input: CreateEscalationRuleInput
+): Promise<EscalationRule> {
+  validateEscalation(input)
+  const name = normalizeName(input.name)
+  const [created] = await db
+    .insert(escalationRules)
+    .values({
+      policyId: input.policyId,
+      name,
+      leadMinutes: input.leadMinutes,
+      targetKind: input.targetKind,
+      recipientType: input.recipientType,
+      recipientTeamId: input.recipientTeamId ?? null,
+      recipientPrincipalIds: input.recipientPrincipalIds ?? [],
+      channels: input.channels ?? ['in_app'],
+      enabled: input.enabled ?? true,
+    })
+    .returning()
+  return created
+}
+
+export interface UpdateEscalationRuleInput {
+  name?: string
+  leadMinutes?: number
+  targetKind?: SlaTargetKind
+  recipientType?: EscalationRecipientType
+  recipientTeamId?: TeamId | null
+  recipientPrincipalIds?: PrincipalId[]
+  channels?: EscalationChannel[]
+  enabled?: boolean
+}
+
+export async function updateEscalationRule(
+  id: EscalationRuleId,
+  input: UpdateEscalationRuleInput
+): Promise<EscalationRule> {
+  validateEscalation(input)
+  const existing = await db.query.escalationRules.findFirst({
+    where: eq(escalationRules.id, id),
+  })
+  if (!existing) throw new NotFoundError('ESCALATION_RULE_NOT_FOUND', `rule ${id} not found`)
+  const patch: Partial<typeof existing> = {}
+  if (input.name !== undefined) patch.name = normalizeName(input.name)
+  if (input.leadMinutes !== undefined) patch.leadMinutes = input.leadMinutes
+  if (input.targetKind !== undefined) patch.targetKind = input.targetKind
+  if (input.recipientType !== undefined) patch.recipientType = input.recipientType
+  if (input.recipientTeamId !== undefined) patch.recipientTeamId = input.recipientTeamId
+  if (input.recipientPrincipalIds !== undefined)
+    patch.recipientPrincipalIds = input.recipientPrincipalIds
+  if (input.channels !== undefined) patch.channels = input.channels
+  if (input.enabled !== undefined) patch.enabled = input.enabled
+  if (Object.keys(patch).length === 0) return existing
+  const [updated] = await db
+    .update(escalationRules)
+    .set(patch)
+    .where(eq(escalationRules.id, id))
+    .returning()
+  return updated
+}
+
+export async function deleteEscalationRule(id: EscalationRuleId): Promise<void> {
+  await db.delete(escalationRules).where(eq(escalationRules.id, id))
+}
+
+export async function listEscalationRulesForPolicy(
+  policyId: SlaPolicyId
+): Promise<EscalationRule[]> {
+  return db
+    .select()
+    .from(escalationRules)
+    .where(eq(escalationRules.policyId, policyId))
+    .orderBy(asc(escalationRules.leadMinutes))
+}
diff --git a/apps/web/src/lib/server/domains/sla/sla.queries.ts b/apps/web/src/lib/server/domains/sla/sla.queries.ts
new file mode 100644
index 000000000..620868fc6
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/sla.queries.ts
@@ -0,0 +1,54 @@
+/**
+ * Read-only queries for SLA clocks (used by REST + queue summaries).
+ */
+import {
+  db,
+  eq,
+  and,
+  inArray,
+  lte,
+  asc,
+  ticketSlaClocks,
+  type TicketSlaClock,
+} from '@/lib/server/db'
+import type { TicketId } from '@quackback/ids'
+
+export async function getActiveClocksForTicket(ticketId: TicketId): Promise<TicketSlaClock[]> {
+  return db
+    .select()
+    .from(ticketSlaClocks)
+    .where(
+      and(
+        eq(ticketSlaClocks.ticketId, ticketId),
+        inArray(ticketSlaClocks.state, ['running', 'paused', 'breached'])
+      )
+    )
+    .orderBy(asc(ticketSlaClocks.dueAt))
+}
+
+export async function getAllClocksForTicket(ticketId: TicketId): Promise<TicketSlaClock[]> {
+  return db
+    .select()
+    .from(ticketSlaClocks)
+    .where(eq(ticketSlaClocks.ticketId, ticketId))
+    .orderBy(asc(ticketSlaClocks.createdAt))
+}
+
+export interface ListBreachingOptions {
+  /** Include clocks whose dueAt is within `windowMinutes` from now (default 0 = breached only). */
+  windowMinutes?: number
+  limit?: number
+}
+
+export async function listBreachingClocks(
+  opts: ListBreachingOptions = {}
+): Promise<TicketSlaClock[]> {
+  const window = opts.windowMinutes ?? 0
+  const cutoff = new Date(Date.now() + window * 60_000)
+  return db
+    .select()
+    .from(ticketSlaClocks)
+    .where(and(eq(ticketSlaClocks.state, 'running'), lte(ticketSlaClocks.dueAt, cutoff)))
+    .orderBy(asc(ticketSlaClocks.dueAt))
+    .limit(opts.limit ?? 200)
+}
diff --git a/apps/web/src/lib/server/domains/sla/sla.types.ts b/apps/web/src/lib/server/domains/sla/sla.types.ts
new file mode 100644
index 000000000..74eb9294e
--- /dev/null
+++ b/apps/web/src/lib/server/domains/sla/sla.types.ts
@@ -0,0 +1,36 @@
+/**
+ * SLA domain shared types & re-exports.
+ *
+ * All cross-module SLA constants & types funnel through this barrel so other
+ * domains import a single, stable surface.
+ */
+export type {
+  BusinessHours,
+  NewBusinessHours,
+  SlaPolicy,
+  NewSlaPolicy,
+  SlaTarget,
+  NewSlaTarget,
+  TicketSlaClock,
+  NewTicketSlaClock,
+  EscalationRule,
+  NewEscalationRule,
+  SlaEscalationLogEntry,
+  NewSlaEscalationLogEntry,
+  BusinessHoursRange,
+  BusinessHoursWeek,
+  BusinessHoursHoliday,
+  SlaTargetKind,
+  SlaClockState,
+  SlaPolicyScope,
+  EscalationRecipientType,
+  EscalationChannel,
+} from '@/lib/server/db'
+
+export {
+  SLA_TARGET_KINDS,
+  SLA_CLOCK_STATES,
+  SLA_POLICY_SCOPES,
+  ESCALATION_RECIPIENT_TYPES,
+  ESCALATION_CHANNELS,
+} from '@/lib/server/db'
diff --git a/apps/web/src/lib/server/domains/statuses/__tests__/status.service.diffcov.test.ts b/apps/web/src/lib/server/domains/statuses/__tests__/status.service.diffcov.test.ts
new file mode 100644
index 000000000..7ba398395
--- /dev/null
+++ b/apps/web/src/lib/server/domains/statuses/__tests__/status.service.diffcov.test.ts
@@ -0,0 +1,242 @@
+/**
+ * Differential-coverage tests for status.service — create/update/delete
+ * validation (name/slug/color/dup/default/in-use), default management,
+ * reorder, getters, and the public-list error wrapping.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  findFirst: vi.fn(),
+  findMany: vi.fn(),
+  execute: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  selectWhere: vi.fn(),
+  dCreated: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dUpdated: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dDeleted: vi.fn((..._a: unknown[]) => Promise.resolve()),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: { postStatuses: { findFirst: m.findFirst, findMany: m.findMany } },
+    execute: (...a: unknown[]) => m.execute(...a),
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({
+      set: () => ({
+        where: () => ({
+          returning: m.updateReturning,
+          then: (r: (v: unknown) => void) => r(undefined),
+        }),
+      }),
+    }),
+    select: () => ({ from: () => ({ where: () => m.selectWhere() }) }),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  inArray: vi.fn(),
+  asc: vi.fn(),
+  sql: Object.assign((..._a: unknown[]) => ({ __sql: true }), { raw: () => ({ __raw: true }) }),
+  posts: { statusId: 'p.statusId', deletedAt: 'p.deletedAt' },
+  postStatuses: {
+    id: 'ps.id',
+    slug: 'ps.slug',
+    isDefault: 'ps.isDefault',
+    deletedAt: 'ps.deletedAt',
+    category: 'ps.category',
+    position: 'ps.position',
+  },
+}))
+vi.mock('@quackback/ids', () => ({ toUuid: (id: string) => id }))
+vi.mock('@/lib/server/logger', () => ({
+  logger: { child: () => ({ debug: vi.fn(), error: vi.fn() }) },
+}))
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchStatusCreated: (...a: unknown[]) => m.dCreated(...a),
+  dispatchStatusUpdated: (...a: unknown[]) => m.dUpdated(...a),
+  dispatchStatusDeleted: (...a: unknown[]) => m.dDeleted(...a),
+}))
+
+import * as svc from '../status.service'
+
+const status = (over: Record<string, unknown> = {}) => ({
+  id: 'st_1',
+  slug: 'open',
+  name: 'Open',
+  color: '#3b82f6',
+  category: 'active',
+  position: 0,
+  showOnRoadmap: false,
+  isDefault: false,
+  createdAt: new Date('2026-01-01'),
+  deletedAt: null,
+  ...over,
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.findFirst.mockResolvedValue(undefined)
+  m.findMany.mockResolvedValue([status()])
+  m.execute.mockResolvedValue(undefined)
+  m.insertReturning.mockResolvedValue([status()])
+  m.updateReturning.mockResolvedValue([status()])
+  m.selectWhere.mockResolvedValue([{ count: 0 }])
+})
+
+describe('createStatus', () => {
+  it('validates name / slug / color', async () => {
+    await expect(
+      svc.createStatus({ name: ' ', slug: 'open', color: '#3b82f6', category: 'active' } as never)
+    ).rejects.toThrow('Name is required')
+    await expect(
+      svc.createStatus({
+        name: 'x'.repeat(51),
+        slug: 'o',
+        color: '#3b82f6',
+        category: 'active',
+      } as never)
+    ).rejects.toThrow('50 characters')
+    await expect(
+      svc.createStatus({ name: 'N', slug: ' ', color: '#3b82f6', category: 'active' } as never)
+    ).rejects.toThrow('Slug is required')
+    await expect(
+      svc.createStatus({
+        name: 'N',
+        slug: 'x'.repeat(51),
+        color: '#3b82f6',
+        category: 'active',
+      } as never)
+    ).rejects.toThrow('Slug must be 50')
+    await expect(
+      svc.createStatus({
+        name: 'N',
+        slug: 'Bad Slug',
+        color: '#3b82f6',
+        category: 'active',
+      } as never)
+    ).rejects.toThrow('lowercase')
+    await expect(
+      svc.createStatus({ name: 'N', slug: 'ok', color: ' ', category: 'active' } as never)
+    ).rejects.toThrow('Color is required')
+    await expect(
+      svc.createStatus({ name: 'N', slug: 'ok', color: 'red', category: 'active' } as never)
+    ).rejects.toThrow('hex format')
+  })
+  it('rejects a duplicate slug', async () => {
+    m.findFirst.mockResolvedValueOnce(status())
+    await expect(
+      svc.createStatus({ name: 'N', slug: 'open', color: '#3b82f6', category: 'active' } as never)
+    ).rejects.toThrow('already exists')
+  })
+  it('creates and sets default atomically', async () => {
+    await svc.createStatus({
+      name: 'N',
+      slug: 'open',
+      color: '#3b82f6',
+      category: 'active',
+      isDefault: true,
+    } as never)
+    expect(m.execute).toHaveBeenCalled()
+    expect(m.dCreated).toHaveBeenCalled()
+  })
+})
+
+describe('updateStatus', () => {
+  it('throws when missing', async () => {
+    m.findFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.updateStatus('st_1' as never, { name: 'x' } as never)).rejects.toThrow(
+      'not found'
+    )
+  })
+  it('validates name and color', async () => {
+    m.findFirst.mockResolvedValue(status())
+    await expect(svc.updateStatus('st_1' as never, { name: ' ' } as never)).rejects.toThrow(
+      'cannot be empty'
+    )
+    await expect(
+      svc.updateStatus('st_1' as never, { name: 'x'.repeat(51) } as never)
+    ).rejects.toThrow('50 characters')
+    await expect(svc.updateStatus('st_1' as never, { color: ' ' } as never)).rejects.toThrow(
+      'cannot be empty'
+    )
+    await expect(svc.updateStatus('st_1' as never, { color: 'red' } as never)).rejects.toThrow(
+      'hex format'
+    )
+  })
+  it('updates fields, setting default atomically', async () => {
+    m.findFirst.mockResolvedValueOnce(status())
+    await svc.updateStatus(
+      'st_1' as never,
+      { name: ' New ', color: '#000000', showOnRoadmap: true, isDefault: true } as never
+    )
+    expect(m.execute).toHaveBeenCalled()
+    expect(m.dUpdated).toHaveBeenCalled()
+  })
+  it('handles isDefault=false and a missing updated row', async () => {
+    m.findFirst.mockResolvedValueOnce(status())
+    await svc.updateStatus('st_1' as never, { isDefault: false } as never)
+    m.findFirst.mockResolvedValueOnce(status())
+    m.updateReturning.mockResolvedValueOnce([])
+    await expect(svc.updateStatus('st_1' as never, { name: 'x' } as never)).rejects.toThrow(
+      'not found'
+    )
+  })
+})
+
+describe('deleteStatus', () => {
+  it('throws not-found / default / in-use, then succeeds', async () => {
+    m.findFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.deleteStatus('st_1' as never)).rejects.toThrow('not found')
+    m.findFirst.mockResolvedValueOnce(status({ isDefault: true }))
+    await expect(svc.deleteStatus('st_1' as never)).rejects.toThrow('default status')
+    m.findFirst.mockResolvedValueOnce(status())
+    m.selectWhere.mockResolvedValueOnce([{ count: 3 }])
+    await expect(svc.deleteStatus('st_1' as never)).rejects.toThrow('post(s) are using')
+    m.findFirst.mockResolvedValueOnce(status())
+    await svc.deleteStatus('st_1' as never)
+    expect(m.dDeleted).toHaveBeenCalled()
+  })
+  it('throws when the soft-delete matches no row', async () => {
+    m.findFirst.mockResolvedValueOnce(status())
+    m.updateReturning.mockResolvedValueOnce([])
+    await expect(svc.deleteStatus('st_1' as never)).rejects.toThrow('not found')
+  })
+})
+
+describe('getters + reorder + default', () => {
+  it('getStatusById throws / returns', async () => {
+    await expect(svc.getStatusById('st_1' as never)).rejects.toThrow('not found')
+    m.findFirst.mockResolvedValueOnce(status())
+    expect((await svc.getStatusById('st_1' as never)).id).toBe('st_1')
+  })
+  it('listStatuses / listPublicStatuses return rows; public wraps errors', async () => {
+    expect(await svc.listStatuses()).toEqual([status()])
+    expect(await svc.listPublicStatuses()).toEqual([status()])
+    m.findMany.mockRejectedValueOnce(new Error('db'))
+    await expect(svc.listPublicStatuses()).rejects.toThrow('Failed to fetch statuses')
+  })
+  it('reorderStatuses validates empty input and updates otherwise', async () => {
+    await expect(svc.reorderStatuses([])).rejects.toThrow('IDs are required')
+    await svc.reorderStatuses(['st_1', 'st_2'] as never)
+    expect(true).toBe(true)
+  })
+  it('setDefaultStatus: missing / success / missing-after', async () => {
+    m.findFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.setDefaultStatus('st_1' as never)).rejects.toThrow('not found')
+    m.findFirst.mockResolvedValueOnce(status()) // exists
+    m.findFirst.mockResolvedValueOnce(status({ isDefault: true })) // refetch
+    expect((await svc.setDefaultStatus('st_1' as never)).isDefault).toBe(true)
+    m.findFirst.mockResolvedValueOnce(status()) // exists
+    m.findFirst.mockResolvedValueOnce(undefined) // refetch missing
+    await expect(svc.setDefaultStatus('st_1' as never)).rejects.toThrow('not found')
+  })
+  it('getDefaultStatus returns null when none; getStatusBySlug throws/returns', async () => {
+    expect(await svc.getDefaultStatus()).toBeNull()
+    m.findFirst.mockResolvedValueOnce(status({ isDefault: true }))
+    expect((await svc.getDefaultStatus())?.isDefault).toBe(true)
+    await expect(svc.getStatusBySlug('nope')).rejects.toThrow('not found')
+    m.findFirst.mockResolvedValueOnce(status())
+    expect((await svc.getStatusBySlug('open')).slug).toBe('open')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/statuses/status.service.ts b/apps/web/src/lib/server/domains/statuses/status.service.ts
index d6923af83..c6dc0650d 100644
--- a/apps/web/src/lib/server/domains/statuses/status.service.ts
+++ b/apps/web/src/lib/server/domains/statuses/status.service.ts
@@ -19,10 +19,34 @@ import {
   InternalError,
 } from '@/lib/shared/errors'
 import type { Status, CreateStatusInput, UpdateStatusInput } from './status.types'
+import {
+  dispatchStatusCreated,
+  dispatchStatusUpdated,
+  dispatchStatusDeleted,
+} from '@/lib/server/events/dispatch'
+import type { EventActor, EventStatusRef } from '@/lib/server/events/types'
 import { logger } from '@/lib/server/logger'
 
 const log = logger.child({ component: 'statuses' })
 
+/** Service-actor fallback for status lifecycle events. */
+const statusEventActor: EventActor = { type: 'service', displayName: 'statuses-system' }
+
+/** Build the fixed-shape webhook ref from a status row. */
+function toStatusRef(status: Status): EventStatusRef {
+  return {
+    id: status.id,
+    slug: status.slug,
+    name: status.name,
+    color: status.color ?? null,
+    category: status.category,
+    position: status.position,
+    showOnRoadmap: status.showOnRoadmap,
+    isDefault: status.isDefault,
+    createdAt: status.createdAt?.toISOString() ?? null,
+  }
+}
+
 /**
  * Atomically set a status as default, unsetting all others in a single query.
  * This prevents race conditions where concurrent requests could result in
@@ -92,6 +116,7 @@ export async function createStatus(input: CreateStatusInput): Promise<Status> {
     await setStatusAsDefaultAtomic(status.id)
   }
 
+  void dispatchStatusCreated(statusEventActor, toStatusRef(status)).catch(() => {})
   return status
 }
 
@@ -149,6 +174,14 @@ export async function updateStatus(id: StatusId, input: UpdateStatusInput): Prom
     throw new NotFoundError('STATUS_NOT_FOUND', `Status with ID ${id} not found`)
   }
 
+  // Derive from caller-facing input so the `isDefault: true` path (which goes
+  // through the atomic setter rather than `updateData`) is still reported.
+  const changedFields = (['name', 'color', 'showOnRoadmap', 'isDefault'] as const).filter(
+    (k) => input[k] !== undefined
+  )
+  void dispatchStatusUpdated(statusEventActor, toStatusRef(updatedStatus), changedFields).catch(
+    () => {}
+  )
   return updatedStatus
 }
 
@@ -199,6 +232,8 @@ export async function deleteStatus(id: StatusId): Promise<void> {
   if (deleteResult.length === 0) {
     throw new NotFoundError('STATUS_NOT_FOUND', `Status with ID ${id} not found`)
   }
+
+  void dispatchStatusDeleted(statusEventActor, toStatusRef(existingStatus)).catch(() => {})
 }
 
 /**
diff --git a/apps/web/src/lib/server/domains/subscriptions/__tests__/subscription.service.diffcov.test.ts b/apps/web/src/lib/server/domains/subscriptions/__tests__/subscription.service.diffcov.test.ts
new file mode 100644
index 000000000..a902cffc9
--- /dev/null
+++ b/apps/web/src/lib/server/domains/subscriptions/__tests__/subscription.service.diffcov.test.ts
@@ -0,0 +1,357 @@
+/**
+ * Differential-coverage tests for subscription.service — subscribe/unsubscribe,
+ * level updates, status, subscriber/preference queries (with default fallbacks),
+ * unsubscribe-token generation, and the token-processing branch matrix.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  selectWhere: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  onConflict: vi.fn(),
+  deleteWhere: vi.fn(),
+  setWhere: vi.fn(),
+  subsFindFirst: vi.fn(),
+  prefsFindFirst: vi.fn(),
+  tokensFindFirst: vi.fn(),
+  principalFindFirst: vi.fn(),
+  postsFindFirst: vi.fn(),
+}))
+
+vi.mock('@/lib/server/logger', () => ({
+  logger: { child: () => ({ debug: vi.fn() }) },
+}))
+
+vi.mock('@/lib/server/db', () => {
+  const selectChain: Record<string, unknown> = {
+    from: () => selectChain,
+    innerJoin: () => selectChain,
+    where: () => m.selectWhere(),
+  }
+  const valuesResult = {
+    onConflictDoNothing: (...a: unknown[]) => m.onConflict(...a),
+    returning: () => m.insertReturning(),
+    then: (r: (v: unknown) => void) => r(undefined),
+  }
+  const setWhereResult = {
+    returning: () => m.updateReturning(),
+    then: (r: (v: unknown) => void) => r(m.setWhere()),
+  }
+  return {
+    db: {
+      select: vi.fn(() => selectChain),
+      insert: vi.fn(() => ({ values: () => valuesResult })),
+      update: vi.fn(() => ({ set: () => ({ where: () => setWhereResult }) })),
+      delete: vi.fn(() => ({ where: (...a: unknown[]) => m.deleteWhere(...a) })),
+      query: {
+        postSubscriptions: { findFirst: m.subsFindFirst },
+        notificationPreferences: { findFirst: m.prefsFindFirst },
+        unsubscribeTokens: { findFirst: m.tokensFindFirst },
+        principal: { findFirst: m.principalFindFirst },
+        posts: { findFirst: m.postsFindFirst },
+      },
+    },
+    eq: vi.fn((a, b) => ({ eq: [a, b] })),
+    and: vi.fn((...a) => ({ and: a })),
+    inArray: vi.fn((a, b) => ({ inArray: [a, b] })),
+    isNull: vi.fn((a) => ({ isNull: a })),
+    isNotNull: vi.fn((a) => ({ isNotNull: a })),
+    postSubscriptions: {
+      id: 'ps.id',
+      principalId: 'ps.principalId',
+      postId: 'ps.postId',
+      notifyComments: 'ps.nc',
+      notifyStatusChanges: 'ps.ns',
+      reason: 'ps.reason',
+      createdAt: 'ps.createdAt',
+    },
+    notificationPreferences: { principalId: 'np.principalId', emailStatusChange: 'np.esc' },
+    unsubscribeTokens: { token: 'ut.token', id: 'ut.id' },
+    posts: { id: 'posts.id', title: 'posts.title', deletedAt: 'posts.deletedAt' },
+    principal: { id: 'principal.id', userId: 'principal.userId' },
+    user: { id: 'user.id', email: 'user.email', name: 'user.name' },
+  }
+})
+
+import * as svc from '../subscription.service'
+
+const pid = 'principal_1' as never
+const postId = 'post_1' as never
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.selectWhere.mockResolvedValue([])
+  m.onConflict.mockResolvedValue(undefined)
+  m.deleteWhere.mockResolvedValue(undefined)
+  m.setWhere.mockReturnValue(undefined)
+  m.insertReturning.mockResolvedValue([{ emailStatusChange: true }])
+  m.updateReturning.mockResolvedValue([{ emailStatusChange: false }])
+})
+
+describe('subscribe/unsubscribe/level', () => {
+  it('subscribes with the default level (all)', async () => {
+    await svc.subscribeToPost(pid, postId, 'authored' as never)
+    expect(m.onConflict).toHaveBeenCalled()
+  })
+
+  it('subscribes status_only within a provided transaction', async () => {
+    const tx = { insert: vi.fn(() => ({ values: () => ({ onConflictDoNothing: m.onConflict }) })) }
+    await svc.subscribeToPost(pid, postId, 'authored' as never, {
+      tx: tx as never,
+      level: 'status_only',
+    })
+    expect(tx.insert).toHaveBeenCalled()
+  })
+
+  it('unsubscribes', async () => {
+    await svc.unsubscribeFromPost(pid, postId)
+    expect(m.deleteWhere).toHaveBeenCalled()
+  })
+
+  it('updateSubscriptionLevel none delegates to unsubscribe', async () => {
+    await svc.updateSubscriptionLevel(pid, postId, 'none' as never)
+    expect(m.deleteWhere).toHaveBeenCalled()
+  })
+
+  it('updateSubscriptionLevel all updates flags', async () => {
+    await svc.updateSubscriptionLevel(pid, postId, 'all' as never)
+    expect(m.deleteWhere).not.toHaveBeenCalled()
+  })
+})
+
+describe('getSubscriptionStatus', () => {
+  it('returns unsubscribed defaults when no row', async () => {
+    m.subsFindFirst.mockResolvedValueOnce(undefined)
+    const s = await svc.getSubscriptionStatus(pid, postId)
+    expect(s).toMatchObject({ subscribed: false, level: 'none' })
+  })
+
+  it('maps an existing subscription', async () => {
+    m.subsFindFirst.mockResolvedValueOnce({
+      notifyComments: true,
+      notifyStatusChanges: true,
+      reason: 'authored',
+    })
+    const s = await svc.getSubscriptionStatus(pid, postId)
+    expect(s.subscribed).toBe(true)
+  })
+})
+
+describe('subscriber + subscription queries', () => {
+  it('getSubscribersForEvent filters out null emails (comment)', async () => {
+    m.selectWhere.mockResolvedValueOnce([
+      {
+        principalId: 'p1',
+        userId: 'u1',
+        email: 'a@x.test',
+        name: 'A',
+        reason: 'authored',
+        notifyComments: true,
+        notifyStatusChanges: true,
+      },
+      {
+        principalId: 'p2',
+        userId: 'u2',
+        email: null,
+        name: 'B',
+        reason: 'authored',
+        notifyComments: true,
+        notifyStatusChanges: false,
+      },
+    ])
+    const subs = await svc.getSubscribersForEvent(postId, 'comment')
+    expect(subs).toHaveLength(1)
+    expect(subs[0].email).toBe('a@x.test')
+  })
+
+  it('getSubscribersForEvent uses the status column', async () => {
+    await svc.getSubscribersForEvent(postId, 'status_change')
+    expect(m.selectWhere).toHaveBeenCalled()
+  })
+
+  it('getMemberSubscriptions maps rows', async () => {
+    m.selectWhere.mockResolvedValueOnce([
+      {
+        id: 's1',
+        postId,
+        postTitle: 'T',
+        reason: 'authored',
+        notifyComments: true,
+        notifyStatusChanges: true,
+        createdAt: new Date(),
+      },
+    ])
+    const subs = await svc.getMemberSubscriptions(pid)
+    expect(subs[0].id).toBe('s1')
+  })
+})
+
+describe('notification preferences', () => {
+  it('returns stored preferences', async () => {
+    m.prefsFindFirst.mockResolvedValueOnce({
+      emailStatusChange: false,
+      emailNewComment: false,
+      emailMuted: true,
+      emailTicketThreads: false,
+      emailTicketProperties: false,
+      emailTicketStatus: false,
+      emailTicketAssignment: false,
+      emailTicketParticipants: true,
+      emailTicketShares: true,
+      emailTicketSla: false,
+    })
+    const p = await svc.getNotificationPreferences(pid)
+    expect(p.emailMuted).toBe(true)
+  })
+
+  it('returns defaults when none exist', async () => {
+    m.prefsFindFirst.mockResolvedValueOnce(undefined)
+    const p = await svc.getNotificationPreferences(pid)
+    expect(p.emailStatusChange).toBe(true)
+  })
+
+  it('batchGet returns an empty map for no ids', async () => {
+    expect((await svc.batchGetNotificationPreferences([])).size).toBe(0)
+  })
+
+  it('batchGet fills defaults for missing ids', async () => {
+    m.selectWhere.mockResolvedValueOnce([
+      {
+        principalId: 'p1',
+        emailStatusChange: false,
+        emailNewComment: true,
+        emailMuted: false,
+        emailTicketThreads: true,
+        emailTicketProperties: true,
+        emailTicketStatus: true,
+        emailTicketAssignment: true,
+        emailTicketParticipants: false,
+        emailTicketShares: false,
+        emailTicketSla: true,
+      },
+    ])
+    const map = await svc.batchGetNotificationPreferences(['p1', 'p2'] as never)
+    expect(map.get('p1' as never)?.emailStatusChange).toBe(false)
+    expect(map.get('p2' as never)?.emailStatusChange).toBe(true) // default
+  })
+
+  it('updateNotificationPreferences updates an existing row', async () => {
+    m.prefsFindFirst.mockResolvedValueOnce({ principalId: 'p1' })
+    m.updateReturning.mockResolvedValueOnce([
+      {
+        emailStatusChange: false,
+        emailNewComment: false,
+        emailMuted: false,
+        emailTicketThreads: false,
+        emailTicketProperties: false,
+        emailTicketStatus: false,
+        emailTicketAssignment: false,
+        emailTicketParticipants: false,
+        emailTicketShares: false,
+        emailTicketSla: false,
+      },
+    ])
+    const p = await svc.updateNotificationPreferences(pid, { emailMuted: false })
+    expect(p.emailStatusChange).toBe(false)
+  })
+
+  it('updateNotificationPreferences inserts defaults when none exists', async () => {
+    m.prefsFindFirst.mockResolvedValueOnce(undefined)
+    m.insertReturning.mockResolvedValueOnce([
+      {
+        emailStatusChange: true,
+        emailNewComment: true,
+        emailMuted: false,
+        emailTicketThreads: true,
+        emailTicketProperties: true,
+        emailTicketStatus: true,
+        emailTicketAssignment: true,
+        emailTicketParticipants: false,
+        emailTicketShares: false,
+        emailTicketSla: true,
+      },
+    ])
+    const p = await svc.updateNotificationPreferences(pid, {})
+    expect(p.emailNewComment).toBe(true)
+  })
+})
+
+describe('unsubscribe tokens', () => {
+  it('generates a token', async () => {
+    const t = await svc.generateUnsubscribeToken(pid, postId, 'unsubscribe_post')
+    expect(typeof t).toBe('string')
+  })
+
+  it('batch generate returns empty for no entries', async () => {
+    expect((await svc.batchGenerateUnsubscribeTokens([])).size).toBe(0)
+  })
+
+  it('batch generate returns a token per principal', async () => {
+    const map = await svc.batchGenerateUnsubscribeTokens([
+      { principalId: 'p1' as never, postId, action: 'unsubscribe_post' },
+    ])
+    expect(map.size).toBe(1)
+  })
+})
+
+describe('processUnsubscribeToken', () => {
+  const future = new Date(Date.now() + 1000000)
+  it('returns null for an unknown token', async () => {
+    m.tokensFindFirst.mockResolvedValueOnce(undefined)
+    expect(await svc.processUnsubscribeToken('x')).toBeNull()
+  })
+
+  it('returns null for a used token', async () => {
+    m.tokensFindFirst.mockResolvedValueOnce({ usedAt: new Date() })
+    expect(await svc.processUnsubscribeToken('x')).toBeNull()
+  })
+
+  it('returns null for an expired token', async () => {
+    m.tokensFindFirst.mockResolvedValueOnce({ usedAt: null, expiresAt: new Date(0) })
+    expect(await svc.processUnsubscribeToken('x')).toBeNull()
+  })
+
+  it('returns null when the principal is gone', async () => {
+    m.tokensFindFirst.mockResolvedValueOnce({
+      usedAt: null,
+      expiresAt: future,
+      id: 'tok',
+      principalId: 'p1',
+      postId: null,
+      action: 'unsubscribe_all',
+    })
+    m.principalFindFirst.mockResolvedValueOnce(undefined)
+    expect(await svc.processUnsubscribeToken('x')).toBeNull()
+  })
+
+  it('processes unsubscribe_post with post details', async () => {
+    m.tokensFindFirst.mockResolvedValueOnce({
+      usedAt: null,
+      expiresAt: future,
+      id: 'tok',
+      principalId: 'p1',
+      postId,
+      action: 'unsubscribe_post',
+    })
+    m.principalFindFirst.mockResolvedValueOnce({ id: 'p1' })
+    m.postsFindFirst.mockResolvedValueOnce({ title: 'T', board: { slug: 'b' } })
+    const res = await svc.processUnsubscribeToken('x')
+    expect(res).toMatchObject({ action: 'unsubscribe_post', post: { title: 'T', boardSlug: 'b' } })
+  })
+
+  it('processes unsubscribe_all (no post)', async () => {
+    m.tokensFindFirst.mockResolvedValueOnce({
+      usedAt: null,
+      expiresAt: future,
+      id: 'tok',
+      principalId: 'p1',
+      postId: null,
+      action: 'unsubscribe_all',
+    })
+    m.principalFindFirst.mockResolvedValueOnce({ id: 'p1' })
+    m.prefsFindFirst.mockResolvedValueOnce({ principalId: 'p1' })
+    const res = await svc.processUnsubscribeToken('x')
+    expect(res?.action).toBe('unsubscribe_all')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/subscriptions/subscription.service.ts b/apps/web/src/lib/server/domains/subscriptions/subscription.service.ts
index 06065b4fd..c906635b1 100644
--- a/apps/web/src/lib/server/domains/subscriptions/subscription.service.ts
+++ b/apps/web/src/lib/server/domains/subscriptions/subscription.service.ts
@@ -75,10 +75,7 @@ export async function subscribeToPost(
   reason: SubscriptionReason,
   options?: SubscribeOptions
 ): Promise<void> {
-  log.debug(
-    { post_id: postId, principal_id: principalId, reason },
-    'subscribe to post'
-  )
+  log.debug({ post_id: postId, principal_id: principalId, reason }, 'subscribe to post')
   const executor = options?.tx ?? db
   const level = options?.level ?? 'all'
 
@@ -101,10 +98,7 @@ export async function subscribeToPost(
  * Unsubscribe a member from a post
  */
 export async function unsubscribeFromPost(principalId: PrincipalId, postId: PostId): Promise<void> {
-  log.debug(
-    { post_id: postId, principal_id: principalId },
-    'unsubscribe from post'
-  )
+  log.debug({ post_id: postId, principal_id: principalId }, 'unsubscribe from post')
   await db
     .delete(postSubscriptions)
     .where(
@@ -120,10 +114,7 @@ export async function updateSubscriptionLevel(
   postId: PostId,
   level: SubscriptionLevel
 ): Promise<void> {
-  log.debug(
-    { post_id: postId, principal_id: principalId, level },
-    'update subscription level'
-  )
+  log.debug({ post_id: postId, principal_id: principalId, level }, 'update subscription level')
   if (level === 'none') {
     await unsubscribeFromPost(principalId, postId)
     return
@@ -157,10 +148,7 @@ export async function getSubscriptionStatus(
   reason: SubscriptionReason | null
   level: SubscriptionLevel
 }> {
-  log.debug(
-    { post_id: postId, principal_id: principalId },
-    'get subscription status'
-  )
+  log.debug({ post_id: postId, principal_id: principalId }, 'get subscription status')
   const subscription = await db.query.postSubscriptions.findFirst({
     where: and(
       eq(postSubscriptions.principalId, principalId),
@@ -200,10 +188,7 @@ export async function getSubscribersForEvent(
   postId: PostId,
   eventType: NotificationEventType
 ): Promise<Subscriber[]> {
-  log.debug(
-    { post_id: postId, event_type: eventType },
-    'get subscribers for event'
-  )
+  log.debug({ post_id: postId, event_type: eventType }, 'get subscribers for event')
   // Determine which column to filter by
   const notifyColumn =
     eventType === 'comment'
@@ -288,6 +273,13 @@ export async function getNotificationPreferences(
       emailStatusChange: prefs.emailStatusChange,
       emailNewComment: prefs.emailNewComment,
       emailMuted: prefs.emailMuted,
+      emailTicketThreads: prefs.emailTicketThreads,
+      emailTicketProperties: prefs.emailTicketProperties,
+      emailTicketStatus: prefs.emailTicketStatus,
+      emailTicketAssignment: prefs.emailTicketAssignment,
+      emailTicketParticipants: prefs.emailTicketParticipants,
+      emailTicketShares: prefs.emailTicketShares,
+      emailTicketSla: prefs.emailTicketSla,
     }
   }
 
@@ -296,6 +288,13 @@ export async function getNotificationPreferences(
     emailStatusChange: true,
     emailNewComment: true,
     emailMuted: false,
+    emailTicketThreads: true,
+    emailTicketProperties: true,
+    emailTicketStatus: true,
+    emailTicketAssignment: true,
+    emailTicketParticipants: false,
+    emailTicketShares: false,
+    emailTicketSla: true,
   }
 }
 
@@ -303,6 +302,13 @@ const DEFAULT_NOTIFICATION_PREFS: NotificationPreferencesData = {
   emailStatusChange: true,
   emailNewComment: true,
   emailMuted: false,
+  emailTicketThreads: true,
+  emailTicketProperties: true,
+  emailTicketStatus: true,
+  emailTicketAssignment: true,
+  emailTicketParticipants: false,
+  emailTicketShares: false,
+  emailTicketSla: true,
 }
 
 /**
@@ -312,10 +318,7 @@ const DEFAULT_NOTIFICATION_PREFS: NotificationPreferencesData = {
 export async function batchGetNotificationPreferences(
   principalIds: PrincipalId[]
 ): Promise<Map<PrincipalId, NotificationPreferencesData>> {
-  log.debug(
-    { count: principalIds.length },
-    'batch get notification preferences'
-  )
+  log.debug({ count: principalIds.length }, 'batch get notification preferences')
   if (principalIds.length === 0) return new Map()
 
   const rows = await db
@@ -324,6 +327,13 @@ export async function batchGetNotificationPreferences(
       emailStatusChange: notificationPreferences.emailStatusChange,
       emailNewComment: notificationPreferences.emailNewComment,
       emailMuted: notificationPreferences.emailMuted,
+      emailTicketThreads: notificationPreferences.emailTicketThreads,
+      emailTicketProperties: notificationPreferences.emailTicketProperties,
+      emailTicketStatus: notificationPreferences.emailTicketStatus,
+      emailTicketAssignment: notificationPreferences.emailTicketAssignment,
+      emailTicketParticipants: notificationPreferences.emailTicketParticipants,
+      emailTicketShares: notificationPreferences.emailTicketShares,
+      emailTicketSla: notificationPreferences.emailTicketSla,
     })
     .from(notificationPreferences)
     .where(inArray(notificationPreferences.principalId, principalIds))
@@ -336,6 +346,13 @@ export async function batchGetNotificationPreferences(
         emailStatusChange: row.emailStatusChange,
         emailNewComment: row.emailNewComment,
         emailMuted: row.emailMuted,
+        emailTicketThreads: row.emailTicketThreads,
+        emailTicketProperties: row.emailTicketProperties,
+        emailTicketStatus: row.emailTicketStatus,
+        emailTicketAssignment: row.emailTicketAssignment,
+        emailTicketParticipants: row.emailTicketParticipants,
+        emailTicketShares: row.emailTicketShares,
+        emailTicketSla: row.emailTicketSla,
       },
     ])
   )
@@ -375,6 +392,13 @@ export async function updateNotificationPreferences(
       emailStatusChange: updated.emailStatusChange,
       emailNewComment: updated.emailNewComment,
       emailMuted: updated.emailMuted,
+      emailTicketThreads: updated.emailTicketThreads,
+      emailTicketProperties: updated.emailTicketProperties,
+      emailTicketStatus: updated.emailTicketStatus,
+      emailTicketAssignment: updated.emailTicketAssignment,
+      emailTicketParticipants: updated.emailTicketParticipants,
+      emailTicketShares: updated.emailTicketShares,
+      emailTicketSla: updated.emailTicketSla,
     }
   } else {
     const [created] = await db
@@ -384,6 +408,13 @@ export async function updateNotificationPreferences(
         emailStatusChange: preferences.emailStatusChange ?? true,
         emailNewComment: preferences.emailNewComment ?? true,
         emailMuted: preferences.emailMuted ?? false,
+        emailTicketThreads: preferences.emailTicketThreads ?? true,
+        emailTicketProperties: preferences.emailTicketProperties ?? true,
+        emailTicketStatus: preferences.emailTicketStatus ?? true,
+        emailTicketAssignment: preferences.emailTicketAssignment ?? true,
+        emailTicketParticipants: preferences.emailTicketParticipants ?? false,
+        emailTicketShares: preferences.emailTicketShares ?? false,
+        emailTicketSla: preferences.emailTicketSla ?? true,
       })
       .returning()
 
@@ -391,6 +422,13 @@ export async function updateNotificationPreferences(
       emailStatusChange: created.emailStatusChange,
       emailNewComment: created.emailNewComment,
       emailMuted: created.emailMuted,
+      emailTicketThreads: created.emailTicketThreads,
+      emailTicketProperties: created.emailTicketProperties,
+      emailTicketStatus: created.emailTicketStatus,
+      emailTicketAssignment: created.emailTicketAssignment,
+      emailTicketParticipants: created.emailTicketParticipants,
+      emailTicketShares: created.emailTicketShares,
+      emailTicketSla: created.emailTicketSla,
     }
   }
 }
@@ -403,10 +441,7 @@ export async function generateUnsubscribeToken(
   postId: PostId | null,
   action: 'unsubscribe_post' | 'unsubscribe_all'
 ): Promise<string> {
-  log.debug(
-    { principal_id: principalId, post_id: postId, action },
-    'generate unsubscribe token'
-  )
+  log.debug({ principal_id: principalId, post_id: postId, action }, 'generate unsubscribe token')
   const token = randomUUID()
   const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) // 30 days
 
diff --git a/apps/web/src/lib/server/domains/subscriptions/subscription.types.ts b/apps/web/src/lib/server/domains/subscriptions/subscription.types.ts
index 685248265..d610b5e56 100644
--- a/apps/web/src/lib/server/domains/subscriptions/subscription.types.ts
+++ b/apps/web/src/lib/server/domains/subscriptions/subscription.types.ts
@@ -51,4 +51,11 @@ export interface NotificationPreferencesData {
   emailStatusChange: boolean
   emailNewComment: boolean
   emailMuted: boolean
+  emailTicketThreads: boolean
+  emailTicketProperties: boolean
+  emailTicketStatus: boolean
+  emailTicketAssignment: boolean
+  emailTicketParticipants: boolean
+  emailTicketShares: boolean
+  emailTicketSla: boolean
 }
diff --git a/apps/web/src/lib/server/domains/teams/__tests__/team.service.diffcov.test.ts b/apps/web/src/lib/server/domains/teams/__tests__/team.service.diffcov.test.ts
new file mode 100644
index 000000000..bed9fb322
--- /dev/null
+++ b/apps/web/src/lib/server/domains/teams/__tests__/team.service.diffcov.test.ts
@@ -0,0 +1,195 @@
+/**
+ * Differential-coverage tests for team.service — create/update/archive with
+ * validation + dup + changed-field diffing, event dispatch (actor + kind +
+ * failure), membership upsert (idempotent / role change / insert), and the
+ * list helpers.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  teamsFindFirst: vi.fn(),
+  teamsFindMany: vi.fn(),
+  membersFindFirst: vi.fn(),
+  membersFindMany: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  deleteWhere: vi.fn(),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({ type: 'principal', displayName: 'team-system' })),
+  dCreated: vi.fn(),
+  dUpdated: vi.fn(),
+  dArchived: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      teams: { findFirst: m.teamsFindFirst, findMany: m.teamsFindMany },
+      teamMemberships: { findFirst: m.membersFindFirst, findMany: m.membersFindMany },
+    },
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({ set: () => ({ where: () => ({ returning: m.updateReturning }) }) }),
+    delete: () => ({ where: (...a: unknown[]) => m.deleteWhere(...a) }),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  asc: vi.fn(),
+  teams: { id: 't.id', slug: 't.slug', name: 't.name', archivedAt: 't.archivedAt' },
+  teamMemberships: { id: 'tm.id', teamId: 'tm.teamId', principalId: 'tm.principalId' },
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchTeamCreated: (...a: unknown[]) => m.dCreated(...a),
+  dispatchTeamUpdated: (...a: unknown[]) => m.dUpdated(...a),
+  dispatchTeamArchived: (...a: unknown[]) => m.dArchived(...a),
+}))
+
+import * as svc from '../team.service'
+
+const withP = { principalId: 'p1' as never, userId: 'u1' as never }
+const svcActor = { principalId: null }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.teamsFindFirst.mockResolvedValue(undefined)
+  m.teamsFindMany.mockResolvedValue([{ id: 'team_1' }])
+  m.membersFindFirst.mockResolvedValue(undefined)
+  m.membersFindMany.mockResolvedValue([{ teamId: 'team_1' }])
+  m.insertReturning.mockResolvedValue([{ id: 'team_1', name: 'Eng' }])
+  m.updateReturning.mockResolvedValue([{ id: 'team_1', name: 'Eng' }])
+  m.deleteWhere.mockResolvedValue(undefined)
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('createTeam', () => {
+  it('requires a name', async () => {
+    await expect(svc.createTeam({ slug: 'eng', name: ' ' }, svcActor)).rejects.toThrow(
+      'name is required'
+    )
+  })
+  it('rejects an invalid slug', async () => {
+    await expect(svc.createTeam({ slug: 'Bad Slug', name: 'X' }, svcActor)).rejects.toThrow(
+      'slug must be'
+    )
+  })
+  it('rejects a duplicate slug', async () => {
+    m.teamsFindFirst.mockResolvedValueOnce({ id: 'dup' })
+    await expect(svc.createTeam({ slug: 'eng', name: 'X' }, svcActor)).rejects.toThrow(
+      'already exists'
+    )
+  })
+  it('creates and fires created with a principal actor', async () => {
+    const t = await svc.createTeam({ slug: 'eng', name: ' Eng ', description: 'd' }, withP)
+    expect(t).toEqual({ id: 'team_1', name: 'Eng' })
+    expect(m.buildEventActor).toHaveBeenCalled()
+    expect(m.dCreated).toHaveBeenCalled()
+  })
+})
+
+describe('updateTeam', () => {
+  it('throws when missing', async () => {
+    m.teamsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.updateTeam('t1' as never, { name: 'x' }, svcActor)).rejects.toThrow(
+      'not found'
+    )
+  })
+  it('diffs all changed fields and fires updated (service actor)', async () => {
+    m.teamsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      name: 'Old',
+      description: null,
+      shortLabel: null,
+      color: null,
+    })
+    m.updateReturning.mockResolvedValueOnce([{ id: 't1', name: 'New' }])
+    await svc.updateTeam(
+      't1' as never,
+      { name: 'New', description: 'd', shortLabel: 's', color: '#fff' },
+      svcActor
+    )
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+    expect(m.dUpdated).toHaveBeenCalled()
+  })
+  it('fires with no changes when input matches existing', async () => {
+    m.teamsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      name: 'Same',
+      description: 'd',
+      shortLabel: 's',
+      color: 'c',
+    })
+    m.updateReturning.mockResolvedValueOnce([{ id: 't1', name: 'Same' }])
+    await svc.updateTeam('t1' as never, {}, svcActor)
+    expect(m.dUpdated).toHaveBeenCalled()
+  })
+})
+
+describe('archive / unarchive', () => {
+  it('archive fires when a row returns, not when empty', async () => {
+    await svc.archiveTeam('t1' as never, withP)
+    expect(m.dArchived).toHaveBeenCalled()
+    m.updateReturning.mockResolvedValueOnce([])
+    await svc.archiveTeam('t1' as never, withP)
+    expect(m.dArchived).toHaveBeenCalledTimes(1)
+  })
+  it('unarchive fires updated with archivedAt, not when empty', async () => {
+    await svc.unarchiveTeam('t1' as never, withP)
+    expect(m.dUpdated).toHaveBeenCalledWith(expect.anything(), expect.anything(), ['archivedAt'])
+    m.updateReturning.mockResolvedValueOnce([])
+    await svc.unarchiveTeam('t1' as never, withP)
+    expect(m.dUpdated).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('getters', () => {
+  it('getTeam returns null when missing', async () => {
+    expect(await svc.getTeam('t1' as never)).toBeNull()
+  })
+  it('listTeams with and without archived', async () => {
+    expect(await svc.listTeams()).toEqual([{ id: 'team_1' }])
+    expect(await svc.listTeams({ includeArchived: true })).toEqual([{ id: 'team_1' }])
+  })
+})
+
+describe('memberships', () => {
+  it('addMember: idempotent when role matches', async () => {
+    m.membersFindFirst.mockResolvedValueOnce({ id: 'mem_1', role: 'member' })
+    expect(await svc.addMember('t1' as never, 'p1' as never, 'member')).toEqual({
+      id: 'mem_1',
+      role: 'member',
+    })
+    expect(m.insertReturning).not.toHaveBeenCalled()
+  })
+  it('addMember: updates the role when it differs', async () => {
+    m.membersFindFirst.mockResolvedValueOnce({ id: 'mem_1', role: 'member' })
+    m.updateReturning.mockResolvedValueOnce([{ id: 'mem_1', role: 'lead' }])
+    expect(await svc.addMember('t1' as never, 'p1' as never, 'lead')).toEqual({
+      id: 'mem_1',
+      role: 'lead',
+    })
+  })
+  it('addMember: inserts a new membership', async () => {
+    m.insertReturning.mockResolvedValueOnce([{ id: 'mem_new', role: 'member' }])
+    expect(await svc.addMember('t1' as never, 'p1' as never)).toEqual({
+      id: 'mem_new',
+      role: 'member',
+    })
+  })
+  it('removeMember, listMembers, listTeamsForPrincipal', async () => {
+    await svc.removeMember('t1' as never, 'p1' as never)
+    expect(m.deleteWhere).toHaveBeenCalled()
+    m.membersFindMany.mockResolvedValueOnce([{ id: 'mem_1' }])
+    expect(await svc.listMembers('t1' as never)).toEqual([{ id: 'mem_1' }])
+    m.membersFindMany.mockResolvedValueOnce([{ teamId: 'team_1' }, { teamId: 'team_2' }])
+    expect(await svc.listTeamsForPrincipal('p1' as never)).toEqual(['team_1', 'team_2'])
+  })
+})
+
+describe('fireTeamEvent failure', () => {
+  it('swallows dispatch errors', async () => {
+    m.dCreated.mockRejectedValueOnce(new Error('boom'))
+    await svc.createTeam({ slug: 'eng', name: 'Eng' }, svcActor)
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/teams/__tests__/team.service.events.test.ts b/apps/web/src/lib/server/domains/teams/__tests__/team.service.events.test.ts
new file mode 100644
index 000000000..21c05290a
--- /dev/null
+++ b/apps/web/src/lib/server/domains/teams/__tests__/team.service.events.test.ts
@@ -0,0 +1,181 @@
+/**
+ * Phase 6: webhook dispatch from team CRUD.
+ *
+ * Verifies that `createTeam`, `updateTeam`, `archiveTeam`, and `unarchiveTeam`
+ * fire the matching configuration-plane dispatchers, that `team.updated`
+ * carries the changed field list (with `unarchiveTeam` reporting
+ * `['archivedAt']`), and that no `team.unarchived` event exists (per design).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const teamFindFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+const updateReturningMock = vi.fn()
+
+const dispatchTeamCreatedMock = vi.fn()
+const dispatchTeamUpdatedMock = vi.fn()
+const dispatchTeamArchivedMock = vi.fn()
+const buildEventActorMock = vi.fn((input: { principalId: string; userId?: string }) => ({
+  type: 'user' as const,
+  principalId: input.principalId,
+  userId: input.userId,
+  displayName: 'team-system',
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      teams: { findFirst: teamFindFirstMock, findMany: vi.fn() },
+    },
+    insert: vi.fn(() => ({
+      values: vi.fn().mockReturnThis(),
+      returning: insertReturningMock,
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn().mockReturnThis(),
+      where: vi.fn().mockReturnThis(),
+      returning: updateReturningMock,
+    })),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  isNotNull: vi.fn(),
+  inArray: vi.fn(),
+  asc: vi.fn(),
+  teams: { _name: 'teams', id: 'id', slug: 'slug' },
+  teamMemberships: { _name: 'team_memberships' },
+}))
+
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E }
+})
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchTeamCreated: (...a: unknown[]) => dispatchTeamCreatedMock(...a),
+  dispatchTeamUpdated: (...a: unknown[]) => dispatchTeamUpdatedMock(...a),
+  dispatchTeamArchived: (...a: unknown[]) => dispatchTeamArchivedMock(...a),
+  buildEventActor: (...a: unknown[]) =>
+    buildEventActorMock(...(a as [{ principalId: string; userId?: string }])),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+const ACTOR = { principalId: 'principal_a' as never, userId: 'user_a' as never }
+
+const SAMPLE_TEAM = {
+  id: 'team_1',
+  slug: 'support',
+  name: 'Support',
+  description: null,
+  shortLabel: null,
+  color: null,
+  archivedAt: null,
+  createdAt: new Date('2025-01-01T00:00:00Z'),
+  updatedAt: new Date('2025-01-01T00:00:00Z'),
+}
+
+describe('team.service events (Phase 6)', () => {
+  it('dispatches team.created on create', async () => {
+    teamFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_TEAM])
+
+    const { createTeam } = await import('../team.service')
+    await createTeam({ slug: 'support', name: 'Support' }, ACTOR)
+
+    expect(dispatchTeamCreatedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchTeamCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'user', principalId: 'principal_a' }),
+      SAMPLE_TEAM
+    )
+  })
+
+  it('dispatches team.updated with computed changedFields', async () => {
+    teamFindFirstMock.mockResolvedValue(SAMPLE_TEAM)
+    const updated = { ...SAMPLE_TEAM, name: 'Renamed', color: '#ff0000' }
+    updateReturningMock.mockResolvedValue([updated])
+
+    const { updateTeam } = await import('../team.service')
+    await updateTeam(
+      'team_1' as never,
+      { name: 'Renamed', color: '#ff0000', shortLabel: null },
+      ACTOR
+    )
+
+    expect(dispatchTeamUpdatedMock).toHaveBeenCalledTimes(1)
+    const [, , changed] = dispatchTeamUpdatedMock.mock.calls[0] as [unknown, unknown, string[]]
+    expect(changed.sort()).toEqual(['color', 'name'])
+  })
+
+  it('dispatches team.updated with empty changedFields when nothing changes', async () => {
+    teamFindFirstMock.mockResolvedValue(SAMPLE_TEAM)
+    updateReturningMock.mockResolvedValue([SAMPLE_TEAM])
+
+    const { updateTeam } = await import('../team.service')
+    await updateTeam('team_1' as never, { name: SAMPLE_TEAM.name }, ACTOR)
+
+    expect(dispatchTeamUpdatedMock).toHaveBeenCalledTimes(1)
+    const [, , changed] = dispatchTeamUpdatedMock.mock.calls[0] as [unknown, unknown, string[]]
+    expect(changed).toEqual([])
+  })
+
+  it('dispatches team.archived on archive', async () => {
+    const archived = { ...SAMPLE_TEAM, archivedAt: new Date('2025-02-01') }
+    updateReturningMock.mockResolvedValue([archived])
+
+    const { archiveTeam } = await import('../team.service')
+    await archiveTeam('team_1' as never, ACTOR)
+
+    expect(dispatchTeamArchivedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchTeamArchivedMock).toHaveBeenCalledWith(expect.any(Object), archived)
+  })
+
+  it('unarchiveTeam dispatches team.updated with archivedAt only', async () => {
+    const restored = { ...SAMPLE_TEAM, archivedAt: null }
+    updateReturningMock.mockResolvedValue([restored])
+
+    const { unarchiveTeam } = await import('../team.service')
+    await unarchiveTeam('team_1' as never, ACTOR)
+
+    expect(dispatchTeamUpdatedMock).toHaveBeenCalledWith(expect.any(Object), restored, [
+      'archivedAt',
+    ])
+    expect(dispatchTeamArchivedMock).not.toHaveBeenCalled()
+  })
+
+  it('uses service actor when principalId is null', async () => {
+    teamFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_TEAM])
+
+    const { createTeam } = await import('../team.service')
+    await createTeam({ slug: 'support', name: 'Support' }, { principalId: null })
+
+    expect(dispatchTeamCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'service', displayName: 'team-system' }),
+      SAMPLE_TEAM
+    )
+  })
+
+  it('swallows dispatcher errors', async () => {
+    teamFindFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_TEAM])
+    dispatchTeamCreatedMock.mockRejectedValueOnce(new Error('hook boom'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const { createTeam } = await import('../team.service')
+    const result = await createTeam({ slug: 'support', name: 'Support' }, ACTOR)
+
+    expect(result).toEqual(SAMPLE_TEAM)
+    expect(warnSpy).toHaveBeenCalled()
+    warnSpy.mockRestore()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/teams/index.ts b/apps/web/src/lib/server/domains/teams/index.ts
new file mode 100644
index 000000000..82242a006
--- /dev/null
+++ b/apps/web/src/lib/server/domains/teams/index.ts
@@ -0,0 +1,15 @@
+export {
+  createTeam,
+  updateTeam,
+  archiveTeam,
+  unarchiveTeam,
+  getTeam,
+  listTeams,
+  addMember,
+  removeMember,
+  listMembers,
+  listTeamsForPrincipal,
+  type CreateTeamInput,
+  type UpdateTeamInput,
+  type TeamRole,
+} from './team.service'
diff --git a/apps/web/src/lib/server/domains/teams/team.service.ts b/apps/web/src/lib/server/domains/teams/team.service.ts
new file mode 100644
index 000000000..d515eb6d4
--- /dev/null
+++ b/apps/web/src/lib/server/domains/teams/team.service.ts
@@ -0,0 +1,209 @@
+/**
+ * Teams domain — CRUD + membership management.
+ *
+ * Permission checks are the caller's responsibility (server functions /
+ * route handlers); this layer is a pure service and does no auth lookups.
+ */
+
+import {
+  db,
+  eq,
+  and,
+  isNull,
+  asc,
+  teams,
+  teamMemberships,
+  type Team,
+  type TeamMembership,
+} from '@/lib/server/db'
+import type { PrincipalId, TeamId, UserId } from '@quackback/ids'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+
+/**
+ * Identity of the operator (or system caller) performing the mutation.
+ * Required so configuration-plane webhook events carry a meaningful actor.
+ */
+export interface TeamActorContext {
+  principalId: PrincipalId | null
+  userId?: UserId | null
+}
+
+async function fireTeamEvent(
+  kind: 'created' | 'updated' | 'archived',
+  actor: TeamActorContext,
+  team: Team,
+  changedFields?: string[]
+): Promise<void> {
+  try {
+    const { buildEventActor, dispatchTeamCreated, dispatchTeamUpdated, dispatchTeamArchived } =
+      await import('@/lib/server/events/dispatch')
+    const eventActor = actor.principalId
+      ? buildEventActor({
+          principalId: actor.principalId,
+          userId: actor.userId ?? undefined,
+          displayName: 'team-system',
+        })
+      : { type: 'service' as const, displayName: 'team-system' }
+    if (kind === 'created') await dispatchTeamCreated(eventActor, team as never)
+    else if (kind === 'updated')
+      await dispatchTeamUpdated(eventActor, team as never, changedFields ?? [])
+    else await dispatchTeamArchived(eventActor, team as never)
+  } catch (err) {
+    console.warn(`[teams] dispatchTeam${kind} failed`, err)
+  }
+}
+
+const SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/
+
+export interface CreateTeamInput {
+  slug: string
+  name: string
+  description?: string | null
+  shortLabel?: string | null
+  color?: string | null
+}
+
+export async function createTeam(input: CreateTeamInput, actor: TeamActorContext): Promise<Team> {
+  if (!input.name?.trim()) {
+    throw new ValidationError('TEAM_NAME_REQUIRED', 'Team name is required')
+  }
+  if (!SLUG_RE.test(input.slug)) {
+    throw new ValidationError(
+      'TEAM_SLUG_INVALID',
+      'Team slug must be lowercase alphanumeric/dashes (1–64 chars)'
+    )
+  }
+  const existing = await db.query.teams.findFirst({ where: eq(teams.slug, input.slug) })
+  if (existing) {
+    throw new ConflictError('TEAM_SLUG_TAKEN', `Team with slug "${input.slug}" already exists`)
+  }
+  const [created] = await db
+    .insert(teams)
+    .values({
+      slug: input.slug,
+      name: input.name.trim(),
+      description: input.description ?? null,
+      shortLabel: input.shortLabel ?? null,
+      color: input.color ?? null,
+    })
+    .returning()
+  await fireTeamEvent('created', actor, created)
+  return created
+}
+
+export interface UpdateTeamInput {
+  name?: string
+  description?: string | null
+  shortLabel?: string | null
+  color?: string | null
+}
+
+export async function updateTeam(
+  teamId: TeamId,
+  input: UpdateTeamInput,
+  actor: TeamActorContext
+): Promise<Team> {
+  const team = await db.query.teams.findFirst({ where: eq(teams.id, teamId) })
+  if (!team) throw new NotFoundError('TEAM_NOT_FOUND', `Team ${teamId} not found`)
+  const changedFields: string[] = []
+  const nextName = input.name?.trim() ?? team.name
+  if (nextName !== team.name) changedFields.push('name')
+  const nextDescription = input.description !== undefined ? input.description : team.description
+  if (input.description !== undefined && nextDescription !== team.description)
+    changedFields.push('description')
+  const nextShortLabel = input.shortLabel !== undefined ? input.shortLabel : team.shortLabel
+  if (input.shortLabel !== undefined && nextShortLabel !== team.shortLabel)
+    changedFields.push('shortLabel')
+  const nextColor = input.color !== undefined ? input.color : team.color
+  if (input.color !== undefined && nextColor !== team.color) changedFields.push('color')
+  const [updated] = await db
+    .update(teams)
+    .set({
+      name: nextName,
+      description: nextDescription,
+      shortLabel: nextShortLabel,
+      color: nextColor,
+    })
+    .where(eq(teams.id, teamId))
+    .returning()
+  await fireTeamEvent('updated', actor, updated, changedFields)
+  return updated
+}
+
+export async function archiveTeam(teamId: TeamId, actor: TeamActorContext): Promise<void> {
+  const [updated] = await db
+    .update(teams)
+    .set({ archivedAt: new Date() })
+    .where(eq(teams.id, teamId))
+    .returning()
+  if (updated) await fireTeamEvent('archived', actor, updated)
+}
+
+export async function unarchiveTeam(teamId: TeamId, actor: TeamActorContext): Promise<void> {
+  const [updated] = await db
+    .update(teams)
+    .set({ archivedAt: null })
+    .where(eq(teams.id, teamId))
+    .returning()
+  if (updated) await fireTeamEvent('updated', actor, updated, ['archivedAt'])
+}
+
+export async function getTeam(teamId: TeamId): Promise<Team | null> {
+  const team = await db.query.teams.findFirst({ where: eq(teams.id, teamId) })
+  return team ?? null
+}
+
+export async function listTeams(opts: { includeArchived?: boolean } = {}): Promise<Team[]> {
+  return db.query.teams.findMany({
+    where: opts.includeArchived ? undefined : isNull(teams.archivedAt),
+    orderBy: [asc(teams.name)],
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Memberships
+// ---------------------------------------------------------------------------
+
+export type TeamRole = 'lead' | 'member'
+
+export async function addMember(
+  teamId: TeamId,
+  principalId: PrincipalId,
+  role: TeamRole = 'member'
+): Promise<TeamMembership> {
+  const existing = await db.query.teamMemberships.findFirst({
+    where: and(eq(teamMemberships.teamId, teamId), eq(teamMemberships.principalId, principalId)),
+  })
+  if (existing) {
+    if (existing.role === role) return existing
+    const [updated] = await db
+      .update(teamMemberships)
+      .set({ role })
+      .where(eq(teamMemberships.id, existing.id))
+      .returning()
+    return updated
+  }
+  const [created] = await db
+    .insert(teamMemberships)
+    .values({ teamId, principalId, role })
+    .returning()
+  return created
+}
+
+export async function removeMember(teamId: TeamId, principalId: PrincipalId): Promise<void> {
+  await db
+    .delete(teamMemberships)
+    .where(and(eq(teamMemberships.teamId, teamId), eq(teamMemberships.principalId, principalId)))
+}
+
+export async function listMembers(teamId: TeamId): Promise<TeamMembership[]> {
+  return db.query.teamMemberships.findMany({ where: eq(teamMemberships.teamId, teamId) })
+}
+
+export async function listTeamsForPrincipal(principalId: PrincipalId): Promise<TeamId[]> {
+  const rows = await db.query.teamMemberships.findMany({
+    where: eq(teamMemberships.principalId, principalId),
+    columns: { teamId: true },
+  })
+  return rows.map((r) => r.teamId as TeamId)
+}
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket-statuses.service.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket-statuses.service.diffcov.test.ts
new file mode 100644
index 000000000..18d8a5989
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket-statuses.service.diffcov.test.ts
@@ -0,0 +1,181 @@
+/**
+ * Differential-coverage tests for ticket-statuses.service — list/get/default,
+ * create/update/archive with validation (name/slug/category), single-default
+ * enforcement, no-op update, system-status guard, and event dispatch.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  findFirst: vi.fn(),
+  selectOrderBy: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({
+    type: 'principal',
+    displayName: 'ticket-status-system',
+  })),
+  dCreated: vi.fn(),
+  dUpdated: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: { ticketStatuses: { findFirst: m.findFirst } },
+    select: () => ({ from: () => ({ where: () => ({ orderBy: () => m.selectOrderBy() }) }) }),
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({
+      set: () => ({
+        where: () => ({
+          returning: m.updateReturning,
+          then: (r: (v: unknown) => void) => r(undefined),
+        }),
+      }),
+    }),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  asc: vi.fn(),
+  ticketStatuses: {
+    id: 'ts.id',
+    slug: 'ts.slug',
+    isDefault: 'ts.isDefault',
+    deletedAt: 'ts.deletedAt',
+    position: 'ts.position',
+    name: 'ts.name',
+  },
+  TICKET_STATUS_CATEGORIES: ['open', 'pending', 'on_hold', 'solved', 'closed'],
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchTicketStatusCreated: (...a: unknown[]) => m.dCreated(...a),
+  dispatchTicketStatusUpdated: (...a: unknown[]) => m.dUpdated(...a),
+}))
+
+import * as svc from '../ticket-statuses.service'
+
+const withP = { principalId: 'p1' as never, userId: 'u1' as never }
+const svcActor = { principalId: null }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.findFirst.mockResolvedValue(undefined)
+  m.selectOrderBy.mockResolvedValue([{ id: 'st_1' }])
+  m.insertReturning.mockResolvedValue([{ id: 'st_1', name: 'Open' }])
+  m.updateReturning.mockResolvedValue([{ id: 'st_1', name: 'Open' }])
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('list / get / default', () => {
+  it('listTicketStatuses with and without deleted', async () => {
+    expect(await svc.listTicketStatuses()).toEqual([{ id: 'st_1' }])
+    expect(await svc.listTicketStatuses({ includeDeleted: true })).toEqual([{ id: 'st_1' }])
+  })
+  it('getTicketStatus returns null when missing', async () => {
+    expect(await svc.getTicketStatus('st_1' as never)).toBeNull()
+  })
+  it('getDefaultTicketStatus returns the default or null', async () => {
+    m.findFirst.mockResolvedValueOnce({ id: 'st_default' })
+    expect(await svc.getDefaultTicketStatus()).toEqual({ id: 'st_default' })
+    expect(await svc.getDefaultTicketStatus()).toBeNull()
+  })
+})
+
+describe('createTicketStatus', () => {
+  it('requires a name', async () => {
+    await expect(
+      svc.createTicketStatus({ name: ' ', slug: 'open', category: 'open' } as never, svcActor)
+    ).rejects.toThrow('name is required')
+  })
+  it('rejects an invalid slug', async () => {
+    await expect(
+      svc.createTicketStatus({ name: 'N', slug: 'Bad Slug', category: 'open' } as never, svcActor)
+    ).rejects.toThrow('slug must match')
+  })
+  it('rejects an invalid category', async () => {
+    await expect(
+      svc.createTicketStatus({ name: 'N', slug: 'open', category: 'bogus' } as never, svcActor)
+    ).rejects.toThrow('invalid category')
+  })
+  it('rejects a duplicate slug', async () => {
+    m.findFirst.mockResolvedValueOnce({ id: 'dup' })
+    await expect(
+      svc.createTicketStatus({ name: 'N', slug: 'open', category: 'open' } as never, svcActor)
+    ).rejects.toThrow('already exists')
+  })
+  it('creates as default (resets others) and fires created with principal actor', async () => {
+    const row = await svc.createTicketStatus(
+      { name: ' Open ', slug: 'OPEN', category: 'open', isDefault: true } as never,
+      withP
+    )
+    expect(row).toEqual({ id: 'st_1', name: 'Open' })
+    expect(m.buildEventActor).toHaveBeenCalled()
+    expect(m.dCreated).toHaveBeenCalled()
+  })
+  it('creates with defaults and a service actor', async () => {
+    await svc.createTicketStatus(
+      { name: 'N', slug: 'pending', category: 'pending' } as never,
+      svcActor
+    )
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+  })
+})
+
+describe('updateTicketStatus', () => {
+  it('throws when missing', async () => {
+    m.findFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.updateTicketStatus('st_1' as never, { name: 'x' }, svcActor)).rejects.toThrow(
+      'not found'
+    )
+  })
+  it('rejects an invalid category', async () => {
+    m.findFirst.mockResolvedValueOnce({ id: 'st_1' })
+    await expect(
+      svc.updateTicketStatus('st_1' as never, { category: 'bogus' as never }, svcActor)
+    ).rejects.toThrow('invalid category')
+  })
+  it('returns existing unchanged when patch is empty', async () => {
+    m.findFirst.mockResolvedValueOnce({ id: 'st_1', name: 'keep' })
+    expect(await svc.updateTicketStatus('st_1' as never, {}, svcActor)).toEqual({
+      id: 'st_1',
+      name: 'keep',
+    })
+    expect(m.updateReturning).not.toHaveBeenCalled()
+  })
+  it('applies all fields, resets default, and fires updated', async () => {
+    m.findFirst.mockResolvedValueOnce({ id: 'st_1' })
+    await svc.updateTicketStatus(
+      'st_1' as never,
+      { name: ' New ', color: '#fff', category: 'solved', position: 2, isDefault: true },
+      withP
+    )
+    expect(m.dUpdated).toHaveBeenCalled()
+  })
+})
+
+describe('archiveTicketStatus', () => {
+  it('throws when missing', async () => {
+    m.findFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.archiveTicketStatus('st_1' as never, svcActor)).rejects.toThrow('not found')
+  })
+  it('refuses to archive a system status', async () => {
+    m.findFirst.mockResolvedValueOnce({ id: 'st_1', isSystem: true })
+    await expect(svc.archiveTicketStatus('st_1' as never, svcActor)).rejects.toThrow(
+      'system statuses'
+    )
+  })
+  it('archives and fires updated with deletedAt', async () => {
+    m.findFirst.mockResolvedValueOnce({ id: 'st_1', isSystem: false })
+    await svc.archiveTicketStatus('st_1' as never, withP)
+    expect(m.dUpdated).toHaveBeenCalledWith(expect.anything(), expect.anything(), ['deletedAt'])
+  })
+})
+
+describe('fireStatusEvent failure', () => {
+  it('swallows dispatch errors', async () => {
+    m.dCreated.mockRejectedValueOnce(new Error('boom'))
+    await svc.createTicketStatus({ name: 'N', slug: 'open', category: 'open' } as never, svcActor)
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket-statuses.service.events.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket-statuses.service.events.test.ts
new file mode 100644
index 000000000..10bd2ae1c
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket-statuses.service.events.test.ts
@@ -0,0 +1,179 @@
+/**
+ * Phase 6: webhook dispatch from ticket-status CRUD.
+ *
+ * Verifies that `createTicketStatus`, `updateTicketStatus`, and
+ * `archiveTicketStatus` fire the matching configuration-plane dispatchers,
+ * that no-op updates skip dispatch, and that archive maps to
+ * `ticket_status.updated` with `changedFields: ['deletedAt']` (per design —
+ * there is no separate `ticket_status.archived` event).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const findFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+const updateReturningMock = vi.fn()
+const updateWhereMock = vi.fn().mockReturnThis()
+
+const dispatchTicketStatusCreatedMock = vi.fn()
+const dispatchTicketStatusUpdatedMock = vi.fn()
+const buildEventActorMock = vi.fn((input: { principalId: string; userId?: string }) => ({
+  type: 'user' as const,
+  principalId: input.principalId,
+  userId: input.userId,
+  displayName: 'ticket-status-system',
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketStatuses: { findFirst: findFirstMock },
+    },
+    insert: vi.fn(() => ({
+      values: vi.fn().mockReturnThis(),
+      returning: insertReturningMock,
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn().mockReturnThis(),
+      where: updateWhereMock,
+      returning: updateReturningMock,
+    })),
+    select: vi.fn(),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  asc: vi.fn(),
+  ticketStatuses: {
+    _name: 'ticket_statuses',
+    id: 'id',
+    slug: 'slug',
+    isDefault: 'isDefault',
+    deletedAt: 'deletedAt',
+  },
+  TICKET_STATUS_CATEGORIES: ['open', 'pending', 'on_hold', 'solved', 'closed'],
+}))
+
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E }
+})
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchTicketStatusCreated: (...a: unknown[]) => dispatchTicketStatusCreatedMock(...a),
+  dispatchTicketStatusUpdated: (...a: unknown[]) => dispatchTicketStatusUpdatedMock(...a),
+  buildEventActor: (...a: unknown[]) =>
+    buildEventActorMock(...(a as [{ principalId: string; userId?: string }])),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+const ACTOR = { principalId: 'principal_a' as never, userId: 'user_a' as never }
+
+const SAMPLE_STATUS = {
+  id: 'tstatus_1',
+  name: 'Open',
+  slug: 'open',
+  color: '#6b7280',
+  category: 'open',
+  position: 0,
+  isDefault: true,
+  isSystem: false,
+  deletedAt: null,
+  createdAt: new Date('2025-01-01T00:00:00Z'),
+  updatedAt: new Date('2025-01-01T00:00:00Z'),
+}
+
+describe('ticket-statuses.service events (Phase 6)', () => {
+  it('dispatches ticket_status.created on create', async () => {
+    findFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_STATUS])
+
+    const { createTicketStatus } = await import('../ticket-statuses.service')
+    await createTicketStatus({ name: 'Open', slug: 'open', category: 'open' }, ACTOR)
+
+    expect(dispatchTicketStatusCreatedMock).toHaveBeenCalledTimes(1)
+    expect(dispatchTicketStatusCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'user', principalId: 'principal_a' }),
+      SAMPLE_STATUS
+    )
+  })
+
+  it('skips ticket_status.updated when patch is empty', async () => {
+    findFirstMock.mockResolvedValue(SAMPLE_STATUS)
+
+    const { updateTicketStatus } = await import('../ticket-statuses.service')
+    const result = await updateTicketStatus('tstatus_1' as never, {}, ACTOR)
+
+    expect(result).toEqual(SAMPLE_STATUS)
+    expect(dispatchTicketStatusUpdatedMock).not.toHaveBeenCalled()
+  })
+
+  it('dispatches ticket_status.updated with changedFields', async () => {
+    findFirstMock.mockResolvedValue(SAMPLE_STATUS)
+    const updated = { ...SAMPLE_STATUS, name: 'Active', color: '#00ff00' }
+    updateReturningMock.mockResolvedValue([updated])
+
+    const { updateTicketStatus } = await import('../ticket-statuses.service')
+    await updateTicketStatus('tstatus_1' as never, { name: 'Active', color: '#00ff00' }, ACTOR)
+
+    expect(dispatchTicketStatusUpdatedMock).toHaveBeenCalledTimes(1)
+    const [, , changed] = dispatchTicketStatusUpdatedMock.mock.calls[0] as [
+      unknown,
+      unknown,
+      string[],
+    ]
+    expect(changed.sort()).toEqual(['color', 'name'])
+  })
+
+  it('archive dispatches ticket_status.updated with deletedAt only', async () => {
+    findFirstMock.mockResolvedValue(SAMPLE_STATUS)
+    const archived = { ...SAMPLE_STATUS, deletedAt: new Date('2025-02-01'), isDefault: false }
+    updateReturningMock.mockResolvedValue([archived])
+
+    const { archiveTicketStatus } = await import('../ticket-statuses.service')
+    await archiveTicketStatus('tstatus_1' as never, ACTOR)
+
+    expect(dispatchTicketStatusUpdatedMock).toHaveBeenCalledWith(expect.any(Object), archived, [
+      'deletedAt',
+    ])
+    expect(dispatchTicketStatusCreatedMock).not.toHaveBeenCalled()
+  })
+
+  it('uses service actor when principalId is null', async () => {
+    findFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_STATUS])
+
+    const { createTicketStatus } = await import('../ticket-statuses.service')
+    await createTicketStatus(
+      { name: 'Open', slug: 'open', category: 'open' },
+      { principalId: null }
+    )
+
+    expect(dispatchTicketStatusCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'service', displayName: 'ticket-status-system' }),
+      SAMPLE_STATUS
+    )
+  })
+
+  it('swallows dispatcher errors', async () => {
+    findFirstMock.mockResolvedValue(undefined)
+    insertReturningMock.mockResolvedValue([SAMPLE_STATUS])
+    dispatchTicketStatusCreatedMock.mockRejectedValueOnce(new Error('hook boom'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const { createTicketStatus } = await import('../ticket-statuses.service')
+    const result = await createTicketStatus({ name: 'Open', slug: 'open', category: 'open' }, ACTOR)
+
+    expect(result).toEqual(SAMPLE_STATUS)
+    expect(warnSpy).toHaveBeenCalled()
+    warnSpy.mockRestore()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.activity.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.activity.diffcov.test.ts
new file mode 100644
index 000000000..d4819e331
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.activity.diffcov.test.ts
@@ -0,0 +1,48 @@
+/**
+ * Differential-coverage tests for ticket.activity — listTicketActivity limit
+ * clamping and the optional `before` cursor condition.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({ limit: vi.fn() }))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: () => ({
+      from: () => ({
+        leftJoin: () => ({ where: () => ({ orderBy: () => ({ limit: m.limit }) }) }),
+      }),
+    }),
+  },
+  eq: vi.fn(),
+  and: vi.fn((...a) => ({ and: a })),
+  lt: vi.fn(),
+  desc: vi.fn(),
+  ticketActivity: {
+    id: 'ta.id',
+    ticketId: 'ta.ticketId',
+    principalId: 'ta.principalId',
+    type: 'ta.type',
+    metadata: 'ta.metadata',
+    createdAt: 'ta.createdAt',
+  },
+  principal: { id: 'pr.id', displayName: 'pr.displayName', avatarUrl: 'pr.avatarUrl' },
+}))
+
+import { listTicketActivity } from '../ticket.activity'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.limit.mockResolvedValue([{ id: 'act_1' }])
+})
+
+describe('listTicketActivity', () => {
+  it('lists with default options', async () => {
+    expect(await listTicketActivity('ticket_1' as never)).toEqual([{ id: 'act_1' }])
+  })
+  it('applies the before cursor and clamps the limit', async () => {
+    expect(
+      await listTicketActivity('ticket_1' as never, { before: new Date('2026-01-01'), limit: 9999 })
+    ).toEqual([{ id: 'act_1' }])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.attachments.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.attachments.diffcov.test.ts
new file mode 100644
index 000000000..0487a00fb
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.attachments.diffcov.test.ts
@@ -0,0 +1,197 @@
+/**
+ * Differential-coverage tests for ticket.attachments — attach/list/remove with
+ * the validation matrix, thread-not-found guard, preview truncation,
+ * from-requester detection, actor (principal vs service), event dispatch +
+ * fallback thread-refresh, and the defensive try/catch swallows.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  threadsFindFirst: vi.fn(),
+  attachmentsFindFirst: vi.fn(),
+  ticketsFindFirst: vi.fn(),
+  insertReturning: vi.fn(),
+  deleteWhere: vi.fn(),
+  selectWhere: vi.fn(),
+  recordEvent: vi.fn(),
+  writeActivity: vi.fn(),
+  bumpLastActivity: vi.fn(),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({ type: 'user', principalId: 'p1' })),
+  dAdded: vi.fn(),
+  dRemoved: vi.fn(),
+  dThreadUpdated: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketThreads: { findFirst: m.threadsFindFirst },
+      ticketAttachments: { findFirst: m.attachmentsFindFirst },
+      tickets: { findFirst: m.ticketsFindFirst },
+    },
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    delete: () => ({ where: (...a: unknown[]) => m.deleteWhere(...a) }),
+    select: () => ({ from: () => ({ where: (...a: unknown[]) => m.selectWhere(...a) }) }),
+  },
+  eq: vi.fn(),
+  ticketAttachments: { id: 'ta.id', threadId: 'ta.threadId' },
+  ticketThreads: { id: 'tt.id' },
+  tickets: { id: 't.id' },
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: (...a: unknown[]) => m.recordEvent(...a) }))
+vi.mock('../ticket.service', () => ({
+  writeActivity: (...a: unknown[]) => m.writeActivity(...a),
+  bumpLastActivity: (...a: unknown[]) => m.bumpLastActivity(...a),
+}))
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchTicketAttachmentAdded: (...a: unknown[]) => m.dAdded(...a),
+  dispatchTicketAttachmentRemoved: (...a: unknown[]) => m.dRemoved(...a),
+  dispatchTicketThreadUpdated: (...a: unknown[]) => m.dThreadUpdated(...a),
+}))
+
+import { attachToThread, listForThread, removeAttachment } from '../ticket.attachments'
+
+const validInput = {
+  threadId: 'thread_1' as never,
+  uploadedByPrincipalId: 'p1' as never,
+  filename: 'file.png',
+  mimeType: 'image/png',
+  sizeBytes: 1024,
+  storageKey: 'key/1',
+  publicUrl: 'https://x/f',
+}
+const thread = (over: Record<string, unknown> = {}) => ({
+  id: 'thread_1',
+  ticketId: 'ticket_1',
+  deletedAt: null,
+  audience: 'public',
+  sharedWithTeamId: null,
+  bodyText: 'hi',
+  principalId: 'p1',
+  createdAt: new Date('2026-01-01'),
+  editedAt: null,
+  ...over,
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.threadsFindFirst.mockResolvedValue(thread())
+  m.attachmentsFindFirst.mockResolvedValue(undefined)
+  m.ticketsFindFirst.mockResolvedValue({ id: 'ticket_1', requesterPrincipalId: 'p1' })
+  m.insertReturning.mockResolvedValue([{ id: 'att_1' }])
+  m.deleteWhere.mockResolvedValue(undefined)
+  m.selectWhere.mockResolvedValue([{ id: 'att_1' }])
+  m.dAdded.mockResolvedValue(undefined)
+  m.dRemoved.mockResolvedValue(undefined)
+  m.dThreadUpdated.mockResolvedValue(undefined)
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('attachToThread validation', () => {
+  it('rejects missing/too-long filename', async () => {
+    await expect(attachToThread({ ...validInput, filename: ' ' })).rejects.toThrow(
+      'filename required'
+    )
+    await expect(attachToThread({ ...validInput, filename: 'x'.repeat(257) })).rejects.toThrow(
+      'filename >'
+    )
+  })
+  it('rejects missing mimeType', async () => {
+    await expect(attachToThread({ ...validInput, mimeType: ' ' })).rejects.toThrow(
+      'mimeType required'
+    )
+  })
+  it('rejects invalid and too-large sizeBytes', async () => {
+    await expect(attachToThread({ ...validInput, sizeBytes: 0 })).rejects.toThrow('positive')
+    await expect(attachToThread({ ...validInput, sizeBytes: Number.NaN })).rejects.toThrow(
+      'positive'
+    )
+    await expect(attachToThread({ ...validInput, sizeBytes: 999 * 1024 * 1024 })).rejects.toThrow(
+      'exceeds'
+    )
+  })
+  it('rejects missing storageKey', async () => {
+    await expect(attachToThread({ ...validInput, storageKey: ' ' })).rejects.toThrow(
+      'storageKey required'
+    )
+  })
+  it('rejects a missing or deleted thread', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(attachToThread(validInput)).rejects.toThrow('not found')
+    m.threadsFindFirst.mockResolvedValueOnce(thread({ deletedAt: new Date() }))
+    await expect(attachToThread(validInput)).rejects.toThrow('not found')
+  })
+})
+
+describe('attachToThread success', () => {
+  it('attaches with a principal actor, long preview, from-requester, and dispatches', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(
+      thread({ bodyText: 'x'.repeat(600), principalId: 'p1' })
+    )
+    const created = await attachToThread(validInput)
+    expect(created).toEqual({ id: 'att_1' })
+    expect(m.buildEventActor).toHaveBeenCalled()
+    expect(m.dAdded).toHaveBeenCalled()
+    expect(m.dThreadUpdated).toHaveBeenCalled()
+  })
+  it('attaches with a service actor (null principal) and a missing ticket ref', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(thread({ principalId: null, bodyText: null }))
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined) // loadTicketEventRef fallback {id}
+    await attachToThread({ ...validInput, uploadedByPrincipalId: null, publicUrl: null })
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+  })
+  it('swallows dispatch and fallback failures', async () => {
+    m.dAdded.mockRejectedValueOnce(new Error('boom'))
+    m.dThreadUpdated.mockRejectedValueOnce(new Error('boom2'))
+    const created = await attachToThread(validInput)
+    expect(created).toEqual({ id: 'att_1' })
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
+
+describe('listForThread', () => {
+  it('returns the rows for a thread', async () => {
+    expect(await listForThread('thread_1' as never)).toEqual([{ id: 'att_1' }])
+  })
+})
+
+describe('removeAttachment', () => {
+  it('throws when the attachment is missing', async () => {
+    m.attachmentsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(removeAttachment('att_x' as never, null)).rejects.toThrow('not found')
+  })
+  it('removes and dispatches when the thread still exists', async () => {
+    m.attachmentsFindFirst.mockResolvedValueOnce({
+      id: 'att_1',
+      threadId: 'thread_1',
+      filename: 'f.png',
+    })
+    m.threadsFindFirst.mockResolvedValueOnce(thread())
+    await removeAttachment('att_1' as never, 'p1' as never)
+    expect(m.deleteWhere).toHaveBeenCalled()
+    expect(m.dRemoved).toHaveBeenCalled()
+  })
+  it('removes but skips dispatch when the thread is gone (service actor)', async () => {
+    m.attachmentsFindFirst.mockResolvedValueOnce({
+      id: 'att_1',
+      threadId: 'thread_1',
+      filename: 'f.png',
+    })
+    m.threadsFindFirst.mockResolvedValueOnce(undefined)
+    await removeAttachment('att_1' as never, null)
+    expect(m.dRemoved).not.toHaveBeenCalled()
+  })
+  it('swallows a removal dispatch failure', async () => {
+    m.attachmentsFindFirst.mockResolvedValueOnce({
+      id: 'att_1',
+      threadId: 'thread_1',
+      filename: 'f.png',
+    })
+    m.threadsFindFirst.mockResolvedValueOnce(thread())
+    m.dRemoved.mockRejectedValueOnce(new Error('boom'))
+    await removeAttachment('att_1' as never, 'p1' as never)
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.attachments.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.attachments.test.ts
new file mode 100644
index 000000000..f6d133f93
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.attachments.test.ts
@@ -0,0 +1,200 @@
+/**
+ * Phase 4: webhook dispatch from ticket attachments.
+ *
+ * Verifies that `attachToThread` and `removeAttachment` fire the new
+ * `ticket.attachment_added` / `ticket.attachment_removed` dispatchers, that
+ * the attachment payload carries the expected metadata, and that a failing
+ * dispatcher is swallowed (warn-only) so the attachment write itself stays
+ * the source of truth.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const threadFindFirstMock = vi.fn()
+const attachmentFindFirstMock = vi.fn()
+const ticketFindFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+const deleteWhereMock = vi.fn()
+
+const dispatchTicketAttachmentAddedMock = vi.fn()
+const dispatchTicketAttachmentRemovedMock = vi.fn()
+const dispatchTicketThreadUpdatedMock = vi.fn()
+const buildEventActorMock = vi.fn((input: { principalId: string }) => ({
+  type: 'user' as const,
+  principalId: input.principalId,
+  displayName: 'ticket-system',
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketThreads: { findFirst: threadFindFirstMock },
+      ticketAttachments: { findFirst: attachmentFindFirstMock },
+      tickets: { findFirst: ticketFindFirstMock },
+    },
+    insert: vi.fn(() => ({
+      values: vi.fn().mockReturnThis(),
+      returning: insertReturningMock,
+    })),
+    delete: vi.fn(() => ({ where: deleteWhereMock.mockResolvedValue(undefined) })),
+    select: vi.fn(),
+  },
+  eq: vi.fn(),
+  ticketAttachments: { _name: 'ticket_attachments' },
+  ticketThreads: { _name: 'ticket_threads' },
+  tickets: { _name: 'tickets' },
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: vi.fn() }))
+vi.mock('../ticket.service', () => ({
+  bumpLastActivity: vi.fn(),
+  writeActivity: vi.fn(),
+}))
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E }
+})
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchTicketAttachmentAdded: (...a: unknown[]) => dispatchTicketAttachmentAddedMock(...a),
+  dispatchTicketAttachmentRemoved: (...a: unknown[]) => dispatchTicketAttachmentRemovedMock(...a),
+  dispatchTicketThreadUpdated: (...a: unknown[]) => dispatchTicketThreadUpdatedMock(...a),
+  buildEventActor: (...a: unknown[]) => buildEventActorMock(...(a as [{ principalId: string }])),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  threadFindFirstMock.mockReset()
+  attachmentFindFirstMock.mockReset()
+  ticketFindFirstMock.mockReset()
+  insertReturningMock.mockReset()
+  deleteWhereMock.mockReset()
+  dispatchTicketAttachmentAddedMock.mockReset()
+  dispatchTicketAttachmentRemovedMock.mockReset()
+  dispatchTicketThreadUpdatedMock.mockReset()
+  ticketFindFirstMock.mockResolvedValue({ id: 'ticket_1', inboxId: 'inbox_1' })
+})
+
+const baseInput = {
+  threadId: 'thread_1' as never,
+  uploadedByPrincipalId: 'user_a' as never,
+  filename: 'screenshot.png',
+  mimeType: 'image/png',
+  sizeBytes: 12345,
+  storageKey: 'uploads/abc.png',
+  publicUrl: 'https://cdn.example.test/abc.png',
+}
+
+describe('attachToThread → dispatchTicketAttachmentAdded', () => {
+  it('fires dispatcher with full attachment metadata', async () => {
+    threadFindFirstMock.mockResolvedValueOnce({
+      id: 'thread_1',
+      ticketId: 'ticket_1',
+      deletedAt: null,
+      audience: 'public',
+      sharedWithTeamId: null,
+      bodyText: 'Initial body',
+      principalId: 'user_a',
+      createdAt: new Date('2026-01-01T00:00:00.000Z'),
+      editedAt: null,
+    })
+    insertReturningMock.mockResolvedValueOnce([{ id: 'att_1', threadId: 'thread_1' }])
+    const { attachToThread } = await import('../ticket.attachments')
+    await attachToThread(baseInput)
+    expect(dispatchTicketAttachmentAddedMock).toHaveBeenCalledTimes(1)
+    const [, ticketPayload, payload] = dispatchTicketAttachmentAddedMock.mock.calls[0]
+    expect(ticketPayload).toEqual({ id: 'ticket_1', inboxId: 'inbox_1' })
+    expect(payload).toEqual({
+      id: 'att_1',
+      threadId: 'thread_1',
+      filename: 'screenshot.png',
+      mimeType: 'image/png',
+      sizeBytes: 12345,
+      uploadedByPrincipalId: 'user_a',
+      publicUrl: 'https://cdn.example.test/abc.png',
+    })
+    expect(dispatchTicketThreadUpdatedMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('swallows dispatcher rejection (warn only) and still returns the attachment', async () => {
+    threadFindFirstMock.mockResolvedValueOnce({
+      id: 'thread_1',
+      ticketId: 'ticket_1',
+      deletedAt: null,
+      audience: 'public',
+      sharedWithTeamId: null,
+      bodyText: 'Initial body',
+      principalId: 'user_a',
+      createdAt: new Date('2026-01-01T00:00:00.000Z'),
+      editedAt: null,
+    })
+    insertReturningMock.mockResolvedValueOnce([{ id: 'att_2' }])
+    dispatchTicketAttachmentAddedMock.mockRejectedValueOnce(new Error('boom'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const { attachToThread } = await import('../ticket.attachments')
+    const created = await attachToThread(baseInput)
+    expect(created.id).toBe('att_2')
+    expect(warnSpy).toHaveBeenCalled()
+    expect(dispatchTicketThreadUpdatedMock).toHaveBeenCalledTimes(1)
+    warnSpy.mockRestore()
+  })
+})
+
+describe('removeAttachment → dispatchTicketAttachmentRemoved', () => {
+  it('fires dispatcher with attachment id, threadId, filename and remover principal', async () => {
+    attachmentFindFirstMock.mockResolvedValueOnce({
+      id: 'att_3',
+      threadId: 'thread_1',
+      filename: 'logs.txt',
+    })
+    threadFindFirstMock.mockResolvedValueOnce({
+      id: 'thread_1',
+      ticketId: 'ticket_1',
+      audience: 'public',
+      sharedWithTeamId: null,
+      bodyText: 'Updated body',
+      principalId: 'user_a',
+      createdAt: new Date('2026-01-01T00:00:00.000Z'),
+      editedAt: new Date('2026-01-02T00:00:00.000Z'),
+    })
+    const { removeAttachment } = await import('../ticket.attachments')
+    await removeAttachment('att_3' as never, 'user_b' as never)
+    expect(dispatchTicketAttachmentRemovedMock).toHaveBeenCalledTimes(1)
+    const [, ticketPayload, attachment, removedBy] =
+      dispatchTicketAttachmentRemovedMock.mock.calls[0]
+    expect(ticketPayload).toEqual({ id: 'ticket_1', inboxId: 'inbox_1' })
+    expect(attachment).toEqual({ id: 'att_3', threadId: 'thread_1', filename: 'logs.txt' })
+    expect(removedBy).toBe('user_b')
+    expect(dispatchTicketThreadUpdatedMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('swallows dispatcher rejection on remove (warn only)', async () => {
+    attachmentFindFirstMock.mockResolvedValueOnce({
+      id: 'att_4',
+      threadId: 'thread_1',
+      filename: 'logs.txt',
+    })
+    threadFindFirstMock.mockResolvedValueOnce({
+      id: 'thread_1',
+      ticketId: 'ticket_1',
+      audience: 'public',
+      sharedWithTeamId: null,
+      bodyText: 'Updated body',
+      principalId: 'user_a',
+      createdAt: new Date('2026-01-01T00:00:00.000Z'),
+      editedAt: new Date('2026-01-02T00:00:00.000Z'),
+    })
+    dispatchTicketAttachmentRemovedMock.mockRejectedValueOnce(new Error('boom'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const { removeAttachment } = await import('../ticket.attachments')
+    await expect(removeAttachment('att_4' as never, null)).resolves.toBeUndefined()
+    expect(warnSpy).toHaveBeenCalled()
+    expect(dispatchTicketThreadUpdatedMock).toHaveBeenCalledTimes(1)
+    warnSpy.mockRestore()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.bulk.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.bulk.diffcov.test.ts
new file mode 100644
index 000000000..e7bc86ab2
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.bulk.diffcov.test.ts
@@ -0,0 +1,246 @@
+/**
+ * Differential-coverage tests for ticket.bulk — focuses on bulkAssign,
+ * bulkTransition, and the errReason helper (the not-found / forbidden /
+ * success / error branches that the existing bulkChangeInbox suite leaves
+ * uncovered).
+ *
+ * Mirrors the mocking conventions in ticket.bulk.test.ts: the db chain,
+ * share lookups, the assignTicket/transitionStatus delegates, and the
+ * dispatcher are all mocked.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const selectFromWhereMock = vi.fn()
+
+const assignTicketMock = vi.fn()
+const transitionStatusMock = vi.fn()
+const listSharesForTicketMock = vi.fn()
+const permitMock = vi.fn()
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: vi.fn(() => ({
+      from: vi.fn(() => ({ where: selectFromWhereMock })),
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn().mockReturnThis(),
+      where: vi.fn().mockReturnThis(),
+      returning: vi.fn(),
+    })),
+    insert: vi.fn(),
+    delete: vi.fn(),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  inArray: vi.fn(),
+  tickets: { _name: 'tickets', id: 'tickets.id', updatedAt: 'tickets.updatedAt' },
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: vi.fn() }))
+vi.mock('../', () => ({
+  assignTicket: (...a: unknown[]) => assignTicketMock(...a),
+  transitionStatus: (...a: unknown[]) => transitionStatusMock(...a),
+  toResourceScope: vi.fn(() => ({ primaryTeamId: null })),
+}))
+vi.mock('../ticket.share', () => ({
+  listSharesForTicket: (...a: unknown[]) => listSharesForTicketMock(...a),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  selectFromWhereMock.mockReset()
+  assignTicketMock.mockReset().mockResolvedValue(undefined)
+  transitionStatusMock.mockReset().mockResolvedValue(undefined)
+  listSharesForTicketMock.mockReset().mockResolvedValue([])
+  permitMock.mockReset().mockReturnValue(true)
+})
+
+const row = (id: string) => ({
+  id,
+  updatedAt: new Date('2026-04-01'),
+  primaryTeamId: null,
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  inboxId: null,
+})
+
+describe('bulkAssign', () => {
+  it('handles success, not-found, and error rows in one batch', async () => {
+    // db returns rows for ticket_ok + ticket_err (in that order); ticket_missing
+    // is absent so it resolves to TICKET_NOT_FOUND.
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_ok'), row('ticket_err')])
+    listSharesForTicketMock.mockResolvedValue([])
+    // Rows are processed in order: assignTicket call #1 (ticket_ok) succeeds,
+    // call #2 (ticket_err) throws a coded error -> errReason uses the code.
+    assignTicketMock
+      .mockResolvedValueOnce(undefined)
+      .mockRejectedValueOnce(Object.assign(new Error('boom'), { code: 'CONFLICT' }))
+
+    const { bulkAssign } = await import('../ticket.bulk')
+    const result = await bulkAssign({
+      ticketIds: ['ticket_ok', 'ticket_missing', 'ticket_err'] as never,
+      actorPrincipalId: 'user_a' as never,
+      assigneePrincipalId: 'user_target' as never,
+      assigneeTeamId: null,
+      permit: (() => true) as never,
+    })
+
+    expect(result.succeeded).toEqual([{ ticketId: 'ticket_ok' }])
+    expect(result.failed).toContainEqual({ ticketId: 'ticket_missing', reason: 'TICKET_NOT_FOUND' })
+    expect(result.failed).toContainEqual({ ticketId: 'ticket_err', reason: 'CONFLICT' })
+  })
+
+  it('marks a row FORBIDDEN when permit returns false', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_1')])
+    const { bulkAssign } = await import('../ticket.bulk')
+    const result = await bulkAssign({
+      ticketIds: ['ticket_1'] as never,
+      actorPrincipalId: 'user_a' as never,
+      assigneePrincipalId: null,
+      assigneeTeamId: 'team_x' as never,
+      permit: (() => false) as never,
+    })
+    expect(result.failed).toEqual([{ ticketId: 'ticket_1', reason: 'FORBIDDEN' }])
+    expect(result.succeeded).toEqual([])
+    expect(assignTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns empty result for an empty ticketIds list (loadTicketsForBulk short-circuit)', async () => {
+    const { bulkAssign } = await import('../ticket.bulk')
+    const result = await bulkAssign({
+      ticketIds: [] as never,
+      actorPrincipalId: 'user_a' as never,
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+      permit: (() => true) as never,
+    })
+    expect(result).toEqual({ succeeded: [], failed: [] })
+    // db.select(...).from(...).where was never called because of the length===0 guard.
+    expect(selectFromWhereMock).not.toHaveBeenCalled()
+  })
+
+  it('passes assignment params through and records success', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_1')])
+    const { bulkAssign } = await import('../ticket.bulk')
+    const result = await bulkAssign({
+      ticketIds: ['ticket_1'] as never,
+      actorPrincipalId: 'user_a' as never,
+      assigneePrincipalId: 'user_b' as never,
+      assigneeTeamId: null,
+      permit: (() => true) as never,
+    })
+    expect(result.succeeded).toEqual([{ ticketId: 'ticket_1' }])
+    expect(assignTicketMock).toHaveBeenCalledWith('ticket_1', {
+      expectedUpdatedAt: new Date('2026-04-01'),
+      actorPrincipalId: 'user_a',
+      assigneePrincipalId: 'user_b',
+      assigneeTeamId: null,
+    })
+  })
+})
+
+describe('bulkTransition', () => {
+  it('handles success, not-found, forbidden, and error rows', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_ok'), row('ticket_err')])
+    transitionStatusMock
+      .mockResolvedValueOnce(undefined)
+      .mockRejectedValueOnce(new Error('stale write'))
+
+    const { bulkTransition } = await import('../ticket.bulk')
+    const result = await bulkTransition({
+      ticketIds: ['ticket_ok', 'ticket_missing', 'ticket_err'] as never,
+      actorPrincipalId: 'user_a' as never,
+      statusId: 'status_done' as never,
+      permit: (() => true) as never,
+    })
+
+    expect(result.succeeded).toEqual([{ ticketId: 'ticket_ok' }])
+    expect(result.failed).toContainEqual({ ticketId: 'ticket_missing', reason: 'TICKET_NOT_FOUND' })
+    // Error without a `code` falls back to the Error.message branch of errReason.
+    expect(result.failed).toContainEqual({ ticketId: 'ticket_err', reason: 'stale write' })
+    expect(transitionStatusMock).toHaveBeenCalledWith('ticket_ok', {
+      expectedUpdatedAt: new Date('2026-04-01'),
+      actorPrincipalId: 'user_a',
+      statusId: 'status_done',
+    })
+  })
+
+  it('marks a row FORBIDDEN when permit returns false', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_1')])
+    const { bulkTransition } = await import('../ticket.bulk')
+    const result = await bulkTransition({
+      ticketIds: ['ticket_1'] as never,
+      actorPrincipalId: 'user_a' as never,
+      statusId: 'status_done' as never,
+      permit: (() => false) as never,
+    })
+    expect(result.failed).toEqual([{ ticketId: 'ticket_1', reason: 'FORBIDDEN' }])
+    expect(transitionStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('returns empty result for an empty ticketIds list', async () => {
+    const { bulkTransition } = await import('../ticket.bulk')
+    const result = await bulkTransition({
+      ticketIds: [] as never,
+      actorPrincipalId: 'user_a' as never,
+      statusId: 'status_done' as never,
+      permit: (() => true) as never,
+    })
+    expect(result).toEqual({ succeeded: [], failed: [] })
+  })
+})
+
+describe('errReason (exercised via bulkTransition error path)', () => {
+  it('uses the error code when present', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_1')])
+    transitionStatusMock.mockRejectedValueOnce({ code: 'OPTIMISTIC_LOCK' })
+    const { bulkTransition } = await import('../ticket.bulk')
+    const result = await bulkTransition({
+      ticketIds: ['ticket_1'] as never,
+      actorPrincipalId: 'user_a' as never,
+      statusId: 'status_done' as never,
+      permit: (() => true) as never,
+    })
+    expect(result.failed).toEqual([{ ticketId: 'ticket_1', reason: 'OPTIMISTIC_LOCK' }])
+  })
+
+  it('falls back to Error.message when there is no code', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_1')])
+    transitionStatusMock.mockRejectedValueOnce(new Error('plain error'))
+    const { bulkTransition } = await import('../ticket.bulk')
+    const result = await bulkTransition({
+      ticketIds: ['ticket_1'] as never,
+      actorPrincipalId: 'user_a' as never,
+      statusId: 'status_done' as never,
+      permit: (() => true) as never,
+    })
+    expect(result.failed).toEqual([{ ticketId: 'ticket_1', reason: 'plain error' }])
+  })
+
+  it('falls back to UNKNOWN for a non-error, non-coded throw', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_1')])
+    transitionStatusMock.mockRejectedValueOnce('a bare string')
+    const { bulkTransition } = await import('../ticket.bulk')
+    const result = await bulkTransition({
+      ticketIds: ['ticket_1'] as never,
+      actorPrincipalId: 'user_a' as never,
+      statusId: 'status_done' as never,
+      permit: (() => true) as never,
+    })
+    expect(result.failed).toEqual([{ ticketId: 'ticket_1', reason: 'UNKNOWN' }])
+  })
+
+  it('treats an object with a non-string code as UNKNOWN', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([row('ticket_1')])
+    transitionStatusMock.mockRejectedValueOnce({ code: 42 })
+    const { bulkTransition } = await import('../ticket.bulk')
+    const result = await bulkTransition({
+      ticketIds: ['ticket_1'] as never,
+      actorPrincipalId: 'user_a' as never,
+      statusId: 'status_done' as never,
+      permit: (() => true) as never,
+    })
+    expect(result.failed).toEqual([{ ticketId: 'ticket_1', reason: 'UNKNOWN' }])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.bulk.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.bulk.test.ts
new file mode 100644
index 000000000..2dadab6e4
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.bulk.test.ts
@@ -0,0 +1,100 @@
+/**
+ * Phase 4: bulkChangeInbox dispatches one ticket.updated per affected ticket.
+ *
+ * Mocks the db, share lookups, and the dispatcher itself; verifies that
+ * succeeded rows trigger a dispatch and that not-found / stale / forbidden
+ * rows do not.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const selectFromWhereMock = vi.fn()
+const updateReturningMock = vi.fn()
+
+const dispatchTicketUpdatedMock = vi.fn()
+const buildEventActorMock = vi.fn((input: { principalId: string }) => ({
+  type: 'user' as const,
+  principalId: input.principalId,
+  displayName: 'ticket-system',
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: vi.fn(() => ({
+      from: vi.fn(() => ({ where: selectFromWhereMock })),
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn().mockReturnThis(),
+      where: vi.fn().mockReturnThis(),
+      returning: updateReturningMock,
+    })),
+    insert: vi.fn(),
+    delete: vi.fn(),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  inArray: vi.fn(),
+  tickets: { _name: 'tickets', id: 'tickets.id', updatedAt: 'tickets.updatedAt' },
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: vi.fn() }))
+vi.mock('../', () => ({
+  assignTicket: vi.fn(),
+  transitionStatus: vi.fn(),
+  toResourceScope: vi.fn(() => ({ primaryTeamId: null })),
+}))
+vi.mock('../ticket.share', () => ({ listSharesForTicket: vi.fn().mockResolvedValue([]) }))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchTicketUpdated: (...a: unknown[]) => dispatchTicketUpdatedMock(...a),
+  buildEventActor: (...a: unknown[]) => buildEventActorMock(...(a as [{ principalId: string }])),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  selectFromWhereMock.mockReset()
+  updateReturningMock.mockReset()
+  dispatchTicketUpdatedMock.mockReset()
+})
+
+describe('bulkChangeInbox → dispatchTicketUpdated', () => {
+  it('fires one dispatch per succeeded ticket and skips not-found rows', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([
+      { id: 'ticket_1', inboxId: 'inbox_old', updatedAt: new Date('2026-04-01') },
+      { id: 'ticket_2', inboxId: 'inbox_old', updatedAt: new Date('2026-04-01') },
+    ])
+    updateReturningMock
+      .mockResolvedValueOnce([{ id: 'ticket_1', inboxId: 'inbox_new' }])
+      .mockResolvedValueOnce([{ id: 'ticket_2', inboxId: 'inbox_new' }])
+
+    const { bulkChangeInbox } = await import('../ticket.bulk')
+    const result = await bulkChangeInbox({
+      ticketIds: ['ticket_1', 'ticket_2', 'ticket_missing'] as never,
+      actorPrincipalId: 'user_a' as never,
+      inboxId: 'inbox_new' as never,
+      permit: () => true,
+    })
+    expect(result.succeeded.map((s) => s.ticketId)).toEqual(['ticket_1', 'ticket_2'])
+    expect(result.failed).toEqual([{ ticketId: 'ticket_missing', reason: 'TICKET_NOT_FOUND' }])
+    expect(dispatchTicketUpdatedMock).toHaveBeenCalledTimes(2)
+    const [, ticket, changedFields, diff] = dispatchTicketUpdatedMock.mock.calls[0]
+    expect((ticket as { id: string }).id).toBe('ticket_1')
+    expect(changedFields).toEqual(['inboxId'])
+    expect(diff).toEqual({ inboxId: { from: 'inbox_old', to: 'inbox_new' } })
+  })
+
+  it('does not dispatch for forbidden rows', async () => {
+    selectFromWhereMock.mockResolvedValueOnce([
+      { id: 'ticket_1', inboxId: 'inbox_old', updatedAt: new Date('2026-04-01') },
+    ])
+    const { bulkChangeInbox } = await import('../ticket.bulk')
+    const result = await bulkChangeInbox({
+      ticketIds: ['ticket_1'] as never,
+      actorPrincipalId: 'user_a' as never,
+      inboxId: 'inbox_new' as never,
+      permit: () => false,
+    })
+    expect(result.failed).toEqual([{ ticketId: 'ticket_1', reason: 'FORBIDDEN' }])
+    expect(dispatchTicketUpdatedMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.create-thread-for-attachments.gap.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.create-thread-for-attachments.gap.test.ts
new file mode 100644
index 000000000..d15d1f304
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.create-thread-for-attachments.gap.test.ts
@@ -0,0 +1,51 @@
+/**
+ * findOrCreateInitialThread — gap tests for both branches: returning an
+ * existing public thread vs creating a synthetic one via addThread.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  threadsFindFirst: vi.fn(),
+  addThread: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketThreads: { findFirst: m.threadsFindFirst },
+    },
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  ticketThreads: { ticketId: 'tt.ticketId', audience: 'tt.audience', deletedAt: 'tt.deletedAt' },
+}))
+
+vi.mock('../ticket.threads', () => ({
+  addThread: m.addThread,
+}))
+
+import { findOrCreateInitialThread } from '../ticket.create-thread-for-attachments'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('findOrCreateInitialThread', () => {
+  it('returns the existing public thread id when one exists', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce({ id: 'thread_existing' })
+    const id = await findOrCreateInitialThread('ticket_1' as never, 'p1' as never)
+    expect(id).toBe('thread_existing')
+    expect(m.addThread).not.toHaveBeenCalled()
+  })
+
+  it('creates a synthetic thread when none exists', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(undefined)
+    m.addThread.mockResolvedValueOnce({ id: 'thread_new' })
+    const id = await findOrCreateInitialThread('ticket_1' as never, null)
+    expect(id).toBe('thread_new')
+    expect(m.addThread).toHaveBeenCalledWith(
+      expect.objectContaining({ ticketId: 'ticket_1', principalId: null, audience: 'public' })
+    )
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.notifications.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.notifications.diffcov.test.ts
new file mode 100644
index 000000000..af875767b
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.notifications.diffcov.test.ts
@@ -0,0 +1,267 @@
+/**
+ * Differential-coverage tests for ticket.notifications — the shared dispatch
+ * core (actor suppression, dedup, trusted-recipient bypass, canViewTicket gate
+ * + permission-failure swallow, empty short-circuits) and each event
+ * dispatcher (created/assigned/status/thread audience/participant/share/sla).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  selectWhere: vi.fn(),
+  createBatch: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  getSubscribers: vi.fn(),
+  canViewTicket: vi.fn(),
+  toResourceScope: vi.fn(),
+  loadPermissionSet: vi.fn(),
+  resolvePortalLinked: vi.fn(),
+  resolvePrincipalsForContacts: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: { select: () => ({ from: () => ({ where: () => m.selectWhere() }) }) },
+  eq: vi.fn(),
+  and: vi.fn(),
+  inArray: vi.fn(),
+  isNull: vi.fn(),
+  ticketShares: { ticketId: 'ts.ticketId', teamId: 'ts.teamId', revokedAt: 'ts.revokedAt' },
+  teamMemberships: { teamId: 'tm.teamId', principalId: 'tm.principalId' },
+}))
+vi.mock('../../notifications/notification.service', () => ({
+  createNotificationsBatch: (...a: unknown[]) => m.createBatch(...a),
+}))
+vi.mock('../ticket.subscriptions', () => ({
+  getSubscribers: (...a: unknown[]) => m.getSubscribers(...a),
+}))
+vi.mock('../ticket.permissions', () => ({
+  canViewTicket: (...a: unknown[]) => m.canViewTicket(...a),
+  toResourceScope: (...a: unknown[]) => m.toResourceScope(...a),
+}))
+vi.mock('../../authz/authz.service', () => ({
+  loadPermissionSet: (...a: unknown[]) => m.loadPermissionSet(...a),
+}))
+vi.mock('../ticket.recipients', () => ({
+  resolvePortalLinkedRecipients: (...a: unknown[]) => m.resolvePortalLinked(...a),
+  resolvePrincipalsForContacts: (...a: unknown[]) => m.resolvePrincipalsForContacts(...a),
+}))
+
+import * as svc from '../ticket.notifications'
+
+const ticket = (over: Record<string, unknown> = {}) => ({
+  id: 'ticket_1',
+  subject: 'Help',
+  primaryTeamId: null,
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  requesterPrincipalId: null,
+  ...over,
+})
+const ctx = (actorPrincipalId: string | null = null) => ({ actorPrincipalId }) as never
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.selectWhere.mockResolvedValue([])
+  m.createBatch.mockResolvedValue(undefined)
+  m.getSubscribers.mockResolvedValue(['sub_1'])
+  m.canViewTicket.mockReturnValue(true)
+  m.toResourceScope.mockReturnValue({})
+  m.loadPermissionSet.mockResolvedValue({})
+  m.resolvePortalLinked.mockResolvedValue({ principalIds: [], portalLinked: new Set() })
+  m.resolvePrincipalsForContacts.mockResolvedValue([])
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('notifyTicketCreated + dispatch core', () => {
+  it('returns early when there are no recipients', async () => {
+    m.getSubscribers.mockResolvedValueOnce([])
+    await svc.notifyTicketCreated(ticket() as never, ctx())
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+  it('dispatches to allowed subscribers', async () => {
+    await svc.notifyTicketCreated(ticket() as never, ctx())
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('suppresses the actor and returns when nobody else remains', async () => {
+    m.getSubscribers.mockResolvedValueOnce(['actor_p'])
+    await svc.notifyTicketCreated(ticket() as never, ctx('actor_p'))
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+  it('trusts owning recipients without a permission check', async () => {
+    m.canViewTicket.mockReturnValue(false) // RBAC would deny
+    m.getSubscribers.mockResolvedValueOnce([])
+    m.resolvePortalLinked.mockResolvedValueOnce({
+      principalIds: ['p_req'],
+      portalLinked: new Set(['p_req']),
+    })
+    await svc.notifyTicketCreated(ticket({ requesterPrincipalId: 'p_req' }) as never, ctx())
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('drops recipients who fail the permission check', async () => {
+    m.canViewTicket.mockReturnValue(false)
+    await svc.notifyTicketCreated(ticket() as never, ctx())
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+  it('swallows a permission-check failure', async () => {
+    m.loadPermissionSet.mockRejectedValue(new Error('authz down'))
+    await svc.notifyTicketCreated(ticket() as never, ctx())
+    expect(console.warn).toHaveBeenCalled()
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('notifyTicketAssigned', () => {
+  it('notifies a new assignee', async () => {
+    await svc.notifyTicketAssigned(ticket({ assigneePrincipalId: 'p_new' }) as never, null, ctx())
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('notifies the previous assignee on unassign', async () => {
+    await svc.notifyTicketAssigned(
+      ticket({ assigneePrincipalId: null }) as never,
+      'p_old' as never,
+      ctx()
+    )
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('does nothing when there is no new or previous assignee', async () => {
+    await svc.notifyTicketAssigned(ticket({ assigneePrincipalId: null }) as never, null, ctx())
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('notifyTicketStatusChanged', () => {
+  it('dispatches with a from→to body', async () => {
+    await svc.notifyTicketStatusChanged(ticket() as never, 'open', 'solved', ctx())
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('returns early when there are no recipients', async () => {
+    m.getSubscribers.mockResolvedValueOnce([])
+    await svc.notifyTicketStatusChanged(ticket() as never, null, 'open', ctx())
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('notifyThreadAdded audience handling', () => {
+  it('public: includes portal-linked and trusts them', async () => {
+    m.resolvePortalLinked.mockResolvedValueOnce({
+      principalIds: ['p_portal'],
+      portalLinked: new Set(['p_portal']),
+    })
+    await svc.notifyThreadAdded(ticket() as never, 'thread_1', 'public', null, ctx())
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('internal: drops requester + portal-linked', async () => {
+    m.resolvePortalLinked.mockResolvedValueOnce({
+      principalIds: [],
+      portalLinked: new Set(['p_portal']),
+    })
+    m.getSubscribers.mockResolvedValueOnce(['p_portal', 'p_req', 'agent_1'])
+    await svc.notifyThreadAdded(
+      ticket({ requesterPrincipalId: 'p_req' }) as never,
+      'thread_1',
+      'internal',
+      null,
+      ctx()
+    )
+    expect(m.createBatch).toHaveBeenCalled() // agent_1 survives
+  })
+  it('returns early when the audience filter empties the set', async () => {
+    m.resolvePortalLinked.mockResolvedValueOnce({
+      principalIds: [],
+      portalLinked: new Set(['p_req']),
+    })
+    m.getSubscribers.mockResolvedValueOnce(['p_req'])
+    await svc.notifyThreadAdded(
+      ticket({ requesterPrincipalId: 'p_req' }) as never,
+      'thread_1',
+      'shared_team',
+      'team_1' as never,
+      ctx()
+    )
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('participant notifications', () => {
+  it('added: notifies a direct principal', async () => {
+    await svc.notifyParticipantAdded(
+      ticket() as never,
+      { principalId: 'p_added', contactId: null } as never,
+      ctx()
+    )
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('added: resolves a contact to linked principals (trusted)', async () => {
+    m.resolvePrincipalsForContacts.mockResolvedValueOnce(['p_linked'])
+    await svc.notifyParticipantAdded(
+      ticket() as never,
+      { principalId: null, contactId: 'contact_1' } as never,
+      ctx()
+    )
+    expect(m.resolvePrincipalsForContacts).toHaveBeenCalled()
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('added: no-ops when neither a principal nor a linked contact exists', async () => {
+    await svc.notifyParticipantAdded(
+      ticket() as never,
+      { principalId: null, contactId: null } as never,
+      ctx()
+    )
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+  it('removed: notifies the removed principal', async () => {
+    await svc.notifyParticipantRemoved(
+      ticket() as never,
+      { principalId: 'p_removed', contactId: null } as never,
+      ctx()
+    )
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('removed: no-ops when nothing to notify', async () => {
+    await svc.notifyParticipantRemoved(
+      ticket() as never,
+      { principalId: null, contactId: null } as never,
+      ctx()
+    )
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('share + sla notifications', () => {
+  it('shared: notifies team members', async () => {
+    m.selectWhere.mockResolvedValueOnce([{ principalId: 'tm_1' }]) // expandTeamMembers
+    await svc.notifyTicketShared(ticket() as never, 'team_1' as never, ctx())
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('shared: returns early with no recipients', async () => {
+    m.selectWhere.mockResolvedValueOnce([]) // no team members
+    m.getSubscribers.mockResolvedValueOnce([])
+    await svc.notifyTicketShared(ticket() as never, 'team_1' as never, ctx())
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+  it('unshared: notifies team members', async () => {
+    m.selectWhere.mockResolvedValueOnce([{ principalId: 'tm_1' }])
+    await svc.notifyTicketUnshared(ticket() as never, 'team_1' as never, ctx())
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('sla warning: returns early with no explicit recipients', async () => {
+    await svc.notifyTicketSlaWarning(ticket() as never, 'first_response', 'Rule', [])
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+  it('sla warning: dispatches to recipients + subscribers', async () => {
+    await svc.notifyTicketSlaWarning(ticket() as never, 'first_response', 'Rule', [
+      'p_oncall',
+    ] as never)
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('sla breach: includes the assignee + subscribers', async () => {
+    await svc.notifyTicketSlaBreach(
+      ticket({ assigneePrincipalId: 'p_assignee' }) as never,
+      'resolution'
+    )
+    expect(m.createBatch).toHaveBeenCalled()
+  })
+  it('sla breach: returns early when there are no recipients', async () => {
+    m.getSubscribers.mockResolvedValueOnce([])
+    await svc.notifyTicketSlaBreach(ticket({ assigneePrincipalId: null }) as never, 'resolution')
+    expect(m.createBatch).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.notifications.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.notifications.test.ts
new file mode 100644
index 000000000..a84ed057e
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.notifications.test.ts
@@ -0,0 +1,325 @@
+/**
+ * ticket.notifications — dispatcher policy: actor suppression, per-recipient
+ * visibility filter, audience-aware thread filter, and team expansion for
+ * `notifyTicketShared`.
+ *
+ * The DB chain + permission engine are mocked. The point is to lock the
+ * recipient-resolution semantics so a future refactor can't silently leak
+ * a notification to a principal who lost view permission or who triggered
+ * the action themselves.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const getSubscribersMock = vi.fn()
+const loadPermissionSetMock = vi.fn()
+const canViewTicketMock = vi.fn()
+const createNotificationsBatchMock = vi.fn()
+
+// Captured by db.select(...).from(...).where(...) for shares, and
+// db.select(...).from(teamMemberships).where(...) for team expansion.
+const sharesRows: Array<{ teamId: string; revokedAt: Date | null }> = []
+const teamMembersRows: Array<{ principalId: string }> = []
+
+vi.mock('@/lib/server/db', () => {
+  const sharesChain = {
+    from: vi.fn((tbl: { _name: string }) => {
+      const isShares = tbl?._name === 'ticket_shares'
+      return {
+        innerJoin: vi.fn().mockReturnThis(),
+        where: vi.fn().mockResolvedValue(isShares ? sharesRows : teamMembersRows),
+      }
+    }),
+  }
+  return {
+    db: {
+      select: vi.fn(() => sharesChain),
+      selectDistinct: vi.fn(() => sharesChain),
+    },
+    eq: vi.fn(),
+    and: vi.fn(),
+    inArray: vi.fn(),
+    isNull: vi.fn(),
+    ticketShares: {
+      _name: 'ticket_shares',
+      teamId: 'team_id',
+      revokedAt: 'revoked_at',
+      ticketId: 'ticket_id',
+    },
+    teamMemberships: { _name: 'team_memberships', principalId: 'principal_id', teamId: 'team_id' },
+    ticketSubscriptions: { _name: 'ticket_subscriptions' },
+    ticketParticipants: {
+      _name: 'ticket_participants',
+      principalId: 'principal_id',
+      contactId: 'contact_id',
+      ticketId: 'ticket_id',
+    },
+    contactUserLinks: { _name: 'contact_user_links', contactId: 'contact_id', userId: 'user_id' },
+    principal: { _name: 'principal', id: 'id', userId: 'user_id' },
+  }
+})
+
+vi.mock('../ticket.subscriptions', () => ({
+  getSubscribers: (...args: unknown[]) => getSubscribersMock(...args),
+}))
+
+vi.mock('../../authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => loadPermissionSetMock(...args),
+}))
+
+vi.mock('../ticket.permissions', () => ({
+  canViewTicket: (...args: unknown[]) => canViewTicketMock(...args),
+  toResourceScope: (input: unknown) => ({ _scope: input }),
+}))
+
+vi.mock('../../notifications/notification.service', () => ({
+  createNotificationsBatch: (...args: unknown[]) => createNotificationsBatchMock(...args),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  getSubscribersMock.mockReset()
+  loadPermissionSetMock.mockReset().mockResolvedValue({ permissions: new Set() })
+  canViewTicketMock.mockReset().mockReturnValue(true)
+  createNotificationsBatchMock.mockReset().mockResolvedValue(undefined)
+  sharesRows.length = 0
+  teamMembersRows.length = 0
+})
+
+const baseTicket = {
+  id: 'ticket_1',
+  subject: 'Hello',
+  primaryTeamId: 'team_a',
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  requesterPrincipalId: null,
+} as Record<string, unknown>
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const T = (extra: Record<string, unknown> = {}): any => ({ ...baseTicket, ...extra })
+
+describe('notifyTicketAssigned', () => {
+  it('does not notify when there is no new assignee or previous assignee', async () => {
+    getSubscribersMock.mockResolvedValue(['principal_sub'])
+    const { notifyTicketAssigned } = await import('../ticket.notifications')
+
+    await notifyTicketAssigned(T({ assigneePrincipalId: null }), null, {
+      actorPrincipalId: 'principal_actor' as never,
+    })
+
+    expect(createNotificationsBatchMock).not.toHaveBeenCalled()
+  })
+
+  it('suppresses actor and notifies new + previous assignee separately', async () => {
+    getSubscribersMock.mockResolvedValue([])
+    const { notifyTicketAssigned } = await import('../ticket.notifications')
+    await notifyTicketAssigned(
+      T({ assigneePrincipalId: 'principal_new' }),
+      'principal_prev' as never,
+      { actorPrincipalId: 'principal_actor' as never }
+    )
+    expect(createNotificationsBatchMock).toHaveBeenCalledTimes(2)
+    const allRecipients = createNotificationsBatchMock.mock.calls
+      .flatMap((c) => c[0])
+      .map((row) => row.principalId)
+    expect(allRecipients).toContain('principal_new')
+    expect(allRecipients).toContain('principal_prev')
+    expect(allRecipients).not.toContain('principal_actor')
+  })
+
+  it('drops the actor even if they are the new assignee', async () => {
+    getSubscribersMock.mockResolvedValue([])
+    const { notifyTicketAssigned } = await import('../ticket.notifications')
+    await notifyTicketAssigned(T({ assigneePrincipalId: 'principal_self' }), null, {
+      actorPrincipalId: 'principal_self' as never,
+    })
+    // Only the new-assignee dispatch attempt fires; recipient set after
+    // suppression is empty so no batch insert happens.
+    expect(createNotificationsBatchMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('notifyTicketCreated and status changes', () => {
+  it('notifies requester and assignee when a ticket is opened', async () => {
+    getSubscribersMock.mockResolvedValue(['principal_sub'])
+    const { notifyTicketCreated } = await import('../ticket.notifications')
+
+    await notifyTicketCreated(
+      T({ requesterPrincipalId: 'principal_req', assigneePrincipalId: 'principal_agent' }),
+      { actorPrincipalId: 'principal_actor' as never }
+    )
+
+    const recipients = createNotificationsBatchMock.mock.calls
+      .flatMap((c) => c[0])
+      .map((row) => row.principalId)
+    expect(recipients).toEqual(['principal_sub', 'principal_req', 'principal_agent'])
+    expect(createNotificationsBatchMock.mock.calls[0][0][0]).toMatchObject({
+      type: 'ticket_thread_added',
+      title: 'Ticket opened: Hello',
+    })
+  })
+
+  it('uses fallback subject and previous-category text for status changes', async () => {
+    getSubscribersMock.mockResolvedValue(['principal_sub'])
+    const { notifyTicketStatusChanged } = await import('../ticket.notifications')
+
+    await notifyTicketStatusChanged(T({ subject: null }), null, 'closed', {
+      actorPrincipalId: null,
+    })
+
+    expect(createNotificationsBatchMock.mock.calls[0][0][0]).toMatchObject({
+      title: 'Status: ticket',
+      body: '— → closed',
+      metadata: { ticketId: 'ticket_1', from: null, to: 'closed' },
+    })
+  })
+})
+
+describe('notifyThreadAdded', () => {
+  it('public audience keeps the requester in the recipient set', async () => {
+    getSubscribersMock.mockResolvedValue([])
+    const { notifyThreadAdded } = await import('../ticket.notifications')
+    await notifyThreadAdded(
+      T({ requesterPrincipalId: 'principal_req' }),
+      'thread_1',
+      'public',
+      null,
+      { actorPrincipalId: 'principal_agent' as never }
+    )
+    const recipients = createNotificationsBatchMock.mock.calls
+      .flatMap((c) => c[0])
+      .map((row) => row.principalId)
+    expect(recipients).toContain('principal_req')
+  })
+
+  it('internal audience drops the requester', async () => {
+    getSubscribersMock.mockResolvedValue([])
+    const { notifyThreadAdded } = await import('../ticket.notifications')
+    await notifyThreadAdded(
+      T({
+        requesterPrincipalId: 'principal_req',
+        assigneePrincipalId: 'principal_agent',
+      }),
+      'thread_1',
+      'internal',
+      null,
+      { actorPrincipalId: 'principal_someone_else' as never }
+    )
+    const recipients = createNotificationsBatchMock.mock.calls
+      .flatMap((c) => c[0])
+      .map((row) => row.principalId)
+    expect(recipients).not.toContain('principal_req')
+    expect(recipients).toContain('principal_agent')
+  })
+})
+
+describe('dispatch visibility filter', () => {
+  it('drops principals whose canViewTicket returns false', async () => {
+    getSubscribersMock.mockResolvedValue(['principal_a', 'principal_b', 'principal_c'])
+    canViewTicketMock.mockImplementation(() => true)
+    // The 2nd permission load will yield a "denied" set.
+    let call = 0
+    canViewTicketMock.mockImplementation(() => {
+      call += 1
+      return call !== 2 // deny the 2nd recipient
+    })
+    const { notifyTicketStatusChanged } = await import('../ticket.notifications')
+    await notifyTicketStatusChanged(T(), 'open', 'pending', { actorPrincipalId: null })
+    const rows = createNotificationsBatchMock.mock.calls.flatMap((c) => c[0])
+    expect(rows).toHaveLength(2) // 3 candidates − 1 denied
+  })
+
+  it('skips a recipient when permission loading fails', async () => {
+    getSubscribersMock.mockResolvedValue(['principal_bad'])
+    loadPermissionSetMock.mockRejectedValueOnce(new Error('permission db unavailable'))
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    try {
+      const { notifyTicketStatusChanged } = await import('../ticket.notifications')
+      await notifyTicketStatusChanged(T(), 'open', 'pending', { actorPrincipalId: null })
+
+      expect(createNotificationsBatchMock).not.toHaveBeenCalled()
+      expect(warn).toHaveBeenCalledWith(
+        '[tickets.notifications] permission check failed for',
+        'principal_bad',
+        expect.any(Error)
+      )
+    } finally {
+      warn.mockRestore()
+    }
+  })
+})
+
+describe('notifyTicketShared', () => {
+  it('expands team members + adds them to the recipient set', async () => {
+    getSubscribersMock.mockResolvedValue([])
+    teamMembersRows.push({ principalId: 'principal_x' }, { principalId: 'principal_y' })
+    const { notifyTicketShared } = await import('../ticket.notifications')
+    await notifyTicketShared(T(), 'team_b' as never, {
+      actorPrincipalId: 'principal_x' as never,
+    })
+    const recipients = createNotificationsBatchMock.mock.calls
+      .flatMap((c) => c[0])
+      .map((row) => row.principalId)
+    // principal_x is the actor → suppressed; principal_y survives.
+    expect(recipients).toEqual(['principal_y'])
+  })
+
+  it('expands team members for unshare notifications', async () => {
+    getSubscribersMock.mockResolvedValue(['principal_sub'])
+    teamMembersRows.push({ principalId: 'principal_x' })
+    const { notifyTicketUnshared } = await import('../ticket.notifications')
+
+    await notifyTicketUnshared(T(), 'team_b' as never, {
+      actorPrincipalId: 'principal_actor' as never,
+    })
+
+    const rows = createNotificationsBatchMock.mock.calls.flatMap((c) => c[0])
+    expect(rows.map((row) => row.principalId)).toEqual(['principal_x', 'principal_sub'])
+    expect(rows[0]).toMatchObject({
+      type: 'ticket_unshared',
+      title: 'Ticket access revoked: Hello',
+      metadata: { ticketId: 'ticket_1', teamId: 'team_b' },
+    })
+  })
+})
+
+describe('SLA notifications', () => {
+  it('does not dispatch SLA warnings when there are no explicit recipients', async () => {
+    const { notifyTicketSlaWarning } = await import('../ticket.notifications')
+
+    await notifyTicketSlaWarning(T(), 'first_response', 'First response', [])
+
+    expect(getSubscribersMock).not.toHaveBeenCalled()
+    expect(createNotificationsBatchMock).not.toHaveBeenCalled()
+  })
+
+  it('notifies explicit and subscribed recipients for SLA warnings', async () => {
+    getSubscribersMock.mockResolvedValue(['principal_sub'])
+    const { notifyTicketSlaWarning } = await import('../ticket.notifications')
+
+    await notifyTicketSlaWarning(T(), 'first_response', 'First response', [
+      'principal_agent' as never,
+    ])
+
+    const rows = createNotificationsBatchMock.mock.calls.flatMap((c) => c[0])
+    expect(rows.map((row) => row.principalId)).toEqual(['principal_agent', 'principal_sub'])
+    expect(rows[0]).toMatchObject({
+      type: 'ticket_sla_warning',
+      body: 'First response (first response) escalation triggered.',
+    })
+  })
+
+  it('notifies assignee and subscribers for SLA breaches', async () => {
+    getSubscribersMock.mockResolvedValue(['principal_sub'])
+    const { notifyTicketSlaBreach } = await import('../ticket.notifications')
+
+    await notifyTicketSlaBreach(T({ assigneePrincipalId: 'principal_agent' }), 'next_response')
+
+    const rows = createNotificationsBatchMock.mock.calls.flatMap((c) => c[0])
+    expect(rows.map((row) => row.principalId)).toEqual(['principal_agent', 'principal_sub'])
+    expect(rows[0]).toMatchObject({
+      type: 'ticket_sla_breach',
+      body: 'next response target was missed.',
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.participants.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.participants.diffcov.test.ts
new file mode 100644
index 000000000..024f037e2
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.participants.diffcov.test.ts
@@ -0,0 +1,254 @@
+/**
+ * Differential-coverage tests for ticket.participants — add/remove/list with
+ * the validation guards, idempotency, audit + activity writes, auto-subscribe,
+ * notification dispatch (principal vs service actor), and the defensive
+ * try/catch fallbacks around the notification + webhook side-effects.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  participantsFindFirst: vi.fn(),
+  ticketsFindFirst: vi.fn(),
+  returningMock: vi.fn(),
+  deleteWhereMock: vi.fn(),
+  selectWhereMock: vi.fn(),
+  recordEvent: vi.fn(),
+  writeActivity: vi.fn(),
+  bumpLastActivity: vi.fn(),
+  safeSubscribe: vi.fn(),
+  notifyAdded: vi.fn(),
+  notifyRemoved: vi.fn(),
+  dispatchAdded: vi.fn(),
+  dispatchRemoved: vi.fn(),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({
+    type: 'principal',
+    displayName: 'ticket-system',
+  })),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketParticipants: { findFirst: m.participantsFindFirst },
+      tickets: { findFirst: m.ticketsFindFirst },
+    },
+    insert: vi.fn(() => ({ values: vi.fn(() => ({ returning: m.returningMock })) })),
+    delete: vi.fn(() => ({ where: m.deleteWhereMock })),
+    select: vi.fn(() => ({ from: vi.fn(() => ({ where: m.selectWhereMock })) })),
+  },
+  eq: vi.fn((a, b) => ({ eq: [a, b] })),
+  and: vi.fn((...a) => ({ and: a })),
+  tickets: { id: 'tickets.id' },
+  ticketParticipants: {
+    id: 'tp.id',
+    ticketId: 'tp.ticketId',
+    principalId: 'tp.principalId',
+    contactId: 'tp.contactId',
+  },
+  TICKET_PARTICIPANT_ROLES: ['collaborator', 'watcher', 'cc'],
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: (...a: unknown[]) => m.recordEvent(...a) }))
+vi.mock('../ticket.service', () => ({
+  writeActivity: (...a: unknown[]) => m.writeActivity(...a),
+  bumpLastActivity: (...a: unknown[]) => m.bumpLastActivity(...a),
+}))
+vi.mock('../ticket.subscriptions', () => ({
+  safeSubscribe: (...a: unknown[]) => m.safeSubscribe(...a),
+}))
+vi.mock('../ticket.notifications', () => ({
+  notifyParticipantAdded: (...a: unknown[]) => m.notifyAdded(...a),
+  notifyParticipantRemoved: (...a: unknown[]) => m.notifyRemoved(...a),
+}))
+vi.mock('@/lib/server/events/dispatch', () => ({
+  dispatchTicketParticipantAdded: (...a: unknown[]) => m.dispatchAdded(...a),
+  dispatchTicketParticipantRemoved: (...a: unknown[]) => m.dispatchRemoved(...a),
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+}))
+
+import { addParticipant, removeParticipant, listParticipants } from '../ticket.participants'
+
+const tid = 'ticket_1' as never
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.participantsFindFirst.mockResolvedValue(undefined)
+  m.ticketsFindFirst.mockResolvedValue({ id: 'ticket_1' })
+  m.returningMock.mockResolvedValue([{ id: 'tp_1' }])
+  m.deleteWhereMock.mockResolvedValue(undefined)
+  m.selectWhereMock.mockResolvedValue([{ id: 'tp_1' }])
+  m.safeSubscribe.mockResolvedValue(undefined)
+  m.notifyAdded.mockResolvedValue(undefined)
+  m.notifyRemoved.mockResolvedValue(undefined)
+  m.dispatchAdded.mockResolvedValue(undefined)
+  m.dispatchRemoved.mockResolvedValue(undefined)
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('addParticipant validation', () => {
+  it('rejects an invalid role', async () => {
+    await expect(
+      addParticipant({
+        ticketId: tid,
+        role: 'bogus' as never,
+        principalId: 'p1' as never,
+        addedByPrincipalId: null,
+      })
+    ).rejects.toThrow('invalid role')
+  })
+
+  it('rejects when both principalId and contactId are set', async () => {
+    await expect(
+      addParticipant({
+        ticketId: tid,
+        role: 'watcher',
+        principalId: 'p1' as never,
+        contactId: 'c1' as never,
+        addedByPrincipalId: null,
+      })
+    ).rejects.toThrow('exactly one')
+  })
+
+  it('rejects when neither subject is set', async () => {
+    await expect(
+      addParticipant({ ticketId: tid, role: 'watcher', addedByPrincipalId: null })
+    ).rejects.toThrow('exactly one')
+  })
+
+  it('is idempotent — returns the existing row', async () => {
+    m.participantsFindFirst.mockResolvedValueOnce({ id: 'tp_existing' })
+    const res = await addParticipant({
+      ticketId: tid,
+      role: 'watcher',
+      principalId: 'p1' as never,
+      addedByPrincipalId: null,
+    })
+    expect(res).toEqual({ id: 'tp_existing' })
+    expect(m.returningMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('addParticipant success paths', () => {
+  it('creates with a principal, auto-subscribes, notifies, and dispatches a principal actor', async () => {
+    const res = await addParticipant({
+      ticketId: tid,
+      role: 'collaborator',
+      principalId: 'p1' as never,
+      addedByPrincipalId: 'actor_1' as never,
+    })
+    expect(res).toEqual({ id: 'tp_1' })
+    expect(m.bumpLastActivity).toHaveBeenCalledWith(tid)
+    expect(m.writeActivity).toHaveBeenCalled()
+    expect(m.recordEvent).toHaveBeenCalled()
+    expect(m.safeSubscribe).toHaveBeenCalledWith(
+      expect.objectContaining({ source: 'auto_participant' })
+    )
+    expect(m.notifyAdded).toHaveBeenCalled()
+    expect(m.buildEventActor).toHaveBeenCalled()
+    expect(m.dispatchAdded).toHaveBeenCalled()
+  })
+
+  it('creates with a contact and a null actor (service actor, no auto-subscribe)', async () => {
+    await addParticipant({
+      ticketId: tid,
+      role: 'cc',
+      contactId: 'c1' as never,
+      addedByPrincipalId: null,
+    })
+    expect(m.safeSubscribe).not.toHaveBeenCalled()
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+    expect(m.dispatchAdded).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'service' }),
+      expect.anything(),
+      null,
+      'cc'
+    )
+  })
+
+  it('skips notifications when the ticket row is missing', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await addParticipant({
+      ticketId: tid,
+      role: 'watcher',
+      principalId: 'p1' as never,
+      addedByPrincipalId: 'a1' as never,
+    })
+    expect(m.notifyAdded).not.toHaveBeenCalled()
+  })
+
+  it('swallows a dispatch failure (inner catch)', async () => {
+    m.dispatchAdded.mockRejectedValueOnce(new Error('boom'))
+    const res = await addParticipant({
+      ticketId: tid,
+      role: 'watcher',
+      principalId: 'p1' as never,
+      addedByPrincipalId: 'a1' as never,
+    })
+    expect(res).toEqual({ id: 'tp_1' })
+    expect(console.warn).toHaveBeenCalled()
+  })
+
+  it('swallows a notify failure (outer catch)', async () => {
+    m.notifyAdded.mockRejectedValueOnce(new Error('notify-fail'))
+    const res = await addParticipant({
+      ticketId: tid,
+      role: 'watcher',
+      principalId: 'p1' as never,
+      addedByPrincipalId: 'a1' as never,
+    })
+    expect(res).toEqual({ id: 'tp_1' })
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
+
+describe('removeParticipant', () => {
+  it('throws when the participant is missing', async () => {
+    m.participantsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(removeParticipant('tp_x' as never, null)).rejects.toThrow('not found')
+  })
+
+  it('deletes, records, and dispatches the removed notification', async () => {
+    m.participantsFindFirst.mockResolvedValueOnce({
+      id: 'tp_1',
+      ticketId: 'ticket_1',
+      principalId: 'p1',
+      contactId: null,
+    })
+    await removeParticipant('tp_1' as never, 'actor_1' as never)
+    expect(m.deleteWhereMock).toHaveBeenCalled()
+    expect(m.recordEvent).toHaveBeenCalled()
+    expect(m.notifyRemoved).toHaveBeenCalled()
+    expect(m.dispatchRemoved).toHaveBeenCalled()
+  })
+
+  it('uses a service actor and skips notify when the ticket row is gone', async () => {
+    m.participantsFindFirst.mockResolvedValueOnce({
+      id: 'tp_1',
+      ticketId: 'ticket_1',
+      principalId: null,
+      contactId: 'c1',
+    })
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await removeParticipant('tp_1' as never, null)
+    expect(m.notifyRemoved).not.toHaveBeenCalled()
+  })
+
+  it('swallows a dispatch failure', async () => {
+    m.participantsFindFirst.mockResolvedValueOnce({
+      id: 'tp_1',
+      ticketId: 'ticket_1',
+      principalId: 'p1',
+      contactId: null,
+    })
+    m.dispatchRemoved.mockRejectedValueOnce(new Error('boom'))
+    await removeParticipant('tp_1' as never, 'a1' as never)
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
+
+describe('listParticipants', () => {
+  it('returns the rows from the select chain', async () => {
+    const res = await listParticipants(tid)
+    expect(res).toEqual([{ id: 'tp_1' }])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.participants.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.participants.test.ts
new file mode 100644
index 000000000..5ed3dcece
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.participants.test.ts
@@ -0,0 +1,107 @@
+/**
+ * ticket.participants — exactly-one invariant + idempotent re-add.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const partFindFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: { ticketParticipants: { findFirst: partFindFirstMock } },
+    insert: vi.fn(() => ({
+      values: vi.fn().mockReturnThis(),
+      returning: insertReturningMock,
+    })),
+    delete: vi.fn(() => ({ where: vi.fn().mockResolvedValue(undefined) })),
+    select: vi.fn(),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  or: vi.fn(),
+  isNull: vi.fn(),
+  ticketParticipants: { _name: 'ticket_participants' },
+  tickets: { _name: 'tickets', id: 'tickets.id' },
+  TICKET_PARTICIPANT_ROLES: ['watcher', 'collaborator', 'cc'] as const,
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: vi.fn() }))
+vi.mock('../ticket.service', () => ({
+  writeActivity: vi.fn().mockResolvedValue({ id: 'act' }),
+  bumpLastActivity: vi.fn(),
+}))
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E }
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  partFindFirstMock.mockReset()
+  insertReturningMock.mockReset()
+})
+
+describe('addParticipant', () => {
+  it('rejects when both principalId and contactId are set', async () => {
+    const { addParticipant } = await import('../ticket.participants')
+    await expect(
+      addParticipant({
+        ticketId: 'ticket_1' as never,
+        role: 'watcher',
+        principalId: 'user_a' as never,
+        contactId: 'contact_a' as never,
+        addedByPrincipalId: null,
+      })
+    ).rejects.toThrow(/exactly one/i)
+  })
+
+  it('rejects when neither principalId nor contactId is set', async () => {
+    const { addParticipant } = await import('../ticket.participants')
+    await expect(
+      addParticipant({
+        ticketId: 'ticket_1' as never,
+        role: 'watcher',
+        addedByPrincipalId: null,
+      })
+    ).rejects.toThrow(/exactly one/i)
+  })
+
+  it('returns existing row idempotently', async () => {
+    partFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_part_1',
+      ticketId: 'ticket_1',
+      principalId: 'user_a',
+      role: 'watcher',
+    })
+    const { addParticipant } = await import('../ticket.participants')
+    const result = await addParticipant({
+      ticketId: 'ticket_1' as never,
+      role: 'watcher',
+      principalId: 'user_a' as never,
+      addedByPrincipalId: null,
+    })
+    expect(result.id).toBe('ticket_part_1')
+    expect(insertReturningMock).not.toHaveBeenCalled()
+  })
+
+  it('inserts when no matching row exists', async () => {
+    partFindFirstMock.mockResolvedValueOnce(undefined)
+    insertReturningMock.mockResolvedValueOnce([
+      { id: 'ticket_part_new', ticketId: 'ticket_1', principalId: 'user_a' },
+    ])
+    const { addParticipant } = await import('../ticket.participants')
+    const result = await addParticipant({
+      ticketId: 'ticket_1' as never,
+      role: 'collaborator',
+      principalId: 'user_a' as never,
+      addedByPrincipalId: 'user_b' as never,
+    })
+    expect(result.id).toBe('ticket_part_new')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.permissions.gap.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.permissions.gap.test.ts
new file mode 100644
index 000000000..1c3858fd0
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.permissions.gap.test.ts
@@ -0,0 +1,55 @@
+/**
+ * ticket.permissions — gap tests for canCommentInternal and the
+ * undefined-shares branch of toResourceScope.
+ */
+import { describe, it, expect } from 'vitest'
+import { PERMISSIONS, type PermissionKey } from '../../authz'
+import type { PermissionSet } from '../../authz/authz.service'
+import type { PrincipalId, TeamId } from '@quackback/ids'
+import { canCommentInternal, toResourceScope } from '../ticket.permissions'
+
+const P = (s: string) => s as unknown as PrincipalId
+const T = (s: string) => s as unknown as TeamId
+
+function makeSet(opts: {
+  workspace?: PermissionKey[]
+  team?: Record<string, PermissionKey[]>
+}): PermissionSet {
+  const teamPermissions = new Map<TeamId, ReadonlySet<PermissionKey>>()
+  for (const [k, v] of Object.entries(opts.team ?? {})) {
+    teamPermissions.set(T(k), new Set(v))
+  }
+  return {
+    principalId: P('user_a'),
+    workspacePermissions: new Set(opts.workspace ?? []),
+    teamPermissions,
+    teamIds: Object.keys(opts.team ?? {}).map(T),
+  }
+}
+
+const scope = {
+  primaryTeamId: T('team_x'),
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  sharedTeamIds: [] as TeamId[],
+}
+
+describe('canCommentInternal', () => {
+  it('requires the comment_internal permission', () => {
+    const yes = makeSet({ workspace: [PERMISSIONS.TICKET_COMMENT_INTERNAL] })
+    const no = makeSet({ workspace: [PERMISSIONS.TICKET_REPLY_PUBLIC] })
+    expect(canCommentInternal(yes, scope)).toBe(true)
+    expect(canCommentInternal(no, scope)).toBe(false)
+  })
+})
+
+describe('toResourceScope', () => {
+  it('defaults sharedTeamIds to empty when shares is undefined', () => {
+    const result = toResourceScope({
+      primaryTeamId: T('team_x'),
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+    })
+    expect(result.sharedTeamIds).toEqual([])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.permissions.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.permissions.test.ts
new file mode 100644
index 000000000..82f024701
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.permissions.test.ts
@@ -0,0 +1,173 @@
+/**
+ * ticket.permissions — unit tests for the per-ticket permission helpers.
+ *
+ * Uses synthetic `PermissionSet` and `ResourceScope` objects so we can verify
+ * the exact combinations of workspace/team grants and resource shapes without
+ * touching the database.
+ */
+import { describe, it, expect } from 'vitest'
+import { PERMISSIONS, type PermissionKey } from '../../authz'
+import type { PermissionSet } from '../../authz/authz.service'
+import type { PrincipalId, TeamId } from '@quackback/ids'
+import {
+  canAssign,
+  canAssignSelf,
+  canEditFields,
+  canManageParticipants,
+  canReplyPublic,
+  canShareCrossTeam,
+  canViewTicket,
+  toResourceScope,
+} from '../ticket.permissions'
+
+const P = (s: string) => s as unknown as PrincipalId
+const T = (s: string) => s as unknown as TeamId
+
+function makeSet(opts: {
+  principalId?: PrincipalId
+  workspace?: PermissionKey[]
+  team?: Record<string, PermissionKey[]>
+  teamIds?: TeamId[]
+}): PermissionSet {
+  const teamPermissions = new Map<TeamId, ReadonlySet<PermissionKey>>()
+  for (const [k, v] of Object.entries(opts.team ?? {})) {
+    teamPermissions.set(T(k), new Set(v))
+  }
+  return {
+    principalId: opts.principalId ?? P('user_a'),
+    workspacePermissions: new Set(opts.workspace ?? []),
+    teamPermissions,
+    teamIds: opts.teamIds ?? Object.keys(opts.team ?? {}).map(T),
+  }
+}
+
+describe('toResourceScope', () => {
+  it('drops revoked shares', () => {
+    const scope = toResourceScope({
+      primaryTeamId: T('team_x'),
+      assigneePrincipalId: P('user_b'),
+      assigneeTeamId: null,
+      shares: [
+        { teamId: T('team_y'), revokedAt: null },
+        { teamId: T('team_z'), revokedAt: new Date() },
+      ],
+    })
+    expect(scope.sharedTeamIds).toEqual([T('team_y')])
+    expect(scope.primaryTeamId).toBe(T('team_x'))
+  })
+})
+
+describe('canViewTicket', () => {
+  const baseScope = {
+    primaryTeamId: T('team_x'),
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    sharedTeamIds: [] as TeamId[],
+  }
+
+  it('grants when actor has TICKET_VIEW_ALL workspace-wide', () => {
+    const set = makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ALL] })
+    expect(canViewTicket(set, baseScope)).toBe(true)
+  })
+
+  it('grants when actor is in the owning team and holds team_view', () => {
+    const set = makeSet({
+      team: { team_x: [PERMISSIONS.TICKET_VIEW_TEAM] },
+    })
+    expect(canViewTicket(set, baseScope)).toBe(true)
+  })
+
+  it('denies when actor has team_view but for a different team', () => {
+    const set = makeSet({
+      team: { team_other: [PERMISSIONS.TICKET_VIEW_TEAM] },
+    })
+    expect(canViewTicket(set, baseScope)).toBe(false)
+  })
+
+  it("grants via shared scope when ticket is shared with one of actor's teams", () => {
+    const set = makeSet({
+      teamIds: [T('team_y')],
+      workspace: [PERMISSIONS.TICKET_VIEW_SHARED],
+    })
+    expect(
+      canViewTicket(set, {
+        ...baseScope,
+        primaryTeamId: T('team_x'),
+        sharedTeamIds: [T('team_y')],
+      })
+    ).toBe(true)
+  })
+
+  it('grants via assigned scope when actor is the assignee', () => {
+    const set = makeSet({
+      principalId: P('user_a'),
+      workspace: [PERMISSIONS.TICKET_VIEW_ASSIGNED],
+    })
+    expect(
+      canViewTicket(set, {
+        ...baseScope,
+        assigneePrincipalId: P('user_a'),
+      })
+    ).toBe(true)
+  })
+})
+
+describe('canReplyPublic / canEditFields / canShareCrossTeam', () => {
+  const scope = {
+    primaryTeamId: T('team_x'),
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    sharedTeamIds: [] as TeamId[],
+  }
+
+  it('canReplyPublic respects team-scoped grant', () => {
+    const set = makeSet({ team: { team_x: [PERMISSIONS.TICKET_REPLY_PUBLIC] } })
+    expect(canReplyPublic(set, scope)).toBe(true)
+    const elsewhere = makeSet({ team: { team_y: [PERMISSIONS.TICKET_REPLY_PUBLIC] } })
+    expect(canReplyPublic(elsewhere, scope)).toBe(false)
+  })
+
+  it('canEditFields requires the explicit permission', () => {
+    const set = makeSet({ workspace: [PERMISSIONS.TICKET_REPLY_PUBLIC] })
+    expect(canEditFields(set, scope)).toBe(false)
+    const set2 = makeSet({ workspace: [PERMISSIONS.TICKET_EDIT_FIELDS] })
+    expect(canEditFields(set2, scope)).toBe(true)
+  })
+
+  it('canShareCrossTeam is gated by share_cross_team', () => {
+    const set = makeSet({ team: { team_x: [PERMISSIONS.TICKET_SHARE_CROSS_TEAM] } })
+    expect(canShareCrossTeam(set, scope)).toBe(true)
+    const noPerm = makeSet({ team: { team_x: [PERMISSIONS.TICKET_REPLY_PUBLIC] } })
+    expect(canShareCrossTeam(noPerm, scope)).toBe(false)
+  })
+
+  it('canManageParticipants checks the explicit permission', () => {
+    const yes = makeSet({ workspace: [PERMISSIONS.TICKET_MANAGE_PARTICIPANTS] })
+    const no = makeSet({ workspace: [PERMISSIONS.TICKET_REPLY_PUBLIC] })
+    expect(canManageParticipants(yes, scope)).toBe(true)
+    expect(canManageParticipants(no, scope)).toBe(false)
+  })
+})
+
+describe('canAssign / canAssignSelf', () => {
+  const scope = {
+    primaryTeamId: T('team_x'),
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    sharedTeamIds: [] as TeamId[],
+  }
+
+  it('canAssign requires assign_any (workspace or team)', () => {
+    const ws = makeSet({ workspace: [PERMISSIONS.TICKET_ASSIGN_ANY] })
+    expect(canAssign(ws, scope)).toBe(true)
+    const teamScoped = makeSet({ team: { team_x: [PERMISSIONS.TICKET_ASSIGN_ANY] } })
+    expect(canAssign(teamScoped, scope)).toBe(true)
+    const onlySelf = makeSet({ workspace: [PERMISSIONS.TICKET_ASSIGN_SELF] })
+    expect(canAssign(onlySelf, scope)).toBe(false)
+  })
+
+  it('canAssignSelf falls back to assign_self when assign_any missing', () => {
+    const onlySelf = makeSet({ workspace: [PERMISSIONS.TICKET_ASSIGN_SELF] })
+    expect(canAssignSelf(onlySelf, scope)).toBe(true)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.portal-query.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.portal-query.diffcov.test.ts
new file mode 100644
index 000000000..698e69de2
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.portal-query.diffcov.test.ts
@@ -0,0 +1,416 @@
+/**
+ * Differential-coverage tests for ticket.portal-query — the ownership-gated
+ * portal access path (identity resolution, ownership predicate branches,
+ * list/get, viewer-relationship resolution, reply/edit/close/reopen guards).
+ *
+ * All collaborators are mocked: the db (select chain + query.findFirst),
+ * principal/contact lookups, thread/ticket mutations, and status listing.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// db.select() is used both for awaited list/count queries and as inArray
+// subquery arguments. A single chain object handles both: `.where()` returns a
+// tail that is thenable (resolves to the count row) AND chainable through
+// orderBy/limit/offset (resolves to the rows).
+const m = vi.hoisted(() => {
+  const offsetMock = vi.fn()
+  const tail: Record<string, unknown> = {
+    orderBy: () => tail,
+    limit: () => tail,
+    offset: () => offsetMock(),
+    then: (resolve: (v: unknown) => void) => resolve([{ count: 7 }]),
+  }
+  return {
+    ticketsFindFirst: vi.fn(),
+    statusesFindFirst: vi.fn(),
+    participantsFindFirst: vi.fn(),
+    offsetMock,
+    selectChain: { from: () => ({ where: () => tail }) },
+  }
+})
+const { ticketsFindFirst, statusesFindFirst, participantsFindFirst, offsetMock } = m
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: vi.fn(() => m.selectChain),
+    query: {
+      tickets: { findFirst: m.ticketsFindFirst },
+      ticketStatuses: { findFirst: m.statusesFindFirst },
+      ticketParticipants: { findFirst: m.participantsFindFirst },
+    },
+  },
+  eq: vi.fn((a, b) => ({ eq: [a, b] })),
+  and: vi.fn((...a) => ({ and: a })),
+  or: vi.fn((...a) => ({ or: a })),
+  isNull: vi.fn((a) => ({ isNull: a })),
+  inArray: vi.fn((a, b) => ({ inArray: [a, b] })),
+  desc: vi.fn((a) => a),
+  sql: Object.assign(vi.fn(), { raw: vi.fn() }),
+  tickets: {
+    id: 'tickets.id',
+    requesterPrincipalId: 'tickets.requesterPrincipalId',
+    requesterContactId: 'tickets.requesterContactId',
+    deletedAt: 'tickets.deletedAt',
+    statusId: 'tickets.statusId',
+    sourceWidgetProfileId: 'tickets.sourceWidgetProfileId',
+    inboxId: 'tickets.inboxId',
+    lastActivityAt: 'tickets.lastActivityAt',
+  },
+  ticketStatuses: { id: 'ticketStatuses.id', category: 'ticketStatuses.category' },
+  ticketParticipants: {
+    ticketId: 'tp.ticketId',
+    principalId: 'tp.principalId',
+    contactId: 'tp.contactId',
+  },
+}))
+
+const getMemberByUser = vi.fn()
+const listLinksForUser = vi.fn()
+const addThread = vi.fn()
+const updateTicket = vi.fn()
+const transitionStatus = vi.fn()
+const listTicketStatuses = vi.fn()
+
+vi.mock('../../principals/principal.service', () => ({
+  getMemberByUser: (...a: unknown[]) => getMemberByUser(...a),
+}))
+vi.mock('../../organizations/contact.service', () => ({
+  listLinksForUser: (...a: unknown[]) => listLinksForUser(...a),
+}))
+vi.mock('../ticket.threads', () => ({ addThread: (...a: unknown[]) => addThread(...a) }))
+vi.mock('../ticket.service', () => ({
+  updateTicket: (...a: unknown[]) => updateTicket(...a),
+  transitionStatus: (...a: unknown[]) => transitionStatus(...a),
+}))
+vi.mock('../ticket-statuses.service', () => ({
+  listTicketStatuses: (...a: unknown[]) => listTicketStatuses(...a),
+}))
+
+import {
+  buildPortalIdentity,
+  listTicketsForPortalUser,
+  getTicketForPortalUser,
+  resolveViewerRelationship,
+  addPortalReply,
+  updatePortalTicketDescription,
+  closePortalTicket,
+  reopenPortalTicket,
+} from '../ticket.portal-query'
+
+const uid = 'user_1' as never
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  getMemberByUser.mockResolvedValue({ id: 'principal_1' })
+  listLinksForUser.mockResolvedValue([{ contactId: 'contact_1' }, { contactId: 'contact_1' }])
+  offsetMock.mockResolvedValue([{ id: 'ticket_1' }])
+  listTicketStatuses.mockResolvedValue([
+    { id: 'st_open', category: 'open' },
+    { id: 'st_solved', category: 'solved' },
+  ])
+})
+
+describe('buildPortalIdentity', () => {
+  it('dedupes linked contacts and resolves the principal', async () => {
+    const id = await buildPortalIdentity(uid)
+    expect(id).toEqual({ principalId: 'principal_1', contactIds: ['contact_1'] })
+  })
+
+  it('returns a null principal when no member row exists', async () => {
+    getMemberByUser.mockResolvedValueOnce(undefined)
+    const id = await buildPortalIdentity(uid)
+    expect(id.principalId).toBeNull()
+  })
+})
+
+describe('listTicketsForPortalUser', () => {
+  it('returns empty when the identity is empty (no ownership predicate)', async () => {
+    getMemberByUser.mockResolvedValueOnce(null)
+    listLinksForUser.mockResolvedValueOnce([])
+    const res = await listTicketsForPortalUser({ userId: uid })
+    expect(res).toEqual({ rows: [], total: 0 })
+  })
+
+  it('lists with status/widget filters and clamps the limit', async () => {
+    const res = await listTicketsForPortalUser({
+      userId: uid,
+      statusCategory: 'open' as never,
+      sourceWidgetProfileId: 'wp_1' as never,
+      limit: 9999,
+      offset: -5,
+    })
+    expect(res).toEqual({ rows: [{ id: 'ticket_1' }], total: 7 })
+  })
+
+  it('short-circuits to empty when allowedInboxIds is an empty list', async () => {
+    const res = await listTicketsForPortalUser({ userId: uid, allowedInboxIds: [] })
+    expect(res).toEqual({ rows: [], total: 0 })
+  })
+
+  it('applies a non-empty allowedInboxIds filter', async () => {
+    const res = await listTicketsForPortalUser({
+      userId: uid,
+      allowedInboxIds: ['inbox_1'] as never,
+    })
+    expect(res.total).toBe(7)
+  })
+
+  it('builds an ownership predicate from contacts only', async () => {
+    getMemberByUser.mockResolvedValueOnce(null)
+    const res = await listTicketsForPortalUser({ userId: uid })
+    expect(res.total).toBe(7)
+  })
+})
+
+describe('getTicketForPortalUser', () => {
+  it('throws NotFound when identity is empty', async () => {
+    getMemberByUser.mockResolvedValueOnce(null)
+    listLinksForUser.mockResolvedValueOnce([])
+    await expect(getTicketForPortalUser({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'not found'
+    )
+  })
+
+  it('throws NotFound when the row is missing', async () => {
+    ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(getTicketForPortalUser({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'not found'
+    )
+  })
+
+  it('returns the ticket when found', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({ id: 't1' })
+    const row = await getTicketForPortalUser({ userId: uid, ticketId: 't1' as never })
+    expect(row).toEqual({ id: 't1' })
+  })
+})
+
+describe('resolveViewerRelationship', () => {
+  const identity = { principalId: 'principal_1', contactIds: ['contact_1'] } as never
+
+  it('returns requester when the principal matches', async () => {
+    const rel = await resolveViewerRelationship(
+      { id: 't1', requesterPrincipalId: 'principal_1' } as never,
+      identity
+    )
+    expect(rel).toBe('requester')
+  })
+
+  it('returns requester when a linked contact matches', async () => {
+    const rel = await resolveViewerRelationship(
+      { id: 't1', requesterPrincipalId: 'other', requesterContactId: 'contact_1' } as never,
+      identity
+    )
+    expect(rel).toBe('requester')
+  })
+
+  it('looks up the participant role when not the requester', async () => {
+    participantsFindFirst.mockResolvedValueOnce({ role: 'collaborator' })
+    const rel = await resolveViewerRelationship({ id: 't1' } as never, identity)
+    expect(rel).toBe('collaborator')
+  })
+
+  it('falls back to watcher when no participant row is found', async () => {
+    participantsFindFirst.mockResolvedValueOnce(undefined)
+    const rel = await resolveViewerRelationship({ id: 't1' } as never, identity)
+    expect(rel).toBe('watcher')
+  })
+
+  it('returns watcher immediately when the identity is empty', async () => {
+    const rel = await resolveViewerRelationship(
+      { id: 't1' } as never,
+      { principalId: null, contactIds: [] } as never
+    )
+    expect(rel).toBe('watcher')
+    expect(participantsFindFirst).not.toHaveBeenCalled()
+  })
+})
+
+describe('addPortalReply', () => {
+  it('rejects replies to a closed ticket', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({ id: 't1', statusId: 'st_closed' })
+    statusesFindFirst.mockResolvedValueOnce({ category: 'closed' })
+    await expect(addPortalReply({ userId: uid, ticketId: 't1' as never })).rejects.toThrow('closed')
+  })
+
+  it('throws when the portal user has no principal', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({ id: 't1', requesterPrincipalId: 'principal_1' })
+    getMemberByUser.mockResolvedValueOnce({ id: 'principal_1' }) // for getTicketForPortalUser identity
+    getMemberByUser.mockResolvedValueOnce(undefined) // the explicit member check
+    await expect(addPortalReply({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'no principal'
+    )
+  })
+
+  it('denies a watcher and allows a requester', async () => {
+    // watcher: ticket has no requester match + participant role watcher
+    ticketsFindFirst.mockResolvedValueOnce({ id: 't1', statusId: null })
+    participantsFindFirst.mockResolvedValueOnce({ role: 'watcher' })
+    await expect(addPortalReply({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'cannot reply'
+    )
+
+    // requester: principal matches → reply created
+    ticketsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      statusId: null,
+      requesterPrincipalId: 'principal_1',
+    })
+    addThread.mockResolvedValueOnce({ id: 'thread_1' })
+    const thread = await addPortalReply({
+      userId: uid,
+      ticketId: 't1' as never,
+      bodyText: 'hi',
+    })
+    expect(thread).toEqual({ id: 'thread_1' })
+  })
+})
+
+describe('updatePortalTicketDescription', () => {
+  it('rejects edits to a closed ticket', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({ id: 't1', statusId: 'st_closed' })
+    statusesFindFirst.mockResolvedValueOnce({ category: 'closed' })
+    await expect(
+      updatePortalTicketDescription({
+        userId: uid,
+        ticketId: 't1' as never,
+        expectedUpdatedAt: new Date(),
+      })
+    ).rejects.toThrow('closed')
+  })
+
+  it('denies a non-requester/collaborator role', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({ id: 't1', statusId: null })
+    participantsFindFirst.mockResolvedValueOnce({ role: 'cc' })
+    await expect(
+      updatePortalTicketDescription({
+        userId: uid,
+        ticketId: 't1' as never,
+        expectedUpdatedAt: new Date(),
+      })
+    ).rejects.toThrow('cannot edit')
+  })
+
+  it('updates the description for the requester', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      statusId: null,
+      requesterPrincipalId: 'principal_1',
+    })
+    updateTicket.mockResolvedValueOnce({ id: 't1' })
+    const res = await updatePortalTicketDescription({
+      userId: uid,
+      ticketId: 't1' as never,
+      expectedUpdatedAt: new Date('2026-01-01'),
+      descriptionText: 'x',
+    })
+    expect(res).toEqual({ id: 't1' })
+    expect(updateTicket).toHaveBeenCalled()
+  })
+})
+
+describe('closePortalTicket', () => {
+  it('denies a non-requester', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({ id: 't1' })
+    participantsFindFirst.mockResolvedValueOnce({ role: 'collaborator' })
+    await expect(closePortalTicket({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'requester'
+    )
+  })
+
+  it('rejects when the ticket is not in an active category', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      requesterPrincipalId: 'principal_1',
+      statusId: 'st_solved',
+    })
+    statusesFindFirst.mockResolvedValueOnce({ category: 'solved' })
+    await expect(closePortalTicket({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'not in an active state'
+    )
+  })
+
+  it('transitions an active ticket to the solved status', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      requesterPrincipalId: 'principal_1',
+      statusId: 'st_open',
+      updatedAt: new Date('2026-01-01'),
+    })
+    statusesFindFirst.mockResolvedValueOnce({ category: 'open' })
+    transitionStatus.mockResolvedValueOnce({ id: 't1' })
+    const res = await closePortalTicket({ userId: uid, ticketId: 't1' as never })
+    expect(res).toEqual({ id: 't1' })
+    expect(transitionStatus).toHaveBeenCalledWith(
+      't1',
+      expect.objectContaining({ statusId: 'st_solved' })
+    )
+  })
+
+  it('throws when no solved status is configured', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      requesterPrincipalId: 'principal_1',
+      statusId: 'st_open',
+      updatedAt: new Date(),
+    })
+    statusesFindFirst.mockResolvedValueOnce({ category: 'open' })
+    listTicketStatuses.mockResolvedValueOnce([{ id: 'st_open', category: 'open' }])
+    await expect(closePortalTicket({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'no solved status'
+    )
+  })
+})
+
+describe('reopenPortalTicket', () => {
+  it('denies a non-requester', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({ id: 't1' })
+    participantsFindFirst.mockResolvedValueOnce({ role: 'collaborator' })
+    await expect(reopenPortalTicket({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'requester'
+    )
+  })
+
+  it('rejects when the ticket is not solved', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      requesterPrincipalId: 'principal_1',
+      statusId: 'st_open',
+    })
+    statusesFindFirst.mockResolvedValueOnce({ category: 'open' })
+    await expect(reopenPortalTicket({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'only solved tickets'
+    )
+  })
+
+  it('reopens a solved ticket to the first open status', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      requesterPrincipalId: 'principal_1',
+      statusId: 'st_solved',
+      updatedAt: new Date(),
+    })
+    statusesFindFirst.mockResolvedValueOnce({ category: 'solved' })
+    transitionStatus.mockResolvedValueOnce({ id: 't1' })
+    const res = await reopenPortalTicket({ userId: uid, ticketId: 't1' as never })
+    expect(transitionStatus).toHaveBeenCalledWith(
+      't1',
+      expect.objectContaining({ statusId: 'st_open' })
+    )
+    expect(res).toEqual({ id: 't1' })
+  })
+
+  it('throws when no open status is configured', async () => {
+    ticketsFindFirst.mockResolvedValueOnce({
+      id: 't1',
+      requesterPrincipalId: 'principal_1',
+      statusId: 'st_solved',
+      updatedAt: new Date(),
+    })
+    statusesFindFirst.mockResolvedValueOnce({ category: 'solved' })
+    listTicketStatuses.mockResolvedValueOnce([{ id: 'st_solved', category: 'solved' }])
+    await expect(reopenPortalTicket({ userId: uid, ticketId: 't1' as never })).rejects.toThrow(
+      'no open status'
+    )
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.portal-query.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.portal-query.test.ts
new file mode 100644
index 000000000..0e296a90f
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.portal-query.test.ts
@@ -0,0 +1,294 @@
+/**
+ * Portal-side ticket query — ownership predicate + access negative paths.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const getMemberByUserMock = vi.fn()
+const listLinksForUserMock = vi.fn()
+const addThreadMock = vi.fn()
+
+const ticketsFindFirstMock = vi.fn()
+const ticketStatusesFindFirstMock = vi.fn()
+const ticketParticipantsFindFirstMock = vi.fn()
+const rowsResultMock = vi.fn<() => unknown[]>()
+const countResultMock = vi.fn<() => Array<{ count: number }>>()
+/** Captures the WHERE arg for top-level rows / count queries (in call order). */
+const capturedWhereCalls: Array<{ kind: 'rows' | 'count'; where: any }> = []
+
+vi.mock('../../principals/principal.service', () => ({
+  getMemberByUser: (...args: unknown[]) => getMemberByUserMock(...args),
+}))
+
+vi.mock('../../organizations/contact.service', () => ({
+  listLinksForUser: (...args: unknown[]) => listLinksForUserMock(...args),
+}))
+
+vi.mock('../ticket.threads', () => ({
+  addThread: (...args: unknown[]) => addThreadMock(...args),
+}))
+
+vi.mock('@/lib/server/db', () => {
+  // Each `db.select()` produces a fresh chain. Whether it ends up being the
+  // ROWS query (.limit().offset() awaited) or the COUNT query (.where() awaited
+  // directly) is decided by which terminator the caller uses.
+  function makeChain() {
+    const chain: any = {}
+    let lastWhere: any = null
+    let isFromTickets = false
+    chain.from = vi.fn((tbl: any) => {
+      isFromTickets = tbl?._name === 'tickets'
+      return chain
+    })
+    chain.where = vi.fn((arg: any) => {
+      lastWhere = arg
+      // Make the chain thenable so the count query (awaits after .where) works.
+      // Only do this for top-level queries (from tickets); subqueries are passed
+      // opaquely into inArray() and never awaited.
+      if (isFromTickets) {
+        chain.then = (resolve: (v: unknown) => unknown) => {
+          capturedWhereCalls.push({ kind: 'count', where: lastWhere })
+          return Promise.resolve(countResultMock()).then(resolve)
+        }
+      }
+      return chain
+    })
+    chain.orderBy = vi.fn(() => chain)
+    chain.limit = vi.fn(() => chain)
+    chain.offset = vi.fn(() => {
+      // Once .offset() is called we know this is the rows query — strip the
+      // count thenable and resolve to row data instead.
+      delete chain.then
+      capturedWhereCalls.push({ kind: 'rows', where: lastWhere })
+      return Promise.resolve(rowsResultMock())
+    })
+    return chain
+  }
+
+  return {
+    db: {
+      query: {
+        tickets: { findFirst: ticketsFindFirstMock },
+        ticketStatuses: { findFirst: ticketStatusesFindFirstMock },
+        ticketParticipants: { findFirst: ticketParticipantsFindFirstMock },
+      },
+      select: vi.fn(() => makeChain()),
+      insert: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+    },
+    eq: vi.fn((col, val) => ({ _op: 'eq', col, val })),
+    and: vi.fn((...args) => ({ _op: 'and', args })),
+    or: vi.fn((...args) => ({ _op: 'or', args })),
+    isNull: vi.fn((col) => ({ _op: 'isNull', col })),
+    inArray: vi.fn((col, vals) => ({ _op: 'inArray', col, vals })),
+    desc: vi.fn(),
+    asc: vi.fn(),
+    sql: Object.assign(
+      vi.fn(() => 'sql_frag'),
+      { raw: vi.fn() }
+    ),
+    tickets: {
+      _name: 'tickets',
+      id: 'tickets.id',
+      requesterPrincipalId: 'tickets.requester_principal_id',
+      requesterContactId: 'tickets.requester_contact_id',
+      statusId: 'tickets.status_id',
+      deletedAt: 'tickets.deleted_at',
+      lastActivityAt: 'tickets.last_activity_at',
+    },
+    ticketStatuses: {
+      _name: 'ticket_statuses',
+      id: 'ticket_statuses.id',
+      category: 'ticket_statuses.category',
+    },
+    ticketParticipants: {
+      _name: 'ticket_participants',
+      ticketId: 'ticket_participants.ticket_id',
+      principalId: 'ticket_participants.principal_id',
+      contactId: 'ticket_participants.contact_id',
+    },
+  }
+})
+
+vi.mock('@/lib/shared/errors', () => {
+  class DomainErr extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return {
+    ConflictError: DomainErr,
+    NotFoundError: DomainErr,
+    ValidationError: DomainErr,
+    ForbiddenError: DomainErr,
+  }
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  getMemberByUserMock.mockReset()
+  listLinksForUserMock.mockReset()
+  addThreadMock.mockReset()
+  ticketsFindFirstMock.mockReset()
+  ticketStatusesFindFirstMock.mockReset()
+  ticketParticipantsFindFirstMock.mockReset()
+  rowsResultMock.mockReset()
+  countResultMock.mockReset()
+  capturedWhereCalls.length = 0
+  rowsResultMock.mockReturnValue([])
+  countResultMock.mockReturnValue([{ count: 0 }])
+})
+
+function findOwnership(): any {
+  const top = capturedWhereCalls.find((c) => c.kind === 'rows')
+  if (!top) return null
+  // top.where = and(isNull(deletedAt), ownership, [statusFilter?])
+  const andArgs: any[] = top.where?.args ?? []
+  return andArgs.find((a) => a?._op === 'or' || a?._op === 'eq' || a?._op === 'inArray')
+}
+
+function ownershipBranches(): any[] {
+  const o = findOwnership()
+  if (!o) return []
+  return o._op === 'or' ? o.args : [o]
+}
+
+describe('listTicketsForPortalUser', () => {
+  it('returns empty without DB hit when identity is empty', async () => {
+    getMemberByUserMock.mockResolvedValueOnce(null)
+    listLinksForUserMock.mockResolvedValueOnce([])
+    const { listTicketsForPortalUser } = await import('../ticket.portal-query')
+    const result = await listTicketsForPortalUser({ userId: 'user_x' as never })
+    expect(result).toEqual({ rows: [], total: 0 })
+    expect(rowsResultMock).not.toHaveBeenCalled()
+  })
+
+  it('builds a requester-principal branch when only principal is present', async () => {
+    getMemberByUserMock.mockResolvedValueOnce({ id: 'principal_1' })
+    listLinksForUserMock.mockResolvedValueOnce([])
+    rowsResultMock.mockReturnValue([{ id: 'ticket_1' }])
+    countResultMock.mockReturnValue([{ count: 1 }])
+    const { listTicketsForPortalUser } = await import('../ticket.portal-query')
+    const result = await listTicketsForPortalUser({ userId: 'user_1' as never })
+    expect(result.total).toBe(1)
+    const branches = ownershipBranches()
+    expect(
+      branches.some(
+        (b) =>
+          b?._op === 'eq' && b.col === 'tickets.requester_principal_id' && b.val === 'principal_1'
+      )
+    ).toBe(true)
+  })
+
+  it('builds a contact branch when only links are present', async () => {
+    getMemberByUserMock.mockResolvedValueOnce(null)
+    listLinksForUserMock.mockResolvedValueOnce([
+      { contactId: 'contact_a' },
+      { contactId: 'contact_b' },
+    ])
+    const { listTicketsForPortalUser } = await import('../ticket.portal-query')
+    await listTicketsForPortalUser({ userId: 'user_2' as never })
+    const branches = ownershipBranches()
+    expect(
+      branches.some(
+        (b) =>
+          b?._op === 'inArray' &&
+          b.col === 'tickets.requester_contact_id' &&
+          Array.isArray(b.vals) &&
+          b.vals.length === 2
+      )
+    ).toBe(true)
+  })
+
+  it('includes the participant subquery branch when identity is non-empty', async () => {
+    getMemberByUserMock.mockResolvedValueOnce({ id: 'principal_3' })
+    listLinksForUserMock.mockResolvedValueOnce([])
+    const { listTicketsForPortalUser } = await import('../ticket.portal-query')
+    await listTicketsForPortalUser({ userId: 'user_3' as never })
+    const branches = ownershipBranches()
+    expect(branches.some((b) => b?._op === 'inArray' && b.col === 'tickets.id')).toBe(true)
+  })
+})
+
+describe('getTicketForPortalUser', () => {
+  it('throws NotFoundError when identity is empty', async () => {
+    getMemberByUserMock.mockResolvedValueOnce(null)
+    listLinksForUserMock.mockResolvedValueOnce([])
+    const { getTicketForPortalUser } = await import('../ticket.portal-query')
+    await expect(
+      getTicketForPortalUser({ userId: 'user_x' as never, ticketId: 'ticket_1' as never })
+    ).rejects.toMatchObject({ code: 'TICKET_NOT_FOUND' })
+    expect(ticketsFindFirstMock).not.toHaveBeenCalled()
+  })
+
+  it('throws NotFoundError (not Forbidden) when predicate misses', async () => {
+    getMemberByUserMock.mockResolvedValueOnce({ id: 'principal_1' })
+    listLinksForUserMock.mockResolvedValueOnce([])
+    ticketsFindFirstMock.mockResolvedValueOnce(undefined)
+    const { getTicketForPortalUser } = await import('../ticket.portal-query')
+    await expect(
+      getTicketForPortalUser({ userId: 'user_1' as never, ticketId: 'ticket_1' as never })
+    ).rejects.toMatchObject({ code: 'TICKET_NOT_FOUND' })
+  })
+
+  it('returns the ticket when ownership matches', async () => {
+    getMemberByUserMock.mockResolvedValueOnce({ id: 'principal_1' })
+    listLinksForUserMock.mockResolvedValueOnce([])
+    ticketsFindFirstMock.mockResolvedValueOnce({ id: 'ticket_1', subject: 'Hi' })
+    const { getTicketForPortalUser } = await import('../ticket.portal-query')
+    const t = await getTicketForPortalUser({
+      userId: 'user_1' as never,
+      ticketId: 'ticket_1' as never,
+    })
+    expect(t.id).toBe('ticket_1')
+  })
+})
+
+describe('addPortalReply', () => {
+  it('rejects when status category is closed', async () => {
+    getMemberByUserMock.mockResolvedValue({ id: 'principal_1' })
+    listLinksForUserMock.mockResolvedValue([])
+    ticketsFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_1',
+      statusId: 'ticket_status_closed',
+    })
+    ticketStatusesFindFirstMock.mockResolvedValueOnce({ category: 'closed' })
+    const { addPortalReply } = await import('../ticket.portal-query')
+    await expect(
+      addPortalReply({
+        userId: 'user_1' as never,
+        ticketId: 'ticket_1' as never,
+        bodyText: 'hi',
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_CLOSED' })
+    expect(addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('calls addThread with audience=public and the user principal', async () => {
+    getMemberByUserMock.mockResolvedValue({ id: 'principal_1' })
+    listLinksForUserMock.mockResolvedValue([])
+    ticketsFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_1',
+      statusId: 'ticket_status_open',
+    })
+    ticketStatusesFindFirstMock.mockResolvedValueOnce({ category: 'open' })
+    ticketParticipantsFindFirstMock.mockResolvedValueOnce({ role: 'collaborator' })
+    addThreadMock.mockResolvedValueOnce({ id: 'thread_1', audience: 'public' })
+    const { addPortalReply } = await import('../ticket.portal-query')
+    const result = await addPortalReply({
+      userId: 'user_1' as never,
+      ticketId: 'ticket_1' as never,
+      bodyText: 'hi',
+    })
+    expect(result.id).toBe('thread_1')
+    expect(addThreadMock).toHaveBeenCalledWith({
+      ticketId: 'ticket_1',
+      principalId: 'principal_1',
+      audience: 'public',
+      bodyJson: null,
+      bodyText: 'hi',
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.query.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.query.diffcov.test.ts
new file mode 100644
index 000000000..777449ed5
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.query.diffcov.test.ts
@@ -0,0 +1,213 @@
+/**
+ * Differential-coverage tests for ticket.query — the listTickets filter matrix
+ * (inbox/org/contact null-vs-value, status ids/category, search, sort) and the
+ * scope→permission gate in buildScopeWhere across every queue scope, including
+ * the denied, degraded (no team), and invalid-scope branches.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => {
+  const offsetMock = vi.fn()
+  const tail: Record<string, unknown> = {
+    orderBy: () => tail,
+    limit: () => tail,
+    offset: () => offsetMock(),
+    then: (resolve: (v: unknown) => void) => resolve([{ count: 3 }]),
+  }
+  return {
+    offsetMock,
+    selectChain: { from: () => ({ where: () => tail }) },
+    PERMISSIONS: {
+      TICKET_VIEW_ALL: 'ticket.view_all',
+      TICKET_VIEW_TEAM: 'ticket.view_team',
+      TICKET_VIEW_ASSIGNED: 'ticket.view_assigned',
+      TICKET_VIEW_SHARED: 'ticket.view_shared',
+      INBOX_VIEW: 'inbox.view',
+    },
+  }
+})
+
+vi.mock('@/lib/server/db', () => ({
+  db: { select: vi.fn(() => m.selectChain) },
+  eq: vi.fn((a, b) => ({ eq: [a, b] })),
+  and: vi.fn((...a) => ({ and: a })),
+  or: vi.fn((...a) => ({ or: a })),
+  isNull: vi.fn((a) => ({ isNull: a })),
+  inArray: vi.fn((a, b) => ({ inArray: [a, b] })),
+  desc: vi.fn((a) => ({ desc: a })),
+  asc: vi.fn((a) => ({ asc: a })),
+  ilike: vi.fn((a, b) => ({ ilike: [a, b] })),
+  sql: vi.fn((s) => ({ sql: s })),
+  tickets: {
+    id: 't.id',
+    deletedAt: 't.deletedAt',
+    inboxId: 't.inboxId',
+    organizationId: 't.organizationId',
+    requesterContactId: 't.requesterContactId',
+    statusId: 't.statusId',
+    subject: 't.subject',
+    descriptionText: 't.descriptionText',
+    createdAt: 't.createdAt',
+    lastActivityAt: 't.lastActivityAt',
+    assigneePrincipalId: 't.assigneePrincipalId',
+    assigneeTeamId: 't.assigneeTeamId',
+    primaryTeamId: 't.primaryTeamId',
+  },
+  ticketShares: { ticketId: 'ts.ticketId', teamId: 'ts.teamId', revokedAt: 'ts.revokedAt' },
+  ticketStatuses: { id: 'tst.id', category: 'tst.category' },
+  inboxMemberships: { inboxId: 'im.inboxId', principalId: 'im.principalId' },
+}))
+
+const PERMISSIONS = m.PERMISSIONS
+vi.mock('../../authz', () => ({ PERMISSIONS: m.PERMISSIONS }))
+vi.mock('../../authz/authz.service', () => ({
+  hasPermission: (
+    set: { workspacePermissions: Set<string>; teamPermissions: Map<string, Set<string>> },
+    perm: string
+  ) =>
+    set.workspacePermissions.has(perm) ||
+    [...set.teamPermissions.values()].some((s) => s.has(perm)),
+}))
+
+import { listTickets } from '../ticket.query'
+
+const makeSet = (
+  opts: {
+    workspace?: string[]
+    teams?: Record<string, string[]>
+    teamIds?: string[]
+    principalId?: string
+  } = {}
+) => ({
+  principalId: (opts.principalId ?? 'p1') as never,
+  teamIds: (opts.teamIds ?? []) as never,
+  workspacePermissions: new Set(opts.workspace ?? []),
+  teamPermissions: new Map(Object.entries(opts.teams ?? {}).map(([k, v]) => [k, new Set(v)])),
+})
+
+const list = (
+  scope: string,
+  set: ReturnType<typeof makeSet>,
+  extra: Record<string, unknown> = {}
+) => listTickets({ scope, permissionSet: set, ...extra } as never)
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.offsetMock.mockResolvedValue([{ id: 'ticket_1' }])
+})
+
+describe('listTickets filter matrix (scope=all)', () => {
+  const all = () => makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ALL] })
+
+  it('applies value filters, status ids, category, search, and created_desc sort', async () => {
+    const res = await list('all', all(), {
+      inboxId: 'inbox_1',
+      organizationId: 'org_1',
+      requesterContactId: 'contact_1',
+      statusIds: ['st_1'],
+      statusCategory: 'open',
+      search: '  hello  ',
+      sort: 'created_desc',
+      limit: 9999,
+      offset: -3,
+    })
+    expect(res).toEqual({ rows: [{ id: 'ticket_1' }], total: 3 })
+  })
+
+  it('applies null filters (inbox/org/contact null) and created_asc sort', async () => {
+    const res = await list('all', all(), {
+      inboxId: null,
+      organizationId: null,
+      requesterContactId: null,
+      sort: 'created_asc',
+    })
+    expect(res.total).toBe(3)
+  })
+
+  it('runs with no optional filters and default sort', async () => {
+    const res = await list('all', all())
+    expect(res.total).toBe(3)
+  })
+})
+
+describe('buildScopeWhere permission gates', () => {
+  it('all: allowed with view_all, denied otherwise', async () => {
+    await expect(
+      list('all', makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ALL] }))
+    ).resolves.toBeTruthy()
+    await expect(list('all', makeSet())).rejects.toThrow('view_all')
+  })
+
+  it('my_assigned: allowed with view_assigned, denied without', async () => {
+    await expect(
+      list('my_assigned', makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ASSIGNED] }))
+    ).resolves.toBeTruthy()
+    await expect(list('my_assigned', makeSet())).rejects.toThrow('my_assigned')
+  })
+
+  it('my_team: team grant, workspace grant with no teams (degraded), and denied', async () => {
+    await expect(
+      list(
+        'my_team',
+        makeSet({ teams: { team_1: [PERMISSIONS.TICKET_VIEW_TEAM] }, teamIds: ['team_1'] })
+      )
+    ).resolves.toBeTruthy()
+    // view_all but no team memberships -> degrades to false, still resolves
+    await expect(
+      list('my_team', makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ALL] }))
+    ).resolves.toBeTruthy()
+    await expect(list('my_team', makeSet())).rejects.toThrow('my_team')
+  })
+
+  it('shared_with_me: with teams, empty teams (false), and denied', async () => {
+    await expect(
+      list(
+        'shared_with_me',
+        makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_SHARED], teamIds: ['team_1'] })
+      )
+    ).resolves.toBeTruthy()
+    await expect(
+      list('shared_with_me', makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_SHARED] }))
+    ).resolves.toBeTruthy()
+    await expect(list('shared_with_me', makeSet())).rejects.toThrow('shared_with_me')
+  })
+
+  it('unassigned: view_all base, team-scoped, empty teams (false), and denied', async () => {
+    await expect(
+      list('unassigned', makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ALL] }))
+    ).resolves.toBeTruthy()
+    await expect(
+      list(
+        'unassigned',
+        makeSet({ teams: { team_1: [PERMISSIONS.TICKET_VIEW_TEAM] }, teamIds: ['team_1'] })
+      )
+    ).resolves.toBeTruthy()
+    await expect(
+      list('unassigned', makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_TEAM] }))
+    ).resolves.toBeTruthy()
+    await expect(list('unassigned', makeSet())).rejects.toThrow('unassigned')
+  })
+
+  it('my_inbox: allowed with inbox.view, denied without', async () => {
+    await expect(
+      list('my_inbox', makeSet({ workspace: [PERMISSIONS.INBOX_VIEW] }))
+    ).resolves.toBeTruthy()
+    await expect(list('my_inbox', makeSet())).rejects.toThrow('my_inbox')
+  })
+
+  it('inbox: requires permission and an inboxId', async () => {
+    await expect(
+      list('inbox', makeSet({ workspace: [PERMISSIONS.INBOX_VIEW] }), { inboxId: 'inbox_1' })
+    ).resolves.toBeTruthy()
+    await expect(list('inbox', makeSet({ workspace: [PERMISSIONS.INBOX_VIEW] }))).rejects.toThrow(
+      'inboxId is required'
+    )
+    await expect(list('inbox', makeSet())).rejects.toThrow('inbox.view')
+  })
+
+  it('rejects an unknown scope', async () => {
+    await expect(
+      list('bogus', makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ALL] }))
+    ).rejects.toThrow('unknown scope')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.query.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.query.test.ts
new file mode 100644
index 000000000..5cff45e24
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.query.test.ts
@@ -0,0 +1,166 @@
+/**
+ * ticket.query — verifies that scope→permission gating is enforced and that
+ * each scope produces the expected SQL filter shape (asserted via mock spies).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { PERMISSIONS, type PermissionKey } from '../../authz'
+import type { PermissionSet } from '../../authz/authz.service'
+import type { PrincipalId, TeamId } from '@quackback/ids'
+
+const selectChainOrderByMock = vi.fn()
+
+const selectChain = {
+  from: vi.fn().mockReturnThis(),
+  where: vi.fn().mockReturnThis(),
+  orderBy: selectChainOrderByMock,
+}
+
+vi.mock('@/lib/server/db', () => {
+  const limitMock = vi.fn().mockReturnThis()
+  const offsetMock = vi.fn().mockResolvedValue([])
+  selectChainOrderByMock.mockImplementation(() => ({ limit: limitMock, offset: offsetMock }))
+  const countSelect = {
+    from: vi.fn().mockReturnThis(),
+    where: vi.fn().mockResolvedValue([{ count: 0 }]),
+  }
+  return {
+    db: {
+      select: vi.fn((shape?: { count?: unknown }) => {
+        if (shape && 'count' in shape) return countSelect
+        return selectChain
+      }),
+    },
+    eq: vi.fn(),
+    and: vi.fn((...a: unknown[]) => ({ kind: 'and', args: a })),
+    or: vi.fn((...a: unknown[]) => ({ kind: 'or', args: a })),
+    isNull: vi.fn(() => ({ kind: 'isNull' })),
+    isNotNull: vi.fn(() => ({ kind: 'isNotNull' })),
+    inArray: vi.fn((col, vals) => ({ kind: 'inArray', col, vals })),
+    desc: vi.fn(() => 'DESC'),
+    asc: vi.fn(() => 'ASC'),
+    ilike: vi.fn(() => ({ kind: 'ilike' })),
+    sql: Object.assign((..._a: unknown[]) => ({ kind: 'sql' }), { raw: vi.fn() }),
+    tickets: {
+      _name: 'tickets',
+      id: 'tickets.id',
+      assigneePrincipalId: 'tickets.assignee_principal_id',
+      assigneeTeamId: 'tickets.assignee_team_id',
+      primaryTeamId: 'tickets.primary_team_id',
+      statusId: 'tickets.status_id',
+      subject: 'tickets.subject',
+      descriptionText: 'tickets.description_text',
+      lastActivityAt: 'tickets.last_activity_at',
+      createdAt: 'tickets.created_at',
+      deletedAt: 'tickets.deleted_at',
+    },
+    ticketShares: {
+      _name: 'ticket_shares',
+      ticketId: 'shares.ticket_id',
+      teamId: 'shares.team_id',
+      revokedAt: 'shares.revoked_at',
+    },
+    ticketStatuses: {
+      _name: 'ticket_statuses',
+      id: 'ticket_statuses.id',
+      category: 'ticket_statuses.category',
+    },
+  }
+})
+
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ForbiddenError: E, ValidationError: E }
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+const P = (s: string) => s as unknown as PrincipalId
+const T = (s: string) => s as unknown as TeamId
+
+function makeSet(opts: {
+  principalId?: PrincipalId
+  workspace?: PermissionKey[]
+  team?: Record<string, PermissionKey[]>
+  teamIds?: TeamId[]
+}): PermissionSet {
+  const teamPermissions = new Map<TeamId, ReadonlySet<PermissionKey>>()
+  for (const [k, v] of Object.entries(opts.team ?? {})) {
+    teamPermissions.set(T(k), new Set(v))
+  }
+  return {
+    principalId: opts.principalId ?? P('user_a'),
+    workspacePermissions: new Set(opts.workspace ?? []),
+    teamPermissions,
+    teamIds: opts.teamIds ?? Object.keys(opts.team ?? {}).map(T),
+  }
+}
+
+describe('listTickets scope gating', () => {
+  it('rejects "all" scope without TICKET_VIEW_ALL', async () => {
+    const { listTickets } = await import('../ticket.query')
+    await expect(
+      listTickets({
+        scope: 'all',
+        permissionSet: makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_TEAM] }),
+      })
+    ).rejects.toThrow(/view_all/i)
+  })
+
+  it('allows "all" scope when TICKET_VIEW_ALL granted', async () => {
+    const { listTickets } = await import('../ticket.query')
+    await expect(
+      listTickets({
+        scope: 'all',
+        permissionSet: makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ALL] }),
+      })
+    ).resolves.toBeDefined()
+  })
+
+  it('rejects "my_team" without team-view perm', async () => {
+    const { listTickets } = await import('../ticket.query')
+    await expect(
+      listTickets({
+        scope: 'my_team',
+        permissionSet: makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ASSIGNED] }),
+      })
+    ).rejects.toThrow(/view_team/i)
+  })
+
+  it('rejects "shared_with_me" without view_shared perm', async () => {
+    const { listTickets } = await import('../ticket.query')
+    await expect(
+      listTickets({
+        scope: 'shared_with_me',
+        permissionSet: makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ASSIGNED] }),
+      })
+    ).rejects.toThrow(/view_shared/i)
+  })
+
+  it('rejects "unassigned" without view_team or view_all', async () => {
+    const { listTickets } = await import('../ticket.query')
+    await expect(
+      listTickets({
+        scope: 'unassigned',
+        permissionSet: makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ASSIGNED] }),
+      })
+    ).rejects.toThrow(/view_team/i)
+  })
+
+  it('allows "my_assigned" with view_assigned', async () => {
+    const { listTickets } = await import('../ticket.query')
+    await expect(
+      listTickets({
+        scope: 'my_assigned',
+        permissionSet: makeSet({ workspace: [PERMISSIONS.TICKET_VIEW_ASSIGNED] }),
+      })
+    ).resolves.toBeDefined()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.recipients.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.recipients.test.ts
new file mode 100644
index 000000000..21e6d989e
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.recipients.test.ts
@@ -0,0 +1,161 @@
+/**
+ * ticket.recipients — portal-aware recipient resolver.
+ *
+ * Locks the contract used by the notification dispatcher:
+ *   - contact-only participants AND requesterContactId expand to portal
+ *     principals via `contact_user_links`,
+ *   - direct-`principalId` participants are returned but NOT marked as
+ *     portal-linked (they're addressable by RBAC),
+ *   - empty input never issues SQL,
+ *   - duplicates are deduped.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// ---------------------------------------------------------------------------
+// SQL chain mocks
+// ---------------------------------------------------------------------------
+
+const participantRows: Array<{ principalId: string | null; contactId: string | null }> = []
+const principalLinkRows: Array<{ id: string }> = []
+const innerJoinSpy = vi.fn()
+const whereSpyParticipants = vi.fn()
+const whereSpyLinks = vi.fn()
+
+vi.mock('@/lib/server/db', () => {
+  function makeSelectChain() {
+    const chain: { from: ReturnType<typeof vi.fn>; where: ReturnType<typeof vi.fn> } = {
+      from: vi.fn((tbl: { _name: string }) => {
+        const isParticipants = tbl?._name === 'ticket_participants'
+        chain.where = vi.fn((arg: unknown) => {
+          if (isParticipants) {
+            whereSpyParticipants(arg)
+            return Promise.resolve(participantRows)
+          }
+          return Promise.resolve([])
+        })
+        return chain
+      }),
+      where: vi.fn(),
+    }
+    return chain
+  }
+
+  function makeSelectDistinctChain() {
+    const chain: {
+      from: ReturnType<typeof vi.fn>
+      innerJoin: ReturnType<typeof vi.fn>
+      where: ReturnType<typeof vi.fn>
+    } = {
+      from: vi.fn(() => chain),
+      innerJoin: vi.fn((tbl: unknown, on: unknown) => {
+        innerJoinSpy(tbl, on)
+        return chain
+      }),
+      where: vi.fn((arg: unknown) => {
+        whereSpyLinks(arg)
+        return Promise.resolve(principalLinkRows)
+      }),
+    }
+    return chain
+  }
+
+  return {
+    db: {
+      select: vi.fn(() => makeSelectChain()),
+      selectDistinct: vi.fn(() => makeSelectDistinctChain()),
+    },
+    eq: vi.fn((col, val) => ({ _op: 'eq', col, val })),
+    inArray: vi.fn((col, vals) => ({ _op: 'inArray', col, vals })),
+    contactUserLinks: {
+      _name: 'contact_user_links',
+      contactId: 'contact_user_links.contact_id',
+      userId: 'contact_user_links.user_id',
+    },
+    principal: {
+      _name: 'principal',
+      id: 'principal.id',
+      userId: 'principal.user_id',
+    },
+    ticketParticipants: {
+      _name: 'ticket_participants',
+      ticketId: 'ticket_participants.ticket_id',
+      principalId: 'ticket_participants.principal_id',
+      contactId: 'ticket_participants.contact_id',
+    },
+  }
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  participantRows.length = 0
+  principalLinkRows.length = 0
+})
+
+describe('resolvePrincipalsForContacts', () => {
+  it('returns deduped principal IDs for the linked users', async () => {
+    principalLinkRows.push({ id: 'principal_a' }, { id: 'principal_b' })
+    const { resolvePrincipalsForContacts } = await import('../ticket.recipients')
+    const result = await resolvePrincipalsForContacts(['contact_1' as never, 'contact_2' as never])
+    expect(result).toEqual(['principal_a', 'principal_b'])
+    expect(whereSpyLinks).toHaveBeenCalledTimes(1)
+  })
+
+  it('short-circuits on empty input without issuing SQL', async () => {
+    const { resolvePrincipalsForContacts } = await import('../ticket.recipients')
+    const result = await resolvePrincipalsForContacts([])
+    expect(result).toEqual([])
+    expect(whereSpyLinks).not.toHaveBeenCalled()
+  })
+})
+
+describe('resolvePortalLinkedRecipients', () => {
+  it('expands requesterContactId + contact-participants and flags portalLinked', async () => {
+    participantRows.push(
+      { principalId: null, contactId: 'contact_part' },
+      { principalId: 'principal_direct', contactId: null }
+    )
+    principalLinkRows.push({ id: 'principal_portal_a' }, { id: 'principal_portal_b' })
+
+    const { resolvePortalLinkedRecipients } = await import('../ticket.recipients')
+    const result = await resolvePortalLinkedRecipients({
+      id: 'ticket_1' as never,
+      requesterContactId: 'contact_req' as never,
+    })
+
+    // principalIds = direct ∪ portal-linked (deduped)
+    expect([...result.principalIds].sort()).toEqual(
+      ['principal_direct', 'principal_portal_a', 'principal_portal_b'].sort()
+    )
+    // portalLinked excludes the direct participant.
+    expect(Array.from(result.portalLinked).sort()).toEqual(
+      ['principal_portal_a', 'principal_portal_b'].sort()
+    )
+    expect(result.portalLinked.has('principal_direct' as never)).toBe(false)
+  })
+
+  it('returns empty sets when ticket has no contact-side references', async () => {
+    // No participants, no requesterContactId → no contact-link query at all.
+    const { resolvePortalLinkedRecipients } = await import('../ticket.recipients')
+    const result = await resolvePortalLinkedRecipients({
+      id: 'ticket_1' as never,
+      requesterContactId: null,
+    })
+    expect(result.principalIds).toEqual([])
+    expect(result.portalLinked.size).toBe(0)
+    expect(whereSpyLinks).not.toHaveBeenCalled()
+  })
+
+  it('does NOT mark a direct-principal participant as portal-linked even if also linked via contact', async () => {
+    participantRows.push({ principalId: 'principal_x', contactId: null })
+    // The contact-link query happens to return the same principal as the
+    // direct participant — it must NOT appear in portalLinked.
+    principalLinkRows.push({ id: 'principal_x' })
+    const { resolvePortalLinkedRecipients } = await import('../ticket.recipients')
+    const result = await resolvePortalLinkedRecipients({
+      id: 'ticket_1' as never,
+      requesterContactId: 'contact_req' as never,
+    })
+    expect([...result.principalIds]).toEqual(['principal_x'])
+    expect(result.portalLinked.size).toBe(0)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.service.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.service.diffcov.test.ts
new file mode 100644
index 000000000..3a9dafcfe
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.service.diffcov.test.ts
@@ -0,0 +1,516 @@
+/**
+ * Differential-coverage tests for ticket.service — the edge/defensive branches
+ * the existing suite leaves uncovered: subject/priority/channel/visibility
+ * validation, status resolution, requester-contact + customer-context
+ * resolution, routing side-effects, optimistic-concurrency staleness,
+ * field-diff building, assignment (assign/unassign), status-category timestamp
+ * transitions, soft-delete/restore, and the dispatch/notify/sla try-catch
+ * swallows.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  ticketsFindFirst: vi.fn(),
+  statusesFindFirst: vi.fn(),
+  principalFindFirst: vi.fn(),
+  userFindFirst: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  selectWhere: vi.fn(),
+  recordEvent: vi.fn(),
+  route: vi.fn(),
+  bumpMatchStats: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  attachClocks: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  onStatusTransition: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  safeSubscribe: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  notifyCreated: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  notifyAssigned: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  notifyStatus: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({ type: 'user', principalId: 'p1' })),
+  dCreated: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dUpdated: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dAssigned: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dUnassigned: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dStatus: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dDeleted: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dRestored: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  findOrCreateByEmail: vi.fn(),
+  linkContactToUser: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  listLinksForUser: vi.fn(),
+  getContact: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      tickets: { findFirst: m.ticketsFindFirst },
+      ticketStatuses: { findFirst: m.statusesFindFirst },
+      principal: { findFirst: m.principalFindFirst },
+      user: { findFirst: m.userFindFirst },
+    },
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({
+      set: () => ({
+        where: () => ({
+          returning: m.updateReturning,
+          then: (r: (v: unknown) => void) => r(undefined),
+        }),
+      }),
+    }),
+    select: () => ({ from: () => ({ where: () => m.selectWhere() }) }),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  inArray: vi.fn(),
+  tickets: { id: 't.id', updatedAt: 't.updatedAt', deletedAt: 't.deletedAt' },
+  ticketStatuses: { id: 'ts.id', isDefault: 'ts.isDefault', deletedAt: 'ts.deletedAt' },
+  ticketActivity: {},
+  principal: { id: 'pr.id' },
+  user: { id: 'u.id' },
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  TICKET_CHANNELS: ['api', 'email', 'chat', 'web', 'widget'],
+  TICKET_VISIBILITY_SCOPES: ['team', 'workspace', 'private'],
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: (...a: unknown[]) => m.recordEvent(...a) }))
+vi.mock('@/lib/server/sanitize-tiptap', () => ({ sanitizeTiptapContent: (j: unknown) => j }))
+vi.mock('../tiptap-text', () => ({ tiptapToPlainText: () => 'plain' }))
+vi.mock('../../organizations/contact.service', () => ({
+  findOrCreateByEmail: (...a: unknown[]) => m.findOrCreateByEmail(...a),
+  linkContactToUser: (...a: unknown[]) => m.linkContactToUser(...a),
+  listLinksForUser: (...a: unknown[]) => m.listLinksForUser(...a),
+  getContact: (...a: unknown[]) => m.getContact(...a),
+}))
+vi.mock('../../inboxes/routing.engine', () => ({ route: (...a: unknown[]) => m.route(...a) }))
+vi.mock('../../inboxes/routing.service', () => ({
+  bumpMatchStats: (...a: unknown[]) => m.bumpMatchStats(...a),
+}))
+vi.mock('../../sla/sla.engine', () => ({
+  attachClocksOnCreate: (...a: unknown[]) => m.attachClocks(...a),
+  onStatusTransition: (...a: unknown[]) => m.onStatusTransition(...a),
+}))
+vi.mock('../ticket.subscriptions', () => ({
+  safeSubscribe: (...a: unknown[]) => m.safeSubscribe(...a),
+}))
+vi.mock('../ticket.notifications', () => ({
+  notifyTicketCreated: (...a: unknown[]) => m.notifyCreated(...a),
+  notifyTicketAssigned: (...a: unknown[]) => m.notifyAssigned(...a),
+  notifyTicketStatusChanged: (...a: unknown[]) => m.notifyStatus(...a),
+}))
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchTicketCreated: (...a: unknown[]) => m.dCreated(...a),
+  dispatchTicketUpdated: (...a: unknown[]) => m.dUpdated(...a),
+  dispatchTicketAssigned: (...a: unknown[]) => m.dAssigned(...a),
+  dispatchTicketUnassigned: (...a: unknown[]) => m.dUnassigned(...a),
+  dispatchTicketStatusChanged: (...a: unknown[]) => m.dStatus(...a),
+  dispatchTicketDeleted: (...a: unknown[]) => m.dDeleted(...a),
+  dispatchTicketRestored: (...a: unknown[]) => m.dRestored(...a),
+}))
+
+import * as svc from '../ticket.service'
+
+const D1 = new Date('2026-04-01T00:00:00Z')
+const ticket = (over: Record<string, unknown> = {}) => ({
+  id: 'ticket_1',
+  subject: 'Help',
+  descriptionText: 'd',
+  descriptionJson: null,
+  priority: 'normal',
+  channel: 'api',
+  visibilityScope: 'team',
+  statusId: 'status_open',
+  primaryTeamId: null,
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  requesterPrincipalId: null,
+  requesterContactId: null,
+  organizationId: null,
+  inboxId: null,
+  updatedAt: D1,
+  resolvedAt: null,
+  closedAt: null,
+  deletedAt: null,
+  ...over,
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.ticketsFindFirst.mockResolvedValue(ticket())
+  m.statusesFindFirst.mockResolvedValue({ id: 'status_open', category: 'open', isDefault: true })
+  m.principalFindFirst.mockResolvedValue(undefined)
+  m.userFindFirst.mockResolvedValue(undefined)
+  m.insertReturning.mockResolvedValue([ticket()])
+  m.updateReturning.mockResolvedValue([ticket()])
+  m.selectWhere.mockResolvedValue([])
+  m.route.mockResolvedValue({ matchedRuleId: null, inboxId: null })
+  m.listLinksForUser.mockResolvedValue([])
+  m.getContact.mockResolvedValue(null)
+  m.findOrCreateByEmail.mockResolvedValue({ id: 'contact_1', organizationId: null })
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('createTicket validation + status', () => {
+  it('rejects empty / over-long subject', async () => {
+    await expect(svc.createTicket({ subject: ' ' } as never)).rejects.toThrow('subject is required')
+    await expect(svc.createTicket({ subject: 'x'.repeat(501) } as never)).rejects.toThrow('exceeds')
+  })
+  it('rejects invalid priority / channel / visibility', async () => {
+    await expect(svc.createTicket({ subject: 'S', priority: 'bogus' } as never)).rejects.toThrow(
+      'invalid priority'
+    )
+    await expect(svc.createTicket({ subject: 'S', channel: 'bogus' } as never)).rejects.toThrow(
+      'invalid channel'
+    )
+    await expect(
+      svc.createTicket({ subject: 'S', visibilityScope: 'bogus' } as never)
+    ).rejects.toThrow('invalid visibilityScope')
+  })
+  it('resolves an explicit statusId and throws when it is missing', async () => {
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_x', category: 'open' })
+    await svc.createTicket({ subject: 'S', statusId: 'status_x' } as never)
+    m.statusesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.createTicket({ subject: 'S', statusId: 'ghost' } as never)).rejects.toThrow(
+      'status ghost not found'
+    )
+  })
+  it('throws when no default status is configured', async () => {
+    m.statusesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.createTicket({ subject: 'S' } as never)).rejects.toThrow(
+      'No default ticket status'
+    )
+  })
+})
+
+describe('createTicket happy paths + side effects', () => {
+  it('routes, records the routed activity, and bumps match stats', async () => {
+    m.route.mockResolvedValueOnce({
+      matchedRuleId: 'rule_1',
+      inboxId: 'inbox_1',
+      primaryTeamId: 'team_1',
+      assigneePrincipalId: 'p_assignee',
+      priority: 'high',
+      visibilityScope: 'workspace',
+    })
+    await svc.createTicket({
+      subject: 'S',
+      descriptionJson: { type: 'doc' },
+      createdByPrincipalId: 'p1',
+    } as never)
+    expect(m.bumpMatchStats).toHaveBeenCalled()
+    expect(m.dCreated).toHaveBeenCalled()
+  })
+  it('resolves the requester contact via an existing link', async () => {
+    m.principalFindFirst.mockResolvedValueOnce({ userId: 'u1', type: 'user' })
+    m.listLinksForUser.mockResolvedValueOnce([{ contactId: 'contact_existing' }])
+    await svc.createTicket({ subject: 'S', requesterPrincipalId: 'p_req' } as never)
+    expect(m.findOrCreateByEmail).not.toHaveBeenCalled()
+  })
+  it('creates + links a contact when the verified user has no link', async () => {
+    m.principalFindFirst.mockResolvedValueOnce({ userId: 'u1', type: 'user' })
+    m.listLinksForUser.mockResolvedValueOnce([])
+    m.userFindFirst.mockResolvedValueOnce({ email: 'a@x.test', emailVerified: true })
+    await svc.createTicket({ subject: 'S', requesterPrincipalId: 'p_req' } as never)
+    expect(m.linkContactToUser).toHaveBeenCalled()
+  })
+  it('looks up the org from the contact when organizationId is not supplied', async () => {
+    m.getContact.mockResolvedValueOnce({ organizationId: 'org_1' })
+    await svc.createTicket({ subject: 'S', requesterContactId: 'contact_1' } as never)
+    expect(m.getContact).toHaveBeenCalled()
+  })
+  it('swallows a customer-context resolution failure', async () => {
+    m.principalFindFirst.mockRejectedValueOnce(new Error('db'))
+    await svc.createTicket({ subject: 'S', requesterPrincipalId: 'p_req' } as never)
+    expect(console.warn).toHaveBeenCalled()
+  })
+  it('swallows sla / notify / dispatch failures', async () => {
+    m.attachClocks.mockRejectedValueOnce(new Error('sla'))
+    m.notifyCreated.mockRejectedValueOnce(new Error('notify'))
+    m.dCreated.mockRejectedValueOnce(new Error('dispatch'))
+    await svc.createTicket({
+      subject: 'S',
+      requesterPrincipalId: 'p_req',
+      assigneePrincipalId: 'p_a',
+    } as never)
+    expect(m.safeSubscribe).toHaveBeenCalled()
+  })
+})
+
+describe('getTicket / loadTicketsByIds', () => {
+  it('getTicket returns null when missing', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    expect(await svc.getTicket('ticket_1' as never)).toBeNull()
+  })
+  it('loadTicketsByIds short-circuits on empty', async () => {
+    expect(await svc.loadTicketsByIds([])).toEqual([])
+    m.selectWhere.mockResolvedValueOnce([ticket()])
+    expect(await svc.loadTicketsByIds(['ticket_1'] as never)).toHaveLength(1)
+  })
+})
+
+describe('updateTicket', () => {
+  it('throws when missing', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      svc.updateTicket(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null } as never
+      )
+    ).rejects.toThrow('not found')
+  })
+  it('throws stale when timestamps differ and merge is not allowed', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ updatedAt: new Date('2026-05-01') }))
+    await expect(
+      svc.updateTicket(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null, subject: 'New' } as never
+      )
+    ).rejects.toThrow('refresh and retry')
+  })
+  it('re-reads the latest row when stale but a field merge is allowed', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ updatedAt: new Date('2026-05-01') })) // existing (stale)
+    m.ticketsFindFirst.mockResolvedValueOnce(
+      ticket({ updatedAt: new Date('2026-05-01'), subject: 'Old' })
+    ) // latest
+    m.updateReturning.mockResolvedValueOnce([ticket({ subject: 'New' })])
+    await svc.updateTicket(
+      'ticket_1' as never,
+      {
+        expectedUpdatedAt: D1,
+        actorPrincipalId: 'p1',
+        subject: 'New',
+        allowStaleFieldUpdate: true,
+      } as never
+    )
+    expect(m.dUpdated).toHaveBeenCalled()
+  })
+  it('re-read returns null -> not found', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ updatedAt: new Date('2026-05-01') }))
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      svc.updateTicket(
+        'ticket_1' as never,
+        {
+          expectedUpdatedAt: D1,
+          actorPrincipalId: null,
+          subject: 'New',
+          allowStaleFieldUpdate: true,
+        } as never
+      )
+    ).rejects.toThrow('not found')
+  })
+  it('builds a full diff across all editable fields', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket())
+    m.updateReturning.mockResolvedValueOnce([ticket()])
+    await svc.updateTicket(
+      'ticket_1' as never,
+      {
+        expectedUpdatedAt: D1,
+        actorPrincipalId: null,
+        subject: 'New',
+        descriptionJson: { type: 'doc' },
+        descriptionText: 'nd',
+        priority: 'high',
+        visibilityScope: 'workspace',
+        primaryTeamId: 'team_2',
+        organizationId: 'org_2',
+        requesterContactId: 'contact_2',
+        inboxId: 'inbox_2',
+      } as never
+    )
+    expect(m.dUpdated).toHaveBeenCalled()
+  })
+  it('rejects invalid priority / visibility on update', async () => {
+    m.ticketsFindFirst.mockResolvedValue(ticket())
+    await expect(
+      svc.updateTicket(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null, priority: 'bogus' } as never
+      )
+    ).rejects.toThrow('invalid priority')
+    await expect(
+      svc.updateTicket(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null, visibilityScope: 'bogus' } as never
+      )
+    ).rejects.toThrow('invalid visibilityScope')
+  })
+  it('returns existing unchanged when no fields change', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ subject: 'Same' }))
+    const res = await svc.updateTicket(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: null, subject: 'Same' } as never
+    )
+    expect(res.subject).toBe('Same')
+    expect(m.updateReturning).not.toHaveBeenCalled()
+  })
+  it('throws conflict when the optimistic update matches no row', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket())
+    m.updateReturning.mockResolvedValueOnce([])
+    await expect(
+      svc.updateTicket(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null, subject: 'New' } as never
+      )
+    ).rejects.toThrow('modified concurrently')
+  })
+})
+
+describe('assignTicket', () => {
+  it('throws not found / stale', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      svc.assignTicket(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null } as never
+      )
+    ).rejects.toThrow('not found')
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ updatedAt: new Date('2026-05-01') }))
+    await expect(
+      svc.assignTicket(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null, assigneePrincipalId: 'p_a' } as never
+      )
+    ).rejects.toThrow('refresh and retry')
+  })
+  it('returns existing when assignment is unchanged', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ assigneePrincipalId: 'p_a' }))
+    const res = await svc.assignTicket(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: null, assigneePrincipalId: 'p_a' } as never
+    )
+    expect(res.id).toBe('ticket_1')
+    expect(m.updateReturning).not.toHaveBeenCalled()
+  })
+  it('assigns a new principal (subscribe + dispatch assigned)', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ assigneePrincipalId: null }))
+    m.updateReturning.mockResolvedValueOnce([ticket({ assigneePrincipalId: 'p_new' })])
+    await svc.assignTicket(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: 'p1', assigneePrincipalId: 'p_new' } as never
+    )
+    expect(m.safeSubscribe).toHaveBeenCalled()
+    expect(m.dAssigned).toHaveBeenCalled()
+  })
+  it('unassigns (dispatch unassigned for the prior assignee)', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ assigneePrincipalId: 'p_old' }))
+    m.updateReturning.mockResolvedValueOnce([ticket({ assigneePrincipalId: null })])
+    await svc.assignTicket(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: 'p1', assigneePrincipalId: null } as never
+    )
+    expect(m.dUnassigned).toHaveBeenCalled()
+  })
+  it('throws conflict when the update matches no row', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ assigneePrincipalId: null }))
+    m.updateReturning.mockResolvedValueOnce([])
+    await expect(
+      svc.assignTicket(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null, assigneePrincipalId: 'p_new' } as never
+      )
+    ).rejects.toThrow('modified concurrently')
+  })
+})
+
+describe('transitionStatus', () => {
+  it('throws not found and returns existing when status is unchanged', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      svc.transitionStatus(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null, statusId: 'status_x' } as never
+      )
+    ).rejects.toThrow('not found')
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ statusId: 'status_open' }))
+    const res = await svc.transitionStatus(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: null, statusId: 'status_open' } as never
+    )
+    expect(res.id).toBe('ticket_1')
+  })
+  it('transitions to solved (sets resolvedAt, clears closedAt)', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ statusId: 'status_open' }))
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_solved', category: 'solved' }) // next
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_open', category: 'open' }) // prev
+    await svc.transitionStatus(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: 'p1', statusId: 'status_solved' } as never
+    )
+    expect(m.dStatus).toHaveBeenCalled()
+  })
+  it('transitions to closed', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ statusId: 'status_open' }))
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_closed', category: 'closed' })
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_open', category: 'open' })
+    await svc.transitionStatus(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: null, statusId: 'status_closed' } as never
+    )
+    expect(m.onStatusTransition).toHaveBeenCalled()
+  })
+  it('reopens from a terminal state (clears resolved/closed)', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(
+      ticket({ statusId: 'status_closed', resolvedAt: D1, closedAt: D1 })
+    )
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_open', category: 'open' }) // next
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_closed', category: 'closed' }) // prev
+    await svc.transitionStatus(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: null, statusId: 'status_open' } as never
+    )
+    expect(m.dStatus).toHaveBeenCalled()
+  })
+  it('handles a ticket with no previous status', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ statusId: null }))
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_open', category: 'open' }) // next
+    await svc.transitionStatus(
+      'ticket_1' as never,
+      { expectedUpdatedAt: D1, actorPrincipalId: null, statusId: 'status_open' } as never
+    )
+    expect(m.dStatus).toHaveBeenCalled()
+  })
+  it('throws conflict when the update matches no row', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ statusId: 'status_open' }))
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_solved', category: 'solved' })
+    m.statusesFindFirst.mockResolvedValueOnce({ id: 'status_open', category: 'open' })
+    m.updateReturning.mockResolvedValueOnce([])
+    await expect(
+      svc.transitionStatus(
+        'ticket_1' as never,
+        { expectedUpdatedAt: D1, actorPrincipalId: null, statusId: 'status_solved' } as never
+      )
+    ).rejects.toThrow('modified concurrently')
+  })
+})
+
+describe('softDelete / restore / bump', () => {
+  it('soft-deletes (service actor) and dispatches', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket())
+    await svc.softDeleteTicket('ticket_1' as never, null)
+    expect(m.dDeleted).toHaveBeenCalled()
+  })
+  it('soft-delete throws when missing', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.softDeleteTicket('ticket_1' as never, 'p1' as never)).rejects.toThrow(
+      'not found'
+    )
+  })
+  it('restore throws when missing / not deleted, succeeds otherwise', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(svc.restoreTicket('ticket_1' as never, 'p1' as never)).rejects.toThrow('not found')
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ deletedAt: null }))
+    await expect(svc.restoreTicket('ticket_1' as never, 'p1' as never)).rejects.toThrow(
+      'not deleted'
+    )
+    m.ticketsFindFirst.mockResolvedValueOnce(ticket({ deletedAt: D1 }))
+    await svc.restoreTicket('ticket_1' as never, 'p1' as never)
+    expect(m.dRestored).toHaveBeenCalled()
+  })
+  it('bumpLastActivity and writeActivity run', async () => {
+    await svc.bumpLastActivity('ticket_1' as never)
+    m.insertReturning.mockResolvedValueOnce([{ id: 'act_1' }])
+    expect(await svc.writeActivity('ticket_1' as never, null, 'x', {})).toEqual({ id: 'act_1' })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.service.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.service.test.ts
new file mode 100644
index 000000000..2f060f8c6
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.service.test.ts
@@ -0,0 +1,851 @@
+/**
+ * ticket.service — focused unit tests for status-transition timestamp logic
+ * and optimistic-concurrency rejection. Pure DB chains are mocked.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// ---- shared mocks ----
+const ticketFindFirstMock = vi.fn()
+const statusFindFirstMock = vi.fn()
+const principalFindFirstMock = vi.fn()
+const userFindFirstMock = vi.fn()
+const insertTicketsReturningMock = vi.fn()
+const insertActivityReturningMock = vi.fn()
+const updateTicketsReturningMock = vi.fn()
+const selectTicketsWhereMock = vi.fn()
+const recordEventMock = vi.fn()
+const findOrCreateByEmailMock = vi.fn()
+const linkContactToUserMock = vi.fn()
+const listLinksForUserMock = vi.fn()
+const getContactMock = vi.fn()
+const routeMock = vi.fn()
+const bumpMatchStatsMock = vi.fn()
+const attachClocksOnCreateMock = vi.fn()
+const onStatusTransitionMock = vi.fn()
+const safeSubscribeMock = vi.fn()
+const notifyTicketCreatedMock = vi.fn()
+const notifyTicketAssignedMock = vi.fn()
+const notifyTicketStatusChangedMock = vi.fn()
+/** Captures the .values(...) payload for every tickets insert. */
+const ticketInsertValuesCalls: Array<Record<string, unknown>> = []
+
+vi.mock('../../organizations/contact.service', () => ({
+  findOrCreateByEmail: (...args: unknown[]) => findOrCreateByEmailMock(...args),
+  linkContactToUser: (...args: unknown[]) => linkContactToUserMock(...args),
+  listLinksForUser: (...args: unknown[]) => listLinksForUserMock(...args),
+  getContact: (...args: unknown[]) => getContactMock(...args),
+}))
+
+const dispatchTicketUpdatedMock = vi.fn()
+const dispatchTicketDeletedMock = vi.fn()
+const dispatchTicketRestoredMock = vi.fn()
+const dispatchTicketCreatedMock = vi.fn()
+const dispatchTicketAssignedMock = vi.fn()
+const dispatchTicketUnassignedMock = vi.fn()
+const dispatchTicketStatusChangedMock = vi.fn()
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (a: { principalId?: string }) => ({
+    type: 'user',
+    principalId: a.principalId,
+  }),
+  dispatchTicketCreated: (...a: unknown[]) => dispatchTicketCreatedMock(...a),
+  dispatchTicketUpdated: (...a: unknown[]) => dispatchTicketUpdatedMock(...a),
+  dispatchTicketDeleted: (...a: unknown[]) => dispatchTicketDeletedMock(...a),
+  dispatchTicketRestored: (...a: unknown[]) => dispatchTicketRestoredMock(...a),
+  dispatchTicketAssigned: (...a: unknown[]) => dispatchTicketAssignedMock(...a),
+  dispatchTicketUnassigned: (...a: unknown[]) => dispatchTicketUnassignedMock(...a),
+  dispatchTicketStatusChanged: (...a: unknown[]) => dispatchTicketStatusChangedMock(...a),
+}))
+
+vi.mock('../../inboxes/routing.engine', () => ({
+  route: (...args: unknown[]) => routeMock(...args),
+}))
+
+vi.mock('../../inboxes/routing.service', () => ({
+  bumpMatchStats: (...args: unknown[]) => bumpMatchStatsMock(...args),
+}))
+
+vi.mock('../../sla/sla.engine', () => ({
+  attachClocksOnCreate: (...args: unknown[]) => attachClocksOnCreateMock(...args),
+  onStatusTransition: (...args: unknown[]) => onStatusTransitionMock(...args),
+}))
+
+vi.mock('../ticket.subscriptions', () => ({
+  safeSubscribe: (...args: unknown[]) => safeSubscribeMock(...args),
+}))
+
+vi.mock('../ticket.notifications', () => ({
+  notifyTicketCreated: (...args: unknown[]) => notifyTicketCreatedMock(...args),
+  notifyTicketAssigned: (...args: unknown[]) => notifyTicketAssignedMock(...args),
+  notifyTicketStatusChanged: (...args: unknown[]) => notifyTicketStatusChangedMock(...args),
+}))
+
+vi.mock('@/lib/server/db', () => {
+  function makeInsertChain(target: 'tickets' | 'activity') {
+    return {
+      values: vi.fn((payload: Record<string, unknown>) => {
+        if (target === 'tickets') ticketInsertValuesCalls.push(payload)
+        return {
+          values: vi.fn().mockReturnThis(),
+          returning:
+            target === 'tickets' ? insertTicketsReturningMock : insertActivityReturningMock,
+        }
+      }),
+      returning: target === 'tickets' ? insertTicketsReturningMock : insertActivityReturningMock,
+    }
+  }
+  const updateChain = {
+    set: vi.fn().mockReturnThis(),
+    where: vi.fn().mockReturnThis(),
+    returning: updateTicketsReturningMock,
+  }
+  return {
+    db: {
+      query: {
+        tickets: { findFirst: ticketFindFirstMock },
+        ticketStatuses: { findFirst: statusFindFirstMock },
+        principal: { findFirst: principalFindFirstMock },
+        user: { findFirst: userFindFirstMock },
+      },
+      insert: vi.fn((tbl: { _name: string }) => {
+        if (tbl?._name === 'ticket_activity') return makeInsertChain('activity')
+        return makeInsertChain('tickets')
+      }),
+      update: vi.fn(() => updateChain),
+      select: vi.fn(() => ({
+        from: vi.fn(() => ({
+          where: (...args: unknown[]) => selectTicketsWhereMock(...args),
+        })),
+      })),
+      delete: vi.fn(),
+    },
+    eq: vi.fn(),
+    and: vi.fn(),
+    or: vi.fn(),
+    isNull: vi.fn(),
+    isNotNull: vi.fn(),
+    inArray: vi.fn((left: unknown, right: unknown) => ['inArray', left, right]),
+    asc: vi.fn(),
+    desc: vi.fn(),
+    ilike: vi.fn(),
+    sql: vi.fn(),
+    tickets: { _name: 'tickets', id: 'tickets.id', updatedAt: 'tickets.updated_at' },
+    ticketStatuses: { _name: 'ticket_statuses', id: 'ticket_statuses.id' },
+    ticketActivity: { _name: 'ticket_activity' },
+    ticketShares: { _name: 'ticket_shares' },
+    principal: { _name: 'principal', id: 'principal.id' },
+    user: { _name: 'user', id: 'user.id' },
+    TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'] as const,
+    TICKET_CHANNELS: ['api', 'email', 'web', 'chat'] as const,
+    TICKET_VISIBILITY_SCOPES: ['team', 'org', 'shared', 'private'] as const,
+  }
+})
+
+vi.mock('@/lib/server/sanitize-tiptap', () => ({
+  sanitizeTiptapContent: (c: unknown) => c,
+}))
+
+vi.mock('../../audit', () => ({
+  recordEvent: (...args: unknown[]) => recordEventMock(...args),
+}))
+
+vi.mock('@/lib/shared/errors', () => {
+  class DomainErr extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return {
+    ConflictError: DomainErr,
+    NotFoundError: DomainErr,
+    ValidationError: DomainErr,
+    ForbiddenError: DomainErr,
+  }
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  ticketFindFirstMock.mockReset()
+  statusFindFirstMock.mockReset()
+  principalFindFirstMock.mockReset()
+  userFindFirstMock.mockReset()
+  insertTicketsReturningMock.mockReset()
+  insertActivityReturningMock.mockReset()
+  updateTicketsReturningMock.mockReset()
+  selectTicketsWhereMock.mockReset()
+  selectTicketsWhereMock.mockResolvedValue([])
+  findOrCreateByEmailMock.mockReset()
+  linkContactToUserMock.mockReset()
+  listLinksForUserMock.mockReset().mockResolvedValue([])
+  getContactMock.mockReset().mockResolvedValue(null)
+  ticketInsertValuesCalls.length = 0
+  insertActivityReturningMock.mockResolvedValue([{ id: 'ticket_act_x' }])
+  recordEventMock.mockReset()
+  routeMock.mockReset()
+  routeMock.mockResolvedValue(null)
+  bumpMatchStatsMock.mockReset()
+  bumpMatchStatsMock.mockResolvedValue(undefined)
+  attachClocksOnCreateMock.mockReset()
+  attachClocksOnCreateMock.mockResolvedValue(undefined)
+  onStatusTransitionMock.mockReset()
+  onStatusTransitionMock.mockResolvedValue(undefined)
+  safeSubscribeMock.mockReset()
+  safeSubscribeMock.mockResolvedValue(undefined)
+  notifyTicketCreatedMock.mockReset()
+  notifyTicketCreatedMock.mockResolvedValue(undefined)
+  notifyTicketAssignedMock.mockReset()
+  notifyTicketAssignedMock.mockResolvedValue(undefined)
+  notifyTicketStatusChangedMock.mockReset()
+  notifyTicketStatusChangedMock.mockResolvedValue(undefined)
+  dispatchTicketUpdatedMock.mockReset()
+  dispatchTicketUpdatedMock.mockResolvedValue(undefined)
+  dispatchTicketDeletedMock.mockReset()
+  dispatchTicketDeletedMock.mockResolvedValue(undefined)
+  dispatchTicketRestoredMock.mockReset()
+  dispatchTicketRestoredMock.mockResolvedValue(undefined)
+  dispatchTicketCreatedMock.mockReset()
+  dispatchTicketCreatedMock.mockResolvedValue(undefined)
+  dispatchTicketAssignedMock.mockReset()
+  dispatchTicketAssignedMock.mockResolvedValue(undefined)
+  dispatchTicketUnassignedMock.mockReset()
+  dispatchTicketUnassignedMock.mockResolvedValue(undefined)
+  dispatchTicketStatusChangedMock.mockReset()
+  dispatchTicketStatusChangedMock.mockResolvedValue(undefined)
+})
+
+const FIXED_NOW = new Date('2026-05-01T10:00:00.000Z')
+
+function baseTicket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'ticket_1',
+    statusId: 'ticket_status_open',
+    updatedAt: new Date('2026-04-30T09:00:00.000Z'),
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    primaryTeamId: null,
+    requesterPrincipalId: null,
+    firstResponseAt: null,
+    resolvedAt: null,
+    reopenedAt: null,
+    closedAt: null,
+    deletedAt: null,
+    subject: 'Help',
+    priority: 'normal',
+    visibilityScope: 'team',
+    organizationId: null,
+    requesterContactId: null,
+    descriptionJson: null,
+    descriptionText: null,
+    ...overrides,
+  }
+}
+
+describe('transitionStatus', () => {
+  it('rejects with TICKET_STALE when expectedUpdatedAt does not match', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce(baseTicket())
+    const { transitionStatus } = await import('../ticket.service')
+    await expect(
+      transitionStatus('ticket_1' as never, {
+        expectedUpdatedAt: new Date('2025-01-01T00:00:00.000Z'),
+        actorPrincipalId: null,
+        statusId: 'ticket_status_solved' as never,
+      })
+    ).rejects.toThrow(/modified concurrently/i)
+  })
+
+  it('sets resolvedAt when moving to a solved-category status', async () => {
+    const ticket = baseTicket()
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    statusFindFirstMock
+      .mockResolvedValueOnce({ id: 'ticket_status_solved', category: 'solved' })
+      .mockResolvedValueOnce({ id: 'ticket_status_open', category: 'open' })
+    updateTicketsReturningMock.mockResolvedValueOnce([
+      { ...ticket, statusId: 'ticket_status_solved', resolvedAt: FIXED_NOW },
+    ])
+    const { transitionStatus } = await import('../ticket.service')
+    const result = await transitionStatus('ticket_1' as never, {
+      expectedUpdatedAt: ticket.updatedAt,
+      actorPrincipalId: null,
+      statusId: 'ticket_status_solved' as never,
+    })
+    expect(result.statusId).toBe('ticket_status_solved')
+    expect(result.resolvedAt).not.toBeNull()
+  })
+
+  it('sets reopenedAt and clears resolvedAt when moving from solved to open', async () => {
+    const ticket = baseTicket({
+      statusId: 'ticket_status_solved',
+      resolvedAt: new Date('2026-04-29T12:00:00.000Z'),
+    })
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    statusFindFirstMock
+      .mockResolvedValueOnce({ id: 'ticket_status_open', category: 'open' })
+      .mockResolvedValueOnce({ id: 'ticket_status_solved', category: 'solved' })
+    updateTicketsReturningMock.mockResolvedValueOnce([
+      { ...ticket, statusId: 'ticket_status_open', resolvedAt: null, reopenedAt: FIXED_NOW },
+    ])
+    const { transitionStatus } = await import('../ticket.service')
+    const result = await transitionStatus('ticket_1' as never, {
+      expectedUpdatedAt: ticket.updatedAt,
+      actorPrincipalId: null,
+      statusId: 'ticket_status_open' as never,
+    })
+    expect(result.resolvedAt).toBeNull()
+    expect(result.reopenedAt).not.toBeNull()
+  })
+
+  it('returns the existing row unchanged when target status equals current', async () => {
+    const ticket = baseTicket({ statusId: 'ticket_status_open' })
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    const { transitionStatus } = await import('../ticket.service')
+    const result = await transitionStatus('ticket_1' as never, {
+      expectedUpdatedAt: ticket.updatedAt,
+      actorPrincipalId: null,
+      statusId: 'ticket_status_open' as never,
+    })
+    expect(result).toEqual(ticket)
+    expect(updateTicketsReturningMock).not.toHaveBeenCalled()
+  })
+
+  it('throws TICKET_STALE when underlying UPDATE returns 0 rows', async () => {
+    const ticket = baseTicket()
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    statusFindFirstMock
+      .mockResolvedValueOnce({ id: 'ticket_status_solved', category: 'solved' })
+      .mockResolvedValueOnce({ id: 'ticket_status_open', category: 'open' })
+    updateTicketsReturningMock.mockResolvedValueOnce([])
+    const { transitionStatus } = await import('../ticket.service')
+    await expect(
+      transitionStatus('ticket_1' as never, {
+        expectedUpdatedAt: ticket.updatedAt,
+        actorPrincipalId: null,
+        statusId: 'ticket_status_solved' as never,
+      })
+    ).rejects.toThrow(/modified concurrently/i)
+  })
+})
+
+describe('createTicket', () => {
+  it('rejects empty subject', async () => {
+    const { createTicket } = await import('../ticket.service')
+    await expect(createTicket({ subject: '   ' })).rejects.toThrow(/subject is required/i)
+  })
+
+  it('rejects invalid priority, channel, and visibility values', async () => {
+    const { createTicket } = await import('../ticket.service')
+    await expect(createTicket({ subject: 'Hi', priority: 'bad' as never })).rejects.toMatchObject({
+      code: 'TICKET_PRIORITY_INVALID',
+    })
+    await expect(createTicket({ subject: 'Hi', channel: 'bad' as never })).rejects.toMatchObject({
+      code: 'TICKET_CHANNEL_INVALID',
+    })
+    await expect(
+      createTicket({ subject: 'Hi', visibilityScope: 'bad' as never })
+    ).rejects.toMatchObject({
+      code: 'TICKET_VISIBILITY_INVALID',
+    })
+  })
+
+  it('uses the workspace default status when statusId omitted', async () => {
+    statusFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_status_open',
+      category: 'open',
+    })
+    insertTicketsReturningMock.mockResolvedValueOnce([
+      { id: 'ticket_1', statusId: 'ticket_status_open', subject: 'Hi' },
+    ])
+    const { createTicket } = await import('../ticket.service')
+    const result = await createTicket({ subject: 'Hi' })
+    expect(result.id).toBe('ticket_1')
+    expect(statusFindFirstMock).toHaveBeenCalled()
+  })
+
+  it('rejects when no default status is configured and none provided', async () => {
+    statusFindFirstMock.mockResolvedValueOnce(undefined)
+    const { createTicket } = await import('../ticket.service')
+    await expect(createTicket({ subject: 'Hi' })).rejects.toThrow(/default ticket status/i)
+  })
+
+  it('applies routing decisions, bumps match stats, subscribes principals, and dispatches creation side effects', async () => {
+    statusFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_status_open',
+      category: 'open',
+    })
+    routeMock.mockResolvedValueOnce({
+      matchedRuleId: 'routing_rule_1',
+      inboxId: 'inbox_routed',
+      primaryTeamId: 'team_primary',
+      assigneePrincipalId: 'principal_assignee',
+      assigneeTeamId: 'team_assignee',
+      priority: 'high',
+      visibilityScope: 'shared',
+    })
+    const created = baseTicket({
+      id: 'ticket_created',
+      subject: 'Routed ticket',
+      inboxId: 'inbox_routed',
+      assigneePrincipalId: 'principal_assignee',
+    })
+    insertTicketsReturningMock.mockResolvedValueOnce([created])
+
+    const { createTicket } = await import('../ticket.service')
+    await expect(
+      createTicket({
+        subject: '  Routed ticket  ',
+        descriptionText: '  body  ',
+        requesterPrincipalId: 'principal_requester' as never,
+        createdByPrincipalId: 'principal_actor' as never,
+        channel: 'email',
+        syncSourceIntegrationId: 'github_1',
+      })
+    ).resolves.toBe(created)
+
+    expect(routeMock).toHaveBeenCalledWith({
+      subject: 'Routed ticket',
+      descriptionText: 'body',
+      channel: 'email',
+      priority: undefined,
+      candidateInboxId: null,
+    })
+    expect(ticketInsertValuesCalls[0]).toMatchObject({
+      subject: 'Routed ticket',
+      descriptionText: 'body',
+      priority: 'high',
+      channel: 'email',
+      visibilityScope: 'shared',
+      statusId: 'ticket_status_open',
+      primaryTeamId: 'team_primary',
+      assigneePrincipalId: 'principal_assignee',
+      assigneeTeamId: 'team_assignee',
+      requesterPrincipalId: 'principal_requester',
+      inboxId: 'inbox_routed',
+    })
+    expect(bumpMatchStatsMock).toHaveBeenCalledWith('routing_rule_1')
+    expect(attachClocksOnCreateMock).toHaveBeenCalledWith(created, 'principal_actor')
+    expect(safeSubscribeMock).toHaveBeenCalledWith({
+      ticketId: 'ticket_created',
+      principalId: 'principal_requester',
+      source: 'manual',
+    })
+    expect(safeSubscribeMock).toHaveBeenCalledWith({
+      ticketId: 'ticket_created',
+      principalId: 'principal_assignee',
+      source: 'auto_assigned',
+    })
+    expect(notifyTicketCreatedMock).toHaveBeenCalledWith(created, {
+      actorPrincipalId: 'principal_actor',
+    })
+    expect(dispatchTicketCreatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ principalId: 'principal_actor' }),
+      created,
+      { syncSourceIntegrationId: 'github_1' }
+    )
+  })
+
+  it('does not route when caller supplies an inbox explicitly', async () => {
+    statusFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_status_open',
+      category: 'open',
+    })
+    insertTicketsReturningMock.mockResolvedValueOnce([
+      baseTicket({ id: 'ticket_explicit', inboxId: 'inbox_explicit' }),
+    ])
+
+    const { createTicket } = await import('../ticket.service')
+    await createTicket({ subject: 'Explicit', inboxId: 'inbox_explicit' as never })
+
+    expect(routeMock).not.toHaveBeenCalled()
+    expect(ticketInsertValuesCalls[0]?.inboxId).toBe('inbox_explicit')
+  })
+
+  describe('requesterContactId resolution', () => {
+    function stubDefaultStatus() {
+      statusFindFirstMock.mockResolvedValue({ id: 'ticket_status_open', category: 'open' })
+      insertTicketsReturningMock.mockResolvedValue([
+        { id: 'ticket_1', statusId: 'ticket_status_open', subject: 'Hi' },
+      ])
+    }
+
+    it('derives a contact from the portal user email when only principal is supplied', async () => {
+      stubDefaultStatus()
+      principalFindFirstMock.mockResolvedValueOnce({ userId: 'user_1', type: 'user' })
+      userFindFirstMock.mockResolvedValueOnce({ email: '[email protected]', emailVerified: true })
+      findOrCreateByEmailMock.mockResolvedValueOnce({ id: 'contact_x' })
+      linkContactToUserMock.mockResolvedValueOnce({ id: 'cu_link_x' })
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterPrincipalId: 'principal_1' as never,
+      })
+      expect(findOrCreateByEmailMock).toHaveBeenCalledWith({ email: '[email protected]' })
+      expect(linkContactToUserMock).toHaveBeenCalledWith({
+        contactId: 'contact_x',
+        userId: 'user_1',
+        linkedByPrincipalId: null,
+      })
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe('contact_x')
+      expect(ticketInsertValuesCalls[0]?.requesterPrincipalId).toBe('principal_1')
+    })
+
+    it('uses an existing contact link before deriving by email', async () => {
+      stubDefaultStatus()
+      principalFindFirstMock.mockResolvedValueOnce({ userId: 'user_1', type: 'user' })
+      listLinksForUserMock.mockResolvedValueOnce([{ contactId: 'contact_linked' }])
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterPrincipalId: 'principal_1' as never,
+      })
+      expect(userFindFirstMock).not.toHaveBeenCalled()
+      expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe('contact_linked')
+    })
+
+    it('derives organizationId from the resolved contact when caller omits it', async () => {
+      stubDefaultStatus()
+      principalFindFirstMock.mockResolvedValueOnce({ userId: 'user_1', type: 'user' })
+      listLinksForUserMock.mockResolvedValueOnce([{ contactId: 'contact_linked' }])
+      getContactMock.mockResolvedValueOnce({ id: 'contact_linked', organizationId: 'org_1' })
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterPrincipalId: 'principal_1' as never,
+      })
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe('contact_linked')
+      expect(ticketInsertValuesCalls[0]?.organizationId).toBe('org_1')
+    })
+
+    it('preserves caller-provided organizationId over contact enrichment', async () => {
+      stubDefaultStatus()
+      getContactMock.mockResolvedValueOnce({
+        id: 'contact_explicit',
+        organizationId: 'org_contact',
+      })
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterContactId: 'contact_explicit' as never,
+        organizationId: 'org_explicit' as never,
+      })
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe('contact_explicit')
+      expect(ticketInsertValuesCalls[0]?.organizationId).toBe('org_explicit')
+    })
+
+    it('keeps caller-provided requesterContactId and skips derivation', async () => {
+      stubDefaultStatus()
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterPrincipalId: 'principal_1' as never,
+        requesterContactId: 'contact_explicit' as never,
+      })
+      expect(principalFindFirstMock).not.toHaveBeenCalled()
+      expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe('contact_explicit')
+    })
+
+    it('skips derivation for anonymous principals', async () => {
+      stubDefaultStatus()
+      principalFindFirstMock.mockResolvedValueOnce({ userId: 'user_anon', type: 'anonymous' })
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterPrincipalId: 'principal_anon' as never,
+      })
+      expect(userFindFirstMock).not.toHaveBeenCalled()
+      expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe(null)
+    })
+
+    it('skips derivation when the user has no email', async () => {
+      stubDefaultStatus()
+      principalFindFirstMock.mockResolvedValueOnce({ userId: 'user_2', type: 'user' })
+      userFindFirstMock.mockResolvedValueOnce({ email: null })
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterPrincipalId: 'principal_2' as never,
+      })
+      expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe(null)
+    })
+
+    it('skips derivation when the user email is unverified', async () => {
+      stubDefaultStatus()
+      principalFindFirstMock.mockResolvedValueOnce({ userId: 'user_2', type: 'user' })
+      userFindFirstMock.mockResolvedValueOnce({
+        email: '[email protected]',
+        emailVerified: false,
+      })
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterPrincipalId: 'principal_2' as never,
+      })
+      expect(findOrCreateByEmailMock).not.toHaveBeenCalled()
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe(null)
+    })
+
+    it('swallows resolver errors and still creates the ticket', async () => {
+      stubDefaultStatus()
+      principalFindFirstMock.mockRejectedValueOnce(new Error('db down'))
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      const { createTicket } = await import('../ticket.service')
+      const result = await createTicket({
+        subject: 'Hi',
+        requesterPrincipalId: 'principal_3' as never,
+      })
+      expect(result.id).toBe('ticket_1')
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe(null)
+      expect(warnSpy).toHaveBeenCalled()
+      warnSpy.mockRestore()
+    })
+
+    it('does not touch principal/user when only contact is supplied (inbound-email path)', async () => {
+      stubDefaultStatus()
+      const { createTicket } = await import('../ticket.service')
+      await createTicket({
+        subject: 'Hi',
+        requesterContactId: 'contact_inbound' as never,
+      })
+      expect(principalFindFirstMock).not.toHaveBeenCalled()
+      expect(userFindFirstMock).not.toHaveBeenCalled()
+      expect(ticketInsertValuesCalls[0]?.requesterContactId).toBe('contact_inbound')
+      expect(ticketInsertValuesCalls[0]?.requesterPrincipalId).toBe(null)
+    })
+  })
+})
+
+describe('updateTicket — webhook dispatch', () => {
+  it('dispatches ticket.updated with changedFields when fields actually change', async () => {
+    const ticket = baseTicket({ priority: 'normal' })
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    updateTicketsReturningMock.mockResolvedValueOnce([{ ...ticket, priority: 'high' }])
+    const { updateTicket } = await import('../ticket.service')
+    await updateTicket('ticket_1' as never, {
+      expectedUpdatedAt: ticket.updatedAt,
+      actorPrincipalId: 'principal_actor' as never,
+      priority: 'high',
+    })
+    expect(dispatchTicketUpdatedMock).toHaveBeenCalledTimes(1)
+    const [, , changedFields, diff] = dispatchTicketUpdatedMock.mock.calls[0]
+    expect(changedFields).toEqual(['priority'])
+    expect((diff as Record<string, { from: unknown; to: unknown }>).priority).toEqual({
+      from: 'normal',
+      to: 'high',
+    })
+  })
+
+  it('does NOT dispatch ticket.updated when no fields change', async () => {
+    const ticket = baseTicket({ priority: 'normal' })
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    const { updateTicket } = await import('../ticket.service')
+    await updateTicket('ticket_1' as never, {
+      expectedUpdatedAt: ticket.updatedAt,
+      actorPrincipalId: 'principal_actor' as never,
+      priority: 'normal',
+    })
+    expect(dispatchTicketUpdatedMock).not.toHaveBeenCalled()
+  })
+
+  it('merges stale field-only updates when explicitly allowed', async () => {
+    const staleTicket = baseTicket({
+      subject: 'Old subject',
+      updatedAt: new Date('2026-04-30T09:00:00.000Z'),
+    })
+    const latestTicket = baseTicket({
+      subject: 'Latest subject',
+      updatedAt: new Date('2026-05-01T09:00:00.000Z'),
+    })
+    const updated = { ...latestTicket, subject: 'Merged subject' }
+    ticketFindFirstMock.mockResolvedValueOnce(staleTicket).mockResolvedValueOnce(latestTicket)
+    updateTicketsReturningMock.mockResolvedValueOnce([updated])
+
+    const { updateTicket } = await import('../ticket.service')
+    await expect(
+      updateTicket('ticket_1' as never, {
+        expectedUpdatedAt: new Date('2026-04-29T09:00:00.000Z'),
+        actorPrincipalId: 'principal_actor' as never,
+        subject: 'Merged subject',
+        allowStaleFieldUpdate: true,
+      })
+    ).resolves.toEqual(updated)
+  })
+})
+
+describe('assignTicket', () => {
+  it('returns unchanged when assignment is identical', async () => {
+    const ticket = baseTicket({ assigneePrincipalId: 'principal_a', assigneeTeamId: 'team_a' })
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+
+    const { assignTicket } = await import('../ticket.service')
+    await expect(
+      assignTicket('ticket_1' as never, {
+        expectedUpdatedAt: ticket.updatedAt,
+        actorPrincipalId: 'principal_actor' as never,
+        assigneePrincipalId: 'principal_a' as never,
+        assigneeTeamId: 'team_a' as never,
+      })
+    ).resolves.toBe(ticket)
+    expect(updateTicketsReturningMock).not.toHaveBeenCalled()
+  })
+
+  it('assigns a new principal, subscribes them, and emits assign/unassign webhook events', async () => {
+    const ticket = baseTicket({ assigneePrincipalId: 'principal_old', assigneeTeamId: null })
+    const updated = { ...ticket, assigneePrincipalId: 'principal_new', assigneeTeamId: 'team_new' }
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    updateTicketsReturningMock.mockResolvedValueOnce([updated])
+
+    const { assignTicket } = await import('../ticket.service')
+    await expect(
+      assignTicket('ticket_1' as never, {
+        expectedUpdatedAt: ticket.updatedAt,
+        actorPrincipalId: 'principal_actor' as never,
+        assigneePrincipalId: 'principal_new' as never,
+        assigneeTeamId: 'team_new' as never,
+        syncSourceIntegrationId: 'github_1',
+      })
+    ).resolves.toBe(updated)
+
+    expect(safeSubscribeMock).toHaveBeenCalledWith({
+      ticketId: 'ticket_1',
+      principalId: 'principal_new',
+      source: 'auto_assigned',
+    })
+    expect(notifyTicketAssignedMock).toHaveBeenCalledWith(updated, 'principal_old', {
+      actorPrincipalId: 'principal_actor',
+    })
+    expect(dispatchTicketAssignedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ principalId: 'principal_actor' }),
+      updated,
+      'principal_old',
+      'principal_new',
+      { syncSourceIntegrationId: 'github_1' }
+    )
+    expect(dispatchTicketUnassignedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ principalId: 'principal_actor' }),
+      updated,
+      'principal_old',
+      { syncSourceIntegrationId: 'github_1' }
+    )
+  })
+
+  it('rejects missing, stale, and concurrently modified assignments', async () => {
+    const ticket = baseTicket()
+    const { assignTicket } = await import('../ticket.service')
+
+    ticketFindFirstMock.mockResolvedValueOnce(undefined)
+    await expect(
+      assignTicket('missing' as never, {
+        expectedUpdatedAt: ticket.updatedAt,
+        actorPrincipalId: null,
+        assigneePrincipalId: 'principal_new' as never,
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_NOT_FOUND' })
+
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    await expect(
+      assignTicket('ticket_1' as never, {
+        expectedUpdatedAt: new Date('2025-01-01T00:00:00.000Z'),
+        actorPrincipalId: null,
+        assigneePrincipalId: 'principal_new' as never,
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_STALE' })
+
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    updateTicketsReturningMock.mockResolvedValueOnce([])
+    await expect(
+      assignTicket('ticket_1' as never, {
+        expectedUpdatedAt: ticket.updatedAt,
+        actorPrincipalId: null,
+        assigneePrincipalId: 'principal_new' as never,
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_STALE' })
+  })
+})
+
+describe('softDeleteTicket — webhook dispatch', () => {
+  it('rejects missing tickets', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce(undefined)
+    const { softDeleteTicket } = await import('../ticket.service')
+    await expect(softDeleteTicket('missing' as never, null)).rejects.toMatchObject({
+      code: 'TICKET_NOT_FOUND',
+    })
+  })
+
+  it('dispatches ticket.deleted with the actor principal', async () => {
+    const ticket = baseTicket()
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    updateTicketsReturningMock.mockResolvedValueOnce([
+      { ...ticket, deletedAt: FIXED_NOW, deletedByPrincipalId: 'principal_actor' },
+    ])
+    const { softDeleteTicket } = await import('../ticket.service')
+    await softDeleteTicket('ticket_1' as never, 'principal_actor' as never)
+    expect(dispatchTicketDeletedMock).toHaveBeenCalledTimes(1)
+    const [, , deletedByPrincipalId] = dispatchTicketDeletedMock.mock.calls[0]
+    expect(deletedByPrincipalId).toBe('principal_actor')
+  })
+})
+
+describe('restoreTicket — webhook dispatch', () => {
+  it('rejects missing and not-deleted tickets', async () => {
+    const { restoreTicket } = await import('../ticket.service')
+
+    ticketFindFirstMock.mockResolvedValueOnce(undefined)
+    await expect(restoreTicket('missing' as never, null)).rejects.toMatchObject({
+      code: 'TICKET_NOT_FOUND',
+    })
+
+    ticketFindFirstMock.mockResolvedValueOnce(baseTicket({ deletedAt: null }))
+    await expect(restoreTicket('ticket_1' as never, null)).rejects.toMatchObject({
+      code: 'TICKET_NOT_DELETED',
+    })
+  })
+
+  it('dispatches ticket.restored with the actor principal', async () => {
+    const ticket = baseTicket({ deletedAt: FIXED_NOW, deletedByPrincipalId: 'principal_other' })
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    updateTicketsReturningMock.mockResolvedValueOnce([
+      { ...ticket, deletedAt: null, deletedByPrincipalId: null },
+    ])
+    const { restoreTicket } = await import('../ticket.service')
+    await restoreTicket('ticket_1' as never, 'principal_actor' as never)
+    expect(dispatchTicketRestoredMock).toHaveBeenCalledTimes(1)
+    const [, , restoredByPrincipalId] = dispatchTicketRestoredMock.mock.calls[0]
+    expect(restoredByPrincipalId).toBe('principal_actor')
+  })
+
+  it('uses service actor and swallows dispatcher errors', async () => {
+    const ticket = baseTicket({ deletedAt: FIXED_NOW })
+    ticketFindFirstMock.mockResolvedValueOnce(ticket)
+    updateTicketsReturningMock.mockResolvedValueOnce([{ ...ticket, deletedAt: null }])
+    dispatchTicketRestoredMock.mockRejectedValueOnce(new Error('hook boom'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const { restoreTicket } = await import('../ticket.service')
+    const result = await restoreTicket('ticket_1' as never, null)
+    expect(result.deletedAt).toBeNull()
+    expect(warnSpy).toHaveBeenCalled()
+    warnSpy.mockRestore()
+  })
+})
+
+describe('ticket service query helpers', () => {
+  it('loads tickets by id and returns early for empty inputs', async () => {
+    const ticket = baseTicket({ id: 'ticket_1' })
+    const { loadTicketsByIds } = await import('../ticket.service')
+
+    await expect(loadTicketsByIds([])).resolves.toEqual([])
+
+    selectTicketsWhereMock.mockResolvedValueOnce([ticket])
+    await expect(loadTicketsByIds(['ticket_1' as never])).resolves.toEqual([ticket])
+    expect(selectTicketsWhereMock).toHaveBeenCalled()
+  })
+
+  it('bumps last activity without writing a timeline row', async () => {
+    const { bumpLastActivity } = await import('../ticket.service')
+    await bumpLastActivity('ticket_1' as never)
+    expect(insertActivityReturningMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.share.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.share.diffcov.test.ts
new file mode 100644
index 000000000..3ed1bbcb6
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.share.diffcov.test.ts
@@ -0,0 +1,164 @@
+/**
+ * Differential-coverage tests for ticket.share — share (invalid level, missing
+ * ticket, idempotent existing grant, create + notify/dispatch), revoke (missing,
+ * already-revoked, success + notify/dispatch), and the list helpers.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  ticketsFindFirst: vi.fn(),
+  sharesFindFirst: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  selectOrderBy: vi.fn(),
+  recordEvent: vi.fn(),
+  writeActivity: vi.fn(),
+  bumpLastActivity: vi.fn(),
+  notifyShared: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  notifyUnshared: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({ type: 'user' })),
+  dShared: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dUnshared: vi.fn((..._a: unknown[]) => Promise.resolve()),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      tickets: { findFirst: m.ticketsFindFirst },
+      ticketShares: { findFirst: m.sharesFindFirst },
+    },
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({ set: () => ({ where: () => ({ returning: m.updateReturning }) }) }),
+    select: () => ({ from: () => ({ where: () => ({ orderBy: () => m.selectOrderBy() }) }) }),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  desc: vi.fn(),
+  ticketShares: {
+    id: 'ts.id',
+    ticketId: 'ts.ticketId',
+    teamId: 'ts.teamId',
+    revokedAt: 'ts.revokedAt',
+    createdAt: 'ts.createdAt',
+  },
+  tickets: { id: 't.id', deletedAt: 't.deletedAt' },
+  TICKET_SHARE_LEVELS: ['read', 'comment', 'edit'],
+}))
+vi.mock('../../audit', () => ({ recordEvent: (...a: unknown[]) => m.recordEvent(...a) }))
+vi.mock('../ticket.service', () => ({
+  writeActivity: (...a: unknown[]) => m.writeActivity(...a),
+  bumpLastActivity: (...a: unknown[]) => m.bumpLastActivity(...a),
+}))
+vi.mock('../ticket.notifications', () => ({
+  notifyTicketShared: (...a: unknown[]) => m.notifyShared(...a),
+  notifyTicketUnshared: (...a: unknown[]) => m.notifyUnshared(...a),
+}))
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchTicketShared: (...a: unknown[]) => m.dShared(...a),
+  dispatchTicketUnshared: (...a: unknown[]) => m.dUnshared(...a),
+}))
+
+import {
+  shareTicketWithTeam,
+  revokeShare,
+  listSharesForTicket,
+  listTicketsSharedWithTeam,
+} from '../ticket.share'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.ticketsFindFirst.mockResolvedValue({ id: 'ticket_1' })
+  m.sharesFindFirst.mockResolvedValue(undefined)
+  m.insertReturning.mockResolvedValue([{ id: 'share_1', accessLevel: 'read' }])
+  m.updateReturning.mockResolvedValue([{ id: 'share_1' }])
+  m.selectOrderBy.mockResolvedValue([{ id: 'share_1' }])
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('shareTicketWithTeam', () => {
+  it('rejects an invalid access level', async () => {
+    await expect(
+      shareTicketWithTeam({ ticketId: 't', teamId: 'team_1', accessLevel: 'bogus' } as never)
+    ).rejects.toThrow('invalid accessLevel')
+  })
+  it('throws when the ticket is missing', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      shareTicketWithTeam({ ticketId: 't', teamId: 'team_1', grantedByPrincipalId: null } as never)
+    ).rejects.toThrow('not found')
+  })
+  it('returns the existing grant idempotently', async () => {
+    m.sharesFindFirst.mockResolvedValueOnce({ id: 'existing' })
+    const res = await shareTicketWithTeam({
+      ticketId: 'ticket_1',
+      teamId: 'team_1',
+      grantedByPrincipalId: null,
+    } as never)
+    expect(res).toEqual({ id: 'existing' })
+    expect(m.insertReturning).not.toHaveBeenCalled()
+  })
+  it('creates a grant and dispatches (principal actor)', async () => {
+    await shareTicketWithTeam({
+      ticketId: 'ticket_1',
+      teamId: 'team_1',
+      grantedByPrincipalId: 'p1',
+    } as never)
+    expect(m.notifyShared).toHaveBeenCalled()
+    expect(m.dShared).toHaveBeenCalled()
+  })
+  it('swallows notify + dispatch failures (service actor)', async () => {
+    m.notifyShared.mockRejectedValueOnce(new Error('notify'))
+    m.dShared.mockRejectedValueOnce(new Error('dispatch'))
+    await shareTicketWithTeam({
+      ticketId: 'ticket_1',
+      teamId: 'team_1',
+      grantedByPrincipalId: null,
+    } as never)
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
+
+describe('revokeShare', () => {
+  it('throws when the share is missing', async () => {
+    m.sharesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(revokeShare('share_1' as never, null)).rejects.toThrow('not found')
+  })
+  it('is idempotent when already revoked', async () => {
+    m.sharesFindFirst.mockResolvedValueOnce({ id: 'share_1', revokedAt: new Date() })
+    const res = await revokeShare('share_1' as never, null)
+    expect(res).toMatchObject({ id: 'share_1' })
+    expect(m.updateReturning).not.toHaveBeenCalled()
+  })
+  it('revokes and dispatches when the ticket still exists', async () => {
+    m.sharesFindFirst.mockResolvedValueOnce({
+      id: 'share_1',
+      revokedAt: null,
+      ticketId: 'ticket_1',
+      teamId: 'team_1',
+    })
+    m.ticketsFindFirst.mockResolvedValueOnce({ id: 'ticket_1' })
+    await revokeShare('share_1' as never, 'p1' as never)
+    expect(m.notifyUnshared).toHaveBeenCalled()
+    expect(m.dUnshared).toHaveBeenCalled()
+  })
+  it('skips the notification when the ticket is gone', async () => {
+    m.sharesFindFirst.mockResolvedValueOnce({
+      id: 'share_1',
+      revokedAt: null,
+      ticketId: 'ticket_1',
+      teamId: 'team_1',
+    })
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await revokeShare('share_1' as never, null)
+    expect(m.notifyUnshared).not.toHaveBeenCalled()
+  })
+})
+
+describe('list helpers', () => {
+  it('listSharesForTicket / listTicketsSharedWithTeam return rows', async () => {
+    expect(await listSharesForTicket('ticket_1' as never)).toEqual([{ id: 'share_1' }])
+    expect(await listTicketsSharedWithTeam('team_1' as never)).toEqual([{ id: 'share_1' }])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.share.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.share.test.ts
new file mode 100644
index 000000000..934f7a928
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.share.test.ts
@@ -0,0 +1,139 @@
+/**
+ * ticket.share — verifies idempotent share, idempotent revoke, and the
+ * "no duplicate active grant" invariant.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const sharesFindFirstMock = vi.fn()
+const ticketsFindFirstMock = vi.fn()
+const insertReturningMock = vi.fn()
+const updateReturningMock = vi.fn()
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketShares: { findFirst: sharesFindFirstMock },
+      tickets: { findFirst: ticketsFindFirstMock },
+    },
+    insert: vi.fn(() => ({
+      values: vi.fn().mockReturnThis(),
+      returning: insertReturningMock,
+    })),
+    update: vi.fn(() => ({
+      set: vi.fn().mockReturnThis(),
+      where: vi.fn().mockReturnThis(),
+      returning: updateReturningMock,
+    })),
+    select: vi.fn(),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  desc: vi.fn(),
+  ticketShares: { _name: 'ticket_shares' },
+  tickets: { _name: 'tickets', id: 'tickets.id' },
+  TICKET_SHARE_LEVELS: ['read', 'comment', 'full'] as const,
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: vi.fn() }))
+vi.mock('../ticket.service', () => ({
+  writeActivity: vi.fn().mockResolvedValue({ id: 'act' }),
+  bumpLastActivity: vi.fn(),
+}))
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E }
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  sharesFindFirstMock.mockReset()
+  ticketsFindFirstMock.mockReset()
+  insertReturningMock.mockReset()
+  updateReturningMock.mockReset()
+})
+
+describe('shareTicketWithTeam', () => {
+  it('returns the existing active grant rather than inserting a duplicate', async () => {
+    ticketsFindFirstMock.mockResolvedValueOnce({ id: 'ticket_1', deletedAt: null })
+    sharesFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_share_1',
+      ticketId: 'ticket_1',
+      teamId: 'team_y',
+      accessLevel: 'read',
+      revokedAt: null,
+    })
+    const { shareTicketWithTeam } = await import('../ticket.share')
+    const result = await shareTicketWithTeam({
+      ticketId: 'ticket_1' as never,
+      teamId: 'team_y' as never,
+      grantedByPrincipalId: 'user_a' as never,
+    })
+    expect(result.id).toBe('ticket_share_1')
+    expect(insertReturningMock).not.toHaveBeenCalled()
+  })
+
+  it('inserts a new grant when none exists', async () => {
+    ticketsFindFirstMock.mockResolvedValueOnce({ id: 'ticket_1', deletedAt: null })
+    sharesFindFirstMock.mockResolvedValueOnce(undefined)
+    insertReturningMock.mockResolvedValueOnce([
+      { id: 'ticket_share_new', accessLevel: 'comment', teamId: 'team_y' },
+    ])
+    const { shareTicketWithTeam } = await import('../ticket.share')
+    const result = await shareTicketWithTeam({
+      ticketId: 'ticket_1' as never,
+      teamId: 'team_y' as never,
+      accessLevel: 'comment',
+      grantedByPrincipalId: 'user_a' as never,
+    })
+    expect(result.id).toBe('ticket_share_new')
+  })
+
+  it('rejects unknown ticket', async () => {
+    ticketsFindFirstMock.mockResolvedValueOnce(undefined)
+    const { shareTicketWithTeam } = await import('../ticket.share')
+    await expect(
+      shareTicketWithTeam({
+        ticketId: 'ticket_missing' as never,
+        teamId: 'team_y' as never,
+        grantedByPrincipalId: null,
+      })
+    ).rejects.toThrow(/not found/i)
+  })
+})
+
+describe('revokeShare', () => {
+  it('is idempotent — re-revoking returns the same row without writing', async () => {
+    sharesFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_share_1',
+      ticketId: 'ticket_1',
+      teamId: 'team_y',
+      revokedAt: new Date('2026-04-30T00:00:00.000Z'),
+    })
+    const { revokeShare } = await import('../ticket.share')
+    const result = await revokeShare('ticket_share_1' as never, null)
+    expect(result.id).toBe('ticket_share_1')
+    expect(updateReturningMock).not.toHaveBeenCalled()
+  })
+
+  it('marks an active grant as revoked', async () => {
+    sharesFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_share_1',
+      ticketId: 'ticket_1',
+      teamId: 'team_y',
+      revokedAt: null,
+    })
+    updateReturningMock.mockResolvedValueOnce([
+      { id: 'ticket_share_1', revokedAt: new Date(), revokedByPrincipalId: 'user_a' },
+    ])
+    const { revokeShare } = await import('../ticket.share')
+    const result = await revokeShare('ticket_share_1' as never, 'user_a' as never)
+    expect(result.revokedAt).not.toBeNull()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.subscriptions.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.subscriptions.test.ts
new file mode 100644
index 000000000..8228ae261
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.subscriptions.test.ts
@@ -0,0 +1,380 @@
+/**
+ * ticket.subscriptions — UPSERT semantics + mute window filtering.
+ *
+ * The schema-level concerns (FK cascade, unique constraint) live in the
+ * integration suite; here we exercise the service-layer policy decisions:
+ *   - auto sources never overwrite an existing manual row
+ *   - manual writes refuse to mutate an auto row unless `force: true`
+ *   - getSubscribers honours the mute window
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const insertReturningMock = vi.fn()
+const insertOnConflictDoNothingMock = vi.fn()
+const insertOnConflictDoUpdateMock = vi.fn()
+const updateReturningMock = vi.fn()
+const deleteReturningMock = vi.fn()
+const selectFromMock = vi.fn()
+const selectAwaitMock = vi.fn()
+
+const insertChain: Record<string, unknown> = {}
+insertChain.values = vi.fn().mockReturnThis()
+insertChain.onConflictDoNothing = vi.fn(() => ({
+  returning: insertOnConflictDoNothingMock,
+}))
+insertChain.onConflictDoUpdate = vi.fn(() => ({
+  returning: insertOnConflictDoUpdateMock,
+}))
+insertChain.returning = insertReturningMock
+
+const updateChain = {
+  set: vi.fn().mockReturnThis(),
+  where: vi.fn().mockReturnThis(),
+  returning: updateReturningMock,
+}
+
+const deleteChain = {
+  where: vi.fn().mockReturnThis(),
+  returning: deleteReturningMock,
+}
+
+const selectChain = {
+  from: vi.fn().mockReturnThis(),
+  innerJoin: vi.fn().mockReturnThis(),
+  where: vi.fn().mockReturnThis(),
+  orderBy: vi.fn().mockReturnThis(),
+  limit: vi.fn().mockResolvedValue([]),
+  then: vi.fn((resolve, reject) => Promise.resolve(selectAwaitMock()).then(resolve, reject)),
+}
+
+vi.mock('@/lib/server/db', () => {
+  return {
+    db: {
+      insert: vi.fn(() => insertChain),
+      update: vi.fn(() => updateChain),
+      delete: vi.fn(() => deleteChain),
+      select: vi.fn(() => {
+        selectFromMock()
+        return selectChain
+      }),
+    },
+    eq: vi.fn((a, b) => ({ _eq: [a, b] })),
+    and: vi.fn((...args) => ({ _and: args })),
+    or: vi.fn((...args) => ({ _or: args })),
+    isNull: vi.fn((c) => ({ _isNull: c })),
+    inArray: vi.fn(),
+    gt: vi.fn(),
+    lt: vi.fn((a, b) => ({ _lt: [a, b] })),
+    desc: vi.fn(),
+    sql: Object.assign(vi.fn(), { raw: vi.fn() }),
+    ticketSubscriptions: {
+      id: 'col.id',
+      ticketId: 'col.ticketId',
+      principalId: 'col.principalId',
+      notifyThreads: 'col.notifyThreads',
+      notifyProperties: 'col.notifyProperties',
+      notifyStatus: 'col.notifyStatus',
+      notifyAssignment: 'col.notifyAssignment',
+      notifyParticipants: 'col.notifyParticipants',
+      notifyShares: 'col.notifyShares',
+      notifySla: 'col.notifySla',
+      mutedUntil: 'col.mutedUntil',
+      createdAt: 'col.createdAt',
+    },
+    tickets: {
+      id: 'tickets.id',
+      subject: 'tickets.subject',
+      statusId: 'tickets.statusId',
+      priority: 'tickets.priority',
+      channel: 'tickets.channel',
+      updatedAt: 'tickets.updatedAt',
+    },
+  }
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  insertReturningMock.mockReset()
+  insertOnConflictDoNothingMock.mockReset()
+  insertOnConflictDoUpdateMock.mockReset()
+  updateReturningMock.mockReset()
+  deleteReturningMock.mockReset()
+  selectAwaitMock.mockReset()
+  selectChain.limit.mockResolvedValue([])
+  selectAwaitMock.mockReturnValue([])
+})
+
+describe('subscribeToTicket', () => {
+  it('auto source returns the inserted row when there is no conflict', async () => {
+    const inserted = { id: 'tkt_sub_new', source: 'auto_assigned', notifyThreads: true }
+    insertOnConflictDoNothingMock.mockResolvedValue([inserted])
+
+    const { subscribeToTicket } = await import('../ticket.subscriptions')
+    const row = await subscribeToTicket({
+      ticketId: 't1' as never,
+      principalId: 'p1' as never,
+      source: 'auto_assigned',
+    })
+
+    expect(row).toBe(inserted)
+    expect(selectChain.limit).not.toHaveBeenCalled()
+  })
+
+  it('auto source uses onConflictDoNothing and falls back to existing row', async () => {
+    insertOnConflictDoNothingMock.mockResolvedValue([]) // conflict path
+    const existing = {
+      id: 'tkt_sub_1',
+      ticketId: 't1',
+      principalId: 'p1',
+      source: 'manual',
+      notifyThreads: true,
+    }
+    selectChain.limit.mockResolvedValueOnce([existing])
+
+    const { subscribeToTicket } = await import('../ticket.subscriptions')
+    const row = await subscribeToTicket({
+      ticketId: 't1' as never,
+      principalId: 'p1' as never,
+      source: 'auto_assigned',
+    })
+    expect(row).toBe(existing)
+    expect(insertChain.onConflictDoNothing).toHaveBeenCalled()
+    expect(insertChain.onConflictDoUpdate).not.toHaveBeenCalled()
+  })
+
+  it('throws if an auto-source conflict cannot load the existing row', async () => {
+    insertOnConflictDoNothingMock.mockResolvedValue([])
+    selectChain.limit.mockResolvedValueOnce([])
+
+    const { subscribeToTicket } = await import('../ticket.subscriptions')
+    await expect(
+      subscribeToTicket({
+        ticketId: 't1' as never,
+        principalId: 'p1' as never,
+        source: 'auto_assigned',
+      })
+    ).rejects.toThrow('row vanished')
+  })
+
+  it('manual source uses onConflictDoUpdate (overwrites prefs + clears mute)', async () => {
+    insertOnConflictDoUpdateMock.mockResolvedValue([
+      { id: 'tkt_sub_2', source: 'manual', notifyThreads: false, mutedUntil: null },
+    ])
+    const { subscribeToTicket } = await import('../ticket.subscriptions')
+    const row = await subscribeToTicket({
+      ticketId: 't1' as never,
+      principalId: 'p1' as never,
+      source: 'manual',
+      prefs: { notifyThreads: false },
+    })
+    expect(insertChain.onConflictDoUpdate).toHaveBeenCalled()
+    expect(row.source).toBe('manual')
+    expect(row.notifyThreads).toBe(false)
+  })
+})
+
+describe('updateSubscriptionPrefs', () => {
+  it('returns null when there is no existing row to patch', async () => {
+    selectChain.limit.mockResolvedValueOnce([])
+
+    const { updateSubscriptionPrefs } = await import('../ticket.subscriptions')
+    const row = await updateSubscriptionPrefs({
+      ticketId: 't1' as never,
+      principalId: 'p1' as never,
+      patch: { notifyThreads: false },
+    })
+
+    expect(row).toBeNull()
+    expect(updateChain.set).not.toHaveBeenCalled()
+  })
+
+  it('refuses to mutate an auto-sourced row without force:true', async () => {
+    selectChain.limit.mockResolvedValueOnce([
+      { id: 'tkt_sub_1', source: 'auto_assigned', notifyThreads: true },
+    ])
+    const { updateSubscriptionPrefs } = await import('../ticket.subscriptions')
+    const row = await updateSubscriptionPrefs({
+      ticketId: 't1' as never,
+      principalId: 'p1' as never,
+      patch: { notifyThreads: false },
+    })
+    expect(row?.source).toBe('auto_assigned')
+    expect(updateChain.set).not.toHaveBeenCalled()
+  })
+
+  it('upgrades auto row to manual when force:true', async () => {
+    selectChain.limit.mockResolvedValueOnce([
+      { id: 'tkt_sub_1', source: 'auto_assigned', notifyThreads: true },
+    ])
+    updateReturningMock.mockResolvedValueOnce([
+      { id: 'tkt_sub_1', source: 'manual', notifyThreads: false },
+    ])
+    const { updateSubscriptionPrefs } = await import('../ticket.subscriptions')
+    const row = await updateSubscriptionPrefs({
+      ticketId: 't1' as never,
+      principalId: 'p1' as never,
+      patch: { notifyThreads: false },
+      force: true,
+    })
+    expect(updateChain.set).toHaveBeenCalled()
+    expect(row?.source).toBe('manual')
+  })
+
+  it('patches all manual preference flags without changing source', async () => {
+    selectChain.limit.mockResolvedValueOnce([{ id: 'tkt_sub_1', source: 'manual' }])
+    updateReturningMock.mockResolvedValueOnce([{ id: 'tkt_sub_1', source: 'manual' }])
+
+    const { updateSubscriptionPrefs } = await import('../ticket.subscriptions')
+    await updateSubscriptionPrefs({
+      ticketId: 't1' as never,
+      principalId: 'p1' as never,
+      patch: {
+        notifyThreads: false,
+        notifyProperties: false,
+        notifyStatus: false,
+        notifyAssignment: false,
+        notifyParticipants: true,
+        notifyShares: true,
+        notifySla: false,
+      },
+    })
+
+    expect(updateChain.set).toHaveBeenCalledWith(
+      expect.objectContaining({
+        notifyThreads: false,
+        notifyProperties: false,
+        notifyStatus: false,
+        notifyAssignment: false,
+        notifyParticipants: true,
+        notifyShares: true,
+        notifySla: false,
+      })
+    )
+    expect(updateChain.set).not.toHaveBeenCalledWith(expect.objectContaining({ source: 'manual' }))
+  })
+})
+
+describe('subscription deletion and mute state', () => {
+  it('returns whether unsubscribe deleted a row', async () => {
+    const { unsubscribeFromTicket } = await import('../ticket.subscriptions')
+
+    deleteReturningMock.mockResolvedValueOnce([{ id: 'tkt_sub_1' }])
+    await expect(unsubscribeFromTicket('t1' as never, 'p1' as never)).resolves.toBe(true)
+
+    deleteReturningMock.mockResolvedValueOnce([])
+    await expect(unsubscribeFromTicket('t1' as never, 'p1' as never)).resolves.toBe(false)
+  })
+
+  it('sets and clears mute windows', async () => {
+    const until = new Date('2026-01-01T00:00:00.000Z')
+    const { muteTicket, unmuteTicket } = await import('../ticket.subscriptions')
+
+    updateReturningMock.mockResolvedValueOnce([{ id: 'tkt_sub_1', mutedUntil: until }])
+    await expect(muteTicket('t1' as never, 'p1' as never, until)).resolves.toMatchObject({
+      mutedUntil: until,
+    })
+    expect(updateChain.set).toHaveBeenCalledWith(expect.objectContaining({ mutedUntil: until }))
+
+    updateReturningMock.mockResolvedValueOnce([])
+    await expect(unmuteTicket('t1' as never, 'p1' as never)).resolves.toBeNull()
+    expect(updateChain.set).toHaveBeenLastCalledWith(expect.objectContaining({ mutedUntil: null }))
+  })
+})
+
+describe('subscription readers', () => {
+  it('returns subscribers whose mute window does not cover now', async () => {
+    selectAwaitMock.mockReturnValueOnce([{ principalId: 'p1' }, { principalId: 'p2' }])
+
+    const { getSubscribers } = await import('../ticket.subscriptions')
+    await expect(getSubscribers('t1' as never, 'thread')).resolves.toEqual(['p1', 'p2'])
+
+    expect(selectChain.where).toHaveBeenCalled()
+  })
+
+  it('lists subscriptions for a principal with cursor pagination', async () => {
+    const rows = [{ id: 'tkt_sub_1', principalId: 'p1' }]
+    selectChain.limit.mockResolvedValueOnce(rows)
+
+    const { listSubscriptionsForPrincipal } = await import('../ticket.subscriptions')
+    await expect(
+      listSubscriptionsForPrincipal('p1' as never, {
+        limit: 10,
+        cursor: { createdAt: new Date('2026-01-01T00:00:00.000Z'), id: 'tkt_sub_0' as never },
+      })
+    ).resolves.toBe(rows)
+
+    expect(selectChain.orderBy).toHaveBeenCalled()
+    expect(selectChain.limit).toHaveBeenCalledWith(10)
+  })
+
+  it('lists subscribers for a ticket ordered by creation time', async () => {
+    const rows = [{ id: 'tkt_sub_1', ticketId: 't1' }]
+    selectAwaitMock.mockReturnValueOnce(rows)
+
+    const { listSubscribersForTicket } = await import('../ticket.subscriptions')
+    await expect(listSubscribersForTicket('t1' as never)).resolves.toBe(rows)
+
+    expect(selectChain.orderBy).toHaveBeenCalled()
+  })
+
+  it('lists subscriptions with ticket snapshots and maps the joined rows', async () => {
+    const updatedAt = new Date('2026-01-01T00:00:00.000Z')
+    selectChain.limit.mockResolvedValueOnce([
+      {
+        sub: { id: 'tkt_sub_1', principalId: 'p1' },
+        ticket: {
+          id: 'ticket_1',
+          subject: 'Need help',
+          statusId: null,
+          priority: 'normal',
+          channel: 'portal',
+          updatedAt,
+        },
+      },
+    ])
+
+    const { listSubscriptionsForPrincipalWithTickets } = await import('../ticket.subscriptions')
+    await expect(
+      listSubscriptionsForPrincipalWithTickets('p1' as never, { limit: 1 })
+    ).resolves.toEqual([
+      {
+        id: 'tkt_sub_1',
+        principalId: 'p1',
+        ticket: {
+          id: 'ticket_1',
+          subject: 'Need help',
+          statusId: null,
+          priority: 'normal',
+          channel: 'portal',
+          updatedAt,
+        },
+      },
+    ])
+    expect(selectChain.innerJoin).toHaveBeenCalled()
+  })
+})
+
+describe('safeSubscribe', () => {
+  it('swallows subscription setup failures and logs a warning', async () => {
+    insertOnConflictDoNothingMock.mockResolvedValue([])
+    selectChain.limit.mockResolvedValueOnce([])
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    try {
+      const { safeSubscribe } = await import('../ticket.subscriptions')
+      await expect(
+        safeSubscribe({
+          ticketId: 't1' as never,
+          principalId: 'p1' as never,
+          source: 'auto_assigned',
+        })
+      ).resolves.toBeUndefined()
+      expect(warn).toHaveBeenCalledWith(
+        '[tickets.subscriptions] safeSubscribe failed',
+        expect.any(Error)
+      )
+    } finally {
+      warn.mockRestore()
+    }
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.take-return.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.take-return.diffcov.test.ts
new file mode 100644
index 000000000..7c99672c1
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.take-return.diffcov.test.ts
@@ -0,0 +1,42 @@
+/**
+ * Differential-coverage tests for ticket.take-return — take/return wrappers
+ * over assignTicket, including the not-found guards.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({ getTicket: vi.fn(), assignTicket: vi.fn() }))
+
+vi.mock('../ticket.service', () => ({
+  getTicket: (...a: unknown[]) => m.getTicket(...a),
+  assignTicket: (...a: unknown[]) => m.assignTicket(...a),
+}))
+
+import { takeTicket, returnTicket } from '../ticket.take-return'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.getTicket.mockResolvedValue({ updatedAt: new Date('2026-01-01') })
+  m.assignTicket.mockResolvedValue({ id: 'ticket_1' })
+})
+
+describe('takeTicket / returnTicket', () => {
+  it('takeTicket assigns the actor', async () => {
+    await takeTicket('ticket_1' as never, 'p_actor' as never)
+    expect(m.assignTicket).toHaveBeenCalledWith(
+      'ticket_1',
+      expect.objectContaining({ assigneePrincipalId: 'p_actor' })
+    )
+  })
+  it('returnTicket clears the assignee', async () => {
+    await returnTicket('ticket_1' as never, 'p_actor' as never)
+    expect(m.assignTicket).toHaveBeenCalledWith(
+      'ticket_1',
+      expect.objectContaining({ assigneePrincipalId: null })
+    )
+  })
+  it('both throw when the ticket is missing', async () => {
+    m.getTicket.mockResolvedValue(undefined)
+    await expect(takeTicket('ticket_1' as never, 'p' as never)).rejects.toThrow('not found')
+    await expect(returnTicket('ticket_1' as never, 'p' as never)).rejects.toThrow('not found')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.diffcov.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.diffcov.test.ts
new file mode 100644
index 000000000..439c726dc
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.diffcov.test.ts
@@ -0,0 +1,324 @@
+/**
+ * Differential-coverage tests for ticket.threads — add (audience validation,
+ * share-grant guard, body validation, first-response side-effect, sla/notify/
+ * dispatch hooks), edit (owner + body guards), soft-delete (already-deleted
+ * guard), and the audience-aware list filter.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  ticketsFindFirst: vi.fn(),
+  threadsFindFirst: vi.fn(),
+  sharesFindFirst: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  selectOrderBy: vi.fn(),
+  recordEvent: vi.fn(),
+  writeActivity: vi.fn(),
+  onCustomerReply: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  onPublicAgentReply: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  notifyThreadAdded: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({ type: 'user', principalId: 'p1' })),
+  dThreadAdded: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dFirstResponse: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dThreadUpdated: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dThreadDeleted: vi.fn((..._a: unknown[]) => Promise.resolve()),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      tickets: { findFirst: m.ticketsFindFirst },
+      ticketThreads: { findFirst: m.threadsFindFirst },
+      ticketShares: { findFirst: m.sharesFindFirst },
+    },
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({
+      set: () => ({
+        where: () => ({
+          returning: m.updateReturning,
+          then: (r: (v: unknown) => void) => r(undefined),
+        }),
+      }),
+    }),
+    select: () => ({ from: () => ({ where: () => ({ orderBy: () => m.selectOrderBy() }) }) }),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  asc: vi.fn(),
+  inArray: vi.fn(),
+  TICKET_THREAD_AUDIENCES: ['public', 'internal', 'shared_team'],
+  tickets: { id: 't.id', deletedAt: 't.deletedAt' },
+  ticketThreads: {
+    id: 'tt.id',
+    ticketId: 'tt.ticketId',
+    deletedAt: 'tt.deletedAt',
+    createdAt: 'tt.createdAt',
+  },
+  ticketShares: { ticketId: 'ts.ticketId', teamId: 'ts.teamId', revokedAt: 'ts.revokedAt' },
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: (...a: unknown[]) => m.recordEvent(...a) }))
+vi.mock('@/lib/server/sanitize-tiptap', () => ({ sanitizeTiptapContent: (j: unknown) => j }))
+vi.mock('../tiptap-text', () => ({ tiptapToPlainText: () => 'plain text' }))
+vi.mock('../ticket.service', () => ({ writeActivity: (...a: unknown[]) => m.writeActivity(...a) }))
+vi.mock('../sla/sla.engine', () => ({
+  onCustomerReply: (...a: unknown[]) => m.onCustomerReply(...a),
+  onPublicAgentReply: (...a: unknown[]) => m.onPublicAgentReply(...a),
+}))
+vi.mock('../../sla/sla.engine', () => ({
+  onCustomerReply: (...a: unknown[]) => m.onCustomerReply(...a),
+  onPublicAgentReply: (...a: unknown[]) => m.onPublicAgentReply(...a),
+}))
+vi.mock('./ticket.notifications', () => ({
+  notifyThreadAdded: (...a: unknown[]) => m.notifyThreadAdded(...a),
+}))
+vi.mock('../ticket.notifications', () => ({
+  notifyThreadAdded: (...a: unknown[]) => m.notifyThreadAdded(...a),
+}))
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...a: unknown[]) => m.buildEventActor(...a),
+  dispatchTicketThreadAdded: (...a: unknown[]) => m.dThreadAdded(...a),
+  dispatchTicketFirstResponse: (...a: unknown[]) => m.dFirstResponse(...a),
+  dispatchTicketThreadUpdated: (...a: unknown[]) => m.dThreadUpdated(...a),
+  dispatchTicketThreadDeleted: (...a: unknown[]) => m.dThreadDeleted(...a),
+}))
+
+import {
+  addThread,
+  editThread,
+  softDeleteThread,
+  listThreads,
+  getThread,
+  loadThreadsByTicketIds,
+  listPublicThreadsForTicket,
+} from '../ticket.threads'
+
+const ticket = (over: Record<string, unknown> = {}) => ({
+  id: 'ticket_1',
+  deletedAt: null,
+  firstResponseAt: null,
+  requesterPrincipalId: 'req_p',
+  ...over,
+})
+const thread = (over: Record<string, unknown> = {}) => ({
+  id: 'thread_1',
+  ticketId: 'ticket_1',
+  deletedAt: null,
+  principalId: 'p1',
+  audience: 'public',
+  sharedWithTeamId: null,
+  bodyText: 'old',
+  bodyJson: null,
+  createdAt: new Date('2026-01-01'),
+  editedAt: null,
+  ...over,
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.ticketsFindFirst.mockResolvedValue(ticket())
+  m.threadsFindFirst.mockResolvedValue(undefined)
+  m.sharesFindFirst.mockResolvedValue({ id: 'share_1' })
+  m.insertReturning.mockResolvedValue([thread()])
+  m.updateReturning.mockResolvedValue([thread()])
+  m.selectOrderBy.mockResolvedValue([])
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('addThread validation', () => {
+  it('rejects invalid audience and bad shared_team combos', async () => {
+    await expect(
+      addThread({ ticketId: 't', principalId: 'p1', audience: 'bogus' } as never)
+    ).rejects.toThrow('invalid audience')
+    await expect(
+      addThread({ ticketId: 't', principalId: 'p1', audience: 'shared_team' } as never)
+    ).rejects.toThrow('required for shared_team')
+    await expect(
+      addThread({
+        ticketId: 't',
+        principalId: 'p1',
+        audience: 'public',
+        sharedWithTeamId: 'team_1',
+      } as never)
+    ).rejects.toThrow('only valid for shared_team')
+  })
+  it('rejects a missing ticket and a missing share grant', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      addThread({ ticketId: 't', principalId: 'p1', audience: 'public', bodyText: 'hi' } as never)
+    ).rejects.toThrow('not found')
+    m.sharesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      addThread({
+        ticketId: 't',
+        principalId: 'p1',
+        audience: 'shared_team',
+        sharedWithTeamId: 'team_1',
+        bodyText: 'hi',
+      } as never)
+    ).rejects.toThrow('share grant')
+  })
+  it('rejects empty and over-long bodies', async () => {
+    await expect(
+      addThread({
+        ticketId: 't',
+        principalId: 'p1',
+        audience: 'internal',
+        bodyText: '   ',
+        bodyJson: null,
+      } as never)
+    ).rejects.toThrow('cannot be empty')
+    await expect(
+      addThread({
+        ticketId: 't',
+        principalId: 'p1',
+        audience: 'internal',
+        bodyText: 'x'.repeat(100_001),
+      } as never)
+    ).rejects.toThrow('exceeds')
+  })
+})
+
+describe('addThread success paths', () => {
+  it('public agent reply triggers first-response + agent SLA + dispatch', async () => {
+    const created = await addThread({
+      ticketId: 'ticket_1',
+      principalId: 'agent_p',
+      audience: 'public',
+      bodyText: 'reply',
+    } as never)
+    expect(created.id).toBe('thread_1')
+    expect(m.onPublicAgentReply).toHaveBeenCalled()
+    expect(m.dFirstResponse).toHaveBeenCalled()
+    expect(m.dThreadAdded).toHaveBeenCalled()
+  })
+  it('public customer reply triggers the customer SLA hook (no first response)', async () => {
+    m.ticketsFindFirst.mockResolvedValueOnce(
+      ticket({ requesterPrincipalId: 'req_p', firstResponseAt: new Date() })
+    )
+    await addThread({
+      ticketId: 'ticket_1',
+      principalId: 'req_p',
+      audience: 'public',
+      bodyJson: { type: 'doc' },
+    } as never)
+    expect(m.onCustomerReply).toHaveBeenCalled()
+    expect(m.dFirstResponse).not.toHaveBeenCalled()
+  })
+  it('internal thread skips SLA hooks but still notifies + dispatches', async () => {
+    await addThread({
+      ticketId: 'ticket_1',
+      principalId: 'agent_p',
+      audience: 'internal',
+      bodyText: 'note',
+    } as never)
+    expect(m.onPublicAgentReply).not.toHaveBeenCalled()
+    expect(m.notifyThreadAdded).toHaveBeenCalled()
+  })
+  it('swallows sla / notify / dispatch failures', async () => {
+    m.onPublicAgentReply.mockRejectedValueOnce(new Error('sla'))
+    m.notifyThreadAdded.mockRejectedValueOnce(new Error('notify'))
+    m.dThreadAdded.mockRejectedValueOnce(new Error('dispatch'))
+    const created = await addThread({
+      ticketId: 'ticket_1',
+      principalId: 'agent_p',
+      audience: 'public',
+      bodyText: 'reply',
+    } as never)
+    expect(created.id).toBe('thread_1')
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
+
+describe('editThread', () => {
+  it('throws when missing/deleted and when not the owner', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      editThread({ threadId: 'thread_1', actorPrincipalId: 'p1' } as never)
+    ).rejects.toThrow('not found')
+    m.threadsFindFirst.mockResolvedValueOnce(thread({ principalId: 'owner', deletedAt: null }))
+    await expect(
+      editThread({ threadId: 'thread_1', actorPrincipalId: 'someone-else' } as never)
+    ).rejects.toThrow('another user')
+  })
+  it('rejects an empty edited body', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(thread({ bodyText: '', bodyJson: null }))
+    await expect(
+      editThread({
+        threadId: 'thread_1',
+        actorPrincipalId: 'p1',
+        bodyText: '  ',
+        bodyJson: null,
+      } as never)
+    ).rejects.toThrow('cannot be empty')
+  })
+  it('edits and dispatches an update', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(thread())
+    m.updateReturning.mockResolvedValueOnce([thread({ editedAt: new Date() })])
+    await editThread({ threadId: 'thread_1', actorPrincipalId: 'p1', bodyText: 'new' } as never)
+    expect(m.dThreadUpdated).toHaveBeenCalled()
+  })
+})
+
+describe('softDeleteThread', () => {
+  it('throws when missing or already deleted', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(undefined)
+    await expect(softDeleteThread('thread_1' as never, 'p1' as never)).rejects.toThrow('not found')
+    m.threadsFindFirst.mockResolvedValueOnce(thread({ deletedAt: new Date() }))
+    await expect(softDeleteThread('thread_1' as never, 'p1' as never)).rejects.toThrow(
+      'already deleted'
+    )
+  })
+  it('soft-deletes and dispatches', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(thread())
+    await softDeleteThread('thread_1' as never, 'p1' as never)
+    expect(m.dThreadDeleted).toHaveBeenCalled()
+  })
+})
+
+describe('listThreads + helpers', () => {
+  it('filters rows by audience for a viewer', async () => {
+    m.selectOrderBy.mockResolvedValueOnce([
+      thread({ id: 'a', audience: 'public' }),
+      thread({ id: 'b', audience: 'internal' }),
+      thread({ id: 'c', audience: 'shared_team', sharedWithTeamId: 'team_1' }),
+      thread({ id: 'd', audience: 'shared_team', sharedWithTeamId: null }),
+      thread({ id: 'e', audience: 'bogus' }),
+    ])
+    const res = await listThreads('ticket_1' as never, {
+      viewerTeamIds: ['team_1'] as never,
+      canSeeInternal: true,
+    })
+    expect(res.map((r) => r.id)).toEqual(['a', 'b', 'c'])
+  })
+  it('requester sees public only', async () => {
+    m.selectOrderBy.mockResolvedValueOnce([
+      thread({ id: 'a', audience: 'public' }),
+      thread({ id: 'b', audience: 'internal' }),
+    ])
+    const res = await listThreads('ticket_1' as never, {
+      viewerTeamIds: [],
+      canSeeInternal: true,
+      isRequester: true,
+      includeDeleted: true,
+    })
+    expect(res.map((r) => r.id)).toEqual(['a'])
+  })
+  it('getThread returns null when missing', async () => {
+    expect(await getThread('thread_1' as never)).toBeNull()
+  })
+  it('loadThreadsByTicketIds short-circuits on empty', async () => {
+    expect(await loadThreadsByTicketIds([])).toEqual([])
+    m.selectOrderBy.mockResolvedValueOnce([thread()])
+    expect(await loadThreadsByTicketIds(['ticket_1'] as never)).toHaveLength(1)
+  })
+  it('listPublicThreadsForTicket delegates to public-only', async () => {
+    m.selectOrderBy.mockResolvedValueOnce([
+      thread({ audience: 'public' }),
+      thread({ audience: 'internal' }),
+    ])
+    expect(await listPublicThreadsForTicket('ticket_1' as never)).toHaveLength(1)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.gap.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.gap.test.ts
new file mode 100644
index 000000000..b5cc059c0
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.gap.test.ts
@@ -0,0 +1,198 @@
+/**
+ * ticket.threads — gap tests for branches not hit by the diffcov suite:
+ * system (null-principal) service-actor paths in add/edit/delete, the
+ * null-bodyJson edit fallback, and the null shared-team / null body
+ * fallbacks in the dispatch payloads.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  ticketsFindFirst: vi.fn(),
+  threadsFindFirst: vi.fn(),
+  sharesFindFirst: vi.fn(),
+  insertReturning: vi.fn(),
+  updateReturning: vi.fn(),
+  selectOrderBy: vi.fn(),
+  recordEvent: vi.fn(),
+  writeActivity: vi.fn(),
+  onCustomerReply: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  onPublicAgentReply: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  notifyThreadAdded: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  buildEventActor: vi.fn((..._a: unknown[]) => ({ type: 'user', principalId: 'p1' })),
+  dThreadAdded: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dFirstResponse: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dThreadUpdated: vi.fn((..._a: unknown[]) => Promise.resolve()),
+  dThreadDeleted: vi.fn((..._a: unknown[]) => Promise.resolve()),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      tickets: { findFirst: m.ticketsFindFirst },
+      ticketThreads: { findFirst: m.threadsFindFirst },
+      ticketShares: { findFirst: m.sharesFindFirst },
+    },
+    insert: () => ({ values: () => ({ returning: m.insertReturning }) }),
+    update: () => ({
+      set: () => ({
+        where: () => ({
+          returning: m.updateReturning,
+          then: (r: (v: unknown) => void) => r(undefined),
+        }),
+      }),
+    }),
+    select: () => ({ from: () => ({ where: () => ({ orderBy: () => m.selectOrderBy() }) }) }),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  asc: vi.fn(),
+  inArray: vi.fn(),
+  TICKET_THREAD_AUDIENCES: ['public', 'internal', 'shared_team'],
+  tickets: { id: 't.id', deletedAt: 't.deletedAt' },
+  ticketThreads: {
+    id: 'tt.id',
+    ticketId: 'tt.ticketId',
+    deletedAt: 'tt.deletedAt',
+    createdAt: 'tt.createdAt',
+  },
+  ticketShares: { ticketId: 'ts.ticketId', teamId: 'ts.teamId', revokedAt: 'ts.revokedAt' },
+}))
+
+vi.mock('../../audit', () => ({ recordEvent: m.recordEvent }))
+vi.mock('@/lib/server/sanitize-tiptap', () => ({ sanitizeTiptapContent: (j: unknown) => j }))
+vi.mock('../tiptap-text', () => ({ tiptapToPlainText: () => 'plain text' }))
+vi.mock('../ticket.service', () => ({ writeActivity: m.writeActivity }))
+vi.mock('../sla/sla.engine', () => ({
+  onCustomerReply: m.onCustomerReply,
+  onPublicAgentReply: m.onPublicAgentReply,
+}))
+vi.mock('../../sla/sla.engine', () => ({
+  onCustomerReply: m.onCustomerReply,
+  onPublicAgentReply: m.onPublicAgentReply,
+}))
+vi.mock('./ticket.notifications', () => ({
+  notifyThreadAdded: m.notifyThreadAdded,
+}))
+vi.mock('../ticket.notifications', () => ({
+  notifyThreadAdded: m.notifyThreadAdded,
+}))
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: m.buildEventActor,
+  dispatchTicketThreadAdded: m.dThreadAdded,
+  dispatchTicketFirstResponse: m.dFirstResponse,
+  dispatchTicketThreadUpdated: m.dThreadUpdated,
+  dispatchTicketThreadDeleted: m.dThreadDeleted,
+}))
+
+import { addThread, editThread, softDeleteThread } from '../ticket.threads'
+
+const ticket = (over: Record<string, unknown> = {}) => ({
+  id: 'ticket_1',
+  deletedAt: null,
+  firstResponseAt: null,
+  requesterPrincipalId: 'req_p',
+  ...over,
+})
+const thread = (over: Record<string, unknown> = {}) => ({
+  id: 'thread_1',
+  ticketId: 'ticket_1',
+  deletedAt: null,
+  principalId: 'p1',
+  audience: 'public',
+  sharedWithTeamId: null,
+  bodyText: 'old',
+  bodyJson: null,
+  createdAt: new Date('2026-01-01'),
+  editedAt: null,
+  ...over,
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.ticketsFindFirst.mockResolvedValue(ticket())
+  m.threadsFindFirst.mockResolvedValue(undefined)
+  m.sharesFindFirst.mockResolvedValue({ id: 'share_1' })
+  m.insertReturning.mockResolvedValue([thread()])
+  m.updateReturning.mockResolvedValue([thread()])
+  m.selectOrderBy.mockResolvedValue([])
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('addThread system (null principal) path', () => {
+  it('builds a service actor and skips SLA hooks when principalId is null', async () => {
+    await addThread({
+      ticketId: 'ticket_1',
+      principalId: null,
+      audience: 'public',
+      bodyText: 'system note',
+    } as never)
+    // null principal -> no SLA hook fired (neither customer nor agent branch)
+    expect(m.onCustomerReply).not.toHaveBeenCalled()
+    expect(m.onPublicAgentReply).not.toHaveBeenCalled()
+    // service actor (buildEventActor not used for the dispatch actor)
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+    expect(m.dThreadAdded).toHaveBeenCalled()
+    // firstResponseFired is false (principalId null), so no first-response dispatch
+    expect(m.dFirstResponse).not.toHaveBeenCalled()
+  })
+
+  it('missing active share grant rejects shared_team threads', async () => {
+    m.sharesFindFirst.mockResolvedValueOnce(undefined)
+    await expect(
+      addThread({
+        ticketId: 'ticket_1',
+        principalId: 'agent_p',
+        audience: 'shared_team',
+        sharedWithTeamId: 'team_1',
+        bodyText: 'note',
+      } as never)
+    ).rejects.toThrow('share grant')
+  })
+})
+
+describe('editThread fallbacks', () => {
+  it('keeps existing bodyJson and uses a service actor when actor is null', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(
+      thread({ principalId: null, bodyJson: { type: 'doc' }, bodyText: 'keep' })
+    )
+    m.updateReturning.mockResolvedValueOnce([
+      thread({ principalId: null, sharedWithTeamId: null, editedAt: new Date() }),
+    ])
+    await editThread({
+      threadId: 'thread_1',
+      actorPrincipalId: null,
+      bodyText: 'new body',
+    } as never)
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+    expect(m.dThreadUpdated).toHaveBeenCalled()
+  })
+
+  it('skips dispatch when the parent ticket is gone', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(thread())
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await editThread({ threadId: 'thread_1', actorPrincipalId: 'p1', bodyText: 'new' } as never)
+    expect(m.dThreadUpdated).not.toHaveBeenCalled()
+  })
+})
+
+describe('softDeleteThread fallbacks', () => {
+  it('uses a service actor and empty-body fallback when fields are null', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(
+      thread({ principalId: null, bodyText: null, sharedWithTeamId: null })
+    )
+    m.updateReturning.mockResolvedValueOnce([
+      thread({ principalId: null, bodyText: null, sharedWithTeamId: null, deletedAt: new Date() }),
+    ])
+    await softDeleteThread('thread_1' as never, null)
+    expect(m.buildEventActor).not.toHaveBeenCalled()
+    expect(m.dThreadDeleted).toHaveBeenCalled()
+  })
+
+  it('skips dispatch when the parent ticket is gone', async () => {
+    m.threadsFindFirst.mockResolvedValueOnce(thread())
+    m.ticketsFindFirst.mockResolvedValueOnce(undefined)
+    await softDeleteThread('thread_1' as never, 'p1' as never)
+    expect(m.dThreadDeleted).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.test.ts
new file mode 100644
index 000000000..4f54b1dc8
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/ticket.threads.test.ts
@@ -0,0 +1,583 @@
+/**
+ * ticket.threads — verifies first-response timestamp behaviour and audience
+ * filtering in `listThreads`.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const ticketFindFirstMock = vi.fn()
+const sharesFindFirstMock = vi.fn()
+const threadFindFirstMock = vi.fn()
+const insertThreadsReturningMock = vi.fn()
+const insertActivityReturningMock = vi.fn()
+const updateChainSetMock = vi.fn()
+const updateTicketChainWhereMock = vi.fn()
+const updateReturningMock = vi.fn()
+const selectFromMock = vi.fn()
+const selectWhereMock = vi.fn()
+const selectOrderByMock = vi.fn()
+const notifyThreadAddedMock = vi.fn()
+const onCustomerReplyMock = vi.fn()
+const onPublicAgentReplyMock = vi.fn()
+const dispatchTicketThreadAddedMock = vi.fn()
+const dispatchTicketFirstResponseMock = vi.fn()
+const dispatchTicketThreadUpdatedMock = vi.fn()
+const dispatchTicketThreadDeletedMock = vi.fn()
+const buildEventActorMock = vi.fn((input: { principalId: string; displayName?: string }) => ({
+  type: 'user' as const,
+  principalId: input.principalId,
+  displayName: input.displayName ?? 'ticket-system',
+}))
+
+vi.mock('@/lib/server/db', () => {
+  const insertChain = (which: 'threads' | 'activity') => ({
+    values: vi.fn().mockReturnThis(),
+    returning: which === 'threads' ? insertThreadsReturningMock : insertActivityReturningMock,
+  })
+  const updateChain = {
+    set: (patch: unknown) => {
+      updateChainSetMock(patch)
+      return updateChain
+    },
+    where: (...args: unknown[]) => {
+      updateTicketChainWhereMock(...args)
+      return {
+        returning: updateReturningMock,
+      }
+    },
+  }
+  return {
+    db: {
+      query: {
+        tickets: { findFirst: ticketFindFirstMock },
+        ticketShares: { findFirst: sharesFindFirstMock },
+        ticketThreads: { findFirst: threadFindFirstMock },
+      },
+      insert: vi.fn((tbl: { _name: string }) => {
+        if (tbl._name === 'ticket_activity') return insertChain('activity')
+        return insertChain('threads')
+      }),
+      update: vi.fn(() => updateChain),
+      select: vi.fn(() => ({
+        from: (table: unknown) => {
+          selectFromMock(table)
+          return {
+            where: (condition: unknown) => {
+              selectWhereMock(condition)
+              return { orderBy: (...args: unknown[]) => selectOrderByMock(...args) }
+            },
+          }
+        },
+      })),
+    },
+    eq: vi.fn((left: unknown, right: unknown) => ['eq', left, right]),
+    and: vi.fn((...parts: unknown[]) => ['and', ...parts]),
+    or: vi.fn((...parts: unknown[]) => ['or', ...parts]),
+    isNull: vi.fn((value: unknown) => ['isNull', value]),
+    asc: vi.fn((value: unknown) => ['asc', value]),
+    inArray: vi.fn((left: unknown, right: unknown) => ['inArray', left, right]),
+    tickets: {
+      _name: 'tickets',
+      id: 'tickets.id',
+      deletedAt: 'tickets.deletedAt',
+    },
+    ticketThreads: {
+      _name: 'ticket_threads',
+      id: 'ticketThreads.id',
+      ticketId: 'ticketThreads.ticketId',
+      deletedAt: 'ticketThreads.deletedAt',
+      createdAt: 'ticketThreads.createdAt',
+    },
+    ticketShares: {
+      _name: 'ticket_shares',
+      ticketId: 'ticketShares.ticketId',
+      teamId: 'ticketShares.teamId',
+      revokedAt: 'ticketShares.revokedAt',
+    },
+    TICKET_THREAD_AUDIENCES: ['public', 'internal', 'shared_team'] as const,
+  }
+})
+
+vi.mock('@/lib/server/sanitize-tiptap', () => ({
+  sanitizeTiptapContent: (c: unknown) => c,
+}))
+
+vi.mock('../../audit', () => ({
+  recordEvent: vi.fn(),
+}))
+
+vi.mock('../ticket.service', () => ({
+  writeActivity: vi.fn().mockResolvedValue({ id: 'ticket_act_x' }),
+  bumpLastActivity: vi.fn(),
+}))
+
+vi.mock('../ticket.notifications', () => ({
+  notifyThreadAdded: (...args: unknown[]) => notifyThreadAddedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/sla/sla.engine', () => ({
+  onCustomerReply: (...args: unknown[]) => onCustomerReplyMock(...args),
+  onPublicAgentReply: (...args: unknown[]) => onPublicAgentReplyMock(...args),
+}))
+
+vi.mock('@/lib/server/events/dispatch', () => ({
+  buildEventActor: (...args: unknown[]) =>
+    buildEventActorMock(...(args as [{ principalId: string; displayName?: string }])),
+  dispatchTicketThreadAdded: (...args: unknown[]) => dispatchTicketThreadAddedMock(...args),
+  dispatchTicketFirstResponse: (...args: unknown[]) => dispatchTicketFirstResponseMock(...args),
+  dispatchTicketThreadUpdated: (...args: unknown[]) => dispatchTicketThreadUpdatedMock(...args),
+  dispatchTicketThreadDeleted: (...args: unknown[]) => dispatchTicketThreadDeletedMock(...args),
+}))
+
+vi.mock('@/lib/shared/errors', () => {
+  class E extends Error {
+    code: string
+    constructor(c: string, m: string) {
+      super(m)
+      this.code = c
+    }
+  }
+  return { ConflictError: E, NotFoundError: E, ValidationError: E, ForbiddenError: E }
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  ticketFindFirstMock.mockReset()
+  sharesFindFirstMock.mockReset()
+  threadFindFirstMock.mockReset()
+  insertThreadsReturningMock.mockReset()
+  insertActivityReturningMock.mockReset()
+  insertActivityReturningMock.mockResolvedValue([{ id: 'act' }])
+  updateReturningMock.mockReset()
+  updateChainSetMock.mockReset()
+  updateTicketChainWhereMock.mockReset()
+  selectFromMock.mockReset()
+  selectWhereMock.mockReset()
+  selectOrderByMock.mockReset()
+  selectOrderByMock.mockResolvedValue([])
+  notifyThreadAddedMock.mockReset()
+  notifyThreadAddedMock.mockResolvedValue(undefined)
+  onCustomerReplyMock.mockReset()
+  onCustomerReplyMock.mockResolvedValue(undefined)
+  onPublicAgentReplyMock.mockReset()
+  onPublicAgentReplyMock.mockResolvedValue(undefined)
+  dispatchTicketThreadAddedMock.mockReset()
+  dispatchTicketThreadAddedMock.mockResolvedValue(undefined)
+  dispatchTicketFirstResponseMock.mockReset()
+  dispatchTicketFirstResponseMock.mockResolvedValue(undefined)
+  dispatchTicketThreadUpdatedMock.mockReset()
+  dispatchTicketThreadUpdatedMock.mockResolvedValue(undefined)
+  dispatchTicketThreadDeletedMock.mockReset()
+  dispatchTicketThreadDeletedMock.mockResolvedValue(undefined)
+  buildEventActorMock.mockClear()
+})
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'ticket_1',
+    requesterPrincipalId: 'user_requester',
+    firstResponseAt: null,
+    deletedAt: null,
+    ...overrides,
+  }
+}
+
+function thread(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'thread_1',
+    ticketId: 'ticket_1',
+    principalId: 'user_agent',
+    audience: 'public',
+    bodyJson: null,
+    bodyText: 'hello',
+    sharedWithTeamId: null,
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    editedAt: null,
+    deletedAt: null,
+    ...overrides,
+  }
+}
+
+describe('addThread — firstResponseAt', () => {
+  it('sets firstResponseAt when first PUBLIC thread is from a non-requester', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_1',
+      requesterPrincipalId: 'user_requester',
+      firstResponseAt: null,
+      deletedAt: null,
+    })
+    insertThreadsReturningMock.mockResolvedValueOnce([{ id: 'thread_1', audience: 'public' }])
+    const { addThread } = await import('../ticket.threads')
+    await addThread({
+      ticketId: 'ticket_1' as never,
+      principalId: 'user_agent' as never,
+      audience: 'public',
+      bodyText: 'hello',
+    })
+    // The header-update call must include firstResponseAt
+    expect(updateChainSetMock).toHaveBeenCalled()
+    const patch = updateChainSetMock.mock.calls[0][0] as Record<string, unknown>
+    expect(patch.firstResponseAt).toBeInstanceOf(Date)
+  })
+
+  it('does NOT set firstResponseAt when the author is the requester', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_1',
+      requesterPrincipalId: 'user_requester',
+      firstResponseAt: null,
+      deletedAt: null,
+    })
+    insertThreadsReturningMock.mockResolvedValueOnce([{ id: 'thread_1', audience: 'public' }])
+    const { addThread } = await import('../ticket.threads')
+    await addThread({
+      ticketId: 'ticket_1' as never,
+      principalId: 'user_requester' as never,
+      audience: 'public',
+      bodyText: 'follow up',
+    })
+    const patch = updateChainSetMock.mock.calls[0][0] as Record<string, unknown>
+    expect(patch.firstResponseAt).toBeUndefined()
+  })
+
+  it('does NOT set firstResponseAt for internal-only threads', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_1',
+      requesterPrincipalId: 'user_requester',
+      firstResponseAt: null,
+      deletedAt: null,
+    })
+    insertThreadsReturningMock.mockResolvedValueOnce([{ id: 'thread_1', audience: 'internal' }])
+    const { addThread } = await import('../ticket.threads')
+    await addThread({
+      ticketId: 'ticket_1' as never,
+      principalId: 'user_agent' as never,
+      audience: 'internal',
+      bodyText: 'note to self',
+    })
+    const patch = updateChainSetMock.mock.calls[0][0] as Record<string, unknown>
+    expect(patch.firstResponseAt).toBeUndefined()
+  })
+
+  it('refuses shared_team thread when no active share grant exists', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_1',
+      requesterPrincipalId: 'user_requester',
+      firstResponseAt: null,
+      deletedAt: null,
+    })
+    sharesFindFirstMock.mockResolvedValueOnce(undefined)
+    const { addThread } = await import('../ticket.threads')
+    await expect(
+      addThread({
+        ticketId: 'ticket_1' as never,
+        principalId: 'user_agent' as never,
+        audience: 'shared_team',
+        sharedWithTeamId: 'team_y' as never,
+        bodyText: 'fyi',
+      })
+    ).rejects.toThrow(/share grant/i)
+  })
+
+  it('rejects empty bodies', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce({
+      id: 'ticket_1',
+      requesterPrincipalId: null,
+      firstResponseAt: null,
+      deletedAt: null,
+    })
+    const { addThread } = await import('../ticket.threads')
+    await expect(
+      addThread({
+        ticketId: 'ticket_1' as never,
+        principalId: null,
+        audience: 'public',
+        bodyText: '   ',
+      })
+    ).rejects.toThrow(/empty/i)
+  })
+
+  it('validates audience/team combinations and missing tickets before writing', async () => {
+    const { addThread } = await import('../ticket.threads')
+
+    await expect(
+      addThread({
+        ticketId: 'ticket_1' as never,
+        principalId: 'user_agent' as never,
+        audience: 'invalid' as never,
+        bodyText: 'hello',
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_AUDIENCE_INVALID' })
+
+    await expect(
+      addThread({
+        ticketId: 'ticket_1' as never,
+        principalId: 'user_agent' as never,
+        audience: 'shared_team',
+        bodyText: 'hello',
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_SHARED_TEAM_REQUIRED' })
+
+    await expect(
+      addThread({
+        ticketId: 'ticket_1' as never,
+        principalId: 'user_agent' as never,
+        audience: 'public',
+        sharedWithTeamId: 'team_1' as never,
+        bodyText: 'hello',
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_SHARED_TEAM_NOT_ALLOWED' })
+
+    ticketFindFirstMock.mockResolvedValueOnce(undefined)
+    await expect(
+      addThread({
+        ticketId: 'ticket_1' as never,
+        principalId: 'user_agent' as never,
+        audience: 'public',
+        bodyText: 'hello',
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_NOT_FOUND' })
+
+    ticketFindFirstMock.mockResolvedValueOnce(ticket())
+    await expect(
+      addThread({
+        ticketId: 'ticket_1' as never,
+        principalId: 'user_agent' as never,
+        audience: 'public',
+        bodyText: 'x'.repeat(100_001),
+      })
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_TOO_LONG' })
+  })
+
+  it('fires SLA, notification, and webhook side effects for public first responses', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce(ticket())
+    const created = thread({ id: 'thread_long', bodyText: 'ignored' })
+    insertThreadsReturningMock.mockResolvedValueOnce([created])
+    const bodyText = 'x'.repeat(510)
+
+    const { addThread } = await import('../ticket.threads')
+    await expect(
+      addThread({
+        ticketId: 'ticket_1' as never,
+        principalId: 'user_agent' as never,
+        audience: 'public',
+        bodyText,
+        syncSourceIntegrationId: 'github_1',
+      })
+    ).resolves.toBe(created)
+
+    expect(onPublicAgentReplyMock).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 'ticket_1', firstResponseAt: expect.any(Date) }),
+      'user_agent'
+    )
+    expect(onCustomerReplyMock).not.toHaveBeenCalled()
+    expect(notifyThreadAddedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 'ticket_1' }),
+      'thread_long',
+      'public',
+      null,
+      { actorPrincipalId: 'user_agent' }
+    )
+    expect(dispatchTicketFirstResponseMock).toHaveBeenCalledWith(
+      expect.objectContaining({ principalId: 'user_agent' }),
+      expect.objectContaining({ id: 'ticket_1' }),
+      'thread_long',
+      expect.any(String),
+      { syncSourceIntegrationId: 'github_1' }
+    )
+    expect(dispatchTicketThreadAddedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ principalId: 'user_agent' }),
+      expect.objectContaining({ id: 'ticket_1' }),
+      'thread_long',
+      'public',
+      null,
+      expect.objectContaining({
+        bodyText,
+        bodyTextPreview: 'x'.repeat(500),
+        bodyTextTruncated: true,
+        isFromRequester: false,
+      }),
+      { syncSourceIntegrationId: 'github_1' }
+    )
+  })
+
+  it('calls the customer SLA hook for public requester replies without first-response dispatch', async () => {
+    ticketFindFirstMock.mockResolvedValueOnce(ticket())
+    const created = thread({ principalId: 'user_requester' })
+    insertThreadsReturningMock.mockResolvedValueOnce([created])
+
+    const { addThread } = await import('../ticket.threads')
+    await addThread({
+      ticketId: 'ticket_1' as never,
+      principalId: 'user_requester' as never,
+      audience: 'public',
+      bodyText: 'requester reply',
+    })
+
+    expect(onCustomerReplyMock).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 'ticket_1' }),
+      'user_requester'
+    )
+    expect(onPublicAgentReplyMock).not.toHaveBeenCalled()
+    expect(dispatchTicketFirstResponseMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('editThread', () => {
+  it('rejects missing, deleted, and non-owned threads', async () => {
+    const { editThread } = await import('../ticket.threads')
+
+    threadFindFirstMock.mockResolvedValueOnce(undefined)
+    await expect(
+      editThread({ threadId: 'thread_missing' as never, actorPrincipalId: 'user_agent' as never })
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_NOT_FOUND' })
+
+    threadFindFirstMock.mockResolvedValueOnce(thread({ deletedAt: new Date() }))
+    await expect(
+      editThread({ threadId: 'thread_deleted' as never, actorPrincipalId: 'user_agent' as never })
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_NOT_FOUND' })
+
+    threadFindFirstMock.mockResolvedValueOnce(thread({ principalId: 'user_other' }))
+    await expect(
+      editThread({ threadId: 'thread_1' as never, actorPrincipalId: 'user_agent' as never })
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_NOT_OWNER' })
+  })
+
+  it('updates editable thread text and dispatches an update event when the ticket still exists', async () => {
+    const existing = thread()
+    const updated = thread({
+      bodyText: 'edited text',
+      editedAt: new Date('2026-01-01T01:00:00.000Z'),
+    })
+    threadFindFirstMock.mockResolvedValueOnce(existing)
+    updateReturningMock.mockResolvedValueOnce([updated])
+    ticketFindFirstMock.mockResolvedValueOnce(ticket())
+
+    const { editThread } = await import('../ticket.threads')
+    await expect(
+      editThread({
+        threadId: 'thread_1' as never,
+        actorPrincipalId: 'user_agent' as never,
+        bodyText: ' edited text ',
+        syncSourceIntegrationId: 'github_1',
+      })
+    ).resolves.toBe(updated)
+
+    expect(updateChainSetMock).toHaveBeenCalledWith({
+      bodyJson: null,
+      bodyText: 'edited text',
+      editedAt: expect.any(Date),
+      editedByPrincipalId: 'user_agent',
+    })
+    expect(dispatchTicketThreadUpdatedMock).toHaveBeenCalledWith(
+      expect.objectContaining({ principalId: 'user_agent' }),
+      expect.objectContaining({ id: 'ticket_1' }),
+      'thread_1',
+      'public',
+      null,
+      expect.objectContaining({
+        bodyText: 'edited text',
+        bodyTextPreview: 'edited text',
+        bodyTextTruncated: false,
+        isFromRequester: false,
+      }),
+      { syncSourceIntegrationId: 'github_1' }
+    )
+  })
+})
+
+describe('softDeleteThread', () => {
+  it('rejects missing and already-deleted threads', async () => {
+    const { softDeleteThread } = await import('../ticket.threads')
+
+    threadFindFirstMock.mockResolvedValueOnce(undefined)
+    await expect(
+      softDeleteThread('thread_missing' as never, 'user_agent' as never)
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_NOT_FOUND' })
+
+    threadFindFirstMock.mockResolvedValueOnce(thread({ deletedAt: new Date() }))
+    await expect(
+      softDeleteThread('thread_deleted' as never, 'user_agent' as never)
+    ).rejects.toMatchObject({ code: 'TICKET_THREAD_ALREADY_DELETED' })
+  })
+
+  it('soft-deletes a thread and dispatches a delete event with a service actor fallback', async () => {
+    const existing = thread({ principalId: null, bodyText: 'deleted body' })
+    const deleted = thread({ ...existing, deletedAt: new Date('2026-01-01T02:00:00.000Z') })
+    threadFindFirstMock.mockResolvedValueOnce(existing)
+    updateReturningMock.mockResolvedValueOnce([deleted])
+    ticketFindFirstMock.mockResolvedValueOnce(ticket({ requesterPrincipalId: null }))
+
+    const { softDeleteThread } = await import('../ticket.threads')
+    await expect(softDeleteThread('thread_1' as never, null, 'github_1')).resolves.toBe(deleted)
+
+    expect(updateChainSetMock).toHaveBeenCalledWith({ deletedAt: expect.any(Date) })
+    expect(dispatchTicketThreadDeletedMock).toHaveBeenCalledWith(
+      { type: 'service', displayName: 'ticket-system' },
+      expect.objectContaining({ id: 'ticket_1' }),
+      'thread_1',
+      'public',
+      null,
+      null,
+      expect.objectContaining({
+        bodyText: 'deleted body',
+        authorPrincipalId: null,
+        isFromRequester: false,
+      }),
+      { syncSourceIntegrationId: 'github_1' }
+    )
+  })
+})
+
+describe('thread queries', () => {
+  it('filters thread audiences for agents, requesters, shared teams, and deleted rows', async () => {
+    const rows = [
+      thread({ id: 'public_1', audience: 'public' }),
+      thread({ id: 'internal_1', audience: 'internal' }),
+      thread({ id: 'shared_visible', audience: 'shared_team', sharedWithTeamId: 'team_visible' }),
+      thread({ id: 'shared_hidden', audience: 'shared_team', sharedWithTeamId: 'team_hidden' }),
+      thread({ id: 'shared_missing', audience: 'shared_team', sharedWithTeamId: null }),
+      thread({ id: 'unknown', audience: 'unknown' }),
+    ]
+    selectOrderByMock.mockResolvedValue(rows)
+
+    const { listThreads } = await import('../ticket.threads')
+    await expect(
+      listThreads('ticket_1' as never, {
+        viewerTeamIds: ['team_visible' as never],
+        canSeeInternal: true,
+      })
+    ).resolves.toEqual([rows[0], rows[1], rows[2]])
+    expect(selectWhereMock).toHaveBeenCalledWith(
+      expect.arrayContaining(['and', ['eq', 'ticketThreads.ticketId', 'ticket_1']])
+    )
+
+    await expect(
+      listThreads('ticket_1' as never, {
+        viewerTeamIds: ['team_visible' as never],
+        canSeeInternal: true,
+        isRequester: true,
+        includeDeleted: true,
+      })
+    ).resolves.toEqual([rows[0]])
+  })
+
+  it('gets threads, loads threads by ticket ids, and exposes public-only portal fetches', async () => {
+    const row = thread()
+    const { getThread, loadThreadsByTicketIds, listPublicThreadsForTicket } =
+      await import('../ticket.threads')
+
+    threadFindFirstMock.mockResolvedValueOnce(row).mockResolvedValueOnce(undefined)
+    await expect(getThread('thread_1' as never)).resolves.toBe(row)
+    await expect(getThread('missing' as never)).resolves.toBeNull()
+
+    await expect(loadThreadsByTicketIds([])).resolves.toEqual([])
+
+    selectOrderByMock.mockResolvedValueOnce([row])
+    await expect(loadThreadsByTicketIds(['ticket_1' as never])).resolves.toEqual([row])
+    expect(selectWhereMock).toHaveBeenCalledWith(
+      expect.arrayContaining(['and', ['inArray', 'ticketThreads.ticketId', ['ticket_1']]])
+    )
+
+    selectOrderByMock.mockResolvedValueOnce([row, thread({ audience: 'internal' })])
+    await expect(listPublicThreadsForTicket('ticket_1' as never)).resolves.toEqual([row])
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/tiptap-text.gap.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/tiptap-text.gap.test.ts
new file mode 100644
index 000000000..5d0cf1061
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/tiptap-text.gap.test.ts
@@ -0,0 +1,19 @@
+/**
+ * tiptap-text — gap tests covering the falsy-child guard in walk().
+ */
+import { describe, it, expect } from 'vitest'
+import { tiptapToPlainText } from '../tiptap-text'
+
+describe('tiptapToPlainText gap', () => {
+  it('skips null/undefined children inside a content array', () => {
+    const doc = {
+      type: 'doc',
+      content: [
+        null,
+        undefined,
+        { type: 'paragraph', content: [{ type: 'text', text: 'Hi' }, null] },
+      ],
+    }
+    expect(tiptapToPlainText(doc as never)).toBe('Hi')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/__tests__/tiptap-text.test.ts b/apps/web/src/lib/server/domains/tickets/__tests__/tiptap-text.test.ts
new file mode 100644
index 000000000..85c6e4f3d
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/__tests__/tiptap-text.test.ts
@@ -0,0 +1,39 @@
+/**
+ * tiptap-text — quick smoke tests for the plain-text extractor.
+ */
+import { describe, it, expect } from 'vitest'
+import { tiptapToPlainText } from '../tiptap-text'
+
+describe('tiptapToPlainText', () => {
+  it('returns empty string for null/empty input', () => {
+    expect(tiptapToPlainText(null)).toBe('')
+    expect(tiptapToPlainText({ type: 'doc' } as never)).toBe('')
+  })
+
+  it('concatenates text nodes across paragraphs with blank lines', () => {
+    const doc = {
+      type: 'doc',
+      content: [
+        { type: 'paragraph', content: [{ type: 'text', text: 'Hello' }] },
+        { type: 'paragraph', content: [{ type: 'text', text: 'World' }] },
+      ],
+    }
+    expect(tiptapToPlainText(doc as never)).toBe('Hello\n\nWorld')
+  })
+
+  it('handles nested marks and inline structures', () => {
+    const doc = {
+      type: 'doc',
+      content: [
+        {
+          type: 'paragraph',
+          content: [
+            { type: 'text', text: 'plain ' },
+            { type: 'text', text: 'bold', marks: [{ type: 'bold' }] },
+          ],
+        },
+      ],
+    }
+    expect(tiptapToPlainText(doc as never)).toBe('plain bold')
+  })
+})
diff --git a/apps/web/src/lib/server/domains/tickets/index.ts b/apps/web/src/lib/server/domains/tickets/index.ts
new file mode 100644
index 000000000..5370d77a9
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/index.ts
@@ -0,0 +1,12 @@
+export * from './ticket.permissions'
+export * from './tiptap-text'
+export * from './ticket-statuses.service'
+export * from './ticket.service'
+export * from './ticket.threads'
+export * from './ticket.participants'
+export * from './ticket.share'
+export * from './ticket.attachments'
+export * from './ticket.activity'
+export * from './ticket.query'
+export * from './ticket.bulk'
+export * from './ticket.take-return'
diff --git a/apps/web/src/lib/server/domains/tickets/ticket-statuses.service.ts b/apps/web/src/lib/server/domains/tickets/ticket-statuses.service.ts
new file mode 100644
index 000000000..678f2dc93
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket-statuses.service.ts
@@ -0,0 +1,191 @@
+/**
+ * Ticket statuses — admin CRUD over the workflow state catalogue.
+ *
+ * Permission gating happens at the server-fn / REST layer
+ * (`ADMIN_MANAGE_SETTINGS`); this service stays pure.
+ */
+import {
+  db,
+  eq,
+  and,
+  isNull,
+  asc,
+  ticketStatuses,
+  TICKET_STATUS_CATEGORIES,
+  type TicketStatusEntity,
+  type TicketStatusCategory,
+} from '@/lib/server/db'
+import type { TicketStatusId, PrincipalId, UserId } from '@quackback/ids'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+
+/**
+ * Identity of the operator (or system caller) performing the mutation.
+ * Required so configuration-plane webhook events carry a meaningful actor.
+ */
+export interface TicketStatusActorContext {
+  principalId: PrincipalId | null
+  userId?: UserId | null
+}
+
+async function fireStatusEvent(
+  kind: 'created' | 'updated',
+  actor: TicketStatusActorContext,
+  status: TicketStatusEntity,
+  changedFields?: string[]
+): Promise<void> {
+  try {
+    const { buildEventActor, dispatchTicketStatusCreated, dispatchTicketStatusUpdated } =
+      await import('@/lib/server/events/dispatch')
+    const eventActor = actor.principalId
+      ? buildEventActor({
+          principalId: actor.principalId,
+          userId: actor.userId ?? undefined,
+          displayName: 'ticket-status-system',
+        })
+      : { type: 'service' as const, displayName: 'ticket-status-system' }
+    if (kind === 'created') await dispatchTicketStatusCreated(eventActor, status as never)
+    else await dispatchTicketStatusUpdated(eventActor, status as never, changedFields ?? [])
+  } catch (err) {
+    console.warn(`[ticket-statuses] dispatchTicketStatus${kind} failed`, err)
+  }
+}
+
+const SLUG_RE = /^[a-z0-9_-]+$/
+
+export interface CreateTicketStatusInput {
+  name: string
+  slug: string
+  color?: string
+  category: TicketStatusCategory
+  position?: number
+  isDefault?: boolean
+}
+
+export async function listTicketStatuses(
+  opts: { includeDeleted?: boolean } = {}
+): Promise<TicketStatusEntity[]> {
+  const where = opts.includeDeleted ? undefined : isNull(ticketStatuses.deletedAt)
+  return db
+    .select()
+    .from(ticketStatuses)
+    .where(where)
+    .orderBy(asc(ticketStatuses.position), asc(ticketStatuses.name))
+}
+
+export async function getTicketStatus(id: TicketStatusId): Promise<TicketStatusEntity | null> {
+  const row = await db.query.ticketStatuses.findFirst({
+    where: eq(ticketStatuses.id, id),
+  })
+  return row ?? null
+}
+
+export async function getDefaultTicketStatus(): Promise<TicketStatusEntity | null> {
+  const row = await db.query.ticketStatuses.findFirst({
+    where: and(eq(ticketStatuses.isDefault, true), isNull(ticketStatuses.deletedAt)),
+  })
+  return row ?? null
+}
+
+export async function createTicketStatus(
+  input: CreateTicketStatusInput,
+  actor: TicketStatusActorContext
+): Promise<TicketStatusEntity> {
+  const name = input.name?.trim()
+  const slug = input.slug?.trim().toLowerCase()
+  if (!name) throw new ValidationError('TICKET_STATUS_NAME_REQUIRED', 'name is required')
+  if (!slug || !SLUG_RE.test(slug)) {
+    throw new ValidationError('TICKET_STATUS_SLUG_INVALID', 'slug must match [a-z0-9_-]+')
+  }
+  if (!TICKET_STATUS_CATEGORIES.includes(input.category)) {
+    throw new ValidationError('TICKET_STATUS_CATEGORY_INVALID', 'invalid category')
+  }
+  const dup = await db.query.ticketStatuses.findFirst({
+    where: eq(ticketStatuses.slug, slug),
+  })
+  if (dup) throw new ConflictError('TICKET_STATUS_SLUG_TAKEN', `slug "${slug}" already exists`)
+
+  // Only one default at a time.
+  if (input.isDefault) {
+    await db
+      .update(ticketStatuses)
+      .set({ isDefault: false })
+      .where(eq(ticketStatuses.isDefault, true))
+  }
+
+  const [row] = await db
+    .insert(ticketStatuses)
+    .values({
+      name,
+      slug,
+      color: input.color ?? '#6b7280',
+      category: input.category,
+      position: input.position ?? 0,
+      isDefault: input.isDefault ?? false,
+      isSystem: false,
+    })
+    .returning()
+  await fireStatusEvent('created', actor, row)
+  return row
+}
+
+export interface UpdateTicketStatusInput {
+  name?: string
+  color?: string
+  category?: TicketStatusCategory
+  position?: number
+  isDefault?: boolean
+}
+
+export async function updateTicketStatus(
+  id: TicketStatusId,
+  input: UpdateTicketStatusInput,
+  actor: TicketStatusActorContext
+): Promise<TicketStatusEntity> {
+  const existing = await getTicketStatus(id)
+  if (!existing) throw new NotFoundError('TICKET_STATUS_NOT_FOUND', `status ${id} not found`)
+
+  if (input.category && !TICKET_STATUS_CATEGORIES.includes(input.category)) {
+    throw new ValidationError('TICKET_STATUS_CATEGORY_INVALID', 'invalid category')
+  }
+  if (input.isDefault) {
+    await db
+      .update(ticketStatuses)
+      .set({ isDefault: false })
+      .where(eq(ticketStatuses.isDefault, true))
+  }
+
+  const patch: Partial<typeof existing> = {}
+  if (input.name !== undefined) patch.name = input.name.trim()
+  if (input.color !== undefined) patch.color = input.color
+  if (input.category !== undefined) patch.category = input.category
+  if (input.position !== undefined) patch.position = input.position
+  if (input.isDefault !== undefined) patch.isDefault = input.isDefault
+
+  if (Object.keys(patch).length === 0) return existing
+
+  const [row] = await db
+    .update(ticketStatuses)
+    .set(patch)
+    .where(eq(ticketStatuses.id, id))
+    .returning()
+  await fireStatusEvent('updated', actor, row, Object.keys(patch))
+  return row
+}
+
+export async function archiveTicketStatus(
+  id: TicketStatusId,
+  actor: TicketStatusActorContext
+): Promise<TicketStatusEntity> {
+  const existing = await getTicketStatus(id)
+  if (!existing) throw new NotFoundError('TICKET_STATUS_NOT_FOUND', `status ${id} not found`)
+  if (existing.isSystem) {
+    throw new ValidationError('TICKET_STATUS_SYSTEM', 'system statuses cannot be archived')
+  }
+  const [row] = await db
+    .update(ticketStatuses)
+    .set({ deletedAt: new Date(), isDefault: false })
+    .where(eq(ticketStatuses.id, id))
+    .returning()
+  await fireStatusEvent('updated', actor, row, ['deletedAt'])
+  return row
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.activity.ts b/apps/web/src/lib/server/domains/tickets/ticket.activity.ts
new file mode 100644
index 000000000..ad071f163
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.activity.ts
@@ -0,0 +1,62 @@
+/**
+ * Ticket activity timeline — read-only query helper.
+ *
+ * Used by the MCP tool `get_ticket_activity` and the public REST route
+ * `GET /api/v1/tickets/:ticketId/activity`. Permission filtering happens
+ * at the call site (this module is pure data access).
+ *
+ * Returns rows in reverse-chronological order, joined to `principal` for
+ * actor display name + avatar so consumers can render the timeline without
+ * a follow-up lookup.
+ */
+import { db, eq, and, lt, desc, ticketActivity, principal } from '@/lib/server/db'
+import type { TicketId, TicketActivityId, PrincipalId } from '@quackback/ids'
+
+export interface TicketActivityRow {
+  id: TicketActivityId
+  ticketId: TicketId
+  principalId: PrincipalId | null
+  type: string
+  metadata: unknown
+  createdAt: Date
+  actorName: string | null
+  actorAvatarUrl: string | null
+}
+
+export interface ListTicketActivityOptions {
+  /** ISO timestamp cursor — return rows strictly older than this. */
+  before?: Date
+  /** Default 50, hard cap 200. */
+  limit?: number
+}
+
+const DEFAULT_LIMIT = 50
+const MAX_LIMIT = 200
+
+export async function listTicketActivity(
+  ticketId: TicketId,
+  opts: ListTicketActivityOptions = {}
+): Promise<TicketActivityRow[]> {
+  const limit = Math.min(Math.max(opts.limit ?? DEFAULT_LIMIT, 1), MAX_LIMIT)
+  const conditions = [eq(ticketActivity.ticketId, ticketId)]
+  if (opts.before) {
+    conditions.push(lt(ticketActivity.createdAt, opts.before))
+  }
+  const rows = await db
+    .select({
+      id: ticketActivity.id,
+      ticketId: ticketActivity.ticketId,
+      principalId: ticketActivity.principalId,
+      type: ticketActivity.type,
+      metadata: ticketActivity.metadata,
+      createdAt: ticketActivity.createdAt,
+      actorName: principal.displayName,
+      actorAvatarUrl: principal.avatarUrl,
+    })
+    .from(ticketActivity)
+    .leftJoin(principal, eq(ticketActivity.principalId, principal.id))
+    .where(and(...conditions))
+    .orderBy(desc(ticketActivity.createdAt))
+    .limit(limit)
+  return rows as TicketActivityRow[]
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.attachments.ts b/apps/web/src/lib/server/domains/tickets/ticket.attachments.ts
new file mode 100644
index 000000000..f5ecd7eaf
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.attachments.ts
@@ -0,0 +1,300 @@
+/**
+ * Ticket attachments — metadata-only.
+ *
+ * The actual file upload pipeline (S3 / disk fallback) is reused unchanged
+ * from `/api/upload/image`; this module records the metadata pointing at the
+ * already-uploaded object.
+ */
+import {
+  db,
+  eq,
+  ticketAttachments,
+  ticketThreads,
+  tickets,
+  type TicketAttachment,
+} from '@/lib/server/db'
+import type { TicketId, TicketThreadId, TicketAttachmentId, PrincipalId } from '@quackback/ids'
+import { NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { recordEvent } from '../audit'
+import { writeActivity, bumpLastActivity } from './ticket.service'
+
+const MAX_FILENAME = 256
+const MAX_BYTES = 50 * 1024 * 1024 // 50 MB
+const THREAD_PREVIEW_MAX = 500
+
+export interface AttachInput {
+  threadId: TicketThreadId
+  uploadedByPrincipalId: PrincipalId | null
+  filename: string
+  mimeType: string
+  sizeBytes: number
+  storageKey: string
+  publicUrl?: string | null
+}
+
+async function loadTicketEventRef(ticketId: TicketId): Promise<Record<string, unknown>> {
+  const ticket = await db.query.tickets.findFirst({
+    where: eq(tickets.id, ticketId),
+    columns: {
+      id: true,
+      subject: true,
+      descriptionText: true,
+      statusId: true,
+      statusCategory: true,
+      priority: true,
+      channel: true,
+      visibilityScope: true,
+      inboxId: true,
+      primaryTeamId: true,
+      assigneePrincipalId: true,
+      assigneeTeamId: true,
+      requesterPrincipalId: true,
+      requesterContactId: true,
+    },
+  })
+
+  return ticket ?? { id: ticketId }
+}
+
+function threadPreview(bodyText: string): { bodyTextPreview: string; bodyTextTruncated: boolean } {
+  return {
+    bodyTextPreview:
+      bodyText.length > THREAD_PREVIEW_MAX ? bodyText.slice(0, THREAD_PREVIEW_MAX) : bodyText,
+    bodyTextTruncated: bodyText.length > THREAD_PREVIEW_MAX,
+  }
+}
+
+async function dispatchThreadRefresh(args: {
+  actor: { type: 'user' | 'service'; principalId?: string; displayName?: string }
+  ticket: Record<string, unknown>
+  thread: {
+    id: string
+    audience: 'public' | 'internal' | 'shared_team'
+    sharedWithTeamId: string | null
+    bodyText: string | null
+    principalId: string | null
+    createdAt: Date | string
+    editedAt: Date | string | null
+  }
+}): Promise<void> {
+  const { dispatchTicketThreadUpdated } = await import('@/lib/server/events/dispatch')
+  const bodyText = args.thread.bodyText ?? ''
+  const requesterPrincipalId =
+    (args.ticket.requesterPrincipalId as string | null | undefined) ?? null
+  const isFromRequester =
+    args.thread.principalId !== null && args.thread.principalId === requesterPrincipalId
+
+  await dispatchTicketThreadUpdated(
+    args.actor,
+    args.ticket,
+    args.thread.id,
+    args.thread.audience,
+    args.thread.sharedWithTeamId,
+    {
+      ...threadPreview(bodyText),
+      bodyText,
+      authorPrincipalId: args.thread.principalId,
+      isFromRequester,
+      createdAt: args.thread.createdAt,
+      editedAt: args.thread.editedAt,
+    }
+  )
+}
+
+export async function attachToThread(input: AttachInput): Promise<TicketAttachment> {
+  const filename = input.filename?.trim()
+  if (!filename) throw new ValidationError('TICKET_ATT_FILENAME_REQUIRED', 'filename required')
+  if (filename.length > MAX_FILENAME) {
+    throw new ValidationError('TICKET_ATT_FILENAME_TOO_LONG', `filename > ${MAX_FILENAME}`)
+  }
+  if (!input.mimeType?.trim()) {
+    throw new ValidationError('TICKET_ATT_MIME_REQUIRED', 'mimeType required')
+  }
+  if (!Number.isFinite(input.sizeBytes) || input.sizeBytes <= 0) {
+    throw new ValidationError('TICKET_ATT_SIZE_INVALID', 'sizeBytes must be positive')
+  }
+  if (input.sizeBytes > MAX_BYTES) {
+    throw new ValidationError('TICKET_ATT_TOO_LARGE', `attachment exceeds ${MAX_BYTES} bytes`)
+  }
+  if (!input.storageKey?.trim()) {
+    throw new ValidationError('TICKET_ATT_STORAGE_KEY_REQUIRED', 'storageKey required')
+  }
+
+  const thread = await db.query.ticketThreads.findFirst({
+    where: eq(ticketThreads.id, input.threadId),
+    columns: {
+      id: true,
+      ticketId: true,
+      deletedAt: true,
+      audience: true,
+      sharedWithTeamId: true,
+      bodyText: true,
+      principalId: true,
+      createdAt: true,
+      editedAt: true,
+    },
+  })
+  if (!thread || thread.deletedAt) {
+    throw new NotFoundError('TICKET_THREAD_NOT_FOUND', `thread ${input.threadId} not found`)
+  }
+
+  const [created] = await db
+    .insert(ticketAttachments)
+    .values({
+      threadId: input.threadId,
+      uploadedByPrincipalId: input.uploadedByPrincipalId,
+      filename,
+      mimeType: input.mimeType,
+      sizeBytes: input.sizeBytes,
+      storageKey: input.storageKey,
+      publicUrl: input.publicUrl ?? null,
+    })
+    .returning()
+
+  await bumpLastActivity(thread.ticketId as TicketId)
+  await writeActivity(
+    thread.ticketId as TicketId,
+    input.uploadedByPrincipalId,
+    'attachment.added',
+    { attachmentId: created.id, threadId: input.threadId, filename }
+  )
+  void recordEvent({
+    principalId: input.uploadedByPrincipalId,
+    action: 'ticket.attachment_added',
+    targetType: 'ticket',
+    targetId: thread.ticketId,
+    diff: { context: { attachmentId: created.id, filename } },
+  })
+  try {
+    const { buildEventActor } = await import('@/lib/server/events/dispatch')
+    const actor = input.uploadedByPrincipalId
+      ? buildEventActor({
+          principalId: input.uploadedByPrincipalId,
+          displayName: 'ticket-system',
+        })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    const ticketEventRef = await loadTicketEventRef(thread.ticketId as TicketId)
+
+    try {
+      const { dispatchTicketAttachmentAdded } = await import('@/lib/server/events/dispatch')
+      await dispatchTicketAttachmentAdded(actor, ticketEventRef, {
+        id: created.id,
+        threadId: input.threadId,
+        filename,
+        mimeType: input.mimeType,
+        sizeBytes: input.sizeBytes,
+        uploadedByPrincipalId: input.uploadedByPrincipalId,
+        publicUrl: input.publicUrl ?? null,
+      })
+    } catch (err) {
+      console.warn('[tickets] dispatchTicketAttachmentAdded failed', err)
+    }
+
+    // Compatibility fallback: integrations created before attachment event
+    // mappings existed still receive thread updates and can sync attachments.
+    try {
+      await dispatchThreadRefresh({
+        actor,
+        ticket: ticketEventRef,
+        thread: {
+          id: thread.id,
+          audience: thread.audience,
+          sharedWithTeamId: thread.sharedWithTeamId ?? null,
+          bodyText: thread.bodyText ?? '',
+          principalId: thread.principalId ?? null,
+          createdAt: thread.createdAt,
+          editedAt: thread.editedAt ?? null,
+        },
+      })
+    } catch (err) {
+      console.warn('[tickets] dispatchTicketThreadUpdated fallback failed', err)
+    }
+  } catch (err) {
+    console.warn('[tickets] attachment dispatch setup failed', err)
+  }
+  return created
+}
+
+export async function listForThread(threadId: TicketThreadId): Promise<TicketAttachment[]> {
+  return db.select().from(ticketAttachments).where(eq(ticketAttachments.threadId, threadId))
+}
+
+export async function removeAttachment(
+  attachmentId: TicketAttachmentId,
+  actorPrincipalId: PrincipalId | null
+): Promise<void> {
+  const existing = await db.query.ticketAttachments.findFirst({
+    where: eq(ticketAttachments.id, attachmentId),
+  })
+  if (!existing) {
+    throw new NotFoundError('TICKET_ATT_NOT_FOUND', `attachment ${attachmentId} not found`)
+  }
+  await db.delete(ticketAttachments).where(eq(ticketAttachments.id, attachmentId))
+  const thread = await db.query.ticketThreads.findFirst({
+    where: eq(ticketThreads.id, existing.threadId),
+    columns: {
+      id: true,
+      ticketId: true,
+      audience: true,
+      sharedWithTeamId: true,
+      bodyText: true,
+      principalId: true,
+      createdAt: true,
+      editedAt: true,
+    },
+  })
+  if (thread) {
+    await bumpLastActivity(thread.ticketId as TicketId)
+    await writeActivity(thread.ticketId as TicketId, actorPrincipalId, 'attachment.removed', {
+      attachmentId,
+    })
+    void recordEvent({
+      principalId: actorPrincipalId,
+      action: 'ticket.attachment_removed',
+      targetType: 'ticket',
+      targetId: thread.ticketId,
+      diff: { context: { attachmentId } },
+    })
+    try {
+      const { buildEventActor } = await import('@/lib/server/events/dispatch')
+      const actor = actorPrincipalId
+        ? buildEventActor({ principalId: actorPrincipalId, displayName: 'ticket-system' })
+        : { type: 'service' as const, displayName: 'ticket-system' }
+      const ticketEventRef = await loadTicketEventRef(thread.ticketId as TicketId)
+
+      try {
+        const { dispatchTicketAttachmentRemoved } = await import('@/lib/server/events/dispatch')
+        await dispatchTicketAttachmentRemoved(
+          actor,
+          ticketEventRef,
+          { id: attachmentId, threadId: existing.threadId, filename: existing.filename },
+          actorPrincipalId
+        )
+      } catch (err) {
+        console.warn('[tickets] dispatchTicketAttachmentRemoved failed', err)
+      }
+
+      // Compatibility fallback: refresh linked thread comment body when
+      // integrations do not yet have attachment event mappings.
+      try {
+        await dispatchThreadRefresh({
+          actor,
+          ticket: ticketEventRef,
+          thread: {
+            id: thread.id,
+            audience: thread.audience,
+            sharedWithTeamId: thread.sharedWithTeamId ?? null,
+            bodyText: thread.bodyText ?? '',
+            principalId: thread.principalId ?? null,
+            createdAt: thread.createdAt,
+            editedAt: thread.editedAt ?? null,
+          },
+        })
+      } catch (err) {
+        console.warn('[tickets] dispatchTicketThreadUpdated fallback failed', err)
+      }
+    } catch (err) {
+      console.warn('[tickets] attachment removal dispatch setup failed', err)
+    }
+  }
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.bulk.ts b/apps/web/src/lib/server/domains/tickets/ticket.bulk.ts
new file mode 100644
index 000000000..7e3c32688
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.bulk.ts
@@ -0,0 +1,195 @@
+/**
+ * Ticket bulk operations — best-effort partial-success.
+ *
+ * Each per-ticket op runs independently with its own optimistic-concurrency
+ * check (assignTicket/transitionStatus). Failures are collected and returned
+ * so callers can surface partial success without aborting the batch.
+ *
+ * Permission checks are the caller's responsibility — pass them in via the
+ * `permit` callback (called once per ticket scope) so we can short-circuit
+ * before mutating.
+ */
+import { db, eq, and, isNull, inArray, tickets, type Ticket } from '@/lib/server/db'
+import type { TicketId, TicketStatusId, PrincipalId, TeamId, InboxId } from '@quackback/ids'
+import { assignTicket, transitionStatus, toResourceScope } from './'
+import { listSharesForTicket } from './ticket.share'
+import { recordEvent } from '../audit'
+import type { ResourceScope } from '../authz/authz.scopes'
+
+export interface BulkSuccess {
+  ticketId: TicketId
+}
+export interface BulkFailure {
+  ticketId: TicketId
+  reason: string
+}
+export interface BulkResult {
+  succeeded: BulkSuccess[]
+  failed: BulkFailure[]
+}
+
+async function loadTicketsForBulk(ticketIds: readonly TicketId[]): Promise<Ticket[]> {
+  if (ticketIds.length === 0) return []
+  return db
+    .select()
+    .from(tickets)
+    .where(and(inArray(tickets.id, ticketIds as TicketId[]), isNull(tickets.deletedAt)))
+}
+
+async function permitFor(
+  ticket: Ticket,
+  permit: (scope: ResourceScope) => boolean
+): Promise<boolean> {
+  const shares = await listSharesForTicket(ticket.id as TicketId)
+  return permit(
+    toResourceScope({
+      primaryTeamId: ticket.primaryTeamId as TeamId | null,
+      assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+      assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+      shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+    })
+  )
+}
+
+export interface BulkAssignInput {
+  ticketIds: TicketId[]
+  actorPrincipalId: PrincipalId
+  assigneePrincipalId?: PrincipalId | null
+  assigneeTeamId?: TeamId | null
+  permit: (scope: ResourceScope) => boolean
+}
+
+export async function bulkAssign(input: BulkAssignInput): Promise<BulkResult> {
+  const result: BulkResult = { succeeded: [], failed: [] }
+  const rows = await loadTicketsForBulk(input.ticketIds)
+  const byId = new Map(rows.map((r) => [r.id, r]))
+  for (const ticketId of input.ticketIds) {
+    const t = byId.get(ticketId)
+    if (!t) {
+      result.failed.push({ ticketId, reason: 'TICKET_NOT_FOUND' })
+      continue
+    }
+    if (!(await permitFor(t, input.permit))) {
+      result.failed.push({ ticketId, reason: 'FORBIDDEN' })
+      continue
+    }
+    try {
+      await assignTicket(ticketId, {
+        expectedUpdatedAt: t.updatedAt,
+        actorPrincipalId: input.actorPrincipalId,
+        assigneePrincipalId: input.assigneePrincipalId,
+        assigneeTeamId: input.assigneeTeamId,
+      })
+      result.succeeded.push({ ticketId })
+    } catch (err) {
+      result.failed.push({ ticketId, reason: errReason(err) })
+    }
+  }
+  return result
+}
+
+export interface BulkTransitionInput {
+  ticketIds: TicketId[]
+  actorPrincipalId: PrincipalId
+  statusId: TicketStatusId
+  permit: (scope: ResourceScope) => boolean
+}
+
+export async function bulkTransition(input: BulkTransitionInput): Promise<BulkResult> {
+  const result: BulkResult = { succeeded: [], failed: [] }
+  const rows = await loadTicketsForBulk(input.ticketIds)
+  const byId = new Map(rows.map((r) => [r.id, r]))
+  for (const ticketId of input.ticketIds) {
+    const t = byId.get(ticketId)
+    if (!t) {
+      result.failed.push({ ticketId, reason: 'TICKET_NOT_FOUND' })
+      continue
+    }
+    if (!(await permitFor(t, input.permit))) {
+      result.failed.push({ ticketId, reason: 'FORBIDDEN' })
+      continue
+    }
+    try {
+      await transitionStatus(ticketId, {
+        expectedUpdatedAt: t.updatedAt,
+        actorPrincipalId: input.actorPrincipalId,
+        statusId: input.statusId,
+      })
+      result.succeeded.push({ ticketId })
+    } catch (err) {
+      result.failed.push({ ticketId, reason: errReason(err) })
+    }
+  }
+  return result
+}
+
+export interface BulkChangeInboxInput {
+  ticketIds: TicketId[]
+  actorPrincipalId: PrincipalId
+  inboxId: InboxId | null
+  permit: (scope: ResourceScope) => boolean
+}
+
+export async function bulkChangeInbox(input: BulkChangeInboxInput): Promise<BulkResult> {
+  const result: BulkResult = { succeeded: [], failed: [] }
+  const rows = await loadTicketsForBulk(input.ticketIds)
+  const byId = new Map(rows.map((r) => [r.id, r]))
+  for (const ticketId of input.ticketIds) {
+    const t = byId.get(ticketId)
+    if (!t) {
+      result.failed.push({ ticketId, reason: 'TICKET_NOT_FOUND' })
+      continue
+    }
+    if (!(await permitFor(t, input.permit))) {
+      result.failed.push({ ticketId, reason: 'FORBIDDEN' })
+      continue
+    }
+    try {
+      const [updated] = await db
+        .update(tickets)
+        .set({ inboxId: input.inboxId, lastActivityAt: new Date() })
+        .where(and(eq(tickets.id, ticketId), eq(tickets.updatedAt, t.updatedAt)))
+        .returning()
+      if (!updated) {
+        result.failed.push({ ticketId, reason: 'TICKET_STALE' })
+        continue
+      }
+      void recordEvent({
+        principalId: input.actorPrincipalId,
+        action: 'ticket.inbox_changed',
+        targetType: 'ticket',
+        targetId: ticketId,
+        diff: { before: { inboxId: t.inboxId }, after: { inboxId: input.inboxId } },
+      })
+      try {
+        const { dispatchTicketUpdated, buildEventActor } =
+          await import('@/lib/server/events/dispatch')
+        const actor = input.actorPrincipalId
+          ? buildEventActor({
+              principalId: input.actorPrincipalId,
+              displayName: 'ticket-system',
+            })
+          : { type: 'service' as const, displayName: 'ticket-system' }
+        await dispatchTicketUpdated(
+          actor,
+          updated as unknown as Record<string, unknown>,
+          ['inboxId'],
+          { inboxId: { from: t.inboxId, to: input.inboxId } }
+        )
+      } catch (err) {
+        console.warn('[tickets] dispatchTicketUpdated (bulkChangeInbox) failed', err)
+      }
+      result.succeeded.push({ ticketId })
+    } catch (err) {
+      result.failed.push({ ticketId, reason: errReason(err) })
+    }
+  }
+  return result
+}
+
+function errReason(err: unknown): string {
+  if (err && typeof err === 'object' && 'code' in err && typeof err.code === 'string')
+    return err.code
+  if (err instanceof Error) return err.message
+  return 'UNKNOWN'
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.create-thread-for-attachments.ts b/apps/web/src/lib/server/domains/tickets/ticket.create-thread-for-attachments.ts
new file mode 100644
index 000000000..69b50b108
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.create-thread-for-attachments.ts
@@ -0,0 +1,45 @@
+/**
+ * Server helper to ensure a ticket has an initial thread for attachments.
+ *
+ * When a ticket is created, we may want to attach files immediately. Since
+ * attachments are stored on threads, we need an initial public thread to link
+ * them to. This helper finds the first public thread (usually created by the
+ * requester) or creates a synthetic one if none exists.
+ *
+ * Returns the thread ID suitable for attaching files.
+ */
+import { db, eq, and, isNull, ticketThreads } from '@/lib/server/db'
+import type { TicketId, TicketThreadId, PrincipalId } from '@quackback/ids'
+import { addThread } from './ticket.threads'
+
+export async function findOrCreateInitialThread(
+  ticketId: TicketId,
+  _requesterPrincipalId: PrincipalId | null
+): Promise<TicketThreadId> {
+  // Look for the first public thread on the ticket (typically created by
+  // the requester during creation flow if they added a description).
+  const existing = await db.query.ticketThreads.findFirst({
+    where: and(
+      eq(ticketThreads.ticketId, ticketId),
+      eq(ticketThreads.audience, 'public'),
+      isNull(ticketThreads.deletedAt)
+    ),
+  })
+
+  if (existing) {
+    return existing.id as TicketThreadId
+  }
+
+  // No public thread yet; create a synthetic one to hold attachments.
+  // This is an internal system thread (empty body) that won't show in the
+  // user-facing thread list — just used for attachment metadata.
+  // Use principalId=null to mark it as system-generated.
+  const created = await addThread({
+    ticketId,
+    principalId: null,
+    audience: 'public',
+    bodyText: '[Attachments added at ticket creation]',
+  })
+
+  return created.id as TicketThreadId
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.notifications.ts b/apps/web/src/lib/server/domains/tickets/ticket.notifications.ts
new file mode 100644
index 000000000..4c666e116
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.notifications.ts
@@ -0,0 +1,407 @@
+/**
+ * Ticket → in-app notification dispatcher.
+ *
+ * One function per ticket event. Each function:
+ *   1. Resolves the candidate recipient set (subscribers ∪ implicit owners).
+ *   2. Suppresses the actor (you don't get pinged for your own actions).
+ *   3. Filters by `canViewTicket(...)` so we never leak a ticket to someone
+ *      who lost permission between subscribe and dispatch.
+ *   4. Emits one in-app row per surviving recipient.
+ *
+ * Every dispatcher is best-effort — wrap calls in `try/catch` at the call
+ * site (the write path must not fail because we couldn't notify someone).
+ */
+
+import {
+  db,
+  eq,
+  and,
+  inArray,
+  isNull,
+  ticketShares,
+  teamMemberships,
+  type Ticket,
+} from '@/lib/server/db'
+import type { TicketId, PrincipalId, ContactId, TeamId } from '@quackback/ids'
+import { createNotificationsBatch } from '../notifications/notification.service'
+import type { CreateNotificationInput, NotificationType } from '../notifications/notification.types'
+import { getSubscribers, type TicketSubscriptionEvent } from './ticket.subscriptions'
+import { canViewTicket, toResourceScope } from './ticket.permissions'
+import { loadPermissionSet } from '../authz/authz.service'
+import { resolvePortalLinkedRecipients, resolvePrincipalsForContacts } from './ticket.recipients'
+
+interface NotifyContext {
+  actorPrincipalId: PrincipalId | null
+}
+
+interface DispatchOptions extends NotifyContext {
+  ticket: Ticket
+  /** Recipients to notify — duplicates are deduped before permission check. */
+  recipients: ReadonlyArray<PrincipalId>
+  type: NotificationType
+  title: string
+  body?: string
+  metadata?: Record<string, unknown>
+  /**
+   * Principals admitted by ownership instead of RBAC (e.g. portal users
+   * reached via `contact_user_links`, or the requester themselves). The
+   * staff `canViewTicket` check is bypassed for these — they're already
+   * known to have a legitimate relationship to the ticket.
+   */
+  trustedRecipients?: ReadonlySet<PrincipalId>
+}
+
+async function dispatch(options: DispatchOptions): Promise<void> {
+  const dedup = new Set<PrincipalId>()
+  for (const r of options.recipients) {
+    if (options.actorPrincipalId && r === options.actorPrincipalId) continue
+    dedup.add(r)
+  }
+  if (dedup.size === 0) return
+
+  const scope = toResourceScope({
+    primaryTeamId: options.ticket.primaryTeamId,
+    assigneePrincipalId: options.ticket.assigneePrincipalId,
+    assigneeTeamId: options.ticket.assigneeTeamId,
+    shares: await loadActiveShares(options.ticket.id as TicketId),
+  })
+
+  const allowed: PrincipalId[] = []
+  for (const principalId of dedup) {
+    if (options.trustedRecipients?.has(principalId)) {
+      allowed.push(principalId)
+      continue
+    }
+    try {
+      const set = await loadPermissionSet(principalId)
+      if (canViewTicket(set, scope)) allowed.push(principalId)
+    } catch (err) {
+      console.warn('[tickets.notifications] permission check failed for', principalId, err)
+    }
+  }
+  if (allowed.length === 0) return
+
+  const inputs: CreateNotificationInput[] = allowed.map((principalId) => ({
+    principalId,
+    type: options.type,
+    title: options.title,
+    body: options.body,
+    ticketId: options.ticket.id as TicketId,
+    metadata: { ticketId: options.ticket.id, ...(options.metadata ?? {}) },
+  }))
+  await createNotificationsBatch(inputs)
+}
+
+async function loadActiveShares(ticketId: TicketId) {
+  const rows = await db
+    .select({ teamId: ticketShares.teamId, revokedAt: ticketShares.revokedAt })
+    .from(ticketShares)
+    .where(and(eq(ticketShares.ticketId, ticketId), isNull(ticketShares.revokedAt)))
+  return rows.map((r) => ({ teamId: r.teamId as TeamId, revokedAt: r.revokedAt }))
+}
+
+async function gatherSubscribers(
+  ticketId: TicketId,
+  event: TicketSubscriptionEvent,
+  extra: ReadonlyArray<PrincipalId | null | undefined> = []
+): Promise<PrincipalId[]> {
+  const subs = await getSubscribers(ticketId, event)
+  const all = new Set<PrincipalId>(subs)
+  for (const id of extra) {
+    if (id) all.add(id)
+  }
+  return Array.from(all)
+}
+
+function ticketHeader(ticket: Ticket): string {
+  return ticket.subject ?? 'ticket'
+}
+
+/**
+ * Build the dispatch trust set for ownership-based recipients:
+ *   - every portal-linked principal (resolved via `contact_user_links`)
+ *   - the requester principal itself (their access is by ownership, not RBAC)
+ */
+function trustedSetForOwnership(
+  ticket: Ticket,
+  portalLinked: ReadonlySet<PrincipalId>
+): ReadonlySet<PrincipalId> | undefined {
+  const requesterId = ticket.requesterPrincipalId as PrincipalId | null
+  if (!requesterId && portalLinked.size === 0) return undefined
+  const out = new Set<PrincipalId>(portalLinked)
+  if (requesterId) out.add(requesterId)
+  return out
+}
+
+// ---------------------------------------------------------------------------
+// Event-specific dispatchers
+// ---------------------------------------------------------------------------
+
+export async function notifyTicketCreated(ticket: Ticket, ctx: NotifyContext): Promise<void> {
+  // Implicit recipients: requester + assignee (if either differs from actor).
+  const portal = await resolvePortalLinkedRecipients(ticket)
+  const recipients = await gatherSubscribers(ticket.id as TicketId, 'thread', [
+    ticket.requesterPrincipalId as PrincipalId | null,
+    ticket.assigneePrincipalId as PrincipalId | null,
+    ...portal.principalIds,
+  ])
+  if (recipients.length === 0) return
+  const trusted = trustedSetForOwnership(ticket, portal.portalLinked)
+  await dispatch({
+    ticket,
+    actorPrincipalId: ctx.actorPrincipalId,
+    recipients,
+    type: 'ticket_thread_added',
+    title: `Ticket opened: ${ticketHeader(ticket)}`,
+    trustedRecipients: trusted,
+  })
+}
+
+export async function notifyTicketAssigned(
+  ticket: Ticket,
+  prevAssigneeId: PrincipalId | null,
+  ctx: NotifyContext
+): Promise<void> {
+  const newAssignee = ticket.assigneePrincipalId as PrincipalId | null
+  const subs = await getSubscribers(ticket.id as TicketId, 'assignment')
+
+  // Notify the new assignee (if any) — even if they aren't subscribed yet.
+  if (newAssignee) {
+    const recipients = Array.from(new Set<PrincipalId>([newAssignee, ...subs]))
+    await dispatch({
+      ticket,
+      actorPrincipalId: ctx.actorPrincipalId,
+      recipients,
+      type: 'ticket_assigned',
+      title: `Assigned to you: ${ticketHeader(ticket)}`,
+      metadata: { previousAssigneePrincipalId: prevAssigneeId },
+    })
+  }
+
+  // Notify the previous assignee that they were unassigned.
+  if (prevAssigneeId && prevAssigneeId !== newAssignee) {
+    await dispatch({
+      ticket,
+      actorPrincipalId: ctx.actorPrincipalId,
+      recipients: [prevAssigneeId],
+      type: 'ticket_unassigned',
+      title: `Unassigned: ${ticketHeader(ticket)}`,
+      metadata: { newAssigneePrincipalId: newAssignee },
+    })
+  }
+}
+
+export async function notifyTicketStatusChanged(
+  ticket: Ticket,
+  prevCategory: string | null,
+  nextCategory: string,
+  ctx: NotifyContext
+): Promise<void> {
+  const portal = await resolvePortalLinkedRecipients(ticket)
+  const recipients = await gatherSubscribers(ticket.id as TicketId, 'status', [
+    ticket.requesterPrincipalId as PrincipalId | null,
+    ticket.assigneePrincipalId as PrincipalId | null,
+    ...portal.principalIds,
+  ])
+  if (recipients.length === 0) return
+  const trusted = trustedSetForOwnership(ticket, portal.portalLinked)
+  await dispatch({
+    ticket,
+    actorPrincipalId: ctx.actorPrincipalId,
+    recipients,
+    type: 'ticket_status_changed',
+    title: `Status: ${ticketHeader(ticket)}`,
+    body: `${prevCategory ?? '—'} → ${nextCategory}`,
+    metadata: { from: prevCategory, to: nextCategory },
+    trustedRecipients: trusted,
+  })
+}
+
+export async function notifyThreadAdded(
+  ticket: Ticket,
+  threadId: string,
+  audience: 'public' | 'internal' | 'shared_team',
+  sharedWithTeamId: TeamId | null,
+  ctx: NotifyContext
+): Promise<void> {
+  const portal = await resolvePortalLinkedRecipients(ticket)
+  const baseSubs = await gatherSubscribers(ticket.id as TicketId, 'thread', [
+    ticket.requesterPrincipalId as PrincipalId | null,
+    ticket.assigneePrincipalId as PrincipalId | null,
+    // Portal-linked principals only join the recipient set for public threads;
+    // for internal / shared_team they're filtered out below regardless.
+    ...(audience === 'public' ? portal.principalIds : []),
+  ])
+
+  // Audience-aware filter:
+  //   - 'public'      → all subscribers (visibility check happens in dispatch)
+  //   - 'internal'    → drop the requester + every portal-linked principal
+  //                     (they cannot see internal threads)
+  //   - 'shared_team' → same as internal for portal-linked + requester
+  const requesterId = ticket.requesterPrincipalId as PrincipalId | null
+  const recipients =
+    audience === 'public'
+      ? baseSubs
+      : baseSubs.filter((id) => id !== requesterId && !portal.portalLinked.has(id))
+
+  if (recipients.length === 0) return
+  // Only public threads trust portal-linked principals; for non-public the
+  // set is empty (they were already filtered out above).
+  const trusted =
+    audience === 'public' ? trustedSetForOwnership(ticket, portal.portalLinked) : undefined
+  await dispatch({
+    ticket,
+    actorPrincipalId: ctx.actorPrincipalId,
+    recipients,
+    type: 'ticket_thread_added',
+    title: `New reply: ${ticketHeader(ticket)}`,
+    metadata: { threadId, audience, sharedWithTeamId },
+    trustedRecipients: trusted,
+  })
+}
+
+export interface ParticipantTarget {
+  principalId: PrincipalId | null
+  contactId: ContactId | null
+}
+
+export async function notifyParticipantAdded(
+  ticket: Ticket,
+  target: ParticipantTarget,
+  ctx: NotifyContext
+): Promise<void> {
+  const direct = target.principalId
+  const linked = target.contactId ? await resolvePrincipalsForContacts([target.contactId]) : []
+  // Nothing to notify about — contact had no linked portal users yet.
+  if (!direct && linked.length === 0) return
+  // Notify the added principal directly + anyone subscribed to participant events.
+  const subs = await getSubscribers(ticket.id as TicketId, 'participants')
+  const seed: PrincipalId[] = direct ? [direct] : []
+  const recipients = Array.from(new Set<PrincipalId>([...seed, ...linked, ...subs]))
+  await dispatch({
+    ticket,
+    actorPrincipalId: ctx.actorPrincipalId,
+    recipients,
+    type: 'ticket_participant_added',
+    title: `Added to ticket: ${ticketHeader(ticket)}`,
+    metadata: {
+      addedPrincipalId: direct,
+      addedContactId: target.contactId,
+    },
+    trustedRecipients: linked.length > 0 ? new Set(linked) : undefined,
+  })
+}
+
+export async function notifyParticipantRemoved(
+  ticket: Ticket,
+  target: ParticipantTarget,
+  ctx: NotifyContext
+): Promise<void> {
+  const direct = target.principalId
+  const linked = target.contactId ? await resolvePrincipalsForContacts([target.contactId]) : []
+  if (!direct && linked.length === 0) return
+  const subs = await getSubscribers(ticket.id as TicketId, 'participants')
+  const seed: PrincipalId[] = direct ? [direct] : []
+  const recipients = Array.from(new Set<PrincipalId>([...seed, ...linked, ...subs]))
+  await dispatch({
+    ticket,
+    actorPrincipalId: ctx.actorPrincipalId,
+    recipients,
+    type: 'ticket_participant_removed',
+    title: `Removed from ticket: ${ticketHeader(ticket)}`,
+    metadata: {
+      removedPrincipalId: direct,
+      removedContactId: target.contactId,
+    },
+    trustedRecipients: linked.length > 0 ? new Set(linked) : undefined,
+  })
+}
+
+async function expandTeamMembers(teamId: TeamId): Promise<PrincipalId[]> {
+  const rows = await db
+    .select({ principalId: teamMemberships.principalId })
+    .from(teamMemberships)
+    .where(eq(teamMemberships.teamId, teamId))
+  return rows.map((r) => r.principalId as PrincipalId)
+}
+
+export async function notifyTicketShared(
+  ticket: Ticket,
+  teamId: TeamId,
+  ctx: NotifyContext
+): Promise<void> {
+  const teamMembers = await expandTeamMembers(teamId)
+  const subs = await getSubscribers(ticket.id as TicketId, 'shares')
+  const recipients = Array.from(new Set<PrincipalId>([...teamMembers, ...subs]))
+  if (recipients.length === 0) return
+  await dispatch({
+    ticket,
+    actorPrincipalId: ctx.actorPrincipalId,
+    recipients,
+    type: 'ticket_shared',
+    title: `Ticket shared: ${ticketHeader(ticket)}`,
+    metadata: { teamId },
+  })
+}
+
+export async function notifyTicketUnshared(
+  ticket: Ticket,
+  teamId: TeamId,
+  ctx: NotifyContext
+): Promise<void> {
+  const teamMembers = await expandTeamMembers(teamId)
+  const subs = await getSubscribers(ticket.id as TicketId, 'shares')
+  const recipients = Array.from(new Set<PrincipalId>([...teamMembers, ...subs]))
+  if (recipients.length === 0) return
+  await dispatch({
+    ticket,
+    actorPrincipalId: ctx.actorPrincipalId,
+    recipients,
+    type: 'ticket_unshared',
+    title: `Ticket access revoked: ${ticketHeader(ticket)}`,
+    metadata: { teamId },
+  })
+}
+
+export async function notifyTicketSlaWarning(
+  ticket: Ticket,
+  kind: string,
+  ruleName: string,
+  recipients: ReadonlyArray<PrincipalId>
+): Promise<void> {
+  if (recipients.length === 0) return
+  const subs = await getSubscribers(ticket.id as TicketId, 'sla')
+  const all = Array.from(new Set<PrincipalId>([...recipients, ...subs]))
+  await dispatch({
+    ticket,
+    actorPrincipalId: null,
+    recipients: all,
+    type: 'ticket_sla_warning',
+    title: `SLA escalation: ${ticketHeader(ticket)}`,
+    body: `${ruleName} (${kind.replace(/_/g, ' ')}) escalation triggered.`,
+    metadata: { kind, ruleName },
+  })
+}
+
+export async function notifyTicketSlaBreach(ticket: Ticket, kind: string): Promise<void> {
+  const subs = await getSubscribers(ticket.id as TicketId, 'sla', undefined)
+  const recipients = Array.from(
+    new Set<PrincipalId>([
+      ...(ticket.assigneePrincipalId ? [ticket.assigneePrincipalId as PrincipalId] : []),
+      ...subs,
+    ])
+  )
+  if (recipients.length === 0) return
+  await dispatch({
+    ticket,
+    actorPrincipalId: null,
+    recipients,
+    type: 'ticket_sla_breach',
+    title: `SLA breached: ${ticketHeader(ticket)}`,
+    body: `${kind.replace(/_/g, ' ')} target was missed.`,
+    metadata: { kind },
+  })
+}
+
+// Suppress unused warning for helpers exposed for downstream callers.
+void inArray
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.participants.ts b/apps/web/src/lib/server/domains/tickets/ticket.participants.ts
new file mode 100644
index 000000000..29fbc5188
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.participants.ts
@@ -0,0 +1,204 @@
+/**
+ * Ticket participants — watchers, collaborators, and CC'd contacts.
+ *
+ * The DB CHECK constraint guarantees exactly one of `principalId` /
+ * `contactId` is set; we mirror that invariant in the service so callers
+ * get a friendly domain error instead of a Postgres exception.
+ */
+import {
+  db,
+  eq,
+  and,
+  ticketParticipants,
+  tickets,
+  TICKET_PARTICIPANT_ROLES,
+  type TicketParticipant,
+  type TicketParticipantRole,
+} from '@/lib/server/db'
+import type { TicketId, TicketParticipantId, PrincipalId, ContactId } from '@quackback/ids'
+import { NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { recordEvent } from '../audit'
+import { writeActivity, bumpLastActivity } from './ticket.service'
+
+export interface AddParticipantInput {
+  ticketId: TicketId
+  role: TicketParticipantRole
+  principalId?: PrincipalId | null
+  contactId?: ContactId | null
+  addedByPrincipalId: PrincipalId | null
+}
+
+export async function addParticipant(input: AddParticipantInput): Promise<TicketParticipant> {
+  if (!TICKET_PARTICIPANT_ROLES.includes(input.role)) {
+    throw new ValidationError('TICKET_PARTICIPANT_ROLE_INVALID', 'invalid role')
+  }
+  const hasPrincipal = !!input.principalId
+  const hasContact = !!input.contactId
+  if (hasPrincipal === hasContact) {
+    throw new ValidationError(
+      'TICKET_PARTICIPANT_SUBJECT_INVALID',
+      'exactly one of principalId / contactId must be set'
+    )
+  }
+
+  // Idempotency: re-adding the same subject returns the existing row.
+  const existing = await db.query.ticketParticipants.findFirst({
+    where: and(
+      eq(ticketParticipants.ticketId, input.ticketId),
+      hasPrincipal
+        ? eq(ticketParticipants.principalId, input.principalId!)
+        : eq(ticketParticipants.contactId, input.contactId!)
+    ),
+  })
+  if (existing) return existing
+
+  const [created] = await db
+    .insert(ticketParticipants)
+    .values({
+      ticketId: input.ticketId,
+      role: input.role,
+      principalId: input.principalId ?? null,
+      contactId: input.contactId ?? null,
+      addedByPrincipalId: input.addedByPrincipalId,
+    })
+    .returning()
+
+  await bumpLastActivity(input.ticketId)
+  await writeActivity(input.ticketId, input.addedByPrincipalId, 'participant.added', {
+    participantId: created.id,
+    role: input.role,
+    principalId: input.principalId ?? null,
+    contactId: input.contactId ?? null,
+  })
+  void recordEvent({
+    principalId: input.addedByPrincipalId,
+    action: 'ticket.participant_added',
+    targetType: 'ticket',
+    targetId: input.ticketId,
+    diff: {
+      context: {
+        participantId: created.id,
+        role: input.role,
+        principalId: input.principalId ?? null,
+        contactId: input.contactId ?? null,
+      },
+    },
+  })
+
+  // Phase 7: auto-subscribe added principal + dispatch participant.added notification.
+  try {
+    if (input.principalId) {
+      const { safeSubscribe } = await import('./ticket.subscriptions')
+      await safeSubscribe({
+        ticketId: input.ticketId,
+        principalId: input.principalId,
+        source: 'auto_participant',
+      })
+    }
+    const ticketRow = await db.query.tickets.findFirst({ where: eq(tickets.id, input.ticketId) })
+    if (ticketRow) {
+      const { notifyParticipantAdded } = await import('./ticket.notifications')
+      await notifyParticipantAdded(
+        ticketRow,
+        {
+          principalId: input.principalId ?? null,
+          contactId: input.contactId ?? null,
+        },
+        {
+          actorPrincipalId: input.addedByPrincipalId,
+        }
+      )
+      // Phase 7.5: outbound webhook event.
+      try {
+        const { dispatchTicketParticipantAdded, buildEventActor } =
+          await import('@/lib/server/events/dispatch')
+        const actor = input.addedByPrincipalId
+          ? buildEventActor({
+              principalId: input.addedByPrincipalId,
+              displayName: 'ticket-system',
+            })
+          : { type: 'service' as const, displayName: 'ticket-system' }
+        await dispatchTicketParticipantAdded(
+          actor,
+          ticketRow as unknown as Record<string, unknown>,
+          (input.principalId as string | null) ?? null,
+          (input.role as string | null) ?? null
+        )
+      } catch (err) {
+        console.warn('[tickets] dispatchTicketParticipantAdded failed', err)
+      }
+    }
+  } catch (err) {
+    console.warn('[tickets] notifyParticipantAdded failed', err)
+  }
+
+  return created
+}
+
+export async function removeParticipant(
+  participantId: TicketParticipantId,
+  actorPrincipalId: PrincipalId | null
+): Promise<void> {
+  const existing = await db.query.ticketParticipants.findFirst({
+    where: eq(ticketParticipants.id, participantId),
+  })
+  if (!existing) {
+    throw new NotFoundError(
+      'TICKET_PARTICIPANT_NOT_FOUND',
+      `participant ${participantId} not found`
+    )
+  }
+  await db.delete(ticketParticipants).where(eq(ticketParticipants.id, participantId))
+  await bumpLastActivity(existing.ticketId as TicketId)
+  await writeActivity(existing.ticketId as TicketId, actorPrincipalId, 'participant.removed', {
+    participantId,
+  })
+  void recordEvent({
+    principalId: actorPrincipalId,
+    action: 'ticket.participant_removed',
+    targetType: 'ticket',
+    targetId: existing.ticketId,
+    diff: { context: { participantId } },
+  })
+
+  // Phase 7: dispatch participant.removed notification.
+  try {
+    const ticketRow = await db.query.tickets.findFirst({
+      where: eq(tickets.id, existing.ticketId as TicketId),
+    })
+    if (ticketRow) {
+      const { notifyParticipantRemoved } = await import('./ticket.notifications')
+      await notifyParticipantRemoved(
+        ticketRow,
+        {
+          principalId: existing.principalId as PrincipalId | null,
+          contactId: existing.contactId as ContactId | null,
+        },
+        {
+          actorPrincipalId,
+        }
+      )
+      // Phase 7.5: outbound webhook event.
+      try {
+        const { dispatchTicketParticipantRemoved, buildEventActor } =
+          await import('@/lib/server/events/dispatch')
+        const actor = actorPrincipalId
+          ? buildEventActor({ principalId: actorPrincipalId, displayName: 'ticket-system' })
+          : { type: 'service' as const, displayName: 'ticket-system' }
+        await dispatchTicketParticipantRemoved(
+          actor,
+          ticketRow as unknown as Record<string, unknown>,
+          (existing.principalId as string | null) ?? null
+        )
+      } catch (err) {
+        console.warn('[tickets] dispatchTicketParticipantRemoved failed', err)
+      }
+    }
+  } catch (err) {
+    console.warn('[tickets] notifyParticipantRemoved failed', err)
+  }
+}
+
+export async function listParticipants(ticketId: TicketId): Promise<TicketParticipant[]> {
+  return db.select().from(ticketParticipants).where(eq(ticketParticipants.ticketId, ticketId))
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.permissions.ts b/apps/web/src/lib/server/domains/tickets/ticket.permissions.ts
new file mode 100644
index 000000000..160324f88
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.permissions.ts
@@ -0,0 +1,71 @@
+/**
+ * Ticket-specific permission helpers built on top of the generic authz layer.
+ *
+ * Every helper takes a pre-loaded `PermissionSet` plus the ticket-shaped
+ * `ResourceScope` and returns a boolean — the service layer composes these
+ * into higher-level "can the actor do X?" checks.
+ *
+ * Keeping these in a single file makes the permission matrix easy to audit
+ * and gives tests a single import surface.
+ */
+
+import type { PrincipalId, TeamId } from '@quackback/ids'
+import { PERMISSIONS } from '../authz'
+import type { ResourceScope } from '../authz/authz.scopes'
+import {
+  hasPermission,
+  hasPermissionForResource,
+  evaluateTicketView,
+  type PermissionSet,
+} from '../authz/authz.service'
+
+/** Convert a ticket row + its (optional) shares into the authz scope shape. */
+export function toResourceScope(ticket: {
+  primaryTeamId: TeamId | null
+  assigneePrincipalId: PrincipalId | null
+  assigneeTeamId: TeamId | null
+  shares?: ReadonlyArray<{ teamId: TeamId; revokedAt: Date | null }>
+}): ResourceScope {
+  return {
+    primaryTeamId: ticket.primaryTeamId,
+    assigneePrincipalId: ticket.assigneePrincipalId,
+    assigneeTeamId: ticket.assigneeTeamId,
+    sharedTeamIds: (ticket.shares ?? []).filter((s) => s.revokedAt == null).map((s) => s.teamId),
+  }
+}
+
+export function canViewTicket(set: PermissionSet, resource: ResourceScope): boolean {
+  return evaluateTicketView(set, resource).inScope
+}
+
+export function canReplyPublic(set: PermissionSet, resource: ResourceScope): boolean {
+  return hasPermissionForResource(set, PERMISSIONS.TICKET_REPLY_PUBLIC, resource)
+}
+
+export function canCommentInternal(set: PermissionSet, resource: ResourceScope): boolean {
+  return hasPermissionForResource(set, PERMISSIONS.TICKET_COMMENT_INTERNAL, resource)
+}
+
+export function canEditFields(set: PermissionSet, resource: ResourceScope): boolean {
+  return hasPermissionForResource(set, PERMISSIONS.TICKET_EDIT_FIELDS, resource)
+}
+
+export function canAssign(set: PermissionSet, resource: ResourceScope): boolean {
+  if (hasPermission(set, PERMISSIONS.TICKET_ASSIGN_ANY)) return true
+  return hasPermissionForResource(set, PERMISSIONS.TICKET_ASSIGN_ANY, resource)
+}
+
+export function canAssignSelf(set: PermissionSet, resource: ResourceScope): boolean {
+  return (
+    canAssign(set, resource) ||
+    hasPermissionForResource(set, PERMISSIONS.TICKET_ASSIGN_SELF, resource)
+  )
+}
+
+export function canShareCrossTeam(set: PermissionSet, resource: ResourceScope): boolean {
+  return hasPermissionForResource(set, PERMISSIONS.TICKET_SHARE_CROSS_TEAM, resource)
+}
+
+export function canManageParticipants(set: PermissionSet, resource: ResourceScope): boolean {
+  return hasPermissionForResource(set, PERMISSIONS.TICKET_MANAGE_PARTICIPANTS, resource)
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.portal-query.ts b/apps/web/src/lib/server/domains/tickets/ticket.portal-query.ts
new file mode 100644
index 000000000..e527c598f
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.portal-query.ts
@@ -0,0 +1,424 @@
+/**
+ * Portal-side ticket access — ownership-gated, NOT permission-gated.
+ *
+ * The staff-side `listTickets` enforces a queue scope + permission set.
+ * Portal users have an intentionally-empty role bundle, so we cannot reuse
+ * that path. Instead, every portal query is filtered by an OWNERSHIP
+ * predicate built from the user's identity-set:
+ *
+ *   identity-set := principalId(userId) ∪ linkedContactIds(userId)
+ *
+ * A ticket is visible iff:
+ *   - `requesterPrincipalId` matches the user's principal, OR
+ *   - `requesterContactId`   matches one of the user's linked contacts, OR
+ *   - the user appears in `ticket_participants` via either subject column.
+ *
+ * Misses ALWAYS surface as `NotFoundError` (never `ForbiddenError`) so we
+ * don't leak existence of tickets the portal user has no relationship with.
+ */
+import {
+  db,
+  eq,
+  and,
+  or,
+  isNull,
+  inArray,
+  desc,
+  sql,
+  tickets,
+  ticketStatuses,
+  ticketParticipants,
+  type Ticket,
+  type TicketStatusCategory,
+  type TiptapContent,
+} from '@/lib/server/db'
+import type {
+  ContactId,
+  InboxId,
+  PrincipalId,
+  TicketId,
+  UserId,
+  WidgetProfileId,
+} from '@quackback/ids'
+import type { TicketThread } from '@/lib/server/db'
+import { ConflictError, ForbiddenError, NotFoundError } from '@/lib/shared/errors'
+import { getMemberByUser } from '../principals/principal.service'
+import { listLinksForUser } from '../organizations/contact.service'
+import { addThread } from './ticket.threads'
+import { updateTicket, transitionStatus } from './ticket.service'
+import { listTicketStatuses } from './ticket-statuses.service'
+
+const DEFAULT_LIMIT = 20
+const MAX_LIMIT = 50
+
+export interface PortalIdentity {
+  principalId: PrincipalId | null
+  contactIds: ContactId[]
+}
+
+export type PortalViewerRelationship = 'requester' | 'collaborator' | 'watcher' | 'cc'
+
+/**
+ * Resolve the union of principal + linked contacts that this portal user
+ * "is". Never throws — callers treat an empty identity as "no access".
+ */
+export async function buildPortalIdentity(userId: UserId): Promise<PortalIdentity> {
+  const [memberRow, links] = await Promise.all([getMemberByUser(userId), listLinksForUser(userId)])
+  const contactIds = Array.from(new Set(links.map((l) => l.contactId as ContactId)))
+  return {
+    principalId: (memberRow?.id as PrincipalId | undefined) ?? null,
+    contactIds,
+  }
+}
+
+/**
+ * Compose the ownership predicate. Returns `null` when the identity is empty
+ * (caller should short-circuit to no-results).
+ */
+function ownershipWhere(identity: PortalIdentity) {
+  const branches = []
+  if (identity.principalId) {
+    branches.push(eq(tickets.requesterPrincipalId, identity.principalId))
+  }
+  if (identity.contactIds.length > 0) {
+    branches.push(inArray(tickets.requesterContactId, identity.contactIds))
+  }
+  // Participant subquery — include only when at least one identity column matches.
+  const participantBranches = []
+  if (identity.principalId) {
+    participantBranches.push(eq(ticketParticipants.principalId, identity.principalId))
+  }
+  if (identity.contactIds.length > 0) {
+    participantBranches.push(inArray(ticketParticipants.contactId, identity.contactIds))
+  }
+  if (participantBranches.length > 0) {
+    branches.push(
+      inArray(
+        tickets.id,
+        db
+          .select({ id: ticketParticipants.ticketId })
+          .from(ticketParticipants)
+          .where(
+            participantBranches.length === 1 ? participantBranches[0] : or(...participantBranches)
+          )
+      )
+    )
+  }
+  if (branches.length === 0) return null
+  return branches.length === 1 ? branches[0] : or(...branches)
+}
+
+export interface ListTicketsForPortalUserOptions {
+  userId: UserId
+  statusCategory?: TicketStatusCategory
+  limit?: number
+  offset?: number
+  sourceWidgetProfileId?: WidgetProfileId | null
+  allowedInboxIds?: InboxId[] | null
+}
+
+export async function listTicketsForPortalUser(
+  opts: ListTicketsForPortalUserOptions
+): Promise<{ rows: Ticket[]; total: number }> {
+  const identity = await buildPortalIdentity(opts.userId)
+  const ownership = ownershipWhere(identity)
+  if (!ownership) return { rows: [], total: 0 }
+
+  const limit = Math.min(opts.limit ?? DEFAULT_LIMIT, MAX_LIMIT)
+  const offset = Math.max(opts.offset ?? 0, 0)
+
+  const filters = [isNull(tickets.deletedAt), ownership]
+  if (opts.statusCategory) {
+    filters.push(
+      inArray(
+        tickets.statusId,
+        db
+          .select({ id: ticketStatuses.id })
+          .from(ticketStatuses)
+          .where(eq(ticketStatuses.category, opts.statusCategory))
+      )
+    )
+  }
+  if (opts.sourceWidgetProfileId) {
+    filters.push(eq(tickets.sourceWidgetProfileId, opts.sourceWidgetProfileId))
+  }
+  if (opts.allowedInboxIds) {
+    if (opts.allowedInboxIds.length === 0) return { rows: [], total: 0 }
+    filters.push(inArray(tickets.inboxId, opts.allowedInboxIds))
+  }
+  const where = and(...filters)
+
+  const [rows, [{ count }]] = await Promise.all([
+    db
+      .select()
+      .from(tickets)
+      .where(where)
+      .orderBy(desc(tickets.lastActivityAt))
+      .limit(limit)
+      .offset(offset),
+    db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(tickets)
+      .where(where),
+  ])
+  return { rows, total: count }
+}
+
+export interface GetTicketForPortalUserOptions {
+  userId: UserId
+  ticketId: TicketId
+}
+
+export async function getTicketForPortalUser(opts: GetTicketForPortalUserOptions): Promise<Ticket> {
+  const identity = await buildPortalIdentity(opts.userId)
+  const ownership = ownershipWhere(identity)
+  if (!ownership) {
+    throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${opts.ticketId} not found`)
+  }
+  const row = await db.query.tickets.findFirst({
+    where: and(eq(tickets.id, opts.ticketId), isNull(tickets.deletedAt), ownership),
+  })
+  if (!row) {
+    // Deliberately NotFound, never Forbidden, to avoid existence leak.
+    throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${opts.ticketId} not found`)
+  }
+  return row
+}
+
+/**
+ * Determine the viewer's relationship to a ticket given their identity set.
+ * Returns 'requester' if the viewer owns the ticket, otherwise the participant
+ * role ('collaborator' | 'watcher' | 'cc'). Falls back to 'watcher' if no
+ * matching participant row is found (defensive).
+ */
+export async function resolveViewerRelationship(
+  ticket: Ticket,
+  identity: PortalIdentity
+): Promise<PortalViewerRelationship> {
+  // Check requester by principal
+  if (identity.principalId && ticket.requesterPrincipalId === identity.principalId) {
+    return 'requester'
+  }
+  // Check requester by contact
+  if (
+    ticket.requesterContactId &&
+    identity.contactIds.includes(ticket.requesterContactId as ContactId)
+  ) {
+    return 'requester'
+  }
+  // Must be a participant — look up the role.
+  const branches = []
+  if (identity.principalId) {
+    branches.push(
+      and(
+        eq(ticketParticipants.ticketId, ticket.id as TicketId),
+        eq(ticketParticipants.principalId, identity.principalId)
+      )
+    )
+  }
+  if (identity.contactIds.length > 0) {
+    branches.push(
+      and(
+        eq(ticketParticipants.ticketId, ticket.id as TicketId),
+        inArray(ticketParticipants.contactId, identity.contactIds)
+      )
+    )
+  }
+  if (branches.length === 0) return 'watcher'
+  const row = await db.query.ticketParticipants.findFirst({
+    where: branches.length === 1 ? branches[0] : or(...branches),
+  })
+  return (row?.role as PortalViewerRelationship) ?? 'watcher'
+}
+
+export interface AddPortalReplyOptions {
+  userId: UserId
+  ticketId: TicketId
+  bodyJson?: TiptapContent | null
+  bodyText?: string | null
+}
+
+export async function addPortalReply(opts: AddPortalReplyOptions): Promise<TicketThread> {
+  // Re-check ownership; throws NotFoundError on miss.
+  const ticket = await getTicketForPortalUser({ userId: opts.userId, ticketId: opts.ticketId })
+
+  const member = await getMemberByUser(opts.userId)
+  if (!member) {
+    // Server-side invariant: portal users always have a principal row from auth.
+    throw new ForbiddenError('PORTAL_NO_PRINCIPAL', 'portal user has no principal')
+  }
+
+  // Reject replies to closed tickets (UI also disables the composer).
+  const status = ticket.statusId
+    ? await db.query.ticketStatuses.findFirst({
+        where: eq(ticketStatuses.id, ticket.statusId),
+      })
+    : undefined
+  if (status?.category === 'closed') {
+    throw new ConflictError('TICKET_CLOSED', 'cannot reply to a closed ticket')
+  }
+
+  // Only requesters and collaborators may reply; watchers/cc are view-only.
+  const identity = await buildPortalIdentity(opts.userId)
+  const relationship = await resolveViewerRelationship(ticket, identity)
+  if (relationship !== 'requester' && relationship !== 'collaborator') {
+    throw new ForbiddenError('PORTAL_REPLY_DENIED', 'participants with this role cannot reply')
+  }
+
+  return addThread({
+    ticketId: opts.ticketId,
+    principalId: member.id as PrincipalId,
+    audience: 'public',
+    bodyJson: opts.bodyJson ?? null,
+    bodyText: opts.bodyText ?? null,
+  })
+}
+
+export interface UpdatePortalTicketDescriptionOptions {
+  userId: UserId
+  ticketId: TicketId
+  expectedUpdatedAt: Date
+  descriptionJson?: TiptapContent | null
+  descriptionText?: string | null
+}
+
+export async function updatePortalTicketDescription(
+  opts: UpdatePortalTicketDescriptionOptions
+): Promise<Ticket> {
+  // Re-check ownership; throws NotFoundError on miss.
+  const ticket = await getTicketForPortalUser({ userId: opts.userId, ticketId: opts.ticketId })
+
+  const member = await getMemberByUser(opts.userId)
+  if (!member) {
+    throw new ForbiddenError('PORTAL_NO_PRINCIPAL', 'portal user has no principal')
+  }
+
+  // Reject edits to closed tickets.
+  const status = ticket.statusId
+    ? await db.query.ticketStatuses.findFirst({
+        where: eq(ticketStatuses.id, ticket.statusId),
+      })
+    : undefined
+  if (status?.category === 'closed') {
+    throw new ConflictError('TICKET_CLOSED', 'cannot edit a closed ticket')
+  }
+
+  // Requesters and collaborators may edit the description.
+  const identity = await buildPortalIdentity(opts.userId)
+  const relationship = await resolveViewerRelationship(ticket, identity)
+  if (relationship !== 'requester' && relationship !== 'collaborator') {
+    throw new ForbiddenError(
+      'PORTAL_EDIT_DENIED',
+      'participants with this role cannot edit the description'
+    )
+  }
+
+  return updateTicket(opts.ticketId, {
+    expectedUpdatedAt: opts.expectedUpdatedAt,
+    actorPrincipalId: member.id as PrincipalId,
+    descriptionJson: opts.descriptionJson,
+    descriptionText: opts.descriptionText,
+    allowStaleFieldUpdate: true,
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Portal close / reopen
+// ---------------------------------------------------------------------------
+
+export interface ClosePortalTicketOptions {
+  userId: UserId
+  ticketId: TicketId
+}
+
+/**
+ * Requester marks their ticket as solved. Only allowed from open / pending /
+ * on_hold categories. Transitions to the first status with category 'solved'.
+ */
+export async function closePortalTicket(opts: ClosePortalTicketOptions): Promise<Ticket> {
+  const ticket = await getTicketForPortalUser({ userId: opts.userId, ticketId: opts.ticketId })
+
+  const member = await getMemberByUser(opts.userId)
+  if (!member) {
+    throw new ForbiddenError('PORTAL_NO_PRINCIPAL', 'portal user has no principal')
+  }
+
+  // Only the requester can close/reopen.
+  const identity = await buildPortalIdentity(opts.userId)
+  const relationship = await resolveViewerRelationship(ticket, identity)
+  if (relationship !== 'requester') {
+    throw new ForbiddenError(
+      'PORTAL_CLOSE_DENIED',
+      'only the requester can mark a ticket as solved'
+    )
+  }
+
+  // Must be in an active category.
+  const currentStatus = ticket.statusId
+    ? await db.query.ticketStatuses.findFirst({ where: eq(ticketStatuses.id, ticket.statusId) })
+    : undefined
+  const activeCats: TicketStatusCategory[] = ['open', 'pending', 'on_hold']
+  if (!currentStatus || !activeCats.includes(currentStatus.category as TicketStatusCategory)) {
+    throw new ConflictError('TICKET_NOT_ACTIVE', 'ticket is not in an active state')
+  }
+
+  // Find the first 'solved' status.
+  const allStatuses = await listTicketStatuses()
+  const solvedStatus = allStatuses.find((s) => s.category === 'solved')
+  if (!solvedStatus) {
+    throw new ConflictError('NO_SOLVED_STATUS', 'no solved status configured')
+  }
+
+  return transitionStatus(opts.ticketId, {
+    expectedUpdatedAt: ticket.updatedAt,
+    actorPrincipalId: member.id as PrincipalId,
+    statusId: solvedStatus.id,
+  })
+}
+
+export interface ReopenPortalTicketOptions {
+  userId: UserId
+  ticketId: TicketId
+}
+
+/**
+ * Requester reopens a solved ticket. Only allowed from 'solved' category.
+ * Transitions to the first status with category 'open'.
+ * Closed tickets (admin-final) cannot be reopened from the portal.
+ */
+export async function reopenPortalTicket(opts: ReopenPortalTicketOptions): Promise<Ticket> {
+  const ticket = await getTicketForPortalUser({ userId: opts.userId, ticketId: opts.ticketId })
+
+  const member = await getMemberByUser(opts.userId)
+  if (!member) {
+    throw new ForbiddenError('PORTAL_NO_PRINCIPAL', 'portal user has no principal')
+  }
+
+  // Only the requester can reopen.
+  const identity = await buildPortalIdentity(opts.userId)
+  const relationship = await resolveViewerRelationship(ticket, identity)
+  if (relationship !== 'requester') {
+    throw new ForbiddenError('PORTAL_REOPEN_DENIED', 'only the requester can reopen a ticket')
+  }
+
+  // Must be solved (not closed — closed is admin-final).
+  const currentStatus = ticket.statusId
+    ? await db.query.ticketStatuses.findFirst({ where: eq(ticketStatuses.id, ticket.statusId) })
+    : undefined
+  if (!currentStatus || currentStatus.category !== 'solved') {
+    throw new ConflictError('TICKET_NOT_SOLVED', 'only solved tickets can be reopened')
+  }
+
+  // Find the first 'open' status.
+  const allStatuses = await listTicketStatuses()
+  const openStatus = allStatuses.find((s) => s.category === 'open')
+  if (!openStatus) {
+    throw new ConflictError('NO_OPEN_STATUS', 'no open status configured')
+  }
+
+  return transitionStatus(opts.ticketId, {
+    expectedUpdatedAt: ticket.updatedAt,
+    actorPrincipalId: member.id as PrincipalId,
+    statusId: openStatus.id,
+  })
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.query.ts b/apps/web/src/lib/server/domains/tickets/ticket.query.ts
new file mode 100644
index 000000000..8c67cbc48
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.query.ts
@@ -0,0 +1,262 @@
+/**
+ * Ticket queue queries — scope-aware listings for the agent UI and REST.
+ *
+ * `scope` selects a queue lens; the function picks the correct WHERE clause
+ * AND validates that the actor's PermissionSet contains a permission that
+ * actually authorises the lens. This keeps "scope" and "permission" coupled
+ * so a UI bug can never widen the result set.
+ *
+ * Sorting and pagination are kept simple (offset+limit) for Phase 3; cursor
+ * pagination ships in Phase 7 when the queue grows.
+ */
+import {
+  db,
+  eq,
+  and,
+  or,
+  isNull,
+  inArray,
+  desc,
+  asc,
+  ilike,
+  sql,
+  tickets,
+  ticketShares,
+  ticketStatuses,
+  inboxMemberships,
+  type Ticket,
+  type TicketStatusCategory,
+} from '@/lib/server/db'
+import type { TeamId, TicketStatusId, InboxId, OrganizationId, ContactId } from '@quackback/ids'
+import { ForbiddenError, ValidationError } from '@/lib/shared/errors'
+import { PERMISSIONS } from '../authz'
+import { hasPermission, type PermissionSet } from '../authz/authz.service'
+
+export type TicketQueueScope =
+  | 'all'
+  | 'my_assigned'
+  | 'my_team'
+  | 'shared_with_me'
+  | 'unassigned'
+  | 'my_inbox'
+  | 'inbox'
+
+export interface ListTicketsOptions {
+  scope: TicketQueueScope
+  permissionSet: PermissionSet
+  statusCategory?: TicketStatusCategory
+  statusIds?: readonly TicketStatusId[]
+  search?: string
+  inboxId?: InboxId | null
+  organizationId?: OrganizationId | null
+  requesterContactId?: ContactId | null
+  limit?: number
+  offset?: number
+  sort?: 'last_activity_desc' | 'created_desc' | 'created_asc'
+}
+
+const DEFAULT_LIMIT = 50
+const MAX_LIMIT = 200
+
+export async function listTickets(opts: ListTicketsOptions): Promise<{
+  rows: Ticket[]
+  total: number
+}> {
+  const limit = Math.min(opts.limit ?? DEFAULT_LIMIT, MAX_LIMIT)
+  const offset = Math.max(opts.offset ?? 0, 0)
+  const set = opts.permissionSet
+
+  const scopeWhere = await buildScopeWhere(opts.scope, set, opts.inboxId ?? null)
+
+  const filters = [isNull(tickets.deletedAt), scopeWhere]
+  if (opts.inboxId !== undefined) {
+    if (opts.inboxId === null) filters.push(isNull(tickets.inboxId))
+    else filters.push(eq(tickets.inboxId, opts.inboxId))
+  }
+  if (opts.organizationId !== undefined) {
+    if (opts.organizationId === null) filters.push(isNull(tickets.organizationId))
+    else filters.push(eq(tickets.organizationId, opts.organizationId))
+  }
+  if (opts.requesterContactId !== undefined) {
+    if (opts.requesterContactId === null) filters.push(isNull(tickets.requesterContactId))
+    else filters.push(eq(tickets.requesterContactId, opts.requesterContactId))
+  }
+  if (opts.statusIds?.length) {
+    filters.push(inArray(tickets.statusId, opts.statusIds as TicketStatusId[]))
+  }
+  if (opts.statusCategory) {
+    // Resolve category → statusIds via a subquery to avoid a join.
+    filters.push(
+      inArray(
+        tickets.statusId,
+        db
+          .select({ id: ticketStatuses.id })
+          .from(ticketStatuses)
+          .where(eq(ticketStatuses.category, opts.statusCategory))
+      )
+    )
+  }
+  if (opts.search?.trim()) {
+    const q = `%${opts.search.trim()}%`
+    filters.push(or(ilike(tickets.subject, q), ilike(tickets.descriptionText, q))!)
+  }
+
+  const where = and(...filters)
+  const orderBy = (() => {
+    switch (opts.sort) {
+      case 'created_desc':
+        return desc(tickets.createdAt)
+      case 'created_asc':
+        return asc(tickets.createdAt)
+      case 'last_activity_desc':
+      default:
+        return desc(tickets.lastActivityAt)
+    }
+  })()
+
+  const [rows, [{ count }]] = await Promise.all([
+    db.select().from(tickets).where(where).orderBy(orderBy).limit(limit).offset(offset),
+    db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(tickets)
+      .where(where),
+  ])
+  return { rows, total: count }
+}
+
+async function buildScopeWhere(
+  scope: TicketQueueScope,
+  set: PermissionSet,
+  inboxId: InboxId | null
+) {
+  switch (scope) {
+    case 'all': {
+      if (!hasPermission(set, PERMISSIONS.TICKET_VIEW_ALL)) {
+        throw new ForbiddenError(
+          'TICKET_SCOPE_DENIED',
+          'requires ticket.view_all to use the "all" queue scope'
+        )
+      }
+      return sql`true`
+    }
+    case 'my_assigned': {
+      const allowed =
+        hasPermission(set, PERMISSIONS.TICKET_VIEW_ALL) ||
+        hasPermission(set, PERMISSIONS.TICKET_VIEW_TEAM) ||
+        hasPermission(set, PERMISSIONS.TICKET_VIEW_ASSIGNED)
+      if (!allowed) {
+        throw new ForbiddenError(
+          'TICKET_SCOPE_DENIED',
+          'requires ticket.view_assigned to use the "my_assigned" scope'
+        )
+      }
+      return eq(tickets.assigneePrincipalId, set.principalId)
+    }
+    case 'my_team': {
+      if (
+        !hasPermission(set, PERMISSIONS.TICKET_VIEW_ALL) &&
+        !hasPermission(set, PERMISSIONS.TICKET_VIEW_TEAM)
+      ) {
+        throw new ForbiddenError(
+          'TICKET_SCOPE_DENIED',
+          'requires ticket.view_team to use the "my_team" scope'
+        )
+      }
+      const teamIds = teamsWithViewPermission(set, PERMISSIONS.TICKET_VIEW_TEAM)
+      if (teamIds.length === 0) {
+        // The actor has the workspace-wide grant but no team membership; degrade gracefully.
+        return sql`false`
+      }
+      return or(
+        inArray(tickets.primaryTeamId, teamIds as TeamId[]),
+        inArray(tickets.assigneeTeamId, teamIds as TeamId[])
+      )!
+    }
+    case 'shared_with_me': {
+      if (
+        !hasPermission(set, PERMISSIONS.TICKET_VIEW_ALL) &&
+        !hasPermission(set, PERMISSIONS.TICKET_VIEW_SHARED)
+      ) {
+        throw new ForbiddenError(
+          'TICKET_SCOPE_DENIED',
+          'requires ticket.view_shared to use the "shared_with_me" scope'
+        )
+      }
+      const teamIds = set.teamIds
+      if (teamIds.length === 0) return sql`false`
+      return inArray(
+        tickets.id,
+        db
+          .select({ id: ticketShares.ticketId })
+          .from(ticketShares)
+          .where(
+            and(inArray(ticketShares.teamId, teamIds as TeamId[]), isNull(ticketShares.revokedAt))
+          )
+      )
+    }
+    case 'unassigned': {
+      const allowed =
+        hasPermission(set, PERMISSIONS.TICKET_VIEW_ALL) ||
+        hasPermission(set, PERMISSIONS.TICKET_VIEW_TEAM)
+      if (!allowed) {
+        throw new ForbiddenError(
+          'TICKET_SCOPE_DENIED',
+          'requires ticket.view_team to use the "unassigned" scope'
+        )
+      }
+      const base = and(isNull(tickets.assigneePrincipalId), isNull(tickets.assigneeTeamId))!
+      if (hasPermission(set, PERMISSIONS.TICKET_VIEW_ALL)) return base
+      const teamIds = teamsWithViewPermission(set, PERMISSIONS.TICKET_VIEW_TEAM)
+      if (teamIds.length === 0) return sql`false`
+      return and(base, inArray(tickets.primaryTeamId, teamIds as TeamId[]))!
+    }
+    case 'my_inbox': {
+      if (!hasPermission(set, PERMISSIONS.INBOX_VIEW)) {
+        throw new ForbiddenError(
+          'TICKET_SCOPE_DENIED',
+          'requires inbox.view to use the "my_inbox" scope'
+        )
+      }
+      return inArray(
+        tickets.inboxId,
+        db
+          .select({ id: inboxMemberships.inboxId })
+          .from(inboxMemberships)
+          .where(eq(inboxMemberships.principalId, set.principalId))
+      )
+    }
+    case 'inbox': {
+      if (!hasPermission(set, PERMISSIONS.INBOX_VIEW)) {
+        throw new ForbiddenError(
+          'TICKET_SCOPE_DENIED',
+          'requires inbox.view to use the "inbox" scope'
+        )
+      }
+      if (!inboxId) {
+        throw new ValidationError(
+          'TICKET_INBOX_REQUIRED',
+          'inboxId is required for the "inbox" scope'
+        )
+      }
+      return eq(tickets.inboxId, inboxId)
+    }
+    default:
+      throw new ValidationError('TICKET_SCOPE_INVALID', `unknown scope ${String(scope)}`)
+  }
+}
+
+function teamsWithViewPermission(
+  set: PermissionSet,
+  permission:
+    | typeof PERMISSIONS.TICKET_VIEW_TEAM
+    | typeof PERMISSIONS.TICKET_VIEW_SHARED
+    | typeof PERMISSIONS.TICKET_VIEW_ASSIGNED
+): TeamId[] {
+  // Workspace-wide grant ⇒ all of the actor's teams qualify.
+  if (set.workspacePermissions.has(permission)) return set.teamIds.slice() as TeamId[]
+  const out: TeamId[] = []
+  for (const [teamId, perms] of set.teamPermissions.entries()) {
+    if (perms.has(permission)) out.push(teamId)
+  }
+  return out
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.recipients.ts b/apps/web/src/lib/server/domains/tickets/ticket.recipients.ts
new file mode 100644
index 000000000..18fe47d86
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.recipients.ts
@@ -0,0 +1,106 @@
+/**
+ * Portal-aware recipient resolver for ticket notifications.
+ *
+ * The notification dispatcher only knows about `principalId`s, but a ticket
+ * can also reference its requester / participants by `contactId` (CRM-side).
+ * When a contact is later linked to a portal user (`contact_user_links`),
+ * that user's principal becomes a legitimate notification target.
+ *
+ * This module performs the contact → user → principal expansion in one
+ * indexed SQL roundtrip and returns:
+ *   - `principalIds`: every additional principal the dispatcher should
+ *     consider (deduped, excludes nothing — the dispatcher decides).
+ *   - `portalLinked`: the SUBSET of `principalIds` that were resolved via
+ *     a contact link (i.e. portal users reached by ownership, not RBAC).
+ *     The dispatcher uses this set both to (a) bypass the staff RBAC check
+ *     for those principals and (b) drop them from non-public threads.
+ */
+
+import {
+  db,
+  eq,
+  inArray,
+  contactUserLinks,
+  principal,
+  ticketParticipants,
+  type Ticket,
+} from '@/lib/server/db'
+import type { ContactId, PrincipalId, TicketId } from '@quackback/ids'
+
+export interface PortalLinkedRecipients {
+  /** Additional principals to consider as recipients (deduped). */
+  principalIds: ReadonlyArray<PrincipalId>
+  /**
+   * The subset of `principalIds` reached via a contact link. The dispatcher
+   * trusts these principals by ownership (bypassing the staff RBAC check)
+   * and drops them from non-public thread audiences.
+   */
+  portalLinked: ReadonlySet<PrincipalId>
+}
+
+/**
+ * Given a set of contact IDs, return every principal whose `userId` is linked
+ * to one of those contacts via `contact_user_links`.
+ *
+ * Single SQL: `contact_user_links ⋈ principal ON principal.user_id = link.user_id`.
+ * Both sides are indexed (`contact_user_links_user_idx`, `principal.user_id`).
+ */
+export async function resolvePrincipalsForContacts(
+  contactIds: ReadonlyArray<ContactId>
+): Promise<PrincipalId[]> {
+  if (contactIds.length === 0) return []
+  const rows = await db
+    .selectDistinct({ id: principal.id })
+    .from(contactUserLinks)
+    .innerJoin(principal, eq(principal.userId, contactUserLinks.userId))
+    .where(inArray(contactUserLinks.contactId, contactIds as ContactId[]))
+  return rows.map((r) => r.id as PrincipalId)
+}
+
+/**
+ * Resolve the additional portal-linked recipient set for a ticket.
+ *
+ * Inputs (read once):
+ *   - `ticket.requesterContactId`
+ *   - `ticket_participants` rows for this ticket (both principalId and contactId variants)
+ *
+ * Output:
+ *   - `principalIds` = (participants.principalId ∪ resolvePrincipalsForContacts(requesterContactId ∪ participants.contactId))
+ *   - `portalLinked` = principals reached only via the contact-link branch.
+ *     Direct-`principalId` participants are NOT marked as portal-linked, even
+ *     if they happen to be portal users — they're already addressable by RBAC.
+ */
+export async function resolvePortalLinkedRecipients(
+  ticket: Pick<Ticket, 'id' | 'requesterContactId'>
+): Promise<PortalLinkedRecipients> {
+  const participants = await db
+    .select({
+      principalId: ticketParticipants.principalId,
+      contactId: ticketParticipants.contactId,
+    })
+    .from(ticketParticipants)
+    .where(eq(ticketParticipants.ticketId, ticket.id as TicketId))
+
+  const directPrincipalIds = new Set<PrincipalId>()
+  const contactIdSet = new Set<ContactId>()
+  if (ticket.requesterContactId) contactIdSet.add(ticket.requesterContactId as ContactId)
+  for (const p of participants) {
+    if (p.principalId) directPrincipalIds.add(p.principalId as PrincipalId)
+    if (p.contactId) contactIdSet.add(p.contactId as ContactId)
+  }
+
+  const linkedPrincipalIds =
+    contactIdSet.size > 0 ? await resolvePrincipalsForContacts(Array.from(contactIdSet)) : []
+
+  const portalLinked = new Set<PrincipalId>()
+  for (const id of linkedPrincipalIds) {
+    // Only mark as portal-linked if the principal isn't already a direct
+    // participant (direct participants are addressable by RBAC).
+    if (!directPrincipalIds.has(id)) portalLinked.add(id)
+  }
+
+  const all = new Set<PrincipalId>(directPrincipalIds)
+  for (const id of linkedPrincipalIds) all.add(id)
+
+  return { principalIds: Array.from(all), portalLinked }
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.service.ts b/apps/web/src/lib/server/domains/tickets/ticket.service.ts
new file mode 100644
index 000000000..45b169e2f
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.service.ts
@@ -0,0 +1,870 @@
+/**
+ * Ticket service — header-level CRUD plus status / assignment transitions.
+ *
+ * Optimistic concurrency: every mutation accepts an `expectedUpdatedAt` and
+ * fails with `ConflictError` if the row was changed in the meantime. This is
+ * enough for the ticket detail UI without paying for a separate `version` int.
+ *
+ * Every meaningful state change writes a `ticket_activity` row inside the
+ * same transaction so the timeline is consistent with the ticket header.
+ * Workspace-wide audit (`recordEvent`) is best-effort and happens after.
+ */
+import {
+  db,
+  eq,
+  and,
+  isNull,
+  inArray,
+  tickets,
+  ticketStatuses,
+  ticketActivity,
+  principal,
+  user,
+  type Ticket,
+  type TicketActivity,
+} from '@/lib/server/db'
+import type {
+  TicketId,
+  TicketStatusId,
+  PrincipalId,
+  UserId,
+  TeamId,
+  ContactId,
+  OrganizationId,
+  InboxId,
+  SlaPolicyId,
+  WidgetProfileId,
+} from '@quackback/ids'
+import { ConflictError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { recordEvent } from '../audit'
+import { sanitizeTiptapContent } from '@/lib/server/sanitize-tiptap'
+import { tiptapToPlainText } from './tiptap-text'
+import {
+  TICKET_PRIORITIES,
+  TICKET_CHANNELS,
+  TICKET_VISIBILITY_SCOPES,
+  type TicketPriority,
+  type TicketChannel,
+  type TicketVisibilityScope,
+  type TicketStatusCategory,
+  type TiptapContent,
+  type AuditDiff,
+  type AuditJsonValue,
+} from '@/lib/server/db'
+
+const SUBJECT_MAX = 500
+
+export interface CreateTicketInput {
+  subject: string
+  descriptionJson?: TiptapContent | null
+  descriptionText?: string | null
+  priority?: TicketPriority
+  channel?: TicketChannel
+  visibilityScope?: TicketVisibilityScope
+  statusId?: TicketStatusId | null
+  primaryTeamId?: TeamId | null
+  assigneePrincipalId?: PrincipalId | null
+  assigneeTeamId?: TeamId | null
+  requesterPrincipalId?: PrincipalId | null
+  requesterContactId?: ContactId | null
+  organizationId?: OrganizationId | null
+  /** Inbox the ticket should belong to (Phase 4). When omitted, the routing engine fills this in. */
+  inboxId?: InboxId | null
+  /** Resolved embedded widget profile that created the ticket, if any. */
+  sourceWidgetProfileId?: WidgetProfileId | null
+  /** SLA policy bound at ticket creation (Phase 5). When omitted, the engine selects via scope precedence. */
+  slaPolicyId?: SlaPolicyId | null
+  createdByPrincipalId?: PrincipalId | null
+  /** Set by integration inbound handlers to prevent echo loops in the event dispatcher. */
+  syncSourceIntegrationId?: string | null
+}
+
+function validateSubject(subject: string): string {
+  const trimmed = subject?.trim()
+  if (!trimmed) throw new ValidationError('TICKET_SUBJECT_REQUIRED', 'subject is required')
+  if (trimmed.length > SUBJECT_MAX) {
+    throw new ValidationError('TICKET_SUBJECT_TOO_LONG', `subject exceeds ${SUBJECT_MAX} chars`)
+  }
+  return trimmed
+}
+
+async function resolveDefaultStatus(): Promise<{
+  id: TicketStatusId
+  category: TicketStatusCategory
+}> {
+  const row = await db.query.ticketStatuses.findFirst({
+    where: and(eq(ticketStatuses.isDefault, true), isNull(ticketStatuses.deletedAt)),
+  })
+  if (!row) {
+    throw new ValidationError(
+      'TICKET_NO_DEFAULT_STATUS',
+      'No default ticket status configured; create one or pass statusId explicitly.'
+    )
+  }
+  return { id: row.id as TicketStatusId, category: row.category as TicketStatusCategory }
+}
+
+async function resolveStatus(
+  statusId: TicketStatusId
+): Promise<{ id: TicketStatusId; category: TicketStatusCategory }> {
+  const row = await db.query.ticketStatuses.findFirst({
+    where: eq(ticketStatuses.id, statusId),
+  })
+  if (!row) throw new NotFoundError('TICKET_STATUS_NOT_FOUND', `status ${statusId} not found`)
+  return { id: row.id as TicketStatusId, category: row.category as TicketStatusCategory }
+}
+
+async function resolveRequesterContactId(
+  requesterPrincipalId: PrincipalId | null | undefined
+): Promise<ContactId | null> {
+  if (!requesterPrincipalId) return null
+
+  const principalRow = await db.query.principal.findFirst({
+    where: eq(principal.id, requesterPrincipalId),
+    columns: { userId: true, type: true },
+  })
+  if (!principalRow?.userId || principalRow.type !== 'user') return null
+
+  const { findOrCreateByEmail, linkContactToUser, listLinksForUser } =
+    await import('../organizations/contact.service')
+
+  const existingLinks = await listLinksForUser(principalRow.userId as UserId)
+  if (existingLinks[0]) return existingLinks[0].contactId as ContactId
+
+  const userRow = await db.query.user.findFirst({
+    where: eq(user.id, principalRow.userId as UserId),
+    columns: { email: true, emailVerified: true },
+  })
+  if (!userRow?.email || !userRow.emailVerified) return null
+
+  const contact = await findOrCreateByEmail({ email: userRow.email })
+  await linkContactToUser({
+    contactId: contact.id as ContactId,
+    userId: principalRow.userId as UserId,
+    linkedByPrincipalId: null,
+  })
+  return contact.id as ContactId
+}
+
+async function resolveTicketCustomerContext(
+  input: Pick<CreateTicketInput, 'requesterPrincipalId' | 'requesterContactId' | 'organizationId'>
+): Promise<{
+  requesterContactId: ContactId | null
+  organizationId: OrganizationId | null
+}> {
+  const requesterContactId =
+    input.requesterContactId !== undefined
+      ? input.requesterContactId
+      : await resolveRequesterContactId(input.requesterPrincipalId)
+
+  if (input.organizationId !== undefined) {
+    return {
+      requesterContactId: requesterContactId ?? null,
+      organizationId: input.organizationId,
+    }
+  }
+
+  if (!requesterContactId) {
+    return { requesterContactId: null, organizationId: null }
+  }
+
+  const { getContact } = await import('../organizations/contact.service')
+  const contact = await getContact(requesterContactId)
+  return {
+    requesterContactId,
+    organizationId: (contact?.organizationId as OrganizationId | null | undefined) ?? null,
+  }
+}
+
+export async function createTicket(input: CreateTicketInput): Promise<Ticket> {
+  const subject = validateSubject(input.subject)
+  if (input.priority && !TICKET_PRIORITIES.includes(input.priority)) {
+    throw new ValidationError('TICKET_PRIORITY_INVALID', 'invalid priority')
+  }
+  if (input.channel && !TICKET_CHANNELS.includes(input.channel)) {
+    throw new ValidationError('TICKET_CHANNEL_INVALID', 'invalid channel')
+  }
+  if (input.visibilityScope && !TICKET_VISIBILITY_SCOPES.includes(input.visibilityScope)) {
+    throw new ValidationError('TICKET_VISIBILITY_INVALID', 'invalid visibilityScope')
+  }
+
+  const status = input.statusId ? await resolveStatus(input.statusId) : await resolveDefaultStatus()
+
+  const sanitizedJson = input.descriptionJson ? sanitizeTiptapContent(input.descriptionJson) : null
+  const descriptionText =
+    input.descriptionText?.trim() ||
+    (sanitizedJson ? tiptapToPlainText(sanitizedJson) : null) ||
+    null
+
+  // Phase 4: route the ticket if no inboxId was supplied. Routing failure is
+  // non-fatal — we proceed with the explicit inputs.
+  let routingDecision: import('../inboxes/routing.types').RoutingDecision | null = null
+  if (input.inboxId == null) {
+    try {
+      const { route } = await import('../inboxes/routing.engine')
+      routingDecision = await route({
+        subject,
+        descriptionText,
+        channel: input.channel ?? 'api',
+        priority: input.priority,
+        candidateInboxId: null,
+      })
+    } catch {
+      routingDecision = null
+    }
+  }
+
+  const resolvedInboxId = input.inboxId ?? (routingDecision?.inboxId as InboxId | undefined) ?? null
+  const resolvedPrimaryTeamId =
+    input.primaryTeamId ?? (routingDecision?.primaryTeamId as TeamId | undefined) ?? null
+  const resolvedAssigneePrincipalId =
+    input.assigneePrincipalId ??
+    (routingDecision?.assigneePrincipalId as PrincipalId | undefined) ??
+    null
+  const resolvedAssigneeTeamId =
+    input.assigneeTeamId ?? (routingDecision?.assigneeTeamId as TeamId | undefined) ?? null
+  const resolvedPriority =
+    input.priority ?? (routingDecision?.priority as TicketPriority | undefined) ?? 'normal'
+  const resolvedVisibility =
+    input.visibilityScope ??
+    (routingDecision?.visibilityScope as TicketVisibilityScope | undefined) ??
+    'team'
+
+  let customerContext = {
+    requesterContactId: input.requesterContactId ?? null,
+    organizationId: input.organizationId ?? null,
+  }
+  try {
+    customerContext = await resolveTicketCustomerContext(input)
+  } catch (err) {
+    console.warn('[tickets] resolveTicketCustomerContext failed', {
+      requesterPrincipalId: input.requesterPrincipalId ?? null,
+      requesterContactId: input.requesterContactId ?? null,
+      error: err instanceof Error ? err.message : err,
+    })
+  }
+
+  const now = new Date()
+  const [created] = await db
+    .insert(tickets)
+    .values({
+      subject,
+      descriptionJson: sanitizedJson,
+      descriptionText,
+      priority: resolvedPriority,
+      channel: input.channel ?? 'api',
+      visibilityScope: resolvedVisibility,
+      statusId: status.id,
+      primaryTeamId: resolvedPrimaryTeamId,
+      assigneePrincipalId: resolvedAssigneePrincipalId,
+      assigneeTeamId: resolvedAssigneeTeamId,
+      requesterPrincipalId: input.requesterPrincipalId ?? null,
+      requesterContactId: customerContext.requesterContactId,
+      organizationId: customerContext.organizationId,
+      inboxId: resolvedInboxId,
+      sourceWidgetProfileId: input.sourceWidgetProfileId ?? null,
+      slaPolicyId: input.slaPolicyId ?? null,
+      createdByPrincipalId: input.createdByPrincipalId ?? null,
+      lastActivityAt: now,
+    })
+    .returning()
+
+  await writeActivity(
+    created.id as TicketId,
+    input.createdByPrincipalId ?? null,
+    'ticket.created',
+    {
+      statusCategory: status.category,
+      channel: input.channel ?? 'api',
+      priority: input.priority ?? 'normal',
+      sourceWidgetProfileId: input.sourceWidgetProfileId ?? null,
+    }
+  )
+  if (routingDecision && (routingDecision.matchedRuleId || routingDecision.inboxId)) {
+    await writeActivity(
+      created.id as TicketId,
+      input.createdByPrincipalId ?? null,
+      'ticket.routed',
+      {
+        ruleId: routingDecision.matchedRuleId ?? null,
+        inboxId: (routingDecision.inboxId as string | null | undefined) ?? null,
+        primaryTeamId: (routingDecision.primaryTeamId as string | null | undefined) ?? null,
+        assigneePrincipalId:
+          (routingDecision.assigneePrincipalId as string | null | undefined) ?? null,
+      }
+    )
+    if (routingDecision.matchedRuleId) {
+      try {
+        const { bumpMatchStats } = await import('../inboxes/routing.service')
+        await bumpMatchStats(routingDecision.matchedRuleId as never)
+      } catch {
+        // best-effort
+      }
+    }
+  }
+  void recordEvent({
+    principalId: input.createdByPrincipalId ?? null,
+    action: 'ticket.created',
+    targetType: 'ticket',
+    targetId: created.id,
+    diff: {
+      context: { subject, statusId: status.id, priority: input.priority ?? 'normal' },
+    },
+  })
+
+  // Phase 5: SLA policy assignment + clock attachment. Best-effort; never fails creation.
+  try {
+    const { attachClocksOnCreate } = await import('../sla/sla.engine')
+    await attachClocksOnCreate(created, input.createdByPrincipalId ?? null)
+  } catch (err) {
+    console.warn('[tickets] attachClocksOnCreate failed', err)
+  }
+
+  // Phase 7: auto-subscribe + dispatch ticket.created notification.
+  try {
+    const { safeSubscribe } = await import('./ticket.subscriptions')
+    if (input.requesterPrincipalId) {
+      await safeSubscribe({
+        ticketId: created.id as TicketId,
+        principalId: input.requesterPrincipalId,
+        source: 'manual',
+      })
+    }
+    if (resolvedAssigneePrincipalId) {
+      await safeSubscribe({
+        ticketId: created.id as TicketId,
+        principalId: resolvedAssigneePrincipalId,
+        source: 'auto_assigned',
+      })
+    }
+    const { notifyTicketCreated } = await import('./ticket.notifications')
+    await notifyTicketCreated(created, { actorPrincipalId: input.createdByPrincipalId ?? null })
+  } catch (err) {
+    console.warn('[tickets] notifyTicketCreated failed', err)
+  }
+
+  // Phase 7.5: outbound webhook event.
+  try {
+    const { dispatchTicketCreated, buildEventActor } = await import('@/lib/server/events/dispatch')
+    const actor = input.createdByPrincipalId
+      ? buildEventActor({ principalId: input.createdByPrincipalId, displayName: 'ticket-system' })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    await dispatchTicketCreated(actor, created as unknown as Record<string, unknown>, {
+      syncSourceIntegrationId: input.syncSourceIntegrationId,
+    })
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketCreated failed', err)
+  }
+
+  return created
+}
+
+export async function getTicket(ticketId: TicketId): Promise<Ticket | null> {
+  const row = await db.query.tickets.findFirst({
+    where: and(eq(tickets.id, ticketId), isNull(tickets.deletedAt)),
+  })
+  return row ?? null
+}
+
+export interface UpdateTicketInput {
+  expectedUpdatedAt: Date
+  actorPrincipalId: PrincipalId | null
+  subject?: string
+  descriptionJson?: TiptapContent | null
+  descriptionText?: string | null
+  priority?: TicketPriority
+  visibilityScope?: TicketVisibilityScope
+  primaryTeamId?: TeamId | null
+  organizationId?: OrganizationId | null
+  requesterContactId?: ContactId | null
+  inboxId?: InboxId | null
+  /** Set by integration inbound handlers to prevent echo loops. */
+  syncSourceIntegrationId?: string | null
+  /** Allow field-level ticket edits to merge over unrelated freshness drift. */
+  allowStaleFieldUpdate?: boolean
+}
+
+export async function updateTicket(ticketId: TicketId, input: UpdateTicketInput): Promise<Ticket> {
+  let existing = await getTicket(ticketId)
+  if (!existing) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  const stale = existing.updatedAt.getTime() !== input.expectedUpdatedAt.getTime()
+  if (stale && !canMergeStaleFieldUpdate(input)) {
+    ensureFresh(existing.updatedAt, input.expectedUpdatedAt)
+  }
+
+  if (stale) {
+    const latest = await getTicket(ticketId)
+    if (!latest) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+    existing = latest
+  }
+
+  const patch: Partial<typeof existing> = {}
+  const diff: Record<string, { from: unknown; to: unknown }> = {}
+
+  if (input.subject !== undefined) {
+    const next = validateSubject(input.subject)
+    if (next !== existing.subject) {
+      patch.subject = next
+      diff.subject = { from: existing.subject, to: next }
+    }
+  }
+  if (input.descriptionJson !== undefined) {
+    patch.descriptionJson = input.descriptionJson
+    diff.descriptionJson = { from: '[rich-text]', to: '[rich-text]' }
+  }
+  if (input.descriptionText !== undefined) {
+    patch.descriptionText = input.descriptionText
+    diff.descriptionText = { from: existing.descriptionText, to: input.descriptionText }
+  }
+  if (input.priority !== undefined && input.priority !== existing.priority) {
+    if (!TICKET_PRIORITIES.includes(input.priority)) {
+      throw new ValidationError('TICKET_PRIORITY_INVALID', 'invalid priority')
+    }
+    patch.priority = input.priority
+    diff.priority = { from: existing.priority, to: input.priority }
+  }
+  if (input.visibilityScope !== undefined && input.visibilityScope !== existing.visibilityScope) {
+    if (!TICKET_VISIBILITY_SCOPES.includes(input.visibilityScope)) {
+      throw new ValidationError('TICKET_VISIBILITY_INVALID', 'invalid visibilityScope')
+    }
+    patch.visibilityScope = input.visibilityScope
+    diff.visibilityScope = { from: existing.visibilityScope, to: input.visibilityScope }
+  }
+  if (input.primaryTeamId !== undefined && input.primaryTeamId !== existing.primaryTeamId) {
+    patch.primaryTeamId = input.primaryTeamId
+    diff.primaryTeamId = { from: existing.primaryTeamId, to: input.primaryTeamId }
+  }
+  if (input.organizationId !== undefined && input.organizationId !== existing.organizationId) {
+    patch.organizationId = input.organizationId
+    diff.organizationId = { from: existing.organizationId, to: input.organizationId }
+  }
+  if (
+    input.requesterContactId !== undefined &&
+    input.requesterContactId !== existing.requesterContactId
+  ) {
+    patch.requesterContactId = input.requesterContactId
+    diff.requesterContactId = { from: existing.requesterContactId, to: input.requesterContactId }
+  }
+  if (input.inboxId !== undefined && input.inboxId !== existing.inboxId) {
+    patch.inboxId = input.inboxId
+    diff.inboxId = { from: existing.inboxId, to: input.inboxId }
+  }
+
+  if (Object.keys(patch).length === 0) return existing
+
+  patch.lastActivityAt = new Date()
+  const mergeStaleFieldUpdate = canMergeStaleFieldUpdate(input)
+  const [updated] = await db
+    .update(tickets)
+    .set(patch)
+    .where(
+      mergeStaleFieldUpdate
+        ? and(eq(tickets.id, ticketId), isNull(tickets.deletedAt))
+        : and(eq(tickets.id, ticketId), eq(tickets.updatedAt, existing.updatedAt))
+    )
+    .returning()
+
+  if (!updated) {
+    throw new ConflictError('TICKET_STALE', 'ticket was modified concurrently')
+  }
+  await writeActivity(ticketId, input.actorPrincipalId, 'ticket.updated', { diff })
+  void recordEvent({
+    principalId: input.actorPrincipalId,
+    action: 'ticket.updated',
+    targetType: 'ticket',
+    targetId: ticketId,
+    diff: diffToAuditDiff(diff),
+  })
+  try {
+    const { dispatchTicketUpdated, buildEventActor } = await import('@/lib/server/events/dispatch')
+    const actor = input.actorPrincipalId
+      ? buildEventActor({ principalId: input.actorPrincipalId, displayName: 'ticket-system' })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    await dispatchTicketUpdated(
+      actor,
+      updated as unknown as Record<string, unknown>,
+      Object.keys(diff),
+      diff,
+      { syncSourceIntegrationId: input.syncSourceIntegrationId }
+    )
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketUpdated failed', err)
+  }
+  return updated
+}
+
+export interface AssignTicketInput {
+  expectedUpdatedAt: Date
+  actorPrincipalId: PrincipalId | null
+  assigneePrincipalId?: PrincipalId | null
+  assigneeTeamId?: TeamId | null
+  /** Set by integration inbound handlers to prevent echo loops. */
+  syncSourceIntegrationId?: string | null
+}
+
+export async function assignTicket(ticketId: TicketId, input: AssignTicketInput): Promise<Ticket> {
+  const existing = await getTicket(ticketId)
+  if (!existing) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  ensureFresh(existing.updatedAt, input.expectedUpdatedAt)
+
+  const nextPrincipalId =
+    input.assigneePrincipalId === undefined
+      ? existing.assigneePrincipalId
+      : input.assigneePrincipalId
+  const nextTeamId =
+    input.assigneeTeamId === undefined ? existing.assigneeTeamId : input.assigneeTeamId
+
+  const noChange =
+    nextPrincipalId === existing.assigneePrincipalId && nextTeamId === existing.assigneeTeamId
+  if (noChange) return existing
+
+  const [updated] = await db
+    .update(tickets)
+    .set({
+      assigneePrincipalId: nextPrincipalId,
+      assigneeTeamId: nextTeamId,
+      lastActivityAt: new Date(),
+    })
+    .where(and(eq(tickets.id, ticketId), eq(tickets.updatedAt, existing.updatedAt)))
+    .returning()
+  if (!updated) throw new ConflictError('TICKET_STALE', 'ticket was modified concurrently')
+
+  const activityType =
+    nextPrincipalId == null && nextTeamId == null ? 'ticket.unassigned' : 'ticket.assigned'
+  await writeActivity(ticketId, input.actorPrincipalId, activityType, {
+    from: {
+      principalId: existing.assigneePrincipalId,
+      teamId: existing.assigneeTeamId,
+    },
+    to: { principalId: nextPrincipalId, teamId: nextTeamId },
+  })
+  void recordEvent({
+    principalId: input.actorPrincipalId,
+    action: activityType,
+    targetType: 'ticket',
+    targetId: ticketId,
+    diff: {
+      before: {
+        assigneePrincipalId: existing.assigneePrincipalId,
+        assigneeTeamId: existing.assigneeTeamId,
+      },
+      after: {
+        assigneePrincipalId: nextPrincipalId,
+        assigneeTeamId: nextTeamId,
+      },
+    },
+  })
+
+  // Phase 7: auto-subscribe new assignee + dispatch notification.
+  try {
+    const { safeSubscribe } = await import('./ticket.subscriptions')
+    if (nextPrincipalId) {
+      await safeSubscribe({
+        ticketId,
+        principalId: nextPrincipalId,
+        source: 'auto_assigned',
+      })
+    }
+    const { notifyTicketAssigned } = await import('./ticket.notifications')
+    await notifyTicketAssigned(updated, existing.assigneePrincipalId as PrincipalId | null, {
+      actorPrincipalId: input.actorPrincipalId,
+    })
+  } catch (err) {
+    console.warn('[tickets] notifyTicketAssigned failed', err)
+  }
+
+  // Phase 7.5: outbound webhook events. Emit ticket.assigned when there is
+  // a new assignee; emit ticket.unassigned when the previous assignee was
+  // cleared (or replaced).
+  try {
+    const { dispatchTicketAssigned, dispatchTicketUnassigned, buildEventActor } =
+      await import('@/lib/server/events/dispatch')
+    const actor = input.actorPrincipalId
+      ? buildEventActor({ principalId: input.actorPrincipalId, displayName: 'ticket-system' })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    const prev = (existing.assigneePrincipalId as PrincipalId | null) ?? null
+    const next = (updated.assigneePrincipalId as PrincipalId | null) ?? null
+    if (next) {
+      await dispatchTicketAssigned(
+        actor,
+        updated as unknown as Record<string, unknown>,
+        prev,
+        next,
+        { syncSourceIntegrationId: input.syncSourceIntegrationId }
+      )
+    }
+    if (prev && prev !== next) {
+      await dispatchTicketUnassigned(actor, updated as unknown as Record<string, unknown>, prev, {
+        syncSourceIntegrationId: input.syncSourceIntegrationId,
+      })
+    }
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketAssigned/Unassigned failed', err)
+  }
+
+  return updated
+}
+
+export interface TransitionStatusInput {
+  expectedUpdatedAt: Date
+  actorPrincipalId: PrincipalId | null
+  statusId: TicketStatusId
+  /** Set by integration inbound handlers to prevent echo loops. */
+  syncSourceIntegrationId?: string | null
+}
+
+/**
+ * Move the ticket to a new status. Sets lifecycle timestamps based on the
+ * destination *category*, not its slug — so workspaces can rename statuses
+ * without breaking SLA / reporting later.
+ *
+ * Timestamp rules:
+ *   - resolved category  → set resolvedAt (clears reopenedAt unless still set)
+ *   - closed category    → set closedAt (and resolvedAt if not yet)
+ *   - any open/pending/on_hold from a resolved/closed → set reopenedAt + clear resolvedAt/closedAt
+ */
+export async function transitionStatus(
+  ticketId: TicketId,
+  input: TransitionStatusInput
+): Promise<Ticket> {
+  const existing = await getTicket(ticketId)
+  if (!existing) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  ensureFresh(existing.updatedAt, input.expectedUpdatedAt)
+  if (existing.statusId === input.statusId) return existing
+
+  const next = await resolveStatus(input.statusId)
+  const prevStatus = existing.statusId
+    ? await resolveStatus(existing.statusId as TicketStatusId)
+    : null
+
+  const now = new Date()
+  const patch: Partial<typeof existing> = {
+    statusId: next.id,
+    lastActivityAt: now,
+  }
+
+  const wasTerminal = prevStatus?.category === 'solved' || prevStatus?.category === 'closed'
+  const isTerminal = next.category === 'solved' || next.category === 'closed'
+
+  if (next.category === 'solved') {
+    patch.resolvedAt = existing.resolvedAt ?? now
+    patch.closedAt = null
+  } else if (next.category === 'closed') {
+    patch.resolvedAt = existing.resolvedAt ?? now
+    patch.closedAt = now
+  } else if (wasTerminal && !isTerminal) {
+    patch.reopenedAt = now
+    patch.resolvedAt = null
+    patch.closedAt = null
+  }
+
+  const [updated] = await db
+    .update(tickets)
+    .set(patch)
+    .where(and(eq(tickets.id, ticketId), eq(tickets.updatedAt, existing.updatedAt)))
+    .returning()
+  if (!updated) throw new ConflictError('TICKET_STALE', 'ticket was modified concurrently')
+
+  await writeActivity(ticketId, input.actorPrincipalId, 'ticket.status_changed', {
+    from: { statusId: existing.statusId, category: prevStatus?.category ?? null },
+    to: { statusId: next.id, category: next.category },
+  })
+  void recordEvent({
+    principalId: input.actorPrincipalId,
+    action: 'ticket.status_changed',
+    targetType: 'ticket',
+    targetId: ticketId,
+    diff: {
+      before: { statusId: existing.statusId },
+      after: { statusId: next.id },
+      context: { categoryFrom: prevStatus?.category ?? null, categoryTo: next.category },
+    },
+  })
+
+  // Phase 5: react to category transition for SLA pause/resume/met/cancel.
+  try {
+    const { onStatusTransition } = await import('../sla/sla.engine')
+    await onStatusTransition(
+      updated,
+      prevStatus?.category ?? null,
+      next.category,
+      input.actorPrincipalId
+    )
+  } catch (err) {
+    console.warn('[tickets] sla.onStatusTransition failed', err)
+  }
+
+  // Phase 7: dispatch ticket.status_changed notification.
+  try {
+    const { notifyTicketStatusChanged } = await import('./ticket.notifications')
+    await notifyTicketStatusChanged(updated, prevStatus?.category ?? null, next.category, {
+      actorPrincipalId: input.actorPrincipalId,
+    })
+  } catch (err) {
+    console.warn('[tickets] notifyTicketStatusChanged failed', err)
+  }
+
+  // Phase 7.5: outbound webhook event.
+  try {
+    const { dispatchTicketStatusChanged, buildEventActor } =
+      await import('@/lib/server/events/dispatch')
+    const actor = input.actorPrincipalId
+      ? buildEventActor({ principalId: input.actorPrincipalId, displayName: 'ticket-system' })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    await dispatchTicketStatusChanged(
+      actor,
+      updated as unknown as Record<string, unknown>,
+      prevStatus?.category ?? null,
+      next.category,
+      { syncSourceIntegrationId: input.syncSourceIntegrationId }
+    )
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketStatusChanged failed', err)
+  }
+
+  return updated
+}
+
+export async function softDeleteTicket(
+  ticketId: TicketId,
+  actorPrincipalId: PrincipalId | null
+): Promise<Ticket> {
+  const existing = await getTicket(ticketId)
+  if (!existing) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  const now = new Date()
+  const [updated] = await db
+    .update(tickets)
+    .set({
+      deletedAt: now,
+      deletedByPrincipalId: actorPrincipalId,
+      lastActivityAt: now,
+    })
+    .where(eq(tickets.id, ticketId))
+    .returning()
+  await writeActivity(ticketId, actorPrincipalId, 'ticket.deleted', {})
+  void recordEvent({
+    principalId: actorPrincipalId,
+    action: 'ticket.deleted',
+    targetType: 'ticket',
+    targetId: ticketId,
+  })
+  try {
+    const { dispatchTicketDeleted, buildEventActor } = await import('@/lib/server/events/dispatch')
+    const actor = actorPrincipalId
+      ? buildEventActor({ principalId: actorPrincipalId })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    await dispatchTicketDeleted(
+      actor,
+      updated as unknown as Record<string, unknown>,
+      actorPrincipalId
+    )
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketDeleted failed', err)
+  }
+  return updated
+}
+
+export async function restoreTicket(
+  ticketId: TicketId,
+  actorPrincipalId: PrincipalId | null
+): Promise<Ticket> {
+  const existing = await getTicket(ticketId)
+  if (!existing) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  if (!existing.deletedAt)
+    throw new NotFoundError('TICKET_NOT_DELETED', `ticket ${ticketId} is not deleted`)
+  const now = new Date()
+  const [updated] = await db
+    .update(tickets)
+    .set({
+      deletedAt: null,
+      deletedByPrincipalId: null,
+      lastActivityAt: now,
+    })
+    .where(eq(tickets.id, ticketId))
+    .returning()
+  await writeActivity(ticketId, actorPrincipalId, 'ticket.restored', {})
+  void recordEvent({
+    principalId: actorPrincipalId,
+    action: 'ticket.restored',
+    targetType: 'ticket',
+    targetId: ticketId,
+  })
+  try {
+    const { dispatchTicketRestored, buildEventActor } = await import('@/lib/server/events/dispatch')
+    const actor = actorPrincipalId
+      ? buildEventActor({ principalId: actorPrincipalId })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    await dispatchTicketRestored(
+      actor,
+      updated as unknown as Record<string, unknown>,
+      actorPrincipalId
+    )
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketRestored failed', err)
+  }
+  return updated
+}
+
+/** Note `bumpLastActivity` is intentionally separate from the activity row — */
+/* threads/participants/shares all bump it from their respective services. */
+export async function bumpLastActivity(ticketId: TicketId): Promise<void> {
+  await db.update(tickets).set({ lastActivityAt: new Date() }).where(eq(tickets.id, ticketId))
+}
+
+// ---------------------------------------------------------------------------
+// internal helpers
+// ---------------------------------------------------------------------------
+
+function ensureFresh(actualUpdatedAt: Date, expectedUpdatedAt: Date): void {
+  if (actualUpdatedAt.getTime() !== expectedUpdatedAt.getTime()) {
+    throw new ConflictError('TICKET_STALE', 'ticket was modified concurrently — refresh and retry')
+  }
+}
+
+function canMergeStaleFieldUpdate(input: UpdateTicketInput): boolean {
+  if (!input.allowStaleFieldUpdate) return false
+  return [
+    input.subject,
+    input.descriptionJson,
+    input.descriptionText,
+    input.priority,
+    input.visibilityScope,
+    input.primaryTeamId,
+    input.organizationId,
+    input.requesterContactId,
+    input.inboxId,
+  ].some((value) => value !== undefined)
+}
+
+/** Convert a `{ field: { from, to } }` shaped diff to the AuditDiff shape. */
+function diffToAuditDiff(diff: Record<string, { from: unknown; to: unknown }>): AuditDiff {
+  const before: Record<string, AuditJsonValue> = {}
+  const after: Record<string, AuditJsonValue> = {}
+  for (const [k, v] of Object.entries(diff)) {
+    before[k] = (v.from as AuditJsonValue) ?? null
+    after[k] = (v.to as AuditJsonValue) ?? null
+  }
+  return { before, after }
+}
+
+export async function writeActivity(
+  ticketId: TicketId,
+  principalId: PrincipalId | null,
+  type: string,
+  metadata: Record<string, unknown>
+): Promise<TicketActivity> {
+  const [row] = await db
+    .insert(ticketActivity)
+    .values({ ticketId, principalId, type, metadata })
+    .returning()
+  return row
+}
+
+/** Query helper used by both ticket-shares.service and queue listings. */
+export async function loadTicketsByIds(ids: readonly TicketId[]): Promise<Ticket[]> {
+  if (ids.length === 0) return []
+  return db
+    .select()
+    .from(tickets)
+    .where(and(inArray(tickets.id, ids as TicketId[]), isNull(tickets.deletedAt)))
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.share.ts b/apps/web/src/lib/server/domains/tickets/ticket.share.ts
new file mode 100644
index 000000000..e8755fd54
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.share.ts
@@ -0,0 +1,188 @@
+/**
+ * Cross-team share grants for tickets.
+ *
+ * Sharing is additive: a grant lets the target team's members view (and,
+ * depending on `accessLevel`, comment on or fully edit) a ticket they would
+ * otherwise not see. Grants are soft-revoked (`revokedAt`) so the audit trail
+ * remains intact.
+ *
+ * The unique partial index on (ticket_id, team_id) WHERE revoked_at IS NULL
+ * prevents duplicate active grants — re-sharing simply returns the existing
+ * row. Re-sharing after a revoke creates a brand-new grant.
+ */
+import {
+  db,
+  eq,
+  and,
+  isNull,
+  desc,
+  ticketShares,
+  tickets,
+  TICKET_SHARE_LEVELS,
+  type TicketShare,
+  type TicketShareLevel,
+} from '@/lib/server/db'
+import type { TicketId, TicketShareId, PrincipalId, TeamId } from '@quackback/ids'
+import { NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { recordEvent } from '../audit'
+import { writeActivity, bumpLastActivity } from './ticket.service'
+
+export interface ShareTicketInput {
+  ticketId: TicketId
+  teamId: TeamId
+  accessLevel?: TicketShareLevel
+  grantedByPrincipalId: PrincipalId | null
+}
+
+export async function shareTicketWithTeam(input: ShareTicketInput): Promise<TicketShare> {
+  if (input.accessLevel && !TICKET_SHARE_LEVELS.includes(input.accessLevel)) {
+    throw new ValidationError('TICKET_SHARE_LEVEL_INVALID', 'invalid accessLevel')
+  }
+  const ticket = await db.query.tickets.findFirst({
+    where: and(eq(tickets.id, input.ticketId), isNull(tickets.deletedAt)),
+  })
+  if (!ticket) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${input.ticketId} not found`)
+
+  // Sharing with the primary or assignee team is a no-op rather than an error.
+  const existing = await db.query.ticketShares.findFirst({
+    where: and(
+      eq(ticketShares.ticketId, input.ticketId),
+      eq(ticketShares.teamId, input.teamId),
+      isNull(ticketShares.revokedAt)
+    ),
+  })
+  if (existing) return existing
+
+  const [created] = await db
+    .insert(ticketShares)
+    .values({
+      ticketId: input.ticketId,
+      teamId: input.teamId,
+      accessLevel: input.accessLevel ?? 'read',
+      grantedByPrincipalId: input.grantedByPrincipalId,
+    })
+    .returning()
+
+  await bumpLastActivity(input.ticketId)
+  await writeActivity(input.ticketId, input.grantedByPrincipalId, 'ticket.shared', {
+    shareId: created.id,
+    teamId: input.teamId,
+    accessLevel: created.accessLevel,
+  })
+  void recordEvent({
+    principalId: input.grantedByPrincipalId,
+    action: 'ticket.shared',
+    targetType: 'ticket',
+    targetId: input.ticketId,
+    diff: { context: { teamId: input.teamId, accessLevel: created.accessLevel } },
+  })
+
+  // Phase 7: dispatch ticket.shared notification (lazy team expansion).
+  try {
+    const { notifyTicketShared } = await import('./ticket.notifications')
+    await notifyTicketShared(ticket, input.teamId, {
+      actorPrincipalId: input.grantedByPrincipalId,
+    })
+  } catch (err) {
+    console.warn('[tickets] notifyTicketShared failed', err)
+  }
+
+  // Phase 7.5: outbound webhook event.
+  try {
+    const { dispatchTicketShared, buildEventActor } = await import('@/lib/server/events/dispatch')
+    const actor = input.grantedByPrincipalId
+      ? buildEventActor({
+          principalId: input.grantedByPrincipalId,
+          displayName: 'ticket-system',
+        })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    await dispatchTicketShared(
+      actor,
+      ticket as unknown as Record<string, unknown>,
+      input.teamId as string,
+      (created.accessLevel as string | null) ?? null
+    )
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketShared failed', err)
+  }
+
+  return created
+}
+
+export async function revokeShare(
+  shareId: TicketShareId,
+  actorPrincipalId: PrincipalId | null
+): Promise<TicketShare> {
+  const existing = await db.query.ticketShares.findFirst({
+    where: eq(ticketShares.id, shareId),
+  })
+  if (!existing) throw new NotFoundError('TICKET_SHARE_NOT_FOUND', `share ${shareId} not found`)
+  if (existing.revokedAt) {
+    // Idempotent revoke
+    return existing
+  }
+  const now = new Date()
+  const [updated] = await db
+    .update(ticketShares)
+    .set({ revokedAt: now, revokedByPrincipalId: actorPrincipalId })
+    .where(eq(ticketShares.id, shareId))
+    .returning()
+  await bumpLastActivity(existing.ticketId as TicketId)
+  await writeActivity(existing.ticketId as TicketId, actorPrincipalId, 'ticket.unshared', {
+    shareId,
+    teamId: existing.teamId,
+  })
+  void recordEvent({
+    principalId: actorPrincipalId,
+    action: 'ticket.unshared',
+    targetType: 'ticket',
+    targetId: existing.ticketId,
+    diff: { context: { shareId, teamId: existing.teamId } },
+  })
+
+  // Phase 7: dispatch ticket.unshared notification.
+  try {
+    const ticket = await db.query.tickets.findFirst({
+      where: eq(tickets.id, existing.ticketId as TicketId),
+    })
+    if (ticket) {
+      const { notifyTicketUnshared } = await import('./ticket.notifications')
+      await notifyTicketUnshared(ticket, existing.teamId as TeamId, { actorPrincipalId })
+      // Phase 7.5: outbound webhook event.
+      try {
+        const { dispatchTicketUnshared, buildEventActor } =
+          await import('@/lib/server/events/dispatch')
+        const actor = actorPrincipalId
+          ? buildEventActor({ principalId: actorPrincipalId, displayName: 'ticket-system' })
+          : { type: 'service' as const, displayName: 'ticket-system' }
+        await dispatchTicketUnshared(
+          actor,
+          ticket as unknown as Record<string, unknown>,
+          existing.teamId as string
+        )
+      } catch (err) {
+        console.warn('[tickets] dispatchTicketUnshared failed', err)
+      }
+    }
+  } catch (err) {
+    console.warn('[tickets] notifyTicketUnshared failed', err)
+  }
+
+  return updated
+}
+
+export async function listSharesForTicket(ticketId: TicketId): Promise<TicketShare[]> {
+  return db
+    .select()
+    .from(ticketShares)
+    .where(and(eq(ticketShares.ticketId, ticketId), isNull(ticketShares.revokedAt)))
+    .orderBy(desc(ticketShares.createdAt))
+}
+
+export async function listTicketsSharedWithTeam(teamId: TeamId): Promise<TicketShare[]> {
+  return db
+    .select()
+    .from(ticketShares)
+    .where(and(eq(ticketShares.teamId, teamId), isNull(ticketShares.revokedAt)))
+    .orderBy(desc(ticketShares.createdAt))
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.subscriptions.ts b/apps/web/src/lib/server/domains/tickets/ticket.subscriptions.ts
new file mode 100644
index 000000000..77fbf4c3c
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.subscriptions.ts
@@ -0,0 +1,386 @@
+/**
+ * Per-(ticket, principal) subscription service.
+ *
+ * Subscriptions drive the in-app notification dispatcher (`ticket.notifications`).
+ * A row is created automatically when the ticket lifecycle implies the
+ * principal "owns" it (assignee / requester / participant) and may also be
+ * created manually via the server-fns surface.
+ *
+ * Manual writes refuse to silently overwrite an `auto_*` source unless the
+ * caller passes `force: true`. This preserves user intent across automatic
+ * resubscribes (e.g. reassignment).
+ */
+
+import {
+  db,
+  eq,
+  and,
+  or,
+  inArray,
+  isNull,
+  gt,
+  lt,
+  desc,
+  sql,
+  ticketSubscriptions,
+  tickets,
+  type Transaction,
+} from '@/lib/server/db'
+import type { TicketId, PrincipalId, TicketSubscriptionId } from '@quackback/ids'
+import type { TicketSubscription } from '@/lib/shared/db-types'
+
+export type TicketSubscriptionSource =
+  | 'auto_assigned'
+  | 'auto_participant'
+  | 'auto_team_member'
+  | 'manual'
+
+const AUTO_SOURCES: ReadonlySet<TicketSubscriptionSource> = new Set([
+  'auto_assigned',
+  'auto_participant',
+  'auto_team_member',
+])
+
+export type TicketSubscriptionEvent =
+  | 'thread'
+  | 'properties'
+  | 'status'
+  | 'assignment'
+  | 'participants'
+  | 'shares'
+  | 'sla'
+
+export interface TicketSubscriptionPrefsPatch {
+  notifyThreads?: boolean
+  notifyProperties?: boolean
+  notifyStatus?: boolean
+  notifyAssignment?: boolean
+  notifyParticipants?: boolean
+  notifyShares?: boolean
+  notifySla?: boolean
+}
+
+export interface SubscribeToTicketInput {
+  ticketId: TicketId
+  principalId: PrincipalId
+  source: TicketSubscriptionSource
+  prefs?: TicketSubscriptionPrefsPatch
+}
+
+/**
+ * UPSERT a subscription. Auto sources only insert (never overwrite an existing
+ * row). Manual sources insert-or-update; manual writes can clear `mutedUntil`.
+ */
+export async function subscribeToTicket(
+  input: SubscribeToTicketInput,
+  tx?: Transaction
+): Promise<TicketSubscription> {
+  const executor = tx ?? db
+  const isAuto = AUTO_SOURCES.has(input.source)
+  const values = {
+    ticketId: input.ticketId,
+    principalId: input.principalId,
+    source: input.source,
+    notifyThreads: input.prefs?.notifyThreads ?? true,
+    notifyProperties: input.prefs?.notifyProperties ?? true,
+    notifyStatus: input.prefs?.notifyStatus ?? true,
+    notifyAssignment: input.prefs?.notifyAssignment ?? true,
+    notifyParticipants: input.prefs?.notifyParticipants ?? false,
+    notifyShares: input.prefs?.notifyShares ?? false,
+    notifySla: input.prefs?.notifySla ?? true,
+  }
+  if (isAuto) {
+    // Insert-only; if there is already a (manual or auto) row we keep it.
+    const [row] = await executor
+      .insert(ticketSubscriptions)
+      .values(values)
+      .onConflictDoNothing({
+        target: [ticketSubscriptions.ticketId, ticketSubscriptions.principalId],
+      })
+      .returning()
+    if (row) return row
+    const existing = await getSubscription(input.ticketId, input.principalId, executor)
+    if (!existing) {
+      throw new Error('subscribeToTicket: row vanished after onConflictDoNothing')
+    }
+    return existing
+  }
+
+  // Manual: replace prefs + clear mute window.
+  const [row] = await executor
+    .insert(ticketSubscriptions)
+    .values({ ...values, mutedUntil: null })
+    .onConflictDoUpdate({
+      target: [ticketSubscriptions.ticketId, ticketSubscriptions.principalId],
+      set: {
+        source: 'manual',
+        notifyThreads: values.notifyThreads,
+        notifyProperties: values.notifyProperties,
+        notifyStatus: values.notifyStatus,
+        notifyAssignment: values.notifyAssignment,
+        notifyParticipants: values.notifyParticipants,
+        notifyShares: values.notifyShares,
+        notifySla: values.notifySla,
+        mutedUntil: null,
+        updatedAt: sql`now()`,
+      },
+    })
+    .returning()
+  return row
+}
+
+export async function unsubscribeFromTicket(
+  ticketId: TicketId,
+  principalId: PrincipalId,
+  tx?: Transaction
+): Promise<boolean> {
+  const executor = tx ?? db
+  const result = await executor
+    .delete(ticketSubscriptions)
+    .where(
+      and(
+        eq(ticketSubscriptions.ticketId, ticketId),
+        eq(ticketSubscriptions.principalId, principalId)
+      )
+    )
+    .returning({ id: ticketSubscriptions.id })
+  return result.length > 0
+}
+
+export interface UpdateSubscriptionPrefsInput {
+  ticketId: TicketId
+  principalId: PrincipalId
+  patch: TicketSubscriptionPrefsPatch
+  /** When false (default), refuses to overwrite an auto-sourced subscription. */
+  force?: boolean
+}
+
+/**
+ * Patch flags on an existing subscription. By default this refuses to mutate
+ * a row whose source is one of the `auto_*` values (the caller would lose
+ * the meaning of "I was auto-subscribed because I'm the assignee"). Pass
+ * `force: true` to upgrade the row to `source: 'manual'` while applying the patch.
+ */
+export async function updateSubscriptionPrefs(
+  input: UpdateSubscriptionPrefsInput,
+  tx?: Transaction
+): Promise<TicketSubscription | null> {
+  const executor = tx ?? db
+  const existing = await getSubscription(input.ticketId, input.principalId, executor)
+  if (!existing) return null
+  const isAuto = AUTO_SOURCES.has(existing.source as TicketSubscriptionSource)
+  if (isAuto && !input.force) return existing
+
+  const patch: Record<string, unknown> = { updatedAt: sql`now()` }
+  if (input.patch.notifyThreads !== undefined) patch.notifyThreads = input.patch.notifyThreads
+  if (input.patch.notifyProperties !== undefined)
+    patch.notifyProperties = input.patch.notifyProperties
+  if (input.patch.notifyStatus !== undefined) patch.notifyStatus = input.patch.notifyStatus
+  if (input.patch.notifyAssignment !== undefined)
+    patch.notifyAssignment = input.patch.notifyAssignment
+  if (input.patch.notifyParticipants !== undefined)
+    patch.notifyParticipants = input.patch.notifyParticipants
+  if (input.patch.notifyShares !== undefined) patch.notifyShares = input.patch.notifyShares
+  if (input.patch.notifySla !== undefined) patch.notifySla = input.patch.notifySla
+  if (input.force) patch.source = 'manual'
+
+  const [row] = await executor
+    .update(ticketSubscriptions)
+    .set(patch)
+    .where(eq(ticketSubscriptions.id, existing.id))
+    .returning()
+  return row ?? null
+}
+
+export async function muteTicket(
+  ticketId: TicketId,
+  principalId: PrincipalId,
+  until: Date | null,
+  tx?: Transaction
+): Promise<TicketSubscription | null> {
+  const executor = tx ?? db
+  const [row] = await executor
+    .update(ticketSubscriptions)
+    .set({ mutedUntil: until, updatedAt: sql`now()` })
+    .where(
+      and(
+        eq(ticketSubscriptions.ticketId, ticketId),
+        eq(ticketSubscriptions.principalId, principalId)
+      )
+    )
+    .returning()
+  return row ?? null
+}
+
+export async function unmuteTicket(
+  ticketId: TicketId,
+  principalId: PrincipalId,
+  tx?: Transaction
+): Promise<TicketSubscription | null> {
+  return muteTicket(ticketId, principalId, null, tx)
+}
+
+export async function getSubscription(
+  ticketId: TicketId,
+  principalId: PrincipalId,
+  executor: Transaction | typeof db = db
+): Promise<TicketSubscription | null> {
+  const [row] = await executor
+    .select()
+    .from(ticketSubscriptions)
+    .where(
+      and(
+        eq(ticketSubscriptions.ticketId, ticketId),
+        eq(ticketSubscriptions.principalId, principalId)
+      )
+    )
+    .limit(1)
+  return row ?? null
+}
+
+const EVENT_TO_FLAG = {
+  thread: ticketSubscriptions.notifyThreads,
+  properties: ticketSubscriptions.notifyProperties,
+  status: ticketSubscriptions.notifyStatus,
+  assignment: ticketSubscriptions.notifyAssignment,
+  participants: ticketSubscriptions.notifyParticipants,
+  shares: ticketSubscriptions.notifyShares,
+  sla: ticketSubscriptions.notifySla,
+} as const
+
+/**
+ * Resolve principal IDs subscribed to a given event-kind for a ticket,
+ * filtering out anyone whose mute window covers `now`.
+ */
+export async function getSubscribers(
+  ticketId: TicketId,
+  event: TicketSubscriptionEvent,
+  tx?: Transaction
+): Promise<PrincipalId[]> {
+  const executor = tx ?? db
+  const flagCol = EVENT_TO_FLAG[event]
+  const now = new Date()
+  const rows = await executor
+    .select({ principalId: ticketSubscriptions.principalId })
+    .from(ticketSubscriptions)
+    .where(
+      and(
+        eq(ticketSubscriptions.ticketId, ticketId),
+        eq(flagCol, true),
+        or(isNull(ticketSubscriptions.mutedUntil), lt(ticketSubscriptions.mutedUntil, now))
+      )
+    )
+  return rows.map((r) => r.principalId as PrincipalId)
+}
+
+export interface ListSubscriptionsForPrincipalOptions {
+  limit?: number
+  cursor?: { createdAt: Date; id: TicketSubscriptionId } | null
+}
+
+export async function listSubscriptionsForPrincipal(
+  principalId: PrincipalId,
+  options: ListSubscriptionsForPrincipalOptions = {}
+): Promise<TicketSubscription[]> {
+  const { limit = 50, cursor } = options
+  const conditions = [eq(ticketSubscriptions.principalId, principalId)]
+  if (cursor) {
+    conditions.push(
+      or(
+        lt(ticketSubscriptions.createdAt, cursor.createdAt),
+        and(
+          eq(ticketSubscriptions.createdAt, cursor.createdAt),
+          lt(ticketSubscriptions.id, cursor.id)
+        )
+      )!
+    )
+  }
+  return db
+    .select()
+    .from(ticketSubscriptions)
+    .where(and(...conditions))
+    .orderBy(desc(ticketSubscriptions.createdAt), desc(ticketSubscriptions.id))
+    .limit(limit)
+}
+
+export async function listSubscribersForTicket(ticketId: TicketId): Promise<TicketSubscription[]> {
+  return db
+    .select()
+    .from(ticketSubscriptions)
+    .where(eq(ticketSubscriptions.ticketId, ticketId))
+    .orderBy(desc(ticketSubscriptions.createdAt))
+}
+
+export interface TicketSubscriptionWithTicketRow extends TicketSubscription {
+  ticket: {
+    id: TicketId
+    subject: string
+    statusId: string | null
+    priority: string
+    channel: string
+    updatedAt: Date
+  }
+}
+
+export async function listSubscriptionsForPrincipalWithTickets(
+  principalId: PrincipalId,
+  options: ListSubscriptionsForPrincipalOptions = {}
+): Promise<TicketSubscriptionWithTicketRow[]> {
+  const { limit = 50, cursor } = options
+  const conditions = [eq(ticketSubscriptions.principalId, principalId)]
+  if (cursor) {
+    conditions.push(
+      or(
+        lt(ticketSubscriptions.createdAt, cursor.createdAt),
+        and(
+          eq(ticketSubscriptions.createdAt, cursor.createdAt),
+          lt(ticketSubscriptions.id, cursor.id)
+        )
+      )!
+    )
+  }
+  const rows = await db
+    .select({
+      sub: ticketSubscriptions,
+      ticket: {
+        id: tickets.id,
+        subject: tickets.subject,
+        statusId: tickets.statusId,
+        priority: tickets.priority,
+        channel: tickets.channel,
+        updatedAt: tickets.updatedAt,
+      },
+    })
+    .from(ticketSubscriptions)
+    .innerJoin(tickets, eq(ticketSubscriptions.ticketId, tickets.id))
+    .where(and(...conditions))
+    .orderBy(desc(ticketSubscriptions.createdAt), desc(ticketSubscriptions.id))
+    .limit(limit)
+  return rows.map((r) => ({
+    ...r.sub,
+    ticket: {
+      id: r.ticket.id as TicketId,
+      subject: r.ticket.subject,
+      statusId: r.ticket.statusId,
+      priority: r.ticket.priority,
+      channel: r.ticket.channel,
+      updatedAt: r.ticket.updatedAt,
+    },
+  }))
+}
+
+/**
+ * Best-effort wrapper around `subscribeToTicket` — never throws. Used from
+ * write paths where notification setup is incidental to the main operation.
+ */
+export async function safeSubscribe(input: SubscribeToTicketInput): Promise<void> {
+  try {
+    await subscribeToTicket(input)
+  } catch (err) {
+    console.warn('[tickets.subscriptions] safeSubscribe failed', err)
+  }
+}
+
+// Suppress unused-import warning for helpers exposed for downstream callers.
+void inArray
+void gt
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.take-return.ts b/apps/web/src/lib/server/domains/tickets/ticket.take-return.ts
new file mode 100644
index 000000000..c4c4ce1b9
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.take-return.ts
@@ -0,0 +1,34 @@
+/**
+ * Take/return convenience helpers — wrap assignTicket so the caller doesn't
+ * need to know the current updatedAt or fiddle with assignee fields.
+ */
+import { NotFoundError } from '@/lib/shared/errors'
+import type { TicketId, PrincipalId } from '@quackback/ids'
+import { assignTicket, getTicket } from './ticket.service'
+import type { Ticket } from '@/lib/server/db'
+
+export async function takeTicket(
+  ticketId: TicketId,
+  actorPrincipalId: PrincipalId
+): Promise<Ticket> {
+  const existing = await getTicket(ticketId)
+  if (!existing) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  return assignTicket(ticketId, {
+    expectedUpdatedAt: existing.updatedAt,
+    actorPrincipalId,
+    assigneePrincipalId: actorPrincipalId,
+  })
+}
+
+export async function returnTicket(
+  ticketId: TicketId,
+  actorPrincipalId: PrincipalId
+): Promise<Ticket> {
+  const existing = await getTicket(ticketId)
+  if (!existing) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  return assignTicket(ticketId, {
+    expectedUpdatedAt: existing.updatedAt,
+    actorPrincipalId,
+    assigneePrincipalId: null,
+  })
+}
diff --git a/apps/web/src/lib/server/domains/tickets/ticket.threads.ts b/apps/web/src/lib/server/domains/tickets/ticket.threads.ts
new file mode 100644
index 000000000..3de3434eb
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/ticket.threads.ts
@@ -0,0 +1,416 @@
+/**
+ * Ticket threads — public replies, internal comments, and shared-team notes.
+ *
+ * Audience semantics:
+ *   - `public`        visible to the requester / portal user; counts toward
+ *                     first-response time
+ *   - `internal`      agents only; never sent to the requester
+ *   - `shared_team`   visible only to members of the explicitly-shared team
+ *                     (uses `ticket_shares`)
+ *
+ * `firstResponseAt` is a one-shot side effect: the first PUBLIC thread by a
+ * principal who is *not* the requester sets it. Internal-only threads never
+ * trigger first-response tracking.
+ */
+import {
+  db,
+  eq,
+  and,
+  isNull,
+  asc,
+  inArray,
+  tickets,
+  ticketThreads,
+  ticketShares,
+  TICKET_THREAD_AUDIENCES,
+  type TicketThread,
+  type TicketThreadAudience,
+  type TiptapContent,
+} from '@/lib/server/db'
+import type { TicketId, TicketThreadId, PrincipalId, TeamId } from '@quackback/ids'
+import { ConflictError, ForbiddenError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { recordEvent } from '../audit'
+import { sanitizeTiptapContent } from '@/lib/server/sanitize-tiptap'
+import { tiptapToPlainText } from './tiptap-text'
+import { writeActivity } from './ticket.service'
+
+const BODY_TEXT_MAX = 100_000
+
+export interface AddThreadInput {
+  ticketId: TicketId
+  principalId: PrincipalId | null
+  audience: TicketThreadAudience
+  bodyJson?: TiptapContent | null
+  bodyText?: string | null
+  sharedWithTeamId?: TeamId | null
+  syncSourceIntegrationId?: string | null
+}
+
+function threadPreview(bodyText: string): { bodyTextPreview: string; bodyTextTruncated: boolean } {
+  const PREVIEW_MAX = 500
+  return {
+    bodyTextPreview: bodyText.length > PREVIEW_MAX ? bodyText.slice(0, PREVIEW_MAX) : bodyText,
+    bodyTextTruncated: bodyText.length > PREVIEW_MAX,
+  }
+}
+
+export async function addThread(input: AddThreadInput): Promise<TicketThread> {
+  if (!TICKET_THREAD_AUDIENCES.includes(input.audience)) {
+    throw new ValidationError('TICKET_THREAD_AUDIENCE_INVALID', 'invalid audience')
+  }
+  if (input.audience === 'shared_team' && !input.sharedWithTeamId) {
+    throw new ValidationError(
+      'TICKET_THREAD_SHARED_TEAM_REQUIRED',
+      'sharedWithTeamId is required for shared_team audience'
+    )
+  }
+  if (input.audience !== 'shared_team' && input.sharedWithTeamId) {
+    throw new ValidationError(
+      'TICKET_THREAD_SHARED_TEAM_NOT_ALLOWED',
+      'sharedWithTeamId only valid for shared_team audience'
+    )
+  }
+
+  const ticket = await db.query.tickets.findFirst({
+    where: and(eq(tickets.id, input.ticketId), isNull(tickets.deletedAt)),
+  })
+  if (!ticket) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${input.ticketId} not found`)
+
+  // For shared_team threads the team must actually have an active share grant.
+  if (input.audience === 'shared_team') {
+    const grant = await db.query.ticketShares.findFirst({
+      where: and(
+        eq(ticketShares.ticketId, input.ticketId),
+        eq(ticketShares.teamId, input.sharedWithTeamId!),
+        isNull(ticketShares.revokedAt)
+      ),
+    })
+    if (!grant) {
+      throw new ForbiddenError(
+        'TICKET_THREAD_SHARE_MISSING',
+        'cannot post a shared_team thread without an active share grant'
+      )
+    }
+  }
+
+  const sanitizedJson = input.bodyJson ? sanitizeTiptapContent(input.bodyJson) : null
+  const bodyText =
+    input.bodyText?.trim() || (sanitizedJson ? tiptapToPlainText(sanitizedJson) : '') || ''
+  if (!bodyText) {
+    throw new ValidationError('TICKET_THREAD_EMPTY', 'thread body cannot be empty')
+  }
+  if (bodyText.length > BODY_TEXT_MAX) {
+    throw new ValidationError('TICKET_THREAD_TOO_LONG', `thread exceeds ${BODY_TEXT_MAX} chars`)
+  }
+
+  const [created] = await db
+    .insert(ticketThreads)
+    .values({
+      ticketId: input.ticketId,
+      principalId: input.principalId,
+      audience: input.audience,
+      bodyJson: sanitizedJson,
+      bodyText,
+      sharedWithTeamId: input.sharedWithTeamId ?? null,
+    })
+    .returning()
+
+  // Maintain ticket header counters / first-response timestamp.
+  const now = new Date()
+  const headerPatch: Record<string, unknown> = { lastActivityAt: now }
+  const firstResponseFired =
+    input.audience === 'public' &&
+    !ticket.firstResponseAt &&
+    input.principalId !== null &&
+    input.principalId !== ticket.requesterPrincipalId
+  if (firstResponseFired) {
+    headerPatch.firstResponseAt = now
+  }
+  await db.update(tickets).set(headerPatch).where(eq(tickets.id, input.ticketId))
+
+  await writeActivity(input.ticketId, input.principalId, 'thread.added', {
+    threadId: created.id,
+    audience: input.audience,
+  })
+  void recordEvent({
+    principalId: input.principalId,
+    action: 'ticket.thread_added',
+    targetType: 'ticket',
+    targetId: input.ticketId,
+    diff: { context: { threadId: created.id, audience: input.audience } },
+  })
+
+  // Phase 5: SLA hooks for public threads. Best-effort.
+  if (input.audience === 'public') {
+    try {
+      const refreshedTicket = { ...ticket, ...headerPatch } as typeof ticket
+      const isFromCustomer =
+        input.principalId != null && input.principalId === ticket.requesterPrincipalId
+      if (isFromCustomer) {
+        const { onCustomerReply } = await import('../sla/sla.engine')
+        await onCustomerReply(refreshedTicket, input.principalId)
+      } else if (input.principalId) {
+        const { onPublicAgentReply } = await import('../sla/sla.engine')
+        await onPublicAgentReply(refreshedTicket, input.principalId)
+      }
+    } catch (err) {
+      console.warn('[tickets] sla thread hook failed', err)
+    }
+  }
+
+  // Phase 7: dispatch thread-added notification (audience-aware).
+  try {
+    const refreshedTicket = { ...ticket, ...headerPatch } as typeof ticket
+    const { notifyThreadAdded } = await import('./ticket.notifications')
+    await notifyThreadAdded(
+      refreshedTicket,
+      created.id,
+      input.audience,
+      input.sharedWithTeamId ?? null,
+      { actorPrincipalId: input.principalId }
+    )
+  } catch (err) {
+    console.warn('[tickets] notifyThreadAdded failed', err)
+  }
+
+  // Phase 7.5: outbound webhook event (internal threads are filtered out
+  // inside getWebhookTargets so they never leave the workspace).
+  try {
+    const refreshedTicket = { ...ticket, ...headerPatch } as typeof ticket
+    const { dispatchTicketThreadAdded, dispatchTicketFirstResponse, buildEventActor } =
+      await import('@/lib/server/events/dispatch')
+    const actor = input.principalId
+      ? buildEventActor({ principalId: input.principalId, displayName: 'ticket-system' })
+      : { type: 'service' as const, displayName: 'ticket-system' }
+    if (firstResponseFired) {
+      await dispatchTicketFirstResponse(
+        actor,
+        refreshedTicket as unknown as Record<string, unknown>,
+        created.id,
+        typeof now === 'string' ? now : now.toISOString(),
+        { syncSourceIntegrationId: input.syncSourceIntegrationId }
+      )
+    }
+    const isFromRequester =
+      input.principalId !== null && input.principalId === ticket.requesterPrincipalId
+    await dispatchTicketThreadAdded(
+      actor,
+      refreshedTicket as unknown as Record<string, unknown>,
+      created.id,
+      input.audience,
+      input.sharedWithTeamId ?? null,
+      {
+        ...threadPreview(bodyText),
+        bodyText,
+        authorPrincipalId: input.principalId,
+        isFromRequester,
+        createdAt: created.createdAt ?? now,
+      },
+      { syncSourceIntegrationId: input.syncSourceIntegrationId }
+    )
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketThreadAdded failed', err)
+  }
+
+  return created
+}
+
+export interface EditThreadInput {
+  threadId: TicketThreadId
+  actorPrincipalId: PrincipalId | null
+  bodyJson?: TiptapContent | null
+  bodyText?: string | null
+  syncSourceIntegrationId?: string | null
+}
+
+export async function editThread(input: EditThreadInput): Promise<TicketThread> {
+  const existing = await db.query.ticketThreads.findFirst({
+    where: eq(ticketThreads.id, input.threadId),
+  })
+  if (!existing || existing.deletedAt) {
+    throw new NotFoundError('TICKET_THREAD_NOT_FOUND', `thread ${input.threadId} not found`)
+  }
+  if (existing.principalId && existing.principalId !== input.actorPrincipalId) {
+    throw new ForbiddenError('TICKET_THREAD_NOT_OWNER', "cannot edit another user's thread")
+  }
+  const sanitizedJson = input.bodyJson ? sanitizeTiptapContent(input.bodyJson) : existing.bodyJson
+  const bodyText =
+    input.bodyText?.trim() ||
+    (sanitizedJson ? tiptapToPlainText(sanitizedJson) : '') ||
+    existing.bodyText
+  if (!bodyText) {
+    throw new ValidationError('TICKET_THREAD_EMPTY', 'thread body cannot be empty')
+  }
+  const [updated] = await db
+    .update(ticketThreads)
+    .set({
+      bodyJson: sanitizedJson,
+      bodyText,
+      editedAt: new Date(),
+      editedByPrincipalId: input.actorPrincipalId,
+    })
+    .where(eq(ticketThreads.id, input.threadId))
+    .returning()
+  await writeActivity(existing.ticketId as TicketId, input.actorPrincipalId, 'thread.edited', {
+    threadId: existing.id,
+  })
+  try {
+    const ticket = await db.query.tickets.findFirst({
+      where: and(eq(tickets.id, existing.ticketId as TicketId), isNull(tickets.deletedAt)),
+    })
+    if (ticket) {
+      const { dispatchTicketThreadUpdated, buildEventActor } =
+        await import('@/lib/server/events/dispatch')
+      const actor = input.actorPrincipalId
+        ? buildEventActor({
+            principalId: input.actorPrincipalId,
+            displayName: 'ticket-system',
+          })
+        : { type: 'service' as const, displayName: 'ticket-system' }
+      const isFromRequester =
+        existing.principalId !== null && existing.principalId === ticket.requesterPrincipalId
+      await dispatchTicketThreadUpdated(
+        actor,
+        ticket as unknown as Record<string, unknown>,
+        updated.id,
+        updated.audience,
+        (updated.sharedWithTeamId as TeamId | null) ?? null,
+        {
+          ...threadPreview(bodyText),
+          bodyText,
+          authorPrincipalId: (updated.principalId as PrincipalId | null) ?? null,
+          isFromRequester,
+          createdAt: updated.createdAt,
+          editedAt: updated.editedAt ?? null,
+        },
+        { syncSourceIntegrationId: input.syncSourceIntegrationId }
+      )
+    }
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketThreadUpdated failed', err)
+  }
+  return updated
+}
+
+export async function softDeleteThread(
+  threadId: TicketThreadId,
+  actorPrincipalId: PrincipalId | null,
+  syncSourceIntegrationId?: string | null
+): Promise<TicketThread> {
+  const existing = await db.query.ticketThreads.findFirst({
+    where: eq(ticketThreads.id, threadId),
+  })
+  if (!existing) throw new NotFoundError('TICKET_THREAD_NOT_FOUND', `thread ${threadId} not found`)
+  if (existing.deletedAt) {
+    throw new ConflictError('TICKET_THREAD_ALREADY_DELETED', 'thread already deleted')
+  }
+  const [updated] = await db
+    .update(ticketThreads)
+    .set({ deletedAt: new Date() })
+    .where(eq(ticketThreads.id, threadId))
+    .returning()
+  await writeActivity(existing.ticketId as TicketId, actorPrincipalId, 'thread.deleted', {
+    threadId: existing.id,
+  })
+  try {
+    const ticket = await db.query.tickets.findFirst({
+      where: and(eq(tickets.id, existing.ticketId as TicketId), isNull(tickets.deletedAt)),
+    })
+    if (ticket) {
+      const { dispatchTicketThreadDeleted, buildEventActor } =
+        await import('@/lib/server/events/dispatch')
+      const actor = actorPrincipalId
+        ? buildEventActor({ principalId: actorPrincipalId, displayName: 'ticket-system' })
+        : { type: 'service' as const, displayName: 'ticket-system' }
+      await dispatchTicketThreadDeleted(
+        actor,
+        ticket as unknown as Record<string, unknown>,
+        updated.id,
+        updated.audience,
+        (updated.sharedWithTeamId as TeamId | null) ?? null,
+        actorPrincipalId,
+        {
+          ...threadPreview(existing.bodyText ?? ''),
+          bodyText: existing.bodyText ?? '',
+          authorPrincipalId: (existing.principalId as PrincipalId | null) ?? null,
+          isFromRequester:
+            existing.principalId !== null && existing.principalId === ticket.requesterPrincipalId,
+          createdAt: existing.createdAt,
+        },
+        { syncSourceIntegrationId }
+      )
+    }
+  } catch (err) {
+    console.warn('[tickets] dispatchTicketThreadDeleted failed', err)
+  }
+  return updated
+}
+
+export interface ListThreadsOptions {
+  /** Caller's team memberships — used to filter shared_team audience rows. */
+  viewerTeamIds: readonly TeamId[]
+  /** True if the viewer can see internal comments. */
+  canSeeInternal: boolean
+  /** True if the viewer is the requester (sees public-only). */
+  isRequester?: boolean
+  includeDeleted?: boolean
+}
+
+export async function listThreads(
+  ticketId: TicketId,
+  options: ListThreadsOptions
+): Promise<TicketThread[]> {
+  const conditions = [eq(ticketThreads.ticketId, ticketId)]
+  if (!options.includeDeleted) conditions.push(isNull(ticketThreads.deletedAt))
+  const rows = await db
+    .select()
+    .from(ticketThreads)
+    .where(and(...conditions))
+    .orderBy(asc(ticketThreads.createdAt))
+
+  return rows.filter((row) => {
+    if (row.audience === 'public') return true
+    if (options.isRequester) return false
+    if (row.audience === 'internal') return options.canSeeInternal
+    if (row.audience === 'shared_team') {
+      if (!row.sharedWithTeamId) return false
+      return options.viewerTeamIds.includes(row.sharedWithTeamId as TeamId)
+    }
+    return false
+  })
+}
+
+export async function getThread(threadId: TicketThreadId): Promise<TicketThread | null> {
+  const row = await db.query.ticketThreads.findFirst({
+    where: eq(ticketThreads.id, threadId),
+  })
+  return row ?? null
+}
+
+export async function loadThreadsByTicketIds(
+  ticketIds: readonly TicketId[]
+): Promise<TicketThread[]> {
+  if (ticketIds.length === 0) return []
+  return db
+    .select()
+    .from(ticketThreads)
+    .where(
+      and(inArray(ticketThreads.ticketId, ticketIds as TicketId[]), isNull(ticketThreads.deletedAt))
+    )
+    .orderBy(asc(ticketThreads.createdAt))
+}
+
+/**
+ * Portal-safe thread fetch — returns ONLY `audience='public'` rows for a ticket.
+ *
+ * Delegates to `listThreads` with `isRequester: true`, which the existing
+ * audience filter already collapses to public-only. Keeps the audience policy
+ * defined in exactly one place.
+ */
+export async function listPublicThreadsForTicket(ticketId: TicketId): Promise<TicketThread[]> {
+  return listThreads(ticketId, {
+    viewerTeamIds: [],
+    canSeeInternal: false,
+    isRequester: true,
+  })
+}
diff --git a/apps/web/src/lib/server/domains/tickets/tiptap-text.ts b/apps/web/src/lib/server/domains/tickets/tiptap-text.ts
new file mode 100644
index 000000000..a77c87681
--- /dev/null
+++ b/apps/web/src/lib/server/domains/tickets/tiptap-text.ts
@@ -0,0 +1,50 @@
+/**
+ * Tiny TipTap → plain-text extractor used for `tickets.description_text` and
+ * `ticket_threads.body_text`. Walks the JSON tree, concatenates `text` nodes,
+ * and inserts blank lines between block-level nodes so previews read cleanly.
+ *
+ * Intentionally lightweight: the canonical body is the JSON; the text mirror
+ * is for search, snippets, and email fallbacks.
+ */
+import type { TiptapContent } from '@/lib/server/db'
+
+interface NodeLike {
+  type?: string
+  text?: string
+  content?: NodeLike[]
+}
+
+const BLOCK_TYPES = new Set([
+  'paragraph',
+  'heading',
+  'blockquote',
+  'codeBlock',
+  'bulletList',
+  'orderedList',
+  'listItem',
+  'horizontalRule',
+])
+
+export function tiptapToPlainText(doc: TiptapContent | null | undefined): string {
+  if (!doc) return ''
+  const out: string[] = []
+  walk(doc as NodeLike, out)
+  return out
+    .join('')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim()
+}
+
+function walk(node: NodeLike, out: string[]): void {
+  if (!node) return
+  if (typeof node.text === 'string') {
+    out.push(node.text)
+    return
+  }
+  if (Array.isArray(node.content)) {
+    for (const child of node.content) walk(child, out)
+  }
+  if (node.type && BLOCK_TYPES.has(node.type)) {
+    out.push('\n\n')
+  }
+}
diff --git a/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.deliveries.diffcov.test.ts b/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.deliveries.diffcov.test.ts
new file mode 100644
index 000000000..5a0376f8e
--- /dev/null
+++ b/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.deliveries.diffcov.test.ts
@@ -0,0 +1,124 @@
+/**
+ * Differential-coverage tests for webhook.deliveries — best-effort attempt
+ * recording (snippet clamp, default fill-in, error swallow) and the
+ * list/get read paths with status/cursor/since filters.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => {
+  const tail: Record<string, unknown> = { orderBy: () => tail, limit: () => m.limitMock() }
+  return {
+    limitMock: vi.fn(),
+    insertValues: vi.fn(),
+    tail,
+  }
+})
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    insert: () => ({ values: (v: unknown) => m.insertValues(v) }),
+    select: () => ({ from: () => ({ where: () => m.tail }) }),
+  },
+  eq: vi.fn(),
+  and: vi.fn((...a) => ({ and: a })),
+  or: vi.fn((...a) => ({ or: a })),
+  lt: vi.fn(),
+  desc: vi.fn(),
+  sql: (..._a: unknown[]) => ({ __sql: true }),
+  webhookDeliveries: {
+    webhookId: 'wd.webhookId',
+    status: 'wd.status',
+    attemptedAt: 'wd.attemptedAt',
+    id: 'wd.id',
+  },
+}))
+
+import {
+  recordDeliveryAttempt,
+  listDeliveriesForWebhook,
+  listFailedDeliveries,
+  getDelivery,
+} from '../webhook.deliveries'
+
+const base = {
+  webhookId: 'wh_1' as never,
+  eventId: 'evt_1',
+  eventType: 'ticket.created',
+  attemptNumber: 1,
+  status: 'success' as const,
+  requestUrl: 'https://x',
+  requestPayloadBytes: 100,
+  signatureTimestamp: 123,
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.limitMock.mockResolvedValue([{ id: 'del_1' }])
+  m.insertValues.mockResolvedValue(undefined)
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+describe('recordDeliveryAttempt', () => {
+  it('records with all fields and clamps a long snippet', async () => {
+    await recordDeliveryAttempt({
+      ...base,
+      httpStatus: 200,
+      errorMessage: null,
+      requestPayloadJson: { a: 1 },
+      requestPayloadTruncated: true,
+      responseBodySnippet: 'x'.repeat(600),
+      latencyMs: 42,
+      nextRetryAt: new Date(),
+    })
+    const stored = m.insertValues.mock.calls[0][0] as { responseBodySnippet: string }
+    expect(stored.responseBodySnippet).toHaveLength(500)
+  })
+  it('records with minimal input (null snippet + defaults)', async () => {
+    await recordDeliveryAttempt(base)
+    const stored = m.insertValues.mock.calls[0][0] as {
+      responseBodySnippet: string | null
+      requestPayloadTruncated: boolean
+    }
+    expect(stored.responseBodySnippet).toBeNull()
+    expect(stored.requestPayloadTruncated).toBe(false)
+  })
+  it('swallows an insert failure', async () => {
+    m.insertValues.mockRejectedValueOnce(new Error('db down'))
+    await expect(recordDeliveryAttempt(base)).resolves.toBeUndefined()
+    expect(console.warn).toHaveBeenCalled()
+  })
+})
+
+describe('listDeliveriesForWebhook', () => {
+  it('applies status filter and cursor', async () => {
+    const res = await listDeliveriesForWebhook('wh_1' as never, {
+      statusFilter: 'failed_retryable',
+      cursor: { attemptedAt: new Date('2026-01-01'), id: 'del_0' as never },
+      limit: 10,
+    })
+    expect(res).toEqual([{ id: 'del_1' }])
+  })
+  it('runs with defaults (no filter/cursor)', async () => {
+    expect(await listDeliveriesForWebhook('wh_1' as never)).toEqual([{ id: 'del_1' }])
+  })
+})
+
+describe('listFailedDeliveries', () => {
+  it('applies a sinceMs window', async () => {
+    expect(await listFailedDeliveries({ sinceMs: 60_000, limit: 5 })).toEqual([{ id: 'del_1' }])
+  })
+  it('ignores a zero/absent sinceMs', async () => {
+    expect(await listFailedDeliveries({ sinceMs: 0 })).toEqual([{ id: 'del_1' }])
+    expect(await listFailedDeliveries()).toEqual([{ id: 'del_1' }])
+  })
+})
+
+describe('getDelivery', () => {
+  it('returns the row when found', async () => {
+    expect(await getDelivery('del_1' as never)).toEqual({ id: 'del_1' })
+  })
+  it('returns null when missing', async () => {
+    m.limitMock.mockResolvedValueOnce([])
+    expect(await getDelivery('del_x' as never)).toBeNull()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.deliveries.test.ts b/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.deliveries.test.ts
new file mode 100644
index 000000000..b0c09d3d2
--- /dev/null
+++ b/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.deliveries.test.ts
@@ -0,0 +1,73 @@
+/**
+ * webhook.deliveries — recordDeliveryAttempt is fire-and-forget; INSERT
+ * failures must never throw out to the caller, and `responseBodySnippet`
+ * is truncated to 500 chars so we never balloon the audit row.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const insertValuesMock = vi.fn()
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    insert: vi.fn(() => ({
+      values: insertValuesMock,
+    })),
+    select: vi.fn(),
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  or: vi.fn(),
+  lt: vi.fn(),
+  desc: vi.fn(),
+  sql: Object.assign(vi.fn(), { raw: vi.fn() }),
+  webhookDeliveries: {
+    id: 'col.id',
+    webhookId: 'col.webhookId',
+    attemptedAt: 'col.attemptedAt',
+    status: 'col.status',
+  },
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  insertValuesMock.mockReset()
+})
+
+describe('recordDeliveryAttempt', () => {
+  it('truncates responseBodySnippet to 500 chars before insert', async () => {
+    insertValuesMock.mockResolvedValue(undefined)
+    const long = 'x'.repeat(2_000)
+    const { recordDeliveryAttempt } = await import('../webhook.deliveries')
+    await recordDeliveryAttempt({
+      webhookId: 'webhook_1' as never,
+      eventId: 'evt_1',
+      eventType: 'post.created',
+      attemptNumber: 1,
+      status: 'success',
+      requestUrl: 'https://example.com',
+      requestPayloadBytes: 100,
+      responseBodySnippet: long,
+      signatureTimestamp: 1700000000,
+    })
+    expect(insertValuesMock).toHaveBeenCalledOnce()
+    const arg = insertValuesMock.mock.calls[0][0]
+    expect(arg.responseBodySnippet.length).toBe(500)
+  })
+
+  it('swallows INSERT failures (best-effort)', async () => {
+    insertValuesMock.mockRejectedValueOnce(new Error('db down'))
+    const { recordDeliveryAttempt } = await import('../webhook.deliveries')
+    await expect(
+      recordDeliveryAttempt({
+        webhookId: 'webhook_1' as never,
+        eventId: 'evt_1',
+        eventType: 'post.created',
+        attemptNumber: 1,
+        status: 'failed_terminal',
+        requestUrl: 'https://example.com',
+        requestPayloadBytes: 50,
+        signatureTimestamp: 1700000000,
+      })
+    ).resolves.toBeUndefined()
+  })
+})
diff --git a/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.operator-actions.test.ts b/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.operator-actions.test.ts
new file mode 100644
index 000000000..0b53712e7
--- /dev/null
+++ b/apps/web/src/lib/server/domains/webhooks/__tests__/webhook.operator-actions.test.ts
@@ -0,0 +1,180 @@
+/**
+ * operator-actions — fireTestEvent + redeliverDelivery. Both bypass BullMQ
+ * and call `webhookHook.run` synchronously. Mocks the hook + service +
+ * deliveries reads + secret decryption.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const runMock = vi.fn()
+const getWebhookByIdMock = vi.fn()
+const getDeliveryMock = vi.fn()
+const decryptSecretMock = vi.fn()
+
+vi.mock('../../../events/handlers/webhook', () => ({
+  webhookHook: { run: runMock },
+}))
+
+vi.mock('../webhook.service', () => ({
+  getWebhookById: getWebhookByIdMock,
+}))
+
+vi.mock('../webhook.deliveries', () => ({
+  getDelivery: getDeliveryMock,
+}))
+
+vi.mock('../encryption', () => ({
+  decryptWebhookSecret: decryptSecretMock,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  decryptSecretMock.mockReturnValue('whsec_decoded')
+})
+
+const ACTIVE_WEBHOOK = {
+  id: 'webhook_1',
+  url: 'https://example.com/hook',
+  secret: 'enc:secret',
+  status: 'active' as const,
+  events: ['post.created', 'ticket.created'],
+  deletedAt: null,
+}
+
+describe('fireTestEvent', () => {
+  it('runs the webhook handler with a sample payload + test-fire eventId', async () => {
+    getWebhookByIdMock.mockResolvedValue(ACTIVE_WEBHOOK)
+    runMock.mockResolvedValue({ success: true })
+    const { fireTestEvent } = await import('../webhook.operator-actions')
+    const result = await fireTestEvent({
+      webhookId: 'webhook_1' as never,
+      eventType: 'post.created',
+    })
+
+    expect(result.success).toBe(true)
+    expect(result.eventId.startsWith('evt_test_')).toBe(true)
+    expect(runMock).toHaveBeenCalledOnce()
+    const [event, cfg, ctx] = runMock.mock.calls[0]
+    expect(event.type).toBe('post.created')
+    expect(event.id).toBe(result.eventId)
+    expect(cfg).toEqual({ url: ACTIVE_WEBHOOK.url })
+    expect(ctx).toEqual({
+      secret: 'whsec_decoded',
+      webhookId: 'webhook_1',
+      attemptNumber: 0,
+    })
+  })
+
+  it('rejects unknown event types with WEBHOOK_TEST_BAD_EVENT', async () => {
+    const { fireTestEvent } = await import('../webhook.operator-actions')
+    await expect(
+      fireTestEvent({ webhookId: 'webhook_1' as never, eventType: 'bogus.event' })
+    ).rejects.toMatchObject({ code: 'WEBHOOK_TEST_BAD_EVENT' })
+    expect(runMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects when webhook is disabled with WEBHOOK_INACTIVE', async () => {
+    getWebhookByIdMock.mockResolvedValue({ ...ACTIVE_WEBHOOK, status: 'disabled' })
+    const { fireTestEvent } = await import('../webhook.operator-actions')
+    await expect(
+      fireTestEvent({ webhookId: 'webhook_1' as never, eventType: 'post.created' })
+    ).rejects.toMatchObject({ code: 'WEBHOOK_INACTIVE' })
+    expect(runMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects when webhook does not subscribe to the event', async () => {
+    getWebhookByIdMock.mockResolvedValue({
+      ...ACTIVE_WEBHOOK,
+      events: ['comment.created'],
+    })
+    const { fireTestEvent } = await import('../webhook.operator-actions')
+    await expect(
+      fireTestEvent({ webhookId: 'webhook_1' as never, eventType: 'post.created' })
+    ).rejects.toMatchObject({ code: 'WEBHOOK_NOT_SUBSCRIBED' })
+    expect(runMock).not.toHaveBeenCalled()
+  })
+
+  it('reports handler failure outcome instead of throwing', async () => {
+    getWebhookByIdMock.mockResolvedValue(ACTIVE_WEBHOOK)
+    runMock.mockResolvedValue({ success: false, error: 'connect timeout' })
+    const { fireTestEvent } = await import('../webhook.operator-actions')
+    const result = await fireTestEvent({
+      webhookId: 'webhook_1' as never,
+      eventType: 'post.created',
+    })
+    expect(result).toMatchObject({ success: false, errorMessage: 'connect timeout' })
+  })
+})
+
+describe('redeliverDelivery', () => {
+  const STORED_PAYLOAD = {
+    id: 'evt_real_123',
+    type: 'post.created',
+    createdAt: '2026-01-02T00:00:00.000Z',
+    data: { post: { id: 'post_1' } },
+  }
+
+  it('replays with attemptNumber + 1 using the stored payload', async () => {
+    getDeliveryMock.mockResolvedValue({
+      id: 'wh_deliv_1',
+      webhookId: 'webhook_1',
+      attemptNumber: 2,
+      requestPayloadJson: STORED_PAYLOAD,
+      requestPayloadTruncated: false,
+    })
+    getWebhookByIdMock.mockResolvedValue(ACTIVE_WEBHOOK)
+    runMock.mockResolvedValue({ success: true })
+
+    const { redeliverDelivery } = await import('../webhook.operator-actions')
+    const result = await redeliverDelivery({ deliveryId: 'wh_deliv_1' as never })
+
+    expect(result).toMatchObject({ success: true, eventId: 'evt_real_123' })
+    expect(runMock).toHaveBeenCalledOnce()
+    const [event, cfg, ctx] = runMock.mock.calls[0]
+    expect(event.id).toBe('evt_real_123')
+    expect(event.type).toBe('post.created')
+    expect(event.timestamp).toBe('2026-01-02T00:00:00.000Z')
+    expect(cfg).toEqual({ url: ACTIVE_WEBHOOK.url })
+    expect(ctx).toEqual({
+      secret: 'whsec_decoded',
+      webhookId: 'webhook_1',
+      attemptNumber: 3,
+    })
+  })
+
+  it('rejects with DELIVERY_NO_PAYLOAD when payload was never stored', async () => {
+    getDeliveryMock.mockResolvedValue({
+      id: 'wh_deliv_1',
+      webhookId: 'webhook_1',
+      attemptNumber: 1,
+      requestPayloadJson: null,
+      requestPayloadTruncated: false,
+    })
+    const { redeliverDelivery } = await import('../webhook.operator-actions')
+    await expect(redeliverDelivery({ deliveryId: 'wh_deliv_1' as never })).rejects.toMatchObject({
+      code: 'DELIVERY_NO_PAYLOAD',
+    })
+    expect(runMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects with DELIVERY_NO_PAYLOAD when payload was truncated', async () => {
+    getDeliveryMock.mockResolvedValue({
+      id: 'wh_deliv_1',
+      webhookId: 'webhook_1',
+      attemptNumber: 1,
+      requestPayloadJson: null,
+      requestPayloadTruncated: true,
+    })
+    const { redeliverDelivery } = await import('../webhook.operator-actions')
+    await expect(redeliverDelivery({ deliveryId: 'wh_deliv_1' as never })).rejects.toMatchObject({
+      code: 'DELIVERY_NO_PAYLOAD',
+    })
+  })
+
+  it('rejects with DELIVERY_NOT_FOUND when delivery is missing', async () => {
+    getDeliveryMock.mockResolvedValue(null)
+    const { redeliverDelivery } = await import('../webhook.operator-actions')
+    await expect(
+      redeliverDelivery({ deliveryId: 'wh_deliv_missing' as never })
+    ).rejects.toMatchObject({ code: 'DELIVERY_NOT_FOUND' })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/webhooks/webhook.deliveries.ts b/apps/web/src/lib/server/domains/webhooks/webhook.deliveries.ts
new file mode 100644
index 000000000..49c50d2b0
--- /dev/null
+++ b/apps/web/src/lib/server/domains/webhooks/webhook.deliveries.ts
@@ -0,0 +1,148 @@
+/**
+ * Append-only audit log of webhook delivery attempts.
+ *
+ * Every dispatch outcome — success, retryable failure, terminal failure, or
+ * SSRF block — is recorded here, decoupled from the live `webhooks` row's
+ * `failureCount`/`lastError` cache. Writes are best-effort: an INSERT
+ * failure must never block a delivery from being processed.
+ */
+
+import {
+  db,
+  eq,
+  and,
+  or,
+  lt,
+  desc,
+  sql,
+  webhookDeliveries,
+  type WebhookDelivery,
+} from '@/lib/server/db'
+import type { WebhookId, WebhookDeliveryId } from '@quackback/ids'
+
+export type WebhookDeliveryStatus =
+  | 'queued'
+  | 'success'
+  | 'failed_retryable'
+  | 'failed_terminal'
+  | 'blocked_ssrf'
+
+export interface RecordDeliveryAttemptInput {
+  webhookId: WebhookId
+  eventId: string
+  eventType: string
+  attemptNumber: number
+  status: WebhookDeliveryStatus
+  httpStatus?: number | null
+  errorMessage?: string | null
+  requestUrl: string
+  requestPayloadBytes: number
+  /** Full event envelope as POSTed; null when the writer chose not to store it. */
+  requestPayloadJson?: unknown
+  /** True when the payload exceeded the writer's storage cap and was dropped. */
+  requestPayloadTruncated?: boolean
+  responseBodySnippet?: string | null
+  latencyMs?: number | null
+  signatureTimestamp: number
+  nextRetryAt?: Date | null
+}
+
+const SNIPPET_MAX = 500
+
+/**
+ * Fire-and-forget INSERT. Never throws; logs warnings on failure so the
+ * caller can stay focused on the delivery outcome.
+ */
+export async function recordDeliveryAttempt(input: RecordDeliveryAttemptInput): Promise<void> {
+  try {
+    const snippet =
+      input.responseBodySnippet != null ? input.responseBodySnippet.slice(0, SNIPPET_MAX) : null
+    await db.insert(webhookDeliveries).values({
+      webhookId: input.webhookId,
+      eventId: input.eventId,
+      eventType: input.eventType,
+      attemptNumber: input.attemptNumber,
+      status: input.status,
+      httpStatus: input.httpStatus ?? null,
+      errorMessage: input.errorMessage ?? null,
+      requestUrl: input.requestUrl,
+      requestPayloadBytes: input.requestPayloadBytes,
+      requestPayloadJson: input.requestPayloadJson ?? null,
+      requestPayloadTruncated: input.requestPayloadTruncated ?? false,
+      responseBodySnippet: snippet,
+      latencyMs: input.latencyMs ?? null,
+      signatureTimestamp: input.signatureTimestamp,
+      nextRetryAt: input.nextRetryAt ?? null,
+    })
+  } catch (err) {
+    console.warn('[webhook.deliveries] recordDeliveryAttempt failed', err)
+  }
+}
+
+export interface ListDeliveriesCursor {
+  attemptedAt: Date
+  id: WebhookDeliveryId
+}
+
+export interface ListDeliveriesOptions {
+  cursor?: ListDeliveriesCursor | null
+  limit?: number
+  statusFilter?: WebhookDeliveryStatus | null
+}
+
+export async function listDeliveriesForWebhook(
+  webhookId: WebhookId,
+  options: ListDeliveriesOptions = {}
+): Promise<WebhookDelivery[]> {
+  const { cursor, limit = 50, statusFilter } = options
+  const conditions = [eq(webhookDeliveries.webhookId, webhookId)]
+  if (statusFilter) conditions.push(eq(webhookDeliveries.status, statusFilter))
+  if (cursor) {
+    conditions.push(
+      or(
+        lt(webhookDeliveries.attemptedAt, cursor.attemptedAt),
+        and(
+          eq(webhookDeliveries.attemptedAt, cursor.attemptedAt),
+          lt(webhookDeliveries.id, cursor.id)
+        )
+      )!
+    )
+  }
+  return db
+    .select()
+    .from(webhookDeliveries)
+    .where(and(...conditions))
+    .orderBy(desc(webhookDeliveries.attemptedAt), desc(webhookDeliveries.id))
+    .limit(limit)
+}
+
+export interface ListFailedDeliveriesOptions {
+  sinceMs?: number
+  limit?: number
+}
+
+export async function listFailedDeliveries(
+  options: ListFailedDeliveriesOptions = {}
+): Promise<WebhookDelivery[]> {
+  const { sinceMs, limit = 100 } = options
+  const conditions = [sql`${webhookDeliveries.status} IN ('failed_retryable', 'failed_terminal')`]
+  if (sinceMs && sinceMs > 0) {
+    const since = new Date(Date.now() - sinceMs)
+    conditions.push(sql`${webhookDeliveries.attemptedAt} >= ${since}`)
+  }
+  return db
+    .select()
+    .from(webhookDeliveries)
+    .where(and(...conditions))
+    .orderBy(desc(webhookDeliveries.attemptedAt))
+    .limit(limit)
+}
+
+export async function getDelivery(id: WebhookDeliveryId): Promise<WebhookDelivery | null> {
+  const [row] = await db
+    .select()
+    .from(webhookDeliveries)
+    .where(eq(webhookDeliveries.id, id))
+    .limit(1)
+  return row ?? null
+}
diff --git a/apps/web/src/lib/server/domains/webhooks/webhook.operator-actions.ts b/apps/web/src/lib/server/domains/webhooks/webhook.operator-actions.ts
new file mode 100644
index 000000000..083c7c94a
--- /dev/null
+++ b/apps/web/src/lib/server/domains/webhooks/webhook.operator-actions.ts
@@ -0,0 +1,144 @@
+/**
+ * Phase 5 — operator-driven webhook actions:
+ *   - test-fire (`fireTestEvent`): synchronously deliver a sample payload
+ *     of a chosen event type to a single webhook so the operator can verify
+ *     URL + secret without waiting for real activity.
+ *   - redeliver (`redeliverDelivery`): replay a previously-recorded delivery
+ *     attempt byte-for-byte using the stored `requestPayloadJson`.
+ *
+ * Both bypass BullMQ so the caller (route handler) can return the outcome
+ * synchronously. The webhook handler itself still records each attempt to
+ * `webhook_deliveries`, keeping the audit trail intact.
+ */
+import type { WebhookId, WebhookDeliveryId } from '@quackback/ids'
+import type { EventData, EventType } from '../../events/types'
+import { EVENT_TYPES } from '../../events/types'
+import { getSampleEventPayload, TEST_FIRE_EVENT_ID_PREFIX } from '../../events/sample-payloads'
+import { getWebhookById } from './webhook.service'
+import { getDelivery } from './webhook.deliveries'
+import { decryptWebhookSecret } from './encryption'
+import { ValidationError, NotFoundError } from '@/lib/shared/errors'
+
+/** Discriminator: a hook result we can report back to the operator. */
+export interface OperatorDeliveryOutcome {
+  success: boolean
+  httpStatus?: number | null
+  latencyMs?: number | null
+  errorMessage?: string | null
+  /** Synthetic id used for the audit row (helps the UI find it). */
+  eventId: string
+}
+
+function isEventType(value: string): value is EventType {
+  return (EVENT_TYPES as readonly string[]).includes(value)
+}
+
+/**
+ * Synchronously deliver a canonical sample of `eventType` to `webhookId`.
+ * Throws ValidationError if the webhook is inactive, deleted, or does not
+ * subscribe to the requested event type.
+ */
+export async function fireTestEvent(input: {
+  webhookId: WebhookId
+  eventType: string
+}): Promise<OperatorDeliveryOutcome> {
+  if (!isEventType(input.eventType)) {
+    throw new ValidationError('WEBHOOK_TEST_BAD_EVENT', `unknown event type ${input.eventType}`)
+  }
+  const webhook = await getWebhookById(input.webhookId)
+  if (webhook.deletedAt) {
+    throw new NotFoundError('WEBHOOK_NOT_FOUND', `webhook ${input.webhookId} not found`)
+  }
+  if (webhook.status !== 'active') {
+    throw new ValidationError('WEBHOOK_INACTIVE', `webhook ${input.webhookId} is not active`)
+  }
+  if (!webhook.events.includes(input.eventType)) {
+    throw new ValidationError(
+      'WEBHOOK_NOT_SUBSCRIBED',
+      `webhook is not subscribed to ${input.eventType}`
+    )
+  }
+
+  // Clone the sample so we can stamp a unique runtime id (test-fire prefix)
+  // — receivers can use this to identify and ignore test traffic.
+  const sample = getSampleEventPayload(input.eventType)
+  const eventId = `${TEST_FIRE_EVENT_ID_PREFIX}${Date.now().toString(36)}`
+  const event: EventData = {
+    ...sample,
+    id: eventId,
+    timestamp: new Date().toISOString(),
+  } as EventData
+
+  const secret = decryptWebhookSecret(webhook.secret)
+  const { webhookHook } = await import('../../events/handlers/webhook')
+  const result = await webhookHook.run(
+    event,
+    { url: webhook.url },
+    { secret, webhookId: webhook.id, attemptNumber: 0 }
+  )
+  return {
+    success: !!result.success,
+    errorMessage: result.error ?? null,
+    eventId,
+  }
+}
+
+/**
+ * Replay a previously-recorded delivery using its stored payload. Bumps the
+ * `attemptNumber` by 1. Fails with 422-style ValidationError when the payload
+ * was not stored (legacy row pre-Phase 5 or oversize payload truncated at write).
+ */
+export async function redeliverDelivery(input: {
+  deliveryId: WebhookDeliveryId
+}): Promise<OperatorDeliveryOutcome> {
+  const delivery = await getDelivery(input.deliveryId)
+  if (!delivery) {
+    throw new NotFoundError('DELIVERY_NOT_FOUND', `delivery ${input.deliveryId} not found`)
+  }
+  const row = delivery as typeof delivery & {
+    requestPayloadJson: unknown
+    requestPayloadTruncated: boolean
+  }
+  if (!row.requestPayloadJson) {
+    throw new ValidationError(
+      'DELIVERY_NO_PAYLOAD',
+      row.requestPayloadTruncated
+        ? 'original payload was too large to store; cannot redeliver'
+        : 'original payload was not captured; cannot redeliver'
+    )
+  }
+  const payload = row.requestPayloadJson as {
+    id: string
+    type: EventType
+    createdAt: string
+    data: unknown
+  }
+  const webhook = await getWebhookById(delivery.webhookId as WebhookId)
+  if (webhook.deletedAt) {
+    throw new NotFoundError('WEBHOOK_NOT_FOUND', `webhook ${delivery.webhookId} not found`)
+  }
+  const event = {
+    id: payload.id,
+    type: payload.type,
+    timestamp: payload.createdAt,
+    actor: { type: 'service', service: 'quackback-redeliver', displayName: 'Redeliver' },
+    data: payload.data,
+  } as EventData
+
+  const secret = decryptWebhookSecret(webhook.secret)
+  const { webhookHook } = await import('../../events/handlers/webhook')
+  const result = await webhookHook.run(
+    event,
+    { url: webhook.url },
+    {
+      secret,
+      webhookId: webhook.id,
+      attemptNumber: (delivery.attemptNumber ?? 0) + 1,
+    }
+  )
+  return {
+    success: !!result.success,
+    errorMessage: result.error ?? null,
+    eventId: payload.id,
+  }
+}
diff --git a/apps/web/src/lib/server/domains/webhooks/webhook.service.ts b/apps/web/src/lib/server/domains/webhooks/webhook.service.ts
index f3af99c42..f25364d1c 100644
--- a/apps/web/src/lib/server/domains/webhooks/webhook.service.ts
+++ b/apps/web/src/lib/server/domains/webhooks/webhook.service.ts
@@ -39,10 +39,7 @@ export async function createWebhook(
   input: CreateWebhookInput,
   createdById: PrincipalId
 ): Promise<CreateWebhookResult> {
-  log.debug(
-    { event_count: input.events.length, created_by_id: createdById },
-    'create webhook'
-  )
+  log.debug({ event_count: input.events.length, created_by_id: createdById }, 'create webhook')
   const { assertTierFeature } = await import('@/lib/server/domains/settings/tier-enforce')
   await assertTierFeature('webhooks', 'Webhooks')
 
@@ -88,6 +85,7 @@ export async function createWebhook(
       secret: secretEncrypted,
       events: input.events,
       boardIds: input.boardIds ?? null,
+      inboxIds: input.inboxIds ?? null,
     })
     .returning()
 
@@ -157,6 +155,7 @@ export async function updateWebhook(id: WebhookId, input: UpdateWebhookInput): P
   if (input.url !== undefined) updateData.url = input.url
   if (input.events !== undefined) updateData.events = input.events
   if (input.boardIds !== undefined) updateData.boardIds = input.boardIds
+  if (input.inboxIds !== undefined) updateData.inboxIds = input.inboxIds
   if (input.status !== undefined) {
     updateData.status = input.status
     // Reset failure count when re-enabling
@@ -239,6 +238,7 @@ function mapWebhook(w: typeof webhooks.$inferSelect): Webhook {
     url: w.url,
     events: w.events,
     boardIds: w.boardIds,
+    inboxIds: w.inboxIds,
     status: w.status as 'active' | 'disabled',
     failureCount: w.failureCount,
     lastError: w.lastError,
@@ -246,5 +246,7 @@ function mapWebhook(w: typeof webhooks.$inferSelect): Webhook {
     createdAt: w.createdAt,
     updatedAt: w.updatedAt,
     createdById: w.createdById,
+    secret: w.secret,
+    deletedAt: w.deletedAt,
   }
 }
diff --git a/apps/web/src/lib/server/domains/webhooks/webhook.types.ts b/apps/web/src/lib/server/domains/webhooks/webhook.types.ts
index 4dc2b95ce..fae38531c 100644
--- a/apps/web/src/lib/server/domains/webhooks/webhook.types.ts
+++ b/apps/web/src/lib/server/domains/webhooks/webhook.types.ts
@@ -5,6 +5,8 @@ export interface Webhook {
   url: string
   events: string[]
   boardIds: string[] | null
+  inboxIds: string[] | null
+  secret: string
   status: 'active' | 'disabled'
   failureCount: number
   lastError: string | null
@@ -12,12 +14,14 @@ export interface Webhook {
   createdAt: Date
   updatedAt: Date
   createdById: PrincipalId
+  deletedAt: Date | null
 }
 
 export interface CreateWebhookInput {
   url: string
   events: string[]
   boardIds?: string[]
+  inboxIds?: string[]
 }
 
 export interface CreateWebhookResult {
@@ -30,5 +34,6 @@ export interface UpdateWebhookInput {
   url?: string
   events?: string[]
   boardIds?: string[] | null
+  inboxIds?: string[] | null
   status?: 'active' | 'disabled'
 }
diff --git a/apps/web/src/lib/server/events/__tests__/ai-handler.test.ts b/apps/web/src/lib/server/events/__tests__/ai-handler.test.ts
new file mode 100644
index 000000000..a5b884973
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/ai-handler.test.ts
@@ -0,0 +1,122 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { aiHook } from '../handlers/ai'
+import type { EventData } from '../types'
+
+const mocks = vi.hoisted(() => ({
+  analyzeSentiment: vi.fn(),
+  saveSentiment: vi.fn(),
+  generatePostEmbedding: vi.fn(),
+  claimHookDelivery: vi.fn(),
+  dbSelect: vi.fn(),
+  eq: vi.fn(),
+  logDebug: vi.fn(),
+  logError: vi.fn(),
+  logInfo: vi.fn(),
+  logWarn: vi.fn(),
+}))
+
+vi.mock('@/lib/server/domains/sentiment/sentiment.service', () => ({
+  analyzeSentiment: (...args: unknown[]) => mocks.analyzeSentiment(...args),
+  saveSentiment: (...args: unknown[]) => mocks.saveSentiment(...args),
+}))
+
+vi.mock('@/lib/server/domains/embeddings/embedding.service', () => ({
+  generatePostEmbedding: (...args: unknown[]) => mocks.generatePostEmbedding(...args),
+}))
+
+vi.mock('../hook-idempotency', () => ({
+  claimHookDelivery: (...args: unknown[]) => mocks.claimHookDelivery(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: (...args: unknown[]) => mocks.dbSelect(...args),
+  },
+  postTags: {
+    postId: 'postTags.postId',
+    tagId: 'postTags.tagId',
+  },
+  tags: {
+    id: 'tags.id',
+    name: 'tags.name',
+  },
+  eq: (...args: unknown[]) => mocks.eq(...args),
+}))
+
+vi.mock('@/lib/server/logger', () => ({
+  logger: {
+    child: () => ({
+      debug: (...args: unknown[]) => mocks.logDebug(...args),
+      error: (...args: unknown[]) => mocks.logError(...args),
+      info: (...args: unknown[]) => mocks.logInfo(...args),
+      warn: (...args: unknown[]) => mocks.logWarn(...args),
+    }),
+  },
+}))
+
+function selectRows(rows: ReadonlyArray<Record<string, unknown>>) {
+  const chain = {
+    from: vi.fn(() => chain),
+    innerJoin: vi.fn(() => chain),
+    where: vi.fn(async () => rows),
+  }
+  return chain
+}
+
+function postCreatedEvent(): EventData {
+  return {
+    id: 'evt-post-created',
+    type: 'post.created',
+    timestamp: '2026-06-16T00:00:00.000Z',
+    actor: { type: 'user', principalId: 'principal_1' },
+    data: {
+      post: {
+        id: 'post_1',
+        title: 'Import CSV support',
+        content: 'Customers want CSV import support.',
+      },
+    },
+  } as EventData
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.claimHookDelivery.mockResolvedValue(true)
+  mocks.analyzeSentiment.mockResolvedValue({ sentiment: 'positive', confidence: 0.8 })
+  mocks.saveSentiment.mockResolvedValue(undefined)
+  mocks.generatePostEmbedding.mockResolvedValue(true)
+  mocks.dbSelect.mockReturnValue(selectRows([]))
+})
+
+describe('aiHook', () => {
+  it('adds post tag names to embedding generation', async () => {
+    mocks.dbSelect.mockReturnValueOnce(selectRows([{ name: 'billing' }, { name: 'enterprise' }]))
+
+    await expect(aiHook.run(postCreatedEvent(), {}, {}, { jobId: 'job_1' })).resolves.toEqual({
+      success: true,
+    })
+
+    expect(mocks.claimHookDelivery).toHaveBeenCalledWith('job_1', 'ai')
+    expect(mocks.generatePostEmbedding).toHaveBeenCalledWith(
+      'post_1',
+      'Import CSV support',
+      'Customers want CSV import support.',
+      ['billing', 'enterprise']
+    )
+    expect(mocks.logDebug).toHaveBeenCalledWith(
+      { post_id: 'post_1', tag_count: 2, tags: ['billing', 'enterprise'] },
+      'including tags in embedding'
+    )
+  })
+
+  it('skips duplicate job executions before sentiment or embedding work', async () => {
+    mocks.claimHookDelivery.mockResolvedValue(false)
+
+    await expect(aiHook.run(postCreatedEvent(), {}, {}, { jobId: 'job_1' })).resolves.toEqual({
+      success: true,
+    })
+
+    expect(mocks.analyzeSentiment).not.toHaveBeenCalled()
+    expect(mocks.generatePostEmbedding).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/dispatch-enrichment.test.ts b/apps/web/src/lib/server/events/__tests__/dispatch-enrichment.test.ts
new file mode 100644
index 000000000..679e45ff3
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/dispatch-enrichment.test.ts
@@ -0,0 +1,204 @@
+/**
+ * Phase 3 enrichment: verifies `buildTicketRef` joins related tables and
+ * embeds snapshot fields + a deep-link URL on dispatched ticket events.
+ *
+ * Exercised through a public dispatcher (`dispatchTicketCreated`) so we cover
+ * the real call path; the dispatched event is captured by mocking
+ * `./process` (the indirect target of `dispatchEvent`).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const ticketStatusFindFirstMock = vi.fn()
+const inboxFindFirstMock = vi.fn()
+const teamFindFirstMock = vi.fn()
+const contactFindFirstMock = vi.fn()
+const organizationFindFirstMock = vi.fn()
+
+const processEventMock = vi.fn()
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketStatuses: { findFirst: ticketStatusFindFirstMock },
+      inboxes: { findFirst: inboxFindFirstMock },
+      teams: { findFirst: teamFindFirstMock },
+      contacts: { findFirst: contactFindFirstMock },
+      organizations: { findFirst: organizationFindFirstMock },
+    },
+  },
+  eq: vi.fn(),
+  ticketStatuses: { _name: 'ticket_statuses' },
+  inboxes: { _name: 'inboxes' },
+  teams: { _name: 'teams' },
+  contacts: { _name: 'contacts' },
+  organizations: { _name: 'organizations' },
+}))
+
+vi.mock('@/lib/server/config', () => ({
+  getBaseUrl: () => 'https://example.test',
+}))
+
+vi.mock('../process', () => ({
+  processEvent: (...a: unknown[]) => processEventMock(...a),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  ticketStatusFindFirstMock.mockReset()
+  inboxFindFirstMock.mockReset()
+  teamFindFirstMock.mockReset()
+  contactFindFirstMock.mockReset()
+  organizationFindFirstMock.mockReset()
+  processEventMock.mockReset()
+})
+
+const baseActor = { type: 'service' as const, displayName: 'test' }
+
+interface DispatchedEvent {
+  type: string
+  data: { ticket: Record<string, unknown> }
+}
+
+function lastDispatchedEvent(): DispatchedEvent {
+  expect(processEventMock).toHaveBeenCalledTimes(1)
+  return processEventMock.mock.calls[0][0] as DispatchedEvent
+}
+
+describe('buildTicketRef enrichment via dispatchTicketCreated', () => {
+  it('snapshots status / inbox / team / contact / organization names plus ticketUrl', async () => {
+    ticketStatusFindFirstMock.mockResolvedValueOnce({ name: 'Open' })
+    inboxFindFirstMock.mockResolvedValueOnce({ name: 'Support', slug: 'support' })
+    teamFindFirstMock.mockResolvedValueOnce({ name: 'CX Team' })
+    contactFindFirstMock.mockResolvedValueOnce({
+      name: 'Ada Lovelace',
+      email: '[email protected]',
+      organizationId: 'org_1',
+    })
+    organizationFindFirstMock.mockResolvedValueOnce({ name: 'Acme', domain: 'acme.com' })
+
+    const { dispatchTicketCreated } = await import('../dispatch')
+    await dispatchTicketCreated(baseActor, {
+      id: 'ticket_1',
+      subject: 'help',
+      statusId: 'ticket_status_open',
+      statusCategory: 'open',
+      priority: 'normal',
+      channel: 'portal',
+      visibilityScope: 'team',
+      inboxId: 'inbox_1',
+      primaryTeamId: 'team_1',
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+      requesterPrincipalId: null,
+      requesterContactId: 'contact_1',
+      organizationId: null,
+      createdAt: new Date('2026-05-01T10:00:00.000Z'),
+      firstResponseAt: null,
+      resolvedAt: null,
+      reopenedAt: null,
+      closedAt: null,
+    })
+
+    const event = lastDispatchedEvent()
+    expect(event.type).toBe('ticket.created')
+    const ticket = event.data.ticket
+    expect(ticket.id).toBe('ticket_1')
+    expect(ticket.statusName).toBe('Open')
+    expect(ticket.inboxName).toBe('Support')
+    expect(ticket.inboxSlug).toBe('support')
+    expect(ticket.primaryTeamName).toBe('CX Team')
+    expect(ticket.requesterEmail).toBe('[email protected]')
+    expect(ticket.requesterName).toBe('Ada Lovelace')
+    expect(ticket.organizationName).toBe('Acme')
+    expect(ticket.organizationDomain).toBe('acme.com')
+    expect(ticket.createdAt).toBe('2026-05-01T10:00:00.000Z')
+    expect(ticket.ticketUrl).toBe('https://example.test/admin/tickets/ticket_1')
+  })
+
+  it('skips lookups for null IDs and leaves snapshot fields null', async () => {
+    const { dispatchTicketCreated } = await import('../dispatch')
+    await dispatchTicketCreated(baseActor, {
+      id: 'ticket_2',
+      subject: null,
+      statusId: null,
+      statusCategory: null,
+      priority: null,
+      channel: null,
+      visibilityScope: null,
+      inboxId: null,
+      primaryTeamId: null,
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+      requesterPrincipalId: null,
+      requesterContactId: null,
+      organizationId: null,
+    })
+
+    expect(ticketStatusFindFirstMock).not.toHaveBeenCalled()
+    expect(inboxFindFirstMock).not.toHaveBeenCalled()
+    expect(teamFindFirstMock).not.toHaveBeenCalled()
+    expect(contactFindFirstMock).not.toHaveBeenCalled()
+    expect(organizationFindFirstMock).not.toHaveBeenCalled()
+
+    const ticket = lastDispatchedEvent().data.ticket
+    expect(ticket.statusName).toBeNull()
+    expect(ticket.inboxName).toBeNull()
+    expect(ticket.requesterEmail).toBeNull()
+    expect(ticket.organizationName).toBeNull()
+    expect(ticket.ticketUrl).toBe('https://example.test/admin/tickets/ticket_2')
+  })
+
+  it('falls back to the bare ref when an enrichment query throws', async () => {
+    ticketStatusFindFirstMock.mockRejectedValueOnce(new Error('db down'))
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const { dispatchTicketCreated } = await import('../dispatch')
+    await dispatchTicketCreated(baseActor, {
+      id: 'ticket_3',
+      subject: 'x',
+      statusId: 'ticket_status_open',
+      statusCategory: 'open',
+      priority: 'normal',
+      channel: 'portal',
+      visibilityScope: 'team',
+      inboxId: null,
+      primaryTeamId: null,
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+      requesterPrincipalId: null,
+      requesterContactId: null,
+      organizationId: null,
+    })
+
+    const ticket = lastDispatchedEvent().data.ticket
+    expect(ticket.id).toBe('ticket_3')
+    expect(ticket.statusName).toBeUndefined()
+    expect(ticket.ticketUrl).toBeUndefined()
+    expect(warnSpy).toHaveBeenCalled()
+    warnSpy.mockRestore()
+  })
+
+  it('reuses primary team name for the assignee team when both IDs match', async () => {
+    teamFindFirstMock.mockResolvedValueOnce({ name: 'Shared Team' })
+    const { dispatchTicketCreated } = await import('../dispatch')
+    await dispatchTicketCreated(baseActor, {
+      id: 'ticket_4',
+      subject: 'x',
+      statusId: null,
+      statusCategory: null,
+      priority: null,
+      channel: null,
+      visibilityScope: null,
+      inboxId: null,
+      primaryTeamId: 'team_1',
+      assigneePrincipalId: null,
+      assigneeTeamId: 'team_1',
+      requesterPrincipalId: null,
+      requesterContactId: null,
+      organizationId: null,
+    })
+    expect(teamFindFirstMock).toHaveBeenCalledTimes(1)
+    const ticket = lastDispatchedEvent().data.ticket
+    expect(ticket.primaryTeamName).toBe('Shared Team')
+    expect(ticket.assigneeTeamName).toBe('Shared Team')
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/dispatch-thread-snapshot.test.ts b/apps/web/src/lib/server/events/__tests__/dispatch-thread-snapshot.test.ts
new file mode 100644
index 000000000..0f122cf5c
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/dispatch-thread-snapshot.test.ts
@@ -0,0 +1,77 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const processEventMock = vi.fn()
+
+vi.mock('../process', () => ({
+  processEvent: (...args: unknown[]) => processEventMock(...args),
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  processEventMock.mockReset()
+})
+
+const actor = { type: 'service' as const, displayName: 'test' }
+const ticket = {
+  id: 'ticket_thread_1',
+  subject: 'thread content',
+  statusId: null,
+  statusCategory: 'open',
+  priority: 'normal',
+  channel: 'email',
+  visibilityScope: 'team',
+  inboxId: null,
+  primaryTeamId: null,
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  requesterPrincipalId: 'principal_requester',
+  requesterContactId: null,
+  organizationId: null,
+}
+
+describe('ticket thread dispatch snapshots', () => {
+  it('includes full body text for added thread events', async () => {
+    const { dispatchTicketThreadAdded } = await import('../dispatch')
+    await dispatchTicketThreadAdded(actor, ticket, 'thread_1', 'public', null, {
+      bodyTextPreview: 'Preview text',
+      bodyText: 'Full reply body with enough context for the email recipient.',
+      bodyTextTruncated: false,
+      authorPrincipalId: 'principal_requester',
+      isFromRequester: true,
+      createdAt: '2026-06-16T10:10:00.000Z',
+    })
+
+    const event = processEventMock.mock.calls[0][0] as any
+    expect(event.type).toBe('ticket.thread_added')
+    expect(event.data.thread.bodyText).toBe(
+      'Full reply body with enough context for the email recipient.'
+    )
+    expect(event.data.thread.bodyTextPreview).toBe('Preview text')
+  })
+
+  it('includes the last known body text for deleted thread events', async () => {
+    const { dispatchTicketThreadDeleted } = await import('../dispatch')
+    await dispatchTicketThreadDeleted(
+      actor,
+      ticket,
+      'thread_1',
+      'public',
+      null,
+      'principal_agent',
+      {
+        bodyTextPreview: 'Removed preview',
+        bodyText: 'Removed reply body that should still be understandable in email.',
+        bodyTextTruncated: false,
+        authorPrincipalId: 'principal_requester',
+        isFromRequester: true,
+        createdAt: '2026-06-16T10:10:00.000Z',
+      }
+    )
+
+    const event = processEventMock.mock.calls[0][0] as any
+    expect(event.type).toBe('ticket.thread_deleted')
+    expect(event.data.thread.bodyText).toBe(
+      'Removed reply body that should still be understandable in email.'
+    )
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/dispatch-wrappers.test.ts b/apps/web/src/lib/server/events/__tests__/dispatch-wrappers.test.ts
new file mode 100644
index 000000000..b1be1c9b1
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/dispatch-wrappers.test.ts
@@ -0,0 +1,1112 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import * as dispatch from '../dispatch'
+import type {
+  EventActor,
+  EventApiKeyRef,
+  EventBoardRef,
+  EventBusinessHoursRef,
+  EventChangelogRef,
+  EventContactRef,
+  EventConversationRef,
+  EventHelpCenterArticleRef,
+  EventHelpCenterCategoryRef,
+  EventInboxChannelRef,
+  EventInboxMembershipRef,
+  EventInboxRef,
+  EventOrganizationRef,
+  EventRoadmapRef,
+  EventRoleAssignmentRef,
+  EventRoleRef,
+  EventRoutingRuleRef,
+  EventSegmentRef,
+  EventSlaPolicyRef,
+  EventStatusRef,
+  EventTagRef,
+  EventTeamRef,
+  EventTicketStatusRef,
+  EventUserAttributeRef,
+} from '../types'
+
+const processEvent = vi.fn()
+const getHookTargets = vi.fn()
+const emailHookRun = vi.fn()
+const logDebug = vi.fn()
+const logError = vi.fn()
+
+vi.mock('@/lib/server/logger', () => ({
+  logger: {
+    child: () => ({
+      debug: (...args: unknown[]) => logDebug(...args),
+      error: (...args: unknown[]) => logError(...args),
+    }),
+  },
+}))
+
+vi.mock('@/lib/server/config', () => ({
+  getBaseUrl: () => 'https://example.test',
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketStatuses: { findFirst: vi.fn() },
+      inboxes: { findFirst: vi.fn() },
+      teams: { findFirst: vi.fn() },
+      contacts: { findFirst: vi.fn() },
+      organizations: { findFirst: vi.fn() },
+    },
+  },
+  eq: vi.fn(),
+  ticketStatuses: { id: 'ticketStatuses.id' },
+  inboxes: { id: 'inboxes.id' },
+  teams: { id: 'teams.id' },
+  contacts: { id: 'contacts.id' },
+  organizations: { id: 'organizations.id' },
+}))
+
+vi.mock('../process', () => ({
+  processEvent: (...args: unknown[]) => processEvent(...args),
+}))
+
+vi.mock('../targets', () => ({
+  getHookTargets: (...args: unknown[]) => getHookTargets(...args),
+}))
+
+vi.mock('../handlers/email', () => ({
+  emailHook: {
+    run: (...args: unknown[]) => emailHookRun(...args),
+  },
+}))
+
+const actor: EventActor = {
+  type: 'user',
+  principalId: 'principal_admin',
+  userId: 'user_admin',
+  displayName: 'Admin User',
+}
+
+interface CapturedEvent {
+  id: string
+  timestamp: string
+  type: string
+  actor: EventActor
+  data: Record<string, unknown>
+  syncSourceIntegrationId?: string
+}
+
+function lastEvent(): CapturedEvent {
+  expect(processEvent).toHaveBeenCalledTimes(1)
+  return processEvent.mock.calls[0]?.[0] as CapturedEvent
+}
+
+async function expectDispatched(
+  run: () => Promise<void>,
+  expected: {
+    type: string
+    data: Record<string, unknown>
+    syncSourceIntegrationId?: string
+  }
+) {
+  await run()
+  const event = lastEvent()
+  expect(event).toMatchObject({
+    type: expected.type,
+    actor,
+    data: expected.data,
+  })
+  expect(typeof event.id).toBe('string')
+  expect(typeof event.timestamp).toBe('string')
+  if (expected.syncSourceIntegrationId) {
+    expect(event.syncSourceIntegrationId).toBe(expected.syncSourceIntegrationId)
+  } else {
+    expect(event.syncSourceIntegrationId).toBeUndefined()
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  processEvent.mockResolvedValue(undefined)
+  getHookTargets.mockResolvedValue([])
+  emailHookRun.mockResolvedValue(undefined)
+})
+
+const inbox: EventInboxRef = {
+  id: 'inbox_1',
+  slug: 'support',
+  name: 'Support',
+  description: null,
+  primaryTeamId: 'team_1',
+  defaultVisibilityScope: 'team',
+  defaultPriority: 'normal',
+  defaultStatusId: 'ticket_status_open',
+  color: '#0f766e',
+  icon: 'inbox',
+  archivedAt: null,
+}
+
+const team: EventTeamRef = {
+  id: 'team_1',
+  slug: 'support',
+  name: 'Support',
+  description: null,
+  shortLabel: 'SUP',
+  color: '#0f766e',
+  archivedAt: null,
+}
+
+const ticketStatus: EventTicketStatusRef = {
+  id: 'ticket_status_open',
+  slug: 'open',
+  name: 'Open',
+  color: '#16a34a',
+  category: 'open',
+  position: 1,
+  isDefault: true,
+  isSystem: true,
+  deletedAt: null,
+}
+
+const contact: EventContactRef = {
+  id: 'contact_1',
+  name: 'Ada Lovelace',
+  email: 'ada@example.com',
+  phone: null,
+  title: 'CTO',
+  externalId: null,
+  organizationId: 'org_1',
+  archivedAt: null,
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const organization: EventOrganizationRef = {
+  id: 'org_1',
+  name: 'Acme',
+  domain: 'acme.com',
+  website: 'https://acme.com',
+  externalId: null,
+  archivedAt: null,
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const category: EventHelpCenterCategoryRef = {
+  id: 'help_category_1',
+  slug: 'billing',
+  name: 'Billing',
+  parentId: null,
+  isPublic: true,
+  visibility: 'public',
+  position: 1,
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const article: EventHelpCenterArticleRef = {
+  id: 'help_article_1',
+  categoryId: 'help_category_1',
+  slug: 'billing-faq',
+  title: 'Billing FAQ',
+  authorPrincipalId: 'principal_admin',
+  publishedAt: '2026-06-02T00:00:00.000Z',
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const changelog: EventChangelogRef = {
+  id: 'changelog_1',
+  title: 'Release',
+  contentPreview: 'New ticketing tools',
+  categoryId: 'category_1',
+  productId: 'product_1',
+  publishedAt: '2026-06-02T00:00:00.000Z',
+  linkedPostCount: 2,
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const segment: EventSegmentRef = {
+  id: 'segment_1',
+  slug: 'enterprise',
+  name: 'Enterprise',
+  type: 'dynamic',
+  color: '#2563eb',
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const attribute: EventUserAttributeRef = {
+  id: 'attribute_1',
+  key: 'plan',
+  label: 'Plan',
+  type: 'string',
+  currencyCode: null,
+  externalKey: 'plan',
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const board: EventBoardRef = {
+  id: 'board_1',
+  slug: 'ideas',
+  name: 'Ideas',
+  description: null,
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const tag: EventTagRef = {
+  id: 'tag_1',
+  name: 'Priority',
+  color: '#f97316',
+  description: null,
+  createdAt: '2026-06-01T00:00:00.000Z',
+}
+
+const status: EventStatusRef = {
+  id: 'status_1',
+  slug: 'planned',
+  name: 'Planned',
+  color: '#16a34a',
+  category: 'planned',
+  position: 1,
+  showOnRoadmap: true,
+  isDefault: false,
+  createdAt: '2026-06-01T00:00:00.000Z',
+}
+
+const roadmap: EventRoadmapRef = {
+  id: 'roadmap_1',
+  slug: 'public',
+  name: 'Public roadmap',
+  description: null,
+  isPublic: true,
+  position: 1,
+  createdAt: '2026-06-01T00:00:00.000Z',
+  updatedAt: '2026-06-02T00:00:00.000Z',
+}
+
+const policy: EventSlaPolicyRef = {
+  id: 'sla_policy_1',
+  name: 'Gold support',
+  scope: 'inbox',
+  enabled: true,
+  priority: 1,
+  archivedAt: null,
+}
+
+const rule: EventRoutingRuleRef = {
+  id: 'routing_rule_1',
+  name: 'Billing routing',
+  enabled: true,
+  priority: 1,
+  inboxIdScope: 'inbox_1',
+}
+
+const businessHours: EventBusinessHoursRef = {
+  id: 'business_hours_1',
+  name: 'Weekdays',
+  timezone: 'Europe/Berlin',
+  archivedAt: null,
+}
+
+const channel: EventInboxChannelRef = {
+  id: 'inbox_channel_1',
+  inboxId: 'inbox_1',
+  kind: 'email',
+  label: 'Support email',
+  externalId: 'support@example.com',
+  enabled: true,
+  archivedAt: null,
+}
+
+const membership: EventInboxMembershipRef = {
+  id: 'inbox_membership_1',
+  inboxId: 'inbox_1',
+  principalId: 'principal_agent',
+  role: 'agent',
+}
+
+const apiKey: EventApiKeyRef = {
+  id: 'api_key_1',
+  name: 'Reporting',
+  scopes: ['tickets:read'],
+}
+
+const role: EventRoleRef = {
+  id: 'role_1',
+  key: 'support_agent',
+  name: 'Support agent',
+  isSystem: false,
+}
+
+const assignment: EventRoleAssignmentRef = {
+  id: 'role_assignment_1',
+  roleId: 'role_1',
+  roleKey: 'support_agent',
+  principalId: 'principal_agent',
+  teamId: 'team_1',
+}
+
+const conversation: EventConversationRef = {
+  id: 'conversation_1',
+  status: 'open',
+  channel: 'live_chat',
+  priority: 'medium',
+}
+
+const bareTicket = {
+  id: 'ticket_1',
+  subject: 'Billing question',
+  descriptionText: 'Please check the invoice.',
+  statusId: null,
+  statusCategory: 'open',
+  priority: 'normal',
+  channel: 'email',
+  visibility: 'team',
+  inboxId: null,
+  primaryTeamId: null,
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  requesterPrincipalId: null,
+  requesterContactId: null,
+  organizationId: null,
+}
+
+describe('configuration, content, and security event dispatch wrappers', () => {
+  const cases: Array<{
+    name: string
+    run: () => Promise<void>
+    type: string
+    data: Record<string, unknown>
+  }> = [
+    {
+      name: 'post.mentioned',
+      run: () =>
+        dispatch.dispatchPostMentioned(actor, {
+          postId: 'post_1',
+          postTitle: 'Import CSV support',
+          postUrl: 'https://example.test/p/import-csv',
+          mentionedPrincipalId: 'principal_mentioned',
+          mentioningPrincipalId: 'principal_admin',
+          excerpt: 'cc @support',
+        }),
+      type: 'post.mentioned',
+      data: {
+        postId: 'post_1',
+        postTitle: 'Import CSV support',
+        postUrl: 'https://example.test/p/import-csv',
+        mentionedPrincipalId: 'principal_mentioned',
+        mentioningPrincipalId: 'principal_admin',
+        excerpt: 'cc @support',
+      },
+    },
+    {
+      name: 'conversation.assigned',
+      run: () =>
+        dispatch.dispatchConversationAssigned(
+          actor,
+          conversation,
+          'principal_previous',
+          'principal_next'
+        ),
+      type: 'conversation.assigned',
+      data: {
+        conversation,
+        previousAgentPrincipalId: 'principal_previous',
+        assignedAgentPrincipalId: 'principal_next',
+      },
+    },
+    {
+      name: 'conversation.priority_changed',
+      run: () =>
+        dispatch.dispatchConversationPriorityChanged(actor, conversation, 'medium', 'urgent'),
+      type: 'conversation.priority_changed',
+      data: { conversation, previousPriority: 'medium', newPriority: 'urgent' },
+    },
+    {
+      name: 'message.deleted',
+      run: () =>
+        dispatch.dispatchMessageDeleted(
+          actor,
+          { id: 'message_1', conversationId: 'conversation_1' },
+          conversation
+        ),
+      type: 'message.deleted',
+      data: { message: { id: 'message_1', conversationId: 'conversation_1' }, conversation },
+    },
+    {
+      name: 'inbox.created',
+      run: () => dispatch.dispatchInboxCreated(actor, inbox),
+      type: 'inbox.created',
+      data: { inbox },
+    },
+    {
+      name: 'inbox.updated',
+      run: () => dispatch.dispatchInboxUpdated(actor, inbox, ['name']),
+      type: 'inbox.updated',
+      data: { inbox, changedFields: ['name'] },
+    },
+    {
+      name: 'inbox.archived',
+      run: () => dispatch.dispatchInboxArchived(actor, inbox),
+      type: 'inbox.archived',
+      data: { inbox },
+    },
+    {
+      name: 'inbox.unarchived',
+      run: () => dispatch.dispatchInboxUnarchived(actor, inbox),
+      type: 'inbox.unarchived',
+      data: { inbox },
+    },
+    {
+      name: 'team.created',
+      run: () => dispatch.dispatchTeamCreated(actor, team),
+      type: 'team.created',
+      data: { team },
+    },
+    {
+      name: 'team.updated',
+      run: () => dispatch.dispatchTeamUpdated(actor, team, ['color']),
+      type: 'team.updated',
+      data: { team, changedFields: ['color'] },
+    },
+    {
+      name: 'team.archived',
+      run: () => dispatch.dispatchTeamArchived(actor, team),
+      type: 'team.archived',
+      data: { team },
+    },
+    {
+      name: 'ticket_status.created',
+      run: () => dispatch.dispatchTicketStatusCreated(actor, ticketStatus),
+      type: 'ticket_status.created',
+      data: { status: ticketStatus },
+    },
+    {
+      name: 'ticket_status.updated',
+      run: () => dispatch.dispatchTicketStatusUpdated(actor, ticketStatus, ['position']),
+      type: 'ticket_status.updated',
+      data: { status: ticketStatus, changedFields: ['position'] },
+    },
+    {
+      name: 'contact.created',
+      run: () => dispatch.dispatchContactCreated(actor, contact),
+      type: 'contact.created',
+      data: { contact },
+    },
+    {
+      name: 'contact.updated',
+      run: () => dispatch.dispatchContactUpdated(actor, contact, ['email']),
+      type: 'contact.updated',
+      data: { contact, changedFields: ['email'] },
+    },
+    {
+      name: 'contact.archived',
+      run: () => dispatch.dispatchContactArchived(actor, contact),
+      type: 'contact.archived',
+      data: { contact },
+    },
+    {
+      name: 'contact.linked',
+      run: () => dispatch.dispatchContactLinked(actor, contact, 'user_linked', 'principal_admin'),
+      type: 'contact.linked',
+      data: { contact, userId: 'user_linked', linkedByPrincipalId: 'principal_admin' },
+    },
+    {
+      name: 'contact.unlinked',
+      run: () => dispatch.dispatchContactUnlinked(actor, contact, 'user_linked'),
+      type: 'contact.unlinked',
+      data: { contact, userId: 'user_linked' },
+    },
+    {
+      name: 'organization.created',
+      run: () => dispatch.dispatchOrganizationCreated(actor, organization),
+      type: 'organization.created',
+      data: { organization },
+    },
+    {
+      name: 'organization.updated',
+      run: () => dispatch.dispatchOrganizationUpdated(actor, organization, ['domain']),
+      type: 'organization.updated',
+      data: { organization, changedFields: ['domain'] },
+    },
+    {
+      name: 'organization.archived',
+      run: () => dispatch.dispatchOrganizationArchived(actor, organization),
+      type: 'organization.archived',
+      data: { organization },
+    },
+    {
+      name: 'organization.unarchived',
+      run: () => dispatch.dispatchOrganizationUnarchived(actor, organization),
+      type: 'organization.unarchived',
+      data: { organization },
+    },
+    {
+      name: 'help_center.category.created',
+      run: () => dispatch.dispatchHelpCenterCategoryCreated(actor, category),
+      type: 'help_center.category.created',
+      data: { category },
+    },
+    {
+      name: 'help_center.category.updated',
+      run: () => dispatch.dispatchHelpCenterCategoryUpdated(actor, category, ['visibility']),
+      type: 'help_center.category.updated',
+      data: { category, changedFields: ['visibility'] },
+    },
+    {
+      name: 'help_center.category.deleted',
+      run: () => dispatch.dispatchHelpCenterCategoryDeleted(actor, category),
+      type: 'help_center.category.deleted',
+      data: { category },
+    },
+    {
+      name: 'help_center.article.created',
+      run: () => dispatch.dispatchHelpCenterArticleCreated(actor, article),
+      type: 'help_center.article.created',
+      data: { article },
+    },
+    {
+      name: 'help_center.article.updated',
+      run: () => dispatch.dispatchHelpCenterArticleUpdated(actor, article, ['title']),
+      type: 'help_center.article.updated',
+      data: { article, changedFields: ['title'] },
+    },
+    {
+      name: 'help_center.article.published',
+      run: () => dispatch.dispatchHelpCenterArticlePublished(actor, article),
+      type: 'help_center.article.published',
+      data: { article },
+    },
+    {
+      name: 'help_center.article.unpublished',
+      run: () => dispatch.dispatchHelpCenterArticleUnpublished(actor, article),
+      type: 'help_center.article.unpublished',
+      data: { article },
+    },
+    {
+      name: 'help_center.article.deleted',
+      run: () => dispatch.dispatchHelpCenterArticleDeleted(actor, article),
+      type: 'help_center.article.deleted',
+      data: { article },
+    },
+    {
+      name: 'changelog.created',
+      run: () => dispatch.dispatchChangelogCreated(actor, changelog),
+      type: 'changelog.created',
+      data: { changelog },
+    },
+    {
+      name: 'changelog.updated',
+      run: () => dispatch.dispatchChangelogUpdated(actor, changelog, ['productId']),
+      type: 'changelog.updated',
+      data: { changelog, changedFields: ['productId'] },
+    },
+    {
+      name: 'changelog.deleted',
+      run: () => dispatch.dispatchChangelogDeleted(actor, changelog),
+      type: 'changelog.deleted',
+      data: { changelog },
+    },
+    {
+      name: 'segment.created',
+      run: () => dispatch.dispatchSegmentCreated(actor, segment),
+      type: 'segment.created',
+      data: { segment },
+    },
+    {
+      name: 'segment.updated',
+      run: () => dispatch.dispatchSegmentUpdated(actor, segment, ['name']),
+      type: 'segment.updated',
+      data: { segment, changedFields: ['name'] },
+    },
+    {
+      name: 'segment.deleted',
+      run: () => dispatch.dispatchSegmentDeleted(actor, segment),
+      type: 'segment.deleted',
+      data: { segment },
+    },
+    {
+      name: 'user_attribute.created',
+      run: () => dispatch.dispatchUserAttributeCreated(actor, attribute),
+      type: 'user_attribute.created',
+      data: { attribute },
+    },
+    {
+      name: 'user_attribute.updated',
+      run: () => dispatch.dispatchUserAttributeUpdated(actor, attribute, ['label']),
+      type: 'user_attribute.updated',
+      data: { attribute, changedFields: ['label'] },
+    },
+    {
+      name: 'user_attribute.deleted',
+      run: () => dispatch.dispatchUserAttributeDeleted(actor, attribute),
+      type: 'user_attribute.deleted',
+      data: { attribute },
+    },
+    {
+      name: 'board.created',
+      run: () => dispatch.dispatchBoardCreated(actor, board),
+      type: 'board.created',
+      data: { board },
+    },
+    {
+      name: 'board.updated',
+      run: () => dispatch.dispatchBoardUpdated(actor, board, ['name']),
+      type: 'board.updated',
+      data: { board, changedFields: ['name'] },
+    },
+    {
+      name: 'board.deleted',
+      run: () => dispatch.dispatchBoardDeleted(actor, board),
+      type: 'board.deleted',
+      data: { board },
+    },
+    {
+      name: 'tag.created',
+      run: () => dispatch.dispatchTagCreated(actor, tag),
+      type: 'tag.created',
+      data: { tag },
+    },
+    {
+      name: 'tag.updated',
+      run: () => dispatch.dispatchTagUpdated(actor, tag, ['color']),
+      type: 'tag.updated',
+      data: { tag, changedFields: ['color'] },
+    },
+    {
+      name: 'tag.deleted',
+      run: () => dispatch.dispatchTagDeleted(actor, tag),
+      type: 'tag.deleted',
+      data: { tag },
+    },
+    {
+      name: 'status.created',
+      run: () => dispatch.dispatchStatusCreated(actor, status),
+      type: 'status.created',
+      data: { status },
+    },
+    {
+      name: 'status.updated',
+      run: () => dispatch.dispatchStatusUpdated(actor, status, ['showOnRoadmap']),
+      type: 'status.updated',
+      data: { status, changedFields: ['showOnRoadmap'] },
+    },
+    {
+      name: 'status.deleted',
+      run: () => dispatch.dispatchStatusDeleted(actor, status),
+      type: 'status.deleted',
+      data: { status },
+    },
+    {
+      name: 'roadmap.created',
+      run: () => dispatch.dispatchRoadmapCreated(actor, roadmap),
+      type: 'roadmap.created',
+      data: { roadmap },
+    },
+    {
+      name: 'roadmap.updated',
+      run: () => dispatch.dispatchRoadmapUpdated(actor, roadmap, ['isPublic']),
+      type: 'roadmap.updated',
+      data: { roadmap, changedFields: ['isPublic'] },
+    },
+    {
+      name: 'roadmap.deleted',
+      run: () => dispatch.dispatchRoadmapDeleted(actor, roadmap),
+      type: 'roadmap.deleted',
+      data: { roadmap },
+    },
+    {
+      name: 'sla_policy.created',
+      run: () => dispatch.dispatchSlaPolicyCreated(actor, policy),
+      type: 'sla_policy.created',
+      data: { policy },
+    },
+    {
+      name: 'sla_policy.updated',
+      run: () => dispatch.dispatchSlaPolicyUpdated(actor, policy, ['enabled']),
+      type: 'sla_policy.updated',
+      data: { policy, changedFields: ['enabled'] },
+    },
+    {
+      name: 'sla_policy.archived',
+      run: () => dispatch.dispatchSlaPolicyArchived(actor, policy),
+      type: 'sla_policy.archived',
+      data: { policy },
+    },
+    {
+      name: 'routing_rule.created',
+      run: () => dispatch.dispatchRoutingRuleCreated(actor, rule),
+      type: 'routing_rule.created',
+      data: { rule },
+    },
+    {
+      name: 'routing_rule.updated',
+      run: () => dispatch.dispatchRoutingRuleUpdated(actor, rule, ['priority']),
+      type: 'routing_rule.updated',
+      data: { rule, changedFields: ['priority'] },
+    },
+    {
+      name: 'routing_rule.deleted',
+      run: () => dispatch.dispatchRoutingRuleDeleted(actor, rule),
+      type: 'routing_rule.deleted',
+      data: { rule },
+    },
+    {
+      name: 'business_hours.created',
+      run: () => dispatch.dispatchBusinessHoursCreated(actor, businessHours),
+      type: 'business_hours.created',
+      data: { businessHours },
+    },
+    {
+      name: 'business_hours.updated',
+      run: () => dispatch.dispatchBusinessHoursUpdated(actor, businessHours, ['timezone']),
+      type: 'business_hours.updated',
+      data: { businessHours, changedFields: ['timezone'] },
+    },
+    {
+      name: 'business_hours.archived',
+      run: () => dispatch.dispatchBusinessHoursArchived(actor, businessHours),
+      type: 'business_hours.archived',
+      data: { businessHours },
+    },
+    {
+      name: 'inbox_channel.created',
+      run: () => dispatch.dispatchInboxChannelCreated(actor, channel),
+      type: 'inbox_channel.created',
+      data: { channel },
+    },
+    {
+      name: 'inbox_channel.updated',
+      run: () => dispatch.dispatchInboxChannelUpdated(actor, channel, ['enabled']),
+      type: 'inbox_channel.updated',
+      data: { channel, changedFields: ['enabled'] },
+    },
+    {
+      name: 'inbox_channel.archived',
+      run: () => dispatch.dispatchInboxChannelArchived(actor, channel),
+      type: 'inbox_channel.archived',
+      data: { channel },
+    },
+    {
+      name: 'inbox_membership.added',
+      run: () => dispatch.dispatchInboxMembershipAdded(actor, membership),
+      type: 'inbox_membership.added',
+      data: { membership },
+    },
+    {
+      name: 'inbox_membership.updated',
+      run: () => dispatch.dispatchInboxMembershipUpdated(actor, membership, 'viewer'),
+      type: 'inbox_membership.updated',
+      data: { membership, previousRole: 'viewer' },
+    },
+    {
+      name: 'inbox_membership.removed',
+      run: () => dispatch.dispatchInboxMembershipRemoved(actor, membership),
+      type: 'inbox_membership.removed',
+      data: { membership },
+    },
+    {
+      name: 'api_key.created',
+      run: () => dispatch.dispatchApiKeyCreated(actor, apiKey),
+      type: 'api_key.created',
+      data: { apiKey },
+    },
+    {
+      name: 'api_key.rotated',
+      run: () => dispatch.dispatchApiKeyRotated(actor, apiKey),
+      type: 'api_key.rotated',
+      data: { apiKey },
+    },
+    {
+      name: 'api_key.revoked',
+      run: () => dispatch.dispatchApiKeyRevoked(actor, apiKey),
+      type: 'api_key.revoked',
+      data: { apiKey },
+    },
+    {
+      name: 'role.created',
+      run: () => dispatch.dispatchRoleCreated(actor, role),
+      type: 'role.created',
+      data: { role },
+    },
+    {
+      name: 'role.updated',
+      run: () => dispatch.dispatchRoleUpdated(actor, role, ['name']),
+      type: 'role.updated',
+      data: { role, changedFields: ['name'] },
+    },
+    {
+      name: 'role.deleted',
+      run: () => dispatch.dispatchRoleDeleted(actor, role),
+      type: 'role.deleted',
+      data: { role },
+    },
+    {
+      name: 'role_assignment.created',
+      run: () => dispatch.dispatchRoleAssignmentCreated(actor, assignment),
+      type: 'role_assignment.created',
+      data: { assignment },
+    },
+    {
+      name: 'role_assignment.revoked',
+      run: () => dispatch.dispatchRoleAssignmentRevoked(actor, assignment),
+      type: 'role_assignment.revoked',
+      data: { assignment },
+    },
+  ]
+
+  it.each(cases)('$name emits the expected envelope', async ({ run, type, data }) => {
+    await expectDispatched(run, { type, data })
+  })
+})
+
+describe('ticket event dispatch wrappers', () => {
+  const expectedTicket = expect.objectContaining({
+    id: 'ticket_1',
+    subject: 'Billing question',
+    statusCategory: 'open',
+    visibility: 'team',
+    ticketUrl: 'https://example.test/admin/tickets/ticket_1',
+  })
+
+  const cases: Array<{
+    name: string
+    run: () => Promise<void>
+    type: string
+    data: Record<string, unknown>
+    syncSourceIntegrationId?: string
+  }> = [
+    {
+      name: 'ticket.assigned',
+      run: () =>
+        dispatch.dispatchTicketAssigned(actor, bareTicket, 'principal_previous', 'principal_next', {
+          syncSourceIntegrationId: 'github_1',
+        }),
+      type: 'ticket.assigned',
+      syncSourceIntegrationId: 'github_1',
+      data: {
+        ticket: expectedTicket,
+        previousAssigneePrincipalId: 'principal_previous',
+        newAssigneePrincipalId: 'principal_next',
+      },
+    },
+    {
+      name: 'ticket.unassigned',
+      run: () => dispatch.dispatchTicketUnassigned(actor, bareTicket, 'principal_previous'),
+      type: 'ticket.unassigned',
+      data: { ticket: expectedTicket, previousAssigneePrincipalId: 'principal_previous' },
+    },
+    {
+      name: 'ticket.status_changed',
+      run: () =>
+        dispatch.dispatchTicketStatusChanged(actor, bareTicket, 'open', 'closed', {
+          syncSourceIntegrationId: 'zendesk_1',
+        }),
+      type: 'ticket.status_changed',
+      syncSourceIntegrationId: 'zendesk_1',
+      data: {
+        ticket: expectedTicket,
+        previousStatusCategory: 'open',
+        newStatusCategory: 'closed',
+      },
+    },
+    {
+      name: 'ticket.updated',
+      run: () =>
+        dispatch.dispatchTicketUpdated(
+          actor,
+          bareTicket,
+          ['priority'],
+          { priority: { from: 'normal', to: 'high' } },
+          { syncSourceIntegrationId: 'github_1' }
+        ),
+      type: 'ticket.updated',
+      syncSourceIntegrationId: 'github_1',
+      data: {
+        ticket: expectedTicket,
+        changedFields: ['priority'],
+        diff: { priority: { from: 'normal', to: 'high' } },
+      },
+    },
+    {
+      name: 'ticket.first_response',
+      run: () =>
+        dispatch.dispatchTicketFirstResponse(
+          actor,
+          bareTicket,
+          'thread_1',
+          '2026-06-16T12:00:00.000Z'
+        ),
+      type: 'ticket.first_response',
+      data: {
+        ticket: expectedTicket,
+        threadId: 'thread_1',
+        firstResponseAt: '2026-06-16T12:00:00.000Z',
+      },
+    },
+    {
+      name: 'ticket.thread_updated',
+      run: () =>
+        dispatch.dispatchTicketThreadUpdated(
+          actor,
+          bareTicket,
+          'thread_1',
+          'shared_team',
+          'team_2',
+          {
+            bodyTextPreview: 'Preview',
+            bodyText: 'Full internal reply',
+            bodyTextTruncated: false,
+            authorPrincipalId: 'principal_agent',
+            isFromRequester: false,
+            createdAt: new Date('2026-06-16T12:00:00.000Z'),
+            editedAt: new Date('2026-06-16T12:10:00.000Z'),
+          }
+        ),
+      type: 'ticket.thread_updated',
+      data: {
+        ticket: expectedTicket,
+        threadId: 'thread_1',
+        audience: 'shared_team',
+        sharedWithTeamId: 'team_2',
+        thread: {
+          id: 'thread_1',
+          audience: 'shared_team',
+          bodyTextPreview: 'Preview',
+          bodyText: 'Full internal reply',
+          bodyTextTruncated: false,
+          authorPrincipalId: 'principal_agent',
+          isFromRequester: false,
+          sharedWithTeamId: 'team_2',
+          createdAt: '2026-06-16T12:00:00.000Z',
+          editedAt: '2026-06-16T12:10:00.000Z',
+        },
+      },
+    },
+    {
+      name: 'ticket.participant_added',
+      run: () => dispatch.dispatchTicketParticipantAdded(actor, bareTicket, 'principal_cc', 'cc'),
+      type: 'ticket.participant_added',
+      data: { ticket: expectedTicket, addedPrincipalId: 'principal_cc', role: 'cc' },
+    },
+    {
+      name: 'ticket.participant_removed',
+      run: () => dispatch.dispatchTicketParticipantRemoved(actor, bareTicket, 'principal_cc'),
+      type: 'ticket.participant_removed',
+      data: { ticket: expectedTicket, removedPrincipalId: 'principal_cc' },
+    },
+    {
+      name: 'ticket.shared',
+      run: () => dispatch.dispatchTicketShared(actor, bareTicket, 'team_2', 'comment'),
+      type: 'ticket.shared',
+      data: { ticket: expectedTicket, teamId: 'team_2', accessLevel: 'comment' },
+    },
+    {
+      name: 'ticket.unshared',
+      run: () => dispatch.dispatchTicketUnshared(actor, bareTicket, 'team_2'),
+      type: 'ticket.unshared',
+      data: { ticket: expectedTicket, teamId: 'team_2' },
+    },
+    {
+      name: 'ticket.sla_warning',
+      run: () => dispatch.dispatchTicketSlaWarning(actor, bareTicket, 'first_response', 'Gold'),
+      type: 'ticket.sla_warning',
+      data: { ticket: expectedTicket, kind: 'first_response', ruleName: 'Gold' },
+    },
+    {
+      name: 'ticket.sla_breach',
+      run: () => dispatch.dispatchTicketSlaBreach(actor, bareTicket, 'resolution'),
+      type: 'ticket.sla_breach',
+      data: { ticket: expectedTicket, kind: 'resolution' },
+    },
+    {
+      name: 'ticket.restored',
+      run: () => dispatch.dispatchTicketRestored(actor, bareTicket, 'principal_admin'),
+      type: 'ticket.restored',
+      data: { ticket: expectedTicket, restoredByPrincipalId: 'principal_admin' },
+    },
+    {
+      name: 'ticket.attachment_added',
+      run: () =>
+        dispatch.dispatchTicketAttachmentAdded(actor, bareTicket, {
+          id: 'attachment_1',
+          threadId: 'thread_1',
+          filename: 'invoice.pdf',
+          mimeType: 'application/pdf',
+          sizeBytes: 2048,
+          uploadedByPrincipalId: 'principal_admin',
+          publicUrl: null,
+        }),
+      type: 'ticket.attachment_added',
+      data: {
+        ticket: expectedTicket,
+        attachment: {
+          id: 'attachment_1',
+          threadId: 'thread_1',
+          filename: 'invoice.pdf',
+          mimeType: 'application/pdf',
+          sizeBytes: 2048,
+          uploadedByPrincipalId: 'principal_admin',
+          publicUrl: null,
+        },
+      },
+    },
+    {
+      name: 'ticket.attachment_removed',
+      run: () =>
+        dispatch.dispatchTicketAttachmentRemoved(
+          actor,
+          bareTicket,
+          { id: 'attachment_1', threadId: 'thread_1', filename: 'invoice.pdf' },
+          'principal_admin'
+        ),
+      type: 'ticket.attachment_removed',
+      data: {
+        ticket: expectedTicket,
+        attachment: { id: 'attachment_1', threadId: 'thread_1', filename: 'invoice.pdf' },
+        removedByPrincipalId: 'principal_admin',
+      },
+    },
+    {
+      name: 'ticket.deleted',
+      run: () =>
+        dispatch.dispatchTicketDeleted(actor, bareTicket, 'principal_admin', {
+          syncSourceIntegrationId: 'github_1',
+        }),
+      type: 'ticket.deleted',
+      syncSourceIntegrationId: 'github_1',
+      data: { ticket: expectedTicket, deletedByPrincipalId: 'principal_admin' },
+    },
+  ]
+
+  it.each(cases)('$name emits the expected payload', async (testCase) => {
+    await expectDispatched(testCase.run, testCase)
+  })
+})
+
+describe('dispatch fallback email delivery', () => {
+  it('sends email targets synchronously when event processing fails', async () => {
+    const target = {
+      type: 'email',
+      target: { email: 'owner@example.com' },
+      config: { subject: 'Fallback delivery' },
+    }
+    processEvent.mockRejectedValueOnce(new Error('queue unavailable'))
+    getHookTargets.mockResolvedValueOnce([
+      target,
+      { type: 'webhook', target: { url: 'https://example.com/hook' }, config: {} },
+    ])
+
+    await dispatch.dispatchBoardCreated(actor, board)
+
+    const event = processEvent.mock.calls[0]?.[0]
+    expect(getHookTargets).toHaveBeenCalledWith(event)
+    expect(emailHookRun).toHaveBeenCalledWith(event, target.target, target.config)
+    expect(logError).toHaveBeenCalledWith(
+      expect.objectContaining({ event_type: 'board.created' }),
+      'failed to process event'
+    )
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/hook-context.test.ts b/apps/web/src/lib/server/events/__tests__/hook-context.test.ts
new file mode 100644
index 000000000..f67005a74
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/hook-context.test.ts
@@ -0,0 +1,133 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  baseUrl: 'http://localhost:3000',
+  settingsFindFirst: vi.fn(),
+}))
+
+vi.mock('@/lib/server/config', () => ({
+  getBaseUrl: () => mocks.baseUrl,
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      settings: {
+        findFirst: (...args: unknown[]) => mocks.settingsFindFirst(...args),
+      },
+    },
+  },
+}))
+
+vi.mock('@/lib/server/storage/s3', () => ({
+  getEmailSafeUrl: vi.fn(),
+}))
+
+vi.mock('@/lib/server/logger', () => ({
+  logger: {
+    child: () => ({ error: vi.fn() }),
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequestHeaders: vi.fn(() => new Headers()),
+}))
+
+import { resolvePublicBaseUrl, rewriteUrlToPublicBaseUrl } from '@/lib/server/public-url'
+import { getEmailSafeUrl } from '@/lib/server/storage/s3'
+import { buildHookContext } from '../hook-context'
+
+function headers(input: Record<string, string>): Headers {
+  return new Headers(input)
+}
+
+describe('resolvePublicBaseUrl', () => {
+  beforeEach(() => {
+    mocks.baseUrl = 'http://localhost:3000'
+    mocks.settingsFindFirst.mockReset()
+    vi.mocked(getEmailSafeUrl).mockReset()
+  })
+
+  it('uses the current forwarded HTTPS origin when BASE_URL is local', () => {
+    expect(
+      resolvePublicBaseUrl(
+        headers({
+          host: 'localhost:3000',
+          'x-forwarded-host': 'epic-shoppers-automotive-invited.trycloudflare.com',
+          'x-forwarded-proto': 'https',
+        })
+      )
+    ).toBe('https://epic-shoppers-automotive-invited.trycloudflare.com')
+  })
+
+  it('keeps an externally usable configured base URL', () => {
+    mocks.baseUrl = 'https://feedback.example.com/'
+
+    expect(
+      resolvePublicBaseUrl(
+        headers({
+          host: 'localhost:3000',
+          'x-forwarded-host': 'epic-shoppers-automotive-invited.trycloudflare.com',
+          'x-forwarded-proto': 'https',
+        })
+      )
+    ).toBe('https://feedback.example.com')
+  })
+
+  it('falls back to BASE_URL for local request origins', () => {
+    expect(
+      resolvePublicBaseUrl(
+        headers({
+          host: 'localhost:3000',
+          'x-forwarded-proto': 'http',
+        })
+      )
+    ).toBe('http://localhost:3000')
+  })
+
+  it('rewrites localhost auth email links to the forwarded public origin', () => {
+    expect(
+      rewriteUrlToPublicBaseUrl(
+        'http://localhost:3000/auth/reset-password?token=reset-token',
+        headers({
+          host: 'localhost:3000',
+          'x-forwarded-host': 'epic-shoppers-automotive-invited.trycloudflare.com',
+          'x-forwarded-proto': 'https',
+        })
+      )
+    ).toBe(
+      'https://epic-shoppers-automotive-invited.trycloudflare.com/auth/reset-password?token=reset-token'
+    )
+  })
+})
+
+describe('buildHookContext', () => {
+  beforeEach(() => {
+    mocks.baseUrl = 'https://feedback.example.com'
+    mocks.settingsFindFirst.mockReset()
+    vi.mocked(getEmailSafeUrl).mockReset()
+  })
+
+  it('returns workspace name, public portal URL, and safe logo URL from settings', async () => {
+    mocks.settingsFindFirst.mockResolvedValue({
+      name: 'Acme Support',
+      logoKey: 'logos/acme.png',
+    })
+    vi.mocked(getEmailSafeUrl).mockReturnValue('https://cdn.example.com/logos/acme.png')
+
+    await expect(buildHookContext()).resolves.toEqual({
+      workspaceName: 'Acme Support',
+      portalBaseUrl: 'https://feedback.example.com',
+      logoUrl: 'https://cdn.example.com/logos/acme.png',
+    })
+    expect(mocks.settingsFindFirst).toHaveBeenCalledWith({
+      columns: { name: true, logoKey: true },
+    })
+  })
+
+  it('returns null when workspace settings are missing', async () => {
+    mocks.settingsFindFirst.mockResolvedValue(null)
+
+    await expect(buildHookContext()).resolves.toBeNull()
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/integration-target-coverage.test.ts b/apps/web/src/lib/server/events/__tests__/integration-target-coverage.test.ts
index 6a64d0cbf..a7023283b 100644
--- a/apps/web/src/lib/server/events/__tests__/integration-target-coverage.test.ts
+++ b/apps/web/src/lib/server/events/__tests__/integration-target-coverage.test.ts
@@ -28,13 +28,29 @@ vi.mock('@/lib/server/redis', () => ({
 }))
 
 // --- DB mock (mappings come from the cache mock, so the select chain is unused) ---
-vi.mock('@/lib/server/db', () => ({
+vi.mock('@/lib/server/db', async (importOriginal) => ({
+  // Spread the real module (db is a lazy Proxy ⇒ no connection) so transitively
+  // imported exports like `ticketSubscriptions` resolve; the explicit overrides
+  // below still win for everything this test inspects.
+  ...(await importOriginal<typeof import('@/lib/server/db')>()),
   db: {
     select: () => ({ from: () => ({ innerJoin: () => ({ where: () => [] }) }) }),
     query: { webhooks: { findMany: vi.fn().mockResolvedValue([]) } },
   },
-  integrations: { id: 'id', integrationType: 'integrationType', secrets: 'secrets', config: 'config', status: 'status' },
-  integrationEventMappings: { integrationId: 'integrationId', eventType: 'eventType', actionConfig: 'actionConfig', filters: 'filters', enabled: 'enabled' },
+  integrations: {
+    id: 'id',
+    integrationType: 'integrationType',
+    secrets: 'secrets',
+    config: 'config',
+    status: 'status',
+  },
+  integrationEventMappings: {
+    integrationId: 'integrationId',
+    eventType: 'eventType',
+    actionConfig: 'actionConfig',
+    filters: 'filters',
+    enabled: 'enabled',
+  },
   webhooks: { status: 'status', deletedAt: 'deletedAt', $inferSelect: {} },
   eq: vi.fn(),
   and: vi.fn(),
@@ -79,7 +95,10 @@ const { listIntegrationTypes, getIntegrationHook } = await import('@/lib/server/
  * Enrichment hooks that store NO channelId at connect time are listed in
  * KNOWN_UNRESOLVED below, not here — do not fabricate a channelId for them.
  */
-const CONNECTED_FIXTURES: Record<string, { integrationConfig?: Record<string, unknown>; actionConfig?: Record<string, unknown> }> = {
+const CONNECTED_FIXTURES: Record<
+  string,
+  { integrationConfig?: Record<string, unknown>; actionConfig?: Record<string, unknown> }
+> = {
   slack: { actionConfig: { channelId: 'C1' } },
   discord: { actionConfig: { channelId: 'C1' } },
   teams: { integrationConfig: { channelId: 'C1' } },
diff --git a/apps/web/src/lib/server/events/__tests__/process.test.ts b/apps/web/src/lib/server/events/__tests__/process.test.ts
index 2d4e5991f..85e7e88ee 100644
--- a/apps/web/src/lib/server/events/__tests__/process.test.ts
+++ b/apps/web/src/lib/server/events/__tests__/process.test.ts
@@ -6,13 +6,23 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from 'vitest'
-import type { PostCreatedEvent } from '../types'
+import type { EventData, PostCreatedEvent } from '../types'
 
 // --- Mocks ---
 
 const mockQueueAddBulk = vi.fn().mockResolvedValue(undefined)
 const mockQueueClose = vi.fn().mockResolvedValue(undefined)
 const mockWorkerClose = vi.fn().mockResolvedValue(undefined)
+const insertMocks = vi.hoisted(() => {
+  const onConflictDoNothing = vi.fn().mockResolvedValue(undefined)
+  const values = vi.fn(() => ({
+    onConflictDoNothing,
+  }))
+  const dbInsert = vi.fn(() => ({
+    values,
+  }))
+  return { dbInsert, values, onConflictDoNothing }
+})
 
 // Captured once when the Worker is constructed (module-level singleton)
 let capturedProcessor: ((job: unknown) => Promise<void>) | null = null
@@ -63,12 +73,15 @@ vi.mock('../registry', () => ({
 // db mock: inline to avoid hoisting issues. Access via import for assertions.
 vi.mock('@/lib/server/db', () => ({
   db: {
+    insert: insertMocks.dbInsert,
     update: vi.fn(() => ({
       set: vi.fn(() => ({
         where: vi.fn().mockResolvedValue(undefined),
       })),
     })),
   },
+  ticketExternalLinks: { _name: 'ticketExternalLinks' },
+  postExternalLinks: { _name: 'postExternalLinks' },
   webhooks: {
     id: 'id',
     failureCount: 'failureCount',
@@ -115,6 +128,21 @@ function makeJob(overrides: Record<string, unknown> = {}) {
   }
 }
 
+function makeTicketCreatedEvent(): EventData {
+  return {
+    id: 'evt-ticket-created',
+    type: 'ticket.created',
+    timestamp: '2026-06-16T00:00:00.000Z',
+    actor: { type: 'user', principalId: 'principal_1' },
+    data: {
+      ticket: {
+        id: 'ticket_1',
+        subject: 'Billing question',
+      },
+    },
+  } as EventData
+}
+
 // --- Bootstrap ---
 // Import once to initialize the module. The first processEvent call with targets
 // triggers ensureQueue() which creates the Queue and Worker singletons.
@@ -190,6 +218,99 @@ describe('Event Processing (BullMQ)', () => {
       expect(mockHook.run).toHaveBeenCalled()
     })
 
+    it('persists ticket external links for successful ticket.created hook results', async () => {
+      await ensureInitialized()
+      const mockHook = {
+        run: vi.fn().mockResolvedValue({
+          success: true,
+          externalId: 'EXT-123',
+          externalDisplayId: 'SUP-123',
+          externalUrl: 'https://github.example/issues/123',
+        }),
+      }
+      mockGetHook.mockReturnValue(mockHook)
+
+      await capturedProcessor!(
+        makeJob({
+          data: {
+            hookType: 'github',
+            event: makeTicketCreatedEvent(),
+            target: {},
+            config: { integrationId: 'integration_1' },
+          },
+        })
+      )
+
+      expect(insertMocks.dbInsert).toHaveBeenCalledWith({ _name: 'ticketExternalLinks' })
+      expect(insertMocks.values).toHaveBeenCalledWith({
+        ticketId: 'ticket_1',
+        integrationId: 'integration_1',
+        integrationType: 'github',
+        externalId: 'EXT-123',
+        externalDisplayId: 'SUP-123',
+        externalUrl: 'https://github.example/issues/123',
+        syncDirection: 'outbound',
+      })
+      expect(insertMocks.onConflictDoNothing).toHaveBeenCalled()
+    })
+
+    it('persists post external links for successful post.created hook results', async () => {
+      await ensureInitialized()
+      const mockHook = {
+        run: vi.fn().mockResolvedValue({
+          success: true,
+          externalId: 'LIN-123',
+        }),
+      }
+      mockGetHook.mockReturnValue(mockHook)
+
+      await capturedProcessor!(
+        makeJob({
+          data: {
+            hookType: 'linear',
+            event: makeEvent(),
+            target: {},
+            config: { integrationId: 'integration_linear' },
+          },
+        })
+      )
+
+      expect(insertMocks.dbInsert).toHaveBeenCalledWith({ _name: 'postExternalLinks' })
+      expect(insertMocks.values).toHaveBeenCalledWith({
+        postId: 'post_1',
+        integrationId: 'integration_linear',
+        integrationType: 'linear',
+        externalId: 'LIN-123',
+        externalDisplayId: null,
+        externalUrl: null,
+      })
+      expect(insertMocks.onConflictDoNothing).toHaveBeenCalled()
+    })
+
+    it('does not persist external links when integrationId is missing', async () => {
+      await ensureInitialized()
+      const mockHook = {
+        run: vi.fn().mockResolvedValue({
+          success: true,
+          externalId: 'EXT-123',
+        }),
+      }
+      mockGetHook.mockReturnValue(mockHook)
+
+      await capturedProcessor!(
+        makeJob({
+          data: {
+            hookType: 'github',
+            event: makeTicketCreatedEvent(),
+            target: {},
+            config: {},
+          },
+        })
+      )
+
+      expect(insertMocks.dbInsert).not.toHaveBeenCalled()
+    })
+
     it('throws UnrecoverableError for unknown hook type', async () => {
       await ensureInitialized()
       mockGetHook.mockReturnValue(undefined)
diff --git a/apps/web/src/lib/server/events/__tests__/sample-payloads.contact-org.test.ts b/apps/web/src/lib/server/events/__tests__/sample-payloads.contact-org.test.ts
new file mode 100644
index 000000000..be5e7be8f
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/sample-payloads.contact-org.test.ts
@@ -0,0 +1,64 @@
+/**
+ * Phase 5: ensure CRM event types have well-formed sample payloads so
+ * the test-fire endpoint and create/edit dialog preview accordion work
+ * for every new event.
+ */
+import { describe, it, expect } from 'vitest'
+import { getSampleEventPayload } from '../sample-payloads'
+import type { EventType } from '../types'
+
+const CRM_EVENTS: EventType[] = [
+  'contact.created',
+  'contact.updated',
+  'contact.archived',
+  'contact.linked',
+  'contact.unlinked',
+  'organization.created',
+  'organization.updated',
+  'organization.archived',
+  'organization.unarchived',
+]
+
+describe('sample-payloads — CRM events (Phase 5)', () => {
+  it.each(CRM_EVENTS)('returns a well-formed envelope for %s', (eventType) => {
+    const sample = getSampleEventPayload(eventType)
+    expect(sample.type).toBe(eventType)
+    expect(sample.id).toMatch(/^evt_sample_/)
+    expect(sample.timestamp).toBeTruthy()
+    expect(sample.actor).toBeTruthy()
+    expect(sample.data).toBeTruthy()
+  })
+
+  it('contact.* samples carry a contact ref', () => {
+    for (const t of CRM_EVENTS.filter((e) => e.startsWith('contact.'))) {
+      const s = getSampleEventPayload(t)
+      // @ts-expect-error narrow at runtime
+      expect(s.data.contact?.id).toBe('contact_sample')
+    }
+  })
+
+  it('organization.* samples carry an organization ref', () => {
+    for (const t of CRM_EVENTS.filter((e) => e.startsWith('organization.'))) {
+      const s = getSampleEventPayload(t)
+      // @ts-expect-error narrow at runtime
+      expect(s.data.organization?.id).toBe('org_sample')
+    }
+  })
+
+  it('contact.updated and organization.updated carry changedFields', () => {
+    const c = getSampleEventPayload('contact.updated')
+    const o = getSampleEventPayload('organization.updated')
+    // @ts-expect-error narrow at runtime
+    expect(Array.isArray(c.data.changedFields)).toBe(true)
+    // @ts-expect-error narrow at runtime
+    expect(Array.isArray(o.data.changedFields)).toBe(true)
+  })
+
+  it('contact.linked carries userId + linkedByPrincipalId', () => {
+    const s = getSampleEventPayload('contact.linked')
+    // @ts-expect-error narrow at runtime
+    expect(s.data.userId).toBeTruthy()
+    // @ts-expect-error narrow at runtime
+    expect(s.data.linkedByPrincipalId).toBeTruthy()
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/sample-payloads.test.ts b/apps/web/src/lib/server/events/__tests__/sample-payloads.test.ts
new file mode 100644
index 000000000..745f88805
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/sample-payloads.test.ts
@@ -0,0 +1,40 @@
+/**
+ * Coverage guard: every EVENT_TYPE must have a canonical sample payload, and
+ * each sample's envelope `type` must match its key. Keeps the test-fire +
+ * preview UI honest as new event ids are added.
+ */
+import { describe, it, expect } from 'vitest'
+import { EVENT_TYPES } from '../types'
+import {
+  getSampleEventPayload,
+  getAllSampleEventPayloads,
+  SAMPLE_EVENT_ID_PREFIX,
+} from '../sample-payloads'
+
+describe('sample event payloads', () => {
+  it('has a sample for every EVENT_TYPE', () => {
+    for (const type of EVENT_TYPES) {
+      const sample = getSampleEventPayload(type)
+      expect(sample, `missing sample for ${type}`).toBeDefined()
+      expect(sample.type).toBe(type)
+    }
+  })
+
+  it('returns a record keyed by every event type', () => {
+    const all = getAllSampleEventPayloads()
+    expect(Object.keys(all).sort()).toEqual([...EVENT_TYPES].sort())
+  })
+
+  it('uses the documented sample-id prefix on every envelope', () => {
+    for (const type of EVENT_TYPES) {
+      const sample = getSampleEventPayload(type)
+      expect(sample.id.startsWith(SAMPLE_EVENT_ID_PREFIX), `bad id prefix for ${type}`).toBe(true)
+    }
+  })
+
+  it('marks the actor as service so production logic can short-circuit', () => {
+    for (const type of EVENT_TYPES) {
+      expect(getSampleEventPayload(type).actor.type).toBe('service')
+    }
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/segment-scheduler.gap.test.ts b/apps/web/src/lib/server/events/__tests__/segment-scheduler.gap.test.ts
new file mode 100644
index 000000000..7d2fcf95f
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/segment-scheduler.gap.test.ts
@@ -0,0 +1,117 @@
+/**
+ * Gap coverage for segment-scheduler: the disabled-schedule early return,
+ * the remove-by-key found path, the init-failure reset (line ~65 branch),
+ * the restoreAll happy + catch paths, and graceful close.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const h = vi.hoisted(() => ({
+  waitUntilReady: vi.fn().mockResolvedValue(undefined),
+  evaluateDynamicSegment: vi.fn(),
+  dbSelectWhere: vi.fn().mockResolvedValue([]),
+}))
+
+const queueInstances: Array<Record<string, ReturnType<typeof vi.fn>>> = []
+
+vi.mock('@/lib/server/config', () => ({
+  config: { redisUrl: 'redis://localhost:6379' },
+}))
+
+vi.mock('@/lib/server/queue/redis-config', () => ({
+  getQueueRedis: vi.fn(() => ({})),
+  REDIS_READY_TIMEOUT_MS: 5000,
+}))
+
+vi.mock('bullmq', () => {
+  class Queue {
+    add = vi.fn().mockResolvedValue(undefined)
+    getRepeatableJobs = vi.fn().mockResolvedValue([])
+    removeRepeatableByKey = vi.fn().mockResolvedValue(undefined)
+    waitUntilReady = (...a: unknown[]) => h.waitUntilReady(...a)
+    close = vi.fn().mockResolvedValue(undefined)
+    constructor() {
+      queueInstances.push(this as never)
+    }
+  }
+  class Worker {
+    on = vi.fn()
+    close = vi.fn().mockResolvedValue(undefined)
+  }
+  class UnrecoverableError extends Error {}
+  return { Queue, Worker, UnrecoverableError }
+})
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: () => ({
+      from: () => ({ where: h.dbSelectWhere }),
+    }),
+  },
+  segments: { id: 's.id', type: 's.type', evaluationSchedule: 's.sched', deletedAt: 's.del' },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+}))
+
+vi.mock('@/lib/server/domains/segments/segment.evaluation', () => ({
+  evaluateDynamicSegment: h.evaluateDynamicSegment,
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  queueInstances.length = 0
+  h.waitUntilReady.mockResolvedValue(undefined)
+  h.dbSelectWhere.mockResolvedValue([])
+})
+
+describe('segment-scheduler gap', () => {
+  it('disabled schedule removes existing but does not add', async () => {
+    const mod = await import('../segment-scheduler')
+    await mod.upsertSegmentEvaluationSchedule('segment_x' as never, {
+      enabled: false,
+      pattern: '0 * * * *',
+    })
+    const queue = queueInstances[0]
+    expect(queue.add).not.toHaveBeenCalled()
+    await mod.closeSegmentScheduler()
+  })
+
+  it('removeSegmentEvaluationSchedule removes the matching repeatable job', async () => {
+    const mod = await import('../segment-scheduler')
+    // Trigger queue creation
+    await mod.listEvaluationSchedules()
+    const queue = queueInstances[0]
+    queue.getRepeatableJobs.mockResolvedValue([
+      { name: 'segment-eval:segment_match', key: 'key-1' },
+      { name: 'other', key: 'key-2' },
+    ])
+    await mod.removeSegmentEvaluationSchedule('segment_match' as never)
+    expect(queue.removeRepeatableByKey).toHaveBeenCalledWith('key-1')
+    await mod.closeSegmentScheduler()
+  })
+
+  it('restoreAllEvaluationSchedules schedules enabled dynamic segments and skips disabled', async () => {
+    h.dbSelectWhere.mockResolvedValue([
+      { id: 'seg_enabled', evaluationSchedule: { enabled: true, pattern: '0 * * * *' } },
+      { id: 'seg_disabled', evaluationSchedule: { enabled: false, pattern: '0 * * * *' } },
+      { id: 'seg_null', evaluationSchedule: null },
+    ])
+    const mod = await import('../segment-scheduler')
+    await mod.restoreAllEvaluationSchedules()
+    const queue = queueInstances[0]
+    expect(queue.add).toHaveBeenCalledTimes(1)
+    await mod.closeSegmentScheduler()
+  })
+
+  it('restoreAllEvaluationSchedules swallows db errors', async () => {
+    h.dbSelectWhere.mockRejectedValue(new Error('db down'))
+    const mod = await import('../segment-scheduler')
+    await expect(mod.restoreAllEvaluationSchedules()).resolves.toBeUndefined()
+  })
+
+  it('closeSegmentScheduler is a no-op when never initialized', async () => {
+    vi.resetModules()
+    const mod = await import('../segment-scheduler')
+    await expect(mod.closeSegmentScheduler()).resolves.toBeUndefined()
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/targets-cache.test.ts b/apps/web/src/lib/server/events/__tests__/targets-cache.test.ts
index c7c41b5cf..52dc72f99 100644
--- a/apps/web/src/lib/server/events/__tests__/targets-cache.test.ts
+++ b/apps/web/src/lib/server/events/__tests__/targets-cache.test.ts
@@ -34,7 +34,11 @@ const mockInnerJoin = vi.fn()
 const mockDbWhere = vi.fn()
 const mockFindMany = vi.fn()
 
-vi.mock('@/lib/server/db', () => ({
+vi.mock('@/lib/server/db', async (importOriginal) => ({
+  // Spread the real module (db is a lazy Proxy ⇒ no connection) so transitively
+  // imported exports like `ticketSubscriptions` resolve; the explicit overrides
+  // below still win for everything this test inspects.
+  ...(await importOriginal<typeof import('@/lib/server/db')>()),
   db: {
     select: (...args: unknown[]) => mockSelect(...args),
     query: {
diff --git a/apps/web/src/lib/server/events/__tests__/targets-inbox-filter.test.ts b/apps/web/src/lib/server/events/__tests__/targets-inbox-filter.test.ts
new file mode 100644
index 000000000..edbb3a599
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/targets-inbox-filter.test.ts
@@ -0,0 +1,295 @@
+/**
+ * Phase 4: per-inbox webhook filter tests for `getHookTargets`.
+ *
+ * Verifies the new `inboxIds` filter behaves like the existing `boardIds`
+ * filter for ticket events. Uses the same mock surface as
+ * `targets-cache.test.ts` so the two suites stay close in style.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const mockCacheGet = vi.fn()
+const mockCacheSet = vi.fn()
+
+vi.mock('@/lib/server/redis', () => ({
+  cacheGet: (...args: unknown[]) => mockCacheGet(...args),
+  cacheSet: (...args: unknown[]) => mockCacheSet(...args),
+  cacheDel: vi.fn(),
+  CACHE_KEYS: {
+    TENANT_SETTINGS: 'settings:tenant',
+    INTEGRATION_MAPPINGS: 'hooks:integration-mappings',
+    ACTIVE_WEBHOOKS: 'hooks:webhooks-active',
+    SLACK_CHANNELS: 'slack:channels',
+  },
+}))
+
+const mockSelect = vi.fn()
+const mockFrom = vi.fn()
+const mockInnerJoin = vi.fn()
+const mockDbWhere = vi.fn()
+const mockFindMany = vi.fn()
+
+vi.mock('@/lib/server/db', async (importOriginal) => ({
+  // Spread the real module (db is a lazy Proxy ⇒ no connection) so transitively
+  // imported exports like `ticketSubscriptions` resolve; the explicit overrides
+  // below still win for everything this test inspects.
+  ...(await importOriginal<typeof import('@/lib/server/db')>()),
+  db: {
+    select: (...args: unknown[]) => mockSelect(...args),
+    query: {
+      webhooks: { findMany: (...args: unknown[]) => mockFindMany(...args) },
+    },
+  },
+  integrations: {},
+  integrationEventMappings: {},
+  webhooks: { status: 'status', deletedAt: 'deletedAt', $inferSelect: {} },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  inArray: vi.fn(),
+  principal: {},
+}))
+
+vi.mock('@/lib/server/integrations/encryption', () => ({
+  decryptSecrets: vi.fn((s: string) => JSON.parse(s)),
+}))
+vi.mock('@/lib/server/domains/webhooks/encryption', () => ({
+  decryptWebhookSecret: vi.fn((s: string) => s),
+}))
+vi.mock('@/lib/server/domains/subscriptions/subscription.service', () => ({
+  getSubscribersForEvent: vi.fn().mockResolvedValue([]),
+  batchGetNotificationPreferences: vi.fn().mockResolvedValue(new Map()),
+  batchGenerateUnsubscribeTokens: vi.fn().mockResolvedValue(new Map()),
+}))
+vi.mock('@/lib/server/domains/ai/config', () => ({
+  getOpenAI: vi.fn().mockReturnValue(null),
+}))
+vi.mock('../hook-context', () => ({
+  buildHookContext: vi.fn().mockResolvedValue({
+    workspaceName: 'Test',
+    portalBaseUrl: 'https://test.quackback.io',
+  }),
+}))
+vi.mock('../hook-utils', () => ({
+  stripHtml: vi.fn((s: string) => s),
+  truncate: vi.fn((s: string) => s),
+}))
+// Out of scope for this suite: ticket *email* targets are a separate concern
+// (own DB queries). Left unmocked, getTicketEmailTargets runs for every
+// ticket.* event and throws on the unmocked DB, which getHookTargets swallows
+// into an empty result — silently zeroing the webhook/integration targets this
+// suite asserts on. Stub it to [] so we isolate inbox-filter behaviour.
+vi.mock('../ticket-targets', () => ({
+  getTicketEmailTargets: vi.fn().mockResolvedValue([]),
+}))
+
+const { getHookTargets } = await import('../targets')
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockCacheGet.mockResolvedValue(null)
+  mockCacheSet.mockResolvedValue(undefined)
+  mockDbWhere.mockResolvedValue([])
+  mockInnerJoin.mockReturnValue({ where: mockDbWhere })
+  mockFrom.mockReturnValue({ innerJoin: mockInnerJoin })
+  mockSelect.mockReturnValue({ from: mockFrom })
+})
+
+function makeTicketCreatedEvent(inboxId: string | null) {
+  return {
+    id: 'evt-tkt-1',
+    type: 'ticket.created' as const,
+    timestamp: '2025-01-01T00:00:00Z',
+    actor: { type: 'user' as const, userId: 'user_1', email: 't@t.com' },
+    data: {
+      ticket: {
+        id: 'ticket_1',
+        subject: 'help',
+        descriptionText: null,
+        statusId: 'tstatus_open',
+        statusCategory: 'open',
+        priority: 'normal',
+        channel: 'portal',
+        visibility: 'team',
+        inboxId,
+        primaryTeamId: null,
+        assigneePrincipalId: null,
+        assigneeTeamId: null,
+        requesterPrincipalId: null,
+        requesterContactId: null,
+      },
+    },
+  }
+}
+
+function makePostCreatedEvent() {
+  return {
+    id: 'evt-post-1',
+    type: 'post.created' as const,
+    timestamp: '2025-01-01T00:00:00Z',
+    actor: { type: 'user' as const, userId: 'user_1', email: 't@t.com' },
+    data: {
+      post: {
+        id: 'post_1',
+        title: 'T',
+        content: 'C',
+        boardId: 'board_1',
+        boardSlug: 'bugs',
+        voteCount: 0,
+      },
+    },
+  }
+}
+
+function setActiveWebhooks(rows: unknown[]) {
+  // Key the cache by its actual key rather than call order — getHookTargets
+  // issues several cacheGet calls (integration mappings, then webhooks) and the
+  // intermediate ordering is not stable, so an ordered mockResolvedValueOnce
+  // queue mis-assigns the webhook rows. '[]' for every other key is a safe
+  // empty cache hit (avoids unmocked DB fallbacks).
+  mockCacheGet.mockImplementation((key: string) =>
+    Promise.resolve(key === 'hooks:webhooks-active' ? rows : [])
+  )
+}
+
+function setActiveIntegrationMappings(rows: unknown[]) {
+  mockCacheGet.mockImplementation((key: string) =>
+    Promise.resolve(key === 'hooks:integration-mappings' ? rows : [])
+  )
+}
+
+function makeGitHubTicketMapping(filters: { inboxIds?: string[] } | null) {
+  return {
+    integrationId: 'integration_1',
+    eventType: 'ticket.created',
+    integrationType: 'github',
+    secrets: JSON.stringify({ accessToken: 'ghs_test' }),
+    integrationConfig: {
+      channelId: 'quackback/repo',
+      syncDirection: 'outbound',
+    },
+    actionConfig: {},
+    filters,
+  }
+}
+
+describe('getHookTargets — inbox filter (Phase 4)', () => {
+  it('matches a ticket event when inboxIds includes the event inbox', async () => {
+    setActiveWebhooks([
+      {
+        id: 'wh_1',
+        url: 'https://example.com/hook',
+        secret: 'sec',
+        events: ['ticket.created'],
+        boardIds: null,
+        inboxIds: ['inbox_1'],
+        status: 'active',
+      },
+    ])
+    const targets = await getHookTargets(makeTicketCreatedEvent('inbox_1'))
+    expect(targets.filter((t) => t.type === 'webhook')).toHaveLength(1)
+  })
+
+  it('excludes a ticket event when inboxIds does not include the event inbox', async () => {
+    setActiveWebhooks([
+      {
+        id: 'wh_1',
+        url: 'https://example.com/hook',
+        secret: 'sec',
+        events: ['ticket.created'],
+        boardIds: null,
+        inboxIds: ['inbox_2'],
+        status: 'active',
+      },
+    ])
+    const targets = await getHookTargets(makeTicketCreatedEvent('inbox_1'))
+    expect(targets.filter((t) => t.type === 'webhook')).toHaveLength(0)
+  })
+
+  it('matches any ticket event when inboxIds is null (backwards compat)', async () => {
+    setActiveWebhooks([
+      {
+        id: 'wh_1',
+        url: 'https://example.com/hook',
+        secret: 'sec',
+        events: ['ticket.created'],
+        boardIds: null,
+        inboxIds: null,
+        status: 'active',
+      },
+    ])
+    const targets = await getHookTargets(makeTicketCreatedEvent('inbox_anything'))
+    expect(targets.filter((t) => t.type === 'webhook')).toHaveLength(1)
+  })
+
+  it('does NOT constrain non-ticket events', async () => {
+    setActiveWebhooks([
+      {
+        id: 'wh_1',
+        url: 'https://example.com/hook',
+        secret: 'sec',
+        events: ['post.created'],
+        boardIds: null,
+        // Inbox filter is set but the event is post.created — must still match.
+        inboxIds: ['inbox_1'],
+        status: 'active',
+      },
+    ])
+    const targets = await getHookTargets(makePostCreatedEvent())
+    expect(targets.filter((t) => t.type === 'webhook')).toHaveLength(1)
+  })
+
+  it('excludes ticket events with null inboxId from inbox-filtered webhooks (opt-in)', async () => {
+    setActiveWebhooks([
+      {
+        id: 'wh_1',
+        url: 'https://example.com/hook',
+        secret: 'sec',
+        events: ['ticket.created'],
+        boardIds: null,
+        inboxIds: ['inbox_1'],
+        status: 'active',
+      },
+    ])
+    const targets = await getHookTargets(makeTicketCreatedEvent(null))
+    expect(targets.filter((t) => t.type === 'webhook')).toHaveLength(0)
+  })
+
+  it('matches a ticket integration mapping when inboxIds includes the event inbox', async () => {
+    setActiveIntegrationMappings([makeGitHubTicketMapping({ inboxIds: ['inbox_1'] })])
+
+    const targets = await getHookTargets(makeTicketCreatedEvent('inbox_1'))
+
+    const githubTargets = targets.filter((t) => t.type === 'github')
+    expect(githubTargets).toHaveLength(1)
+    expect(githubTargets[0].target).toEqual({ channelId: 'quackback/repo' })
+    expect(githubTargets[0].config).toMatchObject({
+      accessToken: 'ghs_test',
+      integrationId: 'integration_1',
+      syncDirection: 'outbound',
+    })
+  })
+
+  it('excludes a ticket integration mapping when inboxIds does not include the event inbox', async () => {
+    setActiveIntegrationMappings([makeGitHubTicketMapping({ inboxIds: ['inbox_2'] })])
+
+    const targets = await getHookTargets(makeTicketCreatedEvent('inbox_1'))
+
+    expect(targets.filter((t) => t.type === 'github')).toHaveLength(0)
+  })
+
+  it('excludes ticket events with null inboxId from inbox-filtered integrations', async () => {
+    setActiveIntegrationMappings([makeGitHubTicketMapping({ inboxIds: ['inbox_1'] })])
+
+    const targets = await getHookTargets(makeTicketCreatedEvent(null))
+
+    expect(targets.filter((t) => t.type === 'github')).toHaveLength(0)
+  })
+
+  it('matches any ticket integration mapping when inboxIds is null', async () => {
+    setActiveIntegrationMappings([makeGitHubTicketMapping(null)])
+
+    const targets = await getHookTargets(makeTicketCreatedEvent('inbox_anything'))
+
+    expect(targets.filter((t) => t.type === 'github')).toHaveLength(1)
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/targets-mention.test.ts b/apps/web/src/lib/server/events/__tests__/targets-mention.test.ts
index ac2c1aa1c..324867410 100644
--- a/apps/web/src/lib/server/events/__tests__/targets-mention.test.ts
+++ b/apps/web/src/lib/server/events/__tests__/targets-mention.test.ts
@@ -38,7 +38,11 @@ const mockDbWhere = vi.fn()
 const mockLimit = vi.fn()
 const mockFindMany = vi.fn()
 
-vi.mock('@/lib/server/db', () => ({
+vi.mock('@/lib/server/db', async (importOriginal) => ({
+  // Spread the real module (db is a lazy Proxy ⇒ no connection) so transitively
+  // imported exports like `ticketSubscriptions` resolve; the explicit overrides
+  // below still win for everything this test inspects.
+  ...(await importOriginal<typeof import('@/lib/server/db')>()),
   db: {
     select: (...args: unknown[]) => mockSelect(...args),
     query: {
diff --git a/apps/web/src/lib/server/events/__tests__/targets-ticket-visibility.test.ts b/apps/web/src/lib/server/events/__tests__/targets-ticket-visibility.test.ts
new file mode 100644
index 000000000..d4ad2e287
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/targets-ticket-visibility.test.ts
@@ -0,0 +1,281 @@
+/**
+ * Tests that internal and shared-team ticket threads are never delivered
+ * to external targets (webhooks and integrations).
+ *
+ * Security invariant: only `audience: 'public'` threads reach external consumers.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// --- Minimal mocks so targets.ts module loads ---
+
+const cacheGetMock = vi.fn()
+const cacheSetMock = vi.fn()
+
+vi.mock('@/lib/server/redis', () => ({
+  cacheGet: (...a: unknown[]) => cacheGetMock(...a),
+  cacheSet: (...a: unknown[]) => cacheSetMock(...a),
+  cacheDel: vi.fn(),
+  CACHE_KEYS: {
+    TENANT_SETTINGS: 'settings:tenant',
+    INTEGRATION_MAPPINGS: 'hooks:integration-mappings',
+    ACTIVE_WEBHOOKS: 'hooks:webhooks-active',
+    SLACK_CHANNELS: 'slack:channels',
+  },
+}))
+
+vi.mock('@/lib/server/db', async (importOriginal) => ({
+  // Spread the real module (db is a lazy Proxy ⇒ no connection) so transitively
+  // imported exports like `ticketSubscriptions` resolve; the explicit overrides
+  // below still win for everything this test inspects.
+  ...(await importOriginal<typeof import('@/lib/server/db')>()),
+  db: {
+    select: vi.fn().mockReturnValue({
+      from: vi.fn().mockReturnValue({
+        innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+      }),
+    }),
+    query: {
+      webhooks: { findMany: vi.fn().mockResolvedValue([]) },
+    },
+  },
+  integrations: {
+    id: 'id',
+    integrationType: 'integrationType',
+    secrets: 'secrets',
+    config: 'config',
+    status: 'status',
+  },
+  integrationEventMappings: {
+    integrationId: 'integrationId',
+    eventType: 'eventType',
+    actionConfig: 'actionConfig',
+    filters: 'filters',
+    enabled: 'enabled',
+  },
+  webhooks: { status: 'status', deletedAt: 'deletedAt', $inferSelect: {} },
+  principal: {
+    id: 'principal.id',
+    userId: 'principal.userId',
+    role: 'principal.role',
+    type: 'principal.type',
+    displayName: 'principal.displayName',
+  },
+  user: { id: 'user.id', email: 'user.email' },
+  posts: {
+    id: 'posts.id',
+    boardId: 'posts.boardId',
+    moderationState: 'posts.moderationState',
+    principalId: 'posts.principalId',
+    deletedAt: 'posts.deletedAt',
+  },
+  boards: { id: 'boards.id', access: 'boards.access', deletedAt: 'boards.deletedAt' },
+  userSegments: { principalId: 'userSegments.principalId', segmentId: 'userSegments.segmentId' },
+  eq: vi.fn((a: unknown, b: unknown) => ({ _eq: [a, b] })),
+  and: vi.fn((...args: unknown[]) => ({ _and: args })),
+  or: vi.fn(),
+  isNull: vi.fn(),
+  inArray: vi.fn(),
+}))
+
+vi.mock('@/lib/server/integrations/encryption', () => ({
+  decryptSecrets: vi.fn((s: string) => JSON.parse(s)),
+}))
+
+vi.mock('@/lib/server/domains/webhooks/encryption', () => ({
+  decryptWebhookSecret: vi.fn((s: string) => s),
+}))
+
+vi.mock('@/lib/server/domains/subscriptions/subscription.service', () => ({
+  getSubscribersForEvent: vi.fn().mockResolvedValue([]),
+  batchGetNotificationPreferences: vi.fn().mockResolvedValue(new Map()),
+  batchGenerateUnsubscribeTokens: vi.fn().mockResolvedValue(new Map()),
+}))
+
+vi.mock('@/lib/server/domains/ai/config', () => ({
+  getOpenAI: vi.fn().mockReturnValue(null),
+}))
+
+vi.mock('../hook-context', () => ({
+  buildHookContext: vi.fn().mockResolvedValue({
+    workspaceName: 'Test Workspace',
+    portalBaseUrl: 'https://test.quackback.io',
+    logoUrl: null,
+  }),
+}))
+
+vi.mock('../hook-utils', () => ({
+  stripHtml: vi.fn((s: string) => s),
+  truncate: vi.fn((s: string) => s),
+}))
+// Ticket *email* targets are a separate, DB-backed concern out of scope here.
+// Left unmocked they throw on the unmocked DB for every ticket.* event, and
+// getHookTargets swallows that into [] — which vacuously "passed" the block
+// assertions while breaking the allow ones. Stub to [] so the webhook/
+// integration visibility assertions below are actually exercised.
+vi.mock('../ticket-targets', () => ({
+  getTicketEmailTargets: vi.fn().mockResolvedValue([]),
+}))
+
+// Import after mocks
+const { getHookTargets } = await import('../targets')
+
+import type { EventData } from '../types'
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+const base = {
+  id: 'evt_test_thread',
+  timestamp: '2026-06-11T00:00:00.000Z',
+  actor: { type: 'user' as const, principalId: 'principal_agent1' },
+}
+
+const ticketRef = {
+  id: 'ticket_01test',
+  subject: 'Test ticket',
+  descriptionText: 'Body',
+  statusId: 'ticket_status_open',
+  statusCategory: 'open',
+  priority: 'normal',
+  channel: 'portal',
+  visibility: 'team',
+  inboxId: 'inbox_01',
+  primaryTeamId: 'team_01',
+  assigneePrincipalId: 'principal_agent1',
+  assigneeTeamId: null,
+  requesterPrincipalId: 'principal_user1',
+  requesterContactId: null,
+}
+
+function threadEvent(audience: 'public' | 'internal' | 'shared_team'): EventData {
+  return {
+    ...base,
+    type: 'ticket.thread_added',
+    data: {
+      ticket: ticketRef,
+      threadId: 'ticket_thread_01',
+      audience,
+      sharedWithTeamId: audience === 'shared_team' ? 'team_02' : null,
+      thread: {
+        id: 'ticket_thread_01',
+        audience,
+        bodyTextPreview: 'This is a test message',
+        bodyTextTruncated: false,
+        authorPrincipalId: 'principal_agent1',
+        isFromRequester: false,
+        sharedWithTeamId: audience === 'shared_team' ? 'team_02' : null,
+        createdAt: base.timestamp,
+      },
+    },
+  } as EventData
+}
+
+// ---------------------------------------------------------------------------
+// Setup: configure mocks to return one active webhook and one integration
+// ---------------------------------------------------------------------------
+
+beforeEach(() => {
+  vi.clearAllMocks()
+
+  // Return one active webhook subscribed to ticket.thread_added
+  cacheGetMock.mockImplementation((key: string) => {
+    if (key === 'hooks:webhooks-active') {
+      return [
+        {
+          id: 'webhook_01',
+          url: 'https://example.com/hook',
+          events: ['ticket.thread_added'],
+          boardIds: null,
+          inboxIds: null,
+          status: 'active',
+          secret: 'test-secret',
+          deletedAt: null,
+          failureCount: 0,
+        },
+      ]
+    }
+    if (key === 'hooks:integration-mappings') {
+      return [
+        {
+          integrationId: 'integration_slack1',
+          integrationType: 'slack',
+          eventType: 'ticket.thread_added',
+          actionConfig: { channelId: '#support' },
+          integrationConfig: {},
+          filters: null,
+          secrets: JSON.stringify({ accessToken: 'xoxb-test' }),
+        },
+      ]
+    }
+    return null
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('ticket thread visibility — webhook and integration targets', () => {
+  it('blocks internal threads from all external targets', async () => {
+    const targets = await getHookTargets(threadEvent('internal'))
+    const webhookTargets = targets.filter((t) => t.type === 'webhook')
+    const integrationTargets = targets.filter(
+      (t) => t.type !== 'webhook' && t.type !== 'email' && t.type !== 'notification'
+    )
+    expect(webhookTargets).toHaveLength(0)
+    expect(integrationTargets).toHaveLength(0)
+  })
+
+  it('blocks shared_team threads from all external targets', async () => {
+    const targets = await getHookTargets(threadEvent('shared_team'))
+    const webhookTargets = targets.filter((t) => t.type === 'webhook')
+    const integrationTargets = targets.filter(
+      (t) => t.type !== 'webhook' && t.type !== 'email' && t.type !== 'notification'
+    )
+    expect(webhookTargets).toHaveLength(0)
+    expect(integrationTargets).toHaveLength(0)
+  })
+
+  it('allows public threads to reach webhook targets', async () => {
+    const targets = await getHookTargets(threadEvent('public'))
+    const webhookTargets = targets.filter((t) => t.type === 'webhook')
+    expect(webhookTargets.length).toBeGreaterThan(0)
+  })
+
+  it('allows public threads to reach integration targets', async () => {
+    const targets = await getHookTargets(threadEvent('public'))
+    const integrationTargets = targets.filter((t) => t.type === 'slack')
+    expect(integrationTargets.length).toBeGreaterThan(0)
+  })
+})
+
+describe('private comment visibility — regression', () => {
+  it('blocks private comments from webhook and integration targets', async () => {
+    const event = {
+      ...base,
+      type: 'comment.created',
+      data: {
+        comment: {
+          id: 'comment_01',
+          content: 'secret internal note',
+          isPrivate: true,
+        },
+        post: {
+          id: 'post_01',
+          title: 'Feedback',
+          boardId: 'board_01',
+          boardSlug: 'feedback',
+        },
+      },
+    } as EventData
+
+    const targets = await getHookTargets(event)
+    const webhookTargets = targets.filter((t) => t.type === 'webhook')
+    const integrationTargets = targets.filter(
+      (t) => t.type !== 'webhook' && t.type !== 'email' && t.type !== 'notification'
+    )
+    expect(webhookTargets).toHaveLength(0)
+    expect(integrationTargets).toHaveLength(0)
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/targets-webhook-match.test.ts b/apps/web/src/lib/server/events/__tests__/targets-webhook-match.test.ts
index faa5d1e98..f5b64fdb6 100644
--- a/apps/web/src/lib/server/events/__tests__/targets-webhook-match.test.ts
+++ b/apps/web/src/lib/server/events/__tests__/targets-webhook-match.test.ts
@@ -14,7 +14,11 @@ vi.mock('@/lib/server/redis', () => ({
   },
 }))
 
-vi.mock('@/lib/server/db', () => ({
+vi.mock('@/lib/server/db', async (importOriginal) => ({
+  // Spread the real module (db is a lazy Proxy ⇒ no connection) so transitively
+  // imported exports like `ticketSubscriptions` resolve; the explicit overrides
+  // below still win for everything this test inspects.
+  ...(await importOriginal<typeof import('@/lib/server/db')>()),
   db: {
     select: vi.fn(),
     query: {
diff --git a/apps/web/src/lib/server/events/__tests__/ticket-email-config.test.ts b/apps/web/src/lib/server/events/__tests__/ticket-email-config.test.ts
new file mode 100644
index 000000000..492c0fedb
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/ticket-email-config.test.ts
@@ -0,0 +1,318 @@
+import { describe, expect, it } from 'vitest'
+import { buildTicketEmailEventConfig } from '../ticket-targets'
+import type { EventData, EventTicketRef } from '../types'
+
+const ticket: EventTicketRef = {
+  id: 'ticket_123',
+  subject: 'Billing question',
+  statusId: 'status_1',
+  statusCategory: 'open',
+  priority: 'high',
+  channel: 'email',
+  visibility: 'public',
+  inboxId: 'inbox_1',
+  primaryTeamId: 'team_1',
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  requesterPrincipalId: 'principal_requester',
+  requesterContactId: 'contact_1',
+  statusName: 'Open',
+  inboxName: 'Support',
+  primaryTeamName: 'Customer Success',
+  requesterName: 'Jamie',
+  requesterEmail: 'jamie@example.com',
+  descriptionText:
+    'My invoice is missing the annual discount. Please check the latest billing run.',
+}
+
+function contentSections(config: Record<string, unknown>) {
+  return config.contentSections as Array<{
+    title: string
+    body?: string
+    rows?: Array<{ label: string; value: string }>
+    tone?: 'default' | 'quote' | 'warning'
+  }>
+}
+
+function event(type: string, data: Record<string, unknown>): EventData {
+  return {
+    id: 'event_1',
+    type,
+    timestamp: '2026-06-16T10:15:00.000Z',
+    actor: { type: 'user', displayName: 'Alex Morgan', email: 'alex@example.com' },
+    data: { ticket, ...data },
+  } as EventData
+}
+
+describe('buildTicketEmailEventConfig', () => {
+  it('describes status changes with previous and new status', () => {
+    const config = buildTicketEmailEventConfig(
+      event('ticket.status_changed', {
+        previousStatusCategory: 'pending',
+        newStatusCategory: 'closed',
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+
+    expect(config.title).toBe('Status: Billing question')
+    expect(config.summary).toBe('This ticket moved from Pending to Closed.')
+    expect(contentSections(config)[0]).toEqual({
+      title: 'Status change',
+      rows: [
+        { label: 'Previous status', value: 'Pending' },
+        { label: 'New status', value: 'Closed' },
+      ],
+    })
+    expect(config.ticketUrl).toBe('https://example.com/tickets/ticket_123')
+  })
+
+  it('includes the initial ticket description as action content', () => {
+    const config = buildTicketEmailEventConfig(
+      event('ticket.created', {}),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+
+    expect(contentSections(config)[0]).toMatchObject({
+      title: 'Initial ticket content',
+      body: ticket.descriptionText,
+    })
+  })
+
+  it('includes full reply body as action content', () => {
+    const config = buildTicketEmailEventConfig(
+      event('ticket.thread_added', {
+        audience: 'public',
+        sharedWithTeamId: null,
+        thread: {
+          id: 'thread_1',
+          audience: 'public',
+          bodyTextPreview: 'Can you check the latest invoice?',
+          bodyText:
+            'Can you check the latest invoice? The customer says the annual discount is missing from the final total.',
+          bodyTextTruncated: true,
+          authorPrincipalId: 'principal_requester',
+          isFromRequester: true,
+          sharedWithTeamId: null,
+          createdAt: '2026-06-16T10:10:00.000Z',
+        },
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+
+    expect(config.eventLabel).toBe('New reply')
+    expect(config.summary).toBe('The requester replied to this ticket.')
+    expect(contentSections(config)[0]).toMatchObject({
+      title: 'Requester reply',
+      body: 'Can you check the latest invoice? The customer says the annual discount is missing from the final total.',
+    })
+    expect(config.details).toContainEqual({ label: 'Audience', value: 'Public' })
+  })
+
+  it('clips and humanizes ticket update diffs', () => {
+    const config = buildTicketEmailEventConfig(
+      event('ticket.updated', {
+        changedFields: ['priority', 'descriptionText'],
+        diff: {
+          priority: { from: 'low', to: 'urgent' },
+          descriptionText: {
+            from: 'Old short description',
+            to: 'A'.repeat(500),
+          },
+        },
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+
+    expect(config.title).toBe('Ticket details updated: Billing question')
+    expect(contentSections(config)[0]?.rows).toContainEqual({
+      label: 'Priority',
+      value: 'Low -> Urgent',
+    })
+    expect(
+      (contentSections(config)[0]?.rows ?? []).some((detail) =>
+        detail.value.includes('Content truncated in email.')
+      )
+    ).toBe(true)
+  })
+
+  it('describes SLA warnings and attachment additions', () => {
+    const slaConfig = buildTicketEmailEventConfig(
+      event('ticket.sla_warning', { kind: 'first_response', ruleName: 'Gold support' }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(slaConfig.summary).toBe('Gold support is approaching its First Response target.')
+    expect(contentSections(slaConfig)[0]?.rows).toContainEqual({
+      label: 'SLA rule',
+      value: 'Gold support',
+    })
+
+    const attachmentConfig = buildTicketEmailEventConfig(
+      event('ticket.attachment_added', {
+        attachment: {
+          id: 'attachment_1',
+          threadId: 'thread_1',
+          filename: 'invoice.pdf',
+          mimeType: 'application/pdf',
+          sizeBytes: 1536,
+          uploadedByPrincipalId: 'principal_1',
+          publicUrl: null,
+        },
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(attachmentConfig.summary).toBe('invoice.pdf was attached to this ticket.')
+    expect(contentSections(attachmentConfig)[0]?.rows).toContainEqual({
+      label: 'Size',
+      value: '1.5 KB',
+    })
+  })
+
+  it('describes assignment, participant, and share changes', () => {
+    const assigned = buildTicketEmailEventConfig(
+      event('ticket.assigned', {
+        previousAssigneePrincipalId: null,
+        newAssigneePrincipalId: 'principal_agent',
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(assigned.title).toBe('Ticket assignment updated: Billing question')
+    expect(contentSections(assigned)[0]?.rows).toEqual([
+      { label: 'Previous assignee', value: 'None' },
+      { label: 'New assignee', value: 'New teammate details unavailable' },
+    ])
+
+    const unassigned = buildTicketEmailEventConfig(
+      event('ticket.unassigned', {
+        previousAssigneePrincipalId: 'principal_agent',
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(unassigned.summary).toBe('The ticket is no longer assigned to an individual teammate.')
+    expect(contentSections(unassigned)[0]?.rows).toContainEqual({
+      label: 'New assignee',
+      value: 'Unassigned',
+    })
+
+    const participant = buildTicketEmailEventConfig(
+      event('ticket.participant_added', { role: 'cc' }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(participant.eventLabel).toBe('Participant added')
+    expect(contentSections(participant)[0]?.rows).toContainEqual({ label: 'Role', value: 'Cc' })
+
+    const shared = buildTicketEmailEventConfig(
+      event('ticket.shared', { accessLevel: 'comment' }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(shared.summary).toBe('This ticket was shared with another team.')
+    expect(contentSections(shared)[0]?.rows).toContainEqual({
+      label: 'Access',
+      value: 'Comment',
+    })
+  })
+
+  it('describes edited/deleted thread content and missing thread bodies', () => {
+    const edited = buildTicketEmailEventConfig(
+      event('ticket.thread_updated', {
+        audience: 'public',
+        thread: {
+          bodyTextPreview: 'Short preview',
+          bodyText: null,
+          bodyTextTruncated: true,
+          editedAt: '2026-06-16T10:20:00.000Z',
+        },
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(edited.title).toBe('Reply updated: Billing question')
+    expect(contentSections(edited)[0]?.body).toContain('Content truncated in event payload.')
+
+    const deleted = buildTicketEmailEventConfig(
+      event('ticket.thread_deleted', {
+        audience: 'internal',
+        thread: {
+          bodyText: '',
+          bodyTextPreview: '',
+          bodyTextTruncated: false,
+        },
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(deleted.eventLabel).toBe('Reply removed')
+    expect(contentSections(deleted)[0]?.body).toBe('Thread content was unavailable.')
+  })
+
+  it('describes SLA breaches, first responses, attachment removals, deletes, and restores', () => {
+    const breach = buildTicketEmailEventConfig(
+      event('ticket.sla_breach', { kind: 'resolution' }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(breach.title).toBe('SLA breached: Billing question')
+    expect(contentSections(breach)[0]?.tone).toBe('warning')
+
+    const firstResponse = buildTicketEmailEventConfig(
+      event('ticket.first_response', { firstResponseAt: '2026-06-16T11:00:00.000Z' }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(firstResponse.summary).toBe('This ticket received its first response.')
+    expect(contentSections(firstResponse)[0]?.rows).toContainEqual({
+      label: 'Response content',
+      value: 'Response body unavailable in the event payload',
+    })
+
+    const removed = buildTicketEmailEventConfig(
+      event('ticket.attachment_removed', {
+        attachment: { filename: 'invoice.pdf', threadId: 'thread_1' },
+      }),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(removed.summary).toBe('invoice.pdf was removed from this ticket.')
+
+    const deleted = buildTicketEmailEventConfig(
+      event('ticket.deleted', {}),
+      'https://example.com',
+      null,
+      null
+    )
+    expect(deleted.title).toBe('Ticket deleted: ticket')
+    expect(deleted.statusLabel).toBeUndefined()
+
+    const restored = buildTicketEmailEventConfig(
+      event('ticket.restored', {}),
+      'https://example.com',
+      ticket.subject,
+      ticket.statusName ?? null
+    )
+    expect(restored.eventLabel).toBe('Ticket restored')
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/ticket-email-targets.test.ts b/apps/web/src/lib/server/events/__tests__/ticket-email-targets.test.ts
new file mode 100644
index 000000000..60da83160
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/ticket-email-targets.test.ts
@@ -0,0 +1,454 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { NotificationPreferencesData } from '../../domains/subscriptions/subscription.types'
+import { getTicketEmailTargets } from '../ticket-targets'
+import type { HookContext } from '../hook-context'
+import type { EventData, EventTicketRef } from '../types'
+
+const mocks = vi.hoisted(() => ({
+  dbSelect: vi.fn(),
+  eq: vi.fn(),
+  inArray: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  getSubscribers: vi.fn(),
+  resolvePortalLinkedRecipients: vi.fn(),
+  resolvePrincipalsForContacts: vi.fn(),
+  canViewTicket: vi.fn(),
+  toResourceScope: vi.fn(),
+  loadPermissionSet: vi.fn(),
+  batchGenerateUnsubscribeTokens: vi.fn(),
+  batchGetNotificationPreferences: vi.fn(),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: (...args: unknown[]) => mocks.dbSelect(...args),
+  },
+  eq: (...args: unknown[]) => mocks.eq(...args),
+  inArray: (...args: unknown[]) => mocks.inArray(...args),
+  and: (...args: unknown[]) => mocks.and(...args),
+  isNull: (...args: unknown[]) => mocks.isNull(...args),
+  ticketShares: {
+    ticketId: 'ticketShares.ticketId',
+    teamId: 'ticketShares.teamId',
+    revokedAt: 'ticketShares.revokedAt',
+  },
+  teamMemberships: {
+    teamId: 'teamMemberships.teamId',
+    principalId: 'teamMemberships.principalId',
+  },
+  principal: {
+    id: 'principal.id',
+    userId: 'principal.userId',
+  },
+  user: {
+    id: 'user.id',
+    email: 'user.email',
+  },
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.subscriptions', () => ({
+  getSubscribers: (...args: unknown[]) => mocks.getSubscribers(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.recipients', () => ({
+  resolvePortalLinkedRecipients: (...args: unknown[]) =>
+    mocks.resolvePortalLinkedRecipients(...args),
+  resolvePrincipalsForContacts: (...args: unknown[]) => mocks.resolvePrincipalsForContacts(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.permissions', () => ({
+  canViewTicket: (...args: unknown[]) => mocks.canViewTicket(...args),
+  toResourceScope: (...args: unknown[]) => mocks.toResourceScope(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => mocks.loadPermissionSet(...args),
+}))
+
+vi.mock('@/lib/server/domains/subscriptions/subscription.service', () => ({
+  batchGenerateUnsubscribeTokens: (...args: unknown[]) =>
+    mocks.batchGenerateUnsubscribeTokens(...args),
+  batchGetNotificationPreferences: (...args: unknown[]) =>
+    mocks.batchGetNotificationPreferences(...args),
+}))
+
+const context: HookContext = {
+  workspaceName: 'Acme Support',
+  portalBaseUrl: 'https://portal.example.com',
+  logoUrl: null,
+}
+
+const ticket: EventTicketRef = {
+  id: 'ticket_123',
+  subject: 'Billing question',
+  descriptionText: 'The invoice is missing a discount.',
+  statusId: 'status_open',
+  statusCategory: 'open',
+  priority: 'high',
+  channel: 'email',
+  visibility: 'team',
+  inboxId: 'inbox_1',
+  primaryTeamId: 'team_1',
+  assigneePrincipalId: 'principal_assignee',
+  assigneeTeamId: null,
+  requesterPrincipalId: 'principal_requester',
+  requesterContactId: 'contact_1',
+  statusName: 'Open',
+  inboxName: 'Support',
+}
+
+function selectRows(rows: ReadonlyArray<Record<string, unknown>>) {
+  const chain = {
+    from: vi.fn(() => chain),
+    innerJoin: vi.fn(() => chain),
+    where: vi.fn(async () => rows),
+  }
+  return chain
+}
+
+function queueSelects(...rowSets: Array<ReadonlyArray<Record<string, unknown>>>) {
+  for (const rows of rowSets) {
+    mocks.dbSelect.mockReturnValueOnce(selectRows(rows))
+  }
+}
+
+function pref(overrides: Partial<NotificationPreferencesData> = {}): NotificationPreferencesData {
+  return {
+    emailStatusChange: true,
+    emailNewComment: true,
+    emailMuted: false,
+    emailTicketThreads: true,
+    emailTicketProperties: true,
+    emailTicketStatus: true,
+    emailTicketAssignment: true,
+    emailTicketParticipants: true,
+    emailTicketShares: true,
+    emailTicketSla: true,
+    ...overrides,
+  }
+}
+
+function prefsFor(
+  entries: Array<[string, Partial<NotificationPreferencesData>?]>
+): Map<string, NotificationPreferencesData> {
+  return new Map(entries.map(([principalId, overrides]) => [principalId, pref(overrides)]))
+}
+
+function emailRow(principalId: string, email: string | null) {
+  return { principalId, email }
+}
+
+type ResolvedTargets = Awaited<ReturnType<typeof getTicketEmailTargets>>
+type ResolvedTarget = ResolvedTargets[number]
+type EmailTarget = ResolvedTarget & {
+  target: { email: string | null; unsubscribeUrl?: string }
+  config: Record<string, unknown>
+}
+
+function asEmailTarget(target: ResolvedTarget): EmailTarget {
+  return target as EmailTarget
+}
+
+function emailAddresses(targets: ResolvedTargets) {
+  return targets.map((target) => asEmailTarget(target).target.email)
+}
+
+function firstEmailTarget(targets: ResolvedTargets): EmailTarget {
+  expect(targets[0]).toBeDefined()
+  return asEmailTarget(targets[0] as ResolvedTarget)
+}
+
+function identityRow(id: string, userId: string | null) {
+  return { id, userId }
+}
+
+function event(type: string, data: Record<string, unknown> = {}): EventData {
+  return {
+    id: `event_${type}`,
+    type,
+    timestamp: '2026-06-16T12:00:00.000Z',
+    actor: {
+      type: 'user',
+      principalId: 'principal_actor',
+      displayName: 'Alex Agent',
+      email: 'alex@example.com',
+    },
+    data: { ticket, ...data },
+  } as EventData
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.getSubscribers.mockResolvedValue([])
+  mocks.resolvePortalLinkedRecipients.mockResolvedValue({
+    principalIds: [],
+    portalLinked: new Set<string>(),
+  })
+  mocks.resolvePrincipalsForContacts.mockResolvedValue([])
+  mocks.toResourceScope.mockReturnValue({ resource: 'ticket_123' })
+  mocks.loadPermissionSet.mockImplementation(async (principalId: string) => ({ principalId }))
+  mocks.canViewTicket.mockReturnValue(true)
+  mocks.batchGenerateUnsubscribeTokens.mockResolvedValue(new Map())
+  mocks.batchGetNotificationPreferences.mockResolvedValue(new Map())
+})
+
+describe('getTicketEmailTargets', () => {
+  it('does not resolve recipients without a ticket payload or subscription category', async () => {
+    await expect(
+      getTicketEmailTargets({ ...event('post.created'), data: {} } as EventData, context)
+    ).resolves.toEqual([])
+    await expect(getTicketEmailTargets(event('ticket.custom'), context)).resolves.toEqual([])
+
+    expect(mocks.getSubscribers).not.toHaveBeenCalled()
+    expect(mocks.dbSelect).not.toHaveBeenCalled()
+  })
+
+  it('delivers public thread emails to subscribers, assignees, requester owners, and portal-linked owners', async () => {
+    mocks.resolvePortalLinkedRecipients.mockResolvedValue({
+      principalIds: ['principal_linked'],
+      portalLinked: new Set(['principal_linked']),
+    })
+    mocks.getSubscribers.mockResolvedValue(['principal_subscriber', 'principal_actor'])
+    mocks.batchGetNotificationPreferences.mockResolvedValue(
+      prefsFor([
+        ['principal_subscriber'],
+        ['principal_requester'],
+        ['principal_assignee'],
+        ['principal_linked'],
+      ])
+    )
+    queueSelects(
+      [{ teamId: 'team_shared', revokedAt: null }],
+      [
+        identityRow('principal_subscriber', 'user_subscriber'),
+        identityRow('principal_requester', 'user_requester'),
+        identityRow('principal_assignee', 'user_assignee'),
+        identityRow('principal_linked', 'user_linked'),
+      ],
+      [],
+      [
+        emailRow('principal_subscriber', 'subscriber@example.com'),
+        emailRow('principal_requester', 'requester@example.com'),
+        emailRow('principal_assignee', 'assignee@example.com'),
+        emailRow('principal_linked', 'linked@example.com'),
+      ]
+    )
+
+    const targets = await getTicketEmailTargets(
+      event('ticket.thread_added', {
+        audience: 'public',
+        thread: {
+          bodyText: 'A customer-facing reply.',
+          bodyTextPreview: 'A customer-facing reply.',
+          isFromRequester: false,
+          createdAt: '2026-06-16T12:00:00.000Z',
+        },
+      }),
+      context
+    )
+
+    expect(emailAddresses(targets)).toEqual([
+      'subscriber@example.com',
+      'requester@example.com',
+      'assignee@example.com',
+      'linked@example.com',
+    ])
+    expect(emailAddresses(targets)).not.toContain('actor@example.com')
+    expect(firstEmailTarget(targets).target.unsubscribeUrl).toBe(
+      'https://portal.example.com/settings/notifications'
+    )
+    expect(firstEmailTarget(targets).config).toMatchObject({
+      workspaceName: 'Acme Support',
+      eventLabel: 'New reply',
+      ticketSubject: 'Billing question',
+      priorityLabel: 'high',
+    })
+    expect(mocks.toResourceScope).toHaveBeenCalledWith(
+      expect.objectContaining({
+        primaryTeamId: 'team_1',
+        assigneePrincipalId: 'principal_assignee',
+        shares: [{ teamId: 'team_shared', revokedAt: null }],
+      })
+    )
+    expect(mocks.batchGenerateUnsubscribeTokens).toHaveBeenCalledWith([
+      expect.objectContaining({ principalId: 'principal_subscriber' }),
+      expect.objectContaining({ principalId: 'principal_requester' }),
+      expect.objectContaining({ principalId: 'principal_assignee' }),
+      expect.objectContaining({ principalId: 'principal_linked' }),
+    ])
+  })
+
+  it('keeps internal thread emails away from requester and portal-linked recipients', async () => {
+    mocks.resolvePortalLinkedRecipients.mockResolvedValue({
+      principalIds: ['principal_linked'],
+      portalLinked: new Set(['principal_linked']),
+    })
+    mocks.getSubscribers.mockResolvedValue([
+      'principal_subscriber',
+      'principal_requester',
+      'principal_linked',
+      'principal_actor',
+    ])
+    mocks.batchGetNotificationPreferences.mockResolvedValue(
+      prefsFor([['principal_subscriber'], ['principal_assignee']])
+    )
+    queueSelects(
+      [],
+      [
+        identityRow('principal_subscriber', 'user_subscriber'),
+        identityRow('principal_assignee', 'user_assignee'),
+      ],
+      [],
+      [
+        emailRow('principal_subscriber', 'subscriber@example.com'),
+        emailRow('principal_assignee', 'assignee@example.com'),
+      ]
+    )
+
+    const targets = await getTicketEmailTargets(
+      event('ticket.thread_added', {
+        audience: 'internal',
+        thread: {
+          bodyText: 'Internal agent note.',
+          bodyTextPreview: 'Internal agent note.',
+          isFromRequester: false,
+          createdAt: '2026-06-16T12:00:00.000Z',
+        },
+      }),
+      context
+    )
+
+    expect(emailAddresses(targets)).toEqual(['subscriber@example.com', 'assignee@example.com'])
+    expect(mocks.batchGetNotificationPreferences).toHaveBeenCalledWith([
+      'principal_subscriber',
+      'principal_assignee',
+    ])
+  })
+
+  it('trusts principals linked from added participant contacts without requiring ticket grants', async () => {
+    mocks.resolvePrincipalsForContacts.mockResolvedValue(['principal_contact'])
+    mocks.canViewTicket.mockReturnValue(false)
+    mocks.batchGetNotificationPreferences.mockResolvedValue(prefsFor([['principal_contact']]))
+    queueSelects(
+      [],
+      [
+        identityRow('principal_direct', 'user_direct'),
+        identityRow('principal_contact', 'user_contact'),
+      ],
+      [],
+      [emailRow('principal_contact', 'contact@example.com')]
+    )
+
+    const targets = await getTicketEmailTargets(
+      event('ticket.participant_added', {
+        addedPrincipalId: 'principal_direct',
+        addedContactId: 'contact_linked',
+        role: 'cc',
+      }),
+      context
+    )
+
+    expect(emailAddresses(targets)).toEqual(['contact@example.com'])
+    expect(mocks.resolvePrincipalsForContacts).toHaveBeenCalledWith(['contact_linked'])
+    expect(mocks.loadPermissionSet).toHaveBeenCalledWith('principal_direct')
+    expect(mocks.loadPermissionSet).not.toHaveBeenCalledWith('principal_contact')
+  })
+
+  it('expands share events to team members and honors share notification preferences', async () => {
+    mocks.getSubscribers.mockResolvedValue(['principal_subscriber'])
+    mocks.batchGetNotificationPreferences.mockResolvedValue(
+      prefsFor([['principal_member'], ['principal_subscriber', { emailTicketShares: false }]])
+    )
+    queueSelects(
+      [{ principalId: 'principal_member' }, { principalId: 'principal_actor' }],
+      [],
+      [
+        identityRow('principal_subscriber', 'user_subscriber'),
+        identityRow('principal_member', 'user_member'),
+      ],
+      [],
+      [emailRow('principal_member', 'member@example.com')]
+    )
+
+    const targets = await getTicketEmailTargets(
+      event('ticket.shared', {
+        teamId: 'team_shared',
+        accessLevel: 'comment',
+      }),
+      context
+    )
+
+    expect(mocks.getSubscribers).toHaveBeenCalledWith('ticket_123', 'shares')
+    expect(emailAddresses(targets)).toEqual(['member@example.com'])
+  })
+
+  it('allows a subscribed principal when any sibling principal for the same user can view the ticket', async () => {
+    const scopedTicket = { ...ticket, requesterPrincipalId: null, assigneePrincipalId: null }
+    mocks.getSubscribers.mockResolvedValue(['principal_subscriber'])
+    mocks.canViewTicket.mockImplementation(
+      (set: { principalId: string }) => set.principalId === 'principal_sibling'
+    )
+    mocks.batchGetNotificationPreferences.mockResolvedValue(prefsFor([['principal_subscriber']]))
+    queueSelects(
+      [],
+      [identityRow('principal_subscriber', 'user_shared')],
+      [
+        identityRow('principal_subscriber', 'user_shared'),
+        identityRow('principal_sibling', 'user_shared'),
+      ],
+      [emailRow('principal_subscriber', 'subscriber@example.com')]
+    )
+
+    const targets = await getTicketEmailTargets(
+      event('ticket.status_changed', {
+        ticket: scopedTicket,
+        previousStatusCategory: 'open',
+        newStatusCategory: 'closed',
+      }),
+      context
+    )
+
+    expect(emailAddresses(targets)).toEqual(['subscriber@example.com'])
+    expect(mocks.loadPermissionSet).toHaveBeenCalledWith('principal_subscriber')
+    expect(mocks.loadPermissionSet).toHaveBeenCalledWith('principal_sibling')
+  })
+
+  it('filters muted recipients, disabled event preferences, and missing email addresses', async () => {
+    const scopedTicket = { ...ticket, requesterPrincipalId: null, assigneePrincipalId: null }
+    mocks.getSubscribers.mockResolvedValue([
+      'principal_muted',
+      'principal_disabled',
+      'principal_without_email',
+    ])
+    mocks.batchGetNotificationPreferences.mockResolvedValue(
+      prefsFor([
+        ['principal_muted', { emailMuted: true }],
+        ['principal_disabled', { emailTicketStatus: false }],
+        ['principal_without_email'],
+      ])
+    )
+    queueSelects(
+      [],
+      [
+        identityRow('principal_muted', 'user_muted'),
+        identityRow('principal_disabled', 'user_disabled'),
+        identityRow('principal_without_email', 'user_without_email'),
+      ],
+      [],
+      [emailRow('principal_without_email', null)]
+    )
+
+    const targets = await getTicketEmailTargets(
+      event('ticket.status_changed', {
+        ticket: scopedTicket,
+        previousStatusCategory: 'open',
+        newStatusCategory: 'closed',
+      }),
+      context
+    )
+
+    expect(targets).toEqual([])
+    expect(mocks.batchGenerateUnsubscribeTokens).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/ticket-targets-resolver.diffcov.test.ts b/apps/web/src/lib/server/events/__tests__/ticket-targets-resolver.diffcov.test.ts
new file mode 100644
index 000000000..2be18c27c
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/ticket-targets-resolver.diffcov.test.ts
@@ -0,0 +1,288 @@
+/**
+ * Differential-coverage tests for getTicketEmailTargets — the recipient
+ * resolver: per-category candidate building (thread public/internal, status,
+ * assignment, participants, shares, sla, properties), actor suppression,
+ * canView + sibling-principal fallback (+cache/catch), notification-preference
+ * filtering, and the email/eligibility short-circuits.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => {
+  const selectWhere = vi.fn()
+  const chain: Record<string, unknown> = { where: () => selectWhere(), innerJoin: () => chain }
+  return {
+    selectWhere,
+    chain,
+    getSubscribers: vi.fn(),
+    resolvePortalLinked: vi.fn(),
+    resolvePrincipalsForContacts: vi.fn(),
+    canViewTicket: vi.fn(),
+    toResourceScope: vi.fn(),
+    loadPermissionSet: vi.fn(),
+    batchGetPrefs: vi.fn(),
+    batchGenTokens: vi.fn(),
+  }
+})
+
+vi.mock('@/lib/server/db', () => ({
+  db: { select: () => ({ from: () => m.chain }) },
+  eq: vi.fn(),
+  inArray: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  ticketShares: {},
+  teamMemberships: { principalId: 'tm.principalId', teamId: 'tm.teamId' },
+  principal: { id: 'pr.id', userId: 'pr.userId' },
+  user: { id: 'u.id', email: 'u.email' },
+}))
+vi.mock('../../domains/tickets/ticket.subscriptions', () => ({
+  getSubscribers: (...a: unknown[]) => m.getSubscribers(...a),
+}))
+vi.mock('../../domains/tickets/ticket.recipients', () => ({
+  resolvePortalLinkedRecipients: (...a: unknown[]) => m.resolvePortalLinked(...a),
+  resolvePrincipalsForContacts: (...a: unknown[]) => m.resolvePrincipalsForContacts(...a),
+}))
+vi.mock('../../domains/tickets/ticket.permissions', () => ({
+  canViewTicket: (...a: unknown[]) => m.canViewTicket(...a),
+  toResourceScope: (...a: unknown[]) => m.toResourceScope(...a),
+}))
+vi.mock('../../domains/authz/authz.service', () => ({
+  loadPermissionSet: (...a: unknown[]) => m.loadPermissionSet(...a),
+}))
+vi.mock('../../domains/subscriptions/subscription.service', () => ({
+  batchGetNotificationPreferences: (...a: unknown[]) => m.batchGetPrefs(...a),
+  batchGenerateUnsubscribeTokens: (...a: unknown[]) => m.batchGenTokens(...a),
+}))
+
+import { getTicketEmailTargets } from '../ticket-targets'
+
+const ticket = (over: Record<string, unknown> = {}) => ({
+  id: 'ticket_1',
+  subject: 'Help',
+  descriptionText: 'desc',
+  statusName: 'Open',
+  statusCategory: 'open',
+  priority: 'high',
+  requesterPrincipalId: null,
+  requesterContactId: null,
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  primaryTeamId: null,
+  ...over,
+})
+const ev = (
+  type: string,
+  data: Record<string, unknown> = {},
+  actorPrincipalId: string | null = null
+) => ({
+  type,
+  data: { ticket: ticket(), ...data },
+  actor: { principalId: actorPrincipalId, displayName: 'Actor', email: 'actor@x.test' },
+  timestamp: '2026-02-02T10:00:00Z',
+})
+const ctx = { portalBaseUrl: 'https://app.test', workspaceName: 'WS', logoUrl: null } as never
+
+const allPrefs = {
+  emailMuted: false,
+  emailTicketThreads: true,
+  emailTicketProperties: true,
+  emailTicketStatus: true,
+  emailTicketAssignment: true,
+  emailTicketParticipants: true,
+  emailTicketShares: true,
+  emailTicketSla: true,
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.selectWhere.mockResolvedValue([]) // default: shares/loadActiveShares/principalRows/etc empty
+  m.getSubscribers.mockResolvedValue(['p1'])
+  m.resolvePortalLinked.mockResolvedValue({ principalIds: [], portalLinked: new Set() })
+  m.resolvePrincipalsForContacts.mockResolvedValue([])
+  m.canViewTicket.mockReturnValue(true)
+  m.toResourceScope.mockReturnValue({})
+  m.loadPermissionSet.mockResolvedValue({})
+  m.batchGetPrefs.mockResolvedValue(new Map([['p1', allPrefs]]))
+  m.batchGenTokens.mockResolvedValue(new Map())
+  // principalRows + siblingRows + emails: sequence after loadActiveShares([])
+  m.selectWhere
+    .mockResolvedValueOnce([]) // loadActiveShares
+    .mockResolvedValueOnce([{ id: 'p1', userId: 'u1' }]) // principalRows
+    .mockResolvedValueOnce([{ id: 'p1', userId: 'u1' }]) // siblingRows
+    .mockResolvedValueOnce([{ principalId: 'p1', email: 'a@x.test' }]) // emails
+})
+
+describe('early returns', () => {
+  it('returns [] when there is no ticket', async () => {
+    expect(
+      await getTicketEmailTargets(
+        { type: 'ticket.created', data: {}, actor: {}, timestamp: 't' } as never,
+        ctx
+      )
+    ).toEqual([])
+  })
+  it('returns [] for an uncategorized event type', async () => {
+    expect(await getTicketEmailTargets(ev('ticket.viewed') as never, ctx)).toEqual([])
+  })
+  it('returns [] when no candidate principals remain', async () => {
+    m.getSubscribers.mockResolvedValueOnce([])
+    expect(
+      await getTicketEmailTargets(
+        ev('ticket.status_changed', {
+          previousStatusCategory: 'open',
+          newStatusCategory: 'solved',
+        }) as never,
+        ctx
+      )
+    ).toEqual([])
+  })
+})
+
+describe('per-category resolution', () => {
+  it('status: builds targets via subscribers + ownership trust', async () => {
+    const targets = await getTicketEmailTargets(
+      ev('ticket.status_changed', {
+        previousStatusCategory: 'open',
+        newStatusCategory: 'solved',
+      }) as never,
+      ctx
+    )
+    expect(targets).toHaveLength(1)
+    expect(targets[0]).toMatchObject({ type: 'email', target: { email: 'a@x.test' } })
+  })
+  it('thread public: includes portal-linked recipients', async () => {
+    m.resolvePortalLinked.mockResolvedValueOnce({
+      principalIds: ['p1'],
+      portalLinked: new Set(['p1']),
+    })
+    const targets = await getTicketEmailTargets(
+      ev('ticket.thread_added', { audience: 'public', thread: { bodyText: 'hi' } }) as never,
+      ctx
+    )
+    expect(targets).toHaveLength(1)
+  })
+  it('thread internal: drops requester + portal-linked', async () => {
+    m.resolvePortalLinked.mockResolvedValueOnce({
+      principalIds: ['p_portal'],
+      portalLinked: new Set(['p_portal']),
+    })
+    m.getSubscribers.mockResolvedValueOnce(['p1', 'p_portal'])
+    const targets = await getTicketEmailTargets(
+      ev('ticket.thread_added', { audience: 'internal', thread: { bodyText: 'hi' } }) as never,
+      ctx
+    )
+    expect(targets).toHaveLength(1) // p_portal filtered, p1 remains
+  })
+  it('assignment: gathers new + previous assignee', async () => {
+    const e = ev('ticket.assigned', {
+      previousAssigneePrincipalId: 'p_prev',
+      newAssigneePrincipalId: 'p1',
+    })
+    ;(e.data.ticket as Record<string, unknown>).assigneePrincipalId = 'p1'
+    expect(await getTicketEmailTargets(e as never, ctx)).toHaveLength(1)
+  })
+  it('participants: resolves a contactId to linked principals', async () => {
+    m.resolvePrincipalsForContacts.mockResolvedValueOnce(['p1'])
+    const targets = await getTicketEmailTargets(
+      ev('ticket.participant_added', {
+        addedPrincipalId: 'p1',
+        addedContactId: 'contact_1',
+        role: 'collaborator',
+      }) as never,
+      ctx
+    )
+    expect(targets).toHaveLength(1)
+    expect(m.resolvePrincipalsForContacts).toHaveBeenCalled()
+  })
+  it('shares: loads team members', async () => {
+    // teamMemberships select is the FIRST select for shares -> reset the queue
+    m.selectWhere.mockReset()
+    m.selectWhere
+      .mockResolvedValueOnce([{ principalId: 'p1' }]) // team members
+      .mockResolvedValueOnce([]) // loadActiveShares
+      .mockResolvedValueOnce([{ id: 'p1', userId: 'u1' }]) // principalRows
+      .mockResolvedValueOnce([{ id: 'p1', userId: 'u1' }]) // siblingRows
+      .mockResolvedValueOnce([{ principalId: 'p1', email: 'a@x.test' }]) // emails
+    const targets = await getTicketEmailTargets(
+      ev('ticket.shared', { teamId: 'team_1', accessLevel: 'read' }) as never,
+      ctx
+    )
+    expect(targets).toHaveLength(1)
+  })
+  it('sla: gathers assignee + subscribers', async () => {
+    expect(
+      await getTicketEmailTargets(
+        ev('ticket.sla_warning', { ruleName: 'Rule', kind: 'first_response' }) as never,
+        ctx
+      )
+    ).toHaveLength(1)
+  })
+  it('properties: includes portal-linked', async () => {
+    expect(
+      await getTicketEmailTargets(
+        ev('ticket.updated', { changedFields: ['priority'] }) as never,
+        ctx
+      )
+    ).toHaveLength(1)
+  })
+})
+
+describe('actor suppression + permission gates', () => {
+  it('suppresses the actor principal', async () => {
+    m.getSubscribers.mockResolvedValueOnce(['p1', 'actor_p'])
+    const targets = await getTicketEmailTargets(
+      ev('ticket.status_changed', {}, 'actor_p') as never,
+      ctx
+    )
+    expect(targets).toHaveLength(1) // actor_p removed, p1 remains
+  })
+  it('trusts an owning requester without a permission check', async () => {
+    m.canViewTicket.mockReturnValue(false) // would deny via permission
+    const e = ev('ticket.status_changed', {})
+    ;(e.data.ticket as Record<string, unknown>).requesterPrincipalId = 'p1' // p1 is the requester -> trusted
+    expect(await getTicketEmailTargets(e as never, ctx)).toHaveLength(1)
+  })
+  it('falls back to a sibling principal that can view', async () => {
+    m.canViewTicket.mockReturnValueOnce(false).mockReturnValueOnce(true) // p1 denied, sibling allowed
+    m.selectWhere.mockReset()
+    m.selectWhere
+      .mockResolvedValueOnce([]) // loadActiveShares
+      .mockResolvedValueOnce([{ id: 'p1', userId: 'u1' }]) // principalRows
+      .mockResolvedValueOnce([
+        { id: 'p1', userId: 'u1' },
+        { id: 'p_sibling', userId: 'u1' },
+      ]) // siblings share user u1
+      .mockResolvedValueOnce([{ principalId: 'p1', email: 'a@x.test' }]) // emails
+    expect(await getTicketEmailTargets(ev('ticket.status_changed', {}) as never, ctx)).toHaveLength(
+      1
+    )
+  })
+  it('denies when permission check throws and no sibling helps', async () => {
+    m.canViewTicket.mockReturnValue(false)
+    m.loadPermissionSet.mockRejectedValue(new Error('authz down'))
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    expect(await getTicketEmailTargets(ev('ticket.status_changed', {}) as never, ctx)).toEqual([])
+  })
+})
+
+describe('preference + email filtering', () => {
+  it('returns [] when preferences mute or disable the category', async () => {
+    m.batchGetPrefs.mockResolvedValueOnce(
+      new Map([['p1', { ...allPrefs, emailTicketStatus: false }]])
+    )
+    expect(await getTicketEmailTargets(ev('ticket.status_changed', {}) as never, ctx)).toEqual([])
+  })
+  it('returns [] when the principal has no preferences row', async () => {
+    m.batchGetPrefs.mockResolvedValueOnce(new Map())
+    expect(await getTicketEmailTargets(ev('ticket.status_changed', {}) as never, ctx)).toEqual([])
+  })
+  it('returns [] when no eligible subscriber has an email', async () => {
+    m.selectWhere.mockReset()
+    m.selectWhere
+      .mockResolvedValueOnce([]) // loadActiveShares
+      .mockResolvedValueOnce([{ id: 'p1', userId: 'u1' }]) // principalRows
+      .mockResolvedValueOnce([{ id: 'p1', userId: 'u1' }]) // siblingRows
+      .mockResolvedValueOnce([{ principalId: 'p1', email: null }]) // emails -> filtered out
+    expect(await getTicketEmailTargets(ev('ticket.status_changed', {}) as never, ctx)).toEqual([])
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/ticket-targets.diffcov.test.ts b/apps/web/src/lib/server/events/__tests__/ticket-targets.diffcov.test.ts
new file mode 100644
index 000000000..d01062b5d
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/ticket-targets.diffcov.test.ts
@@ -0,0 +1,213 @@
+/**
+ * Differential-coverage tests for ticket-targets — exhaustive coverage of the
+ * pure `buildTicketEmailEventConfig` event-type switch and the formatting
+ * helpers (humanize, byte/date formatting, diff rendering, thread-body
+ * truncation) it routes through.
+ */
+import { describe, it, expect, vi } from 'vitest'
+
+vi.mock('@/lib/server/db', () => ({
+  db: {},
+  eq: vi.fn(),
+  and: vi.fn(),
+  inArray: vi.fn(),
+  isNull: vi.fn(),
+  ticketShares: {},
+  teamMemberships: {},
+  principal: {},
+  user: {},
+}))
+// buildTicketEmailEventConfig is pure; stub the domain collaborators so their
+// real (db-touching) module bodies never load.
+vi.mock('../../domains/tickets/ticket.subscriptions', () => ({ getSubscribers: vi.fn() }))
+vi.mock('../../domains/tickets/ticket.recipients', () => ({
+  resolvePortalLinkedRecipients: vi.fn(),
+  resolvePrincipalsForContacts: vi.fn(),
+}))
+vi.mock('../../domains/tickets/ticket.permissions', () => ({
+  canViewTicket: vi.fn(),
+  toResourceScope: vi.fn(),
+}))
+vi.mock('../../domains/authz/authz.service', () => ({ loadPermissionSet: vi.fn() }))
+vi.mock('../../domains/subscriptions/subscription.service', () => ({
+  batchGenerateUnsubscribeTokens: vi.fn(),
+  batchGetNotificationPreferences: vi.fn(),
+}))
+
+import { buildTicketEmailEventConfig } from '../ticket-targets'
+
+const baseTicket = {
+  id: 'ticket_1',
+  priority: 'high',
+  inboxName: 'Support',
+  primaryTeamName: 'Team A',
+  channel: 'email',
+  visibility: 'internal',
+  requesterName: 'Jane',
+  requesterEmail: 'jane@x.test',
+  descriptionText: 'Body text',
+  createdAt: '2026-01-01T00:00:00Z',
+}
+
+function ev(type: string, data: Record<string, unknown> = {}) {
+  return {
+    type,
+    data: { ticket: { ...baseTicket }, ...data },
+    actor: { displayName: 'Actor', email: 'actor@x.test', principalId: 'p1' },
+    timestamp: '2026-02-02T10:00:00Z',
+  } as never
+}
+
+const build = (
+  type: string,
+  data?: Record<string, unknown>,
+  subject: string | null = 'My subject',
+  status: string | null = 'open'
+) => buildTicketEmailEventConfig(ev(type, data), 'https://app.test', subject, status)
+
+describe('buildTicketEmailEventConfig event types', () => {
+  it('covers created (with description + createdAt)', () => {
+    const c = build('ticket.created')
+    expect(c.eventLabel).toBe('Ticket opened')
+    expect(c.ticketUrl).toBe('https://app.test/tickets/ticket_1')
+  })
+
+  it('covers assigned (with and without previous/new assignee)', () => {
+    expect(
+      build('ticket.assigned', { previousAssigneePrincipalId: 'p0', newAssigneePrincipalId: 'p9' })
+        .eventLabel
+    ).toBe('Assignment changed')
+    const t = ev('ticket.assigned')
+    ;(t as never as { data: { ticket: Record<string, unknown> } }).data.ticket.assigneeTeamName =
+      'Team Z'
+    expect(buildTicketEmailEventConfig(t, 'https://app.test', 's', 'open').eventLabel).toBe(
+      'Assignment changed'
+    )
+  })
+
+  it('covers unassigned', () => {
+    expect(build('ticket.unassigned', { previousAssigneePrincipalId: 'p0' }).eventLabel).toBe(
+      'Ticket unassigned'
+    )
+  })
+
+  it('covers status_changed', () => {
+    expect(
+      build('ticket.status_changed', {
+        previousStatusCategory: 'open',
+        newStatusCategory: 'solved',
+      }).eventLabel
+    ).toBe('Status changed')
+  })
+
+  it('covers updated with many, one, and zero changed fields', () => {
+    const many = build('ticket.updated', {
+      changedFields: ['a', 'b', 'c', 'd', 'e', 'f', 'g'],
+      diff: { a: { from: 'x', to: 'y' } },
+    })
+    expect(many.eventLabel).toBe('Ticket details changed')
+    expect(
+      build('ticket.updated', {
+        changedFields: ['priority'],
+        diff: { priority: { from: 'low', to: 'high' } },
+      }).eventLabel
+    ).toBe('Ticket details changed')
+    expect(build('ticket.updated', {}).eventLabel).toBe('Ticket details changed')
+  })
+
+  it('covers thread added (requester + non-requester)', () => {
+    expect(
+      build('ticket.thread_added', {
+        thread: { isFromRequester: true, createdAt: '2026-01-02T00:00:00Z', bodyText: 'hi' },
+        audience: 'public',
+      }).eventLabel
+    ).toBe('New reply')
+    expect(build('ticket.thread_added', { thread: null }).eventLabel).toBe('New reply')
+  })
+
+  it('covers thread updated and deleted', () => {
+    expect(
+      build('ticket.thread_updated', {
+        thread: { editedAt: '2026-01-02T00:00:00Z', bodyTextPreview: 'p', bodyTextTruncated: true },
+        audience: 'internal',
+      }).eventLabel
+    ).toBe('Reply updated')
+    expect(build('ticket.thread_deleted', { thread: { bodyText: 'x' } }).eventLabel).toBe(
+      'Reply removed'
+    )
+  })
+
+  it('covers participant added/removed', () => {
+    expect(build('ticket.participant_added', { role: 'collaborator' }).eventLabel).toBe(
+      'Participant added'
+    )
+    expect(build('ticket.participant_removed').eventLabel).toBe('Participant removed')
+  })
+
+  it('covers shared/unshared', () => {
+    expect(build('ticket.shared', { accessLevel: 'read' }).eventLabel).toBe('Ticket shared')
+    expect(build('ticket.unshared').eventLabel).toBe('Ticket access revoked')
+  })
+
+  it('covers sla warning/breach and first_response', () => {
+    expect(
+      build('ticket.sla_warning', { ruleName: 'Rule', kind: 'first_response' }).eventLabel
+    ).toBe('SLA warning')
+    expect(build('ticket.sla_breach', { kind: 'resolution' }).eventLabel).toBe('SLA breached')
+    expect(
+      build('ticket.first_response', { firstResponseAt: '2026-01-02T00:00:00Z' }).eventLabel
+    ).toBe('First response recorded')
+  })
+
+  it('covers attachment added (with and without publicUrl) and removed', () => {
+    expect(
+      build('ticket.attachment_added', {
+        attachment: {
+          filename: 'f.png',
+          mimeType: 'image/png',
+          sizeBytes: 2048,
+          threadId: 't1',
+          publicUrl: 'https://x/f',
+        },
+      }).eventLabel
+    ).toBe('Attachment added')
+    expect(
+      build('ticket.attachment_added', {
+        attachment: { filename: 'f.png', mimeType: 'image/png', sizeBytes: 5, threadId: 't1' },
+      }).eventLabel
+    ).toBe('Attachment added')
+    expect(
+      build('ticket.attachment_removed', { attachment: { filename: 'f.png', threadId: 't1' } })
+        .eventLabel
+    ).toBe('Attachment removed')
+  })
+
+  it('covers deleted/restored and the default (unknown) event', () => {
+    expect(build('ticket.deleted').eventLabel).toBe('Ticket deleted')
+    expect(build('ticket.restored').eventLabel).toBe('Ticket restored')
+    expect(build('ticket.unknown_event').eventLabel).toBe('Ticket updated')
+  })
+
+  it('handles a null subject and null status label', () => {
+    const c = build('ticket.created', {}, null, null)
+    expect(c.ticketSubject).toBe('ticket')
+    expect(c.statusLabel).toBeUndefined()
+  })
+
+  it('falls back to actor email when displayName is missing', () => {
+    const e = ev('ticket.created')
+    ;(e as never as { actor: { displayName: string | null } }).actor.displayName = null
+    expect(buildTicketEmailEventConfig(e, 'https://app.test', 's', 'open').actorName).toBe(
+      'actor@x.test'
+    )
+  })
+
+  it('handles a ticket with no requester name/email and an invalid timestamp', () => {
+    const e = ev('ticket.created', {
+      ticket: { id: 'ticket_2', descriptionText: null, priority: null },
+    })
+    ;(e as never as { timestamp: string }).timestamp = 'not-a-date'
+    const c = buildTicketEmailEventConfig(e, 'https://app.test', 's', null)
+    expect(c.occurredAt).toBe('not-a-date')
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/updated-payload-shape.test.ts b/apps/web/src/lib/server/events/__tests__/updated-payload-shape.test.ts
new file mode 100644
index 000000000..5cee014a4
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/updated-payload-shape.test.ts
@@ -0,0 +1,53 @@
+/**
+ * Phase 6 housekeeping: lock in the `*.updated` payload contract.
+ *
+ * Every `*.updated` event must carry exactly two data keys: the entity
+ * reference and `changedFields: string[]`. No `before` / `previousValues` /
+ * `prior` / `oldValues` / `diff` snapshot may leak into the payload — keeping
+ * payloads bounded matches the established `ticket.updated` shape and lets
+ * integrators rely on the prior webhook (or REST GET) for before-state.
+ */
+import { describe, it, expect } from 'vitest'
+import { getSampleEventPayload } from '../sample-payloads'
+import type { EventType } from '../types'
+
+interface UpdatedCase {
+  type: EventType
+  refKey: 'inbox' | 'team' | 'status' | 'contact' | 'organization'
+}
+
+const CASES: UpdatedCase[] = [
+  { type: 'inbox.updated', refKey: 'inbox' },
+  { type: 'team.updated', refKey: 'team' },
+  { type: 'ticket_status.updated', refKey: 'status' },
+  { type: 'contact.updated', refKey: 'contact' },
+  { type: 'organization.updated', refKey: 'organization' },
+]
+
+const FORBIDDEN_KEYS = ['before', 'previous', 'previousValues', 'prior', 'oldValues', 'diff']
+
+describe('*.updated payload shape (Phase 6 housekeeping)', () => {
+  it.each(CASES)('$type carries only { $refKey, changedFields }', ({ type, refKey }) => {
+    const event = getSampleEventPayload(type)
+    const data = event.data as unknown as Record<string, unknown>
+
+    // changedFields is required, non-empty, all strings
+    expect(Array.isArray(data.changedFields)).toBe(true)
+    const changedFields = data.changedFields as unknown[]
+    expect(changedFields.length).toBeGreaterThan(0)
+    for (const f of changedFields) expect(typeof f).toBe('string')
+
+    // Entity ref present and shaped like an object with at least an id
+    expect(data[refKey]).toBeDefined()
+    expect(typeof data[refKey]).toBe('object')
+    expect((data[refKey] as { id?: unknown }).id).toBeDefined()
+
+    // Exactly the two expected keys — nothing else
+    expect(Object.keys(data).sort()).toEqual([refKey, 'changedFields'].sort())
+
+    // No before/previous-style snapshot keys leaked in
+    for (const k of FORBIDDEN_KEYS) {
+      expect(data).not.toHaveProperty(k)
+    }
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/webhook-event-config.test.ts b/apps/web/src/lib/server/events/__tests__/webhook-event-config.test.ts
new file mode 100644
index 000000000..f26537d6f
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/webhook-event-config.test.ts
@@ -0,0 +1,41 @@
+/**
+ * Guard test: every event in `EVENT_TYPES` MUST have a matching entry in
+ * `WEBHOOK_EVENT_CONFIG` (otherwise admins can't subscribe to it from the UI),
+ * and every category referenced must be declared in `WEBHOOK_EVENT_CATEGORIES`.
+ *
+ * Without this, a new event type can be added server-side and silently go dark
+ * for every webhook subscriber.
+ */
+import { describe, it, expect } from 'vitest'
+import { EVENT_TYPES } from '../types'
+import { WEBHOOK_EVENT_CONFIG, WEBHOOK_EVENT_CATEGORIES } from '../integrations/webhook/constants'
+
+describe('WEBHOOK_EVENT_CONFIG coverage', () => {
+  it('has exactly one entry per EVENT_TYPES member', () => {
+    const configIds = WEBHOOK_EVENT_CONFIG.map((e) => e.id).sort()
+    const eventIds = [...EVENT_TYPES].sort()
+    expect(configIds).toEqual(eventIds)
+  })
+
+  it('has no duplicate event ids', () => {
+    const ids = WEBHOOK_EVENT_CONFIG.map((e) => e.id)
+    expect(new Set(ids).size).toBe(ids.length)
+  })
+
+  it('uses only declared categories', () => {
+    const allowed = new Set(WEBHOOK_EVENT_CATEGORIES.map((c) => c.id))
+    for (const entry of WEBHOOK_EVENT_CONFIG) {
+      expect(
+        allowed.has(entry.category),
+        `unknown category for ${entry.id}: ${entry.category}`
+      ).toBe(true)
+    }
+  })
+
+  it('every declared category has at least one event', () => {
+    for (const category of WEBHOOK_EVENT_CATEGORIES) {
+      const count = WEBHOOK_EVENT_CONFIG.filter((e) => e.category === category.id).length
+      expect(count, `category ${category.id} has no events`).toBeGreaterThan(0)
+    }
+  })
+})
diff --git a/apps/web/src/lib/server/events/__tests__/webhook-handler.deliveries.test.ts b/apps/web/src/lib/server/events/__tests__/webhook-handler.deliveries.test.ts
new file mode 100644
index 000000000..f4ebfae37
--- /dev/null
+++ b/apps/web/src/lib/server/events/__tests__/webhook-handler.deliveries.test.ts
@@ -0,0 +1,160 @@
+/**
+ * webhook handler — delivery audit row coverage.
+ *
+ * Asserts that every terminal outcome of `webhookHook.run()` writes one
+ * `recordDeliveryAttempt(...)` row, and that a logging failure never breaks
+ * the dispatch pipeline.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const recordDeliveryAttemptMock = vi.fn().mockResolvedValue(undefined)
+const dnsResolve4Mock = vi.fn()
+const dnsResolve6Mock = vi.fn()
+
+vi.mock('dns/promises', () => ({
+  default: {
+    resolve4: (...args: unknown[]) => dnsResolve4Mock(...args),
+    resolve6: (...args: unknown[]) => dnsResolve6Mock(...args),
+  },
+  resolve4: (...args: unknown[]) => dnsResolve4Mock(...args),
+  resolve6: (...args: unknown[]) => dnsResolve6Mock(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    update: vi.fn(() => ({
+      set: vi.fn(() => ({ where: vi.fn().mockResolvedValue(undefined) })),
+    })),
+  },
+  webhooks: { id: 'id', failureCount: 'fc', status: 's' },
+  eq: vi.fn(),
+  sql: vi.fn(),
+}))
+
+vi.mock('@/lib/server/domains/webhooks/webhook.deliveries', () => ({
+  recordDeliveryAttempt: (...args: unknown[]) => recordDeliveryAttemptMock(...args),
+}))
+
+const fetchMock = vi.fn()
+vi.stubGlobal('fetch', fetchMock)
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  recordDeliveryAttemptMock.mockReset().mockResolvedValue(undefined)
+  dnsResolve4Mock.mockReset().mockResolvedValue(['8.8.8.8'])
+  dnsResolve6Mock.mockReset().mockResolvedValue([])
+  fetchMock.mockReset()
+})
+
+const event = {
+  type: 'post.created',
+  timestamp: new Date('2026-04-29T00:00:00.000Z').toISOString(),
+  data: { id: 'post_1' },
+} as never
+
+const target = { url: 'https://example.com/hook' } as never
+const config = { secret: 'shh', webhookId: 'webhook_1', attemptNumber: 2 } as never
+
+async function loadHandler() {
+  const mod = await import('../handlers/webhook')
+  return mod.webhookHook
+}
+
+// Helper to wait for fire-and-forget recordAttempt promise.
+async function flush() {
+  await new Promise((r) => setImmediate(r))
+}
+
+describe('webhookHook.run delivery audit', () => {
+  it('writes status=success on a 2xx response', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      status: 200,
+      text: () => Promise.resolve('ok'),
+    })
+    const handler = await loadHandler()
+    const res = await handler.run(event, target, config)
+    await flush()
+    expect(res.success).toBe(true)
+    expect(recordDeliveryAttemptMock).toHaveBeenCalledTimes(1)
+    expect(recordDeliveryAttemptMock.mock.calls[0][0]).toMatchObject({
+      status: 'success',
+      httpStatus: 200,
+      attemptNumber: 2,
+      eventType: 'post.created',
+    })
+  })
+
+  it('writes status=failed_retryable on 5xx', async () => {
+    fetchMock.mockResolvedValue({
+      ok: false,
+      status: 503,
+      text: () => Promise.resolve('boom'),
+    })
+    const handler = await loadHandler()
+    const res = await handler.run(event, target, config)
+    await flush()
+    expect(res).toMatchObject({ success: false, shouldRetry: true })
+    expect(recordDeliveryAttemptMock.mock.calls[0][0]).toMatchObject({
+      status: 'failed_retryable',
+      httpStatus: 503,
+    })
+  })
+
+  it('writes status=failed_terminal on 4xx (non-429)', async () => {
+    fetchMock.mockResolvedValue({
+      ok: false,
+      status: 400,
+      text: () => Promise.resolve('bad'),
+    })
+    const handler = await loadHandler()
+    const res = await handler.run(event, target, config)
+    await flush()
+    expect(res).toMatchObject({ success: false, shouldRetry: false })
+    expect(recordDeliveryAttemptMock.mock.calls[0][0]).toMatchObject({
+      status: 'failed_terminal',
+      httpStatus: 400,
+    })
+  })
+
+  it('writes status=failed_retryable on 429', async () => {
+    fetchMock.mockResolvedValue({
+      ok: false,
+      status: 429,
+      text: () => Promise.resolve('rate limited'),
+    })
+    const handler = await loadHandler()
+    await handler.run(event, target, config)
+    await flush()
+    expect(recordDeliveryAttemptMock.mock.calls[0][0]).toMatchObject({
+      status: 'failed_retryable',
+      httpStatus: 429,
+    })
+  })
+
+  it('writes status=blocked_ssrf when DNS resolves to a private IP', async () => {
+    dnsResolve4Mock.mockResolvedValue(['10.0.0.1'])
+    const handler = await loadHandler()
+    const res = await handler.run(event, target, config)
+    await flush()
+    expect(res).toMatchObject({ success: false, shouldRetry: false })
+    expect(recordDeliveryAttemptMock.mock.calls[0][0]).toMatchObject({
+      status: 'blocked_ssrf',
+    })
+    // fetch must NOT have been called
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('does not break dispatch when recordDeliveryAttempt throws', async () => {
+    recordDeliveryAttemptMock.mockRejectedValueOnce(new Error('audit down'))
+    fetchMock.mockResolvedValue({
+      ok: true,
+      status: 200,
+      text: () => Promise.resolve('ok'),
+    })
+    const handler = await loadHandler()
+    const res = await handler.run(event, target, config)
+    await flush()
+    expect(res.success).toBe(true)
+  })
+})
diff --git a/apps/web/src/lib/server/events/dispatch.ts b/apps/web/src/lib/server/events/dispatch.ts
index 45f531c37..21bc8d368 100644
--- a/apps/web/src/lib/server/events/dispatch.ts
+++ b/apps/web/src/lib/server/events/dispatch.ts
@@ -6,18 +6,57 @@
  * Errors are caught and logged rather than propagated to the caller.
  */
 
-import type { BoardId, ChangelogId, CommentId, PostId, PrincipalId, UserId } from '@quackback/ids'
+import type {
+  BoardId,
+  ChangelogId,
+  CommentId,
+  PostId,
+  PrincipalId,
+  UserId,
+  TicketStatusId,
+  InboxId,
+  TeamId,
+  ContactId,
+  OrganizationId,
+} from '@quackback/ids'
 
 import type {
   EventActor,
+  EventData,
+  EventPostRef,
+  EventTicketRef,
   EventConversationData,
   EventConversationRef,
-  EventData,
   EventMessageData,
-  EventPostRef,
+  EventInboxRef,
+  EventTeamRef,
+  EventTicketStatusRef,
+  EventContactRef,
+  EventOrganizationRef,
+  EventHelpCenterCategoryRef,
+  EventHelpCenterArticleRef,
+  EventChangelogRef,
+  EventSegmentRef,
+  EventUserAttributeRef,
+  EventBoardRef,
+  EventTagRef,
+  EventStatusRef,
+  EventRoadmapRef,
+  EventSlaPolicyRef,
+  EventRoutingRuleRef,
+  EventBusinessHoursRef,
+  EventInboxChannelRef,
+  EventInboxMembershipRef,
+  EventApiKeyRef,
+  EventRoleRef,
+  EventRoleAssignmentRef,
 } from './types.js'
-import { realEmail } from '@/lib/shared/anonymous-email'
+
 import { logger } from '@/lib/server/logger'
+import { realEmail } from '@/lib/shared/anonymous-email'
+import { db, eq, ticketStatuses, inboxes, teams, contacts, organizations } from '@/lib/server/db'
+import { getBaseUrl } from '@/lib/server/config'
+import { toIsoString } from '@/lib/shared/utils/date'
 
 // Re-export EventActor for API routes that need to construct actor objects
 export type { EventActor } from './types.js'
@@ -27,33 +66,27 @@ const log = logger.child({ component: 'dispatch' })
 /**
  * Build an EventActor from a principal with optional user details.
  * Constructs a 'user' actor when userId is present, otherwise a 'service' actor.
- *
- * `displayName` is preserved on user actors too (not just service) so
- * downstream handlers — notification text, mention email "by X" line —
- * can render the actor's name instead of falling back to "Anonymous user".
- * `name` is accepted as a fallback so callers passing a plain `author`
- * object (which uses `name`, not `displayName`) don't need to remap.
  */
 export function buildEventActor(actor: {
   principalId: PrincipalId
   userId?: UserId
   email?: string
   displayName?: string
-  name?: string
 }): EventActor {
-  const displayName = actor.displayName ?? actor.name
   if (actor.userId) {
     return {
       type: 'user',
       principalId: actor.principalId,
       userId: actor.userId,
-      // Anonymous users carry a synthetic placeholder email — never put it on
-      // the event actor (it reaches webhooks, integrations, the pipeline).
+      // Strip the synthetic anonymous placeholder ("temp-<id>@anon.quackback.io")
+      // so it never rides along into event payloads / webhook deliveries. Real
+      // user emails pass through unchanged. (Regression guard:
+      // build-event-actor.test.ts — this stripping exists on main and must not
+      // be lost when dispatch.ts is rewritten.)
       email: realEmail(actor.email) ?? undefined,
-      displayName,
     }
   }
-  return { type: 'service', principalId: actor.principalId, displayName }
+  return { type: 'service', principalId: actor.principalId, displayName: actor.displayName }
 }
 
 export interface PostCreatedInput {
@@ -108,6 +141,39 @@ async function dispatchEvent(event: EventData): Promise<void> {
     await processEvent(event)
   } catch (error) {
     log.error({ err: error, event_type: event.type, event_id: event.id }, 'failed to process event')
+    await fallbackSendEmails(event)
+  }
+}
+
+/**
+ * Best-effort fallback for when BullMQ/event processing is unavailable.
+ * Sends email targets synchronously so critical notifications are not dropped.
+ */
+async function fallbackSendEmails(event: EventData): Promise<void> {
+  try {
+    const [{ getHookTargets }, { emailHook }] = await Promise.all([
+      import('./targets'),
+      import('./handlers/email'),
+    ])
+    const targets = await getHookTargets(event)
+    const emailTargets = targets.filter((t) => t.type === 'email')
+    if (emailTargets.length === 0) return
+
+    for (const target of emailTargets) {
+      try {
+        await emailHook.run(event, target.target, target.config)
+      } catch (err) {
+        log.error(
+          { err, event_type: event.type, event_id: event.id },
+          'fallback email delivery failed'
+        )
+      }
+    }
+  } catch (err) {
+    log.error(
+      { err, event_type: event.type, event_id: event.id },
+      'fallback email resolution failed'
+    )
   }
 }
 
@@ -147,33 +213,6 @@ export async function dispatchCommentCreated(
   })
 }
 
-export interface PostMentionedInput {
-  postId: PostId
-  postTitle: string
-  postUrl: string
-  mentionedPrincipalId: PrincipalId
-  mentioningPrincipalId: PrincipalId
-  excerpt: string
-}
-
-export async function dispatchPostMentioned(
-  actor: EventActor,
-  input: PostMentionedInput
-): Promise<void> {
-  await dispatchEvent({
-    ...eventEnvelope(actor),
-    type: 'post.mentioned',
-    data: {
-      postId: input.postId,
-      postTitle: input.postTitle,
-      postUrl: input.postUrl,
-      mentionedPrincipalId: input.mentionedPrincipalId,
-      mentioningPrincipalId: input.mentioningPrincipalId,
-      excerpt: input.excerpt,
-    },
-  })
-}
-
 export async function dispatchPostUpdated(
   actor: EventActor,
   post: EventPostRef,
@@ -293,6 +332,546 @@ export async function dispatchChangelogPublished(
   })
 }
 
+// ============================================================================
+// Ticket dispatchers (Phase 7.5)
+// ============================================================================
+
+interface TicketDispatchOptions {
+  syncSourceIntegrationId?: string | null
+}
+
+function sourceFields(options?: TicketDispatchOptions) {
+  return options?.syncSourceIntegrationId
+    ? { syncSourceIntegrationId: options.syncSourceIntegrationId }
+    : {}
+}
+
+/**
+ * Build an `EventTicketRef` from a Drizzle ticket row.
+ *
+ * Accepts the raw ticket as `Record<string, unknown>` to avoid pulling the
+ * Ticket type into this file (which would create a circular import path
+ * through @/lib/server/db). Callers pass the ticket they already have.
+ */
+function ticketRef(t: Record<string, unknown>): EventTicketRef {
+  return {
+    id: String(t.id),
+    subject: (t.subject as string | null) ?? null,
+    descriptionText: (t.descriptionText as string | null) ?? null,
+    statusId: (t.statusId as string | null) ?? null,
+    statusCategory: (t.statusCategory as string | null) ?? null,
+    priority: (t.priority as string | null) ?? null,
+    channel: (t.channel as string | null) ?? null,
+    visibility: (t.visibility as string | null) ?? null,
+    inboxId: (t.inboxId as string | null) ?? null,
+    primaryTeamId: (t.primaryTeamId as string | null) ?? null,
+    assigneePrincipalId: (t.assigneePrincipalId as string | null) ?? null,
+    assigneeTeamId: (t.assigneeTeamId as string | null) ?? null,
+    requesterPrincipalId: (t.requesterPrincipalId as string | null) ?? null,
+    requesterContactId: (t.requesterContactId as string | null) ?? null,
+  }
+}
+
+/**
+ * Enrich a bare {@link ticketRef} with snapshot fields that downstream
+ * consumers (webhook deliveries, ticket-targets notification builders) read
+ * directly off the event payload — the related-entity display names, the
+ * requester's contact details, the organization, the created-at ISO string,
+ * and a deep-link `ticketUrl`. Each lookup is guarded by the presence of its
+ * id, so null ids cost no queries. The whole enrichment is best-effort: if any
+ * query throws we log and fall back to the bare ref rather than dropping the
+ * event, since the snapshot fields are convenience metadata, not load-bearing.
+ *
+ * Regression coverage: dispatch-enrichment.test.ts pins the lookup/skip/
+ * fallback/team-reuse behaviour exercised here.
+ */
+async function buildTicketRef(t: Record<string, unknown>): Promise<EventTicketRef> {
+  const base = ticketRef(t)
+  try {
+    const enriched: EventTicketRef = { ...base }
+
+    // Status name
+    enriched.statusName = base.statusId
+      ? ((
+          await db.query.ticketStatuses.findFirst({
+            where: eq(ticketStatuses.id, base.statusId as TicketStatusId),
+            columns: { name: true },
+          })
+        )?.name ?? null)
+      : null
+
+    // Inbox name + slug
+    if (base.inboxId) {
+      const inbox = await db.query.inboxes.findFirst({
+        where: eq(inboxes.id, base.inboxId as InboxId),
+        columns: { name: true, slug: true },
+      })
+      enriched.inboxName = inbox?.name ?? null
+      enriched.inboxSlug = inbox?.slug ?? null
+    } else {
+      enriched.inboxName = null
+      enriched.inboxSlug = null
+    }
+
+    // Team names — fetch each distinct team id once, then reuse for both the
+    // primary team and the assignee team (they are frequently the same).
+    const teamNameCache = new Map<string, string | null>()
+    const teamName = async (id: string | null): Promise<string | null> => {
+      if (!id) return null
+      if (teamNameCache.has(id)) return teamNameCache.get(id) ?? null
+      const row = await db.query.teams.findFirst({
+        where: eq(teams.id, id as TeamId),
+        columns: { name: true },
+      })
+      const name = row?.name ?? null
+      teamNameCache.set(id, name)
+      return name
+    }
+    enriched.primaryTeamName = await teamName(base.primaryTeamId)
+    enriched.assigneeTeamName = await teamName(base.assigneeTeamId)
+
+    // Requester contact (name + email, plus its organization for the org snapshot)
+    let contactOrgId: string | null = null
+    if (base.requesterContactId) {
+      const contact = await db.query.contacts.findFirst({
+        where: eq(contacts.id, base.requesterContactId as ContactId),
+        columns: { name: true, email: true, organizationId: true },
+      })
+      enriched.requesterName = contact?.name ?? null
+      // Never leak a synthetic anonymous placeholder address into the payload.
+      enriched.requesterEmail = realEmail(contact?.email) ?? null
+      contactOrgId = (contact?.organizationId as string | null) ?? null
+    } else {
+      enriched.requesterName = null
+      enriched.requesterEmail = null
+    }
+
+    // Organization — prefer the ticket's own org, else the requester contact's.
+    const organizationId = ((t.organizationId as string | null) ?? null) || contactOrgId
+    if (organizationId) {
+      const org = await db.query.organizations.findFirst({
+        where: eq(organizations.id, organizationId as OrganizationId),
+        columns: { name: true, domain: true },
+      })
+      enriched.organizationName = org?.name ?? null
+      enriched.organizationDomain = org?.domain ?? null
+    } else {
+      enriched.organizationName = null
+      enriched.organizationDomain = null
+    }
+
+    // Created-at snapshot (ISO) + admin deep link.
+    if (t.createdAt) enriched.createdAt = toIsoString(t.createdAt as Date | string)
+    enriched.ticketUrl = `${getBaseUrl()}/admin/tickets/${base.id}`
+
+    return enriched
+  } catch (err) {
+    // Best-effort: a failed snapshot lookup must not drop the event. Use
+    // console.warn (not the structured logger) so the failure is always
+    // surfaced even before logger transports are wired.
+    console.warn('[dispatch] ticket ref enrichment failed; using bare ref', err)
+    return base
+  }
+}
+
+export async function dispatchTicketCreated(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  options?: TicketDispatchOptions
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.created',
+    data: { ticket: await buildTicketRef(ticket) },
+  })
+}
+
+export async function dispatchTicketAssigned(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  previousAssigneePrincipalId: string | null,
+  newAssigneePrincipalId: string | null,
+  options?: TicketDispatchOptions
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.assigned',
+    data: {
+      ticket: await buildTicketRef(ticket),
+      previousAssigneePrincipalId,
+      newAssigneePrincipalId,
+    },
+  })
+}
+
+export async function dispatchTicketUnassigned(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  previousAssigneePrincipalId: string | null,
+  options?: TicketDispatchOptions
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.unassigned',
+    data: { ticket: await buildTicketRef(ticket), previousAssigneePrincipalId },
+  })
+}
+
+export async function dispatchTicketStatusChanged(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  previousStatusCategory: string | null,
+  newStatusCategory: string,
+  options?: TicketDispatchOptions
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.status_changed',
+    data: { ticket: await buildTicketRef(ticket), previousStatusCategory, newStatusCategory },
+  })
+}
+
+export async function dispatchTicketThreadAdded(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  threadId: string,
+  audience: 'public' | 'internal' | 'shared_team',
+  sharedWithTeamId: string | null,
+  thread?: {
+    bodyTextPreview: string
+    bodyText?: string
+    bodyTextTruncated: boolean
+    authorPrincipalId: string | null
+    isFromRequester: boolean
+    createdAt: Date | string
+  },
+  options?: TicketDispatchOptions
+): Promise<void> {
+  const threadSnapshot = thread
+    ? {
+        id: threadId,
+        audience,
+        bodyTextPreview: thread.bodyTextPreview,
+        bodyText: thread.bodyText,
+        bodyTextTruncated: thread.bodyTextTruncated,
+        authorPrincipalId: thread.authorPrincipalId,
+        isFromRequester: thread.isFromRequester,
+        sharedWithTeamId,
+        createdAt:
+          typeof thread.createdAt === 'string' ? thread.createdAt : thread.createdAt.toISOString(),
+      }
+    : undefined
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.thread_added',
+    data: {
+      ticket: await buildTicketRef(ticket),
+      threadId,
+      audience,
+      sharedWithTeamId,
+      thread: threadSnapshot,
+    },
+  })
+}
+
+export async function dispatchTicketThreadUpdated(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  threadId: string,
+  audience: 'public' | 'internal' | 'shared_team',
+  sharedWithTeamId: string | null,
+  thread: {
+    bodyTextPreview: string
+    bodyText?: string
+    bodyTextTruncated: boolean
+    authorPrincipalId: string | null
+    isFromRequester: boolean
+    createdAt: Date | string
+    editedAt: Date | string | null
+  },
+  options?: TicketDispatchOptions
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.thread_updated',
+    data: {
+      ticket: await buildTicketRef(ticket),
+      threadId,
+      audience,
+      sharedWithTeamId,
+      thread: {
+        id: threadId,
+        audience,
+        bodyTextPreview: thread.bodyTextPreview,
+        bodyText: thread.bodyText,
+        bodyTextTruncated: thread.bodyTextTruncated,
+        authorPrincipalId: thread.authorPrincipalId,
+        isFromRequester: thread.isFromRequester,
+        sharedWithTeamId,
+        createdAt:
+          typeof thread.createdAt === 'string' ? thread.createdAt : thread.createdAt.toISOString(),
+        editedAt:
+          thread.editedAt == null
+            ? null
+            : typeof thread.editedAt === 'string'
+              ? thread.editedAt
+              : thread.editedAt.toISOString(),
+      },
+    },
+  })
+}
+
+export async function dispatchTicketThreadDeleted(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  threadId: string,
+  audience: 'public' | 'internal' | 'shared_team',
+  sharedWithTeamId: string | null,
+  deletedByPrincipalId: string | null,
+  thread?: {
+    bodyTextPreview: string
+    bodyText?: string
+    bodyTextTruncated: boolean
+    authorPrincipalId: string | null
+    isFromRequester: boolean
+    createdAt: Date | string
+  },
+  options?: TicketDispatchOptions
+): Promise<void> {
+  const threadSnapshot = thread
+    ? {
+        id: threadId,
+        audience,
+        bodyTextPreview: thread.bodyTextPreview,
+        bodyText: thread.bodyText,
+        bodyTextTruncated: thread.bodyTextTruncated,
+        authorPrincipalId: thread.authorPrincipalId,
+        isFromRequester: thread.isFromRequester,
+        sharedWithTeamId,
+        createdAt:
+          typeof thread.createdAt === 'string' ? thread.createdAt : thread.createdAt.toISOString(),
+      }
+    : undefined
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.thread_deleted',
+    data: {
+      ticket: await buildTicketRef(ticket),
+      threadId,
+      audience,
+      sharedWithTeamId,
+      deletedByPrincipalId,
+      thread: threadSnapshot,
+    },
+  })
+}
+
+export async function dispatchTicketParticipantAdded(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  addedPrincipalId: string | null,
+  role: string | null
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.participant_added',
+    data: { ticket: await buildTicketRef(ticket), addedPrincipalId, role },
+  })
+}
+
+export async function dispatchTicketParticipantRemoved(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  removedPrincipalId: string | null
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.participant_removed',
+    data: { ticket: await buildTicketRef(ticket), removedPrincipalId },
+  })
+}
+
+export async function dispatchTicketShared(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  teamId: string,
+  accessLevel: string | null
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.shared',
+    data: { ticket: await buildTicketRef(ticket), teamId, accessLevel },
+  })
+}
+
+export async function dispatchTicketUnshared(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  teamId: string
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.unshared',
+    data: { ticket: await buildTicketRef(ticket), teamId },
+  })
+}
+
+export async function dispatchTicketSlaWarning(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  kind: string,
+  ruleName: string
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.sla_warning',
+    data: { ticket: await buildTicketRef(ticket), kind, ruleName },
+  })
+}
+
+export async function dispatchTicketSlaBreach(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  kind: string
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.sla_breach',
+    data: { ticket: await buildTicketRef(ticket), kind },
+  })
+}
+
+export async function dispatchTicketRestored(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  restoredByPrincipalId: string | null
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.restored',
+    data: { ticket: await buildTicketRef(ticket), restoredByPrincipalId },
+  })
+}
+
+export async function dispatchTicketUpdated(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  changedFields: string[],
+  diff: Record<string, { from: unknown; to: unknown }>,
+  options?: TicketDispatchOptions
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.updated',
+    data: { ticket: await buildTicketRef(ticket), changedFields, diff },
+  })
+}
+
+export async function dispatchTicketFirstResponse(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  threadId: string,
+  firstResponseAt: string,
+  options?: TicketDispatchOptions
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.first_response',
+    data: { ticket: await buildTicketRef(ticket), threadId, firstResponseAt },
+  })
+}
+
+export async function dispatchTicketAttachmentAdded(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  attachment: {
+    id: string
+    threadId: string
+    filename: string
+    mimeType: string
+    sizeBytes: number
+    uploadedByPrincipalId: string | null
+    publicUrl: string | null
+  }
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.attachment_added',
+    data: { ticket: await buildTicketRef(ticket), attachment },
+  })
+}
+
+export async function dispatchTicketAttachmentRemoved(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  attachment: { id: string; threadId: string; filename: string },
+  removedByPrincipalId: string | null
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket.attachment_removed',
+    data: { ticket: await buildTicketRef(ticket), attachment, removedByPrincipalId },
+  })
+}
+
+export async function dispatchTicketDeleted(
+  actor: EventActor,
+  ticket: Record<string, unknown>,
+  deletedByPrincipalId: string | null,
+  options?: TicketDispatchOptions
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    ...sourceFields(options),
+    type: 'ticket.deleted',
+    data: { ticket: await buildTicketRef(ticket), deletedByPrincipalId },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Post mention events
+// ---------------------------------------------------------------------------
+
+export interface PostMentionedInput {
+  postId: PostId
+  postTitle: string
+  postUrl: string
+  mentionedPrincipalId: PrincipalId
+  mentioningPrincipalId: PrincipalId
+  excerpt: string
+}
+
+export async function dispatchPostMentioned(
+  actor: EventActor,
+  input: PostMentionedInput
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'post.mentioned',
+    data: {
+      postId: input.postId,
+      postTitle: input.postTitle,
+      postUrl: input.postUrl,
+      mentionedPrincipalId: input.mentionedPrincipalId,
+      mentioningPrincipalId: input.mentioningPrincipalId,
+      excerpt: input.excerpt,
+    },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Conversation / message events (live-chat bridge)
+// ---------------------------------------------------------------------------
+
 export async function dispatchConversationCreated(
   actor: EventActor,
   conversation: EventConversationData
@@ -320,13 +899,13 @@ export async function dispatchConversationStatusChanged(
 export async function dispatchConversationAssigned(
   actor: EventActor,
   conversation: EventConversationRef,
-  assignedAgentPrincipalId: string | null,
-  previousAgentPrincipalId: string | null
+  previousAgentPrincipalId: string | null,
+  newAgentPrincipalId: string | null
 ): Promise<void> {
   await dispatchEvent({
     ...eventEnvelope(actor),
     type: 'conversation.assigned',
-    data: { conversation, assignedAgentPrincipalId, previousAgentPrincipalId },
+    data: { conversation, assignedAgentPrincipalId: newAgentPrincipalId, previousAgentPrincipalId },
   })
 }
 
@@ -347,13 +926,18 @@ export async function dispatchConversationCsatSubmitted(
   actor: EventActor,
   conversation: EventConversationRef,
   rating: number,
-  comment: string | null,
-  submittedAt: string
+  comment?: string | null,
+  submittedAt?: string
 ): Promise<void> {
   await dispatchEvent({
     ...eventEnvelope(actor),
     type: 'conversation.csat_submitted',
-    data: { conversation, rating, comment, submittedAt },
+    data: {
+      conversation,
+      rating,
+      comment: comment ?? null,
+      submittedAt: submittedAt ?? new Date().toISOString(),
+    },
   })
 }
 
@@ -392,3 +976,765 @@ export async function dispatchMessageDeleted(
     data: { message, conversation },
   })
 }
+
+// ---------------------------------------------------------------------------
+// Inbox events
+// ---------------------------------------------------------------------------
+
+export async function dispatchInboxCreated(actor: EventActor, inbox: EventInboxRef): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox.created',
+    data: { inbox },
+  })
+}
+
+export async function dispatchInboxUpdated(
+  actor: EventActor,
+  inbox: EventInboxRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox.updated',
+    data: { inbox, changedFields },
+  })
+}
+
+export async function dispatchInboxArchived(
+  actor: EventActor,
+  inbox: EventInboxRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox.archived',
+    data: { inbox },
+  })
+}
+
+export async function dispatchInboxUnarchived(
+  actor: EventActor,
+  inbox: EventInboxRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox.unarchived',
+    data: { inbox },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Team events
+// ---------------------------------------------------------------------------
+
+export async function dispatchTeamCreated(actor: EventActor, team: EventTeamRef): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'team.created', data: { team } })
+}
+
+export async function dispatchTeamUpdated(
+  actor: EventActor,
+  team: EventTeamRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'team.updated',
+    data: { team, changedFields },
+  })
+}
+
+export async function dispatchTeamArchived(actor: EventActor, team: EventTeamRef): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'team.archived', data: { team } })
+}
+
+// ---------------------------------------------------------------------------
+// Ticket status events
+// ---------------------------------------------------------------------------
+
+export async function dispatchTicketStatusCreated(
+  actor: EventActor,
+  status: EventTicketStatusRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'ticket_status.created', data: { status } })
+}
+
+export async function dispatchTicketStatusUpdated(
+  actor: EventActor,
+  status: EventTicketStatusRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'ticket_status.updated',
+    data: { status, changedFields },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Contact events
+// ---------------------------------------------------------------------------
+
+export async function dispatchContactCreated(
+  actor: EventActor,
+  contact: EventContactRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'contact.created', data: { contact } })
+}
+
+export async function dispatchContactUpdated(
+  actor: EventActor,
+  contact: EventContactRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'contact.updated',
+    data: { contact, changedFields },
+  })
+}
+
+export async function dispatchContactArchived(
+  actor: EventActor,
+  contact: EventContactRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'contact.archived', data: { contact } })
+}
+
+export async function dispatchContactLinked(
+  actor: EventActor,
+  contact: EventContactRef,
+  userId: string,
+  linkedByPrincipalId: string | null
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'contact.linked',
+    data: { contact, userId, linkedByPrincipalId },
+  })
+}
+
+export async function dispatchContactUnlinked(
+  actor: EventActor,
+  contact: EventContactRef,
+  userId: string
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'contact.unlinked',
+    data: { contact, userId },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Organization events
+// ---------------------------------------------------------------------------
+
+export async function dispatchOrganizationCreated(
+  actor: EventActor,
+  organization: EventOrganizationRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'organization.created',
+    data: { organization },
+  })
+}
+
+export async function dispatchOrganizationUpdated(
+  actor: EventActor,
+  organization: EventOrganizationRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'organization.updated',
+    data: { organization, changedFields },
+  })
+}
+
+export async function dispatchOrganizationArchived(
+  actor: EventActor,
+  organization: EventOrganizationRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'organization.archived',
+    data: { organization },
+  })
+}
+
+export async function dispatchOrganizationUnarchived(
+  actor: EventActor,
+  organization: EventOrganizationRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'organization.unarchived',
+    data: { organization },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Help Center — category events
+// ---------------------------------------------------------------------------
+
+export async function dispatchHelpCenterCategoryCreated(
+  actor: EventActor,
+  category: EventHelpCenterCategoryRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'help_center.category.created',
+    data: { category },
+  })
+}
+
+export async function dispatchHelpCenterCategoryUpdated(
+  actor: EventActor,
+  category: EventHelpCenterCategoryRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'help_center.category.updated',
+    data: { category, changedFields },
+  })
+}
+
+export async function dispatchHelpCenterCategoryDeleted(
+  actor: EventActor,
+  category: EventHelpCenterCategoryRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'help_center.category.deleted',
+    data: { category },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Help Center — article events
+// ---------------------------------------------------------------------------
+
+export async function dispatchHelpCenterArticleCreated(
+  actor: EventActor,
+  article: EventHelpCenterArticleRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'help_center.article.created',
+    data: { article },
+  })
+}
+
+export async function dispatchHelpCenterArticleUpdated(
+  actor: EventActor,
+  article: EventHelpCenterArticleRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'help_center.article.updated',
+    data: { article, changedFields },
+  })
+}
+
+export async function dispatchHelpCenterArticlePublished(
+  actor: EventActor,
+  article: EventHelpCenterArticleRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'help_center.article.published',
+    data: { article },
+  })
+}
+
+export async function dispatchHelpCenterArticleUnpublished(
+  actor: EventActor,
+  article: EventHelpCenterArticleRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'help_center.article.unpublished',
+    data: { article },
+  })
+}
+
+export async function dispatchHelpCenterArticleDeleted(
+  actor: EventActor,
+  article: EventHelpCenterArticleRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'help_center.article.deleted',
+    data: { article },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Changelog — entry CRUD events ('changelog.published' is dispatched above)
+// ---------------------------------------------------------------------------
+
+export async function dispatchChangelogCreated(
+  actor: EventActor,
+  changelog: EventChangelogRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'changelog.created',
+    data: { changelog },
+  })
+}
+
+export async function dispatchChangelogUpdated(
+  actor: EventActor,
+  changelog: EventChangelogRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'changelog.updated',
+    data: { changelog, changedFields },
+  })
+}
+
+export async function dispatchChangelogDeleted(
+  actor: EventActor,
+  changelog: EventChangelogRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'changelog.deleted',
+    data: { changelog },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Audience — segment events
+// ---------------------------------------------------------------------------
+
+export async function dispatchSegmentCreated(
+  actor: EventActor,
+  segment: EventSegmentRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'segment.created',
+    data: { segment },
+  })
+}
+
+export async function dispatchSegmentUpdated(
+  actor: EventActor,
+  segment: EventSegmentRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'segment.updated',
+    data: { segment, changedFields },
+  })
+}
+
+export async function dispatchSegmentDeleted(
+  actor: EventActor,
+  segment: EventSegmentRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'segment.deleted',
+    data: { segment },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Audience — user-attribute definition events
+// ---------------------------------------------------------------------------
+
+export async function dispatchUserAttributeCreated(
+  actor: EventActor,
+  attribute: EventUserAttributeRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'user_attribute.created',
+    data: { attribute },
+  })
+}
+
+export async function dispatchUserAttributeUpdated(
+  actor: EventActor,
+  attribute: EventUserAttributeRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'user_attribute.updated',
+    data: { attribute, changedFields },
+  })
+}
+
+export async function dispatchUserAttributeDeleted(
+  actor: EventActor,
+  attribute: EventUserAttributeRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'user_attribute.deleted',
+    data: { attribute },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Feedback configuration — board events
+// ---------------------------------------------------------------------------
+
+export async function dispatchBoardCreated(actor: EventActor, board: EventBoardRef): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'board.created', data: { board } })
+}
+
+export async function dispatchBoardUpdated(
+  actor: EventActor,
+  board: EventBoardRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'board.updated',
+    data: { board, changedFields },
+  })
+}
+
+export async function dispatchBoardDeleted(actor: EventActor, board: EventBoardRef): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'board.deleted', data: { board } })
+}
+
+// ---------------------------------------------------------------------------
+// Feedback configuration — tag events
+// ---------------------------------------------------------------------------
+
+export async function dispatchTagCreated(actor: EventActor, tag: EventTagRef): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'tag.created', data: { tag } })
+}
+
+export async function dispatchTagUpdated(
+  actor: EventActor,
+  tag: EventTagRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'tag.updated',
+    data: { tag, changedFields },
+  })
+}
+
+export async function dispatchTagDeleted(actor: EventActor, tag: EventTagRef): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'tag.deleted', data: { tag } })
+}
+
+// ---------------------------------------------------------------------------
+// Feedback configuration — status events
+// ---------------------------------------------------------------------------
+
+export async function dispatchStatusCreated(
+  actor: EventActor,
+  status: EventStatusRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'status.created', data: { status } })
+}
+
+export async function dispatchStatusUpdated(
+  actor: EventActor,
+  status: EventStatusRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'status.updated',
+    data: { status, changedFields },
+  })
+}
+
+export async function dispatchStatusDeleted(
+  actor: EventActor,
+  status: EventStatusRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'status.deleted', data: { status } })
+}
+
+// ---------------------------------------------------------------------------
+// Feedback configuration — roadmap events
+// ---------------------------------------------------------------------------
+
+export async function dispatchRoadmapCreated(
+  actor: EventActor,
+  roadmap: EventRoadmapRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'roadmap.created', data: { roadmap } })
+}
+
+export async function dispatchRoadmapUpdated(
+  actor: EventActor,
+  roadmap: EventRoadmapRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'roadmap.updated',
+    data: { roadmap, changedFields },
+  })
+}
+
+export async function dispatchRoadmapDeleted(
+  actor: EventActor,
+  roadmap: EventRoadmapRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'roadmap.deleted', data: { roadmap } })
+}
+
+// ---------------------------------------------------------------------------
+// Support configuration — SLA policy events
+// ---------------------------------------------------------------------------
+
+export async function dispatchSlaPolicyCreated(
+  actor: EventActor,
+  policy: EventSlaPolicyRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'sla_policy.created', data: { policy } })
+}
+
+export async function dispatchSlaPolicyUpdated(
+  actor: EventActor,
+  policy: EventSlaPolicyRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'sla_policy.updated',
+    data: { policy, changedFields },
+  })
+}
+
+export async function dispatchSlaPolicyArchived(
+  actor: EventActor,
+  policy: EventSlaPolicyRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'sla_policy.archived', data: { policy } })
+}
+
+// ---------------------------------------------------------------------------
+// Support configuration — routing rule events
+// ---------------------------------------------------------------------------
+
+export async function dispatchRoutingRuleCreated(
+  actor: EventActor,
+  rule: EventRoutingRuleRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'routing_rule.created', data: { rule } })
+}
+
+export async function dispatchRoutingRuleUpdated(
+  actor: EventActor,
+  rule: EventRoutingRuleRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'routing_rule.updated',
+    data: { rule, changedFields },
+  })
+}
+
+export async function dispatchRoutingRuleDeleted(
+  actor: EventActor,
+  rule: EventRoutingRuleRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'routing_rule.deleted', data: { rule } })
+}
+
+// ---------------------------------------------------------------------------
+// Support configuration — business hours events
+// ---------------------------------------------------------------------------
+
+export async function dispatchBusinessHoursCreated(
+  actor: EventActor,
+  businessHours: EventBusinessHoursRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'business_hours.created',
+    data: { businessHours },
+  })
+}
+
+export async function dispatchBusinessHoursUpdated(
+  actor: EventActor,
+  businessHours: EventBusinessHoursRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'business_hours.updated',
+    data: { businessHours, changedFields },
+  })
+}
+
+export async function dispatchBusinessHoursArchived(
+  actor: EventActor,
+  businessHours: EventBusinessHoursRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'business_hours.archived',
+    data: { businessHours },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Support configuration — inbox channel events
+// ---------------------------------------------------------------------------
+
+export async function dispatchInboxChannelCreated(
+  actor: EventActor,
+  channel: EventInboxChannelRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'inbox_channel.created', data: { channel } })
+}
+
+export async function dispatchInboxChannelUpdated(
+  actor: EventActor,
+  channel: EventInboxChannelRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox_channel.updated',
+    data: { channel, changedFields },
+  })
+}
+
+export async function dispatchInboxChannelArchived(
+  actor: EventActor,
+  channel: EventInboxChannelRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox_channel.archived',
+    data: { channel },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Support configuration — inbox membership events
+// ---------------------------------------------------------------------------
+
+export async function dispatchInboxMembershipAdded(
+  actor: EventActor,
+  membership: EventInboxMembershipRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox_membership.added',
+    data: { membership },
+  })
+}
+
+export async function dispatchInboxMembershipUpdated(
+  actor: EventActor,
+  membership: EventInboxMembershipRef,
+  previousRole: string | null
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox_membership.updated',
+    data: { membership, previousRole },
+  })
+}
+
+export async function dispatchInboxMembershipRemoved(
+  actor: EventActor,
+  membership: EventInboxMembershipRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'inbox_membership.removed',
+    data: { membership },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Administration / security — API key events
+// ---------------------------------------------------------------------------
+
+export async function dispatchApiKeyCreated(
+  actor: EventActor,
+  apiKey: EventApiKeyRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'api_key.created', data: { apiKey } })
+}
+
+export async function dispatchApiKeyRotated(
+  actor: EventActor,
+  apiKey: EventApiKeyRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'api_key.rotated', data: { apiKey } })
+}
+
+export async function dispatchApiKeyRevoked(
+  actor: EventActor,
+  apiKey: EventApiKeyRef
+): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'api_key.revoked', data: { apiKey } })
+}
+
+// ---------------------------------------------------------------------------
+// Administration / security — role events
+// ---------------------------------------------------------------------------
+
+export async function dispatchRoleCreated(actor: EventActor, role: EventRoleRef): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'role.created', data: { role } })
+}
+
+export async function dispatchRoleUpdated(
+  actor: EventActor,
+  role: EventRoleRef,
+  changedFields: string[]
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'role.updated',
+    data: { role, changedFields },
+  })
+}
+
+export async function dispatchRoleDeleted(actor: EventActor, role: EventRoleRef): Promise<void> {
+  await dispatchEvent({ ...eventEnvelope(actor), type: 'role.deleted', data: { role } })
+}
+
+// ---------------------------------------------------------------------------
+// Administration / security — role assignment events
+// ---------------------------------------------------------------------------
+
+export async function dispatchRoleAssignmentCreated(
+  actor: EventActor,
+  assignment: EventRoleAssignmentRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'role_assignment.created',
+    data: { assignment },
+  })
+}
+
+export async function dispatchRoleAssignmentRevoked(
+  actor: EventActor,
+  assignment: EventRoleAssignmentRef
+): Promise<void> {
+  await dispatchEvent({
+    ...eventEnvelope(actor),
+    type: 'role_assignment.revoked',
+    data: { assignment },
+  })
+}
diff --git a/apps/web/src/lib/server/events/handlers/ai.ts b/apps/web/src/lib/server/events/handlers/ai.ts
index a0dc5ead2..7a1b0fefe 100644
--- a/apps/web/src/lib/server/events/handlers/ai.ts
+++ b/apps/web/src/lib/server/events/handlers/ai.ts
@@ -106,7 +106,10 @@ async function processEmbedding(postId: PostId, title: string, content: string):
   // Fetch tags to include in embedding for better semantic matching
   const tagNames = await getPostTagNames(postId)
   if (tagNames.length > 0) {
-    log.debug({ post_id: postId, tag_count: tagNames.length, tags: tagNames }, 'including tags in embedding')
+    log.debug(
+      { post_id: postId, tag_count: tagNames.length, tags: tagNames },
+      'including tags in embedding'
+    )
   }
 
   const success = await generatePostEmbedding(postId, title, content, tagNames)
diff --git a/apps/web/src/lib/server/events/handlers/email.ts b/apps/web/src/lib/server/events/handlers/email.ts
index dbc7d5322..017b3f94d 100644
--- a/apps/web/src/lib/server/events/handlers/email.ts
+++ b/apps/web/src/lib/server/events/handlers/email.ts
@@ -8,6 +8,7 @@ import {
   sendNewCommentEmail,
   sendChangelogPublishedEmail,
   sendPostMentionEmail,
+  sendTicketEventEmail,
 } from '@quackback/email'
 import type { HookHandler, HookResult, EmailTarget, EmailConfig } from '../hook-types'
 import type { EventData, EventPostMentionedData } from '../types'
@@ -72,6 +73,26 @@ export const emailHook: HookHandler = {
           unsubscribeUrl,
           logoUrl: cfg.logoUrl,
         })
+      } else if (event.type.startsWith('ticket.')) {
+        result = await sendTicketEventEmail({
+          to: email,
+          title: cfg.title as string,
+          body: cfg.body as string | undefined,
+          ticketSubject: cfg.ticketSubject as string,
+          ticketUrl: cfg.ticketUrl as string,
+          workspaceName: cfg.workspaceName,
+          unsubscribeUrl,
+          logoUrl: cfg.logoUrl,
+          priorityLabel: cfg.priorityLabel as string | undefined,
+          statusLabel: cfg.statusLabel as string | undefined,
+          summary: cfg.summary,
+          eventLabel: cfg.eventLabel,
+          actorName: cfg.actorName,
+          occurredAt: cfg.occurredAt,
+          details: cfg.details,
+          contentSections: cfg.contentSections,
+          quote: cfg.quote,
+        })
       } else {
         return { success: false, error: `Unsupported event type: ${event.type}` }
       }
diff --git a/apps/web/src/lib/server/events/handlers/notification.ts b/apps/web/src/lib/server/events/handlers/notification.ts
index 67fa75f13..c72091214 100644
--- a/apps/web/src/lib/server/events/handlers/notification.ts
+++ b/apps/web/src/lib/server/events/handlers/notification.ts
@@ -48,7 +48,10 @@ export const notificationHook: HookHandler = {
       return { success: true }
     }
 
-    log.debug({ event_type: event.type, member_count: principalIds.length }, 'creating notifications')
+    log.debug(
+      { event_type: event.type, member_count: principalIds.length },
+      'creating notifications'
+    )
 
     try {
       const notifications = buildNotifications(event, principalIds, cfg)
diff --git a/apps/web/src/lib/server/events/handlers/webhook.ts b/apps/web/src/lib/server/events/handlers/webhook.ts
index e912c9028..c1dcd87b9 100644
--- a/apps/web/src/lib/server/events/handlers/webhook.ts
+++ b/apps/web/src/lib/server/events/handlers/webhook.ts
@@ -94,7 +94,10 @@ export const webhookHook: HookHandler = {
     ctx?: HookRunContext
   ): Promise<HookResult> {
     const { url } = target as WebhookTarget
-    const { secret, webhookId } = config as WebhookConfig
+    const { secret, webhookId, attemptNumber } = config as WebhookConfig & {
+      attemptNumber?: number
+    }
+    const attempt = attemptNumber ?? 1
 
     // Idempotency: if BullMQ is re-running this job after a worker crash,
     // skip the delivery — the previous attempt already POSTed (and the
@@ -108,26 +111,47 @@ export const webhookHook: HookHandler = {
 
     log.debug({ event_type: event.type, url }, 'processing webhook')
 
+    const eventId = `evt_${crypto.randomUUID().replace(/-/g, '')}`
+    const timestamp = Math.floor(Date.now() / 1000)
+
     // SSRF protection: Resolve and validate IP at delivery time
     // Note: We validate the IP but use the original hostname for the request
     // to ensure TLS certificates match. The TOCTOU window is minimal in practice.
     const parsedUrl = new URL(url)
     const ipCheck = await resolveAndValidateIP(parsedUrl.hostname)
     if (!ipCheck.valid) {
-      log.error({ url, reason: ipCheck.error }, 'ssrf blocked')
+      log.error(`[Webhook] ❌ SSRF blocked: ${ipCheck.error}`)
+      void recordAttempt({
+        webhookId,
+        eventId,
+        eventType: event.type,
+        attemptNumber: attempt,
+        status: 'blocked_ssrf',
+        errorMessage: ipCheck.error ?? 'blocked',
+        requestUrl: url,
+        requestPayloadBytes: 0,
+        signatureTimestamp: timestamp,
+      })
       return { success: false, error: ipCheck.error, shouldRetry: false }
     }
 
     // Build payload
     const payload = JSON.stringify({
-      id: `evt_${crypto.randomUUID().replace(/-/g, '')}`,
+      id: eventId,
       type: event.type,
       createdAt: event.timestamp,
       data: event.data,
     })
+    const payloadBytes = Buffer.byteLength(payload, 'utf8')
+    // Cap stored payload at ~32 KB so the audit log stays small enough to
+    // browse cheaply. Oversized payloads are dropped (NULL) and flagged so
+    // the redeliver UI can surface a friendly "payload not stored" message.
+    const PAYLOAD_STORE_MAX = 32 * 1024
+    const requestPayloadJson: unknown =
+      payloadBytes <= PAYLOAD_STORE_MAX ? JSON.parse(payload) : null
+    const requestPayloadTruncated = payloadBytes > PAYLOAD_STORE_MAX
 
     // Create HMAC signature
-    const timestamp = Math.floor(Date.now() / 1000)
     const signaturePayload = `${timestamp}.${payload}`
     const signature = crypto.createHmac('sha256', secret).update(signaturePayload).digest('hex')
 
@@ -139,6 +163,7 @@ export const webhookHook: HookHandler = {
       'X-Quackback-Event': event.type,
     }
 
+    const start = Date.now()
     try {
       const controller = new AbortController()
       const timeoutId = setTimeout(() => controller.abort(), TIMEOUT_MS)
@@ -152,10 +177,35 @@ export const webhookHook: HookHandler = {
       })
 
       clearTimeout(timeoutId)
+      const latencyMs = Date.now() - start
+
+      // Read up to 500 chars of response body for the audit log.
+      let snippet: string | null = null
+      try {
+        const text = await response.text()
+        snippet = text.slice(0, 500)
+      } catch {
+        snippet = null
+      }
 
       if (response.ok) {
         log.info({ event_type: event.type, url }, 'webhook delivered')
         await updateWebhookSuccess(webhookId)
+        void recordAttempt({
+          webhookId,
+          eventId,
+          eventType: event.type,
+          attemptNumber: attempt,
+          status: 'success',
+          httpStatus: response.status,
+          requestUrl: url,
+          requestPayloadBytes: payloadBytes,
+          requestPayloadJson,
+          requestPayloadTruncated,
+          responseBodySnippet: snippet,
+          latencyMs,
+          signatureTimestamp: timestamp,
+        })
         return { success: true }
       }
 
@@ -163,8 +213,25 @@ export const webhookHook: HookHandler = {
       const error = `HTTP ${response.status}`
       log.warn({ url, status: response.status }, 'webhook delivery failed')
       const retryable = response.status >= 500 || response.status === 429
+      void recordAttempt({
+        webhookId,
+        eventId,
+        eventType: event.type,
+        attemptNumber: attempt,
+        status: retryable ? 'failed_retryable' : 'failed_terminal',
+        httpStatus: response.status,
+        errorMessage: error,
+        requestUrl: url,
+        requestPayloadBytes: payloadBytes,
+        requestPayloadJson,
+        requestPayloadTruncated,
+        responseBodySnippet: snippet,
+        latencyMs,
+        signatureTimestamp: timestamp,
+      })
       return { success: false, error, shouldRetry: retryable }
     } catch (error) {
+      const latencyMs = Date.now() - start
       let errorMsg = 'Unknown error'
       if (error instanceof Error) {
         errorMsg = error.name === 'AbortError' ? 'Request timeout' : error.message
@@ -172,11 +239,50 @@ export const webhookHook: HookHandler = {
 
       log.error({ err: error, url }, 'webhook delivery failed')
       const retryable = isRetryableError(error)
+      void recordAttempt({
+        webhookId,
+        eventId,
+        eventType: event.type,
+        attemptNumber: attempt,
+        status: retryable ? 'failed_retryable' : 'failed_terminal',
+        errorMessage: errorMsg,
+        requestUrl: url,
+        requestPayloadBytes: payloadBytes,
+        requestPayloadJson,
+        requestPayloadTruncated,
+        latencyMs,
+        signatureTimestamp: timestamp,
+      })
       return { success: false, error: errorMsg, shouldRetry: retryable }
     }
   },
 }
 
+async function recordAttempt(input: {
+  webhookId: WebhookId
+  eventId: string
+  eventType: string
+  attemptNumber: number
+  status: 'queued' | 'success' | 'failed_retryable' | 'failed_terminal' | 'blocked_ssrf'
+  httpStatus?: number | null
+  errorMessage?: string | null
+  requestUrl: string
+  requestPayloadBytes: number
+  requestPayloadJson?: unknown
+  requestPayloadTruncated?: boolean
+  responseBodySnippet?: string | null
+  latencyMs?: number | null
+  signatureTimestamp: number
+}): Promise<void> {
+  try {
+    const { recordDeliveryAttempt } =
+      await import('@/lib/server/domains/webhooks/webhook.deliveries')
+    await recordDeliveryAttempt(input)
+  } catch (err) {
+    console.warn('[Webhook] recordDeliveryAttempt failed', err)
+  }
+}
+
 /**
  * Update webhook on successful delivery.
  */
diff --git a/apps/web/src/lib/server/events/hook-context.ts b/apps/web/src/lib/server/events/hook-context.ts
index d2ce883b0..8de3ba501 100644
--- a/apps/web/src/lib/server/events/hook-context.ts
+++ b/apps/web/src/lib/server/events/hook-context.ts
@@ -6,9 +6,9 @@
  */
 
 import { db } from '@/lib/server/db'
-import { getBaseUrl } from '@/lib/server/config'
 import { getEmailSafeUrl } from '@/lib/server/storage/s3'
 import { logger } from '@/lib/server/logger'
+import { resolvePublicBaseUrl } from '@/lib/server/public-url'
 
 const log = logger.child({ component: 'hook-context' })
 
@@ -42,7 +42,7 @@ export async function buildHookContext(): Promise<HookContext | null> {
 
   return {
     workspaceName: settings.name,
-    portalBaseUrl: getBaseUrl(),
+    portalBaseUrl: resolvePublicBaseUrl(),
     logoUrl: getEmailSafeUrl(settings.logoKey),
   }
 }
diff --git a/apps/web/src/lib/server/events/hook-types.ts b/apps/web/src/lib/server/events/hook-types.ts
index 8efb4151c..505560322 100644
--- a/apps/web/src/lib/server/events/hook-types.ts
+++ b/apps/web/src/lib/server/events/hook-types.ts
@@ -23,6 +23,8 @@ export interface HookResult {
   error?: string
   /** Whether this error is retryable (network issues, rate limits) */
   shouldRetry?: boolean
+  /** Successful no-op that should be logged as skipped when the integration supports it. */
+  skipped?: boolean
 }
 
 /**
@@ -125,4 +127,22 @@ export interface EmailConfig {
   commentPreview?: string
   isTeamMember?: boolean
   logoUrl?: string
+  title?: string
+  body?: string
+  summary?: string
+  eventLabel?: string
+  actorName?: string
+  occurredAt?: string
+  details?: Array<{ label: string; value: string }>
+  contentSections?: Array<{
+    title: string
+    body?: string
+    rows?: Array<{ label: string; value: string }>
+    tone?: 'default' | 'quote' | 'warning'
+  }>
+  quote?: string
+  ticketSubject?: string
+  ticketUrl?: string
+  statusLabel?: string
+  priorityLabel?: string
 }
diff --git a/apps/web/src/lib/server/events/integrations/webhook/constants.ts b/apps/web/src/lib/server/events/integrations/webhook/constants.ts
index 50d16e693..3a1d68d17 100644
--- a/apps/web/src/lib/server/events/integrations/webhook/constants.ts
+++ b/apps/web/src/lib/server/events/integrations/webhook/constants.ts
@@ -17,6 +17,27 @@ import { EVENT_TYPES, type EventType } from '../../types'
 export const WEBHOOK_EVENTS = EVENT_TYPES
 export type WebhookEventType = EventType
 
+/**
+ * Categories used to group webhook events in the admin UI picker.
+ * The order here drives the rendered section order.
+ */
+export const WEBHOOK_EVENT_CATEGORIES = [
+  { id: 'posts', label: 'Posts' },
+  { id: 'comments', label: 'Comments' },
+  { id: 'changelog', label: 'Changelog' },
+  { id: 'tickets', label: 'Tickets' },
+  { id: 'configuration', label: 'Configuration' },
+  { id: 'contacts', label: 'Contacts' },
+  { id: 'organizations', label: 'Organizations' },
+  { id: 'conversations', label: 'Conversations' },
+  { id: 'help_center', label: 'Help Center' },
+  { id: 'audience', label: 'Audience' },
+  { id: 'feedback_config', label: 'Feedback Configuration' },
+  { id: 'admin', label: 'Administration' },
+] as const satisfies ReadonlyArray<{ id: string; label: string }>
+
+export type WebhookEventCategory = (typeof WEBHOOK_EVENT_CATEGORIES)[number]['id']
+
 /**
  * Human-readable labels and descriptions for webhook events.
  * Used in the admin UI for event selection.
@@ -26,98 +47,673 @@ export const WEBHOOK_EVENT_CONFIG = [
     id: 'post.created',
     label: 'New Post Created',
     description: 'When a user submits feedback',
+    category: 'posts',
   },
   {
     id: 'post.status_changed',
     label: 'Post Status Changed',
     description: 'When a post status is updated',
+    category: 'posts',
   },
   {
     id: 'post.updated',
     label: 'Post Updated',
     description: 'When a post title, content, tags, or owner is changed',
+    category: 'posts',
   },
   {
     id: 'post.deleted',
     label: 'Post Deleted',
     description: 'When a post is soft-deleted',
+    category: 'posts',
   },
   {
     id: 'post.restored',
     label: 'Post Restored',
     description: 'When a deleted post is restored',
+    category: 'posts',
   },
   {
     id: 'post.merged',
     label: 'Post Merged',
     description: 'When a duplicate post is merged into a canonical post',
+    category: 'posts',
   },
   {
     id: 'post.unmerged',
     label: 'Post Unmerged',
     description: 'When a merged post is separated back out',
+    category: 'posts',
+  },
+  {
+    id: 'post.mentioned',
+    label: 'Post Mention',
+    description: 'When a principal is mentioned in a post body',
+    category: 'posts',
   },
   {
     id: 'comment.created',
     label: 'New Comment',
     description: 'When a comment is posted',
+    category: 'comments',
   },
   {
     id: 'comment.updated',
     label: 'Comment Updated',
     description: 'When a comment is edited',
+    category: 'comments',
   },
   {
     id: 'comment.deleted',
     label: 'Comment Deleted',
     description: 'When a comment is deleted',
+    category: 'comments',
   },
   {
     id: 'changelog.published',
     label: 'Changelog Published',
     description: 'When a changelog entry is published',
+    category: 'changelog',
+  },
+  {
+    id: 'changelog.created',
+    label: 'Changelog Created',
+    description: 'When a changelog entry is created (draft, scheduled, or published)',
+    category: 'changelog',
+  },
+  {
+    id: 'changelog.updated',
+    label: 'Changelog Updated',
+    description: "When a changelog entry's title, content, category, or product is changed",
+    category: 'changelog',
+  },
+  {
+    id: 'changelog.deleted',
+    label: 'Changelog Deleted',
+    description: 'When a changelog entry is soft-deleted',
+    category: 'changelog',
+  },
+  {
+    id: 'ticket.created',
+    label: 'Ticket Created',
+    description: 'When a new support ticket is opened (portal, email, API, or widget)',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.updated',
+    label: 'Ticket Updated',
+    description:
+      "When a ticket's subject, priority, team, visibility, inbox, organization, or requester is changed",
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.deleted',
+    label: 'Ticket Deleted',
+    description: 'When a ticket is soft-deleted by an agent',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.restored',
+    label: 'Ticket Restored',
+    description: 'When a soft-deleted ticket is restored',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.assigned',
+    label: 'Ticket Assigned',
+    description: 'When a ticket is assigned to an agent or team',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.unassigned',
+    label: 'Ticket Unassigned',
+    description: "When a ticket's assignee is cleared",
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.status_changed',
+    label: 'Ticket Status Changed',
+    description: 'When a ticket moves to a new status (e.g. open → solved)',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.first_response',
+    label: 'Ticket First Response',
+    description:
+      'When the first public agent reply on a ticket is recorded (the SLA first-response clock stops)',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.thread_added',
+    label: 'Ticket Reply Added',
+    description:
+      'When a public reply is added to a ticket. Internal and shared-team notes are never delivered.',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.thread_updated',
+    label: 'Ticket Reply Updated',
+    description:
+      'When a public ticket reply is edited. Internal and shared-team notes are never delivered.',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.thread_deleted',
+    label: 'Ticket Reply Deleted',
+    description:
+      'When a public ticket reply is deleted. Internal and shared-team notes are never delivered.',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.participant_added',
+    label: 'Ticket Participant Added',
+    description: 'When a watcher, collaborator, or CC is added to a ticket',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.participant_removed',
+    label: 'Ticket Participant Removed',
+    description: 'When a participant is removed from a ticket',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.shared',
+    label: 'Ticket Shared',
+    description: 'When a ticket is shared with another team',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.unshared',
+    label: 'Ticket Unshared',
+    description: 'When a ticket share is revoked',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.sla_warning',
+    label: 'SLA Warning',
+    description: 'When a ticket is approaching an SLA deadline (escalation rule fired)',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.sla_breach',
+    label: 'SLA Breach',
+    description: 'When a ticket misses an SLA target',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.attachment_added',
+    label: 'Ticket Attachment Added',
+    description: 'When a file is attached to a ticket thread',
+    category: 'tickets',
+  },
+  {
+    id: 'ticket.attachment_removed',
+    label: 'Ticket Attachment Removed',
+    description: 'When a ticket attachment is deleted',
+    category: 'tickets',
+  },
+  // Configuration plane (Phase 6)
+  {
+    id: 'inbox.created',
+    label: 'Inbox Created',
+    description: 'When a new inbox is added to the workspace',
+    category: 'configuration',
+  },
+  {
+    id: 'inbox.updated',
+    label: 'Inbox Updated',
+    description: 'When inbox settings change (name, defaults, primary team)',
+    category: 'configuration',
+  },
+  {
+    id: 'inbox.archived',
+    label: 'Inbox Archived',
+    description: 'When an inbox is archived (hidden from active queues)',
+    category: 'configuration',
+  },
+  {
+    id: 'inbox.unarchived',
+    label: 'Inbox Unarchived',
+    description: 'When an archived inbox is restored',
+    category: 'configuration',
+  },
+  {
+    id: 'team.created',
+    label: 'Team Created',
+    description: 'When a new team is added to the workspace',
+    category: 'configuration',
+  },
+  {
+    id: 'team.updated',
+    label: 'Team Updated',
+    description: 'When team settings change (name, color, archived state)',
+    category: 'configuration',
+  },
+  {
+    id: 'team.archived',
+    label: 'Team Archived',
+    description: 'When a team is archived',
+    category: 'configuration',
+  },
+  {
+    id: 'ticket_status.created',
+    label: 'Ticket Status Created',
+    description: 'When a new workflow status is added',
+    category: 'configuration',
+  },
+  {
+    id: 'ticket_status.updated',
+    label: 'Ticket Status Updated',
+    description: 'When a workflow status is renamed, recategorized, or archived',
+    category: 'configuration',
+  },
+  {
+    id: 'contact.created',
+    label: 'Contact Created',
+    description: 'When a CRM contact is added (UI, REST, or ticket intake)',
+    category: 'contacts',
+  },
+  {
+    id: 'contact.updated',
+    label: 'Contact Updated',
+    description: "When a contact's name, email, organization, or other fields change",
+    category: 'contacts',
+  },
+  {
+    id: 'contact.archived',
+    label: 'Contact Archived',
+    description: 'When a contact is soft-deleted',
+    category: 'contacts',
+  },
+  {
+    id: 'contact.linked',
+    label: 'Contact Linked to User',
+    description: 'When a contact is linked to a portal user account',
+    category: 'contacts',
+  },
+  {
+    id: 'contact.unlinked',
+    label: 'Contact Unlinked from User',
+    description: 'When a contact is unlinked from a portal user account',
+    category: 'contacts',
+  },
+  {
+    id: 'organization.created',
+    label: 'Organization Created',
+    description: 'When a CRM organization is added (UI, REST, or ticket intake by domain)',
+    category: 'organizations',
+  },
+  {
+    id: 'organization.updated',
+    label: 'Organization Updated',
+    description: "When an organization's name, domain, website, or other fields change",
+    category: 'organizations',
+  },
+  {
+    id: 'organization.archived',
+    label: 'Organization Archived',
+    description: 'When an organization is archived',
+    category: 'organizations',
+  },
+  {
+    id: 'organization.unarchived',
+    label: 'Organization Unarchived',
+    description: 'When an archived organization is restored',
+    category: 'organizations',
   },
   {
     id: 'conversation.created',
     label: 'Conversation Created',
     description: 'When a visitor starts a new conversation',
+    category: 'conversations',
   },
   {
     id: 'conversation.status_changed',
     label: 'Conversation Status Changed',
     description: 'When a conversation moves between open, pending, and closed',
+    category: 'conversations',
   },
   {
     id: 'conversation.assigned',
     label: 'Conversation Assigned',
     description: 'When a conversation is assigned to (or unassigned from) an agent',
+    category: 'conversations',
   },
   {
     id: 'conversation.priority_changed',
     label: 'Conversation Priority Changed',
     description: 'When a conversation priority is changed',
+    category: 'conversations',
   },
   {
     id: 'conversation.csat_submitted',
     label: 'CSAT Submitted',
     description: 'When a visitor submits a satisfaction rating',
+    category: 'conversations',
   },
   {
     id: 'message.created',
     label: 'New Message',
     description: 'When a visitor or agent sends a public message',
+    category: 'conversations',
   },
   {
     id: 'message.note_created',
     label: 'Internal Note Added',
     description: 'When an agent adds an internal note (private content — opt-in)',
+    category: 'conversations',
   },
   {
     id: 'message.deleted',
     label: 'Message Deleted',
     description: 'When a public message is deleted',
+    category: 'conversations',
+  },
+  // Help Center (Phase 2)
+  {
+    id: 'help_center.category.created',
+    label: 'Help Center Category Created',
+    description: 'When a new help-center category is added',
+    category: 'help_center',
+  },
+  {
+    id: 'help_center.category.updated',
+    label: 'Help Center Category Updated',
+    description: "When a category's name, slug, parent, visibility, or position changes",
+    category: 'help_center',
+  },
+  {
+    id: 'help_center.category.deleted',
+    label: 'Help Center Category Deleted',
+    description: 'When a help-center category is soft-deleted',
+    category: 'help_center',
+  },
+  {
+    id: 'help_center.article.created',
+    label: 'Help Center Article Created',
+    description: 'When a new help-center article is created',
+    category: 'help_center',
+  },
+  {
+    id: 'help_center.article.updated',
+    label: 'Help Center Article Updated',
+    description: "When an article's title, content, category, or slug changes",
+    category: 'help_center',
+  },
+  {
+    id: 'help_center.article.published',
+    label: 'Help Center Article Published',
+    description: 'When a help-center article is published',
+    category: 'help_center',
+  },
+  {
+    id: 'help_center.article.unpublished',
+    label: 'Help Center Article Unpublished',
+    description: 'When a published help-center article is reverted to draft',
+    category: 'help_center',
+  },
+  {
+    id: 'help_center.article.deleted',
+    label: 'Help Center Article Deleted',
+    description: 'When a help-center article is soft-deleted',
+    category: 'help_center',
+  },
+  // Audience (Phase 2)
+  {
+    id: 'segment.created',
+    label: 'Segment Created',
+    description: 'When a new audience segment is created (manual or dynamic)',
+    category: 'audience',
+  },
+  {
+    id: 'segment.updated',
+    label: 'Segment Updated',
+    description: "When a segment's name, rules, color, or schedule changes",
+    category: 'audience',
+  },
+  {
+    id: 'segment.deleted',
+    label: 'Segment Deleted',
+    description: 'When an audience segment is soft-deleted',
+    category: 'audience',
+  },
+  {
+    id: 'user_attribute.created',
+    label: 'User Attribute Created',
+    description: 'When a new user-attribute definition is added',
+    category: 'audience',
+  },
+  {
+    id: 'user_attribute.updated',
+    label: 'User Attribute Updated',
+    description: "When a user-attribute definition's label, type, or mapping changes",
+    category: 'audience',
+  },
+  {
+    id: 'user_attribute.deleted',
+    label: 'User Attribute Deleted',
+    description: 'When a user-attribute definition is deleted',
+    category: 'audience',
+  },
+  // Feedback configuration (boards, tags, post statuses, roadmaps)
+  {
+    id: 'board.created',
+    label: 'Board Created',
+    description: 'When a feedback board is created',
+    category: 'feedback_config',
+  },
+  {
+    id: 'board.updated',
+    label: 'Board Updated',
+    description: 'When a feedback board is updated',
+    category: 'feedback_config',
+  },
+  {
+    id: 'board.deleted',
+    label: 'Board Deleted',
+    description: 'When a feedback board is deleted',
+    category: 'feedback_config',
+  },
+  {
+    id: 'tag.created',
+    label: 'Tag Created',
+    description: 'When a post tag is created',
+    category: 'feedback_config',
+  },
+  {
+    id: 'tag.updated',
+    label: 'Tag Updated',
+    description: 'When a post tag is updated',
+    category: 'feedback_config',
+  },
+  {
+    id: 'tag.deleted',
+    label: 'Tag Deleted',
+    description: 'When a post tag is deleted',
+    category: 'feedback_config',
+  },
+  {
+    id: 'status.created',
+    label: 'Status Created',
+    description: 'When a post status is created',
+    category: 'feedback_config',
+  },
+  {
+    id: 'status.updated',
+    label: 'Status Updated',
+    description: 'When a post status is updated',
+    category: 'feedback_config',
+  },
+  {
+    id: 'status.deleted',
+    label: 'Status Deleted',
+    description: 'When a post status is deleted',
+    category: 'feedback_config',
+  },
+  {
+    id: 'roadmap.created',
+    label: 'Roadmap Created',
+    description: 'When a roadmap is created',
+    category: 'feedback_config',
+  },
+  {
+    id: 'roadmap.updated',
+    label: 'Roadmap Updated',
+    description: 'When a roadmap is updated',
+    category: 'feedback_config',
+  },
+  {
+    id: 'roadmap.deleted',
+    label: 'Roadmap Deleted',
+    description: 'When a roadmap is deleted',
+    category: 'feedback_config',
+  },
+  // Support configuration (SLA, routing, business hours, inbox channels/memberships)
+  {
+    id: 'sla_policy.created',
+    label: 'SLA Policy Created',
+    description: 'When an SLA policy is created',
+    category: 'configuration',
+  },
+  {
+    id: 'sla_policy.updated',
+    label: 'SLA Policy Updated',
+    description: 'When an SLA policy is updated',
+    category: 'configuration',
+  },
+  {
+    id: 'sla_policy.archived',
+    label: 'SLA Policy Archived',
+    description: 'When an SLA policy is archived',
+    category: 'configuration',
+  },
+  {
+    id: 'routing_rule.created',
+    label: 'Routing Rule Created',
+    description: 'When a routing rule is created',
+    category: 'configuration',
+  },
+  {
+    id: 'routing_rule.updated',
+    label: 'Routing Rule Updated',
+    description: 'When a routing rule is updated',
+    category: 'configuration',
+  },
+  {
+    id: 'routing_rule.deleted',
+    label: 'Routing Rule Deleted',
+    description: 'When a routing rule is deleted',
+    category: 'configuration',
+  },
+  {
+    id: 'business_hours.created',
+    label: 'Business Hours Created',
+    description: 'When a business-hours calendar is created',
+    category: 'configuration',
+  },
+  {
+    id: 'business_hours.updated',
+    label: 'Business Hours Updated',
+    description: 'When a business-hours calendar is updated',
+    category: 'configuration',
+  },
+  {
+    id: 'business_hours.archived',
+    label: 'Business Hours Archived',
+    description: 'When a business-hours calendar is archived',
+    category: 'configuration',
+  },
+  {
+    id: 'inbox_channel.created',
+    label: 'Inbox Channel Created',
+    description: 'When an inbox channel is added',
+    category: 'configuration',
+  },
+  {
+    id: 'inbox_channel.updated',
+    label: 'Inbox Channel Updated',
+    description: 'When an inbox channel is updated',
+    category: 'configuration',
+  },
+  {
+    id: 'inbox_channel.archived',
+    label: 'Inbox Channel Archived',
+    description: 'When an inbox channel is archived',
+    category: 'configuration',
+  },
+  {
+    id: 'inbox_membership.added',
+    label: 'Inbox Member Added',
+    description: 'When a principal is added to an inbox',
+    category: 'configuration',
+  },
+  {
+    id: 'inbox_membership.updated',
+    label: 'Inbox Member Updated',
+    description: "When an inbox member's role changes",
+    category: 'configuration',
+  },
+  {
+    id: 'inbox_membership.removed',
+    label: 'Inbox Member Removed',
+    description: 'When a principal is removed from an inbox',
+    category: 'configuration',
+  },
+  // Administration (API keys, roles, role assignments)
+  {
+    id: 'api_key.created',
+    label: 'API Key Created',
+    description: 'When an API key is created',
+    category: 'admin',
+  },
+  {
+    id: 'api_key.rotated',
+    label: 'API Key Rotated',
+    description: 'When an API key secret is rotated',
+    category: 'admin',
+  },
+  {
+    id: 'api_key.revoked',
+    label: 'API Key Revoked',
+    description: 'When an API key is revoked',
+    category: 'admin',
+  },
+  {
+    id: 'role.created',
+    label: 'Role Created',
+    description: 'When a custom role is created',
+    category: 'admin',
+  },
+  {
+    id: 'role.updated',
+    label: 'Role Updated',
+    description: 'When a role is updated',
+    category: 'admin',
+  },
+  {
+    id: 'role.deleted',
+    label: 'Role Deleted',
+    description: 'When a custom role is deleted',
+    category: 'admin',
+  },
+  {
+    id: 'role_assignment.created',
+    label: 'Role Assigned',
+    description: 'When a role is assigned to a principal',
+    category: 'admin',
+  },
+  {
+    id: 'role_assignment.revoked',
+    label: 'Role Revoked',
+    description: 'When a role assignment is revoked',
+    category: 'admin',
   },
-] as const satisfies ReadonlyArray<{ id: WebhookEventType; label: string; description: string }>
+] as const satisfies ReadonlyArray<{
+  id: WebhookEventType
+  label: string
+  description: string
+  category: WebhookEventCategory
+}>
 
 // ============================================
 // URL Validation (SSRF Protection)
diff --git a/apps/web/src/lib/server/events/process.ts b/apps/web/src/lib/server/events/process.ts
index 8f4600c3d..12dcdd290 100644
--- a/apps/web/src/lib/server/events/process.ts
+++ b/apps/web/src/lib/server/events/process.ts
@@ -46,8 +46,8 @@ const DEFAULT_JOB_OPTS = {
 }
 
 let initPromise: Promise<{
-  queue: Queue<HookJobData>
-  worker: Worker<HookJobData>
+  queue: Queue
+  worker: Worker
 }> | null = null
 
 /**
@@ -55,14 +55,16 @@ let initPromise: Promise<{
  * Uses a Promise to guard against concurrent first-call race conditions.
  * Resets on failure so transient errors don't permanently break the queue.
  */
-function ensureQueue(): Promise<Queue<HookJobData>> {
+function ensureQueue(): Promise<Queue> {
   if (!initPromise) {
     initPromise = initializeQueue().catch((err) => {
       initPromise = null
       throw err
     })
   }
-  return initPromise.then(({ queue }) => queue)
+  const promise = initPromise
+  if (!promise) throw new Error('Event queue failed to initialize')
+  return promise.then(({ queue }) => queue)
 }
 
 async function initializeQueue() {
@@ -71,15 +73,15 @@ async function initializeQueue() {
   // BullMQ duplicates this client internally for the Worker's blocking
   // commands (BLMOVE), so a single shared connection is safe and avoids
   // opening N TCP sockets per queue.
-  const queue = new Queue<HookJobData>(QUEUE_NAME, {
+  const queue = new Queue(QUEUE_NAME, {
     connection,
     defaultJobOptions: DEFAULT_JOB_OPTS,
   })
 
-  const worker = new Worker<HookJobData>(
+  const worker = new Worker(
     QUEUE_NAME,
     async (job) => {
-      const { hookType, event, target, config: hookConfig } = job.data
+      const { hookType, event, target, config: hookConfig } = job.data as HookJobData
 
       // Handle delayed changelog publish sentinel
       if (hookType === '__changelog_publish__') {
@@ -98,9 +100,16 @@ async function initializeQueue() {
 
       let result: HookResult
       try {
+        // Phase 7: thread the BullMQ attempt counter into hook config so
+        // delivery handlers (e.g. webhook) can record the attempt number
+        // on each audit-log row.
+        const configWithAttempt = {
+          ...hookConfig,
+          attemptNumber: (job.attemptsMade ?? 0) + 1,
+        }
         // Pass job.id so idempotency-sensitive handlers (webhook, AI)
         // can dedupe re-runs after worker crashes.
-        result = await hook.run(event, target, hookConfig, { jobId: job.id })
+        result = await hook.run(event, target, configWithAttempt, { jobId: job.id })
       } catch (error) {
         if (isRetryableError(error)) throw error
         throw new UnrecoverableError(error instanceof Error ? error.message : 'Unknown error')
@@ -108,9 +117,7 @@ async function initializeQueue() {
 
       if (result.success) {
         if (result.externalId) {
-          persistExternalLink(job.data, result).catch((err) =>
-            log.error({ err }, 'failed to persist external link')
-          )
+          await persistExternalLink(job.data, result)
         }
         return
       }
@@ -195,24 +202,42 @@ async function updateWebhookFailureCount(data: HookJobData, errorMessage: string
  * Non-fatal — errors are logged but don't fail the hook job.
  */
 async function persistExternalLink(data: HookJobData, result: HookResult): Promise<void> {
-  // Extract postId from event data
+  // Ticket external links — use integrationId from config (set by targets.ts)
+  const ticketId = (data.event.data as { ticket?: { id?: string } }).ticket?.id
+  if (ticketId && data.event.type === 'ticket.created') {
+    const integrationId = data.config.integrationId as string | undefined
+    if (!integrationId) return
+
+    const { db, ticketExternalLinks } = await import('@/lib/server/db')
+    await db
+      .insert(ticketExternalLinks)
+      .values({
+        ticketId: ticketId as import('@quackback/ids').TicketId,
+        integrationId: integrationId as import('@quackback/ids').IntegrationId,
+        integrationType: data.hookType,
+        externalId: result.externalId!,
+        externalDisplayId: result.externalDisplayId ?? null,
+        externalUrl: result.externalUrl ?? null,
+        syncDirection: 'outbound',
+      })
+      .onConflictDoNothing()
+    return
+  }
+
+  // Post external links — use the resolved integration target when available.
   const postId = (data.event.data as { post?: { id?: string } }).post?.id
-  if (!postId) return
+  if (!postId || data.event.type !== 'post.created') return
 
-  const { db, integrations, postExternalLinks, eq } = await import('@/lib/server/db')
+  const integrationId = data.config.integrationId as string | undefined
+  if (!integrationId) return
 
-  // Look up the integration by type
-  const integration = await db.query.integrations.findFirst({
-    where: eq(integrations.integrationType, data.hookType),
-    columns: { id: true },
-  })
-  if (!integration) return
+  const { db, postExternalLinks } = await import('@/lib/server/db')
 
   await db
     .insert(postExternalLinks)
     .values({
       postId: postId as import('@quackback/ids').PostId,
-      integrationId: integration.id as import('@quackback/ids').IntegrationId,
+      integrationId: integrationId as import('@quackback/ids').IntegrationId,
       integrationType: data.hookType,
       externalId: result.externalId!,
       externalDisplayId: result.externalDisplayId ?? null,
@@ -322,7 +347,10 @@ async function handleDelayedChangelogPublish(hookConfig: Record<string, unknown>
   })
 
   if (!entry || !entry.publishedAt || entry.publishedAt > new Date()) {
-    log.debug({ changelog_id: changelogId }, 'skipping delayed changelog publish, no longer published')
+    log.debug(
+      { changelog_id: changelogId },
+      'skipping delayed changelog publish, no longer published'
+    )
     return
   }
 
diff --git a/apps/web/src/lib/server/events/sample-payloads.ts b/apps/web/src/lib/server/events/sample-payloads.ts
new file mode 100644
index 000000000..aab7edda2
--- /dev/null
+++ b/apps/web/src/lib/server/events/sample-payloads.ts
@@ -0,0 +1,974 @@
+/**
+ * Canonical sample event payloads — one per `EventType`.
+ *
+ * Used by:
+ *   - the test-fire endpoint (`POST /api/v1/webhooks/:id/test`) to send a
+ *     well-formed, deterministic event to a webhook endpoint without waiting
+ *     for real activity, and
+ *   - the create/edit dialog payload-preview accordion so operators can see
+ *     exactly what each event subscription will look like on the wire.
+ *
+ * IDs in samples are static placeholders (`*_sample`) — they do NOT exist
+ * in the database. Receivers should not look these up; the actor is always
+ * marked as a `service` so production logic can short-circuit on test events.
+ */
+import type { EventData, EventType, EventActor } from './types'
+
+const SAMPLE_TIMESTAMP = '2026-01-01T12:00:00.000Z'
+const SAMPLE_ACTOR: EventActor = {
+  type: 'service',
+  service: 'quackback-test-fire',
+  displayName: 'Quackback Test Fire',
+}
+
+function envelope<T extends EventType>(type: T, eventId: string) {
+  return { id: eventId, type, timestamp: SAMPLE_TIMESTAMP, actor: SAMPLE_ACTOR }
+}
+
+const SAMPLE_POST_REF = {
+  id: 'post_sample',
+  title: 'Sample feedback post',
+  boardId: 'board_sample',
+  boardSlug: 'feature-requests',
+}
+
+const SAMPLE_TICKET_REF = {
+  id: 'ticket_sample',
+  subject: 'Sample ticket — please ignore',
+  descriptionText: null,
+  statusId: 'tstatus_sample_open',
+  statusCategory: 'open',
+  priority: 'normal',
+  channel: 'portal',
+  visibility: 'team',
+  inboxId: 'inbox_sample',
+  primaryTeamId: 'team_sample',
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  requesterPrincipalId: 'principal_sample_requester',
+  requesterContactId: 'contact_sample',
+  statusName: 'Open',
+  inboxName: 'Support',
+  inboxSlug: 'support',
+  primaryTeamName: 'CX Team',
+  assigneeTeamName: null,
+  requesterEmail: '[email protected]',
+  requesterName: 'Sample Requester',
+  organizationName: 'Sample Org',
+  organizationDomain: 'sample.test',
+  createdAt: SAMPLE_TIMESTAMP,
+  firstResponseAt: null,
+  resolvedAt: null,
+  reopenedAt: null,
+  closedAt: null,
+  ticketUrl: 'https://app.example.test/tickets/ticket_sample',
+}
+
+const SAMPLE_INBOX_REF = {
+  id: 'inbox_sample',
+  slug: 'support',
+  name: 'Support',
+  description: 'Sample inbox for testing',
+  primaryTeamId: 'team_sample',
+  defaultVisibilityScope: 'team',
+  defaultPriority: 'normal',
+  defaultStatusId: 'tstatus_sample_open',
+  color: '#6366f1',
+  icon: 'inbox',
+  archivedAt: null,
+}
+
+const SAMPLE_TEAM_REF = {
+  id: 'team_sample',
+  slug: 'cx',
+  name: 'CX Team',
+  description: 'Sample team for testing',
+  shortLabel: 'CX',
+  color: '#10b981',
+  archivedAt: null,
+}
+
+const SAMPLE_TICKET_STATUS_REF = {
+  id: 'tstatus_sample_open',
+  slug: 'open',
+  name: 'Open',
+  color: '#3b82f6',
+  category: 'open',
+  position: 0,
+  isDefault: true,
+  isSystem: false,
+  deletedAt: null,
+}
+
+const SAMPLE_CONTACT_REF = {
+  id: 'contact_sample',
+  name: 'Sample Requester',
+  email: '[email protected]',
+  phone: null,
+  title: 'Customer',
+  externalId: null,
+  organizationId: 'org_sample',
+  archivedAt: null,
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+
+const SAMPLE_ORG_REF = {
+  id: 'org_sample',
+  name: 'Sample Org',
+  domain: 'sample.test',
+  website: 'https://sample.test',
+  externalId: null,
+  archivedAt: null,
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+
+const SAMPLE_CONVERSATION_REF = {
+  id: 'conv_sample',
+  status: 'open' as const,
+  channel: 'live_chat' as const,
+  priority: 'medium' as const,
+}
+
+const SAMPLE_CONVERSATION_DATA = {
+  ...SAMPLE_CONVERSATION_REF,
+  subject: 'Sample conversation — please ignore',
+  visitorPrincipalId: 'principal_sample_visitor',
+  visitorEmail: '[email protected]',
+  assignedAgentPrincipalId: null,
+  createdAt: SAMPLE_TIMESTAMP,
+  lastMessageAt: SAMPLE_TIMESTAMP,
+  resolvedAt: null,
+}
+
+const SAMPLE_MESSAGE_DATA = {
+  id: 'msg_sample',
+  conversationId: 'conv_sample',
+  senderType: 'visitor' as const,
+  authorPrincipalId: 'principal_sample_visitor',
+  authorName: 'Sample Visitor',
+  authorEmail: '[email protected]',
+  content: 'Sample message body.',
+  createdAt: SAMPLE_TIMESTAMP,
+}
+
+const SAMPLE_HELP_CENTER_CATEGORY_REF = {
+  id: 'category_sample',
+  slug: 'getting-started',
+  name: 'Getting Started',
+  parentId: null,
+  isPublic: true,
+  visibility: 'public',
+  position: 0,
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+
+const SAMPLE_HELP_CENTER_ARTICLE_REF = {
+  id: 'article_sample',
+  categoryId: 'category_sample',
+  slug: 'how-to-get-started',
+  title: 'How to get started',
+  authorPrincipalId: 'principal_sample_author',
+  publishedAt: SAMPLE_TIMESTAMP,
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+
+const SAMPLE_CHANGELOG_REF = {
+  id: 'changelog_sample',
+  title: 'Sample release',
+  contentPreview: 'New things shipped this week.',
+  categoryId: null,
+  productId: null,
+  publishedAt: SAMPLE_TIMESTAMP,
+  linkedPostCount: 3,
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+
+const SAMPLE_SEGMENT_REF = {
+  id: 'segment_sample',
+  slug: 'power-users',
+  name: 'Power Users',
+  type: 'dynamic',
+  color: '#6b7280',
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+
+const SAMPLE_USER_ATTRIBUTE_REF = {
+  id: 'user_attr_sample',
+  key: 'plan_tier',
+  label: 'Plan Tier',
+  type: 'string',
+  currencyCode: null,
+  externalKey: null,
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+
+const SAMPLE_BOARD_REF = {
+  id: 'board_sample',
+  slug: 'feature-requests',
+  name: 'Feature Requests',
+  description: null,
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+const SAMPLE_TAG_REF = {
+  id: 'tag_sample',
+  name: 'bug',
+  color: '#ef4444',
+  description: null,
+  createdAt: SAMPLE_TIMESTAMP,
+}
+const SAMPLE_STATUS_REF = {
+  id: 'status_sample',
+  slug: 'planned',
+  name: 'Planned',
+  color: '#3b82f6',
+  category: 'active',
+  position: 0,
+  showOnRoadmap: true,
+  isDefault: false,
+  createdAt: SAMPLE_TIMESTAMP,
+}
+const SAMPLE_ROADMAP_REF = {
+  id: 'roadmap_sample',
+  slug: '2026',
+  name: '2026 Roadmap',
+  description: null,
+  isPublic: true,
+  position: 0,
+  createdAt: SAMPLE_TIMESTAMP,
+  updatedAt: SAMPLE_TIMESTAMP,
+}
+const SAMPLE_SLA_POLICY_REF = {
+  id: 'sla_pol_sample',
+  name: 'Standard SLA',
+  scope: 'workspace',
+  enabled: true,
+  priority: 0,
+  archivedAt: null,
+}
+const SAMPLE_ROUTING_RULE_REF = {
+  id: 'route_rule_sample',
+  name: 'Billing to Finance',
+  enabled: true,
+  priority: 0,
+  inboxIdScope: null,
+}
+const SAMPLE_BUSINESS_HOURS_REF = {
+  id: 'bizhrs_sample',
+  name: 'Weekdays 9-5',
+  timezone: 'America/New_York',
+  archivedAt: null,
+}
+const SAMPLE_INBOX_CHANNEL_REF = {
+  id: 'inbox_ch_sample',
+  inboxId: 'inbox_sample',
+  kind: 'email',
+  label: 'Support Email',
+  externalId: null,
+  enabled: true,
+  archivedAt: null,
+}
+const SAMPLE_INBOX_MEMBERSHIP_REF = {
+  id: 'inbox_mem_sample',
+  inboxId: 'inbox_sample',
+  principalId: 'principal_sample',
+  role: 'agent',
+}
+const SAMPLE_API_KEY_REF = {
+  id: 'api_key_sample',
+  name: 'CI deploy key',
+  scopes: ['ticket.view_all'],
+}
+const SAMPLE_ROLE_REF = {
+  id: 'role_sample',
+  key: 'billing_agent',
+  name: 'Billing Agent',
+  isSystem: false,
+}
+const SAMPLE_ROLE_ASSIGNMENT_REF = {
+  id: 'role_asgn_sample',
+  roleId: 'role_sample',
+  roleKey: 'billing_agent',
+  principalId: 'principal_sample',
+  teamId: null,
+}
+
+const SAMPLES: Partial<{ [K in EventType]: EventData }> & Record<string, EventData> = {
+  'post.created': {
+    ...envelope('post.created', 'evt_sample_post_created'),
+    data: {
+      post: {
+        ...SAMPLE_POST_REF,
+        content: 'This is a sample post body.',
+        authorEmail: '[email protected]',
+        authorName: 'Sample User',
+        voteCount: 0,
+      },
+    },
+  },
+  'post.status_changed': {
+    ...envelope('post.status_changed', 'evt_sample_post_status_changed'),
+    data: { post: SAMPLE_POST_REF, previousStatus: 'open', newStatus: 'planned' },
+  },
+  'post.updated': {
+    ...envelope('post.updated', 'evt_sample_post_updated'),
+    data: { post: SAMPLE_POST_REF, changedFields: ['title'] },
+  },
+  'post.deleted': {
+    ...envelope('post.deleted', 'evt_sample_post_deleted'),
+    data: { post: SAMPLE_POST_REF, deletedBy: 'admin@example.test' },
+  },
+  'post.restored': {
+    ...envelope('post.restored', 'evt_sample_post_restored'),
+    data: { post: SAMPLE_POST_REF },
+  },
+  'post.merged': {
+    ...envelope('post.merged', 'evt_sample_post_merged'),
+    data: {
+      duplicatePost: SAMPLE_POST_REF,
+      canonicalPost: { ...SAMPLE_POST_REF, id: 'post_sample_canonical' },
+    },
+  },
+  'post.unmerged': {
+    ...envelope('post.unmerged', 'evt_sample_post_unmerged'),
+    data: {
+      post: SAMPLE_POST_REF,
+      formerCanonicalPost: { ...SAMPLE_POST_REF, id: 'post_sample_canonical' },
+    },
+  },
+  'post.mentioned': {
+    ...envelope('post.mentioned', 'evt_sample_post_mentioned'),
+    data: {
+      postId: 'post_sample',
+      postTitle: 'Sample feedback post',
+      postUrl: 'https://app.example.test/posts/post_sample',
+      mentionedPrincipalId: 'principal_sample_mentioned',
+      mentioningPrincipalId: 'principal_sample_author',
+      excerpt: 'Hey @sample, can you take a look at this sample feedback post?',
+    },
+  },
+  'comment.created': {
+    ...envelope('comment.created', 'evt_sample_comment_created'),
+    data: {
+      comment: {
+        id: 'comment_sample',
+        content: 'Sample comment body.',
+        authorEmail: '[email protected]',
+        authorName: 'Sample User',
+        isPrivate: false,
+      },
+      post: SAMPLE_POST_REF,
+    },
+  },
+  'comment.updated': {
+    ...envelope('comment.updated', 'evt_sample_comment_updated'),
+    data: {
+      comment: { id: 'comment_sample', content: 'Updated sample comment body.' },
+      post: SAMPLE_POST_REF,
+    },
+  },
+  'comment.deleted': {
+    ...envelope('comment.deleted', 'evt_sample_comment_deleted'),
+    data: { comment: { id: 'comment_sample', isPrivate: false }, post: SAMPLE_POST_REF },
+  },
+  'changelog.published': {
+    ...envelope('changelog.published', 'evt_sample_changelog_published'),
+    data: {
+      changelog: {
+        id: 'changelog_sample',
+        title: 'Sample release',
+        contentPreview: 'New things shipped this week.',
+        publishedAt: SAMPLE_TIMESTAMP,
+        linkedPostCount: 3,
+      },
+    },
+  },
+  'ticket.created': {
+    ...envelope('ticket.created', 'evt_sample_ticket_created'),
+    data: { ticket: SAMPLE_TICKET_REF },
+  },
+  'ticket.updated': {
+    ...envelope('ticket.updated', 'evt_sample_ticket_updated'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      changedFields: ['priority'],
+      diff: { priority: { from: 'normal', to: 'high' } },
+    },
+  },
+  'ticket.deleted': {
+    ...envelope('ticket.deleted', 'evt_sample_ticket_deleted'),
+    data: { ticket: SAMPLE_TICKET_REF, deletedByPrincipalId: 'principal_sample_admin' },
+  },
+  'ticket.restored': {
+    ...envelope('ticket.restored', 'evt_sample_ticket_restored'),
+    data: { ticket: SAMPLE_TICKET_REF, restoredByPrincipalId: 'principal_sample_admin' },
+  },
+  'ticket.assigned': {
+    ...envelope('ticket.assigned', 'evt_sample_ticket_assigned'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      previousAssigneePrincipalId: null,
+      newAssigneePrincipalId: 'principal_sample_agent',
+    },
+  },
+  'ticket.unassigned': {
+    ...envelope('ticket.unassigned', 'evt_sample_ticket_unassigned'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      previousAssigneePrincipalId: 'principal_sample_agent',
+    },
+  },
+  'ticket.status_changed': {
+    ...envelope('ticket.status_changed', 'evt_sample_ticket_status_changed'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      previousStatusCategory: 'open',
+      newStatusCategory: 'pending',
+    },
+  },
+  'ticket.first_response': {
+    ...envelope('ticket.first_response', 'evt_sample_ticket_first_response'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      threadId: 'thread_sample',
+      firstResponseAt: SAMPLE_TIMESTAMP,
+    },
+  },
+  'ticket.thread_added': {
+    ...envelope('ticket.thread_added', 'evt_sample_ticket_thread_added'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      threadId: 'thread_sample',
+      audience: 'public',
+      sharedWithTeamId: null,
+      thread: {
+        id: 'thread_sample',
+        audience: 'public',
+        bodyTextPreview: 'Sample reply body.',
+        bodyTextTruncated: false,
+        authorPrincipalId: 'principal_sample_agent',
+        isFromRequester: false,
+        sharedWithTeamId: null,
+        createdAt: SAMPLE_TIMESTAMP,
+      },
+    },
+  },
+  'ticket.thread_updated': {
+    ...envelope('ticket.thread_updated', 'evt_sample_ticket_thread_updated'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      threadId: 'thread_sample',
+      audience: 'public',
+      sharedWithTeamId: null,
+      thread: {
+        id: 'thread_sample',
+        audience: 'public',
+        bodyTextPreview: 'Updated sample reply body.',
+        bodyTextTruncated: false,
+        authorPrincipalId: 'principal_sample_agent',
+        isFromRequester: false,
+        sharedWithTeamId: null,
+        createdAt: SAMPLE_TIMESTAMP,
+        editedAt: SAMPLE_TIMESTAMP,
+      },
+    },
+  },
+  'ticket.thread_deleted': {
+    ...envelope('ticket.thread_deleted', 'evt_sample_ticket_thread_deleted'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      threadId: 'thread_sample',
+      audience: 'public',
+      sharedWithTeamId: null,
+      deletedByPrincipalId: 'principal_sample_agent',
+    },
+  },
+  'ticket.participant_added': {
+    ...envelope('ticket.participant_added', 'evt_sample_ticket_participant_added'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      addedPrincipalId: 'principal_sample_observer',
+      role: 'cc',
+    },
+  },
+  'ticket.participant_removed': {
+    ...envelope('ticket.participant_removed', 'evt_sample_ticket_participant_removed'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      removedPrincipalId: 'principal_sample_observer',
+    },
+  },
+  'ticket.shared': {
+    ...envelope('ticket.shared', 'evt_sample_ticket_shared'),
+    data: { ticket: SAMPLE_TICKET_REF, teamId: 'team_sample_partner', accessLevel: 'read' },
+  },
+  'ticket.unshared': {
+    ...envelope('ticket.unshared', 'evt_sample_ticket_unshared'),
+    data: { ticket: SAMPLE_TICKET_REF, teamId: 'team_sample_partner' },
+  },
+  'ticket.sla_warning': {
+    ...envelope('ticket.sla_warning', 'evt_sample_ticket_sla_warning'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      kind: 'first_response',
+      ruleName: 'Default first-response SLA',
+    },
+  },
+  'ticket.sla_breach': {
+    ...envelope('ticket.sla_breach', 'evt_sample_ticket_sla_breach'),
+    data: { ticket: SAMPLE_TICKET_REF, kind: 'first_response' },
+  },
+  'ticket.attachment_added': {
+    ...envelope('ticket.attachment_added', 'evt_sample_ticket_attachment_added'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      attachment: {
+        id: 'tatt_sample',
+        threadId: 'thread_sample',
+        filename: 'screenshot.png',
+        mimeType: 'image/png',
+        sizeBytes: 12345,
+        uploadedByPrincipalId: 'principal_sample_agent',
+        publicUrl: 'https://cdn.example.test/sample.png',
+      },
+    },
+  },
+  'ticket.attachment_removed': {
+    ...envelope('ticket.attachment_removed', 'evt_sample_ticket_attachment_removed'),
+    data: {
+      ticket: SAMPLE_TICKET_REF,
+      attachment: {
+        id: 'tatt_sample',
+        threadId: 'thread_sample',
+        filename: 'screenshot.png',
+      },
+      removedByPrincipalId: 'principal_sample_agent',
+    },
+  },
+  'inbox.created': {
+    ...envelope('inbox.created', 'evt_sample_inbox_created'),
+    data: { inbox: SAMPLE_INBOX_REF },
+  },
+  'inbox.updated': {
+    ...envelope('inbox.updated', 'evt_sample_inbox_updated'),
+    data: {
+      inbox: { ...SAMPLE_INBOX_REF, name: 'Support (renamed)' },
+      changedFields: ['name'],
+    },
+  },
+  'inbox.archived': {
+    ...envelope('inbox.archived', 'evt_sample_inbox_archived'),
+    data: {
+      inbox: { ...SAMPLE_INBOX_REF, archivedAt: SAMPLE_TIMESTAMP },
+    },
+  },
+  'inbox.unarchived': {
+    ...envelope('inbox.unarchived', 'evt_sample_inbox_unarchived'),
+    data: { inbox: SAMPLE_INBOX_REF },
+  },
+  'team.created': {
+    ...envelope('team.created', 'evt_sample_team_created'),
+    data: { team: SAMPLE_TEAM_REF },
+  },
+  'team.updated': {
+    ...envelope('team.updated', 'evt_sample_team_updated'),
+    data: {
+      team: { ...SAMPLE_TEAM_REF, color: '#0ea5e9' },
+      changedFields: ['color'],
+    },
+  },
+  'team.archived': {
+    ...envelope('team.archived', 'evt_sample_team_archived'),
+    data: {
+      team: { ...SAMPLE_TEAM_REF, archivedAt: SAMPLE_TIMESTAMP },
+    },
+  },
+  'ticket_status.created': {
+    ...envelope('ticket_status.created', 'evt_sample_ticket_status_created'),
+    data: { status: SAMPLE_TICKET_STATUS_REF },
+  },
+  'ticket_status.updated': {
+    ...envelope('ticket_status.updated', 'evt_sample_ticket_status_updated'),
+    data: {
+      status: { ...SAMPLE_TICKET_STATUS_REF, name: 'Open (renamed)' },
+      changedFields: ['name'],
+    },
+  },
+  'contact.created': {
+    ...envelope('contact.created', 'evt_sample_contact_created'),
+    data: { contact: SAMPLE_CONTACT_REF },
+  },
+  'contact.updated': {
+    ...envelope('contact.updated', 'evt_sample_contact_updated'),
+    data: {
+      contact: { ...SAMPLE_CONTACT_REF, title: 'Senior Customer' },
+      changedFields: ['title'],
+    },
+  },
+  'contact.archived': {
+    ...envelope('contact.archived', 'evt_sample_contact_archived'),
+    data: {
+      contact: { ...SAMPLE_CONTACT_REF, archivedAt: SAMPLE_TIMESTAMP },
+    },
+  },
+  'contact.linked': {
+    ...envelope('contact.linked', 'evt_sample_contact_linked'),
+    data: {
+      contact: SAMPLE_CONTACT_REF,
+      userId: 'user_sample_portal',
+      linkedByPrincipalId: 'principal_sample_agent',
+    },
+  },
+  'contact.unlinked': {
+    ...envelope('contact.unlinked', 'evt_sample_contact_unlinked'),
+    data: {
+      contact: SAMPLE_CONTACT_REF,
+      userId: 'user_sample_portal',
+    },
+  },
+  'organization.created': {
+    ...envelope('organization.created', 'evt_sample_organization_created'),
+    data: { organization: SAMPLE_ORG_REF },
+  },
+  'organization.updated': {
+    ...envelope('organization.updated', 'evt_sample_organization_updated'),
+    data: {
+      organization: { ...SAMPLE_ORG_REF, name: 'Sample Org (renamed)' },
+      changedFields: ['name'],
+    },
+  },
+  'organization.archived': {
+    ...envelope('organization.archived', 'evt_sample_organization_archived'),
+    data: {
+      organization: { ...SAMPLE_ORG_REF, archivedAt: SAMPLE_TIMESTAMP },
+    },
+  },
+  'organization.unarchived': {
+    ...envelope('organization.unarchived', 'evt_sample_organization_unarchived'),
+    data: { organization: SAMPLE_ORG_REF },
+  },
+  'conversation.created': {
+    ...envelope('conversation.created', 'evt_sample_conversation_created'),
+    data: { conversation: SAMPLE_CONVERSATION_DATA },
+  },
+  'conversation.status_changed': {
+    ...envelope('conversation.status_changed', 'evt_sample_conversation_status_changed'),
+    data: {
+      conversation: SAMPLE_CONVERSATION_REF,
+      previousStatus: 'open',
+      newStatus: 'pending',
+    },
+  },
+  'conversation.assigned': {
+    ...envelope('conversation.assigned', 'evt_sample_conversation_assigned'),
+    data: {
+      conversation: SAMPLE_CONVERSATION_REF,
+      assignedAgentPrincipalId: 'principal_sample_agent',
+      previousAgentPrincipalId: null,
+    },
+  },
+  'conversation.priority_changed': {
+    ...envelope('conversation.priority_changed', 'evt_sample_conversation_priority_changed'),
+    data: {
+      conversation: SAMPLE_CONVERSATION_REF,
+      previousPriority: 'medium',
+      newPriority: 'high',
+    },
+  },
+  'conversation.csat_submitted': {
+    ...envelope('conversation.csat_submitted', 'evt_sample_conversation_csat_submitted'),
+    data: {
+      conversation: SAMPLE_CONVERSATION_REF,
+      rating: 5,
+      comment: 'Great support, thank you!',
+      submittedAt: SAMPLE_TIMESTAMP,
+    },
+  },
+  'message.created': {
+    ...envelope('message.created', 'evt_sample_message_created'),
+    data: {
+      message: SAMPLE_MESSAGE_DATA,
+      conversation: SAMPLE_CONVERSATION_REF,
+    },
+  },
+  'message.note_created': {
+    ...envelope('message.note_created', 'evt_sample_message_note_created'),
+    data: {
+      message: {
+        ...SAMPLE_MESSAGE_DATA,
+        id: 'msg_sample_note',
+        senderType: 'agent',
+        authorPrincipalId: 'principal_sample_agent',
+        authorName: 'Sample Agent',
+        authorEmail: '[email protected]',
+        content: 'Internal note — visitor mentioned a billing issue.',
+      },
+      conversation: SAMPLE_CONVERSATION_REF,
+    },
+  },
+  'message.deleted': {
+    ...envelope('message.deleted', 'evt_sample_message_deleted'),
+    data: {
+      message: { id: 'msg_sample', conversationId: 'conv_sample' },
+      conversation: SAMPLE_CONVERSATION_REF,
+    },
+  },
+  'help_center.category.created': {
+    ...envelope('help_center.category.created', 'evt_sample_help_center_category_created'),
+    data: { category: SAMPLE_HELP_CENTER_CATEGORY_REF },
+  },
+  'help_center.category.updated': {
+    ...envelope('help_center.category.updated', 'evt_sample_help_center_category_updated'),
+    data: {
+      category: { ...SAMPLE_HELP_CENTER_CATEGORY_REF, name: 'Getting Started (renamed)' },
+      changedFields: ['name'],
+    },
+  },
+  'help_center.category.deleted': {
+    ...envelope('help_center.category.deleted', 'evt_sample_help_center_category_deleted'),
+    data: { category: SAMPLE_HELP_CENTER_CATEGORY_REF },
+  },
+  'help_center.article.created': {
+    ...envelope('help_center.article.created', 'evt_sample_help_center_article_created'),
+    data: { article: { ...SAMPLE_HELP_CENTER_ARTICLE_REF, publishedAt: null } },
+  },
+  'help_center.article.updated': {
+    ...envelope('help_center.article.updated', 'evt_sample_help_center_article_updated'),
+    data: {
+      article: { ...SAMPLE_HELP_CENTER_ARTICLE_REF, title: 'How to get started (revised)' },
+      changedFields: ['title'],
+    },
+  },
+  'help_center.article.published': {
+    ...envelope('help_center.article.published', 'evt_sample_help_center_article_published'),
+    data: { article: SAMPLE_HELP_CENTER_ARTICLE_REF },
+  },
+  'help_center.article.unpublished': {
+    ...envelope('help_center.article.unpublished', 'evt_sample_help_center_article_unpublished'),
+    data: { article: { ...SAMPLE_HELP_CENTER_ARTICLE_REF, publishedAt: null } },
+  },
+  'help_center.article.deleted': {
+    ...envelope('help_center.article.deleted', 'evt_sample_help_center_article_deleted'),
+    data: { article: SAMPLE_HELP_CENTER_ARTICLE_REF },
+  },
+  'changelog.created': {
+    ...envelope('changelog.created', 'evt_sample_changelog_created'),
+    data: { changelog: { ...SAMPLE_CHANGELOG_REF, publishedAt: null, linkedPostCount: 0 } },
+  },
+  'changelog.updated': {
+    ...envelope('changelog.updated', 'evt_sample_changelog_updated'),
+    data: {
+      changelog: { ...SAMPLE_CHANGELOG_REF, title: 'Sample release (revised)' },
+      changedFields: ['title'],
+    },
+  },
+  'changelog.deleted': {
+    ...envelope('changelog.deleted', 'evt_sample_changelog_deleted'),
+    data: { changelog: SAMPLE_CHANGELOG_REF },
+  },
+  'segment.created': {
+    ...envelope('segment.created', 'evt_sample_segment_created'),
+    data: { segment: SAMPLE_SEGMENT_REF },
+  },
+  'segment.updated': {
+    ...envelope('segment.updated', 'evt_sample_segment_updated'),
+    data: {
+      segment: { ...SAMPLE_SEGMENT_REF, name: 'Power Users (renamed)' },
+      changedFields: ['name'],
+    },
+  },
+  'segment.deleted': {
+    ...envelope('segment.deleted', 'evt_sample_segment_deleted'),
+    data: { segment: SAMPLE_SEGMENT_REF },
+  },
+  'user_attribute.created': {
+    ...envelope('user_attribute.created', 'evt_sample_user_attribute_created'),
+    data: { attribute: SAMPLE_USER_ATTRIBUTE_REF },
+  },
+  'user_attribute.updated': {
+    ...envelope('user_attribute.updated', 'evt_sample_user_attribute_updated'),
+    data: {
+      attribute: { ...SAMPLE_USER_ATTRIBUTE_REF, label: 'Plan Tier (renamed)' },
+      changedFields: ['label'],
+    },
+  },
+  'user_attribute.deleted': {
+    ...envelope('user_attribute.deleted', 'evt_sample_user_attribute_deleted'),
+    data: { attribute: SAMPLE_USER_ATTRIBUTE_REF },
+  },
+
+  // Feedback configuration
+  'board.created': {
+    ...envelope('board.created', 'evt_sample_board_created'),
+    data: { board: SAMPLE_BOARD_REF },
+  },
+  'board.updated': {
+    ...envelope('board.updated', 'evt_sample_board_updated'),
+    data: { board: { ...SAMPLE_BOARD_REF, name: 'Ideas' }, changedFields: ['name'] },
+  },
+  'board.deleted': {
+    ...envelope('board.deleted', 'evt_sample_board_deleted'),
+    data: { board: SAMPLE_BOARD_REF },
+  },
+  'tag.created': {
+    ...envelope('tag.created', 'evt_sample_tag_created'),
+    data: { tag: SAMPLE_TAG_REF },
+  },
+  'tag.updated': {
+    ...envelope('tag.updated', 'evt_sample_tag_updated'),
+    data: { tag: { ...SAMPLE_TAG_REF, name: 'defect' }, changedFields: ['name'] },
+  },
+  'tag.deleted': {
+    ...envelope('tag.deleted', 'evt_sample_tag_deleted'),
+    data: { tag: SAMPLE_TAG_REF },
+  },
+  'status.created': {
+    ...envelope('status.created', 'evt_sample_status_created'),
+    data: { status: SAMPLE_STATUS_REF },
+  },
+  'status.updated': {
+    ...envelope('status.updated', 'evt_sample_status_updated'),
+    data: { status: { ...SAMPLE_STATUS_REF, name: 'In Progress' }, changedFields: ['name'] },
+  },
+  'status.deleted': {
+    ...envelope('status.deleted', 'evt_sample_status_deleted'),
+    data: { status: SAMPLE_STATUS_REF },
+  },
+  'roadmap.created': {
+    ...envelope('roadmap.created', 'evt_sample_roadmap_created'),
+    data: { roadmap: SAMPLE_ROADMAP_REF },
+  },
+  'roadmap.updated': {
+    ...envelope('roadmap.updated', 'evt_sample_roadmap_updated'),
+    data: { roadmap: { ...SAMPLE_ROADMAP_REF, isPublic: false }, changedFields: ['isPublic'] },
+  },
+  'roadmap.deleted': {
+    ...envelope('roadmap.deleted', 'evt_sample_roadmap_deleted'),
+    data: { roadmap: SAMPLE_ROADMAP_REF },
+  },
+
+  // Support configuration
+  'sla_policy.created': {
+    ...envelope('sla_policy.created', 'evt_sample_sla_policy_created'),
+    data: { policy: SAMPLE_SLA_POLICY_REF },
+  },
+  'sla_policy.updated': {
+    ...envelope('sla_policy.updated', 'evt_sample_sla_policy_updated'),
+    data: { policy: { ...SAMPLE_SLA_POLICY_REF, enabled: false }, changedFields: ['enabled'] },
+  },
+  'sla_policy.archived': {
+    ...envelope('sla_policy.archived', 'evt_sample_sla_policy_archived'),
+    data: { policy: { ...SAMPLE_SLA_POLICY_REF, archivedAt: SAMPLE_TIMESTAMP } },
+  },
+  'routing_rule.created': {
+    ...envelope('routing_rule.created', 'evt_sample_routing_rule_created'),
+    data: { rule: SAMPLE_ROUTING_RULE_REF },
+  },
+  'routing_rule.updated': {
+    ...envelope('routing_rule.updated', 'evt_sample_routing_rule_updated'),
+    data: { rule: { ...SAMPLE_ROUTING_RULE_REF, enabled: false }, changedFields: ['enabled'] },
+  },
+  'routing_rule.deleted': {
+    ...envelope('routing_rule.deleted', 'evt_sample_routing_rule_deleted'),
+    data: { rule: SAMPLE_ROUTING_RULE_REF },
+  },
+  'business_hours.created': {
+    ...envelope('business_hours.created', 'evt_sample_business_hours_created'),
+    data: { businessHours: SAMPLE_BUSINESS_HOURS_REF },
+  },
+  'business_hours.updated': {
+    ...envelope('business_hours.updated', 'evt_sample_business_hours_updated'),
+    data: {
+      businessHours: { ...SAMPLE_BUSINESS_HOURS_REF, name: 'Weekdays 8-6' },
+      changedFields: ['name'],
+    },
+  },
+  'business_hours.archived': {
+    ...envelope('business_hours.archived', 'evt_sample_business_hours_archived'),
+    data: { businessHours: { ...SAMPLE_BUSINESS_HOURS_REF, archivedAt: SAMPLE_TIMESTAMP } },
+  },
+  'inbox_channel.created': {
+    ...envelope('inbox_channel.created', 'evt_sample_inbox_channel_created'),
+    data: { channel: SAMPLE_INBOX_CHANNEL_REF },
+  },
+  'inbox_channel.updated': {
+    ...envelope('inbox_channel.updated', 'evt_sample_inbox_channel_updated'),
+    data: { channel: { ...SAMPLE_INBOX_CHANNEL_REF, enabled: false }, changedFields: ['enabled'] },
+  },
+  'inbox_channel.archived': {
+    ...envelope('inbox_channel.archived', 'evt_sample_inbox_channel_archived'),
+    data: { channel: { ...SAMPLE_INBOX_CHANNEL_REF, archivedAt: SAMPLE_TIMESTAMP } },
+  },
+  'inbox_membership.added': {
+    ...envelope('inbox_membership.added', 'evt_sample_inbox_membership_added'),
+    data: { membership: SAMPLE_INBOX_MEMBERSHIP_REF },
+  },
+  'inbox_membership.updated': {
+    ...envelope('inbox_membership.updated', 'evt_sample_inbox_membership_updated'),
+    data: { membership: { ...SAMPLE_INBOX_MEMBERSHIP_REF, role: 'owner' }, previousRole: 'agent' },
+  },
+  'inbox_membership.removed': {
+    ...envelope('inbox_membership.removed', 'evt_sample_inbox_membership_removed'),
+    data: { membership: SAMPLE_INBOX_MEMBERSHIP_REF },
+  },
+
+  // Administration
+  'api_key.created': {
+    ...envelope('api_key.created', 'evt_sample_api_key_created'),
+    data: { apiKey: SAMPLE_API_KEY_REF },
+  },
+  'api_key.rotated': {
+    ...envelope('api_key.rotated', 'evt_sample_api_key_rotated'),
+    data: { apiKey: SAMPLE_API_KEY_REF },
+  },
+  'api_key.revoked': {
+    ...envelope('api_key.revoked', 'evt_sample_api_key_revoked'),
+    data: { apiKey: SAMPLE_API_KEY_REF },
+  },
+  'role.created': {
+    ...envelope('role.created', 'evt_sample_role_created'),
+    data: { role: SAMPLE_ROLE_REF },
+  },
+  'role.updated': {
+    ...envelope('role.updated', 'evt_sample_role_updated'),
+    data: { role: { ...SAMPLE_ROLE_REF, name: 'Billing Lead' }, changedFields: ['name'] },
+  },
+  'role.deleted': {
+    ...envelope('role.deleted', 'evt_sample_role_deleted'),
+    data: { role: SAMPLE_ROLE_REF },
+  },
+  'role_assignment.created': {
+    ...envelope('role_assignment.created', 'evt_sample_role_assignment_created'),
+    data: { assignment: SAMPLE_ROLE_ASSIGNMENT_REF },
+  },
+  'role_assignment.revoked': {
+    ...envelope('role_assignment.revoked', 'evt_sample_role_assignment_revoked'),
+    data: { assignment: SAMPLE_ROLE_ASSIGNMENT_REF },
+  },
+}
+
+/**
+ * Returns the canonical sample event payload for a given event type. Returned
+ * objects are shared, deeply-frozen at module init — callers must NOT mutate
+ * (use structuredClone if you need to tweak fields like `id` for a test fire).
+ */
+export function getSampleEventPayload(type: EventType): EventData {
+  return SAMPLES[type]!
+}
+
+/** All samples keyed by event type (for the GET preview endpoint). */
+export function getAllSampleEventPayloads(): Partial<Record<EventType, EventData>> {
+  return SAMPLES
+}
+
+/** Stable prefix every test-fire / sample event id starts with. */
+export const SAMPLE_EVENT_ID_PREFIX = 'evt_sample_'
+/** Prefix for event ids generated by the test-fire endpoint at runtime. */
+export const TEST_FIRE_EVENT_ID_PREFIX = 'evt_test_'
diff --git a/apps/web/src/lib/server/events/segment-scheduler.ts b/apps/web/src/lib/server/events/segment-scheduler.ts
index 7fee8168b..ceeabe3a4 100644
--- a/apps/web/src/lib/server/events/segment-scheduler.ts
+++ b/apps/web/src/lib/server/events/segment-scheduler.ts
@@ -50,32 +50,34 @@ const DEFAULT_JOB_OPTS = {
 // ============================================================================
 
 let initPromise: Promise<{
-  queue: Queue<SegmentEvalJobData>
-  worker: Worker<SegmentEvalJobData>
+  queue: Queue
+  worker: Worker
 }> | null = null
 
-function ensureQueue(): Promise<Queue<SegmentEvalJobData>> {
+function ensureQueue(): Promise<Queue> {
   if (!initPromise) {
     initPromise = initializeQueue().catch((err) => {
       initPromise = null
       throw err
     })
   }
-  return initPromise.then(({ queue }) => queue)
+  const promise = initPromise
+  if (!promise) throw new Error('Segment scheduler queue failed to initialize')
+  return promise.then(({ queue }) => queue)
 }
 
 async function initializeQueue() {
   const connection = getQueueRedis()
 
-  const queue = new Queue<SegmentEvalJobData>(QUEUE_NAME, {
+  const queue = new Queue(QUEUE_NAME, {
     connection,
     defaultJobOptions: DEFAULT_JOB_OPTS,
   })
 
-  const worker = new Worker<SegmentEvalJobData>(
+  const worker = new Worker(
     QUEUE_NAME,
     async (job) => {
-      const { segmentId } = job.data
+      const { segmentId } = job.data as SegmentEvalJobData
       log.debug({ segment_id: segmentId }, 'evaluating segment')
 
       // Lazy import to avoid circular deps
@@ -164,10 +166,7 @@ export async function upsertSegmentEvaluationSchedule(
     }
   )
 
-  log.info(
-    { segment_id: segmentId, pattern: schedule.pattern },
-    'scheduled segment evaluation'
-  )
+  log.info({ segment_id: segmentId, pattern: schedule.pattern }, 'scheduled segment evaluation')
 }
 
 /**
diff --git a/apps/web/src/lib/server/events/targets.ts b/apps/web/src/lib/server/events/targets.ts
index fd0f371d2..d1c9cf689 100644
--- a/apps/web/src/lib/server/events/targets.ts
+++ b/apps/web/src/lib/server/events/targets.ts
@@ -29,16 +29,16 @@ import {
   type Subscriber,
   type NotificationEventType,
 } from '@/lib/server/domains/subscriptions/subscription.service'
-import { cacheGet, cacheSet, CACHE_KEYS } from '@/lib/server/redis'
+import { cacheGet, cacheSet, cacheDel, CACHE_KEYS } from '@/lib/server/redis'
 import type { HookTarget } from './hook-types'
 import { stripHtml, truncate } from './hook-utils'
 import { buildHookContext, type HookContext } from './hook-context'
 import type { EventData, EventActor, PostMergedPayload, PostUnmergedPayload } from './types'
 import { getOpenAI } from '@/lib/server/domains/ai/config'
-import { logger } from '@/lib/server/logger'
+import { getTicketEmailTargets } from './ticket-targets'
 
+import { logger } from '@/lib/server/logger'
 const log = logger.child({ component: 'targets' })
-
 /**
  * Drop subscribers who can't view the post under its current board
  * audience + moderation state. Used by every notification fan-out path
@@ -153,6 +153,26 @@ const SUBSCRIBER_EVENT_TYPES = [
 const MENTION_EVENT_TYPES = ['post.mentioned'] as const
 const AI_EVENT_TYPES = ['post.created'] as const
 const SUMMARY_EVENT_TYPES = ['post.created', 'comment.created'] as const
+const EXTERNAL_TICKET_THREAD_EVENTS = [
+  'ticket.thread_added',
+  'ticket.thread_updated',
+  'ticket.thread_deleted',
+] as const
+
+function isExternalTicketThreadEvent(event: EventData): boolean {
+  return EXTERNAL_TICKET_THREAD_EVENTS.includes(
+    event.type as (typeof EXTERNAL_TICKET_THREAD_EVENTS)[number]
+  )
+}
+
+function isNonPublicTicketThreadEvent(event: EventData): boolean {
+  return (
+    isExternalTicketThreadEvent(event) &&
+    ((event.data as { audience?: string }).audience === 'internal' ||
+      (event.data as { audience?: string }).audience === 'shared_team')
+  )
+}
+
 /**
  * Get all hook targets for an event.
  * Gracefully handles errors - returns empty array on failure.
@@ -189,6 +209,12 @@ export async function getHookTargets(event: EventData): Promise<HookTarget[]> {
       targets.push(...mentionTargets)
     }
 
+    // Ticket Email Targets
+    if (event.type.startsWith('ticket.')) {
+      const ticketEmailTargets = await getTicketEmailTargets(event, context)
+      targets.push(...ticketEmailTargets)
+    }
+
     // AI targets (sentiment, embeddings) - only when AI is configured
     if (getOpenAI() && AI_EVENT_TYPES.includes(event.type as (typeof AI_EVENT_TYPES)[number])) {
       targets.push({
@@ -222,6 +248,7 @@ export async function getHookTargets(event: EventData): Promise<HookTarget[]> {
 }
 
 type CachedIntegrationMapping = {
+  integrationId: string
   eventType: string
   integrationType: string
   secrets: string | null
@@ -230,6 +257,36 @@ type CachedIntegrationMapping = {
   filters: unknown
 }
 
+async function reconcileGitHubMappingsBestEffort(): Promise<void> {
+  try {
+    const githubIntegrations = await db
+      .select({
+        id: integrations.id,
+        config: integrations.config,
+      })
+      .from(integrations)
+      .where(and(eq(integrations.integrationType, 'github'), eq(integrations.status, 'active')))
+
+    if (githubIntegrations.length === 0) return
+
+    const { ensureGitHubEventMappings } =
+      await import('@/lib/server/integrations/github/event-mappings')
+    await Promise.allSettled(
+      githubIntegrations.map((integration) =>
+        ensureGitHubEventMappings({
+          integrationId: integration.id,
+          config: (integration.config as Record<string, unknown> | null) ?? undefined,
+        })
+      )
+    )
+  } catch (error) {
+    log.warn(
+      { err: error },
+      'failed to reconcile GitHub event mappings during target cache refresh'
+    )
+  }
+}
+
 async function getCachedIntegrationMappings(): Promise<CachedIntegrationMapping[]> {
   const cached = await cacheGet<CachedIntegrationMapping[]>(CACHE_KEYS.INTEGRATION_MAPPINGS)
   if (cached) {
@@ -237,8 +294,11 @@ async function getCachedIntegrationMappings(): Promise<CachedIntegrationMapping[
     return cached
   }
 
+  await reconcileGitHubMappingsBestEffort()
+
   const mappings = await db
     .select({
+      integrationId: integrations.id,
       eventType: integrationEventMappings.eventType,
       integrationType: integrations.integrationType,
       secrets: integrations.secrets,
@@ -272,9 +332,26 @@ async function getIntegrationTargets(
     return []
   }
 
+  // Never forward internal or shared-team ticket threads to external integrations.
+  // Internal threads are private agent-only context; shared-team threads are
+  // inter-team collaboration not meant for external consumers.
+  if (isNonPublicTicketThreadEvent(event)) {
+    return []
+  }
+
   // Get all active mappings from cache or DB, then filter by event type
-  const allMappings = await getCachedIntegrationMappings()
-  const mappings = allMappings.filter((m) => m.eventType === event.type)
+  let allMappings = await getCachedIntegrationMappings()
+  let mappings = allMappings.filter((m) => m.eventType === event.type)
+
+  if (
+    mappings.length === 0 &&
+    (event.type === 'ticket.attachment_added' || event.type === 'ticket.attachment_removed')
+  ) {
+    await reconcileGitHubMappingsBestEffort()
+    await cacheDel(CACHE_KEYS.INTEGRATION_MAPPINGS)
+    allMappings = await getCachedIntegrationMappings()
+    mappings = allMappings.filter((m) => m.eventType === event.type)
+  }
 
   if (mappings.length === 0) {
     return []
@@ -282,13 +359,19 @@ async function getIntegrationTargets(
 
   const targets: HookTarget[] = []
   const boardIds = extractBoardIds(event)
+  const inboxIds = extractInboxIds(event)
 
   // Track seen (integrationType, channelId) pairs to deduplicate
   const seen = new Set<string>()
 
   for (const m of mappings) {
+    // Loop prevention: skip integrations that sourced this event
+    if (event.syncSourceIntegrationId && m.integrationId === event.syncSourceIntegrationId) {
+      continue
+    }
+
     // Apply board filter — match if any event board overlaps with filter
-    const filters = m.filters as { boardIds?: string[] } | null
+    const filters = m.filters as { boardIds?: string[]; inboxIds?: string[] } | null
     if (
       filters?.boardIds?.length &&
       boardIds.length > 0 &&
@@ -297,6 +380,14 @@ async function getIntegrationTargets(
       continue
     }
 
+    // Apply inbox filter to ticket events. A scoped integration is opt-in:
+    // ticket events without an inbox must not fan out to inbox-scoped targets.
+    if (filters?.inboxIds?.length && event.type.startsWith('ticket.')) {
+      if (inboxIds.length === 0 || !inboxIds.some((id) => filters.inboxIds!.includes(id))) {
+        continue
+      }
+    }
+
     const integrationConfig = (m.integrationConfig as Record<string, unknown>) || {}
     const actionConfig = (m.actionConfig as Record<string, unknown>) || {}
     const channelId = (actionConfig.channelId || integrationConfig.channelId) as string | undefined
@@ -317,7 +408,10 @@ async function getIntegrationTargets(
         const secrets = decryptSecrets<{ accessToken?: string }>(m.secrets)
         accessToken = secrets.accessToken
       } catch (error) {
-        log.error({ err: error, integration_type: m.integrationType }, 'failed to decrypt integration secrets')
+        log.error(
+          { err: error, integration_type: m.integrationType },
+          'failed to decrypt integration secrets'
+        )
         continue
       }
     }
@@ -325,7 +419,12 @@ async function getIntegrationTargets(
     targets.push({
       type: m.integrationType,
       target: { channelId },
-      config: { accessToken, rootUrl: context.portalBaseUrl },
+      config: {
+        ...integrationConfig,
+        accessToken,
+        rootUrl: context.portalBaseUrl,
+        integrationId: m.integrationId,
+      },
     })
   }
 
@@ -882,6 +981,13 @@ async function getWebhookTargets(event: EventData): Promise<HookTarget[]> {
     return []
   }
 
+  // Never deliver internal or shared-team ticket notes to external webhooks —
+  // internal threads are private agent-only context; shared-team threads are
+  // inter-team collaboration not meant for external consumers.
+  if (isNonPublicTicketThreadEvent(event)) {
+    return []
+  }
+
   try {
     // Get all active, non-deleted webhooks from cache or DB (filter in JS)
     let activeWebhooks = await cacheGet<(typeof webhooks.$inferSelect)[]>(
@@ -903,15 +1009,39 @@ async function getWebhookTargets(event: EventData): Promise<HookTarget[]> {
 
     // Extract boardId(s) from event for filtering
     const boardIds = extractBoardIds(event)
+    // Extract inboxId(s) from event for filtering (Phase 4 — ticket events)
+    const inboxIds = extractInboxIds(event)
+
+    // Filter webhooks by event type and board
+    const matchingWebhooks = activeWebhooks.filter((webhook) => {
+      // Must be subscribed to this event type
+      if (!webhook.events.includes(event.type)) {
+        return false
+      }
 
-    // Filter by event-type subscription and (board-bearing events only) board.
-    const matchingWebhooks = activeWebhooks.filter((webhook) =>
-      webhookSubscriptionMatches(webhook, event)
-    )
+      // If webhook has board filter, must match at least one event board
+      if (webhook.boardIds && webhook.boardIds.length > 0) {
+        if (boardIds.length === 0 || !boardIds.some((id) => webhook.boardIds!.includes(id))) {
+          return false
+        }
+      }
+
+      // If webhook has inbox filter, must match at least one event inbox.
+      // Scope: only applies to ticket.* events. Non-ticket subscriptions
+      // (e.g. post.created) on the same webhook are NOT constrained.
+      // Opt-in semantics for tickets: an event with no inboxId is excluded
+      // by an inbox-filtered webhook (better to drop than over-deliver).
+      if (webhook.inboxIds && webhook.inboxIds.length > 0 && event.type.startsWith('ticket.')) {
+        if (inboxIds.length === 0 || !inboxIds.some((id) => webhook.inboxIds!.includes(id))) {
+          return false
+        }
+      }
 
-    log.debug(
-      { count: matchingWebhooks.length, event_type: event.type, board_ids: boardIds },
-      'found matching webhooks for event'
+      return true
+    })
+
+    console.log(
+      `[Targets] Found ${matchingWebhooks.length} webhook(s) for ${event.type}${boardIds.length ? ` (boards: ${boardIds.join(', ')})` : ''}${inboxIds.length ? ` (inboxes: ${inboxIds.join(', ')})` : ''}`
     )
 
     // Build targets - decrypt secrets for delivery
@@ -955,3 +1085,16 @@ function extractBoardIds(event: EventData): string[] {
   }
   return []
 }
+
+/**
+ * Extract inbox ID(s) from event data (Phase 4 — ticket events).
+ * Returns the ticket's `inboxId` for any event whose payload embeds an
+ * `EventTicketRef`. Configuration-plane events (inbox/team/status CRUD) and
+ * non-ticket events return an empty array — webhooks with an `inboxIds`
+ * filter will simply not constrain those event types.
+ */
+function extractInboxIds(event: EventData): string[] {
+  const data = event.data as { ticket?: { inboxId?: string | null } }
+  const inboxId = data.ticket?.inboxId
+  return inboxId ? [inboxId] : []
+}
diff --git a/apps/web/src/lib/server/events/ticket-targets.ts b/apps/web/src/lib/server/events/ticket-targets.ts
new file mode 100644
index 000000000..d020fd878
--- /dev/null
+++ b/apps/web/src/lib/server/events/ticket-targets.ts
@@ -0,0 +1,742 @@
+import {
+  db,
+  eq,
+  inArray,
+  and,
+  isNull,
+  ticketShares,
+  teamMemberships,
+  principal,
+  user,
+} from '@/lib/server/db'
+import type { PrincipalId, TeamId, TicketId, UserId } from '@quackback/ids'
+import type { EventData, EventTicketRef } from './types'
+import type { HookTarget } from './hook-types'
+import {
+  getSubscribers,
+  type TicketSubscriptionEvent,
+} from '../domains/tickets/ticket.subscriptions'
+import {
+  resolvePortalLinkedRecipients,
+  resolvePrincipalsForContacts,
+} from '../domains/tickets/ticket.recipients'
+import { canViewTicket, toResourceScope } from '../domains/tickets/ticket.permissions'
+import { loadPermissionSet } from '../domains/authz/authz.service'
+import {
+  batchGenerateUnsubscribeTokens,
+  batchGetNotificationPreferences,
+} from '../domains/subscriptions/subscription.service'
+import type { HookContext } from './hook-context'
+
+function getCategoryForEvent(eventType: string): TicketSubscriptionEvent | null {
+  if (
+    [
+      'ticket.created',
+      'ticket.thread_added',
+      'ticket.thread_updated',
+      'ticket.thread_deleted',
+      'ticket.attachment_added',
+      'ticket.attachment_removed',
+    ].includes(eventType)
+  ) {
+    return 'thread'
+  }
+  if (eventType === 'ticket.updated') {
+    return 'properties'
+  }
+  if (['ticket.status_changed', 'ticket.deleted', 'ticket.restored'].includes(eventType)) {
+    return 'status'
+  }
+  if (['ticket.assigned', 'ticket.unassigned'].includes(eventType)) {
+    return 'assignment'
+  }
+  if (['ticket.participant_added', 'ticket.participant_removed'].includes(eventType)) {
+    return 'participants'
+  }
+  if (['ticket.shared', 'ticket.unshared'].includes(eventType)) {
+    return 'shares'
+  }
+  if (['ticket.first_response', 'ticket.sla_warning', 'ticket.sla_breach'].includes(eventType)) {
+    return 'sla'
+  }
+  return null
+}
+
+const GLOBAL_PREF_MAP: Record<
+  TicketSubscriptionEvent,
+  keyof import('../domains/subscriptions/subscription.types').NotificationPreferencesData
+> = {
+  thread: 'emailTicketThreads',
+  properties: 'emailTicketProperties',
+  status: 'emailTicketStatus',
+  assignment: 'emailTicketAssignment',
+  participants: 'emailTicketParticipants',
+  shares: 'emailTicketShares',
+  sla: 'emailTicketSla',
+}
+
+async function loadActiveShares(ticketId: TicketId) {
+  const rows = await db
+    .select({ teamId: ticketShares.teamId, revokedAt: ticketShares.revokedAt })
+    .from(ticketShares)
+    .where(and(eq(ticketShares.ticketId, ticketId), isNull(ticketShares.revokedAt)))
+  return rows.map((r) => ({ teamId: r.teamId as TeamId, revokedAt: r.revokedAt }))
+}
+
+async function gatherSubscribers(
+  ticketId: TicketId,
+  event: TicketSubscriptionEvent,
+  extra: ReadonlyArray<PrincipalId | null | undefined> = []
+): Promise<PrincipalId[]> {
+  const subs = await getSubscribers(ticketId, event)
+  const all = new Set<PrincipalId>(subs)
+  for (const id of extra) {
+    if (id) all.add(id)
+  }
+  return Array.from(all)
+}
+
+function trustedSetForOwnership(
+  ticket: EventTicketRef,
+  portalLinked: ReadonlySet<PrincipalId>
+): ReadonlySet<PrincipalId> | undefined {
+  const requesterId = ticket.requesterPrincipalId as PrincipalId | null
+  if (!requesterId && portalLinked.size === 0) return undefined
+  const out = new Set<PrincipalId>(portalLinked)
+  if (requesterId) out.add(requesterId)
+  return out
+}
+
+/**
+ * Main entry point for resolving ticket email targets.
+ */
+export async function getTicketEmailTargets(
+  event: EventData,
+  context: HookContext
+): Promise<HookTarget[]> {
+  const ticketData = (event.data as any).ticket as EventTicketRef | undefined
+  if (!ticketData) return []
+  const ticketId = ticketData.id as TicketId
+
+  const category = getCategoryForEvent(event.type)
+  if (!category) return []
+
+  // Resolve base recipients according to event specific rules.
+  let candidatePrincipalIds: PrincipalId[] = []
+  let trustedRecipients: ReadonlySet<PrincipalId> | undefined
+
+  // Emulate ticket.notifications.ts inclusion logic
+  if (category === 'thread') {
+    const portal = await resolvePortalLinkedRecipients({
+      id: ticketId,
+      requesterContactId: ticketData.requesterContactId as any,
+    })
+
+    // For internal/shared_team threads, drop requester & portal linked
+    const audience = (event.data as any).audience
+    const isPublic = !audience || audience === 'public'
+
+    const baseSubs = await gatherSubscribers(ticketId, 'thread', [
+      ticketData.requesterPrincipalId as PrincipalId | null,
+      ticketData.assigneePrincipalId as PrincipalId | null,
+      ...(isPublic ? portal.principalIds : []),
+    ])
+
+    const requesterId = ticketData.requesterPrincipalId as PrincipalId | null
+    candidatePrincipalIds = isPublic
+      ? baseSubs
+      : baseSubs.filter((id) => id !== requesterId && !portal.portalLinked.has(id))
+
+    trustedRecipients = isPublic
+      ? trustedSetForOwnership(ticketData, portal.portalLinked)
+      : undefined
+  } else if (category === 'status') {
+    const portal = await resolvePortalLinkedRecipients({
+      id: ticketId,
+      requesterContactId: ticketData.requesterContactId as any,
+    })
+    candidatePrincipalIds = await gatherSubscribers(ticketId, 'status', [
+      ticketData.requesterPrincipalId as PrincipalId | null,
+      ticketData.assigneePrincipalId as PrincipalId | null,
+      ...portal.principalIds,
+    ])
+    trustedRecipients = trustedSetForOwnership(ticketData, portal.portalLinked)
+  } else if (category === 'assignment') {
+    const newAssignee = ticketData.assigneePrincipalId as PrincipalId | null
+    const prevAssignee = (event.data as any).previousAssigneePrincipalId as PrincipalId | null
+    const subs = await gatherSubscribers(ticketId, 'assignment', [newAssignee, prevAssignee])
+    candidatePrincipalIds = subs
+  } else if (category === 'participants') {
+    const direct = ((event.data as any).addedPrincipalId ||
+      (event.data as any).removedPrincipalId) as PrincipalId | null
+    const contactId = ((event.data as any).addedContactId ||
+      (event.data as any).removedContactId) as any
+    const linked = contactId ? await resolvePrincipalsForContacts([contactId]) : []
+    candidatePrincipalIds = await gatherSubscribers(ticketId, 'participants', [direct, ...linked])
+    trustedRecipients = linked.length > 0 ? new Set(linked) : undefined
+  } else if (category === 'shares') {
+    const teamId = (event.data as any).teamId as TeamId
+    const rows = await db
+      .select({ principalId: teamMemberships.principalId })
+      .from(teamMemberships)
+      .where(eq(teamMemberships.teamId, teamId))
+    const teamMembers = rows.map((r) => r.principalId as PrincipalId)
+    candidatePrincipalIds = await gatherSubscribers(ticketId, 'shares', teamMembers)
+  } else if (category === 'sla') {
+    candidatePrincipalIds = await gatherSubscribers(ticketId, 'sla', [
+      ticketData.assigneePrincipalId as PrincipalId | null,
+    ])
+  } else if (category === 'properties') {
+    const portal = await resolvePortalLinkedRecipients({
+      id: ticketId,
+      requesterContactId: ticketData.requesterContactId as any,
+    })
+    candidatePrincipalIds = await gatherSubscribers(ticketId, 'properties', [
+      ticketData.requesterPrincipalId as PrincipalId | null,
+      ticketData.assigneePrincipalId as PrincipalId | null,
+      ...portal.principalIds,
+    ])
+    trustedRecipients = trustedSetForOwnership(ticketData, portal.portalLinked)
+  }
+
+  // Suppress actor
+  const actorId = event.actor.principalId
+  const dedup = new Set<PrincipalId>()
+  for (const r of candidatePrincipalIds) {
+    if (actorId && r === actorId) continue
+    dedup.add(r)
+  }
+  if (dedup.size === 0) return []
+
+  // Check canViewTicket permissions
+  const scope = toResourceScope({
+    primaryTeamId: ticketData.primaryTeamId as TeamId | null,
+    assigneePrincipalId: ticketData.assigneePrincipalId as PrincipalId | null,
+    assigneeTeamId: ticketData.assigneeTeamId as TeamId | null,
+    shares: await loadActiveShares(ticketId),
+  })
+
+  const allowed: PrincipalId[] = []
+  const dedupIds = Array.from(dedup)
+  const principalRows = dedupIds.length
+    ? await db
+        .select({ id: principal.id, userId: principal.userId })
+        .from(principal)
+        .where(inArray(principal.id, dedupIds))
+    : []
+
+  const userIdByPrincipal = new Map<PrincipalId, string>()
+  const userIds: string[] = []
+  for (const row of principalRows) {
+    if (row.userId) {
+      userIdByPrincipal.set(row.id as PrincipalId, row.userId)
+      userIds.push(row.userId)
+    }
+  }
+
+  const siblingRows = userIds.length
+    ? await db
+        .select({ id: principal.id, userId: principal.userId })
+        .from(principal)
+        .where(inArray(principal.userId, Array.from(new Set(userIds)) as UserId[]))
+    : []
+
+  const siblingsByUser = new Map<string, PrincipalId[]>()
+  for (const row of siblingRows) {
+    if (!row.userId) continue
+    const siblings = siblingsByUser.get(row.userId) ?? []
+    siblings.push(row.id as PrincipalId)
+    siblingsByUser.set(row.userId, siblings)
+  }
+
+  const canViewCache = new Map<PrincipalId, boolean>()
+  const canPrincipalView = async (principalId: PrincipalId): Promise<boolean> => {
+    const cached = canViewCache.get(principalId)
+    if (cached !== undefined) return cached
+    try {
+      const set = await loadPermissionSet(principalId)
+      const ok = canViewTicket(set, scope)
+      canViewCache.set(principalId, ok)
+      return ok
+    } catch (err) {
+      console.warn('[ticket-targets] permission check failed for', principalId, err)
+      canViewCache.set(principalId, false)
+      return false
+    }
+  }
+
+  for (const principalId of dedup) {
+    if (trustedRecipients?.has(principalId)) {
+      allowed.push(principalId)
+      continue
+    }
+
+    if (await canPrincipalView(principalId)) {
+      allowed.push(principalId)
+      continue
+    }
+
+    // Some users can own multiple principals; if a subscription points to a
+    // sibling principal without ticket grants, accept when any sibling for the
+    // same user can view this ticket.
+    const userId = userIdByPrincipal.get(principalId)
+    if (!userId) continue
+
+    const siblings = siblingsByUser.get(userId) ?? []
+    for (const siblingId of siblings) {
+      if (siblingId === principalId) continue
+      if (await canPrincipalView(siblingId)) {
+        allowed.push(principalId)
+        break
+      }
+    }
+  }
+
+  if (allowed.length === 0) return []
+
+  // Check global email preferences
+  const prefsMap = await batchGetNotificationPreferences(allowed)
+  const prefKey = GLOBAL_PREF_MAP[category]
+
+  const eligiblePrincipalIds = allowed.filter((id) => {
+    const prefs = prefsMap.get(id)
+    if (!prefs) return false
+    if (prefs.emailMuted) return false
+    return prefs[prefKey] === true
+  })
+
+  if (eligiblePrincipalIds.length === 0) return []
+
+  // Fetch emails for eligible
+  const emailRows = await db
+    .select({ principalId: principal.id, email: user.email })
+    .from(principal)
+    .innerJoin(user, eq(principal.userId, user.id))
+    .where(inArray(principal.id, eligiblePrincipalIds))
+
+  const eligibleSubscribers = emailRows.filter((r) => r.email !== null) as {
+    principalId: PrincipalId
+    email: string
+  }[]
+
+  if (eligibleSubscribers.length === 0) return []
+
+  // Generate tokens
+  await batchGenerateUnsubscribeTokens(
+    eligibleSubscribers.map((s) => ({
+      principalId: s.principalId,
+      postId: null as any, // Not a post, but we might want to extend unsubscribe action or ignore postId
+      action: 'unsubscribe_all' as const, // For now tickets don't have ticket-level unsubscribe token implemented in that table?
+    }))
+  )
+
+  const eventConfig = buildTicketEmailEventConfig(
+    event,
+    context.portalBaseUrl,
+    ticketData.subject as string | null,
+    ticketData.statusName ?? ticketData.statusCategory ?? null
+  )
+
+  return eligibleSubscribers.map((subscriber) => ({
+    type: 'email',
+    target: {
+      email: subscriber.email,
+      unsubscribeUrl: `${context.portalBaseUrl}/settings/notifications`,
+    },
+    config: {
+      workspaceName: context.workspaceName,
+      logoUrl: context.logoUrl ?? undefined,
+      priorityLabel: ticketData.priority ?? undefined,
+      ...eventConfig,
+    },
+  }))
+}
+
+export function buildTicketEmailEventConfig(
+  event: EventData,
+  rootUrl: string,
+  subject: string | null,
+  statusLabel: string | null
+): Record<string, unknown> {
+  const ticket = (event.data as any).ticket as EventTicketRef
+  const ticketUrl = `${rootUrl}/tickets/${ticket.id}`
+  const ticketSubject = subject ?? 'ticket'
+  const actorName = event.actor.displayName ?? event.actor.email
+  const occurredAt = formatDateTime(event.timestamp)
+  const details: Array<{ label: string; value: string }> = []
+  const contentSections: Array<{
+    title: string
+    body?: string
+    rows?: Array<{ label: string; value: string }>
+    tone?: 'default' | 'quote' | 'warning'
+  }> = []
+  const ticketStatus = statusLabel ? humanize(statusLabel) : undefined
+  const priority = ticket.priority ? humanize(ticket.priority) : undefined
+
+  if (ticketStatus) details.push({ label: 'Current status', value: ticketStatus })
+  if (priority) details.push({ label: 'Priority', value: priority })
+  if (ticket.inboxName) details.push({ label: 'Inbox', value: ticket.inboxName })
+  if (ticket.primaryTeamName) details.push({ label: 'Team', value: ticket.primaryTeamName })
+  if (ticket.channel) details.push({ label: 'Channel', value: humanize(ticket.channel) })
+  if (ticket.visibility) details.push({ label: 'Visibility', value: humanize(ticket.visibility) })
+  if (ticket.requesterName || ticket.requesterEmail) {
+    details.push({
+      label: 'Requester',
+      value: formatNameAndEmail(ticket.requesterName, ticket.requesterEmail),
+    })
+  }
+
+  let title = `Update on ticket: ${ticketSubject}`
+  let summary = `There is a new update on this ticket.`
+  let eventLabel = 'Ticket updated'
+  let quote: string | undefined
+
+  if (event.type === 'ticket.created') {
+    title = `Ticket opened: ${ticketSubject}`
+    eventLabel = 'Ticket opened'
+    summary = `A new ticket was opened in ${ticket.inboxName ?? 'your workspace'}.`
+    contentSections.push({
+      title: 'Initial ticket content',
+      body: formatLongText(ticket.descriptionText, 'No description was provided.'),
+      tone: 'quote',
+    })
+    if (ticket.createdAt) details.push({ label: 'Opened', value: formatDateTime(ticket.createdAt) })
+  } else if (event.type === 'ticket.assigned') {
+    title = `Ticket assignment updated: ${ticketSubject}`
+    eventLabel = 'Assignment changed'
+    summary = `The ticket assignment changed.`
+    const data = event.data as any
+    contentSections.push({
+      title: 'Assignment change',
+      rows: [
+        {
+          label: 'Previous assignee',
+          value: data.previousAssigneePrincipalId
+            ? 'Previous teammate details unavailable'
+            : 'None',
+        },
+        {
+          label: 'New assignee',
+          value: ticket.assigneeTeamName
+            ? ticket.assigneeTeamName
+            : data.newAssigneePrincipalId
+              ? 'New teammate details unavailable'
+              : 'None',
+        },
+      ],
+    })
+  } else if (event.type === 'ticket.unassigned') {
+    title = `Ticket unassigned: ${ticketSubject}`
+    eventLabel = 'Ticket unassigned'
+    summary = `The ticket is no longer assigned to an individual teammate.`
+    const data = event.data as any
+    contentSections.push({
+      title: 'Assignment change',
+      rows: [
+        {
+          label: 'Previous assignee',
+          value: data.previousAssigneePrincipalId
+            ? 'Previous teammate details unavailable'
+            : 'None',
+        },
+        { label: 'New assignee', value: 'Unassigned' },
+      ],
+    })
+  } else if (event.type === 'ticket.status_changed') {
+    title = `Status: ${ticketSubject}`
+    const data = event.data as any
+    eventLabel = 'Status changed'
+    const previousStatus = humanize(data.previousStatusCategory ?? 'No status')
+    const newStatus = humanize(data.newStatusCategory)
+    summary = `This ticket moved from ${previousStatus} to ${newStatus}.`
+    contentSections.push({
+      title: 'Status change',
+      rows: [
+        { label: 'Previous status', value: previousStatus },
+        { label: 'New status', value: newStatus },
+      ],
+    })
+  } else if (event.type === 'ticket.updated') {
+    title = `Ticket details updated: ${ticketSubject}`
+    eventLabel = 'Ticket details changed'
+    const data = event.data as any
+    const changedFields = Array.isArray(data.changedFields) ? data.changedFields : []
+    summary = `${changedFields.length || 1} ticket ${changedFields.length === 1 ? 'field was' : 'fields were'} updated.`
+    const changeRows: Array<{ label: string; value: string }> = []
+    for (const field of changedFields.slice(0, 6)) {
+      const diff = data.diff?.[field]
+      changeRows.push({
+        label: humanize(field),
+        value: diff
+          ? `${formatDiffValue(field, diff.from)} -> ${formatDiffValue(field, diff.to)}`
+          : 'Changed',
+      })
+    }
+    if (changedFields.length > 6) {
+      changeRows.push({
+        label: 'More changes',
+        value: `${changedFields.length - 6} additional fields changed`,
+      })
+    }
+    contentSections.push({
+      title: 'Changed fields',
+      rows:
+        changeRows.length > 0
+          ? changeRows
+          : [
+              {
+                label: 'Change',
+                value: 'Ticket fields changed, but no diff details were provided.',
+              },
+            ],
+    })
+  } else if (event.type === 'ticket.thread_added') {
+    title = `New reply: ${ticketSubject}`
+    eventLabel = 'New reply'
+    const thread = (event.data as any).thread
+    summary = thread?.isFromRequester
+      ? `The requester replied to this ticket.`
+      : `A new reply was added to this ticket.`
+    if (thread?.createdAt)
+      details.push({ label: 'Reply time', value: formatDateTime(thread.createdAt) })
+    if ((event.data as any).audience)
+      details.push({ label: 'Audience', value: humanize((event.data as any).audience) })
+    quote = thread ? formatThreadBody(thread) : undefined
+    contentSections.push({
+      title: thread?.isFromRequester ? 'Requester reply' : 'Reply content',
+      body: quote ?? 'Reply content was not included in the event payload.',
+      tone: 'quote',
+    })
+  } else if (event.type === 'ticket.thread_updated') {
+    title = `Reply updated: ${ticketSubject}`
+    eventLabel = 'Reply updated'
+    const thread = (event.data as any).thread
+    summary = `A reply on this ticket was edited.`
+    if (thread?.editedAt) details.push({ label: 'Edited', value: formatDateTime(thread.editedAt) })
+    if ((event.data as any).audience)
+      details.push({ label: 'Audience', value: humanize((event.data as any).audience) })
+    quote = thread ? formatThreadBody(thread) : undefined
+    contentSections.push({
+      title: 'Updated reply content',
+      body: quote ?? 'Updated reply content was not included in the event payload.',
+      tone: 'quote',
+    })
+  } else if (event.type === 'ticket.thread_deleted') {
+    title = `Reply removed: ${ticketSubject}`
+    eventLabel = 'Reply removed'
+    summary = `A reply was removed from this ticket.`
+    if ((event.data as any).audience)
+      details.push({ label: 'Audience', value: humanize((event.data as any).audience) })
+    const thread = (event.data as any).thread
+    quote = thread ? formatThreadBody(thread) : undefined
+    contentSections.push({
+      title: 'Removed reply content',
+      body: quote ?? 'Removed reply content was not available in the event payload.',
+      tone: 'quote',
+    })
+  } else if (event.type === 'ticket.participant_added') {
+    title = `Added to ticket: ${ticketSubject}`
+    eventLabel = 'Participant added'
+    summary = `A participant was added to this ticket.`
+    const role = (event.data as any).role
+    contentSections.push({
+      title: 'Participant change',
+      rows: [
+        { label: 'Participant', value: 'Participant details unavailable' },
+        { label: 'Role', value: role ? humanize(role) : 'Not specified' },
+      ],
+    })
+  } else if (event.type === 'ticket.participant_removed') {
+    title = `Removed from ticket: ${ticketSubject}`
+    eventLabel = 'Participant removed'
+    summary = `A participant was removed from this ticket.`
+    contentSections.push({
+      title: 'Participant change',
+      rows: [{ label: 'Participant', value: 'Participant details unavailable' }],
+    })
+  } else if (event.type === 'ticket.shared') {
+    title = `Ticket shared: ${ticketSubject}`
+    eventLabel = 'Ticket shared'
+    summary = `This ticket was shared with another team.`
+    const accessLevel = (event.data as any).accessLevel
+    contentSections.push({
+      title: 'Share details',
+      rows: [
+        { label: 'Team', value: 'Team details unavailable' },
+        { label: 'Access', value: accessLevel ? humanize(accessLevel) : 'Not specified' },
+      ],
+    })
+  } else if (event.type === 'ticket.unshared') {
+    title = `Ticket access revoked: ${ticketSubject}`
+    eventLabel = 'Ticket access revoked'
+    summary = `A team's access to this ticket was revoked.`
+    contentSections.push({
+      title: 'Share details',
+      rows: [{ label: 'Team', value: 'Team details unavailable' }],
+    })
+  } else if (event.type === 'ticket.sla_warning') {
+    title = `SLA escalation: ${ticketSubject}`
+    const data = event.data as any
+    eventLabel = 'SLA warning'
+    summary = `${data.ruleName} is approaching its ${humanize(data.kind)} target.`
+    contentSections.push({
+      title: 'SLA details',
+      rows: [
+        { label: 'SLA rule', value: data.ruleName },
+        { label: 'Target', value: humanize(data.kind) },
+      ],
+      tone: 'warning',
+    })
+  } else if (event.type === 'ticket.sla_breach') {
+    title = `SLA breached: ${ticketSubject}`
+    const data = event.data as any
+    eventLabel = 'SLA breached'
+    summary = `The ${humanize(data.kind)} target was missed.`
+    contentSections.push({
+      title: 'SLA details',
+      rows: [{ label: 'Breached target', value: humanize(data.kind) }],
+      tone: 'warning',
+    })
+  } else if (event.type === 'ticket.first_response') {
+    title = `First response sent: ${ticketSubject}`
+    eventLabel = 'First response recorded'
+    const data = event.data as any
+    summary = `This ticket received its first response.`
+    contentSections.push({
+      title: 'First response',
+      rows: [
+        { label: 'Recorded at', value: formatDateTime(data.firstResponseAt) },
+        { label: 'Response content', value: 'Response body unavailable in the event payload' },
+      ],
+    })
+  } else if (event.type === 'ticket.attachment_added') {
+    title = `Attachment added: ${ticketSubject}`
+    eventLabel = 'Attachment added'
+    const attachment = (event.data as any).attachment
+    summary = `${attachment.filename} was attached to this ticket.`
+    contentSections.push({
+      title: 'Attachment details',
+      rows: [
+        { label: 'File', value: attachment.filename },
+        { label: 'Type', value: attachment.mimeType },
+        { label: 'Size', value: formatBytes(attachment.sizeBytes) },
+        { label: 'Thread', value: attachment.threadId },
+        ...(attachment.publicUrl ? [{ label: 'File URL', value: attachment.publicUrl }] : []),
+      ],
+    })
+  } else if (event.type === 'ticket.attachment_removed') {
+    title = `Attachment removed: ${ticketSubject}`
+    eventLabel = 'Attachment removed'
+    const attachment = (event.data as any).attachment
+    summary = `${attachment.filename} was removed from this ticket.`
+    contentSections.push({
+      title: 'Attachment details',
+      rows: [
+        { label: 'File', value: attachment.filename },
+        { label: 'Thread', value: attachment.threadId },
+      ],
+    })
+  } else if (event.type === 'ticket.deleted') {
+    title = `Ticket deleted: ${ticketSubject}`
+    eventLabel = 'Ticket deleted'
+    summary = `This ticket was deleted.`
+    contentSections.push({
+      title: 'Deleted ticket content',
+      body: formatLongText(ticket.descriptionText, 'No description snapshot was available.'),
+      tone: 'quote',
+    })
+  } else if (event.type === 'ticket.restored') {
+    title = `Ticket restored: ${ticketSubject}`
+    eventLabel = 'Ticket restored'
+    summary = `This ticket was restored.`
+    contentSections.push({
+      title: 'Restored ticket content',
+      body: formatLongText(ticket.descriptionText, 'No description snapshot was available.'),
+      tone: 'quote',
+    })
+  }
+
+  return {
+    title,
+    body: summary,
+    summary,
+    eventLabel,
+    actorName,
+    occurredAt,
+    details,
+    contentSections,
+    quote,
+    ticketSubject,
+    ticketUrl,
+    statusLabel: ticketStatus,
+  }
+}
+
+function humanize(value: unknown): string {
+  if (value == null || value === '') return 'None'
+  return String(value)
+    .replace(/[_-]+/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .replace(/\b\w/g, (char) => char.toUpperCase())
+}
+
+function formatDateTime(value: string): string {
+  const date = new Date(value)
+  if (Number.isNaN(date.getTime())) return value
+  return new Intl.DateTimeFormat('en', {
+    dateStyle: 'medium',
+    timeStyle: 'short',
+  }).format(date)
+}
+
+function formatNameAndEmail(name?: string | null, email?: string | null): string {
+  if (name && email) return `${name} (${email})`
+  return name ?? email ?? 'Unknown requester'
+}
+
+function formatDiffValue(field: string, value: unknown): string {
+  if (value == null || value === '') return 'None'
+  if (/status|priority|category|role|access/i.test(field)) return humanize(value)
+  if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
+    return clipWithNotice(String(value), 300)
+  }
+  return clipWithNotice(JSON.stringify(value), 300)
+}
+
+function formatThreadBody(thread: {
+  bodyText?: string | null
+  bodyTextPreview?: string | null
+  bodyTextTruncated?: boolean
+}): string {
+  const source = thread.bodyText?.trim() || thread.bodyTextPreview?.trim()
+  if (!source) return 'Thread content was unavailable.'
+  const formatted = formatLongText(source, 'Thread content was unavailable.')
+  if (!thread.bodyText && thread.bodyTextTruncated && !formatted.includes('Content truncated')) {
+    return `${formatted}\n\nContent truncated in event payload.`
+  }
+  return formatted
+}
+
+function formatLongText(value: string | null | undefined, fallback: string): string {
+  const normalized = value?.replace(/\r\n/g, '\n').trim()
+  if (!normalized) return fallback
+  return clipWithNotice(normalized, 4000)
+}
+
+function formatBytes(bytes: number): string {
+  if (!Number.isFinite(bytes) || bytes <= 0) return '0 B'
+  const units = ['B', 'KB', 'MB', 'GB']
+  let size = bytes
+  let unitIndex = 0
+  while (size >= 1024 && unitIndex < units.length - 1) {
+    size /= 1024
+    unitIndex += 1
+  }
+  return `${size >= 10 || unitIndex === 0 ? Math.round(size) : size.toFixed(1)} ${units[unitIndex]}`
+}
+
+function clipWithNotice(value: string, maxLength: number): string {
+  if (value.length <= maxLength) return value
+  return `${value.slice(0, maxLength).trimEnd()}\n\nContent truncated in email.`
+}
diff --git a/apps/web/src/lib/server/events/types.ts b/apps/web/src/lib/server/events/types.ts
index 50a36b6a2..f601d344c 100644
--- a/apps/web/src/lib/server/events/types.ts
+++ b/apps/web/src/lib/server/events/types.ts
@@ -19,6 +19,46 @@ export const EVENT_TYPES = [
   'comment.updated',
   'comment.deleted',
   'changelog.published',
+  // Ticketing (Phase 7.5)
+  'ticket.created',
+  'ticket.updated',
+  'ticket.deleted',
+  'ticket.restored',
+  'ticket.assigned',
+  'ticket.unassigned',
+  'ticket.status_changed',
+  'ticket.first_response',
+  'ticket.thread_added',
+  'ticket.thread_updated',
+  'ticket.thread_deleted',
+  'ticket.participant_added',
+  'ticket.participant_removed',
+  'ticket.shared',
+  'ticket.unshared',
+  'ticket.sla_warning',
+  'ticket.sla_breach',
+  'ticket.attachment_added',
+  'ticket.attachment_removed',
+  // Configuration plane (Phase 6) — admin CRUD over inboxes / teams / statuses
+  'inbox.created',
+  'inbox.updated',
+  'inbox.archived',
+  'inbox.unarchived',
+  'team.created',
+  'team.updated',
+  'team.archived',
+  'ticket_status.created',
+  'ticket_status.updated',
+  // CRM (Phase 5) — contacts and organizations
+  'contact.created',
+  'contact.updated',
+  'contact.archived',
+  'contact.linked',
+  'contact.unlinked',
+  'organization.created',
+  'organization.updated',
+  'organization.archived',
+  'organization.unarchived',
   'conversation.created',
   'conversation.status_changed',
   'conversation.assigned',
@@ -27,6 +67,64 @@ export const EVENT_TYPES = [
   'message.created',
   'message.note_created',
   'message.deleted',
+  // Help Center (Phase 2) — category & article CRUD
+  'help_center.category.created',
+  'help_center.category.updated',
+  'help_center.category.deleted',
+  'help_center.article.created',
+  'help_center.article.updated',
+  'help_center.article.published',
+  'help_center.article.unpublished',
+  'help_center.article.deleted',
+  // Changelog (Phase 2) — entry CRUD ('changelog.published' already exists)
+  'changelog.created',
+  'changelog.updated',
+  'changelog.deleted',
+  // Audience (Phase 2) — segments & user-attribute definitions
+  'segment.created',
+  'segment.updated',
+  'segment.deleted',
+  'user_attribute.created',
+  'user_attribute.updated',
+  'user_attribute.deleted',
+  // Feedback configuration (Phase 8) — boards, tags, statuses, roadmaps
+  'board.created',
+  'board.updated',
+  'board.deleted',
+  'tag.created',
+  'tag.updated',
+  'tag.deleted',
+  'status.created',
+  'status.updated',
+  'status.deleted',
+  'roadmap.created',
+  'roadmap.updated',
+  'roadmap.deleted',
+  // Support configuration (Phase 8) — SLA, routing, business hours, channels, memberships
+  'sla_policy.created',
+  'sla_policy.updated',
+  'sla_policy.archived',
+  'routing_rule.created',
+  'routing_rule.updated',
+  'routing_rule.deleted',
+  'business_hours.created',
+  'business_hours.updated',
+  'business_hours.archived',
+  'inbox_channel.created',
+  'inbox_channel.updated',
+  'inbox_channel.archived',
+  'inbox_membership.added',
+  'inbox_membership.updated',
+  'inbox_membership.removed',
+  // Administration / security (Phase 8) — API keys, roles, role assignments
+  'api_key.created',
+  'api_key.rotated',
+  'api_key.revoked',
+  'role.created',
+  'role.updated',
+  'role.deleted',
+  'role_assignment.created',
+  'role_assignment.revoked',
 ] as const
 
 export type EventType = (typeof EVENT_TYPES)[number]
@@ -232,6 +330,12 @@ interface EventBase<T extends EventType> {
   type: T
   timestamp: string
   actor: EventActor
+  /**
+   * Set by inbound integration handlers to prevent echo loops.
+   * When present, the dispatcher skips integration targets whose
+   * integrationId matches this value.
+   */
+  syncSourceIntegrationId?: string
 }
 
 export interface PostCreatedEvent extends EventBase<'post.created'> {
@@ -329,6 +433,43 @@ export type EventData =
   | CommentUpdatedEvent
   | CommentDeletedEvent
   | ChangelogPublishedEvent
+  | TicketCreatedEvent
+  | TicketUpdatedEvent
+  | TicketDeletedEvent
+  | TicketRestoredEvent
+  | TicketAssignedEvent
+  | TicketUnassignedEvent
+  | TicketStatusChangedEvent
+  | TicketFirstResponseEvent
+  | TicketThreadAddedEvent
+  | TicketThreadUpdatedEvent
+  | TicketThreadDeletedEvent
+  | TicketParticipantAddedEvent
+  | TicketParticipantRemovedEvent
+  | TicketSharedEvent
+  | TicketUnsharedEvent
+  | TicketSlaWarningEvent
+  | TicketSlaBreachEvent
+  | TicketAttachmentAddedEvent
+  | TicketAttachmentRemovedEvent
+  | InboxCreatedEvent
+  | InboxUpdatedEvent
+  | InboxArchivedEvent
+  | InboxUnarchivedEvent
+  | TeamCreatedEvent
+  | TeamUpdatedEvent
+  | TeamArchivedEvent
+  | TicketStatusCreatedEvent
+  | TicketStatusUpdatedEvent
+  | ContactCreatedEvent
+  | ContactUpdatedEvent
+  | ContactArchivedEvent
+  | ContactLinkedEvent
+  | ContactUnlinkedEvent
+  | OrganizationCreatedEvent
+  | OrganizationUpdatedEvent
+  | OrganizationArchivedEvent
+  | OrganizationUnarchivedEvent
   | ConversationCreatedEvent
   | ConversationStatusChangedEvent
   | ConversationAssignedEvent
@@ -337,3 +478,1105 @@ export type EventData =
   | MessageCreatedEvent
   | MessageNoteCreatedEvent
   | MessageDeletedEvent
+  | HelpCenterCategoryCreatedEvent
+  | HelpCenterCategoryUpdatedEvent
+  | HelpCenterCategoryDeletedEvent
+  | HelpCenterArticleCreatedEvent
+  | HelpCenterArticleUpdatedEvent
+  | HelpCenterArticlePublishedEvent
+  | HelpCenterArticleUnpublishedEvent
+  | HelpCenterArticleDeletedEvent
+  | ChangelogCreatedEvent
+  | ChangelogUpdatedEvent
+  | ChangelogDeletedEvent
+  | SegmentCreatedEvent
+  | SegmentUpdatedEvent
+  | SegmentDeletedEvent
+  | UserAttributeCreatedEvent
+  | UserAttributeUpdatedEvent
+  | UserAttributeDeletedEvent
+  | BoardCreatedEvent
+  | BoardUpdatedEvent
+  | BoardDeletedEvent
+  | TagCreatedEvent
+  | TagUpdatedEvent
+  | TagDeletedEvent
+  | StatusCreatedEvent
+  | StatusUpdatedEvent
+  | StatusDeletedEvent
+  | RoadmapCreatedEvent
+  | RoadmapUpdatedEvent
+  | RoadmapDeletedEvent
+  | SlaPolicyCreatedEvent
+  | SlaPolicyUpdatedEvent
+  | SlaPolicyArchivedEvent
+  | RoutingRuleCreatedEvent
+  | RoutingRuleUpdatedEvent
+  | RoutingRuleDeletedEvent
+  | BusinessHoursCreatedEvent
+  | BusinessHoursUpdatedEvent
+  | BusinessHoursArchivedEvent
+  | InboxChannelCreatedEvent
+  | InboxChannelUpdatedEvent
+  | InboxChannelArchivedEvent
+  | InboxMembershipAddedEvent
+  | InboxMembershipUpdatedEvent
+  | InboxMembershipRemovedEvent
+  | ApiKeyCreatedEvent
+  | ApiKeyRotatedEvent
+  | ApiKeyRevokedEvent
+  | RoleCreatedEvent
+  | RoleUpdatedEvent
+  | RoleDeletedEvent
+  | RoleAssignmentCreatedEvent
+  | RoleAssignmentRevokedEvent
+
+// ============================================================================
+// Ticket Events (Phase 7.5)
+// ============================================================================
+
+/**
+ * Common ticket reference embedded in every ticket event.
+ *
+ * Channel/visibility are included so external integrations can filter
+ * (e.g. only forward customer-facing tickets to Slack) without needing
+ * to call back into the API.
+ */
+export interface EventTicketRef {
+  id: string
+  subject: string | null
+  descriptionText: string | null
+  statusId: string | null
+  statusCategory: string | null
+  priority: string | null
+  channel: string | null
+  visibility: string | null
+  inboxId: string | null
+  primaryTeamId: string | null
+  assigneePrincipalId: string | null
+  assigneeTeamId: string | null
+  requesterPrincipalId: string | null
+  requesterContactId: string | null
+  // ---- Phase 3 enrichment: snapshot fields ---------------------------------
+  // All fields below are snapshotted at dispatch time from joined tables so
+  // that webhook receivers don't have to call back into the API. They are
+  // optional on the type to keep the contract backwards compatible — older
+  // code paths that build refs synchronously may still omit them.
+  /** Display name of the ticket's status (e.g. "Open", "Solved"). */
+  statusName?: string | null
+  /** Display name of the inbox the ticket belongs to. */
+  inboxName?: string | null
+  /** URL-safe inbox slug. */
+  inboxSlug?: string | null
+  /** Display name of the team that owns the ticket queue. */
+  primaryTeamName?: string | null
+  /** Display name of the team currently assigned (if assigneeTeamId is set). */
+  assigneeTeamName?: string | null
+  /** Lowercased email of the requester contact, if known. */
+  requesterEmail?: string | null
+  /** Display name of the requester contact, if known. */
+  requesterName?: string | null
+  /** Organization name attached to the ticket / requester. */
+  organizationName?: string | null
+  /** Apex domain of the organization. */
+  organizationDomain?: string | null
+  /** Lifecycle timestamps (ISO strings). */
+  createdAt?: string | null
+  firstResponseAt?: string | null
+  resolvedAt?: string | null
+  reopenedAt?: string | null
+  closedAt?: string | null
+  /** Portal permalink — `${baseUrl}/tickets/{id}`. */
+  ticketUrl?: string | null
+}
+
+export interface TicketCreatedPayload {
+  ticket: EventTicketRef
+}
+
+export interface TicketUpdatedPayload {
+  ticket: EventTicketRef
+  /** Names of fields that changed (e.g. ['priority', 'primaryTeamId']). */
+  changedFields: string[]
+  /** Per-field before/after values. Mirrors the audit diff produced by the service. */
+  diff: Record<string, { from: unknown; to: unknown }>
+}
+
+export interface TicketDeletedPayload {
+  ticket: EventTicketRef
+  deletedByPrincipalId: string | null
+}
+
+export interface TicketRestoredPayload {
+  ticket: EventTicketRef
+  restoredByPrincipalId: string | null
+}
+
+export interface TicketAssignedPayload {
+  ticket: EventTicketRef
+  previousAssigneePrincipalId: string | null
+  newAssigneePrincipalId: string | null
+}
+
+export interface TicketUnassignedPayload {
+  ticket: EventTicketRef
+  previousAssigneePrincipalId: string | null
+}
+
+export interface TicketStatusChangedPayload {
+  ticket: EventTicketRef
+  previousStatusCategory: string | null
+  newStatusCategory: string
+}
+
+export interface TicketFirstResponsePayload {
+  ticket: EventTicketRef
+  /** ID of the thread whose creation triggered first-response tracking. */
+  threadId: string
+  /** ISO timestamp of the moment first-response was recorded. */
+  firstResponseAt: string
+}
+
+export interface TicketThreadAddedPayload {
+  ticket: EventTicketRef
+  threadId: string
+  /**
+   * Audience of the thread. External webhook delivery filters out
+   * `internal` threads to avoid leaking private agent notes.
+   */
+  audience: 'public' | 'internal' | 'shared_team'
+  sharedWithTeamId: string | null
+  /**
+   * Self-contained thread snapshot so webhook receivers don't need a second
+   * round-trip to fetch the body. Optional for backwards compatibility with
+   * older payloads — always populated by current dispatchers.
+   */
+  thread?: {
+    id: string
+    audience: 'public' | 'internal' | 'shared_team'
+    /** First N chars of the plain-text body (capped, see `bodyTextTruncated`). */
+    bodyTextPreview: string
+    /** Plain-text body snapshot for notification/email consumers. */
+    bodyText?: string
+    bodyTextTruncated: boolean
+    authorPrincipalId: string | null
+    /** True when the thread author is the ticket's requester. */
+    isFromRequester: boolean
+    sharedWithTeamId: string | null
+    /** ISO timestamp the thread was created. */
+    createdAt: string
+  }
+}
+
+export interface TicketThreadUpdatedPayload {
+  ticket: EventTicketRef
+  threadId: string
+  audience: 'public' | 'internal' | 'shared_team'
+  sharedWithTeamId: string | null
+  thread: {
+    id: string
+    audience: 'public' | 'internal' | 'shared_team'
+    bodyTextPreview: string
+    bodyText?: string
+    bodyTextTruncated: boolean
+    authorPrincipalId: string | null
+    isFromRequester: boolean
+    sharedWithTeamId: string | null
+    createdAt: string
+    editedAt: string | null
+  }
+}
+
+export interface TicketThreadDeletedPayload {
+  ticket: EventTicketRef
+  threadId: string
+  audience: 'public' | 'internal' | 'shared_team'
+  sharedWithTeamId: string | null
+  deletedByPrincipalId: string | null
+  thread?: {
+    id: string
+    audience: 'public' | 'internal' | 'shared_team'
+    bodyTextPreview: string
+    bodyText?: string
+    bodyTextTruncated: boolean
+    authorPrincipalId: string | null
+    isFromRequester: boolean
+    sharedWithTeamId: string | null
+    createdAt: string
+  }
+}
+
+export interface TicketParticipantAddedPayload {
+  ticket: EventTicketRef
+  addedPrincipalId: string | null
+  role: string | null
+}
+
+export interface TicketParticipantRemovedPayload {
+  ticket: EventTicketRef
+  removedPrincipalId: string | null
+}
+
+export interface TicketSharedPayload {
+  ticket: EventTicketRef
+  teamId: string
+  accessLevel: string | null
+}
+
+export interface TicketUnsharedPayload {
+  ticket: EventTicketRef
+  teamId: string
+}
+
+export interface TicketSlaWarningPayload {
+  ticket: EventTicketRef
+  kind: string
+  ruleName: string
+}
+
+export interface TicketSlaBreachPayload {
+  ticket: EventTicketRef
+  kind: string
+}
+
+export interface TicketAttachmentAddedPayload {
+  ticket: EventTicketRef
+  attachment: {
+    id: string
+    threadId: string
+    filename: string
+    mimeType: string
+    sizeBytes: number
+    uploadedByPrincipalId: string | null
+    /** Public URL when configured (e.g. S3 + CDN). storageKey is intentionally omitted. */
+    publicUrl: string | null
+  }
+}
+
+export interface TicketAttachmentRemovedPayload {
+  ticket: EventTicketRef
+  attachment: {
+    id: string
+    threadId: string
+    filename: string
+  }
+  removedByPrincipalId: string | null
+}
+
+export interface TicketCreatedEvent extends EventBase<'ticket.created'> {
+  data: TicketCreatedPayload
+}
+export interface TicketUpdatedEvent extends EventBase<'ticket.updated'> {
+  data: TicketUpdatedPayload
+}
+export interface TicketDeletedEvent extends EventBase<'ticket.deleted'> {
+  data: TicketDeletedPayload
+}
+export interface TicketRestoredEvent extends EventBase<'ticket.restored'> {
+  data: TicketRestoredPayload
+}
+export interface TicketAssignedEvent extends EventBase<'ticket.assigned'> {
+  data: TicketAssignedPayload
+}
+export interface TicketUnassignedEvent extends EventBase<'ticket.unassigned'> {
+  data: TicketUnassignedPayload
+}
+export interface TicketStatusChangedEvent extends EventBase<'ticket.status_changed'> {
+  data: TicketStatusChangedPayload
+}
+export interface TicketFirstResponseEvent extends EventBase<'ticket.first_response'> {
+  data: TicketFirstResponsePayload
+}
+export interface TicketThreadAddedEvent extends EventBase<'ticket.thread_added'> {
+  data: TicketThreadAddedPayload
+}
+export interface TicketThreadUpdatedEvent extends EventBase<'ticket.thread_updated'> {
+  data: TicketThreadUpdatedPayload
+}
+export interface TicketThreadDeletedEvent extends EventBase<'ticket.thread_deleted'> {
+  data: TicketThreadDeletedPayload
+}
+export interface TicketParticipantAddedEvent extends EventBase<'ticket.participant_added'> {
+  data: TicketParticipantAddedPayload
+}
+export interface TicketParticipantRemovedEvent extends EventBase<'ticket.participant_removed'> {
+  data: TicketParticipantRemovedPayload
+}
+export interface TicketSharedEvent extends EventBase<'ticket.shared'> {
+  data: TicketSharedPayload
+}
+export interface TicketUnsharedEvent extends EventBase<'ticket.unshared'> {
+  data: TicketUnsharedPayload
+}
+export interface TicketSlaWarningEvent extends EventBase<'ticket.sla_warning'> {
+  data: TicketSlaWarningPayload
+}
+export interface TicketSlaBreachEvent extends EventBase<'ticket.sla_breach'> {
+  data: TicketSlaBreachPayload
+}
+export interface TicketAttachmentAddedEvent extends EventBase<'ticket.attachment_added'> {
+  data: TicketAttachmentAddedPayload
+}
+export interface TicketAttachmentRemovedEvent extends EventBase<'ticket.attachment_removed'> {
+  data: TicketAttachmentRemovedPayload
+}
+
+// ============================================================================
+// Configuration-plane events (Phase 6)
+// ============================================================================
+
+/**
+ * Snapshot of an inbox embedded in `inbox.*` events. Mirrors the row shape so
+ * receivers can mirror the inbox catalogue without calling back.
+ */
+export interface EventInboxRef {
+  id: string
+  slug: string
+  name: string
+  description: string | null
+  primaryTeamId: string | null
+  defaultVisibilityScope: string | null
+  defaultPriority: string | null
+  defaultStatusId: string | null
+  color: string | null
+  icon: string | null
+  archivedAt: string | null
+}
+
+/** Snapshot of a team embedded in `team.*` events. */
+export interface EventTeamRef {
+  id: string
+  slug: string
+  name: string
+  description: string | null
+  shortLabel: string | null
+  color: string | null
+  archivedAt: string | null
+}
+
+/** Snapshot of a ticket status embedded in `ticket_status.*` events. */
+export interface EventTicketStatusRef {
+  id: string
+  slug: string
+  name: string
+  color: string | null
+  category: string
+  position: number
+  isDefault: boolean
+  isSystem: boolean
+  deletedAt: string | null
+}
+
+export interface InboxCreatedPayload {
+  inbox: EventInboxRef
+}
+
+export interface InboxUpdatedPayload {
+  inbox: EventInboxRef
+  /** Names of fields that changed (e.g. ['name', 'primaryTeamId']). */
+  changedFields: string[]
+}
+
+export interface InboxArchivedPayload {
+  inbox: EventInboxRef
+}
+
+export interface InboxUnarchivedPayload {
+  inbox: EventInboxRef
+}
+
+export interface TeamCreatedPayload {
+  team: EventTeamRef
+}
+
+export interface TeamUpdatedPayload {
+  team: EventTeamRef
+  changedFields: string[]
+}
+
+export interface TeamArchivedPayload {
+  team: EventTeamRef
+}
+
+export interface TicketStatusCreatedPayload {
+  status: EventTicketStatusRef
+}
+
+export interface TicketStatusUpdatedPayload {
+  status: EventTicketStatusRef
+  changedFields: string[]
+}
+
+export interface InboxCreatedEvent extends EventBase<'inbox.created'> {
+  data: InboxCreatedPayload
+}
+export interface InboxUpdatedEvent extends EventBase<'inbox.updated'> {
+  data: InboxUpdatedPayload
+}
+export interface InboxArchivedEvent extends EventBase<'inbox.archived'> {
+  data: InboxArchivedPayload
+}
+export interface InboxUnarchivedEvent extends EventBase<'inbox.unarchived'> {
+  data: InboxUnarchivedPayload
+}
+export interface TeamCreatedEvent extends EventBase<'team.created'> {
+  data: TeamCreatedPayload
+}
+export interface TeamUpdatedEvent extends EventBase<'team.updated'> {
+  data: TeamUpdatedPayload
+}
+export interface TeamArchivedEvent extends EventBase<'team.archived'> {
+  data: TeamArchivedPayload
+}
+export interface TicketStatusCreatedEvent extends EventBase<'ticket_status.created'> {
+  data: TicketStatusCreatedPayload
+}
+export interface TicketStatusUpdatedEvent extends EventBase<'ticket_status.updated'> {
+  data: TicketStatusUpdatedPayload
+}
+
+// ============================================================================
+// CRM events (Phase 5) — contacts and organizations
+// ============================================================================
+
+/**
+ * Snapshot of a contact embedded in `contact.*` events. Lean shape — omits
+ * `metadata`, `avatarUrl`, `notes` (receivers can hydrate via REST GET if
+ * they need more).
+ */
+export interface EventContactRef {
+  id: string
+  name: string | null
+  email: string | null
+  phone: string | null
+  title: string | null
+  externalId: string | null
+  organizationId: string | null
+  archivedAt: string | null
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+/** Snapshot of an organization embedded in `organization.*` events. */
+export interface EventOrganizationRef {
+  id: string
+  name: string
+  domain: string | null
+  website: string | null
+  externalId: string | null
+  archivedAt: string | null
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+export interface ContactCreatedPayload {
+  contact: EventContactRef
+}
+export interface ContactUpdatedPayload {
+  contact: EventContactRef
+  changedFields: string[]
+}
+export interface ContactArchivedPayload {
+  contact: EventContactRef
+}
+export interface ContactLinkedPayload {
+  contact: EventContactRef
+  userId: string
+  linkedByPrincipalId: string | null
+}
+export interface ContactUnlinkedPayload {
+  contact: EventContactRef
+  userId: string
+}
+export interface OrganizationCreatedPayload {
+  organization: EventOrganizationRef
+}
+export interface OrganizationUpdatedPayload {
+  organization: EventOrganizationRef
+  changedFields: string[]
+}
+export interface OrganizationArchivedPayload {
+  organization: EventOrganizationRef
+}
+export interface OrganizationUnarchivedPayload {
+  organization: EventOrganizationRef
+}
+
+export interface ContactCreatedEvent extends EventBase<'contact.created'> {
+  data: ContactCreatedPayload
+}
+export interface ContactUpdatedEvent extends EventBase<'contact.updated'> {
+  data: ContactUpdatedPayload
+}
+export interface ContactArchivedEvent extends EventBase<'contact.archived'> {
+  data: ContactArchivedPayload
+}
+export interface ContactLinkedEvent extends EventBase<'contact.linked'> {
+  data: ContactLinkedPayload
+}
+export interface ContactUnlinkedEvent extends EventBase<'contact.unlinked'> {
+  data: ContactUnlinkedPayload
+}
+export interface OrganizationCreatedEvent extends EventBase<'organization.created'> {
+  data: OrganizationCreatedPayload
+}
+export interface OrganizationUpdatedEvent extends EventBase<'organization.updated'> {
+  data: OrganizationUpdatedPayload
+}
+export interface OrganizationArchivedEvent extends EventBase<'organization.archived'> {
+  data: OrganizationArchivedPayload
+}
+export interface OrganizationUnarchivedEvent extends EventBase<'organization.unarchived'> {
+  data: OrganizationUnarchivedPayload
+}
+
+// ============================================================================
+// Help Center events (Phase 2) — categories and articles
+// ============================================================================
+
+/**
+ * Snapshot of a help-center category embedded in `help_center.category.*`
+ * events. Lean shape — ids + key display/visibility fields. Receivers can
+ * hydrate richer data (counts, audience lists) via REST GET.
+ */
+export interface EventHelpCenterCategoryRef {
+  id: string
+  slug: string
+  name: string
+  parentId: string | null
+  isPublic: boolean
+  visibility: string | null
+  position: number
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+/**
+ * Snapshot of a help-center article embedded in `help_center.article.*`
+ * events. Omits the rendered body — receivers can hydrate via REST GET.
+ */
+export interface EventHelpCenterArticleRef {
+  id: string
+  categoryId: string
+  slug: string
+  title: string
+  authorPrincipalId: string | null
+  publishedAt: string | null
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+export interface HelpCenterCategoryCreatedPayload {
+  category: EventHelpCenterCategoryRef
+}
+export interface HelpCenterCategoryUpdatedPayload {
+  category: EventHelpCenterCategoryRef
+  changedFields: string[]
+}
+export interface HelpCenterCategoryDeletedPayload {
+  category: EventHelpCenterCategoryRef
+}
+export interface HelpCenterArticleCreatedPayload {
+  article: EventHelpCenterArticleRef
+}
+export interface HelpCenterArticleUpdatedPayload {
+  article: EventHelpCenterArticleRef
+  changedFields: string[]
+}
+export interface HelpCenterArticlePublishedPayload {
+  article: EventHelpCenterArticleRef
+}
+export interface HelpCenterArticleUnpublishedPayload {
+  article: EventHelpCenterArticleRef
+}
+export interface HelpCenterArticleDeletedPayload {
+  article: EventHelpCenterArticleRef
+}
+
+export interface HelpCenterCategoryCreatedEvent extends EventBase<'help_center.category.created'> {
+  data: HelpCenterCategoryCreatedPayload
+}
+export interface HelpCenterCategoryUpdatedEvent extends EventBase<'help_center.category.updated'> {
+  data: HelpCenterCategoryUpdatedPayload
+}
+export interface HelpCenterCategoryDeletedEvent extends EventBase<'help_center.category.deleted'> {
+  data: HelpCenterCategoryDeletedPayload
+}
+export interface HelpCenterArticleCreatedEvent extends EventBase<'help_center.article.created'> {
+  data: HelpCenterArticleCreatedPayload
+}
+export interface HelpCenterArticleUpdatedEvent extends EventBase<'help_center.article.updated'> {
+  data: HelpCenterArticleUpdatedPayload
+}
+export interface HelpCenterArticlePublishedEvent extends EventBase<'help_center.article.published'> {
+  data: HelpCenterArticlePublishedPayload
+}
+export interface HelpCenterArticleUnpublishedEvent extends EventBase<'help_center.article.unpublished'> {
+  data: HelpCenterArticleUnpublishedPayload
+}
+export interface HelpCenterArticleDeletedEvent extends EventBase<'help_center.article.deleted'> {
+  data: HelpCenterArticleDeletedPayload
+}
+
+// ============================================================================
+// Changelog events (Phase 2) — entry CRUD ('changelog.published' is separate)
+// ============================================================================
+
+/** Snapshot of a changelog entry embedded in `changelog.*` CRUD events. */
+export interface EventChangelogRef {
+  id: string
+  title: string
+  contentPreview: string
+  categoryId: string | null
+  productId: string | null
+  publishedAt: string | null
+  linkedPostCount: number
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+export interface ChangelogCreatedPayload {
+  changelog: EventChangelogRef
+}
+export interface ChangelogUpdatedPayload {
+  changelog: EventChangelogRef
+  changedFields: string[]
+}
+export interface ChangelogDeletedPayload {
+  changelog: EventChangelogRef
+}
+
+export interface ChangelogCreatedEvent extends EventBase<'changelog.created'> {
+  data: ChangelogCreatedPayload
+}
+export interface ChangelogUpdatedEvent extends EventBase<'changelog.updated'> {
+  data: ChangelogUpdatedPayload
+}
+export interface ChangelogDeletedEvent extends EventBase<'changelog.deleted'> {
+  data: ChangelogDeletedPayload
+}
+
+// ============================================================================
+// Audience events (Phase 2) — segments and user-attribute definitions
+// ============================================================================
+
+/** Snapshot of a segment embedded in `segment.*` events. */
+export interface EventSegmentRef {
+  id: string
+  slug: string
+  name: string
+  type: string
+  color: string | null
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+/** Snapshot of a user-attribute definition embedded in `user_attribute.*` events. */
+export interface EventUserAttributeRef {
+  id: string
+  key: string
+  label: string
+  type: string
+  currencyCode: string | null
+  externalKey: string | null
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+export interface SegmentCreatedPayload {
+  segment: EventSegmentRef
+}
+export interface SegmentUpdatedPayload {
+  segment: EventSegmentRef
+  changedFields: string[]
+}
+export interface SegmentDeletedPayload {
+  segment: EventSegmentRef
+}
+export interface UserAttributeCreatedPayload {
+  attribute: EventUserAttributeRef
+}
+export interface UserAttributeUpdatedPayload {
+  attribute: EventUserAttributeRef
+  changedFields: string[]
+}
+export interface UserAttributeDeletedPayload {
+  attribute: EventUserAttributeRef
+}
+
+export interface SegmentCreatedEvent extends EventBase<'segment.created'> {
+  data: SegmentCreatedPayload
+}
+export interface SegmentUpdatedEvent extends EventBase<'segment.updated'> {
+  data: SegmentUpdatedPayload
+}
+export interface SegmentDeletedEvent extends EventBase<'segment.deleted'> {
+  data: SegmentDeletedPayload
+}
+export interface UserAttributeCreatedEvent extends EventBase<'user_attribute.created'> {
+  data: UserAttributeCreatedPayload
+}
+export interface UserAttributeUpdatedEvent extends EventBase<'user_attribute.updated'> {
+  data: UserAttributeUpdatedPayload
+}
+export interface UserAttributeDeletedEvent extends EventBase<'user_attribute.deleted'> {
+  data: UserAttributeDeletedPayload
+}
+
+// ============================================================================
+// Feedback configuration events (Phase 8) — boards, tags, statuses, roadmaps
+// ============================================================================
+
+/** Snapshot of a feedback board embedded in `board.*` events. */
+export interface EventBoardRef {
+  id: string
+  slug: string
+  name: string
+  description: string | null
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+/** Snapshot of a tag embedded in `tag.*` events. */
+export interface EventTagRef {
+  id: string
+  name: string
+  color: string | null
+  description: string | null
+  createdAt: string | null
+}
+
+/** Snapshot of a post status embedded in `status.*` events. */
+export interface EventStatusRef {
+  id: string
+  slug: string
+  name: string
+  color: string | null
+  category: string
+  position: number
+  showOnRoadmap: boolean
+  isDefault: boolean
+  createdAt: string | null
+}
+
+/** Snapshot of a roadmap embedded in `roadmap.*` events. */
+export interface EventRoadmapRef {
+  id: string
+  slug: string
+  name: string
+  description: string | null
+  isPublic: boolean
+  position: number
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+export interface BoardCreatedPayload {
+  board: EventBoardRef
+}
+export interface BoardUpdatedPayload {
+  board: EventBoardRef
+  changedFields: string[]
+}
+export interface BoardDeletedPayload {
+  board: EventBoardRef
+}
+export interface TagCreatedPayload {
+  tag: EventTagRef
+}
+export interface TagUpdatedPayload {
+  tag: EventTagRef
+  changedFields: string[]
+}
+export interface TagDeletedPayload {
+  tag: EventTagRef
+}
+export interface StatusCreatedPayload {
+  status: EventStatusRef
+}
+export interface StatusUpdatedPayload {
+  status: EventStatusRef
+  changedFields: string[]
+}
+export interface StatusDeletedPayload {
+  status: EventStatusRef
+}
+export interface RoadmapCreatedPayload {
+  roadmap: EventRoadmapRef
+}
+export interface RoadmapUpdatedPayload {
+  roadmap: EventRoadmapRef
+  changedFields: string[]
+}
+export interface RoadmapDeletedPayload {
+  roadmap: EventRoadmapRef
+}
+
+export interface BoardCreatedEvent extends EventBase<'board.created'> {
+  data: BoardCreatedPayload
+}
+export interface BoardUpdatedEvent extends EventBase<'board.updated'> {
+  data: BoardUpdatedPayload
+}
+export interface BoardDeletedEvent extends EventBase<'board.deleted'> {
+  data: BoardDeletedPayload
+}
+export interface TagCreatedEvent extends EventBase<'tag.created'> {
+  data: TagCreatedPayload
+}
+export interface TagUpdatedEvent extends EventBase<'tag.updated'> {
+  data: TagUpdatedPayload
+}
+export interface TagDeletedEvent extends EventBase<'tag.deleted'> {
+  data: TagDeletedPayload
+}
+export interface StatusCreatedEvent extends EventBase<'status.created'> {
+  data: StatusCreatedPayload
+}
+export interface StatusUpdatedEvent extends EventBase<'status.updated'> {
+  data: StatusUpdatedPayload
+}
+export interface StatusDeletedEvent extends EventBase<'status.deleted'> {
+  data: StatusDeletedPayload
+}
+export interface RoadmapCreatedEvent extends EventBase<'roadmap.created'> {
+  data: RoadmapCreatedPayload
+}
+export interface RoadmapUpdatedEvent extends EventBase<'roadmap.updated'> {
+  data: RoadmapUpdatedPayload
+}
+export interface RoadmapDeletedEvent extends EventBase<'roadmap.deleted'> {
+  data: RoadmapDeletedPayload
+}
+
+// ============================================================================
+// Support configuration events (Phase 8) — SLA, routing, business hours,
+// inbox channels, inbox memberships
+// ============================================================================
+
+/** Snapshot of an SLA policy embedded in `sla_policy.*` events. */
+export interface EventSlaPolicyRef {
+  id: string
+  name: string
+  scope: string
+  enabled: boolean
+  priority: number
+  archivedAt: string | null
+}
+
+/** Snapshot of a routing rule embedded in `routing_rule.*` events. */
+export interface EventRoutingRuleRef {
+  id: string
+  name: string
+  enabled: boolean
+  priority: number
+  inboxIdScope: string | null
+}
+
+/** Snapshot of a business-hours calendar embedded in `business_hours.*` events. */
+export interface EventBusinessHoursRef {
+  id: string
+  name: string
+  timezone: string
+  archivedAt: string | null
+}
+
+/** Snapshot of an inbox channel embedded in `inbox_channel.*` events. `config` is intentionally omitted (opaque, may carry secrets). */
+export interface EventInboxChannelRef {
+  id: string
+  inboxId: string
+  kind: string
+  label: string
+  externalId: string | null
+  enabled: boolean
+  archivedAt: string | null
+}
+
+/** Snapshot of an inbox membership embedded in `inbox_membership.*` events. */
+export interface EventInboxMembershipRef {
+  id: string
+  inboxId: string
+  principalId: string
+  role: string
+}
+
+export interface SlaPolicyCreatedPayload {
+  policy: EventSlaPolicyRef
+}
+export interface SlaPolicyUpdatedPayload {
+  policy: EventSlaPolicyRef
+  changedFields: string[]
+}
+export interface SlaPolicyArchivedPayload {
+  policy: EventSlaPolicyRef
+}
+export interface RoutingRuleCreatedPayload {
+  rule: EventRoutingRuleRef
+}
+export interface RoutingRuleUpdatedPayload {
+  rule: EventRoutingRuleRef
+  changedFields: string[]
+}
+export interface RoutingRuleDeletedPayload {
+  rule: EventRoutingRuleRef
+}
+export interface BusinessHoursCreatedPayload {
+  businessHours: EventBusinessHoursRef
+}
+export interface BusinessHoursUpdatedPayload {
+  businessHours: EventBusinessHoursRef
+  changedFields: string[]
+}
+export interface BusinessHoursArchivedPayload {
+  businessHours: EventBusinessHoursRef
+}
+export interface InboxChannelCreatedPayload {
+  channel: EventInboxChannelRef
+}
+export interface InboxChannelUpdatedPayload {
+  channel: EventInboxChannelRef
+  changedFields: string[]
+}
+export interface InboxChannelArchivedPayload {
+  channel: EventInboxChannelRef
+}
+export interface InboxMembershipAddedPayload {
+  membership: EventInboxMembershipRef
+}
+export interface InboxMembershipUpdatedPayload {
+  membership: EventInboxMembershipRef
+  previousRole: string | null
+}
+export interface InboxMembershipRemovedPayload {
+  membership: EventInboxMembershipRef
+}
+
+export interface SlaPolicyCreatedEvent extends EventBase<'sla_policy.created'> {
+  data: SlaPolicyCreatedPayload
+}
+export interface SlaPolicyUpdatedEvent extends EventBase<'sla_policy.updated'> {
+  data: SlaPolicyUpdatedPayload
+}
+export interface SlaPolicyArchivedEvent extends EventBase<'sla_policy.archived'> {
+  data: SlaPolicyArchivedPayload
+}
+export interface RoutingRuleCreatedEvent extends EventBase<'routing_rule.created'> {
+  data: RoutingRuleCreatedPayload
+}
+export interface RoutingRuleUpdatedEvent extends EventBase<'routing_rule.updated'> {
+  data: RoutingRuleUpdatedPayload
+}
+export interface RoutingRuleDeletedEvent extends EventBase<'routing_rule.deleted'> {
+  data: RoutingRuleDeletedPayload
+}
+export interface BusinessHoursCreatedEvent extends EventBase<'business_hours.created'> {
+  data: BusinessHoursCreatedPayload
+}
+export interface BusinessHoursUpdatedEvent extends EventBase<'business_hours.updated'> {
+  data: BusinessHoursUpdatedPayload
+}
+export interface BusinessHoursArchivedEvent extends EventBase<'business_hours.archived'> {
+  data: BusinessHoursArchivedPayload
+}
+export interface InboxChannelCreatedEvent extends EventBase<'inbox_channel.created'> {
+  data: InboxChannelCreatedPayload
+}
+export interface InboxChannelUpdatedEvent extends EventBase<'inbox_channel.updated'> {
+  data: InboxChannelUpdatedPayload
+}
+export interface InboxChannelArchivedEvent extends EventBase<'inbox_channel.archived'> {
+  data: InboxChannelArchivedPayload
+}
+export interface InboxMembershipAddedEvent extends EventBase<'inbox_membership.added'> {
+  data: InboxMembershipAddedPayload
+}
+export interface InboxMembershipUpdatedEvent extends EventBase<'inbox_membership.updated'> {
+  data: InboxMembershipUpdatedPayload
+}
+export interface InboxMembershipRemovedEvent extends EventBase<'inbox_membership.removed'> {
+  data: InboxMembershipRemovedPayload
+}
+
+// ============================================================================
+// Administration / security events (Phase 8) — API keys, roles, assignments
+// ============================================================================
+
+/**
+ * Snapshot of an API key embedded in `api_key.*` events.
+ *
+ * SECURITY: the plaintext key, key hash, and key prefix MUST NEVER appear in
+ * the event payload. Only id + name + scopes (capabilities) are exposed.
+ */
+export interface EventApiKeyRef {
+  id: string
+  name: string
+  scopes: string[]
+}
+
+/** Snapshot of a role embedded in `role.*` events. */
+export interface EventRoleRef {
+  id: string
+  key: string
+  name: string
+  isSystem: boolean
+}
+
+/** Snapshot of a role assignment embedded in `role_assignment.*` events. */
+export interface EventRoleAssignmentRef {
+  id: string
+  roleId: string
+  roleKey: string
+  principalId: string
+  teamId: string | null
+}
+
+export interface ApiKeyCreatedPayload {
+  apiKey: EventApiKeyRef
+}
+export interface ApiKeyRotatedPayload {
+  apiKey: EventApiKeyRef
+}
+export interface ApiKeyRevokedPayload {
+  apiKey: EventApiKeyRef
+}
+export interface RoleCreatedPayload {
+  role: EventRoleRef
+}
+export interface RoleUpdatedPayload {
+  role: EventRoleRef
+  changedFields: string[]
+}
+export interface RoleDeletedPayload {
+  role: EventRoleRef
+}
+export interface RoleAssignmentCreatedPayload {
+  assignment: EventRoleAssignmentRef
+}
+export interface RoleAssignmentRevokedPayload {
+  assignment: EventRoleAssignmentRef
+}
+
+export interface ApiKeyCreatedEvent extends EventBase<'api_key.created'> {
+  data: ApiKeyCreatedPayload
+}
+export interface ApiKeyRotatedEvent extends EventBase<'api_key.rotated'> {
+  data: ApiKeyRotatedPayload
+}
+export interface ApiKeyRevokedEvent extends EventBase<'api_key.revoked'> {
+  data: ApiKeyRevokedPayload
+}
+export interface RoleCreatedEvent extends EventBase<'role.created'> {
+  data: RoleCreatedPayload
+}
+export interface RoleUpdatedEvent extends EventBase<'role.updated'> {
+  data: RoleUpdatedPayload
+}
+export interface RoleDeletedEvent extends EventBase<'role.deleted'> {
+  data: RoleDeletedPayload
+}
+export interface RoleAssignmentCreatedEvent extends EventBase<'role_assignment.created'> {
+  data: RoleAssignmentCreatedPayload
+}
+export interface RoleAssignmentRevokedEvent extends EventBase<'role_assignment.revoked'> {
+  data: RoleAssignmentRevokedPayload
+}
diff --git a/apps/web/src/lib/server/functions/__tests__/auth-helpers.diffcov.test.ts b/apps/web/src/lib/server/functions/__tests__/auth-helpers.diffcov.test.ts
new file mode 100644
index 000000000..127f26e6a
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/auth-helpers.diffcov.test.ts
@@ -0,0 +1,270 @@
+/**
+ * Differential-coverage tests for auth-helpers.
+ *
+ * Drives the real requireAuth / getOptionalAuth / requirePermission /
+ * requireAuthWithPermissions exports so that:
+ *   - readRequestContext parses cf-connecting-ip, x-forwarded-for fallback,
+ *     user-agent truncation, the all-null case, and the throwing catch path
+ *   - getOptionalAuth threads ipAddress/userAgent into its return value
+ *   - requirePermission resolves both the resource-scoped and unscoped checks,
+ *     allowing on success and throwing ForbiddenError on denial
+ *   - requireAuthWithPermissions returns the loaded permission set
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  mockGetSession: vi.fn(),
+  mockGetRequestHeaders: vi.fn(),
+  mockGetSettings: vi.fn(),
+  mockPrincipalFindFirst: vi.fn(),
+  mockInsertReturning: vi.fn(),
+  mockGenerateId: vi.fn(() => 'principal_generated'),
+  mockLoadPermissionSet: vi.fn(),
+  mockHasPermission: vi.fn(),
+  mockHasPermissionForResource: vi.fn(),
+  mockSegmentIdsForPrincipal: vi.fn(),
+}))
+
+vi.mock('@/lib/server/auth', () => ({
+  auth: {
+    api: {
+      getSession: hoisted.mockGetSession,
+    },
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequestHeaders: hoisted.mockGetRequestHeaders,
+}))
+
+vi.mock('../workspace', () => ({
+  getSettings: hoisted.mockGetSettings,
+}))
+
+vi.mock('@quackback/ids', () => ({
+  generateId: hoisted.mockGenerateId,
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      principal: { findFirst: hoisted.mockPrincipalFindFirst },
+    },
+    insert: () => ({
+      values: () => ({
+        returning: hoisted.mockInsertReturning,
+      }),
+    }),
+  },
+  principal: { userId: 'principal.userId' },
+  eq: vi.fn(() => 'eq'),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: hoisted.mockLoadPermissionSet,
+  hasPermission: hoisted.mockHasPermission,
+  hasPermissionForResource: hoisted.mockHasPermissionForResource,
+}))
+
+vi.mock('@/lib/server/domains/segments/segment-membership.service', () => ({
+  segmentIdsForPrincipal: hoisted.mockSegmentIdsForPrincipal,
+}))
+
+import {
+  requireAuth,
+  getOptionalAuth,
+  requirePermission,
+  requireAuthWithPermissions,
+} from '../auth-helpers'
+import { ForbiddenError } from '@/lib/shared/errors'
+
+const SESSION = {
+  user: { id: 'user_1', email: 'u@x.com', name: 'User', image: 'img.png' },
+}
+const SETTINGS = { id: 'ws_1', slug: 'main', name: 'Main', logoKey: 'logo.png' }
+const PRINCIPAL = { id: 'principal_1', role: 'admin', type: 'user' }
+
+/** Header map keyed for the Record-style index access readRequestContext uses. */
+function headers(map: Record<string, string | string[]>) {
+  return map as unknown as Headers
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockGetSession.mockResolvedValue(SESSION)
+  hoisted.mockGetSettings.mockResolvedValue(SETTINGS)
+  hoisted.mockPrincipalFindFirst.mockResolvedValue(PRINCIPAL)
+  hoisted.mockGetRequestHeaders.mockReturnValue(headers({}))
+})
+
+describe('requireAuth — readRequestContext header parsing', () => {
+  it('prefers cf-connecting-ip and truncates a long user-agent', async () => {
+    const longUa = 'a'.repeat(600)
+    hoisted.mockGetRequestHeaders.mockReturnValue(
+      headers({
+        'cf-connecting-ip': '203.0.113.7',
+        'x-forwarded-for': '198.51.100.1, 10.0.0.1',
+        'user-agent': longUa,
+      })
+    )
+
+    const ctx = await requireAuth()
+
+    expect(ctx.ipAddress).toBe('203.0.113.7')
+    expect(ctx.userAgent).toHaveLength(500)
+    expect(ctx.principal.id).toBe('principal_1')
+    expect(ctx.settings.logoKey).toBe('logo.png')
+  })
+
+  it('falls back to the first x-forwarded-for hop when cf header is absent', async () => {
+    hoisted.mockGetRequestHeaders.mockReturnValue(
+      headers({
+        'x-forwarded-for': '198.51.100.1, 10.0.0.1',
+        'user-agent': 'short-ua',
+      })
+    )
+
+    const ctx = await requireAuth()
+
+    expect(ctx.ipAddress).toBe('198.51.100.1')
+    expect(ctx.userAgent).toBe('short-ua')
+  })
+
+  it('handles array-valued headers by taking the first entry', async () => {
+    hoisted.mockGetRequestHeaders.mockReturnValue(
+      headers({
+        'cf-connecting-ip': ['192.0.2.5', '192.0.2.6'],
+        'user-agent': ['ua-one', 'ua-two'],
+      })
+    )
+
+    const ctx = await requireAuth()
+
+    expect(ctx.ipAddress).toBe('192.0.2.5')
+    expect(ctx.userAgent).toBe('ua-one')
+  })
+
+  it('returns null ip/ua when no relevant headers are present', async () => {
+    hoisted.mockGetRequestHeaders.mockReturnValue(headers({}))
+
+    const ctx = await requireAuth()
+
+    expect(ctx.ipAddress).toBeNull()
+    expect(ctx.userAgent).toBeNull()
+  })
+
+  it('falls back to null ip/ua when getRequestHeaders throws', async () => {
+    // First call (getSessionDirect) returns valid headers; the later call
+    // inside readRequestContext throws → the catch returns the null pair.
+    hoisted.mockGetRequestHeaders.mockReturnValueOnce(headers({})).mockImplementationOnce(() => {
+      throw new Error('headers unavailable')
+    })
+
+    const ctx = await requireAuth()
+
+    expect(ctx.ipAddress).toBeNull()
+    expect(ctx.userAgent).toBeNull()
+  })
+})
+
+describe('getOptionalAuth — request context + return shape', () => {
+  it('threads ip/ua into the returned context for an existing principal', async () => {
+    hoisted.mockGetRequestHeaders.mockReturnValue(
+      headers({ 'cf-connecting-ip': '203.0.113.9', 'user-agent': 'opt-ua' })
+    )
+
+    const ctx = await getOptionalAuth()
+
+    expect(ctx).not.toBeNull()
+    expect(ctx?.ipAddress).toBe('203.0.113.9')
+    expect(ctx?.userAgent).toBe('opt-ua')
+    expect(ctx?.principal.id).toBe('principal_1')
+    expect(ctx?.user.email).toBe('u@x.com')
+    expect(ctx?.source).toBe('web')
+  })
+
+  it('auto-creates a principal and still threads ip/ua on return', async () => {
+    hoisted.mockPrincipalFindFirst.mockResolvedValue(undefined)
+    hoisted.mockInsertReturning.mockResolvedValue([
+      { id: 'principal_generated', role: 'user', type: 'user' },
+    ])
+    hoisted.mockGetRequestHeaders.mockReturnValue(headers({ 'x-forwarded-for': '198.51.100.2' }))
+
+    const ctx = await getOptionalAuth()
+
+    expect(hoisted.mockGenerateId).toHaveBeenCalledWith('principal')
+    expect(ctx?.principal.id).toBe('principal_generated')
+    expect(ctx?.principal.role).toBe('user')
+    expect(ctx?.ipAddress).toBe('198.51.100.2')
+  })
+
+  it('returns null for an anonymous request', async () => {
+    hoisted.mockGetSession.mockResolvedValue(null)
+    const ctx = await getOptionalAuth()
+    expect(ctx).toBeNull()
+  })
+})
+
+describe('requirePermission', () => {
+  it('allows when an unscoped permission is held', async () => {
+    const set = { roleScopes: [] }
+    hoisted.mockLoadPermissionSet.mockResolvedValue(set)
+    hoisted.mockHasPermission.mockReturnValue(true)
+
+    const ctx = await requirePermission('ticket.reply.public' as never)
+
+    expect(hoisted.mockHasPermission).toHaveBeenCalledWith(set, 'ticket.reply.public')
+    expect(hoisted.mockHasPermissionForResource).not.toHaveBeenCalled()
+    expect(ctx.permissions).toBe(set)
+    expect(ctx.principal.id).toBe('principal_1')
+  })
+
+  it('evaluates the resource scope when a resource is supplied', async () => {
+    const set = { roleScopes: [] }
+    hoisted.mockLoadPermissionSet.mockResolvedValue(set)
+    hoisted.mockHasPermissionForResource.mockReturnValue(true)
+
+    const ctx = await requirePermission(
+      'ticket.reply.public' as never,
+      {
+        primaryTeamId: 'team_1',
+      } as never
+    )
+
+    expect(hoisted.mockHasPermissionForResource).toHaveBeenCalledWith(set, 'ticket.reply.public', {
+      primaryTeamId: 'team_1',
+    })
+    expect(hoisted.mockHasPermission).not.toHaveBeenCalled()
+    expect(ctx.permissions).toBe(set)
+  })
+
+  it('throws ForbiddenError when the permission is missing', async () => {
+    hoisted.mockLoadPermissionSet.mockResolvedValue({ roleScopes: [] })
+    hoisted.mockHasPermission.mockReturnValue(false)
+
+    await expect(requirePermission('ticket.delete' as never)).rejects.toBeInstanceOf(ForbiddenError)
+  })
+
+  it('throws ForbiddenError when the resource-scoped permission is denied', async () => {
+    hoisted.mockLoadPermissionSet.mockResolvedValue({ roleScopes: [] })
+    hoisted.mockHasPermissionForResource.mockReturnValue(false)
+
+    await expect(
+      requirePermission('ticket.delete' as never, { primaryTeamId: 'team_x' } as never)
+    ).rejects.toBeInstanceOf(ForbiddenError)
+  })
+})
+
+describe('requireAuthWithPermissions', () => {
+  it('returns the auth context plus the loaded permission set without enforcing', async () => {
+    const set = { roleScopes: ['x'] }
+    hoisted.mockLoadPermissionSet.mockResolvedValue(set)
+
+    const ctx = await requireAuthWithPermissions()
+
+    expect(hoisted.mockLoadPermissionSet).toHaveBeenCalledWith('principal_1')
+    expect(hoisted.mockHasPermission).not.toHaveBeenCalled()
+    expect(ctx.permissions).toBe(set)
+    expect(ctx.principal.role).toBe('admin')
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/authz.test.ts b/apps/web/src/lib/server/functions/__tests__/authz.test.ts
new file mode 100644
index 000000000..54745b132
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/authz.test.ts
@@ -0,0 +1,79 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+type AnyHandler = () => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    handler(fn: AnyHandler) {
+      handlersByIndex.push(fn)
+      return fn
+    },
+  }),
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequireAuth: vi.fn(),
+  mockLoadPermissionSet: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requireAuth: (...args: unknown[]) => hoisted.mockRequireAuth(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.mockLoadPermissionSet(...args),
+}))
+
+await import('../authz')
+
+const [getMyPermissionsFn] = handlersByIndex
+
+if (!getMyPermissionsFn) {
+  throw new Error(`authz handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequireAuth.mockResolvedValue({
+    principal: { id: 'principal_admin' },
+  })
+  hoisted.mockLoadPermissionSet.mockResolvedValue({
+    principalId: 'principal_admin',
+    workspacePermissions: new Set([PERMISSIONS.ADMIN_MANAGE_ROLES]),
+    teamPermissions: new Map([
+      ['team_support', new Set([PERMISSIONS.TICKET_VIEW_TEAM, PERMISSIONS.TICKET_REPLY_PUBLIC])],
+    ]),
+    teamIds: new Set(['team_support']),
+  })
+})
+
+describe('getMyPermissionsFn', () => {
+  it('serializes the current principal permission set for client permission gates', async () => {
+    const result = await getMyPermissionsFn()
+
+    expect(result).toEqual({
+      principalId: 'principal_admin',
+      workspacePermissions: [PERMISSIONS.ADMIN_MANAGE_ROLES],
+      teamPermissions: [
+        {
+          teamId: 'team_support',
+          permissions: [PERMISSIONS.TICKET_VIEW_TEAM, PERMISSIONS.TICKET_REPLY_PUBLIC],
+        },
+      ],
+      teamIds: ['team_support'],
+    })
+    expect(hoisted.mockRequireAuth).toHaveBeenCalledWith({ roles: ['admin', 'member', 'user'] })
+    expect(hoisted.mockLoadPermissionSet).toHaveBeenCalledWith('principal_admin')
+  })
+
+  it('does not load permissions when authentication fails', async () => {
+    hoisted.mockRequireAuth.mockRejectedValueOnce(new Error('login required'))
+
+    await expect(getMyPermissionsFn()).rejects.toThrow('login required')
+
+    expect(hoisted.mockLoadPermissionSet).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/contacts.test.ts b/apps/web/src/lib/server/functions/__tests__/contacts.test.ts
new file mode 100644
index 000000000..4ffb47223
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/contacts.test.ts
@@ -0,0 +1,255 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequirePermission: vi.fn(),
+  mockCreateContact: vi.fn(),
+  mockUpdateContact: vi.fn(),
+  mockArchiveContact: vi.fn(),
+  mockGetContact: vi.fn(),
+  mockListContactsForOrganization: vi.fn(),
+  mockSearchContacts: vi.fn(),
+  mockLinkContactToUser: vi.fn(),
+  mockUnlinkContactFromUser: vi.fn(),
+  mockListLinksForContact: vi.fn(),
+  mockRecordEvent: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requirePermission: (...args: unknown[]) => hoisted.mockRequirePermission(...args),
+}))
+
+vi.mock('@/lib/server/domains/organizations', () => ({
+  createContact: (...args: unknown[]) => hoisted.mockCreateContact(...args),
+  updateContact: (...args: unknown[]) => hoisted.mockUpdateContact(...args),
+  archiveContact: (...args: unknown[]) => hoisted.mockArchiveContact(...args),
+  getContact: (...args: unknown[]) => hoisted.mockGetContact(...args),
+  listContactsForOrganization: (...args: unknown[]) =>
+    hoisted.mockListContactsForOrganization(...args),
+  searchContacts: (...args: unknown[]) => hoisted.mockSearchContacts(...args),
+  linkContactToUser: (...args: unknown[]) => hoisted.mockLinkContactToUser(...args),
+  unlinkContactFromUser: (...args: unknown[]) => hoisted.mockUnlinkContactFromUser(...args),
+  listLinksForContact: (...args: unknown[]) => hoisted.mockListLinksForContact(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.mockRecordEvent(...args),
+}))
+
+await import('../contacts')
+
+const [
+  searchContactsFn,
+  listContactsForOrganizationFn,
+  getContactFn,
+  createContactFn,
+  updateContactFn,
+  archiveContactFn,
+  linkContactToUserFn,
+  unlinkContactFromUserFn,
+  listLinksForContactFn,
+] = handlersByIndex
+
+if (!listLinksForContactFn) {
+  throw new Error(`contacts handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+const ctx = {
+  principal: { id: 'principal_admin' },
+  user: { id: 'user_admin' },
+}
+
+function contact(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'contact_123',
+    name: 'Ada Lovelace',
+    email: 'ada@example.com',
+    organizationId: 'org_123',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequirePermission.mockResolvedValue(ctx)
+  hoisted.mockSearchContacts.mockResolvedValue([contact()])
+  hoisted.mockListContactsForOrganization.mockResolvedValue([contact()])
+  hoisted.mockGetContact.mockResolvedValue(contact({ name: 'Before' }))
+  hoisted.mockCreateContact.mockResolvedValue(contact({ name: 'Created' }))
+  hoisted.mockUpdateContact.mockResolvedValue(contact({ name: 'Updated' }))
+  hoisted.mockArchiveContact.mockResolvedValue(undefined)
+  hoisted.mockLinkContactToUser.mockResolvedValue({ contactId: 'contact_123', userId: 'user_123' })
+  hoisted.mockUnlinkContactFromUser.mockResolvedValue(undefined)
+  hoisted.mockListLinksForContact.mockResolvedValue([{ userId: 'user_123' }])
+  hoisted.mockRecordEvent.mockResolvedValue(undefined)
+})
+
+describe('contact server functions', () => {
+  it('runs read functions behind org.view and passes filters to the organization domain', async () => {
+    await expect(
+      searchContactsFn({
+        data: {
+          query: 'ada',
+          email: 'ada@example.com',
+          organizationId: 'org_123',
+          includeArchived: true,
+          limit: 25,
+          offset: 5,
+        },
+      })
+    ).resolves.toEqual([contact()])
+    expect(hoisted.mockSearchContacts).toHaveBeenCalledWith({
+      query: 'ada',
+      email: 'ada@example.com',
+      organizationId: 'org_123',
+      includeArchived: true,
+      limit: 25,
+      offset: 5,
+    })
+
+    await expect(
+      listContactsForOrganizationFn({
+        data: { organizationId: 'org_123', includeArchived: false, limit: 10, offset: 0 },
+      })
+    ).resolves.toEqual([contact()])
+    expect(hoisted.mockListContactsForOrganization).toHaveBeenCalledWith('org_123', {
+      includeArchived: false,
+      limit: 10,
+      offset: 0,
+    })
+
+    await expect(getContactFn({ data: { contactId: 'contact_123' } })).resolves.toEqual(
+      contact({ name: 'Before' })
+    )
+    await expect(listLinksForContactFn({ data: { contactId: 'contact_123' } })).resolves.toEqual([
+      { userId: 'user_123' },
+    ])
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.ORG_VIEW)
+  })
+
+  it('creates, updates, and archives contacts behind org.manage with audit events', async () => {
+    const createResult = await createContactFn({
+      data: {
+        name: 'Created',
+        email: 'created@example.com',
+        organizationId: 'org_123',
+      },
+    })
+    expect(createResult).toEqual(contact({ name: 'Created' }))
+    expect(hoisted.mockCreateContact).toHaveBeenCalledWith(
+      {
+        name: 'Created',
+        email: 'created@example.com',
+        organizationId: 'org_123',
+      },
+      { principalId: 'principal_admin', userId: 'user_admin' }
+    )
+
+    const updateResult = await updateContactFn({
+      data: { contactId: 'contact_123', name: 'Updated', email: 'updated@example.com' },
+    })
+    expect(updateResult).toEqual(contact({ name: 'Updated' }))
+    expect(hoisted.mockUpdateContact).toHaveBeenCalledWith(
+      'contact_123',
+      { name: 'Updated', email: 'updated@example.com' },
+      { principalId: 'principal_admin', userId: 'user_admin' }
+    )
+
+    await expect(archiveContactFn({ data: { contactId: 'contact_123' } })).resolves.toEqual({
+      ok: true,
+    })
+    expect(hoisted.mockArchiveContact).toHaveBeenCalledWith('contact_123', {
+      principalId: 'principal_admin',
+      userId: 'user_admin',
+    })
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'contact.created', targetId: 'contact_123' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'contact.updated', targetId: 'contact_123' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'contact.archived', targetId: 'contact_123' })
+    )
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.ORG_MANAGE)
+  })
+
+  it('records an update audit event with no before diff when the contact did not exist', async () => {
+    hoisted.mockGetContact.mockResolvedValueOnce(null)
+
+    await updateContactFn({
+      data: { contactId: 'contact_123', name: 'Updated' },
+    })
+
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'contact.updated',
+        diff: expect.objectContaining({ before: undefined }),
+      })
+    )
+  })
+
+  it('links and unlinks users with contact audit context', async () => {
+    await expect(
+      linkContactToUserFn({ data: { contactId: 'contact_123', userId: 'user_123' } })
+    ).resolves.toEqual({ contactId: 'contact_123', userId: 'user_123' })
+    expect(hoisted.mockLinkContactToUser).toHaveBeenCalledWith(
+      {
+        contactId: 'contact_123',
+        userId: 'user_123',
+        linkedByPrincipalId: 'principal_admin',
+      },
+      { principalId: 'principal_admin', userId: 'user_admin' }
+    )
+
+    await expect(
+      unlinkContactFromUserFn({ data: { contactId: 'contact_123', userId: 'user_123' } })
+    ).resolves.toEqual({ ok: true })
+    expect(hoisted.mockUnlinkContactFromUser).toHaveBeenCalledWith('contact_123', 'user_123', {
+      principalId: 'principal_admin',
+      userId: 'user_admin',
+    })
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'contact.linked_user',
+        diff: { context: { userId: 'user_123' } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'contact.unlinked_user',
+        diff: { context: { userId: 'user_123' } },
+      })
+    )
+  })
+
+  it('does not call the organization domain when permission is denied', async () => {
+    hoisted.mockRequirePermission.mockRejectedValueOnce(new Error('org.view required'))
+
+    await expect(searchContactsFn({ data: {} })).rejects.toThrow('org.view required')
+
+    expect(hoisted.mockSearchContacts).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/force-signout.test.ts b/apps/web/src/lib/server/functions/__tests__/force-signout.test.ts
index 5363560e2..c7512879a 100644
--- a/apps/web/src/lib/server/functions/__tests__/force-signout.test.ts
+++ b/apps/web/src/lib/server/functions/__tests__/force-signout.test.ts
@@ -39,6 +39,12 @@ vi.mock('@tanstack/react-start', () => ({
       validator() {
         return chain
       },
+      // Newer createServerFn chains use inputValidator() in place of/alongside
+      // validator(); support both so the chain resolves regardless of which the
+      // server fn under test uses.
+      inputValidator() {
+        return chain
+      },
       handler(fn: AnyHandler) {
         chain._handler = fn
         return chain
diff --git a/apps/web/src/lib/server/functions/__tests__/inboxes.test.ts b/apps/web/src/lib/server/functions/__tests__/inboxes.test.ts
new file mode 100644
index 000000000..94646654c
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/inboxes.test.ts
@@ -0,0 +1,415 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { InboxChannelId, InboxId, InboxMembershipId, PrincipalId } from '@quackback/ids'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequirePermission: vi.fn(),
+  mockRecordEvent: vi.fn(),
+  mockCreateInbox: vi.fn(),
+  mockUpdateInbox: vi.fn(),
+  mockArchiveInbox: vi.fn(),
+  mockUnarchiveInbox: vi.fn(),
+  mockGetInbox: vi.fn(),
+  mockListInboxes: vi.fn(),
+  mockAddInboxMembership: vi.fn(),
+  mockUpdateInboxMembershipRole: vi.fn(),
+  mockRemoveInboxMembership: vi.fn(),
+  mockListMembershipsForInbox: vi.fn(),
+  mockListInboxRowsForPrincipal: vi.fn(),
+  mockAddInboxChannel: vi.fn(),
+  mockUpdateInboxChannel: vi.fn(),
+  mockArchiveInboxChannel: vi.fn(),
+  mockListChannelsForInbox: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requirePermission: (...args: unknown[]) => hoisted.mockRequirePermission(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.mockRecordEvent(...args),
+}))
+
+vi.mock('@/lib/server/domains/inboxes', () => ({
+  createInbox: (...args: unknown[]) => hoisted.mockCreateInbox(...args),
+  updateInbox: (...args: unknown[]) => hoisted.mockUpdateInbox(...args),
+  archiveInbox: (...args: unknown[]) => hoisted.mockArchiveInbox(...args),
+  unarchiveInbox: (...args: unknown[]) => hoisted.mockUnarchiveInbox(...args),
+  getInbox: (...args: unknown[]) => hoisted.mockGetInbox(...args),
+  listInboxes: (...args: unknown[]) => hoisted.mockListInboxes(...args),
+  addInboxMembership: (...args: unknown[]) => hoisted.mockAddInboxMembership(...args),
+  updateInboxMembershipRole: (...args: unknown[]) => hoisted.mockUpdateInboxMembershipRole(...args),
+  removeInboxMembership: (...args: unknown[]) => hoisted.mockRemoveInboxMembership(...args),
+  listMembershipsForInbox: (...args: unknown[]) => hoisted.mockListMembershipsForInbox(...args),
+  listInboxRowsForPrincipal: (...args: unknown[]) => hoisted.mockListInboxRowsForPrincipal(...args),
+  addInboxChannel: (...args: unknown[]) => hoisted.mockAddInboxChannel(...args),
+  updateInboxChannel: (...args: unknown[]) => hoisted.mockUpdateInboxChannel(...args),
+  archiveInboxChannel: (...args: unknown[]) => hoisted.mockArchiveInboxChannel(...args),
+  listChannelsForInbox: (...args: unknown[]) => hoisted.mockListChannelsForInbox(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  INBOX_CHANNEL_KINDS: ['email', 'widget', 'api'],
+  INBOX_MEMBERSHIP_ROLES: ['owner', 'member', 'viewer'],
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  TICKET_VISIBILITY_SCOPES: ['workspace', 'team', 'private'],
+}))
+
+const PRINCIPAL = 'principal_admin' as PrincipalId
+const AGENT = 'principal_agent' as PrincipalId
+const INBOX = 'inbox_123' as InboxId
+const CHANNEL = 'inbox_channel_123' as InboxChannelId
+const MEMBERSHIP = 'inbox_membership_123' as InboxMembershipId
+
+await import('../inboxes')
+
+const [
+  listInboxesFn,
+  getInboxFn,
+  createInboxFn,
+  updateInboxFn,
+  archiveInboxFn,
+  unarchiveInboxFn,
+  listInboxChannelsFn,
+  addInboxChannelFn,
+  updateInboxChannelFn,
+  archiveInboxChannelFn,
+  listInboxMembershipsFn,
+  listMyInboxesFn,
+  addInboxMembershipFn,
+  updateInboxMembershipRoleFn,
+  removeInboxMembershipFn,
+] = handlersByIndex
+
+if (!removeInboxMembershipFn) {
+  throw new Error(`Inbox handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+function inbox(overrides: Record<string, unknown> = {}) {
+  return {
+    id: INBOX,
+    slug: 'support',
+    name: 'Support',
+    description: null,
+    defaultPriority: 'normal',
+    defaultVisibilityScope: 'workspace',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function channel(overrides: Record<string, unknown> = {}) {
+  return {
+    id: CHANNEL,
+    inboxId: INBOX,
+    kind: 'email',
+    label: 'Support email',
+    config: {},
+    externalId: null,
+    enabled: true,
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function membership(overrides: Record<string, unknown> = {}) {
+  return {
+    id: MEMBERSHIP,
+    inboxId: INBOX,
+    principalId: AGENT,
+    role: 'member',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequirePermission.mockResolvedValue({
+    principal: { id: PRINCIPAL, role: 'admin' },
+  })
+  hoisted.mockRecordEvent.mockResolvedValue(undefined)
+})
+
+describe('inbox server functions', () => {
+  it('lists, fetches, and returns current-principal inboxes with view permission', async () => {
+    const row = inbox()
+    const rowsForPrincipal = [{ inboxId: INBOX, role: 'owner' }]
+    hoisted.mockListInboxes.mockResolvedValue([row])
+    hoisted.mockGetInbox.mockResolvedValue(row)
+    hoisted.mockListInboxRowsForPrincipal.mockResolvedValue(rowsForPrincipal)
+
+    await expect(listInboxesFn({ data: { includeArchived: true } })).resolves.toEqual([row])
+    await expect(getInboxFn({ data: { inboxId: INBOX } })).resolves.toBe(row)
+    await expect(listMyInboxesFn({ data: {} })).resolves.toEqual(rowsForPrincipal)
+
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.INBOX_VIEW)
+    expect(hoisted.mockListInboxes).toHaveBeenCalledWith({ includeArchived: true })
+    expect(hoisted.mockGetInbox).toHaveBeenCalledWith(INBOX)
+    expect(hoisted.mockListInboxRowsForPrincipal).toHaveBeenCalledWith(PRINCIPAL)
+  })
+
+  it('creates, updates, archives, and unarchives inboxes with audit events', async () => {
+    const created = inbox({ name: 'Escalations' })
+    const updated = inbox({ name: 'Priority support' })
+    hoisted.mockCreateInbox.mockResolvedValue(created)
+    hoisted.mockUpdateInbox.mockResolvedValue(updated)
+    hoisted.mockArchiveInbox.mockResolvedValue(updated)
+    hoisted.mockUnarchiveInbox.mockResolvedValue(updated)
+
+    await expect(
+      createInboxFn({
+        data: {
+          slug: 'escalations',
+          name: 'Escalations',
+          description: 'Urgent support',
+          primaryTeamId: 'team_support',
+          defaultVisibilityScope: 'team',
+          defaultPriority: 'urgent',
+          defaultStatusId: 'status_open',
+          color: '#ff0000',
+          icon: 'siren',
+        },
+      })
+    ).resolves.toBe(created)
+    expect(hoisted.mockCreateInbox).toHaveBeenCalledWith(
+      {
+        slug: 'escalations',
+        name: 'Escalations',
+        description: 'Urgent support',
+        primaryTeamId: 'team_support',
+        defaultVisibilityScope: 'team',
+        defaultPriority: 'urgent',
+        defaultStatusId: 'status_open',
+        color: '#ff0000',
+        icon: 'siren',
+      },
+      { principalId: PRINCIPAL }
+    )
+
+    await expect(
+      updateInboxFn({
+        data: {
+          inboxId: INBOX,
+          name: 'Priority support',
+          primaryTeamId: null,
+          defaultStatusId: null,
+          color: null,
+        },
+      })
+    ).resolves.toBe(updated)
+    expect(hoisted.mockUpdateInbox).toHaveBeenCalledWith(
+      INBOX,
+      {
+        name: 'Priority support',
+        primaryTeamId: null,
+        defaultStatusId: null,
+        color: null,
+      },
+      { principalId: PRINCIPAL }
+    )
+
+    await expect(archiveInboxFn({ data: { inboxId: INBOX } })).resolves.toBe(updated)
+    await expect(unarchiveInboxFn({ data: { inboxId: INBOX } })).resolves.toBe(updated)
+
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.INBOX_MANAGE)
+    expect(hoisted.mockArchiveInbox).toHaveBeenCalledWith(INBOX, { principalId: PRINCIPAL })
+    expect(hoisted.mockUnarchiveInbox).toHaveBeenCalledWith(INBOX, { principalId: PRINCIPAL })
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principalId: PRINCIPAL,
+        action: 'inbox.created',
+        targetType: 'inbox',
+        targetId: INBOX,
+        diff: { after: { slug: 'support', name: 'Escalations' } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principalId: PRINCIPAL,
+        action: 'inbox.updated',
+        targetId: INBOX,
+        diff: {
+          after: {
+            name: 'Priority support',
+            primaryTeamId: null,
+            defaultStatusId: null,
+            color: null,
+          },
+        },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'inbox.archived', targetId: INBOX })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'inbox.unarchived', targetId: INBOX })
+    )
+  })
+
+  it('stops inbox writes before domain calls when manage permission is denied', async () => {
+    hoisted.mockRequirePermission.mockRejectedValueOnce(new Error('permission denied'))
+
+    await expect(createInboxFn({ data: { slug: 'support', name: 'Support' } })).rejects.toThrow(
+      'permission denied'
+    )
+
+    expect(hoisted.mockCreateInbox).not.toHaveBeenCalled()
+    expect(hoisted.mockRecordEvent).not.toHaveBeenCalled()
+  })
+
+  it('lists and mutates inbox channels with channel-manage audit events', async () => {
+    const row = channel()
+    const updated = channel({ label: 'Renamed channel', enabled: false })
+    hoisted.mockListChannelsForInbox.mockResolvedValue([row])
+    hoisted.mockAddInboxChannel.mockResolvedValue(row)
+    hoisted.mockUpdateInboxChannel.mockResolvedValue(updated)
+    hoisted.mockArchiveInboxChannel.mockResolvedValue(updated)
+
+    await expect(listInboxChannelsFn({ data: { inboxId: INBOX } })).resolves.toEqual([row])
+    expect(hoisted.mockListChannelsForInbox).toHaveBeenCalledWith(INBOX)
+
+    await expect(
+      addInboxChannelFn({
+        data: {
+          inboxId: INBOX,
+          kind: 'email',
+          label: 'Support email',
+          config: { address: 'support@example.com' },
+          externalId: 'support@example.com',
+          enabled: true,
+        },
+      })
+    ).resolves.toBe(row)
+    expect(hoisted.mockAddInboxChannel).toHaveBeenCalledWith({
+      inboxId: INBOX,
+      kind: 'email',
+      label: 'Support email',
+      config: { address: 'support@example.com' },
+      externalId: 'support@example.com',
+      enabled: true,
+    })
+
+    await expect(
+      updateInboxChannelFn({
+        data: {
+          channelId: CHANNEL,
+          label: 'Renamed channel',
+          config: { address: 'vip@example.com' },
+          externalId: null,
+          enabled: false,
+        },
+      })
+    ).resolves.toBe(updated)
+    expect(hoisted.mockUpdateInboxChannel).toHaveBeenCalledWith(CHANNEL, {
+      label: 'Renamed channel',
+      config: { address: 'vip@example.com' },
+      externalId: null,
+      enabled: false,
+    })
+
+    await expect(archiveInboxChannelFn({ data: { channelId: CHANNEL } })).resolves.toBe(updated)
+    expect(hoisted.mockArchiveInboxChannel).toHaveBeenCalledWith(CHANNEL)
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.INBOX_CHANNEL_MANAGE)
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'inbox_channel.added',
+        targetType: 'inbox_channel',
+        targetId: CHANNEL,
+        diff: { after: { inboxId: INBOX, kind: 'email' } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'inbox_channel.updated',
+        targetId: CHANNEL,
+        diff: {
+          after: {
+            label: 'Renamed channel',
+            config: { address: 'vip@example.com' },
+            externalId: null,
+            enabled: false,
+          },
+        },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'inbox_channel.archived', targetId: CHANNEL })
+    )
+  })
+
+  it('lists and mutates memberships with manage permission and audit events', async () => {
+    const row = membership()
+    const updated = membership({ role: 'owner' })
+    hoisted.mockListMembershipsForInbox.mockResolvedValue([row])
+    hoisted.mockAddInboxMembership.mockResolvedValue(row)
+    hoisted.mockUpdateInboxMembershipRole.mockResolvedValue(updated)
+    hoisted.mockRemoveInboxMembership.mockResolvedValue(undefined)
+
+    await expect(listInboxMembershipsFn({ data: { inboxId: INBOX } })).resolves.toEqual([row])
+    expect(hoisted.mockListMembershipsForInbox).toHaveBeenCalledWith(INBOX)
+
+    await expect(
+      addInboxMembershipFn({ data: { inboxId: INBOX, principalId: AGENT, role: 'member' } })
+    ).resolves.toBe(row)
+    expect(hoisted.mockAddInboxMembership).toHaveBeenCalledWith({
+      inboxId: INBOX,
+      principalId: AGENT,
+      role: 'member',
+    })
+
+    await expect(
+      updateInboxMembershipRoleFn({ data: { membershipId: MEMBERSHIP, role: 'owner' } })
+    ).resolves.toBe(updated)
+    expect(hoisted.mockUpdateInboxMembershipRole).toHaveBeenCalledWith(MEMBERSHIP, 'owner')
+
+    await expect(removeInboxMembershipFn({ data: { membershipId: MEMBERSHIP } })).resolves.toEqual({
+      ok: true,
+    })
+    expect(hoisted.mockRemoveInboxMembership).toHaveBeenCalledWith(MEMBERSHIP)
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'inbox.membership_added',
+        targetType: 'inbox',
+        targetId: INBOX,
+        diff: { after: { principalId: AGENT, role: 'member' } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'inbox.membership_updated',
+        targetType: 'inbox',
+        targetId: INBOX,
+        diff: { after: { role: 'owner' } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'inbox.membership_removed',
+        targetType: 'inbox_membership',
+        targetId: MEMBERSHIP,
+      })
+    )
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/notifications.diffcov.test.ts b/apps/web/src/lib/server/functions/__tests__/notifications.diffcov.test.ts
new file mode 100644
index 000000000..fe55238f9
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/notifications.diffcov.test.ts
@@ -0,0 +1,163 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { PrincipalId, TicketId } from '@quackback/ids'
+import { ForbiddenError, NotFoundError } from '@/lib/shared/errors'
+
+type HandlerArgs = { data: Record<string, unknown> }
+type AnyHandler = (args: HandlerArgs) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequireAuth: vi.fn(),
+  mockGetTicket: vi.fn(),
+  mockListSharesForTicket: vi.fn(),
+  mockToResourceScope: vi.fn(),
+  mockCanViewTicket: vi.fn(),
+  mockLoadPermissionSet: vi.fn(),
+  mockSubscribeToTicket: vi.fn(),
+}))
+
+vi.mock('../auth-helpers', () => ({
+  requireAuth: hoisted.mockRequireAuth,
+  policyActorFromAuth: vi.fn(),
+}))
+
+vi.mock('@/lib/server/domains/notifications/notification.service', () => ({
+  getNotificationsForMember: vi.fn(),
+  getUnreadCount: vi.fn(),
+  markAsRead: vi.fn(),
+  markAllAsRead: vi.fn(),
+  archiveNotification: vi.fn(),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.subscriptions', () => ({
+  subscribeToTicket: hoisted.mockSubscribeToTicket,
+  unsubscribeFromTicket: vi.fn(),
+  updateSubscriptionPrefs: vi.fn(),
+  muteTicket: vi.fn(),
+  unmuteTicket: vi.fn(),
+  listSubscribersForTicket: vi.fn(),
+  getSubscription: vi.fn(),
+  listSubscriptionsForPrincipalWithTickets: vi.fn(),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.service', () => ({
+  getTicket: hoisted.mockGetTicket,
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.share', () => ({
+  listSharesForTicket: hoisted.mockListSharesForTicket,
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.permissions', () => ({
+  canViewTicket: hoisted.mockCanViewTicket,
+  toResourceScope: hoisted.mockToResourceScope,
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: hoisted.mockLoadPermissionSet,
+}))
+
+vi.mock('@/lib/shared/utils', () => ({
+  toIsoString: (d: Date | string) => (typeof d === 'string' ? d : (d as Date).toISOString()),
+  toIsoStringOrNull: (d: Date | string | null | undefined) =>
+    d == null ? null : typeof d === 'string' ? d : (d as Date).toISOString(),
+}))
+
+const PRINCIPAL = 'principal_1' as PrincipalId
+const TICKET = 'ticket_1' as TicketId
+
+// subscribeToTicketFn is the first ticket-subscription fn; preceding handlers
+// are the 5 notification fns (get, unread, markRead, markAll, archive).
+const SUBSCRIBE_TO_TICKET = 5
+let subscribeToTicketHandler: AnyHandler
+
+beforeEach(async () => {
+  vi.clearAllMocks()
+  if (handlersByIndex.length === 0) {
+    await import('../notifications')
+  }
+  subscribeToTicketHandler = handlersByIndex[SUBSCRIBE_TO_TICKET]
+  hoisted.mockRequireAuth.mockResolvedValue({ principal: { id: PRINCIPAL, role: 'member' } })
+})
+
+describe('assertCanViewTicket (via subscribeToTicketFn)', () => {
+  it('throws NotFoundError when the ticket does not exist', async () => {
+    hoisted.mockGetTicket.mockResolvedValue(null)
+
+    await expect(subscribeToTicketHandler({ data: { ticketId: TICKET } })).rejects.toBeInstanceOf(
+      NotFoundError
+    )
+    expect(hoisted.mockListSharesForTicket).not.toHaveBeenCalled()
+    expect(hoisted.mockSubscribeToTicket).not.toHaveBeenCalled()
+  })
+
+  it('throws ForbiddenError when the ticket is visible but the principal lacks view permission', async () => {
+    hoisted.mockGetTicket.mockResolvedValue({
+      primaryTeamId: 'team_1',
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+    })
+    hoisted.mockListSharesForTicket.mockResolvedValue([{ teamId: 'team_2', revokedAt: null }])
+    hoisted.mockToResourceScope.mockReturnValue({ scope: 'resolved' })
+    hoisted.mockLoadPermissionSet.mockResolvedValue({ permissions: [] })
+    hoisted.mockCanViewTicket.mockReturnValue(false)
+
+    await expect(subscribeToTicketHandler({ data: { ticketId: TICKET } })).rejects.toBeInstanceOf(
+      ForbiddenError
+    )
+
+    // The scope must be built from the ticket + its (mapped) shares.
+    expect(hoisted.mockToResourceScope).toHaveBeenCalledWith(
+      expect.objectContaining({
+        primaryTeamId: 'team_1',
+        shares: [{ teamId: 'team_2', revokedAt: null }],
+      })
+    )
+    expect(hoisted.mockLoadPermissionSet).toHaveBeenCalledWith(PRINCIPAL)
+    expect(hoisted.mockSubscribeToTicket).not.toHaveBeenCalled()
+  })
+
+  it('proceeds to subscribe when the principal can view the ticket', async () => {
+    hoisted.mockGetTicket.mockResolvedValue({
+      primaryTeamId: 'team_1',
+      assigneePrincipalId: PRINCIPAL,
+      assigneeTeamId: 'team_1',
+    })
+    hoisted.mockListSharesForTicket.mockResolvedValue([])
+    hoisted.mockToResourceScope.mockReturnValue({ scope: 'resolved' })
+    hoisted.mockLoadPermissionSet.mockResolvedValue({ permissions: ['view'] })
+    hoisted.mockCanViewTicket.mockReturnValue(true)
+    hoisted.mockSubscribeToTicket.mockResolvedValue({ id: 'sub_1', source: 'manual' })
+
+    const result = (await subscribeToTicketHandler({
+      data: { ticketId: TICKET, prefs: { notifyThreads: true } },
+    })) as { id: string; source: string }
+
+    expect(result).toEqual({ id: 'sub_1', source: 'manual' })
+    expect(hoisted.mockSubscribeToTicket).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      principalId: PRINCIPAL,
+      source: 'manual',
+      prefs: { notifyThreads: true },
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/organizations.test.ts b/apps/web/src/lib/server/functions/__tests__/organizations.test.ts
new file mode 100644
index 000000000..b4ea7f32a
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/organizations.test.ts
@@ -0,0 +1,184 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequirePermission: vi.fn(),
+  mockCreateOrganization: vi.fn(),
+  mockUpdateOrganization: vi.fn(),
+  mockArchiveOrganization: vi.fn(),
+  mockUnarchiveOrganization: vi.fn(),
+  mockGetOrganization: vi.fn(),
+  mockListOrganizations: vi.fn(),
+  mockRecordEvent: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requirePermission: (...args: unknown[]) => hoisted.mockRequirePermission(...args),
+}))
+
+vi.mock('@/lib/server/domains/organizations', () => ({
+  createOrganization: (...args: unknown[]) => hoisted.mockCreateOrganization(...args),
+  updateOrganization: (...args: unknown[]) => hoisted.mockUpdateOrganization(...args),
+  archiveOrganization: (...args: unknown[]) => hoisted.mockArchiveOrganization(...args),
+  unarchiveOrganization: (...args: unknown[]) => hoisted.mockUnarchiveOrganization(...args),
+  getOrganization: (...args: unknown[]) => hoisted.mockGetOrganization(...args),
+  listOrganizations: (...args: unknown[]) => hoisted.mockListOrganizations(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.mockRecordEvent(...args),
+}))
+
+await import('../organizations')
+
+const [
+  listOrganizationsFn,
+  getOrganizationFn,
+  createOrganizationFn,
+  updateOrganizationFn,
+  archiveOrganizationFn,
+  unarchiveOrganizationFn,
+] = handlersByIndex
+
+if (!unarchiveOrganizationFn) {
+  throw new Error(`organization handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+const ctx = {
+  principal: { id: 'principal_admin' },
+  user: { id: 'user_admin' },
+}
+
+function org(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'org_123',
+    name: 'Acme',
+    domain: 'acme.example',
+    website: 'https://acme.example',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequirePermission.mockResolvedValue(ctx)
+  hoisted.mockListOrganizations.mockResolvedValue([org()])
+  hoisted.mockGetOrganization.mockResolvedValue(org({ name: 'Before' }))
+  hoisted.mockCreateOrganization.mockResolvedValue(org({ name: 'Created' }))
+  hoisted.mockUpdateOrganization.mockResolvedValue(org({ name: 'Updated' }))
+  hoisted.mockArchiveOrganization.mockResolvedValue(undefined)
+  hoisted.mockUnarchiveOrganization.mockResolvedValue(undefined)
+  hoisted.mockRecordEvent.mockResolvedValue(undefined)
+})
+
+describe('organization server functions', () => {
+  it('runs read functions behind org.view and passes list filters through', async () => {
+    await expect(
+      listOrganizationsFn({
+        data: { search: 'acme', includeArchived: true, limit: 50, offset: 10 },
+      })
+    ).resolves.toEqual([org()])
+    expect(hoisted.mockListOrganizations).toHaveBeenCalledWith({
+      search: 'acme',
+      includeArchived: true,
+      limit: 50,
+      offset: 10,
+    })
+
+    await expect(getOrganizationFn({ data: { organizationId: 'org_123' } })).resolves.toEqual(
+      org({ name: 'Before' })
+    )
+    expect(hoisted.mockGetOrganization).toHaveBeenCalledWith('org_123')
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.ORG_VIEW)
+  })
+
+  it('creates, updates, archives, and unarchives organizations with audit events', async () => {
+    await expect(
+      createOrganizationFn({
+        data: { name: 'Created', domain: 'created.example', website: 'https://created.example' },
+      })
+    ).resolves.toEqual(org({ name: 'Created' }))
+    expect(hoisted.mockCreateOrganization).toHaveBeenCalledWith(
+      { name: 'Created', domain: 'created.example', website: 'https://created.example' },
+      { principalId: 'principal_admin', userId: 'user_admin' }
+    )
+
+    await expect(
+      updateOrganizationFn({
+        data: { organizationId: 'org_123', name: 'Updated', domain: 'updated.example' },
+      })
+    ).resolves.toEqual(org({ name: 'Updated' }))
+    expect(hoisted.mockUpdateOrganization).toHaveBeenCalledWith(
+      'org_123',
+      { name: 'Updated', domain: 'updated.example' },
+      { principalId: 'principal_admin', userId: 'user_admin' }
+    )
+
+    await expect(archiveOrganizationFn({ data: { organizationId: 'org_123' } })).resolves.toEqual({
+      ok: true,
+    })
+    await expect(unarchiveOrganizationFn({ data: { organizationId: 'org_123' } })).resolves.toEqual(
+      { ok: true }
+    )
+
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'organization.created', targetId: 'org_123' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'organization.updated', targetId: 'org_123' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'organization.archived', targetId: 'org_123' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'organization.unarchived', targetId: 'org_123' })
+    )
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.ORG_MANAGE)
+  })
+
+  it('records an update audit event with no before diff when the organization did not exist', async () => {
+    hoisted.mockGetOrganization.mockResolvedValueOnce(null)
+
+    await updateOrganizationFn({
+      data: { organizationId: 'org_123', name: 'Updated' },
+    })
+
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'organization.updated',
+        diff: expect.objectContaining({ before: undefined }),
+      })
+    )
+  })
+
+  it('does not call organization domains when permission is denied', async () => {
+    hoisted.mockRequirePermission.mockRejectedValueOnce(new Error('org.view required'))
+
+    await expect(listOrganizationsFn({ data: {} })).rejects.toThrow('org.view required')
+
+    expect(hoisted.mockListOrganizations).not.toHaveBeenCalled()
+    expect(hoisted.mockCreateOrganization).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/policy-actor-from-auth.test.ts b/apps/web/src/lib/server/functions/__tests__/policy-actor-from-auth.test.ts
index b96b4730a..a631228db 100644
--- a/apps/web/src/lib/server/functions/__tests__/policy-actor-from-auth.test.ts
+++ b/apps/web/src/lib/server/functions/__tests__/policy-actor-from-auth.test.ts
@@ -37,6 +37,9 @@ function buildAuth(overrides: {
       role: overrides.principalRole ?? 'user',
       type: overrides.principalType ?? 'user',
     },
+    ipAddress: null,
+    userAgent: null,
+    source: 'web',
   }
 }
 
diff --git a/apps/web/src/lib/server/functions/__tests__/portal-tickets.test.ts b/apps/web/src/lib/server/functions/__tests__/portal-tickets.test.ts
new file mode 100644
index 000000000..51b33f0bc
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/portal-tickets.test.ts
@@ -0,0 +1,453 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PrincipalId, TicketId, TicketStatusId, UserId } from '@quackback/ids'
+import { ForbiddenError } from '@/lib/shared/errors'
+
+type HandlerArgs = { data: Record<string, unknown> }
+type AnyHandler = (args: HandlerArgs) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequireAuth: vi.fn(),
+  mockListTicketsForPortalUser: vi.fn(),
+  mockGetTicketForPortalUser: vi.fn(),
+  mockAddPortalReply: vi.fn(),
+  mockUpdatePortalTicketDescription: vi.fn(),
+  mockClosePortalTicket: vi.fn(),
+  mockReopenPortalTicket: vi.fn(),
+  mockBuildPortalIdentity: vi.fn(),
+  mockResolveViewerRelationship: vi.fn(),
+  mockListPublicThreadsForTicket: vi.fn(),
+  mockCreateTicket: vi.fn(),
+  mockGetMemberByUser: vi.fn(),
+  mockTicketStatusesFindMany: vi.fn(),
+  mockTicketStatusesFindFirst: vi.fn(),
+  mockPrincipalFindFirst: vi.fn(),
+  mockDbSelect: vi.fn(),
+  mockEq: vi.fn(),
+  mockInArray: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requireAuth: hoisted.mockRequireAuth,
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.portal-query', () => ({
+  listTicketsForPortalUser: hoisted.mockListTicketsForPortalUser,
+  getTicketForPortalUser: hoisted.mockGetTicketForPortalUser,
+  addPortalReply: hoisted.mockAddPortalReply,
+  updatePortalTicketDescription: hoisted.mockUpdatePortalTicketDescription,
+  closePortalTicket: hoisted.mockClosePortalTicket,
+  reopenPortalTicket: hoisted.mockReopenPortalTicket,
+  buildPortalIdentity: hoisted.mockBuildPortalIdentity,
+  resolveViewerRelationship: hoisted.mockResolveViewerRelationship,
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.threads', () => ({
+  listPublicThreadsForTicket: hoisted.mockListPublicThreadsForTicket,
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.service', () => ({
+  createTicket: hoisted.mockCreateTicket,
+}))
+
+vi.mock('@/lib/server/domains/principals/principal.service', () => ({
+  getMemberByUser: hoisted.mockGetMemberByUser,
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketStatuses: {
+        findMany: (...args: unknown[]) => hoisted.mockTicketStatusesFindMany(...args),
+        findFirst: (...args: unknown[]) => hoisted.mockTicketStatusesFindFirst(...args),
+      },
+      principal: {
+        findFirst: (...args: unknown[]) => hoisted.mockPrincipalFindFirst(...args),
+      },
+    },
+    select: (...args: unknown[]) => hoisted.mockDbSelect(...args),
+  },
+  eq: (...args: unknown[]) => hoisted.mockEq(...args),
+  inArray: (...args: unknown[]) => hoisted.mockInArray(...args),
+  principal: {
+    id: 'principal.id',
+    type: 'principal.type',
+    userId: 'principal.userId',
+  },
+  user: {
+    id: 'user.id',
+    name: 'user.name',
+  },
+  ticketStatuses: {
+    id: 'ticketStatuses.id',
+  },
+}))
+
+const USER = 'user_portal' as UserId
+const PRINCIPAL = 'principal_portal' as PrincipalId
+const STAFF = 'principal_staff' as PrincipalId
+const TICKET = 'ticket_portal' as TicketId
+const STATUS_OPEN = 'status_open' as TicketStatusId
+const STATUS_SOLVED = 'status_solved' as TicketStatusId
+const CREATED = new Date('2026-04-01T10:00:00.000Z')
+const UPDATED = new Date('2026-04-02T10:00:00.000Z')
+
+await import('../portal-tickets')
+
+const [
+  listMyTicketsFn,
+  getMyTicketFn,
+  replyToMyTicketFn,
+  updateMyTicketDescriptionFn,
+  closeMyTicketFn,
+  reopenMyTicketFn,
+  createMyTicketFn,
+  createTicketInitialThreadFn,
+] = handlersByIndex
+
+if (!createTicketInitialThreadFn) {
+  throw new Error(`portal-ticket handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+function ticketRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: TICKET,
+    subject: 'Portal ticket',
+    descriptionJson: null,
+    descriptionText: 'Details',
+    statusId: STATUS_OPEN,
+    requesterPrincipalId: PRINCIPAL,
+    createdAt: CREATED,
+    lastActivityAt: UPDATED,
+    updatedAt: UPDATED,
+    ...overrides,
+  }
+}
+
+function statusRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: STATUS_OPEN,
+    category: 'open',
+    name: 'Open',
+    color: '#16a34a',
+    ...overrides,
+  }
+}
+
+function principalSelectChain(rows: readonly Record<string, unknown>[]) {
+  const chain = {
+    from: vi.fn(),
+    leftJoin: vi.fn(),
+    where: vi.fn().mockResolvedValue(rows),
+  }
+  chain.from.mockReturnValue(chain)
+  chain.leftJoin.mockReturnValue(chain)
+  return chain
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequireAuth.mockResolvedValue({
+    user: { id: USER, email: 'portal@example.com' },
+    principal: { id: PRINCIPAL },
+  })
+  hoisted.mockTicketStatusesFindMany.mockResolvedValue([statusRow()])
+  hoisted.mockTicketStatusesFindFirst.mockResolvedValue(statusRow())
+  hoisted.mockPrincipalFindFirst.mockResolvedValue({ id: PRINCIPAL })
+  hoisted.mockGetTicketForPortalUser.mockResolvedValue(ticketRow())
+  hoisted.mockListPublicThreadsForTicket.mockResolvedValue([])
+  hoisted.mockBuildPortalIdentity.mockResolvedValue({ principalId: PRINCIPAL, contactIds: [] })
+  hoisted.mockResolveViewerRelationship.mockResolvedValue('requester')
+  hoisted.mockGetMemberByUser.mockResolvedValue({ id: PRINCIPAL })
+})
+
+describe('portal ticket list and detail server functions', () => {
+  it('returns an empty list without status lookup when the portal query has no rows', async () => {
+    hoisted.mockListTicketsForPortalUser.mockResolvedValue({ rows: [], total: 0 })
+
+    const result = await listMyTicketsFn({
+      data: { statusCategory: 'open', limit: 10, offset: 0 },
+    })
+
+    expect(result).toEqual({ rows: [], total: 0 })
+    expect(hoisted.mockListTicketsForPortalUser).toHaveBeenCalledWith({
+      userId: USER,
+      statusCategory: 'open',
+      limit: 10,
+      offset: 0,
+    })
+    expect(hoisted.mockTicketStatusesFindMany).not.toHaveBeenCalled()
+  })
+
+  it('serializes list rows with status metadata and date strings', async () => {
+    hoisted.mockListTicketsForPortalUser.mockResolvedValue({
+      rows: [
+        ticketRow({ statusId: STATUS_OPEN }),
+        ticketRow({ id: 'ticket_unknown', statusId: 'status_missing' }),
+      ],
+      total: 2,
+    })
+    hoisted.mockTicketStatusesFindMany.mockResolvedValue([statusRow()])
+
+    const result = await listMyTicketsFn({ data: { limit: 25 } })
+
+    expect(result).toEqual({
+      rows: [
+        {
+          id: TICKET,
+          subject: 'Portal ticket',
+          statusId: STATUS_OPEN,
+          statusCategory: 'open',
+          statusName: 'Open',
+          statusColor: '#16a34a',
+          lastActivityAt: UPDATED.toISOString(),
+          createdAt: CREATED.toISOString(),
+        },
+        {
+          id: 'ticket_unknown',
+          subject: 'Portal ticket',
+          statusId: 'status_missing',
+          statusCategory: 'open',
+          statusName: 'Unknown',
+          statusColor: null,
+          lastActivityAt: UPDATED.toISOString(),
+          createdAt: CREATED.toISOString(),
+        },
+      ],
+      total: 2,
+    })
+  })
+
+  it('serializes ticket details, public threads, viewer identity, and principal names', async () => {
+    hoisted.mockListPublicThreadsForTicket.mockResolvedValue([
+      {
+        id: 'thread_customer',
+        principalId: PRINCIPAL,
+        audience: 'public',
+        bodyJson: { type: 'doc' },
+        bodyText: 'Customer reply',
+        createdAt: CREATED,
+        editedAt: null,
+      },
+      {
+        id: 'thread_staff',
+        principalId: STAFF,
+        audience: 'public',
+        bodyJson: null,
+        bodyText: 'Staff reply',
+        createdAt: UPDATED,
+        editedAt: UPDATED,
+      },
+    ])
+    hoisted.mockDbSelect.mockReturnValueOnce(
+      principalSelectChain([
+        { id: PRINCIPAL, userName: 'Customer' },
+        { id: STAFF, userName: null },
+      ])
+    )
+
+    const result = await getMyTicketFn({ data: { ticketId: TICKET } })
+
+    expect(hoisted.mockGetTicketForPortalUser).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+    })
+    expect(hoisted.mockResolveViewerRelationship).toHaveBeenCalledWith(ticketRow(), {
+      principalId: PRINCIPAL,
+      contactIds: [],
+    })
+    expect(result).toMatchObject({
+      ticket: {
+        id: TICKET,
+        statusName: 'Open',
+        createdAt: CREATED.toISOString(),
+        updatedAt: UPDATED.toISOString(),
+      },
+      principalNames: {
+        [PRINCIPAL]: 'Customer',
+        [STAFF]: 'User',
+      },
+      viewerPrincipalId: PRINCIPAL,
+      viewerRelationship: 'requester',
+    })
+    expect((result as { threads: Array<{ id: string; editedAt: string | null }> }).threads).toEqual(
+      [
+        expect.objectContaining({ id: 'thread_customer', editedAt: null }),
+        expect.objectContaining({ id: 'thread_staff', editedAt: UPDATED.toISOString() }),
+      ]
+    )
+  })
+})
+
+describe('portal ticket mutation server functions', () => {
+  it('creates portal replies with the authenticated user id and serializes the thread', async () => {
+    hoisted.mockAddPortalReply.mockResolvedValue({
+      id: 'thread_reply',
+      ticketId: TICKET,
+      audience: 'public',
+      createdAt: CREATED,
+    })
+
+    const result = await replyToMyTicketFn({
+      data: {
+        ticketId: TICKET,
+        bodyText: 'Reply',
+      },
+    })
+
+    expect(hoisted.mockAddPortalReply).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+      bodyJson: null,
+      bodyText: 'Reply',
+    })
+    expect(result).toEqual({
+      id: 'thread_reply',
+      ticketId: TICKET,
+      audience: 'public',
+      createdAt: CREATED.toISOString(),
+    })
+  })
+
+  it('updates portal ticket descriptions with a conflict timestamp', async () => {
+    hoisted.mockUpdatePortalTicketDescription.mockResolvedValue({
+      id: TICKET,
+      updatedAt: UPDATED,
+    })
+
+    const result = await updateMyTicketDescriptionFn({
+      data: {
+        ticketId: TICKET,
+        expectedUpdatedAt: '2026-04-01T10:00:00.000Z',
+        descriptionText: 'Updated details',
+      },
+    })
+
+    expect(hoisted.mockUpdatePortalTicketDescription).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+      expectedUpdatedAt: CREATED,
+      descriptionJson: null,
+      descriptionText: 'Updated details',
+    })
+    expect(result).toEqual({ id: TICKET, updatedAt: UPDATED.toISOString() })
+  })
+
+  it('closes and reopens tickets with status fallbacks when status lookup misses', async () => {
+    hoisted.mockTicketStatusesFindFirst.mockResolvedValue(undefined)
+    hoisted.mockClosePortalTicket.mockResolvedValue({
+      id: TICKET,
+      statusId: STATUS_SOLVED,
+      updatedAt: UPDATED,
+    })
+    hoisted.mockReopenPortalTicket.mockResolvedValue({
+      id: TICKET,
+      statusId: null,
+      updatedAt: UPDATED,
+    })
+
+    const closed = await closeMyTicketFn({ data: { ticketId: TICKET } })
+    const reopened = await reopenMyTicketFn({ data: { ticketId: TICKET } })
+
+    expect(hoisted.mockClosePortalTicket).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+    })
+    expect(hoisted.mockReopenPortalTicket).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+    })
+    expect(closed).toEqual({
+      id: TICKET,
+      statusCategory: 'solved',
+      statusName: 'Solved',
+      updatedAt: UPDATED.toISOString(),
+    })
+    expect(reopened).toEqual({
+      id: TICKET,
+      statusCategory: 'open',
+      statusName: 'Open',
+      updatedAt: UPDATED.toISOString(),
+    })
+  })
+})
+
+describe('portal ticket creation server functions', () => {
+  it('rejects portal ticket creation when the authenticated user has no principal', async () => {
+    hoisted.mockGetMemberByUser.mockResolvedValue(null)
+
+    await expect(
+      createMyTicketFn({ data: { subject: 'Need help', descriptionText: 'Details' } })
+    ).rejects.toBeInstanceOf(ForbiddenError)
+
+    expect(hoisted.mockCreateTicket).not.toHaveBeenCalled()
+  })
+
+  it('creates tickets through the portal channel and serializes the created row', async () => {
+    hoisted.mockCreateTicket.mockResolvedValue(ticketRow({ subject: 'Created from portal' }))
+
+    const result = await createMyTicketFn({
+      data: {
+        subject: 'Created from portal',
+        descriptionText: 'Details',
+        priority: 'high',
+      },
+    })
+
+    expect(hoisted.mockCreateTicket).toHaveBeenCalledWith({
+      subject: 'Created from portal',
+      descriptionJson: null,
+      descriptionText: 'Details',
+      priority: 'high',
+      channel: 'portal',
+      requesterPrincipalId: PRINCIPAL,
+      createdByPrincipalId: PRINCIPAL,
+    })
+    expect(result).toEqual({
+      id: TICKET,
+      subject: 'Created from portal',
+      statusId: STATUS_OPEN,
+      statusCategory: 'open',
+      statusName: 'Open',
+      statusColor: '#16a34a',
+      createdAt: CREATED.toISOString(),
+      lastActivityAt: UPDATED.toISOString(),
+    })
+  })
+
+  it('verifies portal ownership before creating the initial attachment thread', async () => {
+    hoisted.mockAddPortalReply.mockResolvedValue({ id: 'thread_initial' })
+
+    const result = await createTicketInitialThreadFn({ data: { ticketId: TICKET } })
+
+    expect(hoisted.mockGetTicketForPortalUser).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+    })
+    expect(hoisted.mockAddPortalReply).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+      bodyText: '[Attachments added at ticket creation]',
+    })
+    expect(result).toEqual({ id: 'thread_initial' })
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/principals.test.ts b/apps/web/src/lib/server/functions/__tests__/principals.test.ts
new file mode 100644
index 000000000..3ec5f834f
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/principals.test.ts
@@ -0,0 +1,202 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequireAuth: vi.fn(),
+  mockSelect: vi.fn(),
+  mockEq: vi.fn(),
+  mockAnd: vi.fn(),
+  mockOr: vi.fn(),
+  mockIlike: vi.fn(),
+  mockInArray: vi.fn(),
+  mockNotInArray: vi.fn(),
+  mockDesc: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requireAuth: (...args: unknown[]) => hoisted.mockRequireAuth(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    select: (...args: unknown[]) => hoisted.mockSelect(...args),
+  },
+  principal: {
+    id: 'principal.id',
+    displayName: 'principal.displayName',
+    avatarUrl: 'principal.avatarUrl',
+    role: 'principal.role',
+    type: 'principal.type',
+    userId: 'principal.userId',
+    createdAt: 'principal.createdAt',
+  },
+  user: {
+    id: 'user.id',
+    email: 'user.email',
+    name: 'user.name',
+  },
+  eq: (...args: unknown[]) => hoisted.mockEq(...args),
+  and: (...args: unknown[]) => hoisted.mockAnd(...args),
+  or: (...args: unknown[]) => hoisted.mockOr(...args),
+  ilike: (...args: unknown[]) => hoisted.mockIlike(...args),
+  inArray: (...args: unknown[]) => hoisted.mockInArray(...args),
+  notInArray: (...args: unknown[]) => hoisted.mockNotInArray(...args),
+  desc: (...args: unknown[]) => hoisted.mockDesc(...args),
+}))
+
+await import('../principals')
+
+const [searchPrincipalsFn, getPrincipalsByIdsFn] = handlersByIndex
+
+if (!getPrincipalsByIdsFn) {
+  throw new Error(`principal handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+function row(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'principal_agent',
+    displayName: 'Agent',
+    avatarUrl: null,
+    role: 'member',
+    type: 'user',
+    userId: 'user_agent',
+    userEmail: 'agent@example.com',
+    userName: 'Ada Agent',
+    ...overrides,
+  }
+}
+
+function searchChain(rows: unknown[]) {
+  const chain = {
+    from: vi.fn(() => chain),
+    leftJoin: vi.fn(() => chain),
+    where: vi.fn(() => chain),
+    orderBy: vi.fn(() => chain),
+    limit: vi.fn(() => Promise.resolve(rows)),
+  }
+  return chain
+}
+
+function byIdChain(rows: unknown[]) {
+  const chain = {
+    from: vi.fn(() => chain),
+    leftJoin: vi.fn(() => chain),
+    where: vi.fn(() => Promise.resolve(rows)),
+  }
+  return chain
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequireAuth.mockResolvedValue({ user: { id: 'user_admin' } })
+  hoisted.mockEq.mockImplementation((left, right) => ({ op: 'eq', left, right }))
+  hoisted.mockAnd.mockImplementation((...parts) => ({ op: 'and', parts }))
+  hoisted.mockOr.mockImplementation((...parts) => ({ op: 'or', parts }))
+  hoisted.mockIlike.mockImplementation((left, right) => ({ op: 'ilike', left, right }))
+  hoisted.mockInArray.mockImplementation((left, values) => ({ op: 'inArray', left, values }))
+  hoisted.mockNotInArray.mockImplementation((left, values) => ({ op: 'notInArray', left, values }))
+  hoisted.mockDesc.mockImplementation((column) => ({ op: 'desc', column }))
+})
+
+describe('principal server functions', () => {
+  it('searches principals with role, exclusion, query, and limit filters', async () => {
+    const chain = searchChain([
+      row({ displayName: null, userName: 'Ada User', userEmail: null, userId: null }),
+    ])
+    hoisted.mockSelect.mockReturnValueOnce(chain)
+
+    const result = await searchPrincipalsFn({
+      data: {
+        query: '  ada  ',
+        roleFilter: ['member'],
+        excludeIds: ['principal_skip'],
+        limit: 5,
+      },
+    })
+
+    expect(result).toEqual([
+      {
+        id: 'principal_agent',
+        displayName: 'Ada User',
+        email: null,
+        role: 'member',
+        avatarUrl: null,
+        type: 'user',
+        userId: null,
+      },
+    ])
+    expect(hoisted.mockRequireAuth).toHaveBeenCalledWith({ roles: ['admin', 'member', 'user'] })
+    expect(hoisted.mockInArray).toHaveBeenCalledWith('principal.role', ['member'])
+    expect(hoisted.mockNotInArray).toHaveBeenCalledWith('principal.id', ['principal_skip'])
+    expect(hoisted.mockIlike).toHaveBeenCalledWith('principal.displayName', '%ada%')
+    expect(chain.where).toHaveBeenCalledWith(expect.objectContaining({ op: 'and' }))
+    expect(chain.limit).toHaveBeenCalledWith(5)
+  })
+
+  it('searches principals with no optional filters and the default limit', async () => {
+    const chain = searchChain([row()])
+    hoisted.mockSelect.mockReturnValueOnce(chain)
+
+    await expect(searchPrincipalsFn({ data: {} })).resolves.toEqual([
+      {
+        id: 'principal_agent',
+        displayName: 'Agent',
+        email: 'agent@example.com',
+        role: 'member',
+        avatarUrl: null,
+        type: 'user',
+        userId: 'user_agent',
+      },
+    ])
+
+    expect(chain.where).toHaveBeenCalledWith(undefined)
+    expect(chain.limit).toHaveBeenCalledWith(20)
+  })
+
+  it('fetches principals by ids and maps nullable user ids', async () => {
+    const chain = byIdChain([row({ userId: null })])
+    hoisted.mockSelect.mockReturnValueOnce(chain)
+
+    await expect(getPrincipalsByIdsFn({ data: { ids: ['principal_agent'] } })).resolves.toEqual([
+      {
+        id: 'principal_agent',
+        displayName: 'Agent',
+        email: 'agent@example.com',
+        role: 'member',
+        avatarUrl: null,
+        type: 'user',
+        userId: null,
+      },
+    ])
+    expect(hoisted.mockInArray).toHaveBeenCalledWith('principal.id', ['principal_agent'])
+  })
+
+  it('does not query principals when authentication fails', async () => {
+    hoisted.mockRequireAuth.mockRejectedValueOnce(new Error('login required'))
+
+    await expect(searchPrincipalsFn({ data: {} })).rejects.toThrow('login required')
+
+    expect(hoisted.mockSelect).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/recovery-codes-consume.test.ts b/apps/web/src/lib/server/functions/__tests__/recovery-codes-consume.test.ts
index 8becf5f47..c6c9814fe 100644
--- a/apps/web/src/lib/server/functions/__tests__/recovery-codes-consume.test.ts
+++ b/apps/web/src/lib/server/functions/__tests__/recovery-codes-consume.test.ts
@@ -61,6 +61,7 @@ vi.mock('@/lib/server/auth/magic-link-mint', () => ({
 
 vi.mock('@/lib/server/config', () => ({
   config: { baseUrl: 'https://acme.quackback.io' },
+  getBaseUrl: () => 'https://acme.quackback.io',
 }))
 
 // Stub Redis: the consume fn rate-limits via INCR + EXPIRE. We don't
diff --git a/apps/web/src/lib/server/functions/__tests__/roles.test.ts b/apps/web/src/lib/server/functions/__tests__/roles.test.ts
new file mode 100644
index 000000000..a11272953
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/roles.test.ts
@@ -0,0 +1,190 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequireAuth: vi.fn(),
+  mockListRoles: vi.fn(),
+  mockGetRoleWithPermissions: vi.fn(),
+  mockCreateRole: vi.fn(),
+  mockUpdateRole: vi.fn(),
+  mockDeleteRole: vi.fn(),
+  mockSetRolePermissions: vi.fn(),
+  mockListAssignmentsForPrincipal: vi.fn(),
+  mockAssignRole: vi.fn(),
+  mockRevokeRoleAssignment: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requireAuth: (...args: unknown[]) => hoisted.mockRequireAuth(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/role.service', () => ({
+  listRoles: (...args: unknown[]) => hoisted.mockListRoles(...args),
+  getRoleWithPermissions: (...args: unknown[]) => hoisted.mockGetRoleWithPermissions(...args),
+  createRole: (...args: unknown[]) => hoisted.mockCreateRole(...args),
+  updateRole: (...args: unknown[]) => hoisted.mockUpdateRole(...args),
+  deleteRole: (...args: unknown[]) => hoisted.mockDeleteRole(...args),
+  setRolePermissions: (...args: unknown[]) => hoisted.mockSetRolePermissions(...args),
+  listAssignmentsForPrincipal: (...args: unknown[]) =>
+    hoisted.mockListAssignmentsForPrincipal(...args),
+  assignRole: (...args: unknown[]) => hoisted.mockAssignRole(...args),
+  revokeRoleAssignment: (...args: unknown[]) => hoisted.mockRevokeRoleAssignment(...args),
+}))
+
+await import('../roles')
+
+const [
+  listRolesFn,
+  getRoleFn,
+  createRoleFn,
+  updateRoleFn,
+  deleteRoleFn,
+  setRolePermissionsFn,
+  listAssignmentsForPrincipalFn,
+  assignRoleFn,
+  revokeRoleAssignmentFn,
+] = handlersByIndex
+
+if (!revokeRoleAssignmentFn) {
+  throw new Error(`role handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequireAuth.mockResolvedValue({
+    principal: { id: 'principal_admin' },
+  })
+  hoisted.mockListRoles.mockResolvedValue([{ id: 'role_admin', key: 'admin' }])
+  hoisted.mockGetRoleWithPermissions.mockResolvedValue({
+    id: 'role_admin',
+    key: 'admin',
+    permissions: [PERMISSIONS.ADMIN_MANAGE_ROLES],
+  })
+  hoisted.mockCreateRole.mockResolvedValue('role_custom')
+  hoisted.mockUpdateRole.mockResolvedValue(undefined)
+  hoisted.mockDeleteRole.mockResolvedValue(undefined)
+  hoisted.mockSetRolePermissions.mockResolvedValue(undefined)
+  hoisted.mockListAssignmentsForPrincipal.mockResolvedValue([{ id: 'role_asgn_1' }])
+  hoisted.mockAssignRole.mockResolvedValue('role_asgn_2')
+  hoisted.mockRevokeRoleAssignment.mockResolvedValue(undefined)
+})
+
+describe('role server functions', () => {
+  it('lists and fetches roles after admin auth', async () => {
+    await expect(listRolesFn({ data: {} })).resolves.toEqual([{ id: 'role_admin', key: 'admin' }])
+    await expect(getRoleFn({ data: { id: 'role_admin' } })).resolves.toEqual({
+      id: 'role_admin',
+      key: 'admin',
+      permissions: [PERMISSIONS.ADMIN_MANAGE_ROLES],
+    })
+
+    expect(hoisted.mockRequireAuth).toHaveBeenCalledWith({ roles: ['admin'] })
+    expect(hoisted.mockGetRoleWithPermissions).toHaveBeenCalledWith('role_admin')
+  })
+
+  it('creates, updates, deletes, and mutates role permissions with actor principal context', async () => {
+    await expect(
+      createRoleFn({
+        data: {
+          key: 'support_lead',
+          name: 'Support lead',
+          description: undefined,
+          permissionKeys: [PERMISSIONS.TICKET_VIEW_TEAM],
+        },
+      })
+    ).resolves.toEqual({ id: 'role_custom' })
+    expect(hoisted.mockCreateRole).toHaveBeenCalledWith({
+      key: 'support_lead',
+      name: 'Support lead',
+      description: null,
+      permissionKeys: [PERMISSIONS.TICKET_VIEW_TEAM],
+      actorPrincipalId: 'principal_admin',
+    })
+
+    await expect(
+      updateRoleFn({
+        data: { id: 'role_custom', name: 'Support lead', description: 'Can triage tickets' },
+      })
+    ).resolves.toEqual({ ok: true })
+    expect(hoisted.mockUpdateRole).toHaveBeenCalledWith({
+      id: 'role_custom',
+      name: 'Support lead',
+      description: 'Can triage tickets',
+      actorPrincipalId: 'principal_admin',
+    })
+
+    await expect(deleteRoleFn({ data: { id: 'role_custom' } })).resolves.toEqual({ ok: true })
+    expect(hoisted.mockDeleteRole).toHaveBeenCalledWith({
+      id: 'role_custom',
+      actorPrincipalId: 'principal_admin',
+    })
+
+    await expect(
+      setRolePermissionsFn({
+        data: { roleId: 'role_custom', permissionKeys: [PERMISSIONS.TICKET_VIEW_TEAM] },
+      })
+    ).resolves.toEqual({ ok: true })
+    expect(hoisted.mockSetRolePermissions).toHaveBeenCalledWith({
+      roleId: 'role_custom',
+      permissionKeys: [PERMISSIONS.TICKET_VIEW_TEAM],
+      actorPrincipalId: 'principal_admin',
+    })
+  })
+
+  it('lists, assigns, and revokes principal role assignments', async () => {
+    await expect(
+      listAssignmentsForPrincipalFn({ data: { principalId: 'principal_agent' } })
+    ).resolves.toEqual([{ id: 'role_asgn_1' }])
+    expect(hoisted.mockListAssignmentsForPrincipal).toHaveBeenCalledWith('principal_agent')
+
+    await expect(
+      assignRoleFn({
+        data: { principalId: 'principal_agent', roleId: 'role_custom', teamId: undefined },
+      })
+    ).resolves.toEqual({ id: 'role_asgn_2' })
+    expect(hoisted.mockAssignRole).toHaveBeenCalledWith({
+      principalId: 'principal_agent',
+      roleId: 'role_custom',
+      teamId: null,
+      actorPrincipalId: 'principal_admin',
+    })
+
+    await expect(
+      revokeRoleAssignmentFn({ data: { assignmentId: 'role_asgn_2' } })
+    ).resolves.toEqual({ ok: true })
+    expect(hoisted.mockRevokeRoleAssignment).toHaveBeenCalledWith({
+      assignmentId: 'role_asgn_2',
+      actorPrincipalId: 'principal_admin',
+    })
+  })
+
+  it('does not call role services when admin auth fails', async () => {
+    hoisted.mockRequireAuth.mockRejectedValueOnce(new Error('admin required'))
+
+    await expect(listRolesFn({ data: {} })).rejects.toThrow('admin required')
+
+    expect(hoisted.mockListRoles).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/routing.test.ts b/apps/web/src/lib/server/functions/__tests__/routing.test.ts
new file mode 100644
index 000000000..d575f7058
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/routing.test.ts
@@ -0,0 +1,194 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequirePermission: vi.fn(),
+  mockCreateRoutingRule: vi.fn(),
+  mockUpdateRoutingRule: vi.fn(),
+  mockDeleteRoutingRule: vi.fn(),
+  mockGetRoutingRule: vi.fn(),
+  mockListRoutingRules: vi.fn(),
+  mockReorderRoutingRules: vi.fn(),
+  mockRecordEvent: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requirePermission: (...args: unknown[]) => hoisted.mockRequirePermission(...args),
+}))
+
+vi.mock('@/lib/server/domains/inboxes', () => ({
+  createRoutingRule: (...args: unknown[]) => hoisted.mockCreateRoutingRule(...args),
+  updateRoutingRule: (...args: unknown[]) => hoisted.mockUpdateRoutingRule(...args),
+  deleteRoutingRule: (...args: unknown[]) => hoisted.mockDeleteRoutingRule(...args),
+  getRoutingRule: (...args: unknown[]) => hoisted.mockGetRoutingRule(...args),
+  listRoutingRules: (...args: unknown[]) => hoisted.mockListRoutingRules(...args),
+  reorderRoutingRules: (...args: unknown[]) => hoisted.mockReorderRoutingRules(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.mockRecordEvent(...args),
+}))
+
+await import('../routing')
+
+const [
+  listRoutingRulesFn,
+  getRoutingRuleFn,
+  createRoutingRuleFn,
+  updateRoutingRuleFn,
+  deleteRoutingRuleFn,
+  reorderRoutingRulesFn,
+] = handlersByIndex
+
+if (!reorderRoutingRulesFn) {
+  throw new Error(`routing handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+const ctx = {
+  principal: { id: 'principal_admin' },
+}
+
+function rule(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'route_rule_123',
+    name: 'Urgent',
+    priority: 10,
+    enabled: true,
+    ...overrides,
+  }
+}
+
+function conditions() {
+  return { match: 'all', conditions: [{ field: 'subject', op: 'contains', value: 'urgent' }] }
+}
+
+function actions() {
+  return [{ type: 'assignToInbox', value: 'inbox_support' }]
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequirePermission.mockResolvedValue(ctx)
+  hoisted.mockListRoutingRules.mockResolvedValue([rule()])
+  hoisted.mockGetRoutingRule.mockResolvedValue(rule())
+  hoisted.mockCreateRoutingRule.mockResolvedValue(rule({ name: 'Created' }))
+  hoisted.mockUpdateRoutingRule.mockResolvedValue(rule({ name: 'Updated' }))
+  hoisted.mockDeleteRoutingRule.mockResolvedValue(undefined)
+  hoisted.mockReorderRoutingRules.mockResolvedValue(undefined)
+  hoisted.mockRecordEvent.mockResolvedValue(undefined)
+})
+
+describe('routing-rule server functions', () => {
+  it('lists and fetches routing rules behind routing.rule.manage', async () => {
+    await expect(
+      listRoutingRulesFn({ data: { inboxIdScope: 'workspace', enabledOnly: true } })
+    ).resolves.toEqual([rule()])
+    expect(hoisted.mockListRoutingRules).toHaveBeenCalledWith({
+      inboxIdScope: 'workspace',
+      enabledOnly: true,
+    })
+
+    await expect(getRoutingRuleFn({ data: { ruleId: 'route_rule_123' } })).resolves.toEqual(rule())
+    expect(hoisted.mockGetRoutingRule).toHaveBeenCalledWith('route_rule_123')
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.ROUTING_RULE_MANAGE)
+  })
+
+  it('creates and updates routing rules with audit events', async () => {
+    await expect(
+      createRoutingRuleFn({
+        data: {
+          name: 'Created',
+          description: null,
+          priority: 10,
+          enabled: true,
+          conditions: conditions(),
+          actions: actions(),
+          inboxIdScope: 'inbox_support',
+        },
+      })
+    ).resolves.toEqual(rule({ name: 'Created' }))
+    expect(hoisted.mockCreateRoutingRule).toHaveBeenCalledWith({
+      name: 'Created',
+      description: null,
+      priority: 10,
+      enabled: true,
+      conditions: conditions(),
+      actions: actions(),
+      inboxIdScope: 'inbox_support',
+    })
+
+    await expect(
+      updateRoutingRuleFn({
+        data: {
+          ruleId: 'route_rule_123',
+          name: 'Updated',
+          priority: 20,
+          conditions: conditions(),
+        },
+      })
+    ).resolves.toEqual(rule({ name: 'Updated' }))
+    expect(hoisted.mockUpdateRoutingRule).toHaveBeenCalledWith('route_rule_123', {
+      name: 'Updated',
+      priority: 20,
+      conditions: conditions(),
+    })
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'routing_rule.created', targetId: 'route_rule_123' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'routing_rule.updated', targetId: 'route_rule_123' })
+    )
+  })
+
+  it('deletes and reorders routing rules with audit events', async () => {
+    await expect(deleteRoutingRuleFn({ data: { ruleId: 'route_rule_123' } })).resolves.toEqual({
+      ok: true,
+    })
+    expect(hoisted.mockDeleteRoutingRule).toHaveBeenCalledWith('route_rule_123')
+
+    await expect(
+      reorderRoutingRulesFn({ data: { orderedIds: ['route_rule_123', 'route_rule_456'] } })
+    ).resolves.toEqual({ ok: true })
+    expect(hoisted.mockReorderRoutingRules).toHaveBeenCalledWith([
+      'route_rule_123',
+      'route_rule_456',
+    ])
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'routing_rule.deleted', targetId: 'route_rule_123' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'routing_rule.reordered', targetId: 'route_rule_123' })
+    )
+  })
+
+  it('does not call routing domains when permission is denied', async () => {
+    hoisted.mockRequirePermission.mockRejectedValueOnce(new Error('routing required'))
+
+    await expect(listRoutingRulesFn({ data: {} })).rejects.toThrow('routing required')
+
+    expect(hoisted.mockListRoutingRules).not.toHaveBeenCalled()
+    expect(hoisted.mockCreateRoutingRule).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/sla.test.ts b/apps/web/src/lib/server/functions/__tests__/sla.test.ts
new file mode 100644
index 000000000..a25cab415
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/sla.test.ts
@@ -0,0 +1,419 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PrincipalId } from '@quackback/ids'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequirePermission: vi.fn(),
+  mockRecordEvent: vi.fn(),
+  mockCreateBusinessHours: vi.fn(),
+  mockUpdateBusinessHours: vi.fn(),
+  mockArchiveBusinessHours: vi.fn(),
+  mockGetBusinessHours: vi.fn(),
+  mockListBusinessHours: vi.fn(),
+  mockCreateSlaPolicy: vi.fn(),
+  mockUpdateSlaPolicy: vi.fn(),
+  mockArchiveSlaPolicy: vi.fn(),
+  mockGetSlaPolicy: vi.fn(),
+  mockListSlaPolicies: vi.fn(),
+  mockReplaceTargets: vi.fn(),
+  mockListTargetsForPolicy: vi.fn(),
+  mockCreateEscalationRule: vi.fn(),
+  mockUpdateEscalationRule: vi.fn(),
+  mockDeleteEscalationRule: vi.fn(),
+  mockListEscalationRulesForPolicy: vi.fn(),
+  mockGetActiveClocksForTicket: vi.fn(),
+  mockGetAllClocksForTicket: vi.fn(),
+  mockListBreachingClocks: vi.fn(),
+  mockRunEscalationTick: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requirePermission: (...args: unknown[]) => hoisted.mockRequirePermission(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.mockRecordEvent(...args),
+}))
+
+vi.mock('@/lib/server/domains/sla', () => ({
+  createBusinessHours: (...args: unknown[]) => hoisted.mockCreateBusinessHours(...args),
+  updateBusinessHours: (...args: unknown[]) => hoisted.mockUpdateBusinessHours(...args),
+  archiveBusinessHours: (...args: unknown[]) => hoisted.mockArchiveBusinessHours(...args),
+  getBusinessHours: (...args: unknown[]) => hoisted.mockGetBusinessHours(...args),
+  listBusinessHours: (...args: unknown[]) => hoisted.mockListBusinessHours(...args),
+  createSlaPolicy: (...args: unknown[]) => hoisted.mockCreateSlaPolicy(...args),
+  updateSlaPolicy: (...args: unknown[]) => hoisted.mockUpdateSlaPolicy(...args),
+  archiveSlaPolicy: (...args: unknown[]) => hoisted.mockArchiveSlaPolicy(...args),
+  getSlaPolicy: (...args: unknown[]) => hoisted.mockGetSlaPolicy(...args),
+  listSlaPolicies: (...args: unknown[]) => hoisted.mockListSlaPolicies(...args),
+  replaceTargets: (...args: unknown[]) => hoisted.mockReplaceTargets(...args),
+  listTargetsForPolicy: (...args: unknown[]) => hoisted.mockListTargetsForPolicy(...args),
+  createEscalationRule: (...args: unknown[]) => hoisted.mockCreateEscalationRule(...args),
+  updateEscalationRule: (...args: unknown[]) => hoisted.mockUpdateEscalationRule(...args),
+  deleteEscalationRule: (...args: unknown[]) => hoisted.mockDeleteEscalationRule(...args),
+  listEscalationRulesForPolicy: (...args: unknown[]) =>
+    hoisted.mockListEscalationRulesForPolicy(...args),
+  getActiveClocksForTicket: (...args: unknown[]) => hoisted.mockGetActiveClocksForTicket(...args),
+  getAllClocksForTicket: (...args: unknown[]) => hoisted.mockGetAllClocksForTicket(...args),
+  listBreachingClocks: (...args: unknown[]) => hoisted.mockListBreachingClocks(...args),
+  runEscalationTick: (...args: unknown[]) => hoisted.mockRunEscalationTick(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  SLA_POLICY_SCOPES: ['workspace', 'team', 'inbox'],
+  SLA_TARGET_KINDS: ['first_response', 'next_response', 'resolution'],
+  ESCALATION_RECIPIENT_TYPES: ['assignee', 'team', 'principals', 'inbox_members'],
+  ESCALATION_CHANNELS: ['in_app', 'email', 'webhook'],
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+}))
+
+const PRINCIPAL = 'principal_admin' as PrincipalId
+
+await import('../sla')
+
+const [
+  listBusinessHoursFn,
+  getBusinessHoursFn,
+  createBusinessHoursFn,
+  updateBusinessHoursFn,
+  archiveBusinessHoursFn,
+  listSlaPoliciesFn,
+  getSlaPolicyFn,
+  createSlaPolicyFn,
+  updateSlaPolicyFn,
+  archiveSlaPolicyFn,
+  replaceSlaTargetsFn,
+  listEscalationRulesFn,
+  createEscalationRuleFn,
+  updateEscalationRuleFn,
+  deleteEscalationRuleFn,
+  getTicketSlaClocksFn,
+  listBreachingClocksFn,
+  runSlaTickFn,
+] = handlersByIndex
+
+if (!runSlaTickFn) {
+  throw new Error(`SLA handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+function businessHours(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'bh_1',
+    name: 'Weekdays',
+    timezone: 'UTC',
+    schedule: {
+      mon: [{ start: '09:00', end: '17:00' }],
+      tue: [],
+      wed: [],
+      thu: [],
+      fri: [],
+      sat: [],
+      sun: [],
+    },
+    holidays: [],
+    ...overrides,
+  }
+}
+
+function policy(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'sla_1',
+    name: 'Default SLA',
+    scope: 'workspace',
+    enabled: true,
+    ...overrides,
+  }
+}
+
+function escalationRule(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'esc_1',
+    policyId: 'sla_1',
+    name: 'Warn',
+    leadMinutes: 30,
+    targetKind: 'resolution',
+    recipientType: 'principals',
+    recipientPrincipalIds: ['principal_1'],
+    channels: ['in_app'],
+    enabled: true,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequirePermission.mockResolvedValue({
+    principal: { id: PRINCIPAL, role: 'admin' },
+  })
+  hoisted.mockRecordEvent.mockResolvedValue(undefined)
+})
+
+describe('SLA server functions — business hours', () => {
+  it('lists and gets business hours after requiring view permission', async () => {
+    const row = businessHours()
+    hoisted.mockListBusinessHours.mockResolvedValue([row])
+    hoisted.mockGetBusinessHours.mockResolvedValue(row)
+
+    await expect(listBusinessHoursFn({ data: { includeArchived: true } })).resolves.toEqual([row])
+    await expect(getBusinessHoursFn({ data: { id: 'bh_1' } })).resolves.toBe(row)
+
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.SLA_VIEW)
+    expect(hoisted.mockListBusinessHours).toHaveBeenCalledWith({ includeArchived: true })
+    expect(hoisted.mockGetBusinessHours).toHaveBeenCalledWith('bh_1')
+  })
+
+  it('creates, updates, and archives business hours with manage permission and audit events', async () => {
+    const row = businessHours({ name: 'Support hours' })
+    hoisted.mockCreateBusinessHours.mockResolvedValue(row)
+    hoisted.mockUpdateBusinessHours.mockResolvedValue(row)
+    hoisted.mockArchiveBusinessHours.mockResolvedValue(row)
+
+    await expect(
+      createBusinessHoursFn({
+        data: {
+          name: 'Support hours',
+          schedule: row.schedule,
+          holidays: [{ date: '2026-01-01', label: 'NYD' }],
+        },
+      })
+    ).resolves.toBe(row)
+    expect(hoisted.mockCreateBusinessHours).toHaveBeenCalledWith({
+      name: 'Support hours',
+      schedule: row.schedule,
+      holidays: [{ date: '2026-01-01', label: 'NYD' }],
+    })
+
+    await expect(
+      updateBusinessHoursFn({ data: { id: 'bh_1', name: 'Updated', timezone: 'Europe/Berlin' } })
+    ).resolves.toBe(row)
+    expect(hoisted.mockUpdateBusinessHours).toHaveBeenCalledWith('bh_1', {
+      name: 'Updated',
+      timezone: 'Europe/Berlin',
+    })
+
+    await expect(archiveBusinessHoursFn({ data: { id: 'bh_1' } })).resolves.toBe(row)
+    expect(hoisted.mockArchiveBusinessHours).toHaveBeenCalledWith('bh_1')
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.BUSINESS_HOURS_MANAGE)
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principalId: PRINCIPAL,
+        action: 'business_hours.created',
+        targetType: 'business_hours',
+        targetId: 'bh_1',
+        diff: { after: { name: 'Support hours' } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'business_hours.updated', targetId: 'bh_1' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'business_hours.archived', targetId: 'bh_1' })
+    )
+  })
+})
+
+describe('SLA server functions — policies', () => {
+  it('lists policies and composes get-policy detail with targets and escalations', async () => {
+    const row = policy()
+    const targetRows = [{ id: 'target_1', kind: 'resolution' }]
+    const escalationRows = [escalationRule()]
+    hoisted.mockListSlaPolicies.mockResolvedValue([row])
+    hoisted.mockGetSlaPolicy.mockResolvedValueOnce(null).mockResolvedValueOnce(row)
+    hoisted.mockListTargetsForPolicy.mockResolvedValue(targetRows)
+    hoisted.mockListEscalationRulesForPolicy.mockResolvedValue(escalationRows)
+
+    await expect(listSlaPoliciesFn({ data: { includeArchived: false } })).resolves.toEqual([row])
+    await expect(getSlaPolicyFn({ data: { id: 'sla_missing' } })).resolves.toBeNull()
+    await expect(getSlaPolicyFn({ data: { id: 'sla_1' } })).resolves.toEqual({
+      policy: row,
+      targets: targetRows,
+      escalations: escalationRows,
+    })
+
+    expect(hoisted.mockListSlaPolicies).toHaveBeenCalledWith({ includeArchived: false })
+    expect(hoisted.mockListTargetsForPolicy).toHaveBeenCalledWith('sla_1')
+    expect(hoisted.mockListEscalationRulesForPolicy).toHaveBeenCalledWith('sla_1')
+  })
+
+  it('creates, updates, archives, and replaces policy targets with audit events', async () => {
+    const row = policy({ name: 'Inbox SLA', scope: 'inbox' })
+    const targets = [{ id: 'target_1', kind: 'resolution' }]
+    hoisted.mockCreateSlaPolicy.mockResolvedValue(row)
+    hoisted.mockUpdateSlaPolicy.mockResolvedValue(row)
+    hoisted.mockArchiveSlaPolicy.mockResolvedValue(row)
+    hoisted.mockReplaceTargets.mockResolvedValue(targets)
+
+    await expect(
+      createSlaPolicyFn({
+        data: {
+          name: 'Inbox SLA',
+          scope: 'inbox',
+          scopeInboxId: 'inbox_1',
+          appliesToPriorities: ['urgent'],
+        },
+      })
+    ).resolves.toBe(row)
+    expect(hoisted.mockCreateSlaPolicy).toHaveBeenCalledWith({
+      name: 'Inbox SLA',
+      scope: 'inbox',
+      scopeInboxId: 'inbox_1',
+      appliesToPriorities: ['urgent'],
+    })
+
+    await expect(
+      updateSlaPolicyFn({ data: { id: 'sla_1', enabled: false, pauseOnPending: false } })
+    ).resolves.toBe(row)
+    expect(hoisted.mockUpdateSlaPolicy).toHaveBeenCalledWith('sla_1', {
+      enabled: false,
+      pauseOnPending: false,
+    })
+
+    await expect(archiveSlaPolicyFn({ data: { id: 'sla_1' } })).resolves.toBe(row)
+    await expect(
+      replaceSlaTargetsFn({
+        data: { policyId: 'sla_1', targets: [{ kind: 'resolution', minutes: 60 }] },
+      })
+    ).resolves.toBe(targets)
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.SLA_MANAGE)
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'sla_policy.created',
+        targetId: 'sla_1',
+        diff: { after: { name: 'Inbox SLA', scope: 'inbox' } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'sla_policy.targets_updated',
+        diff: { after: { count: 1 } },
+      })
+    )
+  })
+})
+
+describe('SLA server functions — escalation rules', () => {
+  it('lists escalation rules with view permission and mutates them with manage permission', async () => {
+    const row = escalationRule({ name: 'Warn agents' })
+    hoisted.mockListEscalationRulesForPolicy.mockResolvedValue([row])
+    hoisted.mockCreateEscalationRule.mockResolvedValue(row)
+    hoisted.mockUpdateEscalationRule.mockResolvedValue(row)
+    hoisted.mockDeleteEscalationRule.mockResolvedValue(undefined)
+
+    await expect(listEscalationRulesFn({ data: { policyId: 'sla_1' } })).resolves.toEqual([row])
+    await expect(
+      createEscalationRuleFn({
+        data: {
+          policyId: 'sla_1',
+          name: 'Warn agents',
+          leadMinutes: 20,
+          targetKind: 'resolution',
+          recipientType: 'principals',
+          recipientPrincipalIds: ['principal_1'],
+          channels: ['in_app', 'email'],
+        },
+      })
+    ).resolves.toBe(row)
+    await expect(
+      updateEscalationRuleFn({ data: { id: 'esc_1', leadMinutes: 10, enabled: false } })
+    ).resolves.toBe(row)
+    await expect(deleteEscalationRuleFn({ data: { id: 'esc_1' } })).resolves.toEqual({ ok: true })
+
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.ESCALATION_RULE_MANAGE)
+    expect(hoisted.mockCreateEscalationRule).toHaveBeenCalledWith({
+      policyId: 'sla_1',
+      name: 'Warn agents',
+      leadMinutes: 20,
+      targetKind: 'resolution',
+      recipientType: 'principals',
+      recipientPrincipalIds: ['principal_1'],
+      channels: ['in_app', 'email'],
+    })
+    expect(hoisted.mockUpdateEscalationRule).toHaveBeenCalledWith('esc_1', {
+      leadMinutes: 10,
+      enabled: false,
+    })
+    expect(hoisted.mockDeleteEscalationRule).toHaveBeenCalledWith('esc_1')
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'escalation_rule.created',
+        targetId: 'esc_1',
+        diff: { after: { name: 'Warn agents', leadMinutes: 30 } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'escalation_rule.deleted', targetId: 'esc_1' })
+    )
+  })
+})
+
+describe('SLA server functions — clocks and tick', () => {
+  it('returns active or all ticket clocks based on includeAll', async () => {
+    const active = [{ id: 'clock_active' }]
+    const all = [{ id: 'clock_active' }, { id: 'clock_met' }]
+    hoisted.mockGetActiveClocksForTicket.mockResolvedValue(active)
+    hoisted.mockGetAllClocksForTicket.mockResolvedValue(all)
+
+    await expect(
+      getTicketSlaClocksFn({ data: { ticketId: 'ticket_1', includeAll: false } })
+    ).resolves.toEqual(active)
+    await expect(
+      getTicketSlaClocksFn({ data: { ticketId: 'ticket_1', includeAll: true } })
+    ).resolves.toEqual(all)
+
+    expect(hoisted.mockGetActiveClocksForTicket).toHaveBeenCalledWith('ticket_1')
+    expect(hoisted.mockGetAllClocksForTicket).toHaveBeenCalledWith('ticket_1')
+  })
+
+  it('lists breaching clocks and runs the escalation tick with the correct permissions', async () => {
+    const breaching = [{ id: 'clock_due' }]
+    hoisted.mockListBreachingClocks.mockResolvedValue(breaching)
+    hoisted.mockRunEscalationTick.mockResolvedValue({ breached: 1, escalated: 2, considered: 3 })
+
+    await expect(
+      listBreachingClocksFn({ data: { windowMinutes: 30, limit: 10 } })
+    ).resolves.toEqual(breaching)
+    await expect(runSlaTickFn({ data: { batchSize: 50 } })).resolves.toEqual({
+      breached: 1,
+      escalated: 2,
+      considered: 3,
+    })
+
+    expect(hoisted.mockListBreachingClocks).toHaveBeenCalledWith({
+      windowMinutes: 30,
+      limit: 10,
+    })
+    expect(hoisted.mockRunEscalationTick).toHaveBeenCalledWith({ batchSize: 50 })
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.SLA_VIEW)
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.SLA_MANAGE)
+  })
+
+  it('does not call domain services when permission checks reject', async () => {
+    hoisted.mockRequirePermission.mockRejectedValueOnce(new Error('denied'))
+
+    await expect(listBreachingClocksFn({ data: {} })).rejects.toThrow('denied')
+
+    expect(hoisted.mockListBreachingClocks).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/teams.test.ts b/apps/web/src/lib/server/functions/__tests__/teams.test.ts
new file mode 100644
index 000000000..7bdc851a7
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/teams.test.ts
@@ -0,0 +1,229 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequirePermission: vi.fn(),
+  mockCreateTeam: vi.fn(),
+  mockUpdateTeam: vi.fn(),
+  mockArchiveTeam: vi.fn(),
+  mockUnarchiveTeam: vi.fn(),
+  mockGetTeam: vi.fn(),
+  mockListTeams: vi.fn(),
+  mockAddMember: vi.fn(),
+  mockRemoveMember: vi.fn(),
+  mockListMembers: vi.fn(),
+  mockRecordEvent: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requirePermission: (...args: unknown[]) => hoisted.mockRequirePermission(...args),
+}))
+
+vi.mock('@/lib/server/domains/teams', () => ({
+  createTeam: (...args: unknown[]) => hoisted.mockCreateTeam(...args),
+  updateTeam: (...args: unknown[]) => hoisted.mockUpdateTeam(...args),
+  archiveTeam: (...args: unknown[]) => hoisted.mockArchiveTeam(...args),
+  unarchiveTeam: (...args: unknown[]) => hoisted.mockUnarchiveTeam(...args),
+  getTeam: (...args: unknown[]) => hoisted.mockGetTeam(...args),
+  listTeams: (...args: unknown[]) => hoisted.mockListTeams(...args),
+  addMember: (...args: unknown[]) => hoisted.mockAddMember(...args),
+  removeMember: (...args: unknown[]) => hoisted.mockRemoveMember(...args),
+  listMembers: (...args: unknown[]) => hoisted.mockListMembers(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.mockRecordEvent(...args),
+}))
+
+await import('../teams')
+
+const [
+  listTeamsFn,
+  getTeamFn,
+  createTeamFn,
+  updateTeamFn,
+  archiveTeamFn,
+  unarchiveTeamFn,
+  listTeamMembersFn,
+  addTeamMemberFn,
+  removeTeamMemberFn,
+] = handlersByIndex
+
+if (!removeTeamMemberFn) {
+  throw new Error(`team handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+const ctx = {
+  principal: { id: 'principal_admin' },
+  user: { id: 'user_admin' },
+}
+
+function team(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'team_support',
+    slug: 'support',
+    name: 'Support',
+    description: 'Customer support',
+    shortLabel: 'SUP',
+    color: '#123456',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequirePermission.mockResolvedValue(ctx)
+  hoisted.mockListTeams.mockResolvedValue([team()])
+  hoisted.mockGetTeam.mockResolvedValue(team({ name: 'Before' }))
+  hoisted.mockCreateTeam.mockResolvedValue(team({ name: 'Created' }))
+  hoisted.mockUpdateTeam.mockResolvedValue(team({ name: 'Updated' }))
+  hoisted.mockArchiveTeam.mockResolvedValue(undefined)
+  hoisted.mockUnarchiveTeam.mockResolvedValue(undefined)
+  hoisted.mockListMembers.mockResolvedValue([{ principalId: 'principal_agent' }])
+  hoisted.mockAddMember.mockResolvedValue({
+    teamId: 'team_support',
+    principalId: 'principal_agent',
+  })
+  hoisted.mockRemoveMember.mockResolvedValue(undefined)
+  hoisted.mockRecordEvent.mockResolvedValue(undefined)
+})
+
+describe('team server functions', () => {
+  it('runs team read functions behind admin.manage_users', async () => {
+    await expect(listTeamsFn({ data: { includeArchived: true } })).resolves.toEqual([team()])
+    expect(hoisted.mockListTeams).toHaveBeenCalledWith({ includeArchived: true })
+
+    await expect(getTeamFn({ data: { teamId: 'team_support' } })).resolves.toEqual(
+      team({ name: 'Before' })
+    )
+    expect(hoisted.mockGetTeam).toHaveBeenCalledWith('team_support')
+
+    await expect(listTeamMembersFn({ data: { teamId: 'team_support' } })).resolves.toEqual([
+      { principalId: 'principal_agent' },
+    ])
+    expect(hoisted.mockListMembers).toHaveBeenCalledWith('team_support')
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.ADMIN_MANAGE_USERS)
+  })
+
+  it('creates, updates, archives, and unarchives teams with audit events', async () => {
+    await expect(
+      createTeamFn({
+        data: {
+          slug: 'support',
+          name: 'Created',
+          description: 'Customer support',
+          shortLabel: 'SUP',
+          color: '#123456',
+        },
+      })
+    ).resolves.toEqual(team({ name: 'Created' }))
+    expect(hoisted.mockCreateTeam).toHaveBeenCalledWith(
+      {
+        slug: 'support',
+        name: 'Created',
+        description: 'Customer support',
+        shortLabel: 'SUP',
+        color: '#123456',
+      },
+      { principalId: 'principal_admin', userId: 'user_admin' }
+    )
+
+    await expect(
+      updateTeamFn({ data: { teamId: 'team_support', name: 'Updated', color: '#654321' } })
+    ).resolves.toEqual(team({ name: 'Updated' }))
+    expect(hoisted.mockUpdateTeam).toHaveBeenCalledWith(
+      'team_support',
+      { teamId: 'team_support', name: 'Updated', color: '#654321' },
+      { principalId: 'principal_admin', userId: 'user_admin' }
+    )
+
+    await expect(archiveTeamFn({ data: { teamId: 'team_support' } })).resolves.toEqual({
+      ok: true,
+    })
+    await expect(unarchiveTeamFn({ data: { teamId: 'team_support' } })).resolves.toEqual({
+      ok: true,
+    })
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'team.created', targetId: 'team_support' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'team.updated', targetId: 'team_support' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'team.archived', targetId: 'team_support' })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'team.unarchived', targetId: 'team_support' })
+    )
+  })
+
+  it('records team updates with no before diff when the team did not exist', async () => {
+    hoisted.mockGetTeam.mockResolvedValueOnce(null)
+
+    await updateTeamFn({ data: { teamId: 'team_support', name: 'Updated' } })
+
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'team.updated',
+        diff: expect.objectContaining({ before: undefined }),
+      })
+    )
+  })
+
+  it('adds and removes team members with audit context', async () => {
+    await expect(
+      addTeamMemberFn({
+        data: { teamId: 'team_support', principalId: 'principal_agent', role: 'lead' },
+      })
+    ).resolves.toEqual({ teamId: 'team_support', principalId: 'principal_agent' })
+    expect(hoisted.mockAddMember).toHaveBeenCalledWith('team_support', 'principal_agent', 'lead')
+
+    await expect(
+      removeTeamMemberFn({ data: { teamId: 'team_support', principalId: 'principal_agent' } })
+    ).resolves.toEqual({ ok: true })
+    expect(hoisted.mockRemoveMember).toHaveBeenCalledWith('team_support', 'principal_agent')
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'team.member_added',
+        diff: { after: { principalId: 'principal_agent', role: 'lead' } },
+      })
+    )
+    expect(hoisted.mockRecordEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'team.member_removed',
+        diff: { before: { principalId: 'principal_agent' } },
+      })
+    )
+  })
+
+  it('does not call team domains when permission is denied', async () => {
+    hoisted.mockRequirePermission.mockRejectedValueOnce(new Error('admin.manage_users required'))
+
+    await expect(listTeamsFn({ data: {} })).rejects.toThrow('admin.manage_users required')
+
+    expect(hoisted.mockListTeams).not.toHaveBeenCalled()
+    expect(hoisted.mockCreateTeam).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/tickets-update-schema.test.ts b/apps/web/src/lib/server/functions/__tests__/tickets-update-schema.test.ts
new file mode 100644
index 000000000..f807e0d35
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/tickets-update-schema.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const ticketsSource = readFileSync(resolve(__dirname, '../tickets.ts'), 'utf8')
+
+function updateTicketFnSource() {
+  const match = ticketsSource.match(
+    /export const updateTicketFn = createServerFn\([\s\S]*?\/\/ ---------- assign ----------/
+  )
+  if (!match) throw new Error('updateTicketFn block not found')
+  return match[0]
+}
+
+describe('updateTicketFn input schema', () => {
+  it('keeps description fields in the admin update mutation validator', () => {
+    const source = updateTicketFnSource()
+
+    expect(source).toContain('descriptionJson: tiptapDocSchema.nullable().optional()')
+    expect(source).toContain('descriptionText: z.string().max(100_000).nullable().optional()')
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/tickets.test.ts b/apps/web/src/lib/server/functions/__tests__/tickets.test.ts
new file mode 100644
index 000000000..61cc6ead8
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/tickets.test.ts
@@ -0,0 +1,677 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PrincipalId, TeamId, TicketId } from '@quackback/ids'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { ForbiddenError } from '@/lib/shared/errors'
+
+type HandlerArgs = { data: Record<string, unknown> }
+type AnyHandler = (args: HandlerArgs) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequireAuthWithPermissions: vi.fn(),
+  mockRequirePermission: vi.fn(),
+  mockListTickets: vi.fn(),
+  mockCreateTicket: vi.fn(),
+  mockGetTicket: vi.fn(),
+  mockUpdateTicket: vi.fn(),
+  mockAssignTicket: vi.fn(),
+  mockTransitionStatus: vi.fn(),
+  mockSoftDeleteTicket: vi.fn(),
+  mockAddThread: vi.fn(),
+  mockListThreads: vi.fn(),
+  mockShareTicketWithTeam: vi.fn(),
+  mockRevokeShare: vi.fn(),
+  mockListSharesForTicket: vi.fn(),
+  mockAddParticipant: vi.fn(),
+  mockRemoveParticipant: vi.fn(),
+  mockListParticipants: vi.fn(),
+  mockToResourceScope: vi.fn(),
+  mockCanViewTicket: vi.fn(),
+  mockCanReplyPublic: vi.fn(),
+  mockCanCommentInternal: vi.fn(),
+  mockCanEditFields: vi.fn(),
+  mockCanAssign: vi.fn(),
+  mockCanAssignSelf: vi.fn(),
+  mockCanShareCrossTeam: vi.fn(),
+  mockCanManageParticipants: vi.fn(),
+  mockTakeTicket: vi.fn(),
+  mockReturnTicket: vi.fn(),
+  mockBulkAssign: vi.fn(),
+  mockBulkTransition: vi.fn(),
+  mockBulkChangeInbox: vi.fn(),
+  mockListTicketStatuses: vi.fn(),
+  mockHasPermissionForResource: vi.fn(),
+  mockDbSelect: vi.fn(),
+  mockEq: vi.fn(),
+  mockAnd: vi.fn(),
+  mockLt: vi.fn(),
+  mockDesc: vi.fn(),
+  mockInArray: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requireAuthWithPermissions: hoisted.mockRequireAuthWithPermissions,
+  requirePermission: hoisted.mockRequirePermission,
+}))
+
+vi.mock('@/lib/server/domains/tickets', () => ({
+  createTicket: hoisted.mockCreateTicket,
+  getTicket: hoisted.mockGetTicket,
+  updateTicket: hoisted.mockUpdateTicket,
+  assignTicket: hoisted.mockAssignTicket,
+  transitionStatus: hoisted.mockTransitionStatus,
+  softDeleteTicket: hoisted.mockSoftDeleteTicket,
+  addThread: hoisted.mockAddThread,
+  listThreads: hoisted.mockListThreads,
+  shareTicketWithTeam: hoisted.mockShareTicketWithTeam,
+  revokeShare: hoisted.mockRevokeShare,
+  listSharesForTicket: hoisted.mockListSharesForTicket,
+  addParticipant: hoisted.mockAddParticipant,
+  removeParticipant: hoisted.mockRemoveParticipant,
+  listParticipants: hoisted.mockListParticipants,
+  listTickets: hoisted.mockListTickets,
+  toResourceScope: hoisted.mockToResourceScope,
+  canViewTicket: hoisted.mockCanViewTicket,
+  canReplyPublic: hoisted.mockCanReplyPublic,
+  canCommentInternal: hoisted.mockCanCommentInternal,
+  canEditFields: hoisted.mockCanEditFields,
+  canAssign: hoisted.mockCanAssign,
+  canAssignSelf: hoisted.mockCanAssignSelf,
+  canShareCrossTeam: hoisted.mockCanShareCrossTeam,
+  canManageParticipants: hoisted.mockCanManageParticipants,
+  takeTicket: hoisted.mockTakeTicket,
+  returnTicket: hoisted.mockReturnTicket,
+  bulkAssign: hoisted.mockBulkAssign,
+  bulkTransition: hoisted.mockBulkTransition,
+  bulkChangeInbox: hoisted.mockBulkChangeInbox,
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket-statuses.service', () => ({
+  listTicketStatuses: hoisted.mockListTicketStatuses,
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  hasPermissionForResource: hoisted.mockHasPermissionForResource,
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  TICKET_CHANNELS: ['web', 'email', 'chat', 'api'],
+  TICKET_VISIBILITY_SCOPES: ['workspace', 'team', 'private'],
+  TICKET_THREAD_AUDIENCES: ['public', 'internal', 'shared_team'],
+  TICKET_SHARE_LEVELS: ['read', 'comment'],
+  TICKET_PARTICIPANT_ROLES: ['requester', 'cc', 'follower'],
+  db: {
+    select: (...args: unknown[]) => hoisted.mockDbSelect(...args),
+  },
+  ticketActivity: {
+    id: 'ticketActivity.id',
+    ticketId: 'ticketActivity.ticketId',
+    principalId: 'ticketActivity.principalId',
+    type: 'ticketActivity.type',
+    metadata: 'ticketActivity.metadata',
+    createdAt: 'ticketActivity.createdAt',
+  },
+  principal: {
+    id: 'principal.id',
+    displayName: 'principal.displayName',
+    avatarUrl: 'principal.avatarUrl',
+  },
+  eq: (...args: unknown[]) => hoisted.mockEq(...args),
+  and: (...args: unknown[]) => hoisted.mockAnd(...args),
+  lt: (...args: unknown[]) => hoisted.mockLt(...args),
+  desc: (...args: unknown[]) => hoisted.mockDesc(...args),
+  inArray: (...args: unknown[]) => hoisted.mockInArray(...args),
+}))
+
+const PRINCIPAL = 'principal_agent' as PrincipalId
+const OTHER_PRINCIPAL = 'principal_other' as PrincipalId
+const TICKET = 'ticket_123' as TicketId
+const TEAM = 'team_support' as TeamId
+const RESOURCE_SCOPE = { kind: 'ticket-scope', teamId: TEAM }
+const PERMISSION_SET = { teamIds: [TEAM], permissions: new Set<string>() }
+
+await import('../tickets')
+
+const [
+  listTicketsFn,
+  createTicketFn,
+  getTicketFn,
+  updateTicketFn,
+  assignTicketFn,
+  transitionTicketStatusFn,
+  softDeleteTicketFn,
+  addThreadFn,
+  listThreadsFn,
+  shareTicketFn,
+  revokeShareFn,
+  listSharesFn,
+  addParticipantFn,
+  removeParticipantFn,
+  listParticipantsFn,
+  takeTicketFn,
+  returnTicketFn,
+  bulkAssignTicketsFn,
+  bulkTransitionTicketsFn,
+  bulkChangeInboxFn,
+  listTicketStatusesFn,
+  listTicketActivityFn,
+  manualSyncTicketFn,
+  createTicketInitialThreadFn,
+] = handlersByIndex
+
+if (!createTicketInitialThreadFn) {
+  throw new Error(`tickets handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+function ticketRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: TICKET,
+    subject: 'Need help',
+    primaryTeamId: TEAM,
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    requesterPrincipalId: OTHER_PRINCIPAL,
+    ...overrides,
+  }
+}
+
+function authContext() {
+  return {
+    principal: { id: PRINCIPAL, role: 'member' },
+    permissions: PERMISSION_SET,
+  }
+}
+
+function principalSelectChain(rows: readonly Record<string, unknown>[]) {
+  const where = vi.fn().mockResolvedValue(rows)
+  const from = vi.fn(() => ({ where }))
+  return { from, where }
+}
+
+function activitySelectChain(rows: readonly Record<string, unknown>[]) {
+  const chain = {
+    from: vi.fn(),
+    leftJoin: vi.fn(),
+    where: vi.fn(),
+    orderBy: vi.fn(),
+    limit: vi.fn().mockResolvedValue(rows),
+  }
+  chain.from.mockReturnValue(chain)
+  chain.leftJoin.mockReturnValue(chain)
+  chain.where.mockReturnValue(chain)
+  chain.orderBy.mockReturnValue(chain)
+  return chain
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequireAuthWithPermissions.mockResolvedValue(authContext())
+  hoisted.mockRequirePermission.mockResolvedValue(authContext())
+  hoisted.mockGetTicket.mockResolvedValue(ticketRow())
+  hoisted.mockListSharesForTicket.mockResolvedValue([])
+  hoisted.mockToResourceScope.mockReturnValue(RESOURCE_SCOPE)
+  hoisted.mockCanViewTicket.mockReturnValue(true)
+  hoisted.mockCanReplyPublic.mockReturnValue(true)
+  hoisted.mockCanCommentInternal.mockReturnValue(true)
+  hoisted.mockCanEditFields.mockReturnValue(true)
+  hoisted.mockCanAssign.mockReturnValue(true)
+  hoisted.mockCanAssignSelf.mockReturnValue(false)
+  hoisted.mockCanShareCrossTeam.mockReturnValue(true)
+  hoisted.mockCanManageParticipants.mockReturnValue(true)
+  hoisted.mockHasPermissionForResource.mockReturnValue(true)
+})
+
+describe('ticket queue and create server functions', () => {
+  it('lists tickets with permission context and normalized optional filters', async () => {
+    hoisted.mockListTickets.mockResolvedValue([{ id: TICKET }])
+
+    const result = await listTicketsFn({
+      data: {
+        scope: 'my_team',
+        statusCategory: 'open',
+        search: 'billing',
+        inboxId: null,
+        organizationId: null,
+        requesterContactId: null,
+        limit: 25,
+        offset: 5,
+        sort: 'created_desc',
+      },
+    })
+
+    expect(result).toEqual([{ id: TICKET }])
+    expect(hoisted.mockListTickets).toHaveBeenCalledWith({
+      scope: 'my_team',
+      permissionSet: PERMISSION_SET,
+      statusCategory: 'open',
+      search: 'billing',
+      inboxId: undefined,
+      organizationId: undefined,
+      requesterContactId: undefined,
+      limit: 25,
+      offset: 5,
+      sort: 'created_desc',
+    })
+  })
+
+  it('creates tickets as the authenticated requester after edit-field permission passes', async () => {
+    hoisted.mockCreateTicket.mockResolvedValue(ticketRow({ subject: 'Created' }))
+
+    const result = await createTicketFn({
+      data: {
+        subject: 'Created',
+        descriptionText: 'Details',
+        priority: 'normal',
+        channel: 'web',
+      },
+    })
+
+    expect(result).toMatchObject({ subject: 'Created' })
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.TICKET_EDIT_FIELDS)
+    expect(hoisted.mockCreateTicket).toHaveBeenCalledWith(
+      expect.objectContaining({
+        subject: 'Created',
+        descriptionJson: null,
+        createdByPrincipalId: PRINCIPAL,
+        requesterPrincipalId: PRINCIPAL,
+      })
+    )
+  })
+})
+
+describe('ticket read and update server functions', () => {
+  it('loads shares into the resource scope before returning a ticket', async () => {
+    hoisted.mockListSharesForTicket.mockResolvedValue([{ teamId: TEAM, revokedAt: null }])
+
+    const result = await getTicketFn({ data: { ticketId: TICKET } })
+
+    expect(result).toMatchObject({ id: TICKET })
+    expect(hoisted.mockToResourceScope).toHaveBeenCalledWith({
+      primaryTeamId: TEAM,
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+      shares: [{ teamId: TEAM, revokedAt: null }],
+    })
+    expect(hoisted.mockCanViewTicket).toHaveBeenCalledWith(PERMISSION_SET, RESOURCE_SCOPE)
+  })
+
+  it('denies ticket reads before returning data when the actor cannot view the scope', async () => {
+    hoisted.mockCanViewTicket.mockReturnValue(false)
+
+    await expect(getTicketFn({ data: { ticketId: TICKET } })).rejects.toBeInstanceOf(ForbiddenError)
+  })
+
+  it('updates tickets with conflict timestamp and actor metadata when edit is allowed', async () => {
+    hoisted.mockUpdateTicket.mockResolvedValue(ticketRow({ subject: 'Updated' }))
+
+    await updateTicketFn({
+      data: {
+        ticketId: TICKET,
+        expectedUpdatedAt: '2026-03-01T00:00:00.000Z',
+        subject: 'Updated',
+      },
+    })
+
+    expect(hoisted.mockUpdateTicket).toHaveBeenCalledWith(
+      TICKET,
+      expect.objectContaining({
+        subject: 'Updated',
+        expectedUpdatedAt: new Date('2026-03-01T00:00:00.000Z'),
+        actorPrincipalId: PRINCIPAL,
+        allowStaleFieldUpdate: true,
+      })
+    )
+  })
+
+  it('denies updates before calling the mutation when edit permission fails', async () => {
+    hoisted.mockCanEditFields.mockReturnValue(false)
+
+    await expect(
+      updateTicketFn({
+        data: { ticketId: TICKET, expectedUpdatedAt: '2026-03-01T00:00:00.000Z' },
+      })
+    ).rejects.toBeInstanceOf(ForbiddenError)
+
+    expect(hoisted.mockUpdateTicket).not.toHaveBeenCalled()
+  })
+})
+
+describe('assignment and status server functions', () => {
+  it('allows self-assignment through the assign-self fallback', async () => {
+    hoisted.mockCanAssign.mockReturnValue(false)
+    hoisted.mockCanAssignSelf.mockReturnValue(true)
+    hoisted.mockAssignTicket.mockResolvedValue(ticketRow({ assigneePrincipalId: PRINCIPAL }))
+
+    await assignTicketFn({
+      data: {
+        ticketId: TICKET,
+        expectedUpdatedAt: '2026-03-01T00:00:00.000Z',
+        assigneePrincipalId: PRINCIPAL,
+      },
+    })
+
+    expect(hoisted.mockCanAssignSelf).toHaveBeenCalledWith(PERMISSION_SET, RESOURCE_SCOPE)
+    expect(hoisted.mockAssignTicket).toHaveBeenCalledWith(
+      TICKET,
+      expect.objectContaining({
+        actorPrincipalId: PRINCIPAL,
+        assigneePrincipalId: PRINCIPAL,
+        assigneeTeamId: null,
+      })
+    )
+  })
+
+  it('denies assigning another principal when assign-any is missing', async () => {
+    hoisted.mockCanAssign.mockReturnValue(false)
+
+    await expect(
+      assignTicketFn({
+        data: {
+          ticketId: TICKET,
+          expectedUpdatedAt: '2026-03-01T00:00:00.000Z',
+          assigneePrincipalId: OTHER_PRINCIPAL,
+        },
+      })
+    ).rejects.toBeInstanceOf(ForbiddenError)
+
+    expect(hoisted.mockCanAssignSelf).not.toHaveBeenCalled()
+    expect(hoisted.mockAssignTicket).not.toHaveBeenCalled()
+  })
+
+  it('transitions status and soft-deletes through edit-field authorization', async () => {
+    await transitionTicketStatusFn({
+      data: {
+        ticketId: TICKET,
+        expectedUpdatedAt: '2026-03-01T00:00:00.000Z',
+        statusId: 'status_solved',
+      },
+    })
+    await softDeleteTicketFn({ data: { ticketId: TICKET } })
+
+    expect(hoisted.mockTransitionStatus).toHaveBeenCalledWith(
+      TICKET,
+      expect.objectContaining({
+        actorPrincipalId: PRINCIPAL,
+        statusId: 'status_solved',
+      })
+    )
+    expect(hoisted.mockSoftDeleteTicket).toHaveBeenCalledWith(TICKET, PRINCIPAL)
+  })
+})
+
+describe('thread server functions', () => {
+  it('adds public threads only when public reply permission passes', async () => {
+    hoisted.mockAddThread.mockResolvedValue({ id: 'thread_public' })
+
+    await addThreadFn({
+      data: {
+        ticketId: TICKET,
+        audience: 'public',
+        bodyText: 'Reply',
+      },
+    })
+
+    expect(hoisted.mockCanReplyPublic).toHaveBeenCalledWith(PERMISSION_SET, RESOURCE_SCOPE)
+    expect(hoisted.mockAddThread).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      principalId: PRINCIPAL,
+      audience: 'public',
+      bodyJson: null,
+      bodyText: 'Reply',
+      sharedWithTeamId: null,
+    })
+  })
+
+  it('denies internal comments when the actor cannot comment internally', async () => {
+    hoisted.mockCanCommentInternal.mockReturnValue(false)
+
+    await expect(
+      addThreadFn({ data: { ticketId: TICKET, audience: 'internal', bodyText: 'Private' } })
+    ).rejects.toBeInstanceOf(ForbiddenError)
+  })
+
+  it('denies shared-team notes when cross-team sharing is unavailable', async () => {
+    hoisted.mockCanShareCrossTeam.mockReturnValue(false)
+
+    await expect(
+      addThreadFn({
+        data: {
+          ticketId: TICKET,
+          audience: 'shared_team',
+          bodyText: 'Shared note',
+          sharedWithTeamId: TEAM,
+        },
+      })
+    ).rejects.toBeInstanceOf(ForbiddenError)
+  })
+
+  it('lists visible threads with viewer flags and principal display names', async () => {
+    hoisted.mockGetTicket.mockResolvedValue(ticketRow({ requesterPrincipalId: PRINCIPAL }))
+    hoisted.mockListThreads.mockResolvedValue([
+      { id: 'thread_1', principalId: PRINCIPAL },
+      { id: 'thread_2', principalId: OTHER_PRINCIPAL },
+      { id: 'thread_3', principalId: null },
+    ])
+    hoisted.mockDbSelect.mockReturnValueOnce(
+      principalSelectChain([{ id: PRINCIPAL, displayName: ' Agent Smith ' }])
+    )
+
+    const result = await listThreadsFn({ data: { ticketId: TICKET } })
+
+    expect(hoisted.mockListThreads).toHaveBeenCalledWith(TICKET, {
+      viewerTeamIds: [TEAM],
+      canSeeInternal: true,
+      isRequester: true,
+    })
+    expect(result).toEqual([
+      { id: 'thread_1', principalId: PRINCIPAL, principalName: 'Agent Smith' },
+      { id: 'thread_2', principalId: OTHER_PRINCIPAL, principalName: 'Unknown' },
+      { id: 'thread_3', principalId: null, principalName: null },
+    ])
+  })
+})
+
+describe('share and participant server functions', () => {
+  it('shares tickets only when cross-team sharing is allowed', async () => {
+    hoisted.mockShareTicketWithTeam.mockResolvedValue({ id: 'share_1' })
+
+    await shareTicketFn({
+      data: { ticketId: TICKET, teamId: TEAM, accessLevel: 'comment' },
+    })
+
+    expect(hoisted.mockShareTicketWithTeam).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      teamId: TEAM,
+      accessLevel: 'comment',
+      grantedByPrincipalId: PRINCIPAL,
+    })
+  })
+
+  it('denies listing shares when the ticket is not visible', async () => {
+    hoisted.mockCanViewTicket.mockReturnValue(false)
+
+    await expect(listSharesFn({ data: { ticketId: TICKET } })).rejects.toBeInstanceOf(
+      ForbiddenError
+    )
+  })
+
+  it('revokes shares with the authenticated actor id', async () => {
+    await revokeShareFn({ data: { shareId: 'share_1' } })
+
+    expect(hoisted.mockRevokeShare).toHaveBeenCalledWith('share_1', PRINCIPAL)
+  })
+
+  it('adds, removes, and lists participants through the participant gate', async () => {
+    hoisted.mockAddParticipant.mockResolvedValue({ id: 'participant_1' })
+    hoisted.mockListParticipants.mockResolvedValue([{ id: 'participant_1' }])
+
+    await addParticipantFn({
+      data: {
+        ticketId: TICKET,
+        role: 'cc',
+        principalId: OTHER_PRINCIPAL,
+      },
+    })
+    const listed = await listParticipantsFn({ data: { ticketId: TICKET } })
+    const removed = await removeParticipantFn({
+      data: { ticketId: TICKET, participantId: 'participant_1' },
+    })
+
+    expect(hoisted.mockAddParticipant).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      role: 'cc',
+      principalId: OTHER_PRINCIPAL,
+      contactId: null,
+      addedByPrincipalId: PRINCIPAL,
+    })
+    expect(listed).toEqual([{ id: 'participant_1' }])
+    expect(removed).toEqual({ ok: true })
+    expect(hoisted.mockRemoveParticipant).toHaveBeenCalledWith('participant_1', PRINCIPAL)
+  })
+})
+
+describe('take, return, bulk, and catalogue server functions', () => {
+  it('gates take and return on resource-scoped assignment permissions', async () => {
+    hoisted.mockHasPermissionForResource.mockImplementation(
+      (_set, permission) => permission === PERMISSIONS.TICKET_ASSIGN_SELF
+    )
+    hoisted.mockTakeTicket.mockResolvedValue(ticketRow({ assigneePrincipalId: PRINCIPAL }))
+    hoisted.mockReturnTicket.mockResolvedValue(ticketRow({ assigneePrincipalId: null }))
+
+    await takeTicketFn({ data: { ticketId: TICKET } })
+    await returnTicketFn({ data: { ticketId: TICKET } })
+
+    expect(hoisted.mockTakeTicket).toHaveBeenCalledWith(TICKET, PRINCIPAL)
+    expect(hoisted.mockReturnTicket).toHaveBeenCalledWith(TICKET, PRINCIPAL)
+  })
+
+  it('denies returning a ticket when neither self nor assign-any permission matches', async () => {
+    hoisted.mockHasPermissionForResource.mockReturnValue(false)
+
+    await expect(returnTicketFn({ data: { ticketId: TICKET } })).rejects.toBeInstanceOf(
+      ForbiddenError
+    )
+
+    expect(hoisted.mockReturnTicket).not.toHaveBeenCalled()
+  })
+
+  it('passes resource permit callbacks into bulk ticket operations', async () => {
+    hoisted.mockHasPermissionForResource.mockImplementation(
+      (_set, permission) => permission === PERMISSIONS.TICKET_ASSIGN_ANY
+    )
+    hoisted.mockBulkAssign.mockImplementation(async (input) => ({
+      permitted: input.permit(RESOURCE_SCOPE),
+    }))
+    hoisted.mockBulkTransition.mockImplementation(async (input) => ({
+      permitted: input.permit(RESOURCE_SCOPE),
+    }))
+    hoisted.mockBulkChangeInbox.mockImplementation(async (input) => ({
+      permitted: input.permit(RESOURCE_SCOPE),
+    }))
+
+    const assign = await bulkAssignTicketsFn({
+      data: { ticketIds: [TICKET], assigneePrincipalId: OTHER_PRINCIPAL },
+    })
+    const transition = await bulkTransitionTicketsFn({
+      data: { ticketIds: [TICKET], statusId: 'status_pending' },
+    })
+    const inbox = await bulkChangeInboxFn({
+      data: { ticketIds: [TICKET], inboxId: null },
+    })
+
+    expect(assign).toEqual({ permitted: true })
+    expect(transition).toEqual({ permitted: false })
+    expect(inbox).toEqual({ permitted: false })
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.TICKET_BULK_OPERATE)
+  })
+
+  it('lists ticket statuses after authenticating', async () => {
+    hoisted.mockListTicketStatuses.mockResolvedValue([{ id: 'status_open' }])
+
+    const result = await listTicketStatusesFn({ data: {} })
+
+    expect(result).toEqual([{ id: 'status_open' }])
+    expect(hoisted.mockRequireAuthWithPermissions).toHaveBeenCalled()
+  })
+})
+
+describe('ticket activity and helper server functions', () => {
+  it('lists activity with before cursor filtering and actor fields', async () => {
+    const rows = [
+      {
+        id: 'activity_1',
+        ticketId: TICKET,
+        principalId: PRINCIPAL,
+        type: 'ticket.updated',
+        metadata: { subject: 'Updated' },
+        createdAt: new Date('2026-03-01T00:00:00.000Z'),
+        actorName: 'Agent',
+        actorAvatarUrl: null,
+      },
+    ]
+    const chain = activitySelectChain(rows)
+    hoisted.mockDbSelect.mockReturnValueOnce(chain)
+
+    const result = await listTicketActivityFn({
+      data: {
+        ticketId: TICKET,
+        before: '2026-03-02T00:00:00.000Z',
+        limit: 10,
+      },
+    })
+
+    expect(result).toEqual(rows)
+    expect(chain.limit).toHaveBeenCalledWith(10)
+    expect(hoisted.mockLt).toHaveBeenCalledWith(
+      'ticketActivity.createdAt',
+      new Date('2026-03-02T00:00:00.000Z')
+    )
+  })
+
+  it('returns the manual sync not-implemented response after edit permission passes', async () => {
+    const result = await manualSyncTicketFn({
+      data: {
+        ticketId: TICKET,
+        integrationId: 'integration_1',
+        direction: 'push',
+      },
+    })
+
+    expect(result).toEqual({ success: false, error: 'Manual sync not yet implemented' })
+    expect(hoisted.mockRequirePermission).toHaveBeenCalledWith(PERMISSIONS.TICKET_EDIT_FIELDS)
+  })
+
+  it('creates an initial public thread for ticket creation attachments', async () => {
+    hoisted.mockAddThread.mockResolvedValue({ id: 'thread_initial' })
+
+    const result = await createTicketInitialThreadFn({ data: { ticketId: TICKET } })
+
+    expect(result).toEqual({ id: 'thread_initial' })
+    expect(hoisted.mockAddThread).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      principalId: PRINCIPAL,
+      audience: 'public',
+      bodyText: '[Attachments added at ticket creation]',
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/functions/__tests__/webhook-deliveries.test.ts b/apps/web/src/lib/server/functions/__tests__/webhook-deliveries.test.ts
new file mode 100644
index 000000000..e5c75128c
--- /dev/null
+++ b/apps/web/src/lib/server/functions/__tests__/webhook-deliveries.test.ts
@@ -0,0 +1,158 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+type AnyHandler = (args: { data: Record<string, unknown> }) => Promise<unknown>
+
+const handlersByIndex: AnyHandler[] = []
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      inputValidator() {
+        return chain
+      },
+      validator() {
+        return chain
+      },
+      handler(fn: AnyHandler) {
+        handlersByIndex.push(fn)
+        return chain
+      },
+    }
+    return chain
+  },
+}))
+
+const hoisted = vi.hoisted(() => ({
+  mockRequireAuth: vi.fn(),
+  mockListDeliveriesForWebhook: vi.fn(),
+}))
+
+vi.mock('@/lib/server/functions/auth-helpers', () => ({
+  requireAuth: (...args: unknown[]) => hoisted.mockRequireAuth(...args),
+}))
+
+vi.mock('@/lib/server/domains/webhooks/webhook.deliveries', () => ({
+  listDeliveriesForWebhook: (...args: unknown[]) => hoisted.mockListDeliveriesForWebhook(...args),
+}))
+
+await import('../webhook-deliveries')
+
+const [listWebhookDeliveriesFn] = handlersByIndex
+
+if (!listWebhookDeliveriesFn) {
+  throw new Error(`webhook delivery handlers were not registered; found ${handlersByIndex.length}`)
+}
+
+function delivery(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'webhook_delivery_123',
+    webhookId: 'webhook_123',
+    eventId: 'event_123',
+    eventType: 'ticket.created',
+    attemptNumber: 1,
+    status: 'failed_retryable',
+    httpStatus: 500,
+    errorMessage: 'server error',
+    requestUrl: 'https://example.test/webhook',
+    requestPayloadBytes: 120,
+    responseBodySnippet: 'oops',
+    latencyMs: 42,
+    signatureTimestamp: 1_766_000_000,
+    attemptedAt: new Date('2026-01-01T00:00:00.000Z'),
+    nextRetryAt: new Date('2026-01-01T00:05:00.000Z'),
+    requestPayloadJson: { id: 'event_123' },
+    requestPayloadTruncated: false,
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.mockRequireAuth.mockResolvedValue({ user: { id: 'user_admin' } })
+})
+
+describe('listWebhookDeliveriesFn', () => {
+  it('lists deliveries with cursor, next cursor, ISO dates, and redelivery eligibility', async () => {
+    const rows = [
+      delivery({ id: 'webhook_delivery_1' }),
+      delivery({
+        id: 'webhook_delivery_2',
+        attemptedAt: new Date('2026-01-01T00:01:00.000Z'),
+        nextRetryAt: null,
+        status: 'success',
+        requestPayloadJson: null,
+      }),
+    ]
+    hoisted.mockListDeliveriesForWebhook.mockResolvedValue(rows)
+
+    const result = await listWebhookDeliveriesFn({
+      data: {
+        webhookId: 'webhook_123',
+        limit: 2,
+        status: 'failed_retryable',
+        cursorAttemptedAt: '2026-01-01T00:00:00.000Z',
+        cursorId: 'webhook_delivery_0',
+      },
+    })
+
+    expect(hoisted.mockRequireAuth).toHaveBeenCalledWith({ roles: ['admin'] })
+    expect(hoisted.mockListDeliveriesForWebhook).toHaveBeenCalledWith('webhook_123', {
+      cursor: {
+        attemptedAt: new Date('2026-01-01T00:00:00.000Z'),
+        id: 'webhook_delivery_0',
+      },
+      limit: 2,
+      statusFilter: 'failed_retryable',
+    })
+    expect(result).toEqual({
+      deliveries: [
+        expect.objectContaining({
+          id: 'webhook_delivery_1',
+          attemptedAt: '2026-01-01T00:00:00.000Z',
+          nextRetryAt: '2026-01-01T00:05:00.000Z',
+          canRedeliver: true,
+        }),
+        expect.objectContaining({
+          id: 'webhook_delivery_2',
+          attemptedAt: '2026-01-01T00:01:00.000Z',
+          nextRetryAt: null,
+          canRedeliver: false,
+        }),
+      ],
+      nextCursor: {
+        cursorAttemptedAt: '2026-01-01T00:01:00.000Z',
+        cursorId: 'webhook_delivery_2',
+      },
+    })
+  })
+
+  it('lists deliveries without cursor, status filter, or next cursor when fewer rows are returned', async () => {
+    hoisted.mockListDeliveriesForWebhook.mockResolvedValue([
+      delivery({ status: 'failed_terminal', requestPayloadTruncated: true }),
+    ])
+
+    const result = await listWebhookDeliveriesFn({
+      data: { webhookId: 'webhook_123', limit: 50 },
+    })
+
+    expect(hoisted.mockListDeliveriesForWebhook).toHaveBeenCalledWith('webhook_123', {
+      cursor: null,
+      limit: 50,
+      statusFilter: null,
+    })
+    expect(result).toMatchObject({
+      deliveries: [{ canRedeliver: false }],
+      nextCursor: null,
+    })
+  })
+
+  it('does not list deliveries when admin authentication fails', async () => {
+    hoisted.mockRequireAuth.mockRejectedValueOnce(new Error('admin required'))
+
+    await expect(
+      listWebhookDeliveriesFn({ data: { webhookId: 'webhook_123', limit: 50 } })
+    ).rejects.toThrow('admin required')
+
+    expect(hoisted.mockListDeliveriesForWebhook).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/functions/audit-log.ts b/apps/web/src/lib/server/functions/audit-log.ts
index d4cd78e88..c292aa3b6 100644
--- a/apps/web/src/lib/server/functions/audit-log.ts
+++ b/apps/web/src/lib/server/functions/audit-log.ts
@@ -17,6 +17,7 @@ import { and, auditLog, db, desc, eq, gte, ilike, lte, notInArray } from '@/lib/
 import type { SQL } from 'drizzle-orm'
 import type { AuditEventOutcome, JsonValue } from '@/lib/server/audit/log'
 import { requireAuth } from './auth-helpers'
+import { toIsoString } from '@/lib/shared/utils'
 
 const DEFAULT_LIMIT = 100
 const MAX_LIMIT = 500
@@ -108,7 +109,7 @@ export const listAuditEventsFn = createServerFn({ method: 'GET' })
 
     const events: AuditEventRow[] = visible.map((row) => ({
       id: row.id,
-      occurredAt: row.occurredAt.toISOString(),
+      occurredAt: toIsoString(row.occurredAt),
       actorUserId: row.actorUserId,
       actorEmail: row.actorEmail,
       actorRole: row.actorRole,
diff --git a/apps/web/src/lib/server/functions/audit.ts b/apps/web/src/lib/server/functions/audit.ts
new file mode 100644
index 000000000..166817d4c
--- /dev/null
+++ b/apps/web/src/lib/server/functions/audit.ts
@@ -0,0 +1,126 @@
+/**
+ * Audit log server functions — read-only.
+ *
+ * Writes go through `recordEvent` from inside other domains; this module only
+ * exposes the listing endpoint used by the admin audit-log page.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import { requirePermission } from './auth-helpers'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { listEvents, listAuditEvents, listDistinctActions } from '@/lib/server/domains/audit'
+import {
+  listUnifiedAuditActions,
+  listUnifiedAuditEvents,
+} from '@/lib/server/domains/audit/audit.unified'
+import type { PrincipalId } from '@quackback/ids'
+
+export const listAuditEventsFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      principalId: z.string().optional(),
+      action: z.string().optional(),
+      targetType: z.string().optional(),
+      targetId: z.string().optional(),
+      sinceIso: z.string().datetime().optional(),
+      untilIso: z.string().datetime().optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.AUDIT_VIEW)
+    return listEvents({
+      principalId: data.principalId as PrincipalId | undefined,
+      action: data.action,
+      targetType: data.targetType,
+      targetId: data.targetId,
+      since: data.sinceIso ? new Date(data.sinceIso) : undefined,
+      until: data.untilIso ? new Date(data.untilIso) : undefined,
+      limit: data.limit,
+    })
+  })
+
+/**
+ * Paginated audit listing with cursor — used by the public REST endpoint.
+ */
+export const listAuditEventsPagedFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      principalId: z.string().optional(),
+      action: z.string().optional(),
+      actionPrefix: z.string().optional(),
+      targetType: z.string().optional(),
+      targetId: z.string().optional(),
+      source: z.enum(['web', 'api', 'integration', 'system', 'mcp']).optional(),
+      from: z.string().datetime().optional(),
+      to: z.string().datetime().optional(),
+      cursor: z.string().optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.AUDIT_VIEW)
+    return listAuditEvents({
+      principalId: data.principalId as PrincipalId | undefined,
+      action: data.action,
+      actionPrefix: data.actionPrefix,
+      targetType: data.targetType,
+      targetId: data.targetId,
+      source: data.source,
+      from: data.from ? new Date(data.from) : undefined,
+      to: data.to ? new Date(data.to) : undefined,
+      cursor: data.cursor,
+      limit: data.limit,
+    })
+  })
+
+/**
+ * Distinct action keys present in the audit log. Used by the admin UI to
+ * populate the action combobox.
+ */
+export const getAuditActionsFn = createServerFn({ method: 'GET' }).handler(async () => {
+  await requirePermission(PERMISSIONS.AUDIT_VIEW)
+  return listDistinctActions()
+})
+
+export const listUnifiedAuditEventsFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      origin: z.enum(['workspace', 'security']).optional(),
+      principalId: z.string().optional(),
+      actorEmail: z.string().max(254).optional(),
+      action: z.string().optional(),
+      actionPrefix: z.string().optional(),
+      targetType: z.string().optional(),
+      targetId: z.string().optional(),
+      source: z.enum(['web', 'api', 'integration', 'system', 'mcp']).optional(),
+      from: z.string().datetime().optional(),
+      to: z.string().datetime().optional(),
+      cursor: z.string().optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+      excludeSecurityActions: z.array(z.string()).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.AUDIT_VIEW)
+    return listUnifiedAuditEvents({
+      origin: data.origin,
+      principalId: data.principalId as PrincipalId | undefined,
+      actorEmail: data.actorEmail,
+      action: data.action,
+      actionPrefix: data.actionPrefix,
+      targetType: data.targetType,
+      targetId: data.targetId,
+      source: data.source,
+      from: data.from ? new Date(data.from) : undefined,
+      to: data.to ? new Date(data.to) : undefined,
+      cursor: data.cursor,
+      limit: data.limit,
+      excludeSecurityActions: data.excludeSecurityActions,
+    })
+  })
+
+export const getUnifiedAuditActionsFn = createServerFn({ method: 'GET' }).handler(async () => {
+  await requirePermission(PERMISSIONS.AUDIT_VIEW)
+  return listUnifiedAuditActions()
+})
diff --git a/apps/web/src/lib/server/functions/auth-helpers.ts b/apps/web/src/lib/server/functions/auth-helpers.ts
index 45a28f8b2..af36f331d 100644
--- a/apps/web/src/lib/server/functions/auth-helpers.ts
+++ b/apps/web/src/lib/server/functions/auth-helpers.ts
@@ -75,6 +75,33 @@ export interface AuthContext {
     role: Role
     type: string
   }
+  /** Best-effort client IP for audit attribution. */
+  ipAddress: string | null
+  /** Best-effort user-agent (truncated to 500 chars) for audit attribution. */
+  userAgent: string | null
+  /** Audit source for write paths originating from web sessions. */
+  source: 'web'
+}
+
+/**
+ * Extract best-effort client IP + user-agent from request headers.
+ */
+function readRequestContext(): { ipAddress: string | null; userAgent: string | null } {
+  try {
+    const headers = getRequestHeaders()
+    const get = (k: string): string | null => {
+      const v = (headers as unknown as Record<string, string | string[] | undefined>)[k]
+      if (!v) return null
+      return Array.isArray(v) ? (v[0] ?? null) : v
+    }
+    const cf = get('cf-connecting-ip')
+    const xff = get('x-forwarded-for')
+    const ip = cf ?? (xff ? (xff.split(',')[0]?.trim() ?? null) : null)
+    const ua = get('user-agent')
+    return { ipAddress: ip, userAgent: ua ? ua.slice(0, 500) : null }
+  } catch {
+    return { ipAddress: null, userAgent: null }
+  }
 }
 
 /**
@@ -119,6 +146,7 @@ export async function requireAuth(options?: { roles?: Role[] }): Promise<AuthCon
       )
     }
 
+    const reqCtx = readRequestContext()
     return {
       settings: {
         id: appSettings.id as WorkspaceId,
@@ -137,6 +165,9 @@ export async function requireAuth(options?: { roles?: Role[] }): Promise<AuthCon
         role: principalRecord.role as Role,
         type: principalRecord.type,
       },
+      ipAddress: reqCtx.ipAddress,
+      userAgent: reqCtx.userAgent,
+      source: 'web',
     }
   } catch (error) {
     log.error({ err: error }, 'require auth failed')
@@ -186,6 +217,7 @@ export async function getOptionalAuth(): Promise<AuthContext | null> {
       principalRecord = created
     }
 
+    const reqCtx = readRequestContext()
     return {
       settings: {
         id: appSettings.id as WorkspaceId,
@@ -204,6 +236,9 @@ export async function getOptionalAuth(): Promise<AuthContext | null> {
         role: principalRecord.role as Role,
         type: principalRecord.type,
       },
+      ipAddress: reqCtx.ipAddress,
+      userAgent: reqCtx.userAgent,
+      source: 'web',
     }
   } catch (error) {
     log.error({ err: error }, 'get optional auth failed')
@@ -211,6 +246,69 @@ export async function getOptionalAuth(): Promise<AuthContext | null> {
   }
 }
 
+// ============================================================================
+// Permission-based auth (Phase 1: ticketing RBAC)
+// ============================================================================
+
+import {
+  loadPermissionSet,
+  hasPermission,
+  hasPermissionForResource,
+  type PermissionSet,
+} from '@/lib/server/domains/authz/authz.service'
+import type { PermissionKey, ResourceScope } from '@/lib/server/domains/authz'
+import { ForbiddenError } from '@/lib/shared/errors'
+
+/**
+ * AuthContext extended with the principal's permission set.
+ *
+ * Built by `requirePermission` and the upcoming ticketing helpers; the
+ * permission set is loaded once per request and reused for downstream checks
+ * to avoid extra round-trips to `principal_role_assignments`.
+ */
+export interface AuthContextWithPermissions extends AuthContext {
+  permissions: PermissionSet
+}
+
+/**
+ * Like `requireAuth`, but additionally requires the principal to hold
+ * `permission`. Loads the full permission set so subsequent checks in the
+ * same request are free.
+ *
+ * For permissions that depend on a specific resource (e.g. team-scoped
+ * grants), pass `resource` to evaluate the scope.
+ *
+ * @example
+ *   const ctx = await requirePermission(PERMISSIONS.TICKET_REPLY_PUBLIC, {
+ *     primaryTeamId: ticket.primaryTeamId,
+ *   })
+ */
+export async function requirePermission(
+  permission: PermissionKey,
+  resource?: ResourceScope
+): Promise<AuthContextWithPermissions> {
+  const auth = await requireAuth()
+  const set = await loadPermissionSet(auth.principal.id)
+  const ok = resource
+    ? hasPermissionForResource(set, permission, resource)
+    : hasPermission(set, permission)
+  if (!ok) {
+    throw new ForbiddenError('PERMISSION_DENIED', `Missing required permission: ${permission}`)
+  }
+  return { ...auth, permissions: set }
+}
+
+/**
+ * Load `AuthContext` plus permission set without enforcing any specific
+ * permission. Useful for endpoints that need to perform multiple
+ * `hasPermission` checks themselves (e.g. listing tickets across scopes).
+ */
+export async function requireAuthWithPermissions(): Promise<AuthContextWithPermissions> {
+  const auth = await requireAuth()
+  const set = await loadPermissionSet(auth.principal.id)
+  return { ...auth, permissions: set }
+}
+
 // ============================================================================
 // Policy actor resolution
 // ============================================================================
diff --git a/apps/web/src/lib/server/functions/authz.ts b/apps/web/src/lib/server/functions/authz.ts
new file mode 100644
index 000000000..11acc5964
--- /dev/null
+++ b/apps/web/src/lib/server/functions/authz.ts
@@ -0,0 +1,35 @@
+/**
+ * Authz / permission server-fns for client UI.
+ *
+ * `getMyPermissionsFn` returns the current actor's permission set in a
+ * client-friendly serialised shape; consumed by `useMyPermissions()` and
+ * the `<PermissionGate />` primitive to gate UI affordances.
+ */
+import { createServerFn } from '@tanstack/react-start'
+import type { PrincipalId, TeamId } from '@quackback/ids'
+import { requireAuth } from './auth-helpers'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import type { PermissionKey } from '@/lib/server/domains/authz'
+
+export interface MyPermissionsResult {
+  principalId: PrincipalId
+  workspacePermissions: PermissionKey[]
+  teamPermissions: Array<{ teamId: TeamId; permissions: PermissionKey[] }>
+  teamIds: TeamId[]
+}
+
+export const getMyPermissionsFn = createServerFn({ method: 'GET' }).handler(
+  async (): Promise<MyPermissionsResult> => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const set = await loadPermissionSet(auth.principal.id)
+    return {
+      principalId: set.principalId,
+      workspacePermissions: Array.from(set.workspacePermissions),
+      teamPermissions: Array.from(set.teamPermissions.entries()).map(([teamId, perms]) => ({
+        teamId,
+        permissions: Array.from(perms),
+      })),
+      teamIds: Array.from(set.teamIds),
+    }
+  }
+)
diff --git a/apps/web/src/lib/server/functions/bootstrap.ts b/apps/web/src/lib/server/functions/bootstrap.ts
index c8ae58d68..5270988f6 100644
--- a/apps/web/src/lib/server/functions/bootstrap.ts
+++ b/apps/web/src/lib/server/functions/bootstrap.ts
@@ -4,10 +4,10 @@ import { resolveLocale, type SupportedLocale } from '@/lib/shared/i18n'
 import type { Session, PrincipalType } from '@/lib/server/auth/session'
 import type { TenantSettings } from '@/lib/server/domains/settings'
 import type { SessionId, UserId } from '@quackback/ids'
-import { logger } from '@/lib/server/logger'
+import { toIsoString } from '@/lib/shared/utils'
 
+import { logger } from '@/lib/server/logger'
 const log = logger.child({ component: 'bootstrap' })
-
 export interface BootstrapData {
   baseUrl: string
   session: Session | null
@@ -84,10 +84,10 @@ async function getSessionAndRole(): Promise<{
       session: {
         session: {
           id: session.session.id as SessionId,
-          expiresAt: session.session.expiresAt.toISOString(),
+          expiresAt: toIsoString(session.session.expiresAt),
           token: session.session.token,
-          createdAt: session.session.createdAt.toISOString(),
-          updatedAt: session.session.updatedAt.toISOString(),
+          createdAt: toIsoString(session.session.createdAt),
+          updatedAt: toIsoString(session.session.updatedAt),
           userId,
         },
         user: {
@@ -97,8 +97,8 @@ async function getSessionAndRole(): Promise<{
           emailVerified: session.user.emailVerified,
           image: session.user.image ?? null,
           principalType: (principalRecord?.type as PrincipalType) ?? 'user',
-          createdAt: session.user.createdAt.toISOString(),
-          updatedAt: session.user.updatedAt.toISOString(),
+          createdAt: toIsoString(session.user.createdAt),
+          updatedAt: toIsoString(session.user.updatedAt),
         },
       },
       role: (principalRecord?.role as 'admin' | 'member' | 'user' | null) ?? null,
diff --git a/apps/web/src/lib/server/functions/contacts.ts b/apps/web/src/lib/server/functions/contacts.ts
new file mode 100644
index 000000000..4722793a8
--- /dev/null
+++ b/apps/web/src/lib/server/functions/contacts.ts
@@ -0,0 +1,186 @@
+/**
+ * Contacts server functions.
+ *
+ * Reads gated by ORG_VIEW; writes gated by ORG_MANAGE. Linking/unlinking
+ * emits audit events so the admin trail captures contact↔user mappings.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type { ContactId, OrganizationId, UserId } from '@quackback/ids'
+import { requirePermission } from './auth-helpers'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  createContact,
+  updateContact,
+  archiveContact,
+  getContact,
+  listContactsForOrganization,
+  searchContacts,
+  linkContactToUser,
+  unlinkContactFromUser,
+  listLinksForContact,
+} from '@/lib/server/domains/organizations'
+import { recordEvent } from '@/lib/server/domains/audit'
+
+const contactIdSchema = z.string().min(1) as z.ZodType<ContactId>
+const organizationIdSchema = z.string().min(1) as z.ZodType<OrganizationId>
+const userIdSchema = z.string().min(1) as z.ZodType<UserId>
+
+export const searchContactsFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      query: z.string().max(200).optional(),
+      email: z.string().max(320).optional(),
+      organizationId: organizationIdSchema.optional(),
+      includeArchived: z.boolean().optional(),
+      limit: z.number().int().min(1).max(100).optional(),
+      offset: z.number().int().min(0).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ORG_VIEW)
+    return searchContacts(data)
+  })
+
+export const listContactsForOrganizationFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      organizationId: organizationIdSchema,
+      includeArchived: z.boolean().optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+      offset: z.number().int().min(0).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ORG_VIEW)
+    const { organizationId, ...rest } = data
+    return listContactsForOrganization(organizationId, rest)
+  })
+
+export const getContactFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ contactId: contactIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ORG_VIEW)
+    return getContact(data.contactId)
+  })
+
+const createContactSchema = z.object({
+  name: z.string().min(1).max(200).nullable().optional(),
+  email: z.string().max(320).nullable().optional(),
+  phone: z.string().max(64).nullable().optional(),
+  title: z.string().max(120).nullable().optional(),
+  externalId: z.string().max(255).nullable().optional(),
+  organizationId: organizationIdSchema.nullable().optional(),
+  avatarUrl: z.string().max(2048).nullable().optional(),
+})
+
+export const createContactFn = createServerFn({ method: 'POST' })
+  .inputValidator(createContactSchema)
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    const contact = await createContact(data, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'contact.created',
+      targetType: 'contact',
+      targetId: contact.id,
+      diff: {
+        after: { name: contact.name, email: contact.email, organizationId: contact.organizationId },
+      },
+    })
+    return contact
+  })
+
+const updateContactSchema = createContactSchema.extend({ contactId: contactIdSchema })
+
+export const updateContactFn = createServerFn({ method: 'POST' })
+  .inputValidator(updateContactSchema)
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    const before = await getContact(data.contactId)
+    const { contactId, ...patch } = data
+    const contact = await updateContact(contactId, patch, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'contact.updated',
+      targetType: 'contact',
+      targetId: contact.id,
+      diff: {
+        before: before
+          ? { name: before.name, email: before.email, organizationId: before.organizationId }
+          : undefined,
+        after: { name: contact.name, email: contact.email, organizationId: contact.organizationId },
+      },
+    })
+    return contact
+  })
+
+export const archiveContactFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ contactId: contactIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    await archiveContact(data.contactId, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'contact.archived',
+      targetType: 'contact',
+      targetId: data.contactId,
+    })
+    return { ok: true as const }
+  })
+
+export const linkContactToUserFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ contactId: contactIdSchema, userId: userIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    const link = await linkContactToUser(
+      {
+        contactId: data.contactId,
+        userId: data.userId,
+        linkedByPrincipalId: ctx.principal.id,
+      },
+      { principalId: ctx.principal.id, userId: ctx.user.id }
+    )
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'contact.linked_user',
+      targetType: 'contact',
+      targetId: data.contactId,
+      diff: { context: { userId: data.userId } },
+    })
+    return link
+  })
+
+export const unlinkContactFromUserFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ contactId: contactIdSchema, userId: userIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    await unlinkContactFromUser(data.contactId, data.userId, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'contact.unlinked_user',
+      targetType: 'contact',
+      targetId: data.contactId,
+      diff: { context: { userId: data.userId } },
+    })
+    return { ok: true as const }
+  })
+
+export const listLinksForContactFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ contactId: contactIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ORG_VIEW)
+    return listLinksForContact(data.contactId)
+  })
diff --git a/apps/web/src/lib/server/functions/inboxes.ts b/apps/web/src/lib/server/functions/inboxes.ts
new file mode 100644
index 000000000..aba2447e2
--- /dev/null
+++ b/apps/web/src/lib/server/functions/inboxes.ts
@@ -0,0 +1,292 @@
+/**
+ * Inbox server functions — admin & agent surface for inbox CRUD,
+ * channels, and memberships.
+ *
+ * - INBOX_VIEW for read endpoints
+ * - INBOX_MANAGE for inbox CRUD + memberships
+ * - INBOX_CHANNEL_MANAGE for channel CRUD
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type {
+  InboxId,
+  InboxChannelId,
+  InboxMembershipId,
+  PrincipalId,
+  TeamId,
+  TicketStatusId,
+} from '@quackback/ids'
+import { requirePermission } from './auth-helpers'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  createInbox,
+  updateInbox,
+  archiveInbox,
+  unarchiveInbox,
+  getInbox,
+  listInboxes,
+  addInboxMembership,
+  updateInboxMembershipRole,
+  removeInboxMembership,
+  listMembershipsForInbox,
+  listInboxRowsForPrincipal,
+  addInboxChannel,
+  updateInboxChannel,
+  archiveInboxChannel,
+  listChannelsForInbox,
+} from '@/lib/server/domains/inboxes'
+import {
+  INBOX_CHANNEL_KINDS,
+  INBOX_MEMBERSHIP_ROLES,
+  TICKET_PRIORITIES,
+  TICKET_VISIBILITY_SCOPES,
+} from '@/lib/server/db'
+import { recordEvent } from '@/lib/server/domains/audit'
+
+const inboxIdSchema = z.string().min(1) as z.ZodType<InboxId>
+const channelIdSchema = z.string().min(1) as z.ZodType<InboxChannelId>
+const membershipIdSchema = z.string().min(1) as z.ZodType<InboxMembershipId>
+const principalIdSchema = z.string().min(1) as z.ZodType<PrincipalId>
+const teamIdSchema = z.string().min(1) as z.ZodType<TeamId>
+const statusIdSchema = z.string().min(1) as z.ZodType<TicketStatusId>
+
+// ---- inbox CRUD ----------------------------------------------------------
+
+export const listInboxesFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ includeArchived: z.boolean().optional() }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.INBOX_VIEW)
+    return listInboxes({ includeArchived: data.includeArchived })
+  })
+
+export const getInboxFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ inboxId: inboxIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.INBOX_VIEW)
+    return getInbox(data.inboxId)
+  })
+
+export const createInboxFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      slug: z.string().min(1).max(100),
+      name: z.string().min(1).max(200),
+      description: z.string().max(1000).nullable().optional(),
+      primaryTeamId: teamIdSchema.nullable().optional(),
+      defaultVisibilityScope: z.enum(TICKET_VISIBILITY_SCOPES).optional(),
+      defaultPriority: z.enum(TICKET_PRIORITIES).optional(),
+      defaultStatusId: statusIdSchema.nullable().optional(),
+      color: z.string().max(16).nullable().optional(),
+      icon: z.string().max(64).nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_MANAGE)
+    const inbox = await createInbox(data, { principalId: ctx.principal.id })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox.created',
+      targetType: 'inbox',
+      targetId: inbox.id,
+      diff: { after: { slug: inbox.slug, name: inbox.name } },
+    })
+    return inbox
+  })
+
+export const updateInboxFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      inboxId: inboxIdSchema,
+      name: z.string().min(1).max(200).optional(),
+      description: z.string().max(1000).nullable().optional(),
+      primaryTeamId: teamIdSchema.nullable().optional(),
+      defaultVisibilityScope: z.enum(TICKET_VISIBILITY_SCOPES).optional(),
+      defaultPriority: z.enum(TICKET_PRIORITIES).optional(),
+      defaultStatusId: statusIdSchema.nullable().optional(),
+      color: z.string().max(16).nullable().optional(),
+      icon: z.string().max(64).nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_MANAGE)
+    const { inboxId, ...patch } = data
+    const inbox = await updateInbox(inboxId, patch, { principalId: ctx.principal.id })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox.updated',
+      targetType: 'inbox',
+      targetId: inbox.id,
+      diff: { after: patch },
+    })
+    return inbox
+  })
+
+export const archiveInboxFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ inboxId: inboxIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_MANAGE)
+    const inbox = await archiveInbox(data.inboxId, { principalId: ctx.principal.id })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox.archived',
+      targetType: 'inbox',
+      targetId: inbox.id,
+    })
+    return inbox
+  })
+
+export const unarchiveInboxFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ inboxId: inboxIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_MANAGE)
+    const inbox = await unarchiveInbox(data.inboxId, { principalId: ctx.principal.id })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox.unarchived',
+      targetType: 'inbox',
+      targetId: inbox.id,
+    })
+    return inbox
+  })
+
+// ---- channels ------------------------------------------------------------
+
+export const listInboxChannelsFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ inboxId: inboxIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.INBOX_VIEW)
+    return listChannelsForInbox(data.inboxId)
+  })
+
+export const addInboxChannelFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      inboxId: inboxIdSchema,
+      kind: z.enum(INBOX_CHANNEL_KINDS),
+      label: z.string().min(1).max(200),
+      config: z.record(z.string(), z.unknown()).optional(),
+      externalId: z.string().max(200).nullable().optional(),
+      enabled: z.boolean().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_CHANNEL_MANAGE)
+    const channel = await addInboxChannel(data as never)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox_channel.added',
+      targetType: 'inbox_channel',
+      targetId: channel.id,
+      diff: { after: { inboxId: data.inboxId, kind: data.kind } },
+    })
+    return channel
+  })
+
+export const updateInboxChannelFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      channelId: channelIdSchema,
+      label: z.string().min(1).max(200).optional(),
+      config: z.record(z.string(), z.unknown()).optional(),
+      externalId: z.string().max(200).nullable().optional(),
+      enabled: z.boolean().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_CHANNEL_MANAGE)
+    const { channelId, ...patch } = data
+    const channel = await updateInboxChannel(channelId, patch as never)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox_channel.updated',
+      targetType: 'inbox_channel',
+      targetId: channel.id,
+      diff: { after: patch as never },
+    })
+    return channel
+  })
+
+export const archiveInboxChannelFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ channelId: channelIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_CHANNEL_MANAGE)
+    const channel = await archiveInboxChannel(data.channelId)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox_channel.archived',
+      targetType: 'inbox_channel',
+      targetId: channel.id,
+    })
+    return channel
+  })
+
+// ---- memberships ---------------------------------------------------------
+
+export const listInboxMembershipsFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ inboxId: inboxIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.INBOX_VIEW)
+    return listMembershipsForInbox(data.inboxId)
+  })
+
+export const listMyInboxesFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({}).optional())
+  .handler(async () => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_VIEW)
+    return listInboxRowsForPrincipal(ctx.principal.id as PrincipalId)
+  })
+
+export const addInboxMembershipFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      inboxId: inboxIdSchema,
+      principalId: principalIdSchema,
+      role: z.enum(INBOX_MEMBERSHIP_ROLES),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_MANAGE)
+    const m = await addInboxMembership(data)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox.membership_added',
+      targetType: 'inbox',
+      targetId: data.inboxId,
+      diff: { after: { principalId: data.principalId, role: data.role } },
+    })
+    return m
+  })
+
+export const updateInboxMembershipRoleFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      membershipId: membershipIdSchema,
+      role: z.enum(INBOX_MEMBERSHIP_ROLES),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_MANAGE)
+    const m = await updateInboxMembershipRole(data.membershipId, data.role)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox.membership_updated',
+      targetType: 'inbox',
+      targetId: m.inboxId,
+      diff: { after: { role: data.role } },
+    })
+    return m
+  })
+
+export const removeInboxMembershipFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ membershipId: membershipIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.INBOX_MANAGE)
+    await removeInboxMembership(data.membershipId)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'inbox.membership_removed',
+      targetType: 'inbox_membership',
+      targetId: data.membershipId,
+    })
+    return { ok: true }
+  })
diff --git a/apps/web/src/lib/server/functions/notifications.ts b/apps/web/src/lib/server/functions/notifications.ts
index d7d77ac50..951dd7bcb 100644
--- a/apps/web/src/lib/server/functions/notifications.ts
+++ b/apps/web/src/lib/server/functions/notifications.ts
@@ -4,7 +4,7 @@
 
 import { z } from 'zod'
 import { createServerFn } from '@tanstack/react-start'
-import type { NotificationId } from '@quackback/ids'
+import type { NotificationId, TicketId, PrincipalId, TeamId } from '@quackback/ids'
 import { requireAuth, policyActorFromAuth } from './auth-helpers'
 import {
   getNotificationsForMember,
@@ -13,10 +13,25 @@ import {
   markAllAsRead,
   archiveNotification,
 } from '@/lib/server/domains/notifications/notification.service'
-import { logger } from '@/lib/server/logger'
+import {
+  subscribeToTicket,
+  unsubscribeFromTicket,
+  updateSubscriptionPrefs,
+  muteTicket as muteTicketSubscription,
+  unmuteTicket as unmuteTicketSubscription,
+  listSubscribersForTicket,
+  getSubscription,
+  listSubscriptionsForPrincipalWithTickets,
+} from '@/lib/server/domains/tickets/ticket.subscriptions'
+import { getTicket } from '@/lib/server/domains/tickets/ticket.service'
+import { listSharesForTicket } from '@/lib/server/domains/tickets/ticket.share'
+import { canViewTicket, toResourceScope } from '@/lib/server/domains/tickets/ticket.permissions'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { ForbiddenError, NotFoundError } from '@/lib/shared/errors'
+import { toIsoString, toIsoStringOrNull } from '@/lib/shared/utils'
 
+import { logger } from '@/lib/server/logger'
 const log = logger.child({ component: 'notifications' })
-
 // ============================================
 // Schemas
 // ============================================
@@ -75,10 +90,11 @@ export const getNotificationsFn = createServerFn({ method: 'GET' })
             body: n.body,
             postId: n.postId,
             commentId: n.commentId,
+            ticketId: n.ticketId ?? null,
             conversationId: typeof conversationId === 'string' ? conversationId : null,
-            readAt: n.readAt?.toISOString() ?? null,
-            archivedAt: n.archivedAt?.toISOString() ?? null,
-            createdAt: n.createdAt.toISOString(),
+            readAt: toIsoStringOrNull(n.readAt),
+            archivedAt: toIsoStringOrNull(n.archivedAt),
+            createdAt: toIsoString(n.createdAt),
             post: n.post,
           }
         }),
@@ -159,3 +175,215 @@ export const archiveNotificationFn = createServerFn({ method: 'POST' })
       throw error
     }
   })
+
+// ============================================
+// Phase 7: Ticket subscription server functions
+// ============================================
+
+/**
+ * Assert the authed principal can view the given ticket. Throws NotFoundError
+ * if missing, ForbiddenError if visible-but-not-permitted (404 vs 403 split
+ * matches the rest of the API surface).
+ */
+async function assertCanViewTicket(ticketId: TicketId, principalId: PrincipalId): Promise<void> {
+  const ticket = await getTicket(ticketId)
+  if (!ticket) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  const shares = await listSharesForTicket(ticketId)
+  const scope = toResourceScope({
+    primaryTeamId: ticket.primaryTeamId,
+    assigneePrincipalId: ticket.assigneePrincipalId,
+    assigneeTeamId: ticket.assigneeTeamId,
+    shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+  })
+  const set = await loadPermissionSet(principalId)
+  if (!canViewTicket(set, scope)) {
+    throw new ForbiddenError('TICKET_FORBIDDEN', 'cannot view ticket')
+  }
+}
+
+const ticketIdInput = z.object({ ticketId: z.string() })
+
+const ticketSubscribeInput = z.object({
+  ticketId: z.string(),
+  prefs: z
+    .object({
+      notifyThreads: z.boolean().optional(),
+      notifyStatus: z.boolean().optional(),
+      notifyAssignment: z.boolean().optional(),
+      notifyParticipants: z.boolean().optional(),
+      notifyShares: z.boolean().optional(),
+      notifySla: z.boolean().optional(),
+    })
+    .optional(),
+})
+
+const ticketUpdatePrefsInput = z.object({
+  ticketId: z.string(),
+  patch: z.object({
+    notifyThreads: z.boolean().optional(),
+    notifyStatus: z.boolean().optional(),
+    notifyAssignment: z.boolean().optional(),
+    notifyParticipants: z.boolean().optional(),
+    notifyShares: z.boolean().optional(),
+    notifySla: z.boolean().optional(),
+  }),
+})
+
+const ticketMuteInput = z.object({
+  ticketId: z.string(),
+  untilIso: z.string().datetime().optional(),
+})
+
+export const subscribeToTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(ticketSubscribeInput)
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const ticketId = data.ticketId as TicketId
+    await assertCanViewTicket(ticketId, auth.principal.id)
+    const row = await subscribeToTicket({
+      ticketId,
+      principalId: auth.principal.id,
+      source: 'manual',
+      prefs: data.prefs,
+    })
+    return { id: row.id, source: row.source }
+  })
+
+export const unsubscribeFromTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(ticketIdInput)
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const ticketId = data.ticketId as TicketId
+    await assertCanViewTicket(ticketId, auth.principal.id)
+    const removed = await unsubscribeFromTicket(ticketId, auth.principal.id)
+    return { removed }
+  })
+
+export const updateTicketSubscriptionPrefsFn = createServerFn({ method: 'POST' })
+  .inputValidator(ticketUpdatePrefsInput)
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const ticketId = data.ticketId as TicketId
+    await assertCanViewTicket(ticketId, auth.principal.id)
+    const updated = await updateSubscriptionPrefs({
+      ticketId,
+      principalId: auth.principal.id,
+      patch: data.patch,
+      // Server-fns are user-driven manual writes; allow them to upgrade auto rows.
+      force: true,
+    })
+    if (!updated) throw new NotFoundError('TICKET_SUB_NOT_FOUND', 'no subscription to update')
+    return { id: updated.id, source: updated.source }
+  })
+
+export const muteTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(ticketMuteInput)
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const ticketId = data.ticketId as TicketId
+    await assertCanViewTicket(ticketId, auth.principal.id)
+    const until = data.untilIso ? new Date(data.untilIso) : null
+    const row = await muteTicketSubscription(ticketId, auth.principal.id, until)
+    return { mutedUntil: toIsoStringOrNull(row?.mutedUntil) }
+  })
+
+export const unmuteTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(ticketIdInput)
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const ticketId = data.ticketId as TicketId
+    await assertCanViewTicket(ticketId, auth.principal.id)
+    await unmuteTicketSubscription(ticketId, auth.principal.id)
+    return { success: true }
+  })
+
+export const listTicketSubscriptionsFn = createServerFn({ method: 'GET' })
+  .inputValidator(ticketIdInput)
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const ticketId = data.ticketId as TicketId
+    await assertCanViewTicket(ticketId, auth.principal.id)
+    const rows = await listSubscribersForTicket(ticketId)
+    return rows.map((r) => ({
+      id: r.id,
+      principalId: r.principalId,
+      source: r.source,
+      notifyThreads: r.notifyThreads,
+      notifyStatus: r.notifyStatus,
+      notifyAssignment: r.notifyAssignment,
+      notifyParticipants: r.notifyParticipants,
+      notifyShares: r.notifyShares,
+      notifySla: r.notifySla,
+      mutedUntil: toIsoStringOrNull(r.mutedUntil),
+      createdAt: toIsoString(r.createdAt),
+    }))
+  })
+
+export const getMyTicketSubscriptionFn = createServerFn({ method: 'GET' })
+  .inputValidator(ticketIdInput)
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const ticketId = data.ticketId as TicketId
+    await assertCanViewTicket(ticketId, auth.principal.id)
+    const row = await getSubscription(ticketId, auth.principal.id)
+    if (!row) return null
+    return {
+      id: row.id,
+      source: row.source,
+      notifyThreads: row.notifyThreads,
+      notifyStatus: row.notifyStatus,
+      notifyAssignment: row.notifyAssignment,
+      notifyParticipants: row.notifyParticipants,
+      notifyShares: row.notifyShares,
+      notifySla: row.notifySla,
+      mutedUntil: toIsoStringOrNull(row.mutedUntil),
+      createdAt: toIsoString(row.createdAt),
+    }
+  })
+
+const listMyTicketSubscriptionsInput = z.object({
+  limit: z.number().min(1).max(100).optional(),
+  cursor: z.object({ createdAt: z.string().datetime(), id: z.string() }).optional().nullable(),
+})
+
+export const listMyTicketSubscriptionsFn = createServerFn({ method: 'GET' })
+  .inputValidator(listMyTicketSubscriptionsInput)
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const limit = data.limit ?? 50
+    const cursor = data.cursor
+      ? {
+          createdAt: new Date(data.cursor.createdAt),
+          id: data.cursor.id as import('@quackback/ids').TicketSubscriptionId,
+        }
+      : null
+    const rows = await listSubscriptionsForPrincipalWithTickets(auth.principal.id, {
+      limit,
+      cursor,
+    })
+    const last = rows.length === limit ? rows[rows.length - 1] : null
+    return {
+      subscriptions: rows.map((r) => ({
+        id: r.id,
+        ticketId: r.ticketId,
+        source: r.source,
+        notifyThreads: r.notifyThreads,
+        notifyStatus: r.notifyStatus,
+        notifyAssignment: r.notifyAssignment,
+        notifyParticipants: r.notifyParticipants,
+        notifyShares: r.notifyShares,
+        notifySla: r.notifySla,
+        mutedUntil: toIsoStringOrNull(r.mutedUntil),
+        createdAt: toIsoString(r.createdAt),
+        ticket: {
+          id: r.ticket.id,
+          subject: r.ticket.subject,
+          statusId: r.ticket.statusId,
+          priority: r.ticket.priority,
+          channel: r.ticket.channel,
+          updatedAt: toIsoString(r.ticket.updatedAt),
+        },
+      })),
+      nextCursor: last ? { createdAt: toIsoString(last.createdAt), id: last.id } : null,
+    }
+  })
diff --git a/apps/web/src/lib/server/functions/onboarding.ts b/apps/web/src/lib/server/functions/onboarding.ts
index d0afa9b6a..e4b9cbdde 100644
--- a/apps/web/src/lib/server/functions/onboarding.ts
+++ b/apps/web/src/lib/server/functions/onboarding.ts
@@ -225,6 +225,7 @@ export const setupWorkspaceFn = createServerFn({ method: 'POST' })
             workspace: true,
             boards: false,
           },
+          source: 'self-hosted',
           useCase,
         }
 
@@ -344,6 +345,7 @@ export const saveUseCaseFn = createServerFn({ method: 'POST' })
         const setupState: SetupState = getSetupState(existingSettings.setupState) ?? {
           version: 1,
           steps: { core: true, workspace: false, boards: false },
+          source: 'self-hosted',
         }
 
         const updatedState: SetupState = { ...setupState, useCase: data.useCase }
@@ -370,6 +372,7 @@ export const saveUseCaseFn = createServerFn({ method: 'POST' })
         const setupState: SetupState = {
           version: 1,
           steps: { core: true, workspace: false, boards: false },
+          source: 'self-hosted',
           useCase: data.useCase,
         }
 
diff --git a/apps/web/src/lib/server/functions/organizations.ts b/apps/web/src/lib/server/functions/organizations.ts
new file mode 100644
index 000000000..fdd53990c
--- /dev/null
+++ b/apps/web/src/lib/server/functions/organizations.ts
@@ -0,0 +1,137 @@
+/**
+ * Organizations server functions.
+ *
+ * Reads gated by ORG_VIEW; writes gated by ORG_MANAGE. Every write emits an
+ * audit event so the admin trail captures CRM changes.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type { OrganizationId } from '@quackback/ids'
+import { requirePermission } from './auth-helpers'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  createOrganization,
+  updateOrganization,
+  archiveOrganization,
+  unarchiveOrganization,
+  getOrganization,
+  listOrganizations,
+} from '@/lib/server/domains/organizations'
+import { recordEvent } from '@/lib/server/domains/audit'
+
+const organizationIdSchema = z.string().min(1) as z.ZodType<OrganizationId>
+
+export const listOrganizationsFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      search: z.string().max(200).optional(),
+      includeArchived: z.boolean().optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+      offset: z.number().int().min(0).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ORG_VIEW)
+    return listOrganizations(data)
+  })
+
+export const getOrganizationFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ organizationId: organizationIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ORG_VIEW)
+    return getOrganization(data.organizationId)
+  })
+
+const createOrgSchema = z.object({
+  name: z.string().min(1).max(200),
+  domain: z.string().max(255).nullable().optional(),
+  externalId: z.string().max(255).nullable().optional(),
+  website: z.string().max(500).nullable().optional(),
+  notes: z.string().max(5000).nullable().optional(),
+})
+
+export const createOrganizationFn = createServerFn({ method: 'POST' })
+  .inputValidator(createOrgSchema)
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    const org = await createOrganization(data, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'organization.created',
+      targetType: 'organization',
+      targetId: org.id,
+      diff: { after: { name: org.name, domain: org.domain } },
+    })
+    return org
+  })
+
+const updateOrgSchema = z.object({
+  organizationId: organizationIdSchema,
+  name: z.string().min(1).max(200).optional(),
+  domain: z.string().max(255).nullable().optional(),
+  externalId: z.string().max(255).nullable().optional(),
+  website: z.string().max(500).nullable().optional(),
+  notes: z.string().max(5000).nullable().optional(),
+})
+
+export const updateOrganizationFn = createServerFn({ method: 'POST' })
+  .inputValidator(updateOrgSchema)
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    const before = await getOrganization(data.organizationId)
+    const { organizationId, ...patch } = data
+    const org = await updateOrganization(organizationId, patch, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'organization.updated',
+      targetType: 'organization',
+      targetId: org.id,
+      diff: {
+        before: before
+          ? { name: before.name, domain: before.domain, website: before.website }
+          : undefined,
+        after: { name: org.name, domain: org.domain, website: org.website },
+      },
+    })
+    return org
+  })
+
+export const archiveOrganizationFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ organizationId: organizationIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    await archiveOrganization(data.organizationId, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'organization.archived',
+      targetType: 'organization',
+      targetId: data.organizationId,
+    })
+    return { ok: true as const }
+  })
+
+export const unarchiveOrganizationFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ organizationId: organizationIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ORG_MANAGE)
+    await unarchiveOrganization(data.organizationId, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'organization.unarchived',
+      targetType: 'organization',
+      targetId: data.organizationId,
+    })
+    return { ok: true as const }
+  })
diff --git a/apps/web/src/lib/server/functions/portal-tickets.ts b/apps/web/src/lib/server/functions/portal-tickets.ts
new file mode 100644
index 000000000..9c116b946
--- /dev/null
+++ b/apps/web/src/lib/server/functions/portal-tickets.ts
@@ -0,0 +1,367 @@
+/**
+ * Portal-side ticket server functions.
+ *
+ * Auth model: every handler `requireAuth()`s. There is NO permission check —
+ * portal users carry an empty PermissionSet by design. The domain layer
+ * (`ticket.portal-query.ts`) gates access by an OWNERSHIP predicate built
+ * from the user's principal + linked-contact set.
+ *
+ * Misses surface as `NotFoundError` (never `Forbidden`) so we don't leak
+ * existence of tickets the user has no relationship with.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import { requireAuth } from './auth-helpers'
+import { db, eq, inArray, principal, user, ticketStatuses } from '@/lib/server/db'
+import type { TiptapContent } from '@/lib/server/db'
+import {
+  listTicketsForPortalUser,
+  getTicketForPortalUser,
+  addPortalReply,
+  updatePortalTicketDescription,
+  closePortalTicket,
+  reopenPortalTicket,
+  buildPortalIdentity,
+  resolveViewerRelationship,
+  type PortalViewerRelationship,
+} from '@/lib/server/domains/tickets/ticket.portal-query'
+import { listPublicThreadsForTicket } from '@/lib/server/domains/tickets/ticket.threads'
+import { createTicket } from '@/lib/server/domains/tickets/ticket.service'
+import { getMemberByUser } from '@/lib/server/domains/principals/principal.service'
+import type { PrincipalId, TicketId, TicketStatusId, UserId } from '@quackback/ids'
+import { toIsoString, toIsoStringOrNull } from '@/lib/shared/utils'
+import { ForbiddenError } from '@/lib/shared/errors'
+
+const tiptapDocSchema = z
+  .object({ type: z.literal('doc'), content: z.array(z.unknown()).optional() })
+  .passthrough()
+
+const statusCategorySchema = z.enum(['open', 'pending', 'on_hold', 'solved', 'closed'])
+
+interface SerializedTicketRow {
+  id: TicketId
+  subject: string
+  statusId: TicketStatusId
+  statusCategory: 'open' | 'pending' | 'on_hold' | 'solved' | 'closed'
+  statusName: string
+  statusColor: string | null
+  lastActivityAt: string
+  createdAt: string
+}
+
+export const listMyTicketsFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      statusCategory: statusCategorySchema.optional(),
+      limit: z.number().int().min(1).max(50).optional(),
+      offset: z.number().int().min(0).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuth()
+    const { rows, total } = await listTicketsForPortalUser({
+      userId: ctx.user.id as UserId,
+      statusCategory: data.statusCategory,
+      limit: data.limit,
+      offset: data.offset,
+    })
+    if (rows.length === 0) return { rows: [] as SerializedTicketRow[], total }
+
+    const statusIdSet = new Set<TicketStatusId>()
+    for (const r of rows) {
+      if (r.statusId) statusIdSet.add(r.statusId as TicketStatusId)
+    }
+    const statusIds = Array.from(statusIdSet)
+    const statusRows = await db.query.ticketStatuses.findMany({
+      where: inArray(ticketStatuses.id, statusIds as TicketStatusId[]),
+    })
+    const statusById = new Map(statusRows.map((s) => [s.id, s]))
+
+    const serialized: SerializedTicketRow[] = rows.map((r) => {
+      const s = r.statusId ? statusById.get(r.statusId as TicketStatusId) : undefined
+      return {
+        id: r.id as TicketId,
+        subject: r.subject,
+        statusId: r.statusId as TicketStatusId,
+        statusCategory: (s?.category ?? 'open') as SerializedTicketRow['statusCategory'],
+        statusName: s?.name ?? 'Unknown',
+        statusColor: s?.color ?? null,
+        lastActivityAt: toIsoString(r.lastActivityAt),
+        createdAt: toIsoString(r.createdAt),
+      }
+    })
+    return { rows: serialized, total }
+  })
+
+interface SerializedThread {
+  id: string
+  principalId: PrincipalId | null
+  audience: 'public' | 'internal' | 'shared_team'
+  bodyJson: TiptapContent | null
+  bodyText: string
+  createdAt: string
+  editedAt: string | null
+}
+
+interface SerializedTicketDetail {
+  ticket: {
+    id: TicketId
+    subject: string
+    descriptionJson: TiptapContent | null
+    descriptionText: string | null
+    statusId: TicketStatusId
+    statusCategory: SerializedTicketRow['statusCategory']
+    statusName: string
+    statusColor: string | null
+    requesterPrincipalId: PrincipalId | null
+    createdAt: string
+    lastActivityAt: string
+    updatedAt: string
+  }
+  threads: SerializedThread[]
+  /** Map of principalId → display name. Staff names are stripped to "Support team" by the UI. */
+  principalNames: Record<string, string>
+  /** The viewer's own principalId, so the UI can show "You" instead of their name. */
+  viewerPrincipalId: PrincipalId | null
+  /** The viewer's relationship to this ticket — drives what actions are available. */
+  viewerRelationship: PortalViewerRelationship
+}
+
+export const getMyTicketFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ ticketId: z.string().min(1) }))
+  .handler(async ({ data }): Promise<SerializedTicketDetail> => {
+    const ctx = await requireAuth()
+    const userId = ctx.user.id as UserId
+
+    const ticket = await getTicketForPortalUser({
+      userId,
+      ticketId: data.ticketId as TicketId,
+    })
+    const [threads, status, viewerPrincipal, identity] = await Promise.all([
+      listPublicThreadsForTicket(ticket.id as TicketId),
+      ticket.statusId
+        ? db.query.ticketStatuses.findFirst({
+            where: eq(ticketStatuses.id, ticket.statusId),
+          })
+        : Promise.resolve(undefined),
+      db.query.principal.findFirst({ where: eq(principal.userId, userId) }),
+      buildPortalIdentity(userId),
+    ])
+    const viewerRelationship = await resolveViewerRelationship(ticket, identity)
+
+    // Hydrate principal display names for each thread author. The UI policy
+    // collapses any staff principal to "Support team" — we still need a map
+    // so the viewer's own threads are labelled correctly.
+    const principalIds = Array.from(
+      new Set(threads.map((t) => t.principalId).filter((p): p is PrincipalId => p != null))
+    )
+    const principalRows = principalIds.length
+      ? await db
+          .select({
+            id: principal.id,
+            type: principal.type,
+            userName: user.name,
+          })
+          .from(principal)
+          .leftJoin(user, eq(principal.userId, user.id))
+          .where(inArray(principal.id, principalIds))
+      : []
+    const principalNames: Record<string, string> = {}
+    for (const row of principalRows) {
+      principalNames[row.id] = row.userName ?? 'User'
+    }
+
+    return {
+      ticket: {
+        id: ticket.id as TicketId,
+        subject: ticket.subject,
+        descriptionJson: (ticket.descriptionJson as TiptapContent | null) ?? null,
+        descriptionText: ticket.descriptionText ?? null,
+        statusId: ticket.statusId as TicketStatusId,
+        statusCategory: (status?.category ?? 'open') as SerializedTicketRow['statusCategory'],
+        statusName: status?.name ?? 'Unknown',
+        statusColor: status?.color ?? null,
+        requesterPrincipalId: (ticket.requesterPrincipalId as PrincipalId | null) ?? null,
+        createdAt: toIsoString(ticket.createdAt),
+        lastActivityAt: toIsoString(ticket.lastActivityAt),
+        updatedAt: toIsoString(ticket.updatedAt),
+      },
+      threads: threads.map(
+        (t): SerializedThread => ({
+          id: t.id,
+          principalId: (t.principalId as PrincipalId | null) ?? null,
+          audience: t.audience as SerializedThread['audience'],
+          bodyJson: (t.bodyJson as TiptapContent | null) ?? null,
+          bodyText: t.bodyText,
+          createdAt: toIsoString(t.createdAt),
+          editedAt: toIsoStringOrNull(t.editedAt),
+        })
+      ),
+      principalNames,
+      viewerPrincipalId: (viewerPrincipal?.id as PrincipalId | undefined) ?? null,
+      viewerRelationship,
+    }
+  })
+
+export const replyToMyTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: z.string().min(1),
+      bodyJson: tiptapDocSchema.nullable().optional(),
+      bodyText: z.string().max(100_000).nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuth()
+    const thread = await addPortalReply({
+      userId: ctx.user.id as UserId,
+      ticketId: data.ticketId as TicketId,
+      bodyJson: (data.bodyJson ?? null) as never,
+      bodyText: data.bodyText ?? null,
+    })
+    return {
+      id: thread.id,
+      ticketId: thread.ticketId as TicketId,
+      audience: thread.audience as SerializedThread['audience'],
+      createdAt: toIsoString(thread.createdAt),
+    }
+  })
+
+export const updateMyTicketDescriptionFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: z.string().min(1),
+      expectedUpdatedAt: z.string().datetime(),
+      descriptionJson: tiptapDocSchema.nullable().optional(),
+      descriptionText: z.string().max(100_000).nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuth()
+    const updated = await updatePortalTicketDescription({
+      userId: ctx.user.id as UserId,
+      ticketId: data.ticketId as TicketId,
+      expectedUpdatedAt: new Date(data.expectedUpdatedAt),
+      descriptionJson: (data.descriptionJson ?? null) as never,
+      descriptionText: data.descriptionText ?? null,
+    })
+    return {
+      id: updated.id as TicketId,
+      updatedAt: toIsoString(updated.updatedAt),
+    }
+  })
+
+export const closeMyTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ ticketId: z.string().min(1) }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuth()
+    const updated = await closePortalTicket({
+      userId: ctx.user.id as UserId,
+      ticketId: data.ticketId as TicketId,
+    })
+    const status = updated.statusId
+      ? await db.query.ticketStatuses.findFirst({
+          where: eq(ticketStatuses.id, updated.statusId),
+        })
+      : undefined
+    return {
+      id: updated.id as TicketId,
+      statusCategory: (status?.category ?? 'solved') as SerializedTicketRow['statusCategory'],
+      statusName: status?.name ?? 'Solved',
+      updatedAt: toIsoString(updated.updatedAt),
+    }
+  })
+
+export const reopenMyTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ ticketId: z.string().min(1) }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuth()
+    const updated = await reopenPortalTicket({
+      userId: ctx.user.id as UserId,
+      ticketId: data.ticketId as TicketId,
+    })
+    const status = updated.statusId
+      ? await db.query.ticketStatuses.findFirst({
+          where: eq(ticketStatuses.id, updated.statusId),
+        })
+      : undefined
+    return {
+      id: updated.id as TicketId,
+      statusCategory: (status?.category ?? 'open') as SerializedTicketRow['statusCategory'],
+      statusName: status?.name ?? 'Open',
+      updatedAt: toIsoString(updated.updatedAt),
+    }
+  })
+
+export const createMyTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      subject: z.string().min(1).max(500),
+      descriptionJson: tiptapDocSchema.nullable().optional(),
+      descriptionText: z.string().max(100_000).nullable().optional(),
+      priority: z.enum(['low', 'normal', 'high', 'urgent']).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuth()
+    const memberRow = await getMemberByUser(ctx.user.id as UserId)
+    if (!memberRow) {
+      throw new ForbiddenError('PORTAL_NO_PRINCIPAL', 'portal user has no principal')
+    }
+
+    const created = await createTicket({
+      subject: data.subject,
+      descriptionJson: (data.descriptionJson ?? null) as never,
+      descriptionText: data.descriptionText ?? null,
+      priority: data.priority,
+      channel: 'portal',
+      requesterPrincipalId: memberRow.id as PrincipalId,
+      createdByPrincipalId: memberRow.id as PrincipalId,
+    })
+
+    const status = created.statusId
+      ? await db.query.ticketStatuses.findFirst({
+          where: eq(ticketStatuses.id, created.statusId),
+        })
+      : undefined
+
+    return {
+      id: created.id as TicketId,
+      subject: created.subject,
+      statusId: created.statusId as TicketStatusId,
+      statusCategory: (status?.category ?? 'open') as SerializedTicketRow['statusCategory'],
+      statusName: status?.name ?? 'Unknown',
+      statusColor: status?.color ?? null,
+      createdAt: toIsoString(created.createdAt),
+      lastActivityAt: toIsoString(created.lastActivityAt),
+    }
+  })
+
+/**
+ * Create an initial public thread for a ticket to hold attachments during
+ * the creation flow. This ensures files can be attached immediately after
+ * ticket creation without requiring the user to open a reply.
+ */
+export const createTicketInitialThreadFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ ticketId: z.string().min(1) }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuth()
+    const ticketId = data.ticketId as TicketId
+
+    // Verify ownership via portal user check
+    await getTicketForPortalUser({
+      userId: ctx.user.id as UserId,
+      ticketId,
+    })
+
+    // Create a public thread with a placeholder body
+    const thread = await addPortalReply({
+      userId: ctx.user.id as UserId,
+      ticketId,
+      bodyText: '[Attachments added at ticket creation]',
+    })
+
+    return {
+      id: thread.id,
+    }
+  })
diff --git a/apps/web/src/lib/server/functions/principals.ts b/apps/web/src/lib/server/functions/principals.ts
new file mode 100644
index 000000000..a7c89ce73
--- /dev/null
+++ b/apps/web/src/lib/server/functions/principals.ts
@@ -0,0 +1,119 @@
+/**
+ * Principal/user search server functions.
+ *
+ * Powers every "people" picker in the agent/admin UI (assignee, team-add,
+ * escalation recipients, contact↔user link). Returns a thin row optimised for
+ * combobox rendering — id, name, email, role, avatar.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type { PrincipalId, UserId } from '@quackback/ids'
+import { requireAuth } from './auth-helpers'
+import { db, eq, and, or, ilike, inArray, notInArray, desc, principal, user } from '@/lib/server/db'
+
+const principalIdSchema = z.string().min(1) as z.ZodType<PrincipalId>
+
+export interface PrincipalSearchRow {
+  id: PrincipalId
+  displayName: string | null
+  email: string | null
+  role: string
+  avatarUrl: string | null
+  type: string
+  userId: UserId | null
+}
+
+export const searchPrincipalsFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      query: z.string().max(200).optional(),
+      roleFilter: z.array(z.string().max(32)).optional(),
+      excludeIds: z.array(principalIdSchema).max(200).optional(),
+      limit: z.number().int().min(1).max(50).optional(),
+    })
+  )
+  .handler(async ({ data }): Promise<PrincipalSearchRow[]> => {
+    // Any authenticated team member can search principals — UI requires it
+    // for picker controls. The result set is read-only (id/name/email/role).
+    await requireAuth({ roles: ['admin', 'member', 'user'] })
+
+    const limit = data.limit ?? 20
+    const trimmed = data.query?.trim() ?? ''
+
+    const filters = []
+
+    if (data.roleFilter && data.roleFilter.length > 0) {
+      filters.push(inArray(principal.role, data.roleFilter))
+    }
+    if (data.excludeIds && data.excludeIds.length > 0) {
+      filters.push(notInArray(principal.id, data.excludeIds))
+    }
+    if (trimmed.length > 0) {
+      const pattern = `%${trimmed}%`
+      const textMatch = or(
+        ilike(principal.displayName, pattern),
+        ilike(user.email, pattern),
+        ilike(user.name, pattern)
+      )
+      if (textMatch) filters.push(textMatch)
+    }
+
+    const where = filters.length > 0 ? and(...filters) : undefined
+
+    const rows = await db
+      .select({
+        id: principal.id,
+        displayName: principal.displayName,
+        avatarUrl: principal.avatarUrl,
+        role: principal.role,
+        type: principal.type,
+        userId: principal.userId,
+        userEmail: user.email,
+        userName: user.name,
+      })
+      .from(principal)
+      .leftJoin(user, eq(principal.userId, user.id))
+      .where(where)
+      .orderBy(desc(principal.createdAt))
+      .limit(limit)
+
+    return rows.map((r) => ({
+      id: r.id as PrincipalId,
+      displayName: r.displayName ?? r.userName ?? null,
+      email: r.userEmail ?? null,
+      role: r.role,
+      avatarUrl: r.avatarUrl,
+      type: r.type,
+      userId: (r.userId as UserId | null) ?? null,
+    }))
+  })
+
+export const getPrincipalsByIdsFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ ids: z.array(principalIdSchema).min(1).max(200) }))
+  .handler(async ({ data }): Promise<PrincipalSearchRow[]> => {
+    await requireAuth({ roles: ['admin', 'member', 'user'] })
+    const rows = await db
+      .select({
+        id: principal.id,
+        displayName: principal.displayName,
+        avatarUrl: principal.avatarUrl,
+        role: principal.role,
+        type: principal.type,
+        userId: principal.userId,
+        userEmail: user.email,
+        userName: user.name,
+      })
+      .from(principal)
+      .leftJoin(user, eq(principal.userId, user.id))
+      .where(inArray(principal.id, data.ids))
+
+    return rows.map((r) => ({
+      id: r.id as PrincipalId,
+      displayName: r.displayName ?? r.userName ?? null,
+      email: r.userEmail ?? null,
+      role: r.role,
+      avatarUrl: r.avatarUrl,
+      type: r.type,
+      userId: (r.userId as UserId | null) ?? null,
+    }))
+  })
diff --git a/apps/web/src/lib/server/functions/recovery-codes-consume.ts b/apps/web/src/lib/server/functions/recovery-codes-consume.ts
index a230ff22e..d4feb1f53 100644
--- a/apps/web/src/lib/server/functions/recovery-codes-consume.ts
+++ b/apps/web/src/lib/server/functions/recovery-codes-consume.ts
@@ -25,7 +25,7 @@ import { hashRecoveryCode, verifyRecoveryCode } from '@/lib/server/auth/recovery
 import { mintMagicLinkUrl } from '@/lib/server/auth/magic-link-mint'
 import { getClientIp } from '@/lib/server/domains/api/rate-limit'
 import { bucketRetryAfter, incrementBucket } from '@/lib/server/utils/redis-rate-bucket'
-import { config } from '@/lib/server/config'
+import { resolvePublicBaseUrl } from '@/lib/server/public-url'
 import { logger } from '@/lib/server/logger'
 
 const log = logger.child({ component: 'recovery' })
@@ -162,11 +162,11 @@ export const consumeRecoveryCodeFn = createServerFn({ method: 'POST' })
     const { url: redirectUrl } = await mintMagicLinkUrl({
       email: data.email,
       callbackPath: '/admin',
+      portalUrl: resolvePublicBaseUrl(headers),
       // Unified login with the `/admin` callback (team break-glass form).
       // Better-Auth merges its `error` param via `URL.searchParams`, so the
       // `?callbackUrl=` query survives on a failed verify (joined with `&`).
       errorCallbackPath: '/auth/login?callbackUrl=/admin',
-      portalUrl: config.baseUrl,
     })
 
     await recordAuditEvent({
diff --git a/apps/web/src/lib/server/functions/recovery-codes.ts b/apps/web/src/lib/server/functions/recovery-codes.ts
index 5d8d18503..4d1240e6b 100644
--- a/apps/web/src/lib/server/functions/recovery-codes.ts
+++ b/apps/web/src/lib/server/functions/recovery-codes.ts
@@ -22,6 +22,7 @@ import { and, db, eq, isNull, ssoRecoveryCode } from '@/lib/server/db'
 import { actorFromAuth, recordAuditEvent } from '@/lib/server/audit/log'
 import { generateRecoveryCode, hashRecoveryCode } from '@/lib/server/auth/recovery-codes'
 import { requireAuth } from './auth-helpers'
+import { toIsoString, toIsoStringOrNull } from '@/lib/shared/utils'
 
 const RECOVERY_CODE_BATCH_SIZE = 10
 
@@ -74,8 +75,8 @@ export const listRecoveryCodesFn = createServerFn({ method: 'GET' })
     return {
       codes: rows.map((row) => ({
         id: row.id,
-        usedAt: row.usedAt ? row.usedAt.toISOString() : null,
-        createdAt: row.createdAt.toISOString(),
+        usedAt: toIsoStringOrNull(row.usedAt),
+        createdAt: toIsoString(row.createdAt),
       })),
     }
   })
diff --git a/apps/web/src/lib/server/functions/roles.ts b/apps/web/src/lib/server/functions/roles.ts
new file mode 100644
index 000000000..6a3267c77
--- /dev/null
+++ b/apps/web/src/lib/server/functions/roles.ts
@@ -0,0 +1,149 @@
+/**
+ * Roles & permissions admin server-fns.
+ *
+ * All gated by `requireAuth({ roles: ['admin'] })`. The actor's principal id
+ * is propagated to the service for `grantedByPrincipalId` and audit events.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type { PrincipalId, RoleId, RoleAssignmentId, TeamId } from '@quackback/ids'
+import { requireAuth } from './auth-helpers'
+import {
+  listRoles,
+  getRoleWithPermissions,
+  createRole,
+  updateRole,
+  deleteRole,
+  setRolePermissions,
+  listAssignmentsForPrincipal,
+  assignRole,
+  revokeRoleAssignment,
+} from '@/lib/server/domains/authz/role.service'
+import { ALL_PERMISSIONS, type PermissionKey } from '@/lib/server/domains/authz/authz.permissions'
+
+const roleIdSchema = z.string().min(1) as z.ZodType<RoleId>
+const principalIdSchema = z.string().min(1) as z.ZodType<PrincipalId>
+const teamIdSchema = z.string().min(1) as z.ZodType<TeamId>
+const assignmentIdSchema = z.string().min(1) as z.ZodType<RoleAssignmentId>
+
+const permissionKeySchema = z.enum(ALL_PERMISSIONS as readonly [PermissionKey, ...PermissionKey[]])
+
+const roleKeySchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(/^[a-z][a-z0-9_-]*$/, 'lowercase letters, digits, _ or - only')
+
+export const listRolesFn = createServerFn({ method: 'GET' }).handler(async () => {
+  await requireAuth({ roles: ['admin'] })
+  return listRoles()
+})
+
+export const getRoleFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ id: roleIdSchema }))
+  .handler(async ({ data }) => {
+    await requireAuth({ roles: ['admin'] })
+    return getRoleWithPermissions(data.id)
+  })
+
+export const createRoleFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      key: roleKeySchema,
+      name: z.string().min(1).max(128),
+      description: z.string().max(2000).optional().nullable(),
+      permissionKeys: z.array(permissionKeySchema).max(128),
+    })
+  )
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin'] })
+    const id = await createRole({
+      key: data.key,
+      name: data.name,
+      description: data.description ?? null,
+      permissionKeys: data.permissionKeys,
+      actorPrincipalId: auth.principal.id,
+    })
+    return { id }
+  })
+
+export const updateRoleFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      id: roleIdSchema,
+      name: z.string().min(1).max(128),
+      description: z.string().max(2000).optional().nullable(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin'] })
+    await updateRole({
+      id: data.id,
+      name: data.name,
+      description: data.description ?? null,
+      actorPrincipalId: auth.principal.id,
+    })
+    return { ok: true as const }
+  })
+
+export const deleteRoleFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ id: roleIdSchema }))
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin'] })
+    await deleteRole({ id: data.id, actorPrincipalId: auth.principal.id })
+    return { ok: true as const }
+  })
+
+export const setRolePermissionsFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      roleId: roleIdSchema,
+      permissionKeys: z.array(permissionKeySchema).max(128),
+    })
+  )
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin'] })
+    await setRolePermissions({
+      roleId: data.roleId,
+      permissionKeys: data.permissionKeys,
+      actorPrincipalId: auth.principal.id,
+    })
+    return { ok: true as const }
+  })
+
+export const listAssignmentsForPrincipalFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ principalId: principalIdSchema }))
+  .handler(async ({ data }) => {
+    await requireAuth({ roles: ['admin'] })
+    return listAssignmentsForPrincipal(data.principalId)
+  })
+
+export const assignRoleFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      principalId: principalIdSchema,
+      roleId: roleIdSchema,
+      teamId: teamIdSchema.optional().nullable(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin'] })
+    const id = await assignRole({
+      principalId: data.principalId,
+      roleId: data.roleId,
+      teamId: data.teamId ?? null,
+      actorPrincipalId: auth.principal.id,
+    })
+    return { id }
+  })
+
+export const revokeRoleAssignmentFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ assignmentId: assignmentIdSchema }))
+  .handler(async ({ data }) => {
+    const auth = await requireAuth({ roles: ['admin'] })
+    await revokeRoleAssignment({
+      assignmentId: data.assignmentId,
+      actorPrincipalId: auth.principal.id,
+    })
+    return { ok: true as const }
+  })
diff --git a/apps/web/src/lib/server/functions/routing.ts b/apps/web/src/lib/server/functions/routing.ts
new file mode 100644
index 000000000..19ab1d9c7
--- /dev/null
+++ b/apps/web/src/lib/server/functions/routing.ts
@@ -0,0 +1,126 @@
+/**
+ * Routing-rule server functions.
+ *
+ * All endpoints require ROUTING_RULE_MANAGE.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type { InboxId, RoutingRuleId } from '@quackback/ids'
+import { requirePermission } from './auth-helpers'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  createRoutingRule,
+  updateRoutingRule,
+  deleteRoutingRule,
+  getRoutingRule,
+  listRoutingRules,
+  reorderRoutingRules,
+  type CreateRoutingRuleInput,
+  type UpdateRoutingRuleInput,
+} from '@/lib/server/domains/inboxes'
+import { recordEvent } from '@/lib/server/domains/audit'
+
+const inboxIdSchema = z.string().min(1) as z.ZodType<InboxId>
+const ruleIdSchema = z.string().min(1) as z.ZodType<RoutingRuleId>
+
+// Conditions/actions are validated inside the service via Zod; pass-through here.
+const ruleSetSchema = z.unknown()
+const actionsSchema = z.unknown()
+
+export const listRoutingRulesFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      inboxIdScope: z.union([inboxIdSchema, z.literal('workspace')]).optional(),
+      enabledOnly: z.boolean().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ROUTING_RULE_MANAGE)
+    return listRoutingRules(data)
+  })
+
+export const getRoutingRuleFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ ruleId: ruleIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ROUTING_RULE_MANAGE)
+    return getRoutingRule(data.ruleId)
+  })
+
+export const createRoutingRuleFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      name: z.string().min(1).max(200),
+      description: z.string().max(1000).nullable().optional(),
+      priority: z.number().int().min(0).max(1_000_000).optional(),
+      enabled: z.boolean().optional(),
+      conditions: ruleSetSchema,
+      actions: actionsSchema,
+      inboxIdScope: inboxIdSchema.nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ROUTING_RULE_MANAGE)
+    const rule = await createRoutingRule(data as unknown as CreateRoutingRuleInput)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'routing_rule.created',
+      targetType: 'routing_rule',
+      targetId: rule.id,
+      diff: { after: { name: rule.name, priority: rule.priority } },
+    })
+    return rule
+  })
+
+export const updateRoutingRuleFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ruleId: ruleIdSchema,
+      name: z.string().min(1).max(200).optional(),
+      description: z.string().max(1000).nullable().optional(),
+      priority: z.number().int().min(0).max(1_000_000).optional(),
+      enabled: z.boolean().optional(),
+      conditions: ruleSetSchema.optional(),
+      actions: actionsSchema.optional(),
+      inboxIdScope: inboxIdSchema.nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ROUTING_RULE_MANAGE)
+    const { ruleId, ...patch } = data
+    const rule = await updateRoutingRule(ruleId, patch as unknown as UpdateRoutingRuleInput)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'routing_rule.updated',
+      targetType: 'routing_rule',
+      targetId: rule.id,
+    })
+    return rule
+  })
+
+export const deleteRoutingRuleFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ ruleId: ruleIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ROUTING_RULE_MANAGE)
+    await deleteRoutingRule(data.ruleId)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'routing_rule.deleted',
+      targetType: 'routing_rule',
+      targetId: data.ruleId,
+    })
+    return { ok: true }
+  })
+
+export const reorderRoutingRulesFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ orderedIds: z.array(ruleIdSchema).min(1) }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ROUTING_RULE_MANAGE)
+    await reorderRoutingRules(data.orderedIds)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'routing_rule.reordered',
+      targetType: 'routing_rule',
+      targetId: data.orderedIds[0],
+    })
+    return { ok: true }
+  })
diff --git a/apps/web/src/lib/server/functions/sla.ts b/apps/web/src/lib/server/functions/sla.ts
new file mode 100644
index 000000000..4331c4319
--- /dev/null
+++ b/apps/web/src/lib/server/functions/sla.ts
@@ -0,0 +1,367 @@
+/**
+ * SLA server functions — admin/agent surface for SLA + escalation CRUD,
+ * and a manual escalation tick trigger.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type {
+  BusinessHoursId,
+  SlaPolicyId,
+  EscalationRuleId,
+  TeamId,
+  InboxId,
+  PrincipalId,
+  TicketId,
+} from '@quackback/ids'
+import { requirePermission } from './auth-helpers'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { recordEvent } from '@/lib/server/domains/audit'
+import {
+  createBusinessHours,
+  updateBusinessHours,
+  archiveBusinessHours,
+  getBusinessHours,
+  listBusinessHours,
+  createSlaPolicy,
+  updateSlaPolicy,
+  archiveSlaPolicy,
+  getSlaPolicy,
+  listSlaPolicies,
+  replaceTargets,
+  listTargetsForPolicy,
+  createEscalationRule,
+  updateEscalationRule,
+  deleteEscalationRule,
+  listEscalationRulesForPolicy,
+  getActiveClocksForTicket,
+  getAllClocksForTicket,
+  listBreachingClocks,
+  runEscalationTick,
+} from '@/lib/server/domains/sla'
+import {
+  SLA_POLICY_SCOPES,
+  SLA_TARGET_KINDS,
+  ESCALATION_RECIPIENT_TYPES,
+  ESCALATION_CHANNELS,
+  TICKET_PRIORITIES,
+} from '@/lib/server/db'
+
+const businessHoursIdSchema = z.string().min(1) as z.ZodType<BusinessHoursId>
+const slaPolicyIdSchema = z.string().min(1) as z.ZodType<SlaPolicyId>
+const escalationRuleIdSchema = z.string().min(1) as z.ZodType<EscalationRuleId>
+const teamIdSchema = z.string().min(1) as z.ZodType<TeamId>
+const inboxIdSchema = z.string().min(1) as z.ZodType<InboxId>
+const principalIdSchema = z.string().min(1) as z.ZodType<PrincipalId>
+const ticketIdSchema = z.string().min(1) as z.ZodType<TicketId>
+
+const rangeSchema = z.object({
+  start: z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),
+  end: z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),
+})
+const scheduleSchema = z.object({
+  mon: z.array(rangeSchema),
+  tue: z.array(rangeSchema),
+  wed: z.array(rangeSchema),
+  thu: z.array(rangeSchema),
+  fri: z.array(rangeSchema),
+  sat: z.array(rangeSchema),
+  sun: z.array(rangeSchema),
+})
+const holidaySchema = z.object({
+  date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  label: z.string().max(200).optional(),
+})
+
+// ---- business hours ----
+
+export const listBusinessHoursFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ includeArchived: z.boolean().optional() }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.SLA_VIEW)
+    return listBusinessHours({ includeArchived: data.includeArchived })
+  })
+
+export const getBusinessHoursFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ id: businessHoursIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.SLA_VIEW)
+    return getBusinessHours(data.id)
+  })
+
+export const createBusinessHoursFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      name: z.string().min(1).max(200),
+      timezone: z.string().min(1).max(64).optional(),
+      schedule: scheduleSchema,
+      holidays: z.array(holidaySchema).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.BUSINESS_HOURS_MANAGE)
+    const row = await createBusinessHours(data)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'business_hours.created',
+      targetType: 'business_hours',
+      targetId: row.id,
+      diff: { after: { name: row.name } },
+    })
+    return row
+  })
+
+export const updateBusinessHoursFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      id: businessHoursIdSchema,
+      name: z.string().min(1).max(200).optional(),
+      timezone: z.string().min(1).max(64).optional(),
+      schedule: scheduleSchema.optional(),
+      holidays: z.array(holidaySchema).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.BUSINESS_HOURS_MANAGE)
+    const { id, ...patch } = data
+    const row = await updateBusinessHours(id, patch)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'business_hours.updated',
+      targetType: 'business_hours',
+      targetId: id,
+    })
+    return row
+  })
+
+export const archiveBusinessHoursFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ id: businessHoursIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.BUSINESS_HOURS_MANAGE)
+    const row = await archiveBusinessHours(data.id)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'business_hours.archived',
+      targetType: 'business_hours',
+      targetId: data.id,
+    })
+    return row
+  })
+
+// ---- sla policies ----
+
+export const listSlaPoliciesFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ includeArchived: z.boolean().optional() }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.SLA_VIEW)
+    return listSlaPolicies({ includeArchived: data.includeArchived })
+  })
+
+export const getSlaPolicyFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ id: slaPolicyIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.SLA_VIEW)
+    const policy = await getSlaPolicy(data.id)
+    if (!policy) return null
+    const targets = await listTargetsForPolicy(data.id)
+    const escalations = await listEscalationRulesForPolicy(data.id)
+    return { policy, targets, escalations }
+  })
+
+export const createSlaPolicyFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      name: z.string().min(1).max(200),
+      description: z.string().max(1000).nullable().optional(),
+      priority: z.number().int().optional(),
+      enabled: z.boolean().optional(),
+      scope: z.enum(SLA_POLICY_SCOPES),
+      scopeTeamId: teamIdSchema.nullable().optional(),
+      scopeInboxId: inboxIdSchema.nullable().optional(),
+      appliesToPriorities: z.array(z.enum(TICKET_PRIORITIES)).optional(),
+      businessHoursId: businessHoursIdSchema.nullable().optional(),
+      pauseOnPending: z.boolean().optional(),
+      pauseOnOnHold: z.boolean().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.SLA_MANAGE)
+    const policy = await createSlaPolicy(data)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'sla_policy.created',
+      targetType: 'sla_policy',
+      targetId: policy.id,
+      diff: { after: { name: policy.name, scope: policy.scope } },
+    })
+    return policy
+  })
+
+export const updateSlaPolicyFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      id: slaPolicyIdSchema,
+      name: z.string().min(1).max(200).optional(),
+      description: z.string().max(1000).nullable().optional(),
+      priority: z.number().int().optional(),
+      enabled: z.boolean().optional(),
+      appliesToPriorities: z.array(z.enum(TICKET_PRIORITIES)).optional(),
+      businessHoursId: businessHoursIdSchema.nullable().optional(),
+      pauseOnPending: z.boolean().optional(),
+      pauseOnOnHold: z.boolean().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.SLA_MANAGE)
+    const { id, ...patch } = data
+    const policy = await updateSlaPolicy(id, patch)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'sla_policy.updated',
+      targetType: 'sla_policy',
+      targetId: id,
+    })
+    return policy
+  })
+
+export const archiveSlaPolicyFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ id: slaPolicyIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.SLA_MANAGE)
+    const policy = await archiveSlaPolicy(data.id)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'sla_policy.archived',
+      targetType: 'sla_policy',
+      targetId: data.id,
+    })
+    return policy
+  })
+
+export const replaceSlaTargetsFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      policyId: slaPolicyIdSchema,
+      targets: z.array(
+        z.object({
+          kind: z.enum(SLA_TARGET_KINDS),
+          minutes: z.number().int().positive(),
+        })
+      ),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.SLA_MANAGE)
+    const rows = await replaceTargets(data.policyId, data.targets)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'sla_policy.targets_updated',
+      targetType: 'sla_policy',
+      targetId: data.policyId,
+      diff: { after: { count: rows.length } },
+    })
+    return rows
+  })
+
+// ---- escalation rules ----
+
+export const listEscalationRulesFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ policyId: slaPolicyIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.SLA_VIEW)
+    return listEscalationRulesForPolicy(data.policyId)
+  })
+
+export const createEscalationRuleFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      policyId: slaPolicyIdSchema,
+      name: z.string().min(1).max(200),
+      leadMinutes: z.number().int(),
+      targetKind: z.enum(SLA_TARGET_KINDS),
+      recipientType: z.enum(ESCALATION_RECIPIENT_TYPES),
+      recipientTeamId: teamIdSchema.nullable().optional(),
+      recipientPrincipalIds: z.array(principalIdSchema).optional(),
+      channels: z.array(z.enum(ESCALATION_CHANNELS)).optional(),
+      enabled: z.boolean().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ESCALATION_RULE_MANAGE)
+    const rule = await createEscalationRule(data)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'escalation_rule.created',
+      targetType: 'escalation_rule',
+      targetId: rule.id,
+      diff: { after: { name: rule.name, leadMinutes: rule.leadMinutes } },
+    })
+    return rule
+  })
+
+export const updateEscalationRuleFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      id: escalationRuleIdSchema,
+      name: z.string().min(1).max(200).optional(),
+      leadMinutes: z.number().int().optional(),
+      targetKind: z.enum(SLA_TARGET_KINDS).optional(),
+      recipientType: z.enum(ESCALATION_RECIPIENT_TYPES).optional(),
+      recipientTeamId: teamIdSchema.nullable().optional(),
+      recipientPrincipalIds: z.array(principalIdSchema).optional(),
+      channels: z.array(z.enum(ESCALATION_CHANNELS)).optional(),
+      enabled: z.boolean().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ESCALATION_RULE_MANAGE)
+    const { id, ...patch } = data
+    const rule = await updateEscalationRule(id, patch)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'escalation_rule.updated',
+      targetType: 'escalation_rule',
+      targetId: id,
+    })
+    return rule
+  })
+
+export const deleteEscalationRuleFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ id: escalationRuleIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ESCALATION_RULE_MANAGE)
+    await deleteEscalationRule(data.id)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'escalation_rule.deleted',
+      targetType: 'escalation_rule',
+      targetId: data.id,
+    })
+    return { ok: true }
+  })
+
+// ---- ticket clocks ----
+
+export const getTicketSlaClocksFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema, includeAll: z.boolean().optional() }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.SLA_VIEW)
+    return data.includeAll
+      ? getAllClocksForTicket(data.ticketId)
+      : getActiveClocksForTicket(data.ticketId)
+  })
+
+export const listBreachingClocksFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({ windowMinutes: z.number().int().optional(), limit: z.number().int().optional() })
+  )
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.SLA_VIEW)
+    return listBreachingClocks(data)
+  })
+
+export const runSlaTickFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ batchSize: z.number().int().optional() }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.SLA_MANAGE)
+    return runEscalationTick({ batchSize: data.batchSize })
+  })
diff --git a/apps/web/src/lib/server/functions/sso.ts b/apps/web/src/lib/server/functions/sso.ts
index dadb7cb17..bd8743b2c 100644
--- a/apps/web/src/lib/server/functions/sso.ts
+++ b/apps/web/src/lib/server/functions/sso.ts
@@ -27,6 +27,7 @@ import { ConflictError, ForbiddenError, ValidationError } from '@/lib/shared/err
 import { httpsUrl } from '@/lib/shared/schemas/auth'
 import { actorFromAuth, withAuditEvent } from '@/lib/server/audit/log'
 import { requireAuth } from './auth-helpers'
+import { toIsoString, toIsoStringOrNull } from '@/lib/shared/utils'
 
 const verifiedDomainId = z.string().regex(/^domain_/) as z.ZodType<`domain_${string}`>
 
@@ -412,7 +413,7 @@ export const verifyProviderDomainFn = createServerFn({ method: 'POST' })
       return { verified: false, reason: 'mismatch' }
     }
 
-    const verifiedAt = new Date().toISOString()
+    const verifiedAt = toIsoString(new Date())
     try {
       await stampVerifiedDomain({
         id: dom.id,
diff --git a/apps/web/src/lib/server/functions/status-sync.ts b/apps/web/src/lib/server/functions/status-sync.ts
index ed59afe3e..b28103314 100644
--- a/apps/web/src/lib/server/functions/status-sync.ts
+++ b/apps/web/src/lib/server/functions/status-sync.ts
@@ -3,6 +3,7 @@
  */
 
 import { createServerFn } from '@tanstack/react-start'
+import { getRequestHeaders } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from './auth-helpers'
 import { db, integrations, eq } from '@/lib/server/db'
@@ -55,7 +56,9 @@ export const enableStatusSyncFn = createServerFn({ method: 'POST' })
       if (integration.status !== 'active') throw new Error('Integration must be active')
 
       const secret = generateWebhookSecret()
-      const callbackUrl = buildWebhookCallbackUrl(data.integrationType)
+      const callbackUrl = buildWebhookCallbackUrl(data.integrationType, {
+        requestHeaders: getRequestHeaders(),
+      })
       const config = (integration.config ?? {}) as Record<string, unknown>
 
       let externalWebhookId: string | undefined
@@ -134,7 +137,18 @@ export const enableStatusSyncFn = createServerFn({ method: 'POST' })
         }
       }
 
-      await storeWebhookConfig(integrationId, secret, externalWebhookId)
+      await storeWebhookConfig(
+        integrationId,
+        secret,
+        externalWebhookId,
+        data.integrationType === 'github'
+          ? {
+              githubWebhookEventsVersion: (
+                await import('@/lib/server/integrations/github/webhook-registration')
+              ).GITHUB_WEBHOOK_EVENTS_VERSION,
+            }
+          : undefined
+      )
 
       return {
         success: true,
diff --git a/apps/web/src/lib/server/functions/teams.ts b/apps/web/src/lib/server/functions/teams.ts
new file mode 100644
index 000000000..2f9778fcf
--- /dev/null
+++ b/apps/web/src/lib/server/functions/teams.ts
@@ -0,0 +1,186 @@
+/**
+ * Teams server functions.
+ *
+ * All write actions are gated by the ADMIN_MANAGE_USERS permission and emit
+ * an audit event so the admin trail captures team membership changes.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type { PrincipalId, TeamId } from '@quackback/ids'
+import { requirePermission } from './auth-helpers'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  createTeam,
+  updateTeam,
+  archiveTeam,
+  unarchiveTeam,
+  getTeam,
+  listTeams,
+  addMember,
+  removeMember,
+  listMembers,
+  type TeamRole,
+} from '@/lib/server/domains/teams'
+import { recordEvent } from '@/lib/server/domains/audit'
+
+const teamIdSchema = z.string().min(1) as z.ZodType<TeamId>
+const principalIdSchema = z.string().min(1) as z.ZodType<PrincipalId>
+
+export const listTeamsFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ includeArchived: z.boolean().optional() }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    return listTeams({ includeArchived: data.includeArchived })
+  })
+
+export const getTeamFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ teamId: teamIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    return getTeam(data.teamId)
+  })
+
+export const createTeamFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      slug: z.string().min(1).max(64),
+      name: z.string().min(1).max(120),
+      description: z.string().max(500).nullable().optional(),
+      shortLabel: z.string().max(8).nullable().optional(),
+      color: z.string().max(16).nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    const team = await createTeam(data, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'team.created',
+      targetType: 'team',
+      targetId: team.id,
+      diff: { after: { slug: team.slug, name: team.name } },
+    })
+    return team
+  })
+
+export const updateTeamFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      teamId: teamIdSchema,
+      name: z.string().min(1).max(120).optional(),
+      description: z.string().max(500).nullable().optional(),
+      shortLabel: z.string().max(8).nullable().optional(),
+      color: z.string().max(16).nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    const before = await getTeam(data.teamId)
+    const team = await updateTeam(data.teamId, data, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'team.updated',
+      targetType: 'team',
+      targetId: team.id,
+      diff: {
+        before: before
+          ? {
+              name: before.name,
+              description: before.description,
+              shortLabel: before.shortLabel,
+              color: before.color,
+            }
+          : undefined,
+        after: {
+          name: team.name,
+          description: team.description,
+          shortLabel: team.shortLabel,
+          color: team.color,
+        },
+      },
+    })
+    return team
+  })
+
+export const archiveTeamFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ teamId: teamIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    await archiveTeam(data.teamId, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'team.archived',
+      targetType: 'team',
+      targetId: data.teamId,
+    })
+    return { ok: true as const }
+  })
+
+export const unarchiveTeamFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ teamId: teamIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    await unarchiveTeam(data.teamId, {
+      principalId: ctx.principal.id,
+      userId: ctx.user.id,
+    })
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'team.unarchived',
+      targetType: 'team',
+      targetId: data.teamId,
+    })
+    return { ok: true as const }
+  })
+
+export const listTeamMembersFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ teamId: teamIdSchema }))
+  .handler(async ({ data }) => {
+    await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    return listMembers(data.teamId)
+  })
+
+export const addTeamMemberFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      teamId: teamIdSchema,
+      principalId: principalIdSchema,
+      role: z.enum(['lead', 'member']).default('member'),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    const membership = await addMember(data.teamId, data.principalId, data.role as TeamRole)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'team.member_added',
+      targetType: 'team',
+      targetId: data.teamId,
+      diff: { after: { principalId: data.principalId, role: data.role } },
+    })
+    return membership
+  })
+
+export const removeTeamMemberFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ teamId: teamIdSchema, principalId: principalIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.ADMIN_MANAGE_USERS)
+    await removeMember(data.teamId, data.principalId)
+    await recordEvent({
+      principalId: ctx.principal.id,
+      action: 'team.member_removed',
+      targetType: 'team',
+      targetId: data.teamId,
+      diff: { before: { principalId: data.principalId } },
+    })
+    return { ok: true as const }
+  })
diff --git a/apps/web/src/lib/server/functions/tickets.ts b/apps/web/src/lib/server/functions/tickets.ts
new file mode 100644
index 000000000..1df9112df
--- /dev/null
+++ b/apps/web/src/lib/server/functions/tickets.ts
@@ -0,0 +1,663 @@
+/**
+ * Tickets server functions.
+ *
+ * Each handler:
+ *   1. Loads the actor's PermissionSet (via `requireAuthWithPermissions` or
+ *      `requirePermission`).
+ *   2. For per-ticket actions, loads the ticket and converts it to a
+ *      ResourceScope so team-scoped grants are evaluated correctly.
+ *   3. Delegates to the domain service, which writes the activity row +
+ *      audit event itself.
+ */
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import type {
+  TicketId,
+  TicketStatusId,
+  TicketThreadId,
+  TicketShareId,
+  TicketParticipantId,
+  PrincipalId,
+  TeamId,
+  ContactId,
+  OrganizationId,
+} from '@quackback/ids'
+import { requireAuthWithPermissions, requirePermission } from './auth-helpers'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { ForbiddenError, NotFoundError } from '@/lib/shared/errors'
+import {
+  TICKET_PRIORITIES,
+  TICKET_CHANNELS,
+  TICKET_VISIBILITY_SCOPES,
+  TICKET_THREAD_AUDIENCES,
+  TICKET_SHARE_LEVELS,
+  TICKET_PARTICIPANT_ROLES,
+} from '@/lib/server/db'
+import {
+  createTicket,
+  getTicket,
+  updateTicket,
+  assignTicket,
+  transitionStatus,
+  softDeleteTicket,
+  addThread,
+  listThreads,
+  shareTicketWithTeam,
+  revokeShare,
+  listSharesForTicket,
+  addParticipant,
+  removeParticipant,
+  listParticipants,
+  listTickets,
+  toResourceScope,
+  canViewTicket,
+  canReplyPublic,
+  canCommentInternal,
+  canEditFields,
+  canAssign,
+  canShareCrossTeam,
+  canManageParticipants,
+  takeTicket,
+  returnTicket,
+  bulkAssign,
+  bulkTransition,
+  bulkChangeInbox,
+  type TicketQueueScope,
+} from '@/lib/server/domains/tickets'
+import { listTicketStatuses } from '@/lib/server/domains/tickets/ticket-statuses.service'
+import { hasPermissionForResource } from '@/lib/server/domains/authz/authz.service'
+import type { InboxId } from '@quackback/ids'
+import { db, ticketActivity, principal, eq, and, lt, desc, inArray } from '@/lib/server/db'
+import type { AuditJsonValue } from '@/lib/shared/db-types'
+
+// ---------- shared schemas ----------
+
+const ticketIdSchema = z.string().min(1) as z.ZodType<TicketId>
+const ticketStatusIdSchema = z.string().min(1) as z.ZodType<TicketStatusId>
+const _ticketThreadIdSchema = z.string().min(1) as z.ZodType<TicketThreadId>
+const ticketShareIdSchema = z.string().min(1) as z.ZodType<TicketShareId>
+const ticketParticipantIdSchema = z.string().min(1) as z.ZodType<TicketParticipantId>
+const principalIdSchema = z.string().min(1) as z.ZodType<PrincipalId>
+const teamIdSchema = z.string().min(1) as z.ZodType<TeamId>
+const contactIdSchema = z.string().min(1) as z.ZodType<ContactId>
+const orgIdSchema = z.string().min(1) as z.ZodType<OrganizationId>
+const isoDate = z.string().datetime()
+
+const tiptapDocSchema = z
+  .object({ type: z.literal('doc'), content: z.array(z.unknown()).optional() })
+  .passthrough()
+
+// ---------- queue ----------
+
+export const listTicketsFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      scope: z.enum([
+        'all',
+        'my_assigned',
+        'my_team',
+        'shared_with_me',
+        'unassigned',
+        'my_inbox',
+        'inbox',
+      ]),
+      statusCategory: z.enum(['open', 'pending', 'on_hold', 'solved', 'closed']).optional(),
+      search: z.string().max(200).optional(),
+      inboxId: z.string().min(1).nullable().optional(),
+      organizationId: orgIdSchema.nullable().optional(),
+      requesterContactId: contactIdSchema.nullable().optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+      offset: z.number().int().min(0).optional(),
+      sort: z.enum(['last_activity_desc', 'created_desc', 'created_asc']).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    return listTickets({
+      scope: data.scope as TicketQueueScope,
+      permissionSet: ctx.permissions,
+      statusCategory: data.statusCategory,
+      search: data.search,
+      inboxId: (data.inboxId ?? undefined) as never,
+      organizationId: data.organizationId ?? undefined,
+      requesterContactId: data.requesterContactId ?? undefined,
+      limit: data.limit,
+      offset: data.offset,
+      sort: data.sort,
+    })
+  })
+
+// ---------- create / read ----------
+
+export const createTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      subject: z.string().min(1).max(500),
+      descriptionJson: tiptapDocSchema.nullable().optional(),
+      descriptionText: z.string().max(100_000).nullable().optional(),
+      priority: z.enum(TICKET_PRIORITIES).optional(),
+      channel: z.enum(TICKET_CHANNELS).optional(),
+      visibilityScope: z.enum(TICKET_VISIBILITY_SCOPES).optional(),
+      statusId: ticketStatusIdSchema.nullable().optional(),
+      primaryTeamId: teamIdSchema.nullable().optional(),
+      assigneePrincipalId: principalIdSchema.nullable().optional(),
+      assigneeTeamId: teamIdSchema.nullable().optional(),
+      requesterContactId: contactIdSchema.nullable().optional(),
+      organizationId: orgIdSchema.nullable().optional(),
+      inboxId: (z.string().min(1) as z.ZodType<InboxId>).nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.TICKET_EDIT_FIELDS)
+    return createTicket({
+      ...data,
+      descriptionJson: (data.descriptionJson ?? null) as never,
+      createdByPrincipalId: ctx.principal.id,
+      requesterPrincipalId: ctx.principal.id,
+    })
+  })
+
+export const getTicketFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const ticket = await getTicket(data.ticketId)
+    if (!ticket) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${data.ticketId} not found`)
+    const shares = await listSharesForTicket(data.ticketId)
+    const scope = toResourceScope({
+      primaryTeamId: ticket.primaryTeamId as TeamId | null,
+      assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+      assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+      shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+    })
+    if (!canViewTicket(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_VIEW_DENIED', 'cannot view this ticket')
+    }
+    return ticket
+  })
+
+// ---------- update ----------
+
+export const updateTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      expectedUpdatedAt: isoDate,
+      subject: z.string().min(1).max(500).optional(),
+      descriptionJson: tiptapDocSchema.nullable().optional(),
+      descriptionText: z.string().max(100_000).nullable().optional(),
+      priority: z.enum(TICKET_PRIORITIES).optional(),
+      visibilityScope: z.enum(TICKET_VISIBILITY_SCOPES).optional(),
+      primaryTeamId: teamIdSchema.nullable().optional(),
+      organizationId: orgIdSchema.nullable().optional(),
+      requesterContactId: contactIdSchema.nullable().optional(),
+      inboxId: (z.string().min(1) as z.ZodType<InboxId>).nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canEditFields(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_EDIT_DENIED', 'cannot edit this ticket')
+    }
+    return updateTicket(data.ticketId, {
+      ...data,
+      descriptionJson: data.descriptionJson as never,
+      expectedUpdatedAt: new Date(data.expectedUpdatedAt),
+      actorPrincipalId: ctx.principal.id,
+      allowStaleFieldUpdate: true,
+    })
+  })
+
+// ---------- assign ----------
+
+export const assignTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      expectedUpdatedAt: isoDate,
+      assigneePrincipalId: principalIdSchema.nullable().optional(),
+      assigneeTeamId: teamIdSchema.nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    const isSelf = data.assigneePrincipalId != null && data.assigneePrincipalId === ctx.principal.id
+    const allowed = isSelf
+      ? canAssign(ctx.permissions, scope) ||
+        // self-assignment fallback
+        (await import('@/lib/server/domains/tickets')).canAssignSelf(ctx.permissions, scope)
+      : canAssign(ctx.permissions, scope)
+    if (!allowed) {
+      throw new ForbiddenError('TICKET_ASSIGN_DENIED', 'cannot assign this ticket')
+    }
+    return assignTicket(data.ticketId, {
+      expectedUpdatedAt: new Date(data.expectedUpdatedAt),
+      actorPrincipalId: ctx.principal.id,
+      assigneePrincipalId: data.assigneePrincipalId ?? null,
+      assigneeTeamId: data.assigneeTeamId ?? null,
+    })
+  })
+
+// ---------- status transition ----------
+
+export const transitionTicketStatusFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      expectedUpdatedAt: isoDate,
+      statusId: ticketStatusIdSchema,
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canEditFields(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_TRANSITION_DENIED', 'cannot transition this ticket')
+    }
+    return transitionStatus(data.ticketId, {
+      expectedUpdatedAt: new Date(data.expectedUpdatedAt),
+      actorPrincipalId: ctx.principal.id,
+      statusId: data.statusId,
+    })
+  })
+
+// ---------- soft delete ----------
+
+export const softDeleteTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canEditFields(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_DELETE_DENIED', 'cannot delete this ticket')
+    }
+    return softDeleteTicket(data.ticketId, ctx.principal.id)
+  })
+
+// ---------- threads ----------
+
+export const addThreadFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      audience: z.enum(TICKET_THREAD_AUDIENCES),
+      bodyJson: tiptapDocSchema.nullable().optional(),
+      bodyText: z.string().max(100_000).nullable().optional(),
+      sharedWithTeamId: teamIdSchema.nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (data.audience === 'public') {
+      if (!canReplyPublic(ctx.permissions, scope)) {
+        throw new ForbiddenError('TICKET_REPLY_DENIED', 'cannot reply publicly')
+      }
+    } else if (data.audience === 'internal') {
+      if (!canCommentInternal(ctx.permissions, scope)) {
+        throw new ForbiddenError('TICKET_COMMENT_DENIED', 'cannot post internal comments')
+      }
+    } else if (data.audience === 'shared_team') {
+      if (!canShareCrossTeam(ctx.permissions, scope)) {
+        throw new ForbiddenError('TICKET_SHARED_NOTE_DENIED', 'cannot post shared-team threads')
+      }
+    }
+    return addThread({
+      ticketId: data.ticketId,
+      principalId: ctx.principal.id,
+      audience: data.audience,
+      bodyJson: (data.bodyJson ?? null) as never,
+      bodyText: data.bodyText ?? null,
+      sharedWithTeamId: data.sharedWithTeamId ?? null,
+    })
+  })
+
+export const listThreadsFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canViewTicket(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_VIEW_DENIED', 'cannot view this ticket')
+    }
+    const ticket = await getTicket(data.ticketId)
+    const threads = await listThreads(data.ticketId, {
+      viewerTeamIds: ctx.permissions.teamIds,
+      canSeeInternal: canCommentInternal(ctx.permissions, scope),
+      isRequester: ticket?.requesterPrincipalId === ctx.principal.id,
+    })
+    const principalIds = Array.from(
+      new Set(threads.map((t) => t.principalId).filter((id): id is PrincipalId => id != null))
+    )
+    const principalRows = principalIds.length
+      ? await db
+          .select({
+            id: principal.id,
+            displayName: principal.displayName,
+          })
+          .from(principal)
+          .where(inArray(principal.id, principalIds))
+      : []
+    const principalNames = new Map(
+      principalRows.map((row) => [row.id, row.displayName?.trim() || 'Unknown'])
+    )
+
+    return threads.map((thread) => ({
+      ...thread,
+      principalName: thread.principalId
+        ? (principalNames.get(thread.principalId as PrincipalId) ?? 'Unknown')
+        : null,
+    }))
+  })
+
+// ---------- shares ----------
+
+export const shareTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      teamId: teamIdSchema,
+      accessLevel: z.enum(TICKET_SHARE_LEVELS).optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canShareCrossTeam(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_SHARE_DENIED', 'cannot share this ticket')
+    }
+    return shareTicketWithTeam({
+      ticketId: data.ticketId,
+      teamId: data.teamId,
+      accessLevel: data.accessLevel,
+      grantedByPrincipalId: ctx.principal.id,
+    })
+  })
+
+export const revokeShareFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ shareId: ticketShareIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    return revokeShare(data.shareId, ctx.principal.id)
+  })
+
+export const listSharesFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canViewTicket(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_VIEW_DENIED', 'cannot view this ticket')
+    }
+    return listSharesForTicket(data.ticketId)
+  })
+
+// ---------- participants ----------
+
+export const addParticipantFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      role: z.enum(TICKET_PARTICIPANT_ROLES),
+      principalId: principalIdSchema.nullable().optional(),
+      contactId: contactIdSchema.nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canManageParticipants(ctx.permissions, scope)) {
+      throw new ForbiddenError(
+        'TICKET_PARTICIPANT_DENIED',
+        'cannot manage participants on this ticket'
+      )
+    }
+    return addParticipant({
+      ticketId: data.ticketId,
+      role: data.role,
+      principalId: data.principalId ?? null,
+      contactId: data.contactId ?? null,
+      addedByPrincipalId: ctx.principal.id,
+    })
+  })
+
+export const removeParticipantFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      participantId: ticketParticipantIdSchema,
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canManageParticipants(ctx.permissions, scope)) {
+      throw new ForbiddenError(
+        'TICKET_PARTICIPANT_DENIED',
+        'cannot manage participants on this ticket'
+      )
+    }
+    await removeParticipant(data.participantId, ctx.principal.id)
+    return { ok: true as const }
+  })
+
+export const listParticipantsFn = createServerFn({ method: 'GET' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canViewTicket(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_VIEW_DENIED', 'cannot view this ticket')
+    }
+    return listParticipants(data.ticketId)
+  })
+
+// ---------- helpers ----------
+
+async function loadScope(ticketId: TicketId) {
+  const ticket = await getTicket(ticketId)
+  if (!ticket) throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticketId} not found`)
+  const shares = await listSharesForTicket(ticketId)
+  return toResourceScope({
+    primaryTeamId: ticket.primaryTeamId as TeamId | null,
+    assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+    assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+    shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+  })
+}
+
+// ---------- take / return ----------
+
+export const takeTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!hasPermissionForResource(ctx.permissions, PERMISSIONS.TICKET_ASSIGN_SELF, scope)) {
+      throw new ForbiddenError('TICKET_ASSIGN_DENIED', 'ticket.assign_self required')
+    }
+    return takeTicket(data.ticketId, ctx.principal.id as PrincipalId)
+  })
+
+export const returnTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    const allowed =
+      hasPermissionForResource(ctx.permissions, PERMISSIONS.TICKET_ASSIGN_ANY, scope) ||
+      hasPermissionForResource(ctx.permissions, PERMISSIONS.TICKET_ASSIGN_SELF, scope)
+    if (!allowed) throw new ForbiddenError('TICKET_RETURN_DENIED', 'cannot return this ticket')
+    return returnTicket(data.ticketId, ctx.principal.id as PrincipalId)
+  })
+
+// ---------- bulk ops ----------
+
+const ticketIdsSchema = z.array(ticketIdSchema).min(1).max(500)
+
+export const bulkAssignTicketsFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketIds: ticketIdsSchema,
+      assigneePrincipalId: principalIdSchema.nullable().optional(),
+      assigneeTeamId: teamIdSchema.nullable().optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.TICKET_BULK_OPERATE)
+    return bulkAssign({
+      ticketIds: data.ticketIds,
+      actorPrincipalId: ctx.principal.id as PrincipalId,
+      assigneePrincipalId: data.assigneePrincipalId ?? undefined,
+      assigneeTeamId: data.assigneeTeamId ?? undefined,
+      permit: (scope) =>
+        hasPermissionForResource(ctx.permissions, PERMISSIONS.TICKET_ASSIGN_ANY, scope),
+    })
+  })
+
+export const bulkTransitionTicketsFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketIds: ticketIdsSchema,
+      statusId: ticketStatusIdSchema,
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.TICKET_BULK_OPERATE)
+    return bulkTransition({
+      ticketIds: data.ticketIds,
+      actorPrincipalId: ctx.principal.id as PrincipalId,
+      statusId: data.statusId,
+      permit: (scope) =>
+        hasPermissionForResource(ctx.permissions, PERMISSIONS.TICKET_EDIT_FIELDS, scope),
+    })
+  })
+
+export const bulkChangeInboxFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketIds: ticketIdsSchema,
+      inboxId: z.string().min(1).nullable(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requirePermission(PERMISSIONS.TICKET_BULK_OPERATE)
+    return bulkChangeInbox({
+      ticketIds: data.ticketIds,
+      actorPrincipalId: ctx.principal.id as PrincipalId,
+      inboxId: data.inboxId as InboxId | null,
+      permit: (scope) =>
+        hasPermissionForResource(ctx.permissions, PERMISSIONS.TICKET_EDIT_FIELDS, scope),
+    })
+  })
+
+// ---------- statuses (read-only catalogue) ----------
+
+/**
+ * List ticket statuses (open/pending/on_hold/solved/closed catalogue).
+ * Read-only; CRUD is admin-only and not exposed yet.
+ */
+export const listTicketStatusesFn = createServerFn({ method: 'GET' }).handler(async () => {
+  await requireAuthWithPermissions()
+  return listTicketStatuses()
+})
+
+// ---------- activity timeline ----------
+
+/**
+ * List ticket-activity events for a single ticket. Read-gated by the same
+ * `canViewTicket` rule as threads. Returns rows in reverse-chronological order
+ * with optional `before` cursor (createdAt ISO) for pagination.
+ */
+export const listTicketActivityFn = createServerFn({ method: 'GET' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      limit: z.number().int().min(1).max(200).optional(),
+      before: isoDate.optional(),
+    })
+  )
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canViewTicket(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_VIEW_DENIED', 'cannot view this ticket')
+    }
+    const limit = data.limit ?? 50
+    const whereClauses = [eq(ticketActivity.ticketId, data.ticketId)]
+    if (data.before) whereClauses.push(lt(ticketActivity.createdAt, new Date(data.before)))
+    const rows = await db
+      .select({
+        id: ticketActivity.id,
+        ticketId: ticketActivity.ticketId,
+        principalId: ticketActivity.principalId,
+        type: ticketActivity.type,
+        metadata: ticketActivity.metadata,
+        createdAt: ticketActivity.createdAt,
+        actorName: principal.displayName,
+        actorAvatarUrl: principal.avatarUrl,
+      })
+      .from(ticketActivity)
+      .leftJoin(principal, eq(ticketActivity.principalId, principal.id))
+      .where(and(...whereClauses))
+      .orderBy(desc(ticketActivity.createdAt))
+      .limit(limit)
+    return rows as Array<{
+      id: (typeof rows)[number]['id']
+      ticketId: (typeof rows)[number]['ticketId']
+      principalId: (typeof rows)[number]['principalId']
+      type: string
+      metadata: AuditJsonValue
+      createdAt: Date
+      actorName: string | null
+      actorAvatarUrl: string | null
+    }>
+  })
+
+// ---------------------------------------------------------------------------
+// GitHub integration stubs (Phase 8 — not yet implemented)
+// ---------------------------------------------------------------------------
+
+/** Manually trigger a push/pull sync for a linked ticket. TODO: implement in Phase 8. */
+export const manualSyncTicketFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      ticketId: ticketIdSchema,
+      integrationId: z.string().min(1),
+      direction: z.enum(['push', 'pull']),
+    })
+  )
+  .handler(async ({ data: _data }) => {
+    await requirePermission(PERMISSIONS.TICKET_EDIT_FIELDS)
+    // TODO: implement bidirectional manual sync in Phase 8
+    return { success: false, error: 'Manual sync not yet implemented' } as const
+  })
+
+/**
+ * Create an initial public thread for a ticket to hold attachments during
+ * the creation flow. This ensures files can be attached immediately after
+ * ticket creation without requiring the user to open a reply.
+ */
+export const createTicketInitialThreadFn = createServerFn({ method: 'POST' })
+  .inputValidator(z.object({ ticketId: ticketIdSchema }))
+  .handler(async ({ data }) => {
+    const ctx = await requireAuthWithPermissions()
+    const scope = await loadScope(data.ticketId)
+    if (!canReplyPublic(ctx.permissions, scope)) {
+      throw new ForbiddenError('TICKET_REPLY_PUBLIC_DENIED', 'cannot reply publicly to this ticket')
+    }
+
+    const { addThread } = await import('@/lib/server/domains/tickets')
+    const thread = await addThread({
+      ticketId: data.ticketId,
+      principalId: ctx.principal.id,
+      audience: 'public',
+      bodyText: '[Attachments added at ticket creation]',
+    })
+
+    return {
+      id: thread.id,
+    }
+  })
diff --git a/apps/web/src/lib/server/functions/webhook-deliveries.ts b/apps/web/src/lib/server/functions/webhook-deliveries.ts
new file mode 100644
index 000000000..4fe1f426d
--- /dev/null
+++ b/apps/web/src/lib/server/functions/webhook-deliveries.ts
@@ -0,0 +1,84 @@
+/**
+ * Server function for the in-app admin UI to list webhook delivery attempts.
+ *
+ * Mirrors the REST surface but uses cookie auth + admin-role gating instead of
+ * scoped API keys. Only admins can read this — webhook payloads can contain
+ * sensitive event data.
+ */
+
+import { z } from 'zod'
+import { createServerFn } from '@tanstack/react-start'
+import { requireAuth } from './auth-helpers'
+import type { WebhookId, WebhookDeliveryId } from '@quackback/ids'
+import { toIsoString, toIsoStringOrNull } from '@/lib/shared/utils'
+
+const STATUSES = [
+  'queued',
+  'success',
+  'failed_retryable',
+  'failed_terminal',
+  'blocked_ssrf',
+] as const
+
+const listInput = z.object({
+  webhookId: z.string(),
+  limit: z.number().int().min(1).max(200).optional().default(50),
+  status: z.enum(STATUSES).optional(),
+  cursorAttemptedAt: z.string().datetime().optional(),
+  cursorId: z.string().optional(),
+})
+
+export const listWebhookDeliveriesFn = createServerFn({ method: 'GET' })
+  .inputValidator(listInput)
+  .handler(async ({ data }) => {
+    await requireAuth({ roles: ['admin'] })
+
+    const { listDeliveriesForWebhook } =
+      await import('@/lib/server/domains/webhooks/webhook.deliveries')
+    const cursor =
+      data.cursorAttemptedAt && data.cursorId
+        ? {
+            attemptedAt: new Date(data.cursorAttemptedAt),
+            id: data.cursorId as WebhookDeliveryId,
+          }
+        : null
+
+    const rows = await listDeliveriesForWebhook(data.webhookId as WebhookId, {
+      cursor,
+      limit: data.limit,
+      statusFilter: data.status ?? null,
+    })
+
+    const nextCursor =
+      rows.length === data.limit
+        ? {
+            cursorAttemptedAt: toIsoString(rows[rows.length - 1].attemptedAt),
+            cursorId: rows[rows.length - 1].id,
+          }
+        : null
+
+    return {
+      deliveries: rows.map((r) => ({
+        id: r.id,
+        webhookId: r.webhookId,
+        eventId: r.eventId,
+        eventType: r.eventType,
+        attemptNumber: r.attemptNumber,
+        status: r.status,
+        httpStatus: r.httpStatus,
+        errorMessage: r.errorMessage,
+        requestUrl: r.requestUrl,
+        requestPayloadBytes: r.requestPayloadBytes,
+        responseBodySnippet: r.responseBodySnippet,
+        latencyMs: r.latencyMs,
+        signatureTimestamp: r.signatureTimestamp,
+        attemptedAt: toIsoString(r.attemptedAt),
+        nextRetryAt: toIsoStringOrNull(r.nextRetryAt),
+        canRedeliver:
+          (r.status === 'failed_retryable' || r.status === 'failed_terminal') &&
+          (r as { requestPayloadJson?: unknown }).requestPayloadJson != null &&
+          !(r as { requestPayloadTruncated?: boolean }).requestPayloadTruncated,
+      })),
+      nextCursor,
+    }
+  })
diff --git a/apps/web/src/lib/server/functions/webhooks.ts b/apps/web/src/lib/server/functions/webhooks.ts
index 1f6399e54..bdc8b2f65 100644
--- a/apps/web/src/lib/server/functions/webhooks.ts
+++ b/apps/web/src/lib/server/functions/webhooks.ts
@@ -21,6 +21,7 @@ const createWebhookSchema = z.object({
   url: z.string().url('Invalid URL format'),
   events: z.array(z.enum(WEBHOOK_EVENTS)).min(1, 'At least one event is required'),
   boardIds: z.array(z.string()).optional(),
+  inboxIds: z.array(z.string()).optional(),
 })
 
 const updateWebhookSchema = z.object({
@@ -28,6 +29,7 @@ const updateWebhookSchema = z.object({
   url: z.string().url('Invalid URL format').optional(),
   events: z.array(z.enum(WEBHOOK_EVENTS)).min(1, 'At least one event is required').optional(),
   boardIds: z.array(z.string()).nullable().optional(),
+  inboxIds: z.array(z.string()).nullable().optional(),
   status: z.enum(['active', 'disabled']).optional(),
 })
 
@@ -39,6 +41,16 @@ const rotateWebhookSecretSchema = z.object({
   webhookId: z.string(),
 })
 
+const testWebhookSchema = z.object({
+  webhookId: z.string(),
+  eventType: z.enum(WEBHOOK_EVENTS),
+})
+
+const redeliverWebhookDeliverySchema = z.object({
+  webhookId: z.string(),
+  deliveryId: z.string(),
+})
+
 // ============================================
 // Type Exports
 // ============================================
@@ -47,6 +59,8 @@ export type CreateWebhookInput = z.infer<typeof createWebhookSchema>
 export type UpdateWebhookInput = z.infer<typeof updateWebhookSchema>
 export type DeleteWebhookInput = z.infer<typeof deleteWebhookSchema>
 export type RotateWebhookSecretInput = z.infer<typeof rotateWebhookSecretSchema>
+export type TestWebhookInput = z.infer<typeof testWebhookSchema>
+export type RedeliverWebhookDeliveryInput = z.infer<typeof redeliverWebhookDeliverySchema>
 
 // ============================================
 // Read Operations
@@ -92,6 +106,7 @@ export const createWebhookFn = createServerFn({ method: 'POST' })
           url: data.url,
           events: data.events,
           boardIds: data.boardIds,
+          inboxIds: data.inboxIds,
         },
         auth.principal.id
       )
@@ -119,6 +134,7 @@ export const updateWebhookFn = createServerFn({ method: 'POST' })
         url: data.url,
         events: data.events,
         boardIds: data.boardIds,
+        inboxIds: data.inboxIds,
         status: data.status,
       })
 
@@ -172,3 +188,58 @@ export const rotateWebhookSecretFn = createServerFn({ method: 'POST' })
       throw error
     }
   })
+
+/**
+ * Synchronously fire a sample event of `eventType` to a webhook for
+ * verification. The attempt is logged in `webhook_deliveries` like a real
+ * delivery (eventId prefixed `evt_test_`).
+ */
+export const testWebhookFn = createServerFn({ method: 'POST' })
+  .inputValidator(testWebhookSchema)
+  .handler(async ({ data }) => {
+    console.log(`[fn:webhooks] testWebhookFn: id=${data.webhookId} type=${data.eventType}`)
+    try {
+      await requireAuth({ roles: ['admin'] })
+      const { fireTestEvent } =
+        await import('@/lib/server/domains/webhooks/webhook.operator-actions')
+      return await fireTestEvent({
+        webhookId: data.webhookId as WebhookId,
+        eventType: data.eventType,
+      })
+    } catch (error) {
+      console.error(`[fn:webhooks] testWebhookFn failed:`, error)
+      throw error
+    }
+  })
+
+/**
+ * Replay a previously-recorded delivery using its stored payload. Bumps
+ * `attemptNumber` by 1.
+ */
+export const redeliverWebhookDeliveryFn = createServerFn({ method: 'POST' })
+  .inputValidator(redeliverWebhookDeliverySchema)
+  .handler(async ({ data }) => {
+    console.log(`[fn:webhooks] redeliverWebhookDeliveryFn: deliveryId=${data.deliveryId}`)
+    try {
+      await requireAuth({ roles: ['admin'] })
+      const { redeliverDelivery } =
+        await import('@/lib/server/domains/webhooks/webhook.operator-actions')
+      return await redeliverDelivery({
+        deliveryId: data.deliveryId as import('@quackback/ids').WebhookDeliveryId,
+      })
+    } catch (error) {
+      console.error(`[fn:webhooks] redeliverWebhookDeliveryFn failed:`, error)
+      throw error
+    }
+  })
+
+/**
+ * Returns a record of canonical sample payloads keyed by event type, used by
+ * the create/edit dialog payload-preview accordion.
+ */
+export const fetchSamplePayloadsFn = createServerFn({ method: 'GET' }).handler(async () => {
+  await requireAuth({ roles: ['admin'] })
+  const { getAllSampleEventPayloads } = await import('@/lib/server/events/sample-payloads')
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return getAllSampleEventPayloads() as any
+})
diff --git a/apps/web/src/lib/server/integrations/github/__tests__/ticket-comments-markers.diffcov.test.ts b/apps/web/src/lib/server/integrations/github/__tests__/ticket-comments-markers.diffcov.test.ts
new file mode 100644
index 000000000..210db7845
--- /dev/null
+++ b/apps/web/src/lib/server/integrations/github/__tests__/ticket-comments-markers.diffcov.test.ts
@@ -0,0 +1,45 @@
+/**
+ * Differential-coverage tests for the github ticket-comments marker helpers
+ * (parse/strip/build for thread + system markers).
+ */
+import { describe, it, expect } from 'vitest'
+import {
+  parseQuackbackThreadMarker,
+  stripQuackbackThreadMarker,
+  buildQuackbackThreadMarker,
+  parseQuackbackSystemMarker,
+  buildQuackbackSystemMarker,
+} from '../ticket-comments'
+
+describe('thread markers', () => {
+  it('builds, parses, and strips a thread marker', () => {
+    const marker = buildQuackbackThreadMarker({
+      ticketId: 't1',
+      threadId: 'th1',
+      integrationId: 'i1',
+    })
+    const body = `Hello world\n${marker}`
+    expect(parseQuackbackThreadMarker(body)).toEqual({
+      ticketId: 't1',
+      threadId: 'th1',
+      integrationId: 'i1',
+    })
+    expect(stripQuackbackThreadMarker(body)).toBe('Hello world')
+  })
+  it('returns null / passes through when no marker is present', () => {
+    expect(parseQuackbackThreadMarker('no marker')).toBeNull()
+    expect(parseQuackbackThreadMarker(null)).toBeNull()
+    expect(stripQuackbackThreadMarker(undefined)).toBe('')
+  })
+})
+
+describe('system markers', () => {
+  it('builds and parses a system marker', () => {
+    const marker = buildQuackbackSystemMarker({ integrationId: 'i1', event: 'ticket.created' })
+    expect(parseQuackbackSystemMarker(marker)).toEqual({
+      integrationId: 'i1',
+      event: 'ticket.created',
+    })
+    expect(parseQuackbackSystemMarker('plain')).toBeNull()
+  })
+})
diff --git a/apps/web/src/lib/server/integrations/github/__tests__/ticket-comments.gap.test.ts b/apps/web/src/lib/server/integrations/github/__tests__/ticket-comments.gap.test.ts
new file mode 100644
index 000000000..969b4e21f
--- /dev/null
+++ b/apps/web/src/lib/server/integrations/github/__tests__/ticket-comments.gap.test.ts
@@ -0,0 +1,136 @@
+/**
+ * Differential-coverage tests for github ticket-comments:
+ * - listGitHubIssueComments (fetch loop + pagination via parseNextLink, error path)
+ * - isUniqueViolation (exercised through upsertThreadExternalLink conflict fallback)
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const h = vi.hoisted(() => {
+  const insertOnConflictMock = vi.fn()
+  const insertValuesMock = vi.fn(() => ({ onConflictDoUpdate: insertOnConflictMock }))
+  const insertMock = vi.fn((_t: unknown) => ({ values: insertValuesMock }))
+  const updateWhereMock = vi.fn()
+  const updateSetMock = vi.fn(() => ({ where: updateWhereMock }))
+  const updateMock = vi.fn((_t: unknown) => ({ set: updateSetMock }))
+  return {
+    insertOnConflictMock,
+    insertValuesMock,
+    insertMock,
+    updateWhereMock,
+    updateSetMock,
+    updateMock,
+  }
+})
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    insert: (t: unknown) => h.insertMock(t),
+    update: (t: unknown) => h.updateMock(t),
+    query: {},
+  },
+  ticketThreadExternalLinks: {
+    integrationId: 'integrationId',
+    threadId: 'threadId',
+    externalCommentId: 'externalCommentId',
+  },
+  eq: vi.fn(),
+  and: vi.fn(),
+  sql: (s: unknown) => s,
+}))
+
+import { listGitHubIssueComments, upsertThreadExternalLink } from '../ticket-comments'
+
+const originalFetch = globalThis.fetch
+
+afterEach(() => {
+  globalThis.fetch = originalFetch
+})
+
+describe('listGitHubIssueComments', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('follows pagination via the link header until no next page', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: async () => [{ id: 1, body: 'a' }],
+        headers: {
+          get: () => '<https://api.github.com/repos/org/repo/issues/5/comments?page=2>; rel="next"',
+        },
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: async () => [{ id: 2, body: 'b' }],
+        headers: { get: () => null },
+      })
+    globalThis.fetch = fetchMock as unknown as typeof fetch
+
+    const comments = await listGitHubIssueComments({
+      ownerRepo: 'org/repo',
+      issueNumber: '5',
+      accessToken: 'tok',
+      since: '2026-01-01T00:00:00Z',
+    })
+
+    expect(comments).toEqual([
+      { id: 1, body: 'a' },
+      { id: 2, body: 'b' },
+    ])
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+    // since query param is appended on the first request
+    expect(fetchMock.mock.calls[0][0]).toContain('since=')
+  })
+
+  it('throws on a non-ok response', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue({
+      ok: false,
+      status: 500,
+      text: async () => 'boom',
+      headers: { get: () => null },
+    }) as unknown as typeof fetch
+
+    await expect(
+      listGitHubIssueComments({ ownerRepo: 'org/repo', issueNumber: '5', accessToken: 'tok' })
+    ).rejects.toThrow('HTTP 500: boom')
+  })
+})
+
+describe('upsertThreadExternalLink isUniqueViolation fallback', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  const args = {
+    ticketId: 'ticket_1',
+    threadId: 'thread_1',
+    integrationId: 'integration_1',
+    externalIssueId: '42',
+    externalCommentId: '1001',
+    syncDirection: 'outbound' as const,
+  }
+
+  it('falls back to an update when the insert hits a unique violation (code 23505)', async () => {
+    h.insertOnConflictMock.mockRejectedValueOnce({ code: '23505' })
+
+    await upsertThreadExternalLink(args)
+
+    expect(h.updateSetMock).toHaveBeenCalledTimes(1)
+    expect(h.updateWhereMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('detects unique violation nested in error.cause', async () => {
+    h.insertOnConflictMock.mockRejectedValueOnce({ cause: { code: '23505' } })
+
+    await upsertThreadExternalLink(args)
+
+    expect(h.updateSetMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('rethrows errors that are not unique violations', async () => {
+    h.insertOnConflictMock.mockRejectedValueOnce(new Error('some other error'))
+
+    await expect(upsertThreadExternalLink(args)).rejects.toThrow('some other error')
+    expect(h.updateSetMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/integrations/github/__tests__/ticket-inbound.test.ts b/apps/web/src/lib/server/integrations/github/__tests__/ticket-inbound.test.ts
new file mode 100644
index 000000000..baa757255
--- /dev/null
+++ b/apps/web/src/lib/server/integrations/github/__tests__/ticket-inbound.test.ts
@@ -0,0 +1,724 @@
+/**
+ * Unit tests for ticket-inbound.ts — GitHub issue → Quackback ticket sync.
+ *
+ * Verifies: event routing, ticket creation, status transitions, assignment
+ * mapping, and loop-prevention via syncSourceIntegrationId.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// ---- Mocks ----
+
+const createTicketMock = vi.fn()
+const getTicketMock = vi.fn()
+const transitionStatusMock = vi.fn()
+const updateTicketMock = vi.fn()
+const assignTicketMock = vi.fn()
+const addThreadMock = vi.fn()
+const editThreadMock = vi.fn()
+const softDeleteThreadMock = vi.fn()
+const markdownToTiptapJsonMock = vi.fn((markdown: string) => ({
+  type: 'doc',
+  content: [{ type: 'paragraph', content: [{ type: 'text', text: markdown }] }],
+}))
+
+vi.mock('@/lib/server/markdown-tiptap', () => ({
+  markdownToTiptapJson: (...a: [string]) => markdownToTiptapJsonMock(...a),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.service', () => ({
+  createTicket: (...a: unknown[]) => createTicketMock(...a),
+  getTicket: (...a: unknown[]) => getTicketMock(...a),
+  transitionStatus: (...a: unknown[]) => transitionStatusMock(...a),
+  updateTicket: (...a: unknown[]) => updateTicketMock(...a),
+  assignTicket: (...a: unknown[]) => assignTicketMock(...a),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.threads', () => ({
+  addThread: (...a: unknown[]) => addThreadMock(...a),
+  editThread: (...a: unknown[]) => editThreadMock(...a),
+  softDeleteThread: (...a: unknown[]) => softDeleteThreadMock(...a),
+}))
+
+const insertValuesMock = vi.fn().mockReturnValue({
+  onConflictDoNothing: vi.fn(),
+  onConflictDoUpdate: vi.fn(),
+})
+const insertMock = vi
+  .fn()
+  .mockReturnValue({ values: (...args: unknown[]) => insertValuesMock(...args) })
+const updateMock = vi.fn().mockReturnValue({ set: vi.fn().mockReturnValue({ where: vi.fn() }) })
+const findFirstLinkMock = vi.fn()
+const findFirstThreadLinkMock = vi.fn()
+const findFirstThreadMock = vi.fn()
+const findFirstStatusMock = vi.fn()
+const findFirstMappingMock = vi.fn()
+const findFirstTicketMock = vi.fn()
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    insert: (...a: unknown[]) => insertMock(...a),
+    update: (...a: unknown[]) => updateMock(...a),
+    query: {
+      ticketExternalLinks: { findFirst: (...a: unknown[]) => findFirstLinkMock(...a) },
+      ticketThreadExternalLinks: {
+        findFirst: (...a: unknown[]) => findFirstThreadLinkMock(...a),
+      },
+      ticketThreads: { findFirst: (...a: unknown[]) => findFirstThreadMock(...a) },
+      tickets: { findFirst: (...a: unknown[]) => findFirstTicketMock(...a) },
+      ticketStatuses: { findFirst: (...a: unknown[]) => findFirstStatusMock(...a) },
+      integrationUserMappings: { findFirst: (...a: unknown[]) => findFirstMappingMock(...a) },
+    },
+  },
+  ticketExternalLinks: {
+    integrationId: 'integrationId',
+    externalId: 'externalId',
+    status: 'status',
+  },
+  ticketThreadExternalLinks: {
+    ticketId: 'ticketId',
+    threadId: 'threadId',
+    integrationId: 'integrationId',
+    externalIssueId: 'externalIssueId',
+    externalCommentId: 'externalCommentId',
+    externalUrl: 'externalUrl',
+    syncDirection: 'syncDirection',
+    status: 'status',
+    lastSyncedAt: 'lastSyncedAt',
+    updatedAt: 'updatedAt',
+  },
+  ticketThreads: { id: 'id' },
+  tickets: { id: 'id', deletedAt: 'deletedAt' },
+  ticketStatuses: { category: 'category', deletedAt: 'deletedAt' },
+  integrationUserMappings: { integrationId: 'integrationId', externalUsername: 'externalUsername' },
+  integrationSyncLog: {},
+  integrations: { errorCount: 'errorCount' },
+  eq: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  sql: vi.fn(),
+}))
+
+import {
+  handleGitHubIssueCommentEvent,
+  handleGitHubTicketEvent,
+  type GitHubIssueCommentPayload,
+  type GitHubIssuePayload,
+} from '../ticket-inbound'
+
+// ---- Fixtures ----
+
+const NOW = new Date('2026-06-11T00:00:00Z')
+
+function makeIntegration(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'integration_gh1',
+    principalId: 'principal_bot1',
+    config: {
+      channelId: 'org/repo',
+      syncDirection: 'bidirectional' as const,
+      createTicketsFromIssues: true,
+      assigneeSync: true,
+      defaultInboxId: 'inbox_support',
+      ...overrides,
+    },
+  }
+}
+
+function makePayload(
+  action: string,
+  overrides: Partial<GitHubIssuePayload['issue']> = {}
+): GitHubIssuePayload {
+  return {
+    action,
+    issue: {
+      number: 42,
+      title: 'Bug: login fails on mobile',
+      body: 'Steps to reproduce...',
+      html_url: 'https://github.com/org/repo/issues/42',
+      state: action === 'closed' ? 'closed' : 'open',
+      state_reason: action === 'closed' ? 'completed' : null,
+      assignee: null,
+      assignees: [],
+      labels: [],
+      ...overrides,
+    },
+    repository: { full_name: 'org/repo' },
+    sender: { login: 'octocat' },
+  }
+}
+
+function makeCommentPayload(
+  action: string,
+  body = 'This is a GitHub comment'
+): GitHubIssueCommentPayload {
+  return {
+    action,
+    issue: {
+      number: 42,
+      html_url: 'https://github.com/org/repo/issues/42',
+    },
+    comment: {
+      id: 1001,
+      body,
+      html_url: 'https://github.com/org/repo/issues/42#issuecomment-1001',
+      user: { login: 'octocat' },
+    },
+    repository: { full_name: 'org/repo' },
+    sender: { login: 'octocat' },
+  }
+}
+
+// ---- Setup ----
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  // Default: no linked ticket found (for create path)
+  findFirstLinkMock.mockResolvedValue(null)
+  findFirstThreadLinkMock.mockResolvedValue(null)
+  findFirstThreadMock.mockResolvedValue(null)
+  findFirstStatusMock.mockResolvedValue(null)
+  findFirstMappingMock.mockResolvedValue(null)
+  findFirstTicketMock.mockResolvedValue(null)
+  addThreadMock.mockResolvedValue({ id: 'ticket_thread_1' })
+  editThreadMock.mockResolvedValue({ id: 'ticket_thread_1' })
+  softDeleteThreadMock.mockResolvedValue({ id: 'ticket_thread_1' })
+})
+
+// ---- Tests ----
+
+describe('handleGitHubTicketEvent — routing', () => {
+  it('returns false when syncDirection is outbound-only', async () => {
+    const result = await handleGitHubTicketEvent(
+      makePayload('opened'),
+      makeIntegration({ syncDirection: 'outbound' })
+    )
+    expect(result).toBe(false)
+    expect(createTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns false for unknown actions', async () => {
+    const result = await handleGitHubTicketEvent(makePayload('pinned'), makeIntegration())
+    expect(result).toBe(false)
+  })
+})
+
+describe('handleGitHubTicketEvent — issues.opened', () => {
+  it('creates ticket with correct fields and syncSourceIntegrationId', async () => {
+    createTicketMock.mockResolvedValueOnce({ id: 'ticket_new1' })
+
+    const result = await handleGitHubTicketEvent(makePayload('opened'), makeIntegration())
+
+    expect(result).toBe(true)
+    expect(createTicketMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        subject: 'Bug: login fails on mobile',
+        descriptionText: 'Steps to reproduce...',
+        descriptionJson: expect.objectContaining({ type: 'doc' }),
+        channel: 'api',
+        inboxId: 'inbox_support',
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+    expect(markdownToTiptapJsonMock).toHaveBeenCalledWith('Steps to reproduce...')
+  })
+
+  it('skips when createTicketsFromIssues is false', async () => {
+    const result = await handleGitHubTicketEvent(
+      makePayload('opened'),
+      makeIntegration({ createTicketsFromIssues: false })
+    )
+    expect(result).toBe(false)
+    expect(createTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('inserts external link after ticket creation', async () => {
+    createTicketMock.mockResolvedValueOnce({ id: 'ticket_new1' })
+    const insertValuesMock = vi.fn().mockReturnValue({ onConflictDoNothing: vi.fn() })
+    insertMock.mockReturnValueOnce({ values: insertValuesMock })
+
+    await handleGitHubTicketEvent(makePayload('opened'), makeIntegration())
+
+    expect(insertMock).toHaveBeenCalled()
+    expect(insertValuesMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ticketId: 'ticket_new1',
+        integrationType: 'github',
+        externalId: '42',
+        externalDisplayId: '#42',
+        syncDirection: 'inbound',
+      })
+    )
+  })
+
+  it('does not create a duplicate ticket when issue body carries a Quackback marker', async () => {
+    findFirstLinkMock.mockResolvedValueOnce(null)
+    findFirstTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1' })
+
+    const payload = makePayload('opened', {
+      body: [
+        'Customer-visible issue text',
+        '',
+        '<!-- quackback:ticket-issue ticketId=ticket_linked1 integrationId=integration_gh1 -->',
+      ].join('\n'),
+    })
+
+    const result = await handleGitHubTicketEvent(payload, makeIntegration())
+
+    expect(result).toBe(true)
+    expect(createTicketMock).not.toHaveBeenCalled()
+    expect(insertValuesMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ticketId: 'ticket_linked1',
+        integrationType: 'github',
+        externalId: '42',
+        syncDirection: 'outbound',
+      })
+    )
+  })
+})
+
+describe('handleGitHubTicketEvent — issues.closed', () => {
+  it('transitions linked ticket to solved status', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstStatusMock.mockResolvedValueOnce({ id: 'tstatus_solved' })
+    getTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1', updatedAt: NOW })
+    transitionStatusMock.mockResolvedValueOnce({})
+
+    const result = await handleGitHubTicketEvent(makePayload('closed'), makeIntegration())
+
+    expect(result).toBe(true)
+    expect(transitionStatusMock).toHaveBeenCalledWith(
+      'ticket_linked1',
+      expect.objectContaining({
+        statusId: 'tstatus_solved',
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+  })
+
+  it('does nothing when issue is not linked to a ticket', async () => {
+    findFirstLinkMock.mockResolvedValueOnce(null)
+
+    const result = await handleGitHubTicketEvent(makePayload('closed'), makeIntegration())
+
+    expect(result).toBe(true) // handler ran but no-op'd
+    expect(transitionStatusMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('handleGitHubTicketEvent — issues.reopened', () => {
+  it('transitions linked ticket back to open status', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstStatusMock.mockResolvedValueOnce({ id: 'tstatus_open' })
+    getTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1', updatedAt: NOW })
+    transitionStatusMock.mockResolvedValueOnce({})
+
+    const result = await handleGitHubTicketEvent(makePayload('reopened'), makeIntegration())
+
+    expect(result).toBe(true)
+    expect(transitionStatusMock).toHaveBeenCalledWith(
+      'ticket_linked1',
+      expect.objectContaining({
+        statusId: 'tstatus_open',
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+  })
+})
+
+describe('handleGitHubTicketEvent — issues.edited', () => {
+  it('updates ticket subject and description', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    getTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1', updatedAt: NOW })
+    updateTicketMock.mockResolvedValueOnce({})
+
+    const payload = makePayload('edited', { title: 'Updated title', body: 'New body' })
+    const result = await handleGitHubTicketEvent(payload, makeIntegration())
+
+    expect(result).toBe(true)
+    expect(updateTicketMock).toHaveBeenCalledWith(
+      'ticket_linked1',
+      expect.objectContaining({
+        subject: 'Updated title',
+        descriptionText: 'New body',
+        descriptionJson: expect.objectContaining({ type: 'doc' }),
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+    expect(markdownToTiptapJsonMock).toHaveBeenCalledWith('New body')
+  })
+
+  it('clears ticket description when the GitHub issue body is empty', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    getTicketMock.mockResolvedValueOnce({
+      id: 'ticket_linked1',
+      updatedAt: NOW,
+      descriptionJson: {
+        type: 'doc',
+        content: [{ type: 'paragraph', content: [{ type: 'text', text: 'Old body' }] }],
+      },
+      descriptionText: 'Old body',
+    })
+    updateTicketMock.mockResolvedValueOnce({})
+
+    const payload = makePayload('edited', { body: null })
+    const result = await handleGitHubTicketEvent(payload, makeIntegration())
+
+    expect(result).toBe(true)
+    expect(updateTicketMock).toHaveBeenCalledWith(
+      'ticket_linked1',
+      expect.objectContaining({
+        descriptionJson: null,
+        descriptionText: null,
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+  })
+
+  it('strips Quackback metadata from outbound GitHub issue bodies', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    getTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1', updatedAt: NOW })
+    updateTicketMock.mockResolvedValueOnce({})
+
+    const payload = makePayload('edited', {
+      body: [
+        'Updated customer-facing description',
+        '',
+        '---',
+        '',
+        '**Priority:** high',
+        '**Channel:** portal',
+        '',
+        '[View in Quackback](https://example.test/admin/tickets/ticket_linked1)',
+      ].join('\n'),
+    })
+    const result = await handleGitHubTicketEvent(payload, makeIntegration())
+
+    expect(result).toBe(true)
+    expect(updateTicketMock).toHaveBeenCalledWith(
+      'ticket_linked1',
+      expect.objectContaining({
+        descriptionText: 'Updated customer-facing description',
+        descriptionJson: expect.objectContaining({ type: 'doc' }),
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+    expect(markdownToTiptapJsonMock).toHaveBeenCalledWith('Updated customer-facing description')
+  })
+})
+
+describe('handleGitHubTicketEvent — issues.assigned', () => {
+  it('assigns ticket to mapped principal', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstMappingMock.mockResolvedValueOnce({ principalId: 'principal_dev1' })
+    getTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1', updatedAt: NOW })
+    assignTicketMock.mockResolvedValueOnce({})
+
+    const payload = makePayload('assigned', { assignee: { login: 'dev-user' } })
+    const result = await handleGitHubTicketEvent(payload, makeIntegration())
+
+    expect(result).toBe(true)
+    expect(assignTicketMock).toHaveBeenCalledWith(
+      'ticket_linked1',
+      expect.objectContaining({
+        assigneePrincipalId: 'principal_dev1',
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+  })
+
+  it('skips when assigneeSync is disabled', async () => {
+    const result = await handleGitHubTicketEvent(
+      makePayload('assigned', { assignee: { login: 'dev-user' } }),
+      makeIntegration({ assigneeSync: false })
+    )
+    expect(result).toBe(false)
+    expect(assignTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('skips when no user mapping exists for the GitHub username', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstMappingMock.mockResolvedValueOnce(null)
+
+    const payload = makePayload('assigned', { assignee: { login: 'unknown-user' } })
+    const result = await handleGitHubTicketEvent(payload, makeIntegration())
+
+    expect(result).toBe(true) // handled but skipped assignment
+    expect(assignTicketMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('handleGitHubTicketEvent — issues.unassigned', () => {
+  it('clears ticket assignment', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    getTicketMock.mockResolvedValueOnce({
+      id: 'ticket_linked1',
+      updatedAt: NOW,
+      assigneePrincipalId: 'principal_prev',
+    })
+    assignTicketMock.mockResolvedValueOnce({})
+
+    const result = await handleGitHubTicketEvent(makePayload('unassigned'), makeIntegration())
+
+    expect(result).toBe(true)
+    expect(assignTicketMock).toHaveBeenCalledWith(
+      'ticket_linked1',
+      expect.objectContaining({
+        assigneePrincipalId: null,
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+  })
+
+  it('skips when ticket has no current assignee', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    getTicketMock.mockResolvedValueOnce({
+      id: 'ticket_linked1',
+      updatedAt: NOW,
+      assigneePrincipalId: null,
+    })
+
+    const result = await handleGitHubTicketEvent(makePayload('unassigned'), makeIntegration())
+
+    expect(result).toBe(true)
+    expect(assignTicketMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('syncSourceIntegrationId — loop prevention', () => {
+  it('every service call passes integration.id as syncSourceIntegrationId', async () => {
+    // Create
+    createTicketMock.mockResolvedValueOnce({ id: 'ticket_new1' })
+    await handleGitHubTicketEvent(makePayload('opened'), makeIntegration())
+    expect(createTicketMock.mock.calls[0][0].syncSourceIntegrationId).toBe('integration_gh1')
+
+    // Transition (close)
+    vi.clearAllMocks()
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstStatusMock.mockResolvedValueOnce({ id: 'tstatus_solved' })
+    getTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1', updatedAt: NOW })
+    transitionStatusMock.mockResolvedValueOnce({})
+    await handleGitHubTicketEvent(makePayload('closed'), makeIntegration())
+    expect(transitionStatusMock.mock.calls[0][1].syncSourceIntegrationId).toBe('integration_gh1')
+
+    // Edit
+    vi.clearAllMocks()
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    getTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1', updatedAt: NOW })
+    updateTicketMock.mockResolvedValueOnce({})
+    await handleGitHubTicketEvent(makePayload('edited'), makeIntegration())
+    expect(updateTicketMock.mock.calls[0][1].syncSourceIntegrationId).toBe('integration_gh1')
+  })
+})
+
+describe('handleGitHubIssueCommentEvent', () => {
+  it('returns false when outbound-only sync has no inbound webhook configured', async () => {
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('created'),
+      makeIntegration({ syncDirection: 'outbound' })
+    )
+
+    expect(result).toBe(false)
+    expect(addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns false when status sync is enabled with outbound direction', async () => {
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('created'),
+      makeIntegration({ syncDirection: 'outbound', statusSyncEnabled: true })
+    )
+
+    expect(result).toBe(false)
+    expect(addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('creates a public ticket thread and link row on issue_comment.created', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstThreadLinkMock.mockResolvedValueOnce(null)
+    addThreadMock.mockResolvedValueOnce({ id: 'ticket_thread_1' })
+
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('created'),
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(addThreadMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ticketId: 'ticket_linked1',
+        audience: 'public',
+        bodyText: 'GitHub reply from octocat:\n\nThis is a GitHub comment',
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+    expect(insertValuesMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ticketId: 'ticket_linked1',
+        threadId: 'ticket_thread_1',
+        integrationType: 'github',
+        externalIssueId: '42',
+        externalCommentId: '1001',
+        syncDirection: 'inbound',
+      })
+    )
+  })
+
+  it('is idempotent when issue_comment.created is retried', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstThreadLinkMock.mockResolvedValueOnce({
+      ticketId: 'ticket_linked1',
+      threadId: 'ticket_thread_1',
+      externalIssueId: '42',
+      externalCommentId: '1001',
+      status: 'active',
+    })
+
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('created'),
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('skips issue_comment.created when no linked ticket exists', async () => {
+    findFirstLinkMock.mockResolvedValueOnce(null)
+
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('created'),
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('recovers a missing issue link from the Quackback ticket URL in the issue body', async () => {
+    findFirstLinkMock.mockResolvedValueOnce(null)
+    findFirstTicketMock.mockResolvedValueOnce({ id: 'ticket_linked1' })
+    findFirstThreadLinkMock.mockResolvedValueOnce(null)
+    addThreadMock.mockResolvedValueOnce({ id: 'ticket_thread_1' })
+
+    const result = await handleGitHubIssueCommentEvent(
+      {
+        ...makeCommentPayload('created'),
+        issue: {
+          number: 42,
+          html_url: 'https://github.com/org/repo/issues/42',
+          body: '[View in Quackback](https://example.test/admin/tickets/ticket_linked1)',
+        },
+      },
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(addThreadMock).toHaveBeenCalledWith(
+      expect.objectContaining({ ticketId: 'ticket_linked1', audience: 'public' })
+    )
+    expect(insertValuesMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ticketId: 'ticket_linked1',
+        integrationType: 'github',
+        externalId: '42',
+        externalDisplayId: '#42',
+        syncDirection: 'outbound',
+      })
+    )
+  })
+
+  it('skips issue_comment.created when the GitHub comment body is empty', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstThreadLinkMock.mockResolvedValueOnce(null)
+
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('created', '   '),
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('updates the linked ticket thread on issue_comment.edited', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstThreadLinkMock.mockResolvedValueOnce({
+      ticketId: 'ticket_linked1',
+      threadId: 'ticket_thread_1',
+      externalIssueId: '42',
+      externalCommentId: '1001',
+      status: 'active',
+    })
+    findFirstThreadMock.mockResolvedValueOnce({
+      id: 'ticket_thread_1',
+      principalId: 'principal_bot1',
+      deletedAt: null,
+    })
+
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('edited', 'Edited GitHub body'),
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(editThreadMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threadId: 'ticket_thread_1',
+        actorPrincipalId: 'principal_bot1',
+        bodyText: 'GitHub reply from octocat:\n\nEdited GitHub body',
+        syncSourceIntegrationId: 'integration_gh1',
+      })
+    )
+  })
+
+  it('soft-deletes the linked ticket thread on issue_comment.deleted', async () => {
+    findFirstLinkMock.mockResolvedValueOnce({ ticketId: 'ticket_linked1' })
+    findFirstThreadLinkMock.mockResolvedValueOnce({
+      ticketId: 'ticket_linked1',
+      threadId: 'ticket_thread_1',
+      externalIssueId: '42',
+      externalCommentId: '1001',
+      status: 'active',
+    })
+
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('deleted'),
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(softDeleteThreadMock).toHaveBeenCalledWith(
+      'ticket_thread_1',
+      'principal_bot1',
+      'integration_gh1'
+    )
+  })
+
+  it('skips Quackback-marker comments to prevent echo', async () => {
+    const marker =
+      '<!-- quackback:ticket-thread ticketId=ticket_linked1 threadId=ticket_thread_1 integrationId=integration_gh1 -->'
+
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('created', `Outbound reply\n\n${marker}`),
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(addThreadMock).not.toHaveBeenCalled()
+    expect(editThreadMock).not.toHaveBeenCalled()
+    expect(softDeleteThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('skips Quackback system marker comments to prevent attachment echo', async () => {
+    const marker =
+      '<!-- quackback:ticket-system integrationId=integration_gh1 event=ticket.attachment_added:att_1 -->'
+
+    const result = await handleGitHubIssueCommentEvent(
+      makeCommentPayload('created', `Attachment synced\n\n${marker}`),
+      makeIntegration()
+    )
+
+    expect(result).toBe(true)
+    expect(addThreadMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/lib/server/integrations/github/__tests__/ticket-message.test.ts b/apps/web/src/lib/server/integrations/github/__tests__/ticket-message.test.ts
new file mode 100644
index 000000000..183775e86
--- /dev/null
+++ b/apps/web/src/lib/server/integrations/github/__tests__/ticket-message.test.ts
@@ -0,0 +1,127 @@
+/**
+ * Unit tests for ticket-message.ts — outbound GitHub issue formatting.
+ */
+import { describe, it, expect } from 'vitest'
+import { buildTicketIssueBody, buildTicketUpdateBody } from '../ticket-message'
+import type { EventData, EventTicketRef } from '../../../events/types'
+
+const baseActor = { type: 'user' as const, principalId: 'principal_agent1' }
+const baseTicket: EventTicketRef = {
+  id: 'ticket_01test',
+  subject: 'Login button broken on mobile',
+  descriptionText: 'Users report that tapping login does nothing on iOS Safari.',
+  statusId: 'tstatus_open',
+  statusCategory: 'open',
+  priority: 'high',
+  channel: 'portal',
+  visibility: 'team',
+  inboxId: 'inbox_01',
+  primaryTeamId: 'team_01',
+  assigneePrincipalId: null,
+  assigneeTeamId: null,
+  requesterPrincipalId: 'principal_user1',
+  requesterContactId: null,
+}
+
+function ticketCreatedEvent(overrides: Partial<EventTicketRef> = {}): EventData {
+  return {
+    id: 'evt_test',
+    timestamp: '2026-06-11T00:00:00Z',
+    actor: baseActor,
+    type: 'ticket.created',
+    data: { ticket: { ...baseTicket, ...overrides } },
+  } as EventData
+}
+
+describe('buildTicketIssueBody', () => {
+  it('formats title from ticket subject', () => {
+    const { title } = buildTicketIssueBody(ticketCreatedEvent())
+    expect(title).toBe('Login button broken on mobile')
+  })
+
+  it('includes priority and channel labels', () => {
+    const { labels } = buildTicketIssueBody(ticketCreatedEvent())
+    expect(labels).toEqual(expect.arrayContaining(['priority:high', 'channel:portal']))
+  })
+
+  it('includes normal priority as a label', () => {
+    const { labels } = buildTicketIssueBody(ticketCreatedEvent({ priority: 'normal' }))
+    expect(labels).toContain('priority:normal')
+  })
+
+  it('includes description text in body', () => {
+    const { body } = buildTicketIssueBody(ticketCreatedEvent())
+    expect(body).toContain('Users report that tapping login does nothing on iOS Safari.')
+  })
+
+  it('includes a Quackback ticket link from rootUrl when enrichment omitted ticketUrl', () => {
+    const { body } = buildTicketIssueBody(ticketCreatedEvent(), 'https://app.example.test/')
+    expect(body).toContain(
+      '[View in Quackback](https://app.example.test/admin/tickets/ticket_01test)'
+    )
+  })
+
+  it('preserves an enriched ticketUrl when present', () => {
+    const { body } = buildTicketIssueBody(
+      ticketCreatedEvent({ ticketUrl: 'https://tenant.example.test/admin/tickets/ticket_01test' }),
+      'https://app.example.test'
+    )
+    expect(body).toContain(
+      '[View in Quackback](https://tenant.example.test/admin/tickets/ticket_01test)'
+    )
+  })
+
+  it('omits priority and channel metadata from body', () => {
+    const { body } = buildTicketIssueBody(ticketCreatedEvent())
+    expect(body).not.toContain('**Priority:**')
+    expect(body).not.toContain('**Channel:**')
+  })
+
+  it('handles null description gracefully', () => {
+    const { body } = buildTicketIssueBody(ticketCreatedEvent({ descriptionText: null }))
+    expect(body).toBeDefined()
+    expect(body).not.toContain('null')
+  })
+
+  it('returns generic title for non-created events', () => {
+    const event = {
+      id: 'evt_test',
+      timestamp: '2026-06-11T00:00:00Z',
+      actor: baseActor,
+      type: 'ticket.updated',
+      data: { ticket: baseTicket, changedFields: ['subject'], diff: {} },
+    } as EventData
+    const { title } = buildTicketIssueBody(event)
+    expect(title).toBe('Ticket')
+  })
+})
+
+describe('buildTicketUpdateBody', () => {
+  it('returns title from ticket subject', () => {
+    const { title } = buildTicketUpdateBody(baseTicket)
+    expect(title).toBe('Login button broken on mobile')
+  })
+
+  it('returns undefined title when subject is empty', () => {
+    const { title } = buildTicketUpdateBody({ ...baseTicket, subject: '' })
+    expect(title).toBeUndefined()
+  })
+
+  it('includes description in body', () => {
+    const { body } = buildTicketUpdateBody(baseTicket)
+    expect(body).toContain('Users report that tapping login')
+  })
+
+  it('includes a Quackback ticket link from rootUrl on update bodies', () => {
+    const { body } = buildTicketUpdateBody(baseTicket, 'https://app.example.test')
+    expect(body).toContain(
+      '[View in Quackback](https://app.example.test/admin/tickets/ticket_01test)'
+    )
+  })
+
+  it('does not include priority or channel metadata in body', () => {
+    const { body } = buildTicketUpdateBody(baseTicket)
+    expect(body).not.toContain('**Priority:**')
+    expect(body).not.toContain('**Channel:**')
+  })
+})
diff --git a/apps/web/src/lib/server/integrations/github/ticket-comments.ts b/apps/web/src/lib/server/integrations/github/ticket-comments.ts
new file mode 100644
index 000000000..1f2580806
--- /dev/null
+++ b/apps/web/src/lib/server/integrations/github/ticket-comments.ts
@@ -0,0 +1,366 @@
+import type { IntegrationId, PrincipalId, TicketId, TicketThreadId } from '@quackback/ids'
+import type { TicketThread } from '@/lib/server/db'
+
+const GITHUB_API = 'https://api.github.com'
+const MARKER_RE =
+  /<!--\s*quackback:ticket-thread\s+ticketId=([^\s]+)\s+threadId=([^\s]+)\s+integrationId=([^\s]+)\s*-->/i
+const SYSTEM_MARKER_RE =
+  /<!--\s*quackback:ticket-system\s+integrationId=([^\s]+)\s+event=([^\s]+)\s*-->/i
+
+export interface QuackbackThreadMarker {
+  ticketId: string
+  threadId: string
+  integrationId: string
+}
+
+export interface QuackbackSystemMarker {
+  integrationId: string
+  event: string
+}
+
+export interface GitHubIssueComment {
+  id: number | string
+  body: string | null
+  html_url?: string
+  user?: {
+    login?: string
+    type?: string
+  } | null
+  created_at?: string
+  updated_at?: string
+}
+
+export function parseQuackbackThreadMarker(
+  body: string | null | undefined
+): QuackbackThreadMarker | null {
+  const match = body?.match(MARKER_RE)
+  if (!match) return null
+  return { ticketId: match[1], threadId: match[2], integrationId: match[3] }
+}
+
+export function stripQuackbackThreadMarker(body: string | null | undefined): string {
+  return (body ?? '').replace(MARKER_RE, '').trim()
+}
+
+export function buildQuackbackThreadMarker(args: {
+  ticketId: string
+  threadId: string
+  integrationId: string
+}): string {
+  return `<!-- quackback:ticket-thread ticketId=${args.ticketId} threadId=${args.threadId} integrationId=${args.integrationId} -->`
+}
+
+export function parseQuackbackSystemMarker(
+  body: string | null | undefined
+): QuackbackSystemMarker | null {
+  const match = body?.match(SYSTEM_MARKER_RE)
+  if (!match) return null
+  return { integrationId: match[1], event: match[2] }
+}
+
+export function buildQuackbackSystemMarker(args: { integrationId: string; event: string }): string {
+  return `<!-- quackback:ticket-system integrationId=${args.integrationId} event=${args.event} -->`
+}
+
+export function buildOutboundGitHubCommentBody(args: {
+  ticketId: string
+  threadId: string
+  integrationId: string
+  bodyText: string
+  authorName?: string | null
+  isFromRequester?: boolean
+}): string {
+  const author = args.authorName?.trim()
+  const source = args.isFromRequester ? 'Customer reply from Quackback' : 'Quackback reply'
+  const heading = author ? `_${source} by ${author}_` : `_${source}_`
+  return [heading, '', args.bodyText.trim(), '', buildQuackbackThreadMarker(args)].join('\n').trim()
+}
+
+export function buildInboundTicketThreadBody(comment: GitHubIssueComment): string {
+  const login = comment.user?.login?.trim() || 'GitHub user'
+  const body = stripQuackbackThreadMarker(comment.body)
+  return [`GitHub reply from ${login}:`, '', body].join('\n').trim()
+}
+
+export function githubHeaders(accessToken: string) {
+  return {
+    Authorization: `Bearer ${accessToken}`,
+    Accept: 'application/vnd.github+json',
+    'Content-Type': 'application/json',
+    'User-Agent': 'quackback',
+    'X-GitHub-Api-Version': '2022-11-28',
+  }
+}
+
+export async function createGitHubIssueComment(args: {
+  ownerRepo: string
+  issueNumber: string
+  accessToken: string
+  body: string
+}): Promise<{ id: string; htmlUrl: string | null }> {
+  const response = await fetch(
+    `${GITHUB_API}/repos/${args.ownerRepo}/issues/${args.issueNumber}/comments`,
+    {
+      method: 'POST',
+      headers: githubHeaders(args.accessToken),
+      body: JSON.stringify({ body: args.body }),
+    }
+  )
+  if (!response.ok) {
+    throw Object.assign(new Error(`HTTP ${response.status}: ${await response.text()}`), {
+      status: response.status,
+    })
+  }
+  const json = (await response.json()) as { id: number | string; html_url?: string }
+  return { id: String(json.id), htmlUrl: json.html_url ?? null }
+}
+
+export async function updateGitHubIssueComment(args: {
+  ownerRepo: string
+  commentId: string
+  accessToken: string
+  body: string
+}): Promise<{ htmlUrl: string | null }> {
+  const response = await fetch(
+    `${GITHUB_API}/repos/${args.ownerRepo}/issues/comments/${args.commentId}`,
+    {
+      method: 'PATCH',
+      headers: githubHeaders(args.accessToken),
+      body: JSON.stringify({ body: args.body }),
+    }
+  )
+  if (!response.ok) {
+    throw Object.assign(new Error(`HTTP ${response.status}: ${await response.text()}`), {
+      status: response.status,
+    })
+  }
+  const json = (await response.json()) as { html_url?: string }
+  return { htmlUrl: json.html_url ?? null }
+}
+
+export async function deleteGitHubIssueComment(args: {
+  ownerRepo: string
+  commentId: string
+  accessToken: string
+}): Promise<void> {
+  const response = await fetch(
+    `${GITHUB_API}/repos/${args.ownerRepo}/issues/comments/${args.commentId}`,
+    {
+      method: 'DELETE',
+      headers: githubHeaders(args.accessToken),
+    }
+  )
+  if (!response.ok && response.status !== 404) {
+    throw Object.assign(new Error(`HTTP ${response.status}: ${await response.text()}`), {
+      status: response.status,
+    })
+  }
+}
+
+export async function listGitHubIssueComments(args: {
+  ownerRepo: string
+  issueNumber: string
+  accessToken: string
+  since?: string
+}): Promise<GitHubIssueComment[]> {
+  const comments: GitHubIssueComment[] = []
+  let url = `${GITHUB_API}/repos/${args.ownerRepo}/issues/${args.issueNumber}/comments?per_page=100`
+  if (args.since) url += `&since=${encodeURIComponent(args.since)}`
+
+  while (url) {
+    const response = await fetch(url, { headers: githubHeaders(args.accessToken) })
+    if (!response.ok) {
+      throw Object.assign(new Error(`HTTP ${response.status}: ${await response.text()}`), {
+        status: response.status,
+      })
+    }
+    comments.push(...((await response.json()) as GitHubIssueComment[]))
+    url = parseNextLink(response.headers.get('link'))
+  }
+
+  return comments
+}
+
+export async function getThreadAuthorName(
+  principalId: string | null | undefined
+): Promise<string | null> {
+  if (!principalId) return null
+  const { db, principal, eq } = await import('@/lib/server/db')
+  const row = await db.query.principal.findFirst({
+    where: eq(principal.id, principalId as PrincipalId),
+    columns: { displayName: true },
+    with: { user: { columns: { name: true, email: true } } },
+  })
+  return row?.displayName || row?.user?.name || row?.user?.email || null
+}
+
+export async function findThreadLinkByThread(args: {
+  integrationId: string
+  threadId: string
+}): Promise<{
+  ticketId: TicketId
+  threadId: TicketThreadId
+  externalIssueId: string
+  externalCommentId: string
+  status: string
+} | null> {
+  const { db, ticketThreadExternalLinks, eq, and } = await import('@/lib/server/db')
+  const row = await db.query.ticketThreadExternalLinks.findFirst({
+    where: and(
+      eq(ticketThreadExternalLinks.integrationId, args.integrationId as IntegrationId),
+      eq(ticketThreadExternalLinks.threadId, args.threadId as TicketThreadId)
+    ),
+  })
+  return row
+    ? {
+        ticketId: row.ticketId as TicketId,
+        threadId: row.threadId as TicketThreadId,
+        externalIssueId: row.externalIssueId,
+        externalCommentId: row.externalCommentId,
+        status: row.status,
+      }
+    : null
+}
+
+export async function findThreadLinkByExternalComment(args: {
+  integrationId: string
+  externalCommentId: string
+}): Promise<{
+  ticketId: TicketId
+  threadId: TicketThreadId
+  externalIssueId: string
+  externalCommentId: string
+  status: string
+} | null> {
+  const { db, ticketThreadExternalLinks, eq, and } = await import('@/lib/server/db')
+  const row = await db.query.ticketThreadExternalLinks.findFirst({
+    where: and(
+      eq(ticketThreadExternalLinks.integrationId, args.integrationId as IntegrationId),
+      eq(ticketThreadExternalLinks.externalCommentId, args.externalCommentId)
+    ),
+  })
+  return row
+    ? {
+        ticketId: row.ticketId as TicketId,
+        threadId: row.threadId as TicketThreadId,
+        externalIssueId: row.externalIssueId,
+        externalCommentId: row.externalCommentId,
+        status: row.status,
+      }
+    : null
+}
+
+export async function upsertThreadExternalLink(args: {
+  ticketId: string
+  threadId: string
+  integrationId: string
+  externalIssueId: string
+  externalCommentId: string
+  externalUrl?: string | null
+  syncDirection: 'outbound' | 'inbound' | 'bidirectional'
+  status?: 'active' | 'deleted'
+}): Promise<void> {
+  const { db, ticketThreadExternalLinks, eq, and, sql } = await import('@/lib/server/db')
+  const now = new Date()
+  const values = {
+    ticketId: args.ticketId as TicketId,
+    threadId: args.threadId as TicketThreadId,
+    integrationId: args.integrationId as IntegrationId,
+    integrationType: 'github',
+    externalIssueId: args.externalIssueId,
+    externalCommentId: args.externalCommentId,
+    externalUrl: args.externalUrl ?? null,
+    syncDirection: args.syncDirection,
+    status: args.status ?? 'active',
+    lastSyncedAt: now,
+    updatedAt: now,
+  }
+  const updateValues = {
+    ticketId: values.ticketId,
+    threadId: values.threadId,
+    externalIssueId: values.externalIssueId,
+    externalCommentId: values.externalCommentId,
+    externalUrl: values.externalUrl,
+    syncDirection: values.syncDirection,
+    status: values.status,
+    lastSyncedAt: values.lastSyncedAt,
+    updatedAt: values.updatedAt,
+  }
+
+  try {
+    await db
+      .insert(ticketThreadExternalLinks)
+      .values(values)
+      .onConflictDoUpdate({
+        target: [
+          ticketThreadExternalLinks.integrationId,
+          ticketThreadExternalLinks.externalCommentId,
+        ],
+        set: {
+          threadId: sql`excluded.thread_id`,
+          ticketId: sql`excluded.ticket_id`,
+          externalIssueId: sql`excluded.external_issue_id`,
+          externalUrl: sql`excluded.external_url`,
+          syncDirection: sql`excluded.sync_direction`,
+          status: sql`excluded.status`,
+          lastSyncedAt: now,
+          updatedAt: now,
+        },
+      })
+  } catch (error) {
+    if (!isUniqueViolation(error)) throw error
+
+    await db
+      .update(ticketThreadExternalLinks)
+      .set(updateValues)
+      .where(
+        and(
+          eq(ticketThreadExternalLinks.integrationId, args.integrationId as IntegrationId),
+          eq(ticketThreadExternalLinks.threadId, args.threadId as TicketThreadId)
+        )
+      )
+  }
+}
+
+function isUniqueViolation(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    ('code' in error || 'cause' in error) &&
+    ((error as { code?: unknown }).code === '23505' ||
+      isUniqueViolation((error as { cause?: unknown }).cause))
+  )
+}
+
+export async function markThreadLinkDeleted(args: {
+  integrationId: string
+  externalCommentId: string
+}): Promise<void> {
+  const { db, ticketThreadExternalLinks, eq, and } = await import('@/lib/server/db')
+  await db
+    .update(ticketThreadExternalLinks)
+    .set({ status: 'deleted', lastSyncedAt: new Date(), updatedAt: new Date() })
+    .where(
+      and(
+        eq(ticketThreadExternalLinks.integrationId, args.integrationId as IntegrationId),
+        eq(ticketThreadExternalLinks.externalCommentId, args.externalCommentId)
+      )
+    )
+}
+
+export async function loadThreadForSync(threadId: string): Promise<TicketThread | null> {
+  const { db, ticketThreads, eq } = await import('@/lib/server/db')
+  return (
+    (await db.query.ticketThreads.findFirst({
+      where: eq(ticketThreads.id, threadId as TicketThreadId),
+    })) ?? null
+  )
+}
+
+function parseNextLink(linkHeader: string | null): string {
+  if (!linkHeader) return ''
+  const part = linkHeader.split(',').find((item) => item.includes('rel="next"'))
+  if (!part) return ''
+  const match = part.match(/<([^>]+)>/)
+  return match?.[1] ?? ''
+}
diff --git a/apps/web/src/lib/server/integrations/github/ticket-inbound.ts b/apps/web/src/lib/server/integrations/github/ticket-inbound.ts
new file mode 100644
index 000000000..bacd0ebff
--- /dev/null
+++ b/apps/web/src/lib/server/integrations/github/ticket-inbound.ts
@@ -0,0 +1,818 @@
+/**
+ * GitHub → Ticket inbound sync.
+ *
+ * Processes GitHub issue webhook events and creates / updates tickets accordingly.
+ * Called from the inbound webhook orchestrator after signature verification.
+ *
+ * Loop prevention: every ticket service call passes `syncSourceIntegrationId`
+ * which the dispatch layer spreads onto the event. The outbound targets filter
+ * in targets.ts skips integrations whose ID matches that field.
+ */
+
+import type { GitHubIntegrationConfig } from './types'
+import { markdownToTiptapJson } from '@/lib/server/markdown-tiptap'
+import {
+  parseQuackbackSystemMarker,
+  buildInboundTicketThreadBody,
+  findThreadLinkByExternalComment,
+  loadThreadForSync,
+  parseQuackbackThreadMarker,
+  stripQuackbackThreadMarker,
+  upsertThreadExternalLink,
+  markThreadLinkDeleted,
+  type GitHubIssueComment,
+} from './ticket-comments'
+import { parseQuackbackTicketIssueMarker } from './ticket-message'
+import type { TicketId, TicketStatusId, PrincipalId, InboxId, IntegrationId } from '@quackback/ids'
+import type { TicketStatusCategory } from '@/lib/server/db'
+
+// ============================================================================
+// Inbound sync logging helpers (mirrors outbound pattern in hook.ts)
+// ============================================================================
+
+async function logInboundSync(entry: {
+  integrationId: string
+  ticketId?: string
+  externalId?: string
+  eventType: string
+  status: 'success' | 'failed' | 'skipped'
+  errorMessage?: string
+  durationMs?: number
+}): Promise<void> {
+  try {
+    const { db, integrationSyncLog } = await import('@/lib/server/db')
+    await db.insert(integrationSyncLog).values({
+      integrationId: entry.integrationId as IntegrationId,
+      ticketId: entry.ticketId ? (entry.ticketId as TicketId) : null,
+      externalId: entry.externalId ?? null,
+      eventType: entry.eventType.includes('.') ? entry.eventType : `issue.${entry.eventType}`,
+      direction: 'inbound',
+      status: entry.status,
+      errorMessage: entry.errorMessage ?? null,
+      durationMs: entry.durationMs ?? null,
+    })
+  } catch (err) {
+    console.error('[GitHub Inbound] Failed to write sync log:', err)
+  }
+}
+
+async function touchLinkSyncedAt(externalId: string, integrationId: string): Promise<void> {
+  try {
+    const { db, ticketExternalLinks, eq, and } = await import('@/lib/server/db')
+    await db
+      .update(ticketExternalLinks)
+      .set({ lastSyncedAt: new Date() })
+      .where(
+        and(
+          eq(ticketExternalLinks.integrationId, integrationId as IntegrationId),
+          eq(ticketExternalLinks.externalId, externalId)
+        )
+      )
+  } catch (err) {
+    console.error('[GitHub Inbound] Failed to update lastSyncedAt:', err)
+  }
+}
+
+async function updateIntegrationError(integrationId: string, error: string): Promise<void> {
+  try {
+    const { db, integrations, eq, sql } = await import('@/lib/server/db')
+    await db
+      .update(integrations)
+      .set({
+        lastError: error,
+        lastErrorAt: new Date(),
+        errorCount: sql`${integrations.errorCount} + 1`,
+      })
+      .where(eq(integrations.id, integrationId as IntegrationId))
+  } catch (err) {
+    console.error('[GitHub Inbound] Failed to update integration error:', err)
+  }
+}
+
+async function clearIntegrationError(integrationId: string): Promise<void> {
+  try {
+    const { db, integrations, eq } = await import('@/lib/server/db')
+    await db
+      .update(integrations)
+      .set({ lastError: null, lastErrorAt: null, errorCount: 0 })
+      .where(eq(integrations.id, integrationId as IntegrationId))
+  } catch (err) {
+    console.error('[GitHub Inbound] Failed to clear integration error:', err)
+  }
+}
+
+// ============================================================================
+// GitHub webhook payload types (subset we care about)
+// ============================================================================
+
+export interface GitHubIssuePayload {
+  action: string
+  issue: {
+    number: number
+    title: string
+    body: string | null
+    html_url: string
+    state: string
+    state_reason?: string | null
+    assignee?: { login: string } | null
+    assignees?: Array<{ login: string }>
+    labels?: Array<{ name: string }>
+  }
+  repository: {
+    full_name: string
+  }
+  sender: {
+    login: string
+  }
+}
+
+export interface GitHubIssueCommentPayload {
+  action: 'created' | 'edited' | 'deleted' | string
+  issue: {
+    number: number
+    html_url: string
+    body?: string | null
+  }
+  comment: GitHubIssueComment & {
+    id: number | string
+    body: string | null
+    html_url: string
+  }
+  repository: {
+    full_name: string
+  }
+  sender: {
+    login: string
+  }
+}
+
+// ============================================================================
+// Public entry point
+// ============================================================================
+
+/**
+ * Route a parsed GitHub issue webhook to the correct handler.
+ * Returns true if the event was handled, false if ignored.
+ */
+export async function handleGitHubTicketEvent(
+  payload: GitHubIssuePayload,
+  integration: { id: string; principalId: string | null; config: GitHubIntegrationConfig }
+): Promise<boolean> {
+  const config = integration.config
+  const syncDirection = config.syncDirection ?? 'outbound'
+
+  // Gate: only process when inbound sync is enabled
+  if (syncDirection !== 'inbound' && syncDirection !== 'bidirectional') {
+    return false
+  }
+
+  const issueNumber = String(payload.issue.number)
+  const start = Date.now()
+
+  const logSuccess = async (action: string, ticketId?: string) => {
+    const durationMs = Date.now() - start
+    await logInboundSync({
+      integrationId: integration.id,
+      ticketId,
+      externalId: issueNumber,
+      eventType: action,
+      status: 'success',
+      durationMs,
+    })
+    await touchLinkSyncedAt(issueNumber, integration.id)
+    await clearIntegrationError(integration.id)
+  }
+
+  const logFailure = async (action: string, error: unknown) => {
+    const durationMs = Date.now() - start
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    await logInboundSync({
+      integrationId: integration.id,
+      externalId: issueNumber,
+      eventType: action,
+      status: 'failed',
+      errorMessage,
+      durationMs,
+    })
+    await updateIntegrationError(integration.id, errorMessage)
+  }
+
+  try {
+    switch (payload.action) {
+      case 'opened':
+        if (!config.createTicketsFromIssues) return false
+        await handleIssueOpened(payload, integration)
+        await logSuccess('opened')
+        return true
+
+      case 'closed':
+        await handleIssueClosed(payload, integration)
+        await logSuccess('closed')
+        return true
+
+      case 'reopened':
+        await handleIssueReopened(payload, integration)
+        await logSuccess('reopened')
+        return true
+
+      case 'edited':
+        await handleIssueEdited(payload, integration)
+        await logSuccess('edited')
+        return true
+
+      case 'assigned':
+        if (config.assigneeSync) {
+          await handleIssueAssigned(payload, integration)
+          await logSuccess('assigned')
+          return true
+        }
+        return false
+
+      case 'unassigned':
+        if (config.assigneeSync) {
+          await handleIssueUnassigned(payload, integration)
+          await logSuccess('unassigned')
+          return true
+        }
+        return false
+
+      default:
+        return false
+    }
+  } catch (error) {
+    await logFailure(payload.action, error)
+    throw error
+  }
+}
+
+/**
+ * Route GitHub issue_comment webhook events to linked ticket thread mutations.
+ * Returns true if the event was consumed, false if ignored.
+ */
+export async function handleGitHubIssueCommentEvent(
+  payload: GitHubIssueCommentPayload,
+  integration: { id: string; principalId: string | null; config: GitHubIntegrationConfig }
+): Promise<boolean> {
+  const config = integration.config
+  const syncDirection = config.syncDirection ?? 'outbound'
+  const inboundTicketSync = syncDirection === 'inbound' || syncDirection === 'bidirectional'
+  if (!inboundTicketSync) {
+    return false
+  }
+
+  if (!['created', 'edited', 'deleted'].includes(payload.action)) {
+    return false
+  }
+
+  const issueNumber = String(payload.issue.number)
+  const externalCommentId = String(payload.comment.id)
+  const start = Date.now()
+  const eventType = `issue_comment.${payload.action}`
+
+  const logResult = async (
+    status: 'success' | 'failed' | 'skipped',
+    ticketId?: string,
+    error?: unknown
+  ) => {
+    const errorMessage =
+      status === 'failed' ? (error instanceof Error ? error.message : 'Unknown error') : undefined
+    await logInboundSync({
+      integrationId: integration.id,
+      ticketId,
+      externalId: externalCommentId,
+      eventType,
+      status,
+      errorMessage,
+      durationMs: Date.now() - start,
+    })
+    if (status === 'success') {
+      await clearIntegrationError(integration.id)
+    } else if (status === 'failed' && errorMessage) {
+      await updateIntegrationError(integration.id, errorMessage)
+    }
+  }
+
+  try {
+    const systemMarker = parseQuackbackSystemMarker(payload.comment.body)
+    if (systemMarker?.integrationId === integration.id) {
+      await logResult('skipped')
+      return true
+    }
+
+    const marker = parseQuackbackThreadMarker(payload.comment.body)
+    if (marker) {
+      if (marker.integrationId === integration.id) {
+        const markedThread = await loadThreadForSync(marker.threadId)
+        if (markedThread) {
+          await upsertThreadExternalLink({
+            ticketId: marker.ticketId,
+            threadId: marker.threadId,
+            integrationId: integration.id,
+            externalIssueId: issueNumber,
+            externalCommentId,
+            externalUrl: payload.comment.html_url,
+            syncDirection: 'outbound',
+          })
+        }
+      }
+      await logResult(
+        'skipped',
+        marker.integrationId === integration.id ? marker.ticketId : undefined
+      )
+      return true
+    }
+
+    const ticketId = await findLinkedTicket(issueNumber, integration.id)
+    const linkedTicketId =
+      ticketId ??
+      (await recoverLinkedTicketFromIssueBody({
+        issueNumber,
+        issueUrl: payload.issue.html_url,
+        issueBody: payload.issue.body ?? null,
+        integrationId: integration.id,
+      }))
+    if (!linkedTicketId) {
+      await logResult('skipped')
+      return true
+    }
+
+    switch (payload.action) {
+      case 'created':
+        await handleIssueCommentCreated(payload, integration, linkedTicketId, issueNumber)
+        await logResult('success', linkedTicketId)
+        await touchLinkSyncedAt(issueNumber, integration.id)
+        return true
+      case 'edited':
+        await handleIssueCommentEdited(payload, integration, linkedTicketId, issueNumber)
+        await logResult('success', linkedTicketId)
+        await touchLinkSyncedAt(issueNumber, integration.id)
+        return true
+      case 'deleted':
+        await handleIssueCommentDeleted(payload, integration, linkedTicketId)
+        await logResult('success', linkedTicketId)
+        await touchLinkSyncedAt(issueNumber, integration.id)
+        return true
+      default:
+        return false
+    }
+  } catch (error) {
+    await logResult('failed', undefined, error)
+    throw error
+  }
+}
+
+// ============================================================================
+// Individual handlers
+// ============================================================================
+
+type IntegrationRecord = {
+  id: string
+  principalId: string | null
+  config: GitHubIntegrationConfig
+}
+
+function buildIssueDescriptionPatch(body: string | null): {
+  descriptionJson: ReturnType<typeof markdownToTiptapJson> | null
+  descriptionText: string | null
+} {
+  const description = extractIssueDescription(body)
+  if (!description?.trim()) {
+    return { descriptionJson: null, descriptionText: null }
+  }
+  return {
+    descriptionJson: markdownToTiptapJson(description),
+    descriptionText: description,
+  }
+}
+
+function extractIssueDescription(body: string | null): string | null {
+  if (body == null) return null
+  const viewLinkIndex = body.search(/\n\[View in Quackback\]\([^)]+\)\s*$/)
+  if (viewLinkIndex === -1) return body
+
+  const beforeFooter = body.slice(0, viewLinkIndex)
+  const separators = [...beforeFooter.matchAll(/^---\s*$/gm)]
+  const boundary = separators[separators.length - 1]
+  return boundary?.index == null ? body : body.slice(0, boundary.index).trim()
+}
+
+async function handleIssueCommentCreated(
+  payload: GitHubIssueCommentPayload,
+  integration: IntegrationRecord,
+  ticketId: TicketId,
+  issueNumber: string
+): Promise<void> {
+  const externalCommentId = String(payload.comment.id)
+  const existingLink = await findThreadLinkByExternalComment({
+    integrationId: integration.id,
+    externalCommentId,
+  })
+  if (existingLink?.status === 'active') return
+
+  const bodyText = buildInboundTicketThreadBody(payload.comment)
+  if (!stripQuackbackThreadMarker(payload.comment.body)) return
+
+  const { addThread } = await import('@/lib/server/domains/tickets/ticket.threads')
+  const thread = await addThread({
+    ticketId,
+    principalId: (integration.principalId as PrincipalId | null) ?? null,
+    audience: 'public',
+    bodyText,
+    syncSourceIntegrationId: integration.id,
+  })
+
+  await upsertThreadExternalLink({
+    ticketId,
+    threadId: thread.id,
+    integrationId: integration.id,
+    externalIssueId: issueNumber,
+    externalCommentId,
+    externalUrl: payload.comment.html_url,
+    syncDirection: 'inbound',
+  })
+}
+
+async function handleIssueCommentEdited(
+  payload: GitHubIssueCommentPayload,
+  integration: IntegrationRecord,
+  ticketId: TicketId,
+  issueNumber: string
+): Promise<void> {
+  const externalCommentId = String(payload.comment.id)
+  const link = await findThreadLinkByExternalComment({
+    integrationId: integration.id,
+    externalCommentId,
+  })
+
+  if (!link || link.status !== 'active') {
+    await handleIssueCommentCreated(payload, integration, ticketId, issueNumber)
+    return
+  }
+
+  const bodyText = buildInboundTicketThreadBody(payload.comment)
+  if (!stripQuackbackThreadMarker(payload.comment.body)) return
+
+  const thread = await loadThreadForSync(link.threadId)
+  if (!thread || thread.deletedAt) {
+    await handleIssueCommentCreated(payload, integration, ticketId, issueNumber)
+    return
+  }
+
+  const { editThread } = await import('@/lib/server/domains/tickets/ticket.threads')
+  await editThread({
+    threadId: link.threadId,
+    actorPrincipalId:
+      (thread.principalId as PrincipalId | null) ?? (integration.principalId as PrincipalId | null),
+    bodyText,
+    syncSourceIntegrationId: integration.id,
+  })
+
+  await upsertThreadExternalLink({
+    ticketId,
+    threadId: link.threadId,
+    integrationId: integration.id,
+    externalIssueId: issueNumber,
+    externalCommentId,
+    externalUrl: payload.comment.html_url,
+    syncDirection: 'inbound',
+  })
+}
+
+async function handleIssueCommentDeleted(
+  payload: GitHubIssueCommentPayload,
+  integration: IntegrationRecord,
+  ticketId: TicketId
+): Promise<void> {
+  const externalCommentId = String(payload.comment.id)
+  const link = await findThreadLinkByExternalComment({
+    integrationId: integration.id,
+    externalCommentId,
+  })
+  if (!link || link.status !== 'active') return
+
+  const { softDeleteThread } = await import('@/lib/server/domains/tickets/ticket.threads')
+  await softDeleteThread(
+    link.threadId,
+    (integration.principalId as PrincipalId | null) ?? null,
+    integration.id
+  )
+  await markThreadLinkDeleted({ integrationId: integration.id, externalCommentId })
+  void ticketId
+}
+
+async function handleIssueOpened(
+  payload: GitHubIssuePayload,
+  integration: IntegrationRecord
+): Promise<void> {
+  const issueNumber = String(payload.issue.number)
+  const alreadyLinkedTicketId = await findLinkedTicket(issueNumber, integration.id)
+  if (alreadyLinkedTicketId) {
+    return
+  }
+
+  const recoveredTicketId = await recoverLinkedTicketFromIssueBody({
+    issueNumber,
+    issueUrl: payload.issue.html_url,
+    issueBody: payload.issue.body ?? null,
+    integrationId: integration.id,
+  })
+  if (recoveredTicketId) {
+    return
+  }
+
+  const { createTicket } = await import('@/lib/server/domains/tickets/ticket.service')
+  const { db, ticketExternalLinks } = await import('@/lib/server/db')
+
+  const issue = payload.issue
+  console.log(
+    `[GitHub Inbound] Creating ticket from issue #${issue.number} in ${payload.repository.full_name}`
+  )
+
+  const ticket = await createTicket({
+    subject: truncateSubject(issue.title),
+    ...buildIssueDescriptionPatch(issue.body),
+    channel: 'api',
+    inboxId: integration.config.defaultInboxId
+      ? (integration.config.defaultInboxId as InboxId)
+      : null,
+    createdByPrincipalId: (integration.principalId as PrincipalId) ?? null,
+    syncSourceIntegrationId: integration.id,
+  })
+
+  // Link the ticket to the GitHub issue
+  await db
+    .insert(ticketExternalLinks)
+    .values({
+      ticketId: ticket.id as TicketId,
+      integrationId: integration.id as IntegrationId,
+      integrationType: 'github',
+      externalId: String(issue.number),
+      externalDisplayId: `#${issue.number}`,
+      externalUrl: issue.html_url,
+      syncDirection: 'inbound',
+    })
+    .onConflictDoNothing()
+
+  console.log(`[GitHub Inbound] Created ticket ${ticket.id} from issue #${issue.number}`)
+}
+
+async function handleIssueClosed(
+  payload: GitHubIssuePayload,
+  integration: IntegrationRecord
+): Promise<void> {
+  const ticketId = await findLinkedTicket(String(payload.issue.number), integration.id)
+  if (!ticketId) return
+
+  // Resolve target status: completed → solved, not_planned → closed
+  const category = payload.issue.state_reason === 'not_planned' ? 'closed' : 'solved'
+  const statusId = await findStatusByCategory(category)
+  if (!statusId) {
+    console.warn(`[GitHub Inbound] No ticket status with category "${category}", skipping`)
+    return
+  }
+
+  const { transitionStatus } = await import('@/lib/server/domains/tickets/ticket.service')
+  const { getTicket } = await import('@/lib/server/domains/tickets/ticket.service')
+
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return
+
+  console.log(
+    `[GitHub Inbound] Closing ticket ${ticketId} (issue #${payload.issue.number} → ${category})`
+  )
+
+  await transitionStatus(ticketId, {
+    expectedUpdatedAt: ticket.updatedAt,
+    actorPrincipalId: (integration.principalId as PrincipalId) ?? null,
+    statusId,
+    syncSourceIntegrationId: integration.id,
+  })
+}
+
+async function handleIssueReopened(
+  payload: GitHubIssuePayload,
+  integration: IntegrationRecord
+): Promise<void> {
+  const ticketId = await findLinkedTicket(String(payload.issue.number), integration.id)
+  if (!ticketId) return
+
+  const statusId = await findStatusByCategory('open')
+  if (!statusId) {
+    console.warn('[GitHub Inbound] No ticket status with category "open", skipping')
+    return
+  }
+
+  const { transitionStatus, getTicket } =
+    await import('@/lib/server/domains/tickets/ticket.service')
+
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return
+
+  console.log(`[GitHub Inbound] Reopening ticket ${ticketId} (issue #${payload.issue.number})`)
+
+  await transitionStatus(ticketId, {
+    expectedUpdatedAt: ticket.updatedAt,
+    actorPrincipalId: (integration.principalId as PrincipalId) ?? null,
+    statusId,
+    syncSourceIntegrationId: integration.id,
+  })
+}
+
+async function handleIssueEdited(
+  payload: GitHubIssuePayload,
+  integration: IntegrationRecord
+): Promise<void> {
+  const ticketId = await findLinkedTicket(String(payload.issue.number), integration.id)
+  if (!ticketId) return
+
+  const { updateTicket, getTicket } = await import('@/lib/server/domains/tickets/ticket.service')
+
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return
+
+  console.log(`[GitHub Inbound] Updating ticket ${ticketId} from issue #${payload.issue.number}`)
+
+  await updateTicket(ticketId, {
+    expectedUpdatedAt: ticket.updatedAt,
+    actorPrincipalId: (integration.principalId as PrincipalId) ?? null,
+    subject: truncateSubject(payload.issue.title),
+    ...buildIssueDescriptionPatch(payload.issue.body),
+    syncSourceIntegrationId: integration.id,
+  })
+}
+
+async function handleIssueAssigned(
+  payload: GitHubIssuePayload,
+  integration: IntegrationRecord
+): Promise<void> {
+  const ticketId = await findLinkedTicket(String(payload.issue.number), integration.id)
+  if (!ticketId) return
+
+  // Resolve GitHub username → Quackback principal
+  const assigneeLogin = payload.issue.assignee?.login
+  if (!assigneeLogin) return
+
+  const principalId = await findPrincipalByGitHubUsername(assigneeLogin, integration.id)
+  if (!principalId) {
+    console.log(
+      `[GitHub Inbound] No user mapping for GitHub user "${assigneeLogin}", skipping assign`
+    )
+    return
+  }
+
+  const { assignTicket, getTicket } = await import('@/lib/server/domains/tickets/ticket.service')
+
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return
+
+  console.log(
+    `[GitHub Inbound] Assigning ticket ${ticketId} to ${principalId} (GitHub: ${assigneeLogin})`
+  )
+
+  await assignTicket(ticketId, {
+    expectedUpdatedAt: ticket.updatedAt,
+    actorPrincipalId: (integration.principalId as PrincipalId) ?? null,
+    assigneePrincipalId: principalId,
+    syncSourceIntegrationId: integration.id,
+  })
+}
+
+async function handleIssueUnassigned(
+  payload: GitHubIssuePayload,
+  integration: IntegrationRecord
+): Promise<void> {
+  const ticketId = await findLinkedTicket(String(payload.issue.number), integration.id)
+  if (!ticketId) return
+
+  const { assignTicket, getTicket } = await import('@/lib/server/domains/tickets/ticket.service')
+
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return
+
+  // Only unassign if ticket currently has an assignee
+  if (!ticket.assigneePrincipalId) return
+
+  console.log(`[GitHub Inbound] Unassigning ticket ${ticketId}`)
+
+  await assignTicket(ticketId, {
+    expectedUpdatedAt: ticket.updatedAt,
+    actorPrincipalId: (integration.principalId as PrincipalId) ?? null,
+    assigneePrincipalId: null,
+    syncSourceIntegrationId: integration.id,
+  })
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+/**
+ * Look up the ticket linked to a GitHub issue number for a specific integration.
+ */
+export async function findLinkedTicket(
+  issueNumber: string,
+  integrationId: string
+): Promise<TicketId | null> {
+  const { db, ticketExternalLinks, eq, and } = await import('@/lib/server/db')
+  const link = await db.query.ticketExternalLinks.findFirst({
+    where: and(
+      eq(ticketExternalLinks.integrationId, integrationId as IntegrationId),
+      eq(ticketExternalLinks.externalId, issueNumber),
+      eq(ticketExternalLinks.status, 'active')
+    ),
+    columns: { ticketId: true },
+  })
+  if (!link) {
+    console.log(
+      `[GitHub Inbound] No linked ticket for issue #${issueNumber} (integration ${integrationId})`
+    )
+    return null
+  }
+  return link.ticketId as TicketId
+}
+
+async function recoverLinkedTicketFromIssueBody(args: {
+  issueNumber: string
+  issueUrl: string
+  issueBody: string | null
+  integrationId: string
+}): Promise<TicketId | null> {
+  const ticketId = extractTicketIdFromGitHubIssueBody(args.issueBody)
+  if (!ticketId) return null
+
+  const { db, ticketExternalLinks, tickets, eq, and, isNull } = await import('@/lib/server/db')
+  const ticket = await db.query.tickets.findFirst({
+    where: and(eq(tickets.id, ticketId as TicketId), isNull(tickets.deletedAt)),
+    columns: { id: true },
+  })
+  if (!ticket) return null
+
+  await db
+    .insert(ticketExternalLinks)
+    .values({
+      ticketId: ticketId as TicketId,
+      integrationId: args.integrationId as IntegrationId,
+      integrationType: 'github',
+      externalId: args.issueNumber,
+      externalDisplayId: `#${args.issueNumber}`,
+      externalUrl: args.issueUrl,
+      syncDirection: 'outbound',
+      lastSyncedAt: new Date(),
+    })
+    .onConflictDoNothing()
+
+  return ticketId as TicketId
+}
+
+function extractTicketIdFromGitHubIssueBody(body: string | null): string | null {
+  if (!body) return null
+  const marker = parseQuackbackTicketIssueMarker(body)
+  if (marker?.ticketId) return marker.ticketId
+
+  return (
+    body.match(/\/(?:admin\/)?tickets\/(ticket_[A-Za-z0-9]+)/)?.[1] ??
+    body.match(/\bticketId=(ticket_[A-Za-z0-9]+)/)?.[1] ??
+    null
+  )
+}
+
+/**
+ * Find the first ticket status matching a given category.
+ */
+async function findStatusByCategory(category: string): Promise<TicketStatusId | null> {
+  const { db, ticketStatuses, eq, and, isNull } = await import('@/lib/server/db')
+  const status = await db.query.ticketStatuses.findFirst({
+    where: and(
+      eq(ticketStatuses.category, category as TicketStatusCategory),
+      isNull(ticketStatuses.deletedAt)
+    ),
+    columns: { id: true },
+  })
+  return (status?.id as TicketStatusId) ?? null
+}
+
+/**
+ * Resolve a GitHub username to a Quackback PrincipalId via integration user mappings.
+ */
+async function findPrincipalByGitHubUsername(
+  username: string,
+  integrationId: string
+): Promise<PrincipalId | null> {
+  const { db, integrationUserMappings, eq, and } = await import('@/lib/server/db')
+  const mapping = await db.query.integrationUserMappings.findFirst({
+    where: and(
+      eq(integrationUserMappings.integrationId, integrationId as IntegrationId),
+      eq(integrationUserMappings.externalUsername, username)
+    ),
+    columns: { principalId: true },
+  })
+  return (mapping?.principalId as PrincipalId) ?? null
+}
+
+/**
+ * Truncate issue title to fit ticket subject constraint (500 chars).
+ */
+function truncateSubject(title: string): string {
+  const trimmed = title?.trim() || 'Untitled issue'
+  return trimmed.length > 500 ? trimmed.slice(0, 497) + '...' : trimmed
+}
diff --git a/apps/web/src/lib/server/integrations/github/ticket-message.ts b/apps/web/src/lib/server/integrations/github/ticket-message.ts
new file mode 100644
index 000000000..8a69c6216
--- /dev/null
+++ b/apps/web/src/lib/server/integrations/github/ticket-message.ts
@@ -0,0 +1,137 @@
+/**
+ * GitHub issue formatting utilities for ticket events.
+ */
+
+import type { EventData, EventTicketRef } from '../../events/types'
+import { truncate } from '../../events/hook-utils'
+
+const ISSUE_MARKER_RE =
+  /<!--\s*quackback:ticket-issue\s+ticketId=([^\s]+)(?:\s+integrationId=([^\s]+))?\s*-->/i
+
+/**
+ * Build a GitHub issue title and body from a ticket event.
+ */
+export function buildTicketIssueBody(
+  event: EventData,
+  rootUrl?: string
+): {
+  title: string
+  body: string
+  labels: string[]
+} {
+  if (event.type !== 'ticket.created') {
+    return { title: 'Ticket', body: '', labels: [] }
+  }
+
+  const { ticket } = event.data
+  const title = ticket.subject || 'Untitled ticket'
+  const body = formatTicketBody(ticket, rootUrl)
+  const labels = buildTicketLabels(ticket)
+
+  return { title, body, labels }
+}
+
+export function buildQuackbackTicketIssueMarker(args: {
+  ticketId: string
+  integrationId?: string | null
+}): string {
+  const integrationPart = args.integrationId ? ` integrationId=${args.integrationId}` : ''
+  return `<!-- quackback:ticket-issue ticketId=${args.ticketId}${integrationPart} -->`
+}
+
+export function parseQuackbackTicketIssueMarker(
+  body: string | null | undefined
+): { ticketId: string; integrationId: string | null } | null {
+  const match = body?.match(ISSUE_MARKER_RE)
+  if (!match) return null
+  return {
+    ticketId: match[1],
+    integrationId: match[2] ?? null,
+  }
+}
+
+export function appendQuackbackTicketIssueMarker(
+  body: string,
+  args: { ticketId: string; integrationId?: string | null }
+): string {
+  const marker = buildQuackbackTicketIssueMarker(args)
+  return body.includes(marker) ? body : `${body}\n\n${marker}`
+}
+
+function formatTicketBody(ticket: EventTicketRef, rootUrl?: string): string {
+  const sections: string[] = []
+
+  const description = ticket.descriptionText?.trim()
+  if (description) {
+    sections.push(description)
+  }
+
+  const meta: string[] = []
+  if (ticket.statusName) {
+    meta.push(`**Status:** ${ticket.statusName}`)
+  }
+  if (ticket.requesterName || ticket.requesterEmail) {
+    const requester = ticket.requesterName || ticket.requesterEmail
+    meta.push(`**Requester:** ${requester}`)
+  }
+  if (ticket.organizationName) {
+    meta.push(`**Organization:** ${ticket.organizationName}`)
+  }
+  if (ticket.inboxName) {
+    meta.push(`**Inbox:** ${ticket.inboxName}`)
+  }
+
+  const ticketUrl = ticket.ticketUrl ?? buildTicketUrl(rootUrl, ticket.id)
+
+  if (meta.length > 0 || ticketUrl) {
+    if (sections.length > 0) {
+      sections.push('')
+      sections.push('---')
+      sections.push('')
+    }
+
+    sections.push(...meta)
+
+    if (ticketUrl) {
+      if (meta.length > 0) {
+        sections.push('')
+      }
+      sections.push(`[View in Quackback](${ticketUrl})`)
+    }
+  }
+
+  return truncate(sections.join('\n'), 65000)
+}
+
+function buildTicketLabels(ticket: EventTicketRef): string[] {
+  const labels: string[] = []
+  if (ticket.priority) {
+    labels.push(`priority:${ticket.priority}`)
+  }
+  if (ticket.channel) {
+    labels.push(`channel:${ticket.channel}`)
+  }
+  return labels
+}
+
+/**
+ * Build an updated issue body for ticket.updated events.
+ * Only called when subject or description changed.
+ */
+export function buildTicketUpdateBody(
+  ticket: EventTicketRef,
+  rootUrl?: string
+): {
+  title?: string
+  body?: string
+} {
+  return {
+    title: ticket.subject || undefined,
+    body: formatTicketBody(ticket, rootUrl),
+  }
+}
+
+function buildTicketUrl(rootUrl: string | undefined, ticketId: string): string | null {
+  if (!rootUrl) return null
+  return `${rootUrl.replace(/\/+$/, '')}/admin/tickets/${ticketId}`
+}
diff --git a/apps/web/src/lib/server/integrations/slack/functions.ts b/apps/web/src/lib/server/integrations/slack/functions.ts
index 7aa9e4cab..f8a8e63c1 100644
--- a/apps/web/src/lib/server/integrations/slack/functions.ts
+++ b/apps/web/src/lib/server/integrations/slack/functions.ts
@@ -36,7 +36,7 @@ export const getSlackConnectUrl = createServerFn({ method: 'GET' }).handler(
     const { randomBytes } = await import('crypto')
     const { requireAuth } = await import('../../functions/auth-helpers')
     const { signOAuthState } = await import('@/lib/server/auth/oauth-state')
-    const { config } = await import('@/lib/server/config')
+    const { getOAuthReturnDomain } = await import('@/lib/server/integrations/oauth')
 
     const auth = await requireAuth({ roles: ['admin'] })
     const { hasPlatformCredentials } =
@@ -46,7 +46,7 @@ export const getSlackConnectUrl = createServerFn({ method: 'GET' }).handler(
         'Slack platform credentials not configured. Configure them in integration settings first.'
       )
     }
-    const returnDomain = new URL(config.baseUrl).host
+    const returnDomain = getOAuthReturnDomain()
 
     const state = signOAuthState({
       type: 'slack_oauth',
diff --git a/apps/web/src/lib/server/integrations/teams/functions.ts b/apps/web/src/lib/server/integrations/teams/functions.ts
index 14dda3fe9..e61038318 100644
--- a/apps/web/src/lib/server/integrations/teams/functions.ts
+++ b/apps/web/src/lib/server/integrations/teams/functions.ts
@@ -4,6 +4,7 @@
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import type { PrincipalId } from '@quackback/ids'
+import { toIsoString } from '@/lib/shared/utils'
 
 export interface TeamsOAuthState {
   type: 'teams_oauth'
@@ -35,7 +36,7 @@ export const getTeamsConnectUrl = createServerFn({ method: 'GET' }).handler(
     const { randomBytes } = await import('crypto')
     const { requireAuth } = await import('../../functions/auth-helpers')
     const { signOAuthState } = await import('@/lib/server/auth/oauth-state')
-    const { config } = await import('@/lib/server/config')
+    const { getOAuthReturnDomain } = await import('@/lib/server/integrations/oauth')
 
     const auth = await requireAuth({ roles: ['admin'] })
     const { hasPlatformCredentials } =
@@ -45,7 +46,7 @@ export const getTeamsConnectUrl = createServerFn({ method: 'GET' }).handler(
         'Teams platform credentials not configured. Configure them in integration settings first.'
       )
     }
-    const returnDomain = new URL(config.baseUrl).host
+    const returnDomain = getOAuthReturnDomain()
 
     const state = signOAuthState({
       type: 'teams_oauth',
@@ -83,7 +84,7 @@ async function getTeamsAccessToken(integration: { secrets: unknown; config: unkn
       const credentials = await getPlatformCredentials('teams')
       const refreshed = await refreshTeamsToken(secrets.refreshToken, credentials ?? undefined)
 
-      const newExpiry = new Date(Date.now() + refreshed.expiresIn * 1000).toISOString()
+      const newExpiry = toIsoString(new Date(Date.now() + refreshed.expiresIn * 1000))
       await db
         .update(integrations)
         .set({
diff --git a/apps/web/src/lib/server/markdown-tiptap.ts b/apps/web/src/lib/server/markdown-tiptap.ts
index 9a7ff62a6..c07c49a6d 100644
--- a/apps/web/src/lib/server/markdown-tiptap.ts
+++ b/apps/web/src/lib/server/markdown-tiptap.ts
@@ -30,6 +30,7 @@ import { sanitizeTiptapContent } from '@/lib/server/sanitize-tiptap'
  * CodeBlockLowlight (lowlight needs no special markdown handling; StarterKit's
  * codeBlock handles ``` fences).
  */
+
 const SERVER_EXTENSIONS = [
   StarterKit.configure({
     heading: { levels: [1, 2, 3] },
@@ -43,7 +44,7 @@ const SERVER_EXTENSIONS = [
   TableRow,
   TableCell,
   TableHeader,
-]
+] as any[]
 
 /** Singleton MarkdownManager - created once at module load */
 const manager = new MarkdownManager({
@@ -76,6 +77,7 @@ export function tiptapJsonToMarkdown(json: TiptapContent | JSONContent): string
  * Slim extension set for comments — no images, no tables, no YouTube.
  * Comments are short, dense, and inline; we want the safe subset only.
  */
+
 const COMMENT_EXTENSIONS = [
   StarterKit.configure({
     heading: { levels: [1, 2, 3] },
@@ -85,7 +87,7 @@ const COMMENT_EXTENSIONS = [
   Underline,
   TaskList,
   TaskItem.configure({ nested: true }),
-]
+] as any[]
 
 const commentManager = new MarkdownManager({
   extensions: COMMENT_EXTENSIONS,
diff --git a/apps/web/src/lib/server/policy/__tests__/support.test.ts b/apps/web/src/lib/server/policy/__tests__/support.test.ts
new file mode 100644
index 000000000..af40a3ddd
--- /dev/null
+++ b/apps/web/src/lib/server/policy/__tests__/support.test.ts
@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'vitest'
+import type { PrincipalId, SegmentId } from '@quackback/ids'
+import { canAccessSupportSurface } from '../support'
+import { ANONYMOUS_ACTOR, type Actor } from '../types'
+import type { SupportAccessConfig } from '@/lib/server/domains/settings/settings.types'
+
+const admin: Actor = {
+  principalId: 'principal_admin' as PrincipalId,
+  role: 'admin',
+  principalType: 'user',
+  segmentIds: new Set(),
+}
+
+const user: Actor = {
+  principalId: 'principal_user' as PrincipalId,
+  role: 'user',
+  principalType: 'user',
+  segmentIds: new Set(),
+}
+
+const selectedUser: Actor = {
+  principalId: 'principal_selected' as PrincipalId,
+  role: 'user',
+  principalType: 'user',
+  segmentIds: new Set(),
+}
+
+const segmentMember: Actor = {
+  principalId: 'principal_segment' as PrincipalId,
+  role: 'user',
+  principalType: 'user',
+  segmentIds: new Set(['segment_vip' as SegmentId]),
+}
+
+const service: Actor = {
+  principalId: 'principal_service' as PrincipalId,
+  role: 'user',
+  principalType: 'service',
+  segmentIds: new Set(['segment_vip' as SegmentId]),
+}
+
+function access(input: Partial<SupportAccessConfig>): SupportAccessConfig {
+  return {
+    mode: 'anonymous',
+    segmentIds: [],
+    principalIds: [],
+    ...input,
+  }
+}
+
+describe('canAccessSupportSurface', () => {
+  it('allows team actors for every mode', () => {
+    for (const mode of ['anonymous', 'authenticated', 'selected', 'team'] as const) {
+      expect(canAccessSupportSurface(admin, access({ mode })).allowed).toBe(true)
+    }
+  })
+
+  it('allows anonymous mode to anonymous and signed-in visitors, but not service principals', () => {
+    const cfg = access({ mode: 'anonymous' })
+    expect(canAccessSupportSurface(ANONYMOUS_ACTOR, cfg).allowed).toBe(true)
+    expect(canAccessSupportSurface(user, cfg).allowed).toBe(true)
+    expect(canAccessSupportSurface(service, cfg).allowed).toBe(false)
+  })
+
+  it('requires a portal user for authenticated mode', () => {
+    const cfg = access({ mode: 'authenticated' })
+    expect(canAccessSupportSurface(ANONYMOUS_ACTOR, cfg).allowed).toBe(false)
+    expect(canAccessSupportSurface(user, cfg).allowed).toBe(true)
+  })
+
+  it('allows selected users by explicit principal id', () => {
+    const cfg = access({
+      mode: 'selected',
+      principalIds: ['principal_selected' as PrincipalId],
+    })
+    expect(canAccessSupportSurface(selectedUser, cfg).allowed).toBe(true)
+    expect(canAccessSupportSurface(user, cfg).allowed).toBe(false)
+  })
+
+  it('allows selected users by segment membership', () => {
+    const cfg = access({ mode: 'selected', segmentIds: ['segment_vip' as SegmentId] })
+    expect(canAccessSupportSurface(segmentMember, cfg).allowed).toBe(true)
+    expect(canAccessSupportSurface(user, cfg).allowed).toBe(false)
+  })
+
+  it('denies service principals even when they match a selected segment', () => {
+    const cfg = access({ mode: 'selected', segmentIds: ['segment_vip' as SegmentId] })
+    expect(canAccessSupportSurface(service, cfg).allowed).toBe(false)
+  })
+
+  it('fails closed for selected mode with empty allowlists', () => {
+    expect(canAccessSupportSurface(user, access({ mode: 'selected' })).allowed).toBe(false)
+  })
+
+  it('denies visitors for team mode', () => {
+    expect(canAccessSupportSurface(user, access({ mode: 'team' })).allowed).toBe(false)
+  })
+})
diff --git a/apps/web/src/lib/server/policy/index.ts b/apps/web/src/lib/server/policy/index.ts
index c39fa400d..4b0fd41e7 100644
--- a/apps/web/src/lib/server/policy/index.ts
+++ b/apps/web/src/lib/server/policy/index.ts
@@ -1,3 +1,18 @@
+/**
+ * Feedback / Portal authorization layer.
+ *
+ * Covers: boards, posts, comments, chat/conversation visibility.
+ *
+ * Design: 3-role model (admin | member | user) with 4-tier access gates:
+ *   anonymous → authenticated → segments → team
+ * Each resource exposes `canX(actor, resource): Decision` for single-row
+ * checks and `xFilter(actor): SQL` for composable list-query predicates.
+ *
+ * For ticketing/CRM authorization (tickets, teams, inboxes, SLA, contacts,
+ * organizations), use `@/lib/server/domains/authz` instead — it uses a
+ * fine-grained RBAC permission catalogue with team-scoped narrowing.
+ */
 export * from './types'
 export * from './boards'
 export * from './posts'
+export * from './support'
diff --git a/apps/web/src/lib/server/policy/support.ts b/apps/web/src/lib/server/policy/support.ts
new file mode 100644
index 000000000..e62845478
--- /dev/null
+++ b/apps/web/src/lib/server/policy/support.ts
@@ -0,0 +1,47 @@
+/**
+ * Feature-level support surface authorization.
+ *
+ * Covers whether a visitor may use a Conversations surface at all (widget chat
+ * or portal Support). Conversation ownership remains in chat.ts.
+ */
+import type { SupportAccessConfig } from '@/lib/server/domains/settings/settings.types'
+import { allowDecision, denyDecision, isTeamActor, type Actor, type Decision } from './types'
+
+function denyMessage(mode: SupportAccessConfig['mode']): string {
+  switch (mode) {
+    case 'anonymous':
+      return 'Support is not available'
+    case 'authenticated':
+      return 'Sign in to contact support'
+    case 'selected':
+      return 'Support is restricted'
+    case 'team':
+      return 'Support is internal'
+  }
+}
+
+export function canAccessSupportSurface(actor: Actor, access: SupportAccessConfig): Decision {
+  if (isTeamActor(actor)) return allowDecision()
+  if (actor.principalType === 'service')
+    return denyDecision('Service principals cannot use support')
+
+  switch (access.mode) {
+    case 'anonymous':
+      return allowDecision()
+    case 'authenticated':
+      return actor.principalType === 'user'
+        ? allowDecision()
+        : denyDecision(denyMessage(access.mode))
+    case 'selected': {
+      const principalAllowed =
+        !!actor.principalId && access.principalIds.some((id) => id === actor.principalId)
+      const segmentAllowed =
+        actor.principalType === 'user' && access.segmentIds.some((id) => actor.segmentIds.has(id))
+      return principalAllowed || segmentAllowed
+        ? allowDecision()
+        : denyDecision(denyMessage(access.mode))
+    }
+    case 'team':
+      return denyDecision(denyMessage(access.mode))
+  }
+}
diff --git a/apps/web/src/lib/server/public-url.ts b/apps/web/src/lib/server/public-url.ts
new file mode 100644
index 000000000..46de082a2
--- /dev/null
+++ b/apps/web/src/lib/server/public-url.ts
@@ -0,0 +1,111 @@
+import { getRequestHeaders } from '@tanstack/react-start/server'
+import { getBaseUrl } from '@/lib/server/config'
+import { getPublicOriginFromHeaders } from '@/lib/server/integrations/oauth'
+
+const LOCAL_HOSTNAMES = new Set(['localhost', 'host.docker.internal', '0.0.0.0', '::1'])
+
+function isLocalOrPrivateHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, '')
+
+  if (
+    LOCAL_HOSTNAMES.has(normalized) ||
+    normalized.endsWith('.localhost') ||
+    normalized.endsWith('.local')
+  ) {
+    return true
+  }
+
+  if (normalized.includes(':')) {
+    return (
+      normalized === '::1' ||
+      normalized.startsWith('fc') ||
+      normalized.startsWith('fd') ||
+      normalized.startsWith('fe80:')
+    )
+  }
+
+  const match = normalized.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
+  if (!match) return false
+
+  const octets = match.slice(1).map(Number)
+  if (octets.some((n) => n > 255)) return false
+
+  const [a, b] = octets
+  return (
+    a === 0 ||
+    a === 10 ||
+    a === 127 ||
+    (a === 169 && b === 254) ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && b === 168) ||
+    (a === 100 && b >= 64 && b <= 127)
+  )
+}
+
+function isLocalOrPrivateUrl(value: string): boolean {
+  try {
+    return isLocalOrPrivateHostname(new URL(value).hostname)
+  } catch {
+    return true
+  }
+}
+
+function isUsableExternalOrigin(origin: string): boolean {
+  try {
+    const url = new URL(origin)
+    return url.protocol === 'https:' && !isLocalOrPrivateHostname(url.hostname)
+  } catch {
+    return false
+  }
+}
+
+function trimTrailingSlash(value: string): string {
+  return value.replace(/\/+$/, '')
+}
+
+export function getActiveRequestHeaders(): Headers | undefined {
+  try {
+    return getRequestHeaders()
+  } catch {
+    return undefined
+  }
+}
+
+export function resolvePublicBaseUrl(
+  requestHeaders: Headers | undefined = getActiveRequestHeaders()
+): string {
+  const configuredBaseUrl = trimTrailingSlash(getBaseUrl())
+
+  if (!isLocalOrPrivateUrl(configuredBaseUrl)) {
+    return configuredBaseUrl
+  }
+
+  try {
+    const requestOrigin = requestHeaders ? getPublicOriginFromHeaders(requestHeaders) : ''
+    if (requestOrigin && isUsableExternalOrigin(requestOrigin)) {
+      return requestOrigin
+    }
+  } catch {
+    // Fall back to the configured URL below.
+  }
+
+  return configuredBaseUrl
+}
+
+export function rewriteUrlToPublicBaseUrl(
+  value: string,
+  requestHeaders: Headers | undefined = getActiveRequestHeaders()
+): string {
+  const publicBaseUrl = resolvePublicBaseUrl(requestHeaders)
+
+  try {
+    const url = new URL(value)
+    const baseUrl = new URL(publicBaseUrl)
+    url.protocol = baseUrl.protocol
+    url.hostname = baseUrl.hostname
+    url.port = baseUrl.port
+    return url.toString()
+  } catch {
+    return value
+  }
+}
diff --git a/apps/web/src/lib/server/queue/redis-config.ts b/apps/web/src/lib/server/queue/redis-config.ts
index 20fc09111..484aa12a0 100644
--- a/apps/web/src/lib/server/queue/redis-config.ts
+++ b/apps/web/src/lib/server/queue/redis-config.ts
@@ -13,7 +13,7 @@ import { config } from '@/lib/server/config'
  */
 let _shared: IORedis | null = null
 
-export function getQueueRedis(): IORedis {
+export function getQueueRedis(): any {
   if (!_shared) {
     _shared = new IORedis(config.redisUrl, {
       maxRetriesPerRequest: null,
@@ -28,7 +28,7 @@ export function getQueueRedis(): IORedis {
  * `new Worker(name, fn, getQueueConnection())`. Returns the shared
  * IORedis instance wrapped in BullMQ's connection option shape.
  */
-export function getQueueConnection(): { connection: IORedis } {
+export function getQueueConnection(): { connection: any } {
   return { connection: getQueueRedis() }
 }
 
diff --git a/apps/web/src/lib/server/storage/s3.ts b/apps/web/src/lib/server/storage/s3.ts
index 7d2b5379f..c90cca12b 100644
--- a/apps/web/src/lib/server/storage/s3.ts
+++ b/apps/web/src/lib/server/storage/s3.ts
@@ -180,13 +180,15 @@ async function getS3Client(): Promise<S3ClientInstance> {
  * so it works with both public and private buckets (e.g., Railway Buckets).
  * Users who want direct endpoint URLs can set S3_PUBLIC_URL to their endpoint.
  */
-function buildPublicUrl(s3Config: S3Config, key: string): string {
+function buildPublicUrl(s3Config: S3Config, key: string, requestOrigin?: string): string {
   if (s3Config.publicUrl) {
     return `${s3Config.publicUrl.replace(/\/$/, '')}/${key}`
   }
 
-  // Default to the presigned URL redirect route — works with any bucket
-  return `${config.baseUrl.replace(/\/$/, '')}/api/storage/${key}`
+  // Use the request's origin when available so tunneled / proxied dev servers
+  // return URLs the browser can actually reach (instead of localhost).
+  const base = (requestOrigin ?? config.baseUrl).replace(/\/$/, '')
+  return `${base}/api/storage/${key}`
 }
 
 // ============================================================================
@@ -295,7 +297,8 @@ export function verifyProxyUploadToken(
 export async function uploadObject(
   key: string,
   body: Buffer | Uint8Array,
-  contentType: string
+  contentType: string,
+  requestOrigin?: string
 ): Promise<string> {
   const s3Config = getS3Config()
   const client = await getS3Client()
@@ -310,7 +313,7 @@ export async function uploadObject(
 
   await client.send(command)
 
-  return buildPublicUrl(s3Config, key)
+  return buildPublicUrl(s3Config, key, requestOrigin)
 }
 
 // ============================================================================
@@ -351,7 +354,37 @@ export function isAllowedImageType(contentType: string): boolean {
 }
 
 /**
- * Maximum allowed file size in bytes (5MB).
+ * Blocked MIME types for general file attachments — executables and scripts
+ * that could be harmful if opened by a user.
+ */
+const BLOCKED_ATTACHMENT_TYPES = new Set([
+  'application/x-msdownload',
+  'application/x-executable',
+  'application/x-msdos-program',
+  'application/x-sh',
+  'application/x-csh',
+  'application/x-bat',
+  'application/x-msi',
+  'application/vnd.microsoft.portable-executable',
+  'text/x-shellscript',
+])
+
+/**
+ * Validate that a MIME type is safe to accept as a general file attachment.
+ * Blocks executables and scripts; allows everything else.
+ */
+export function isAllowedAttachmentType(contentType: string): boolean {
+  const normalised = contentType.split(';')[0].trim().toLowerCase()
+  return !BLOCKED_ATTACHMENT_TYPES.has(normalised)
+}
+
+/**
+ * Maximum allowed file size in bytes for general attachments (25MB).
+ */
+export const MAX_ATTACHMENT_FILE_SIZE = 25 * 1024 * 1024
+
+/**
+ * Maximum allowed file size in bytes for inline images (5MB).
  */
 export const MAX_FILE_SIZE = 5 * 1024 * 1024
 
@@ -361,10 +394,14 @@ export const MAX_FILE_SIZE = 5 * 1024 * 1024
  *
  * @param formData - Already-parsed request FormData (must contain a `file` field)
  * @param storagePrefix - Bucket prefix, e.g. "portal-images"
+ * @param requestOrigin - Optional origin derived from the incoming request (e.g. "https://my-tunnel.trycloudflare.com").
+ *   When provided and S3_PUBLIC_URL is not set, this replaces BASE_URL in the returned publicUrl so that
+ *   tunneled / proxied dev servers return URLs the browser can actually reach.
  */
 export async function uploadImageFromFormData(
   formData: FormData,
-  storagePrefix: string
+  storagePrefix: string,
+  requestOrigin?: string
 ): Promise<Response> {
   const file = formData.get('file')
   if (!(file instanceof File)) {
@@ -390,7 +427,7 @@ export async function uploadImageFromFormData(
     if (sniffImageMime(body) !== file.type) {
       return Response.json({ error: 'File content does not match its type' }, { status: 400 })
     }
-    const publicUrl = await uploadObject(key, body, file.type)
+    const publicUrl = await uploadObject(key, body, file.type, requestOrigin)
     return Response.json({ publicUrl })
   } catch {
     return Response.json({ error: 'Upload failed' }, { status: 500 })
diff --git a/apps/web/src/lib/server/widget/__tests__/ticket-scope.diffcov.test.ts b/apps/web/src/lib/server/widget/__tests__/ticket-scope.diffcov.test.ts
new file mode 100644
index 000000000..828dcb2aa
--- /dev/null
+++ b/apps/web/src/lib/server/widget/__tests__/ticket-scope.diffcov.test.ts
@@ -0,0 +1,74 @@
+/**
+ * Differential-coverage tests for widget/ticket-scope — visible categories,
+ * allowed inbox derivation, list scope/filters, and the assert guard.
+ */
+import { describe, it, expect } from 'vitest'
+import {
+  visibleWidgetSupportCategories,
+  allowedWidgetSupportInboxIds,
+  widgetTicketListScope,
+  widgetTicketListFilters,
+  assertTicketMatchesWidgetContext,
+} from '../ticket-scope'
+
+const ctx = (over: Record<string, unknown> = {}) =>
+  ({
+    profileId: 'wp_1',
+    supportConfig: {
+      categories: [
+        { inboxId: 'inbox_1', visible: true },
+        { inboxId: 'inbox_2', visible: false },
+        { inboxId: 'inbox_1', visible: true },
+      ],
+      ticketListScope: 'same_profile_allowed_inboxes',
+    },
+    ...over,
+  }) as never
+
+describe('ticket-scope helpers', () => {
+  it('filters hidden categories and dedupes inbox ids', () => {
+    expect(visibleWidgetSupportCategories(ctx())).toHaveLength(2)
+    expect(allowedWidgetSupportInboxIds(ctx())).toEqual(['inbox_1'])
+    expect(visibleWidgetSupportCategories(ctx({ supportConfig: {} }))).toEqual([])
+  })
+  it('defaults the list scope to requester_owned', () => {
+    expect(widgetTicketListScope(ctx({ supportConfig: {} }))).toBe('requester_owned')
+  })
+  it('list filters: empty for no profile / requester_owned, scoped otherwise', () => {
+    expect(widgetTicketListFilters(ctx({ profileId: null }))).toEqual({})
+    expect(
+      widgetTicketListFilters(ctx({ supportConfig: { ticketListScope: 'requester_owned' } }))
+    ).toEqual({})
+    expect(widgetTicketListFilters(ctx())).toMatchObject({
+      sourceWidgetProfileId: 'wp_1',
+      allowedInboxIds: ['inbox_1'],
+    })
+  })
+})
+
+describe('assertTicketMatchesWidgetContext', () => {
+  const ticket = (over: Record<string, unknown> = {}) =>
+    ({ id: 't1', sourceWidgetProfileId: 'wp_1', inboxId: 'inbox_1', ...over }) as never
+  it('passes for no-profile and requester_owned scopes', () => {
+    expect(() => assertTicketMatchesWidgetContext(ticket(), ctx({ profileId: null }))).not.toThrow()
+    expect(() =>
+      assertTicketMatchesWidgetContext(
+        ticket(),
+        ctx({ supportConfig: { ticketListScope: 'requester_owned' } })
+      )
+    ).not.toThrow()
+  })
+  it('throws when the ticket is from a different profile', () => {
+    expect(() =>
+      assertTicketMatchesWidgetContext(ticket({ sourceWidgetProfileId: 'other' }), ctx())
+    ).toThrow('not found')
+  })
+  it('throws when the ticket inbox is outside the allowed set', () => {
+    expect(() => assertTicketMatchesWidgetContext(ticket({ inboxId: 'inbox_9' }), ctx())).toThrow(
+      'not found'
+    )
+  })
+  it('passes for a matching profile + allowed inbox', () => {
+    expect(() => assertTicketMatchesWidgetContext(ticket(), ctx())).not.toThrow()
+  })
+})
diff --git a/apps/web/src/lib/server/widget/__tests__/ticketing-gate.gap.test.ts b/apps/web/src/lib/server/widget/__tests__/ticketing-gate.gap.test.ts
new file mode 100644
index 000000000..9ab2c20aa
--- /dev/null
+++ b/apps/web/src/lib/server/widget/__tests__/ticketing-gate.gap.test.ts
@@ -0,0 +1,32 @@
+/**
+ * Differential-coverage tests for the widget ticketing gate — the enabled
+ * pass-through (null) vs the disabled 404 envelope.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({ getWidgetConfig: vi.fn() }))
+vi.mock('@/lib/server/domains/settings/settings.widget', () => ({
+  getWidgetConfig: (...a: unknown[]) => m.getWidgetConfig(...a),
+}))
+vi.mock('../cors', () => ({
+  widgetJsonError: (code: string, message: string, status: number) =>
+    Response.json({ error: { code, message } }, { status }),
+}))
+
+import { widgetTicketingGate } from '../ticketing-gate'
+
+beforeEach(() => vi.clearAllMocks())
+
+describe('widgetTicketingGate', () => {
+  it('returns null when ticketing is enabled', async () => {
+    m.getWidgetConfig.mockResolvedValueOnce({ ticketing: { enabled: true } })
+    expect(await widgetTicketingGate()).toBeNull()
+  })
+  it('returns a 404 envelope when ticketing is disabled or absent', async () => {
+    m.getWidgetConfig.mockResolvedValueOnce({ ticketing: { enabled: false } })
+    const res = await widgetTicketingGate()
+    expect(res?.status).toBe(404)
+    m.getWidgetConfig.mockResolvedValueOnce({})
+    expect((await widgetTicketingGate())?.status).toBe(404)
+  })
+})
diff --git a/apps/web/src/lib/server/widget/ticket-scope.ts b/apps/web/src/lib/server/widget/ticket-scope.ts
new file mode 100644
index 000000000..281b61ef3
--- /dev/null
+++ b/apps/web/src/lib/server/widget/ticket-scope.ts
@@ -0,0 +1,61 @@
+import type { Ticket, WidgetProfileSupportCategory } from '@/lib/server/db'
+import { NotFoundError } from '@/lib/shared/errors'
+import type { WidgetRequestContext } from './context'
+import type { InboxId, WidgetProfileId } from '@quackback/ids'
+
+export function visibleWidgetSupportCategories(
+  context: WidgetRequestContext
+): WidgetProfileSupportCategory[] {
+  return (context.supportConfig.categories ?? []).filter((category) => category.visible !== false)
+}
+
+export function allowedWidgetSupportInboxIds(context: WidgetRequestContext): InboxId[] {
+  return Array.from(
+    new Set(visibleWidgetSupportCategories(context).map((category) => category.inboxId))
+  ) as InboxId[]
+}
+
+export function widgetTicketListScope(context: WidgetRequestContext) {
+  return context.supportConfig.ticketListScope ?? 'requester_owned'
+}
+
+export function widgetTicketListFilters(context: WidgetRequestContext): {
+  sourceWidgetProfileId?: WidgetProfileId
+  allowedInboxIds?: InboxId[]
+} {
+  if (!context.profileId) {
+    return {}
+  }
+
+  const scope = widgetTicketListScope(context)
+  if (scope === 'requester_owned') {
+    return {}
+  }
+
+  return {
+    sourceWidgetProfileId: context.profileId as WidgetProfileId,
+    allowedInboxIds: allowedWidgetSupportInboxIds(context),
+  }
+}
+
+export function assertTicketMatchesWidgetContext(
+  ticket: Ticket,
+  context: WidgetRequestContext
+): void {
+  if (!context.profileId) return
+
+  const scope = widgetTicketListScope(context)
+  if (scope === 'requester_owned') return
+
+  if (
+    scope === 'same_profile_allowed_inboxes' &&
+    ticket.sourceWidgetProfileId !== context.profileId
+  ) {
+    throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticket.id} not found`)
+  }
+
+  const inboxIds = allowedWidgetSupportInboxIds(context)
+  if (inboxIds.length === 0 || !ticket.inboxId || !inboxIds.includes(ticket.inboxId as InboxId)) {
+    throw new NotFoundError('TICKET_NOT_FOUND', `ticket ${ticket.id} not found`)
+  }
+}
diff --git a/apps/web/src/lib/server/widget/ticketing-gate.ts b/apps/web/src/lib/server/widget/ticketing-gate.ts
new file mode 100644
index 000000000..9f6b2a2ac
--- /dev/null
+++ b/apps/web/src/lib/server/widget/ticketing-gate.ts
@@ -0,0 +1,15 @@
+/**
+ * Workspace-level gate for the widget ticketing surface. Returns a 404 envelope
+ * Response when `widgetConfig.ticketing.enabled !== true`, otherwise null.
+ *
+ * 404 (not 403) so disabled workspaces look like "this surface doesn't exist
+ * here" — symmetric with the iframe simply not rendering the entry card.
+ */
+import { getWidgetConfig } from '@/lib/server/domains/settings/settings.widget'
+import { widgetJsonError } from './cors'
+
+export async function widgetTicketingGate(): Promise<Response | null> {
+  const config = await getWidgetConfig()
+  if (config.ticketing?.enabled === true) return null
+  return widgetJsonError('NOT_FOUND', 'Ticketing is not enabled for this workspace', 404)
+}
diff --git a/apps/web/src/lib/shared/db-types.ts b/apps/web/src/lib/shared/db-types.ts
index 5355bbea8..cb81e6ee2 100644
--- a/apps/web/src/lib/shared/db-types.ts
+++ b/apps/web/src/lib/shared/db-types.ts
@@ -23,6 +23,7 @@ export {
   DEFAULT_BOARD_ACCESS,
   MODERATION_RULE_VALUES,
   CONVERSATION_STATUSES,
+  CONVERSATION_PRIORITIES,
   CONVERSATION_END_REASONS,
 } from '@quackback/db/types'
 export type {
diff --git a/apps/web/src/lib/shared/schemas/roles.ts b/apps/web/src/lib/shared/schemas/roles.ts
new file mode 100644
index 000000000..4d9766220
--- /dev/null
+++ b/apps/web/src/lib/shared/schemas/roles.ts
@@ -0,0 +1,30 @@
+/**
+ * Shared validation schemas for RBAC roles & assignments (REST + MCP).
+ * Mirrors the role.service input types. permissionKeys are validated against the
+ * live catalogue inside the service, so a loose string array is sufficient here.
+ */
+import { z } from 'zod'
+
+export const createRoleSchema = z.object({
+  key: z.string().min(1).max(64),
+  name: z.string().min(1).max(200),
+  description: z.string().max(1000).nullable().optional(),
+  permissionKeys: z.array(z.string()).max(200).default([]),
+})
+
+export const updateRoleSchema = z.object({
+  name: z.string().min(1).max(200),
+  description: z.string().max(1000).nullable().optional(),
+})
+
+export const setRolePermissionsSchema = z.object({
+  permissionKeys: z.array(z.string()).max(200),
+})
+
+export const assignRoleSchema = z.object({
+  roleId: z.string().min(1),
+  teamId: z.string().nullable().optional(),
+})
+
+export type CreateRoleSchemaInput = z.infer<typeof createRoleSchema>
+export type UpdateRoleSchemaInput = z.infer<typeof updateRoleSchema>
diff --git a/apps/web/src/lib/shared/schemas/teams.ts b/apps/web/src/lib/shared/schemas/teams.ts
new file mode 100644
index 000000000..7882ca16e
--- /dev/null
+++ b/apps/web/src/lib/shared/schemas/teams.ts
@@ -0,0 +1,32 @@
+/**
+ * Shared validation schemas for teams (REST + MCP).
+ * Mirrors CreateTeamInput / UpdateTeamInput (domains/teams/team.service.ts).
+ */
+import { z } from 'zod'
+
+export const TEAM_ROLES = ['lead', 'member'] as const
+
+export const createTeamSchema = z.object({
+  slug: z
+    .string()
+    .regex(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/, 'lowercase alphanumeric/dashes, 1–64 chars'),
+  name: z.string().min(1).max(200),
+  description: z.string().max(1000).nullable().optional(),
+  shortLabel: z.string().max(40).nullable().optional(),
+  color: z.string().max(16).nullable().optional(),
+})
+
+export const updateTeamSchema = z.object({
+  name: z.string().min(1).max(200).optional(),
+  description: z.string().max(1000).nullable().optional(),
+  shortLabel: z.string().max(40).nullable().optional(),
+  color: z.string().max(16).nullable().optional(),
+})
+
+export const addTeamMemberSchema = z.object({
+  principalId: z.string().min(1),
+  role: z.enum(TEAM_ROLES).optional(),
+})
+
+export type CreateTeamSchemaInput = z.infer<typeof createTeamSchema>
+export type UpdateTeamSchemaInput = z.infer<typeof updateTeamSchema>
diff --git a/apps/web/src/lib/shared/webhook-events.ts b/apps/web/src/lib/shared/webhook-events.ts
index 65fa5a93f..5a178fd6f 100644
--- a/apps/web/src/lib/shared/webhook-events.ts
+++ b/apps/web/src/lib/shared/webhook-events.ts
@@ -6,10 +6,12 @@
 export {
   WEBHOOK_EVENTS,
   WEBHOOK_EVENT_CONFIG,
+  WEBHOOK_EVENT_CATEGORIES,
   isValidWebhookUrl,
 } from '@/lib/server/events/integrations/webhook/constants'
 export type {
   WebhookEventType,
+  WebhookEventCategory,
   WebhookTarget,
   WebhookConfig,
 } from '@/lib/server/events/integrations/webhook/constants'
diff --git a/apps/web/src/locales/ar.json b/apps/web/src/locales/ar.json
index 2d2c63d62..1e787630a 100644
--- a/apps/web/src/locales/ar.json
+++ b/apps/web/src/locales/ar.json
@@ -1,6 +1,50 @@
 {
+  "portal.changelog.description": "ابقَ على اطلاع بآخر تحديثات المنتج والميزات المُطلقة.",
+  "portal.changelog.entryNotFound.backLink": "آخر المستجدات",
+  "portal.changelog.entryNotFound.description": "ربما تمت إزالة هذا الإدخال أو لم يُنشر بعد.",
+  "portal.changelog.entryNotFound.title": "الإدخال غير موجود",
+  "portal.changelog.rssFeed": "خلاصة RSS",
+  "portal.changelog.title": "آخر المستجدات",
+  "portal.commentForm.authorFallback": "مجهول",
+  "portal.commentForm.cancel": "إلغاء",
+  "portal.commentForm.clearStatusChange": "إلغاء تغيير الحالة",
+  "portal.commentForm.errorPost": "فشل نشر التعليق",
+  "portal.commentForm.labelSrOnly": "تعليقك",
+  "portal.commentForm.noStatus": "بدون حالة",
+  "portal.commentForm.placeholder": "اكتب تعليقًا...",
+  "portal.commentForm.postingAnonymously": "تعلّق بشكل مجهول",
+  "portal.commentForm.postingAs": "تعلّق باسم {name}",
+  "portal.commentForm.private": "خاص",
+  "portal.commentForm.privateLockedTooltip": "الردود على التعليقات الخاصة تكون دائمًا خاصة",
+  "portal.commentForm.privateOffTooltip": "اجعل هذا التعليق خاصًا (للفريق فقط)",
+  "portal.commentForm.privateOnTooltip": "مرئي لأعضاء الفريق فقط",
+  "portal.commentForm.reply": "رد",
+  "portal.commentForm.signOut": "تسجيل الخروج",
+  "portal.commentForm.submit": "تعليق",
+  "portal.commentForm.submitWithStatus": "تعليق وتحديد {statusName}",
+  "portal.commentForm.submitting": "جارٍ النشر...",
+  "portal.commentForm.updateStatus": "تحديث الحالة",
+  "portal.commentThread.authorAlt": "كاتب التعليق",
+  "portal.commentThread.authorFallback": "مجهول",
+  "portal.commentThread.changedStatusTo": "غيّر الحالة إلى",
+  "portal.commentThread.delete": "حذف",
+  "portal.commentThread.deleted": "[محذوف]",
+  "portal.commentThread.deleting": "جارٍ الحذف...",
+  "portal.commentThread.empty": "لا توجد تعليقات بعد. كن أول من يشارك رأيه!",
+  "portal.commentThread.internalNote": "ملاحظة داخلية",
+  "portal.commentThread.internalNoteHint": "مرئية لفريقك فقط",
+  "portal.commentThread.pin": "تثبيت",
+  "portal.commentThread.pinnedBadge": "مثبّت",
+  "portal.commentThread.removed": "[مُزال]",
+  "portal.commentThread.reply": "رد",
+  "portal.commentThread.restore": "استعادة",
+  "portal.commentThread.restoring": "جارٍ الاستعادة...",
+  "portal.commentThread.signIn": "تسجيل الدخول",
+  "portal.commentThread.signInToComment": "سجّل الدخول للتعليق",
+  "portal.commentThread.teamBadge": "الفريق",
+  "portal.commentThread.unpin": "إلغاء التثبيت",
   "widget.shell.heading.feedback": "شاركنا أفكارك",
-  "widget.shell.heading.help": "المساعدة والدعم",
+  "widget.shell.heading.help": "مركز المساعدة",
   "widget.shell.heading.changelog": "آخر المستجدات",
   "widget.shell.tab.feedback": "الملاحظات",
   "widget.shell.tab.changelog": "المستجدات",
@@ -111,209 +155,231 @@
   "portal.header.theme.dark": "داكن",
   "portal.feedback.empty.comingSoonTitle": "قريبًا",
   "portal.feedback.empty.comingSoonDescription": "يقوم {orgName} بإعداد بوابة الملاحظات الخاصة به. عد قريبًا لمشاركة أفكارك واقتراحاتك.",
-  "portal.feedback.list.noPostsFiltered": "لا توجد منشورات تطابق الفلاتر المحددة.",
-  "portal.feedback.list.noPostsYet": "لا توجد منشورات بعد.",
-  "portal.feedback.header.postingTo": "تنشر في",
-  "portal.feedback.header.selectBoard": "اختر فئة",
-  "portal.feedback.header.titlePlaceholder": "ما هي فكرتك؟",
-  "portal.feedback.header.detailsPlaceholder": "أضف مزيدًا من التفاصيل... اكتب / للأوامر",
-  "portal.feedback.header.postingAs": "تنشر باسم",
-  "portal.feedback.header.signOut": "تسجيل الخروج",
-  "portal.feedback.header.postingAnonymously": "تنشر بشكل مجهول",
-  "portal.feedback.header.signInToPost": "سجّل الدخول للنشر",
+  "portal.feedback.filter.addFilter": "إضافة فلتر",
+  "portal.feedback.filter.back": "رجوع",
+  "portal.feedback.filter.category.board": "اللوحة",
+  "portal.feedback.filter.category.date": "تاريخ الإنشاء",
+  "portal.feedback.filter.category.response": "رد الفريق",
+  "portal.feedback.filter.category.status": "الحالة",
+  "portal.feedback.filter.category.tag": "الوسم",
+  "portal.feedback.filter.category.votes": "عدد الأصوات",
+  "portal.feedback.filter.chip.board": "اللوحة:",
+  "portal.feedback.filter.chip.date": "التاريخ:",
+  "portal.feedback.filter.chip.response": "رد الفريق:",
+  "portal.feedback.filter.chip.status": "الحالة:",
+  "portal.feedback.filter.chip.tag": "الوسم:",
+  "portal.feedback.filter.chip.tags": "الوسوم:",
+  "portal.feedback.filter.chip.votes": "الحد الأدنى للأصوات:",
+  "portal.feedback.filter.clearAll": "مسح الكل",
+  "portal.feedback.filter.statusGroup.active": "نشط",
+  "portal.feedback.filter.statusGroup.closed": "مغلق",
+  "portal.feedback.filter.statusGroup.complete": "مكتمل",
   "portal.feedback.header.cancel": "إلغاء",
-  "portal.feedback.header.submit": "إرسال",
-  "portal.feedback.header.submitting": "جارٍ الإرسال...",
-  "portal.feedback.header.errorSelectBoard": "يرجى اختيار فئة",
+  "portal.feedback.header.detailsPlaceholder": "أضف مزيدًا من التفاصيل... اكتب / للأوامر",
   "portal.feedback.header.errorAddTitle": "يرجى إضافة عنوان",
-  "portal.feedback.header.errorSignIn": "يرجى تسجيل الدخول لإرسال الملاحظات",
+  "portal.feedback.header.errorSelectBoard": "يرجى اختيار فئة",
   "portal.feedback.header.errorSession": "فشل إنشاء الجلسة",
+  "portal.feedback.header.errorSignIn": "يرجى تسجيل الدخول لإرسال الملاحظات",
   "portal.feedback.header.errorSubmit": "فشل إرسال الملاحظات",
+  "portal.feedback.header.postingAnonymously": "تنشر بشكل مجهول",
+  "portal.feedback.header.postingAs": "تنشر باسم",
+  "portal.feedback.header.postingTo": "تنشر في",
+  "portal.feedback.header.selectBoard": "اختر فئة",
+  "portal.feedback.header.signInToPost": "سجّل الدخول للنشر",
+  "portal.feedback.header.signOut": "تسجيل الخروج",
+  "portal.feedback.header.submit": "إرسال",
   "portal.feedback.header.submitTooltipSignIn": "يرجى تسجيل الدخول لإرسال الملاحظات",
+  "portal.feedback.header.submitting": "جارٍ الإرسال...",
+  "portal.feedback.header.titlePlaceholder": "ما هي فكرتك؟",
   "portal.feedback.header.toastSubmitted": "تم إرسال الملاحظات",
   "portal.feedback.header.toastView": "عرض",
-  "portal.feedback.toolbar.sortTop": "الأعلى",
-  "portal.feedback.toolbar.sortNew": "الأحدث",
-  "portal.feedback.toolbar.sortTrending": "الرائج",
-  "portal.feedback.toolbar.search": "بحث",
-  "portal.feedback.toolbar.searchPlaceholder": "ابحث في المنشورات...",
-  "portal.feedback.toolbar.searchSubmit": "بحث",
-  "portal.feedback.toolbar.clearSearch": "مسح البحث",
-  "portal.feedback.filter.clearAll": "مسح الكل",
+  "portal.feedback.list.noPostsFiltered": "لا توجد منشورات تطابق الفلاتر المحددة.",
+  "portal.feedback.list.noPostsYet": "لا توجد منشورات بعد.",
   "portal.feedback.sidebar.boards": "الفئات",
-  "portal.feedback.sidebar.viewAllPosts": "عرض جميع المنشورات",
   "portal.feedback.sidebar.poweredBy": "مدعوم بواسطة {brand}",
+  "portal.feedback.sidebar.viewAllPosts": "عرض جميع المنشورات",
   "portal.feedback.similarPosts.heading": "أفكار مشابهة",
+  "portal.feedback.toolbar.clearSearch": "مسح البحث",
+  "portal.feedback.toolbar.filter": "تصفية",
+  "portal.feedback.toolbar.search": "بحث",
+  "portal.feedback.toolbar.searchPlaceholder": "ابحث في المنشورات...",
+  "portal.feedback.toolbar.searchSubmit": "بحث",
+  "portal.feedback.toolbar.sortNew": "الأحدث",
+  "portal.feedback.toolbar.sortTop": "الأعلى",
+  "portal.feedback.toolbar.sortTrending": "الرائج",
+  "portal.help.articleNotFound.backLink": "مركز المساعدة",
+  "portal.help.articleNotFound.description": "ربما تمت إزالة هذه المقالة أو لم تُنشر بعد.",
+  "portal.help.articleNotFound.title": "المقالة غير موجودة",
+  "portal.help.categoryNotFound.backLink": "مركز المساعدة",
+  "portal.help.categoryNotFound.description": "ربما تمت إزالة هذه الفئة أو أنها غير موجودة.",
+  "portal.help.categoryNotFound.title": "الفئة غير موجودة",
+  "portal.help.description": "ابحث عن إجابات لأسئلتك وتعلّم كيفية الاستفادة القصوى من منتجنا.",
+  "portal.help.title": "مركز المساعدة",
+  "portal.notifications.empty.description": "صوّت أو علّق على المنشورات للاشتراك. ستتلقى إشعارات عند تغيّر الحالة أو وجود نشاط جديد.",
+  "portal.notifications.empty.title": "أنت على اطلاع بكل جديد!",
+  "portal.notifications.groupEarlier": "سابقًا",
+  "portal.notifications.groupToday": "اليوم",
+  "portal.notifications.groupYesterday": "أمس",
+  "portal.notifications.markAllRead": "تحديد الكل كمقروء",
+  "portal.notifications.readAll": "قراءة الكل",
+  "portal.notifications.subtitle": "تحديثات حول المنشورات التي اشتركت فيها",
+  "portal.notifications.title": "الإشعارات",
+  "portal.pinnedComment.pinnedBadge": "مثبّت",
+  "portal.postCard.authorFallback": "مجهول",
+  "portal.postCard.deleteNotAllowed": "الحذف غير مسموح",
+  "portal.postCard.editNotAllowed": "التعديل غير مسموح",
+  "portal.postCard.quickActions.copyLink": "نسخ الرابط",
+  "portal.postCard.quickActions.delete": "حذف",
+  "portal.postCard.quickActions.edit": "تعديل",
+  "portal.postCard.quickActions.options": "خيارات المنشور",
+  "portal.postCard.quickActions.viewInPortal": "عرض في البوابة",
+  "portal.postCard.toast.linkCopied": "تم نسخ الرابط إلى الحافظة",
+  "portal.postCard.toast.linkCopyFailed": "فشل نسخ الرابط",
+  "portal.postCard.vote.ariaRemoveVote": "إزالة التصويت ({count, plural, zero {لا أصوات} one {صوت واحد} two {صوتان} few {# أصوات} many {# صوتًا} other {# صوت}})",
+  "portal.postCard.vote.ariaVote": "التصويت لهذا المنشور ({count, plural, zero {لا أصوات} one {صوت واحد} two {صوتان} few {# أصوات} many {# صوتًا} other {# صوت}})",
   "portal.postDetail.comments": "{count, plural, zero {لا تعليقات} one {تعليق واحد} two {تعليقان} few {# تعليقات} many {# تعليقًا} other {# تعليق}}",
-  "portal.postDetail.postActions.ariaLabel": "إجراءات المنشور",
-  "portal.postDetail.postActions.edit": "تعديل",
-  "portal.postDetail.postActions.delete": "حذف",
-  "portal.postDetail.edit.titlePlaceholder": "ما هي فكرتك؟",
-  "portal.postDetail.edit.detailsPlaceholder": "أضف مزيدًا من التفاصيل... اكتب / للأوامر",
+  "portal.postDetail.commentsLocked": "التعليقات مغلقة على هذا المنشور",
+  "portal.postDetail.deleteDialog.confirmLabel": "حذف المنشور",
+  "portal.postDetail.deleteDialog.deleting": "جارٍ الحذف...",
+  "portal.postDetail.deleteDialog.description": "هل أنت متأكد أنك تريد حذف «{title}»؟ لا يمكن التراجع عن هذا الإجراء.",
+  "portal.postDetail.deleteDialog.errorLinks": "فشل تحميل عمليات التكامل المرتبطة. يرجى الإغلاق والمحاولة مرة أخرى.",
+  "portal.postDetail.deleteDialog.loading": "جارٍ التحميل...",
+  "portal.postDetail.deleteDialog.title": "حذف المنشور",
   "portal.postDetail.edit.cancel": "إلغاء",
+  "portal.postDetail.edit.detailsPlaceholder": "أضف مزيدًا من التفاصيل... اكتب / للأوامر",
   "portal.postDetail.edit.save": "حفظ",
   "portal.postDetail.edit.saving": "جارٍ الحفظ...",
-  "portal.postDetail.related": "ذو صلة",
+  "portal.postDetail.edit.titlePlaceholder": "ما هي فكرتك؟",
   "portal.postDetail.mergeBanner.mergedInto": "تم دمج هذه الملاحظات في",
   "portal.postDetail.mergeBanner.votesCount": "الأصوات والنشاط تُحتسب الآن للعنصر المرتبط.",
-  "portal.postDetail.metadata.upvotes": "التصويتات",
-  "portal.postDetail.metadata.status": "الحالة",
+  "portal.postDetail.metadata.author": "الكاتب",
+  "portal.postDetail.metadata.authorFallback": "مجهول",
   "portal.postDetail.metadata.board": "الفئة",
-  "portal.postDetail.metadata.tags": "الوسوم",
-  "portal.postDetail.metadata.tagAdd": "إضافة",
+  "portal.postDetail.metadata.date": "التاريخ",
+  "portal.postDetail.metadata.deletePost": "حذف المنشور",
+  "portal.postDetail.metadata.lockComments": "قفل التعليقات",
+  "portal.postDetail.metadata.manage": "إدارة",
+  "portal.postDetail.metadata.managePost": "إدارة المنشور",
+  "portal.postDetail.metadata.merge": "دمج",
+  "portal.postDetail.metadata.mergeIntoAnother": "دمج في منشور آخر...",
+  "portal.postDetail.metadata.mergeIntoThis": "دمج في هذا المنشور",
+  "portal.postDetail.metadata.restorePost": "استعادة المنشور",
   "portal.postDetail.metadata.roadmap": "خارطة الطريق",
   "portal.postDetail.metadata.roadmapAdd": "إضافة",
-  "portal.postDetail.metadata.date": "التاريخ",
   "portal.postDetail.metadata.source": "المصدر",
+  "portal.postDetail.metadata.sourceOpenIn": "فتح في {name}",
   "portal.postDetail.metadata.sourceOriginalFeedback": "الملاحظات الأصلية",
   "portal.postDetail.metadata.sourceUnknownAuthor": "كاتب مجهول",
-  "portal.postDetail.metadata.sourceOpenIn": "فتح في {name}",
-  "portal.postDetail.metadata.author": "الكاتب",
-  "portal.postDetail.metadata.authorFallback": "مجهول",
+  "portal.postDetail.metadata.status": "الحالة",
   "portal.postDetail.metadata.subscribe": "اشتراك",
   "portal.postDetail.metadata.subscribeHint": "احصل على إشعارات عند وجود تحديثات على هذا المنشور",
-  "portal.postDetail.metadata.manage": "إدارة",
-  "portal.postDetail.metadata.managePost": "إدارة المنشور",
-  "portal.postDetail.metadata.merge": "دمج",
-  "portal.postDetail.metadata.mergeIntoThis": "دمج في هذا المنشور",
-  "portal.postDetail.metadata.mergeIntoAnother": "دمج في منشور آخر...",
-  "portal.postDetail.metadata.lockComments": "قفل التعليقات",
+  "portal.postDetail.metadata.tagAdd": "إضافة",
+  "portal.postDetail.metadata.tags": "الوسوم",
   "portal.postDetail.metadata.unlockComments": "فتح التعليقات",
-  "portal.postDetail.metadata.restorePost": "استعادة المنشور",
-  "portal.postDetail.metadata.deletePost": "حذف المنشور",
-  "portal.postDetail.deleteDialog.title": "حذف المنشور",
-  "portal.postDetail.deleteDialog.description": "هل أنت متأكد أنك تريد حذف «{title}»؟ لا يمكن التراجع عن هذا الإجراء.",
-  "portal.postDetail.deleteDialog.confirmLabel": "حذف المنشور",
-  "portal.postDetail.deleteDialog.deleting": "جارٍ الحذف...",
-  "portal.postDetail.deleteDialog.loading": "جارٍ التحميل...",
-  "portal.postDetail.deleteDialog.errorLinks": "فشل تحميل عمليات التكامل المرتبطة. يرجى الإغلاق والمحاولة مرة أخرى.",
+  "portal.postDetail.metadata.upvotes": "التصويتات",
   "portal.postDetail.notFound": "المنشور غير موجود",
-  "portal.postDetail.commentsLocked": "التعليقات مغلقة على هذا المنشور",
-  "portal.changelog.title": "آخر المستجدات",
-  "portal.changelog.description": "ابقَ على اطلاع بآخر تحديثات المنتج والميزات المُطلقة.",
-  "portal.changelog.rssFeed": "خلاصة RSS",
+  "portal.postDetail.postActions.ariaLabel": "إجراءات المنشور",
+  "portal.postDetail.postActions.delete": "حذف",
+  "portal.postDetail.postActions.edit": "تعديل",
+  "portal.postDetail.related": "ذو صلة",
   "portal.changelog.loading": "جارٍ تحميل المستجدات...",
   "portal.changelog.loadMore": "تحميل المزيد",
   "portal.changelog.loadingMore": "جارٍ التحميل...",
   "portal.changelog.empty.title": "لا توجد تحديثات بعد",
   "portal.changelog.empty.description": "عد قريبًا للاطلاع على آخر تحديثات المنتج والميزات الجديدة.",
-  "portal.changelog.entryNotFound.title": "الإدخال غير موجود",
-  "portal.changelog.entryNotFound.description": "ربما تمت إزالة هذا الإدخال أو لم يُنشر بعد.",
-  "portal.changelog.entryNotFound.backLink": "آخر المستجدات",
   "portal.roadmap.title": "خارطة الطريق",
   "portal.roadmap.description": "اطّلع على ما نعمل عليه وما هو قادم.",
   "portal.roadmap.empty.title": "لا توجد خارطة طريق متاحة",
   "portal.roadmap.empty.description": "عد لاحقًا لمعرفة ما نعمل عليه.",
   "portal.roadmap.column.empty": "لا توجد عناصر بعد",
-  "portal.help.title": "مركز المساعدة",
-  "portal.help.description": "ابحث عن إجابات لأسئلتك وتعلّم كيفية الاستفادة القصوى من منتجنا.",
-  "portal.help.categoryNotFound.title": "الفئة غير موجودة",
-  "portal.help.categoryNotFound.description": "ربما تمت إزالة هذه الفئة أو أنها غير موجودة.",
-  "portal.help.categoryNotFound.backLink": "مركز المساعدة",
-  "portal.help.articleNotFound.title": "المقالة غير موجودة",
-  "portal.help.articleNotFound.description": "ربما تمت إزالة هذه المقالة أو لم تُنشر بعد.",
-  "portal.help.articleNotFound.backLink": "مركز المساعدة",
-  "portal.notifications.title": "الإشعارات",
-  "portal.notifications.subtitle": "تحديثات حول المنشورات التي اشتركت فيها",
-  "portal.notifications.markAllRead": "تحديد الكل كمقروء",
-  "portal.notifications.readAll": "قراءة الكل",
-  "portal.notifications.groupToday": "اليوم",
-  "portal.notifications.groupYesterday": "أمس",
-  "portal.notifications.groupEarlier": "سابقًا",
-  "portal.notifications.empty.title": "أنت على اطلاع بكل جديد!",
-  "portal.notifications.empty.description": "صوّت أو علّق على المنشورات للاشتراك. ستتلقى إشعارات عند تغيّر الحالة أو وجود نشاط جديد.",
-  "portal.settings.profile.title": "الملف الشخصي",
-  "portal.settings.profile.description": "إدارة معلوماتك الشخصية",
-  "portal.settings.preferences.title": "التفضيلات",
-  "portal.settings.preferences.description": "خصّص تجربتك",
-  "portal.settings.preferences.appearance.title": "المظهر",
   "portal.settings.preferences.appearance.description": "خصّص مظهر التطبيق",
   "portal.settings.preferences.appearance.themeLabel": "المظهر",
-  "portal.settings.preferences.notifications.title": "إشعارات البريد الإلكتروني",
+  "portal.settings.preferences.appearance.title": "المظهر",
+  "portal.settings.preferences.description": "خصّص تجربتك",
   "portal.settings.preferences.notifications.description": "إدارة إشعارات البريد الإلكتروني للمنشورات التي اشتركت فيها",
+  "portal.settings.preferences.notifications.title": "إشعارات البريد الإلكتروني",
+  "portal.settings.preferences.title": "التفضيلات",
+  "portal.settings.profile.description": "إدارة معلوماتك الشخصية",
+  "portal.settings.profile.title": "الملف الشخصي",
   "portal.subscriptionBell.aria.subscribe": "الاشتراك في الإشعارات",
-  "portal.subscriptionBell.aria.subscribedStatusOnly": "مشترك في تغييرات الحالة فقط",
   "portal.subscriptionBell.aria.subscribedAll": "مشترك في جميع الأنشطة",
-  "portal.subscriptionBell.menu.title": "الإشعارات",
-  "portal.subscriptionBell.menu.subtitle": "اختر ما تريد الاشتراك فيه",
+  "portal.subscriptionBell.aria.subscribedStatusOnly": "مشترك في تغييرات الحالة فقط",
   "portal.subscriptionBell.level.all": "جميع الأنشطة",
   "portal.subscriptionBell.level.allHint": "التعليقات وتغييرات الحالة",
   "portal.subscriptionBell.level.statusOnly": "تغييرات الحالة",
   "portal.subscriptionBell.level.statusOnlyHint": "عند تحديث الحالة",
   "portal.subscriptionBell.level.unsubscribe": "إلغاء الاشتراك",
-  "portal.unsubscribeBanner.message": "تم إلغاء اشتراكك من هذا المنشور. استخدم أيقونة الجرس لإعادة الاشتراك.",
+  "portal.subscriptionBell.menu.subtitle": "اختر ما تريد الاشتراك فيه",
+  "portal.subscriptionBell.menu.title": "الإشعارات",
   "portal.unsubscribeBanner.dismiss": "إغلاق",
-  "portal.pinnedComment.pinnedBadge": "مثبّت",
-  "portal.postCard.authorFallback": "مجهول",
-  "portal.postCard.editNotAllowed": "التعديل غير مسموح",
-  "portal.postCard.deleteNotAllowed": "الحذف غير مسموح",
-  "portal.postCard.quickActions.viewInPortal": "عرض في البوابة",
-  "portal.postCard.quickActions.copyLink": "نسخ الرابط",
-  "portal.postCard.quickActions.edit": "تعديل",
-  "portal.postCard.quickActions.delete": "حذف",
-  "portal.postCard.quickActions.options": "خيارات المنشور",
-  "portal.postCard.vote.ariaVote": "التصويت لهذا المنشور ({count, plural, zero {لا أصوات} one {صوت واحد} two {صوتان} few {# أصوات} many {# صوتًا} other {# صوت}})",
-  "portal.postCard.vote.ariaRemoveVote": "إزالة التصويت ({count, plural, zero {لا أصوات} one {صوت واحد} two {صوتان} few {# أصوات} many {# صوتًا} other {# صوت}})",
-  "portal.postCard.toast.linkCopied": "تم نسخ الرابط إلى الحافظة",
-  "portal.postCard.toast.linkCopyFailed": "فشل نسخ الرابط",
-  "portal.commentThread.empty": "لا توجد تعليقات بعد. كن أول من يشارك رأيه!",
-  "portal.commentThread.signInToComment": "سجّل الدخول للتعليق",
-  "portal.commentThread.signIn": "تسجيل الدخول",
-  "portal.commentThread.deleted": "[محذوف]",
-  "portal.commentThread.removed": "[مُزال]",
-  "portal.commentThread.authorFallback": "مجهول",
-  "portal.commentThread.authorAlt": "كاتب التعليق",
-  "portal.commentThread.teamBadge": "الفريق",
-  "portal.commentThread.internalNote": "ملاحظة داخلية",
-  "portal.commentThread.internalNoteHint": "مرئية لفريقك فقط",
-  "portal.commentThread.pinnedBadge": "مثبّت",
-  "portal.commentThread.changedStatusTo": "غيّر الحالة إلى",
-  "portal.commentThread.reply": "رد",
-  "portal.commentThread.pin": "تثبيت",
-  "portal.commentThread.unpin": "إلغاء التثبيت",
-  "portal.commentThread.restore": "استعادة",
-  "portal.commentThread.restoring": "جارٍ الاستعادة...",
-  "portal.commentThread.delete": "حذف",
-  "portal.commentThread.deleting": "جارٍ الحذف...",
-  "portal.commentForm.labelSrOnly": "تعليقك",
-  "portal.commentForm.placeholder": "اكتب تعليقًا...",
-  "portal.commentForm.authorFallback": "مجهول",
-  "portal.commentForm.noStatus": "بدون حالة",
-  "portal.commentForm.updateStatus": "تحديث الحالة",
-  "portal.commentForm.clearStatusChange": "إلغاء تغيير الحالة",
-  "portal.commentForm.postingAnonymously": "تعلّق بشكل مجهول",
-  "portal.commentForm.postingAs": "تعلّق باسم {name}",
-  "portal.commentForm.signOut": "تسجيل الخروج",
-  "portal.commentForm.cancel": "إلغاء",
-  "portal.commentForm.private": "خاص",
-  "portal.commentForm.privateLockedTooltip": "الردود على التعليقات الخاصة تكون دائمًا خاصة",
-  "portal.commentForm.privateOnTooltip": "مرئي لأعضاء الفريق فقط",
-  "portal.commentForm.privateOffTooltip": "اجعل هذا التعليق خاصًا (للفريق فقط)",
-  "portal.commentForm.submit": "تعليق",
-  "portal.commentForm.submitWithStatus": "تعليق وتحديد {statusName}",
-  "portal.commentForm.reply": "رد",
-  "portal.commentForm.submitting": "جارٍ النشر...",
-  "portal.commentForm.errorPost": "فشل نشر التعليق",
-  "portal.feedback.filter.addFilter": "إضافة فلتر",
-  "portal.feedback.filter.back": "رجوع",
-  "portal.feedback.filter.category.board": "اللوحة",
-  "portal.feedback.filter.category.status": "الحالة",
-  "portal.feedback.filter.category.tag": "الوسم",
-  "portal.feedback.filter.category.votes": "عدد الأصوات",
-  "portal.feedback.filter.category.date": "تاريخ الإنشاء",
-  "portal.feedback.filter.category.response": "رد الفريق",
-  "portal.feedback.filter.statusGroup.active": "نشط",
-  "portal.feedback.filter.statusGroup.complete": "مكتمل",
-  "portal.feedback.filter.statusGroup.closed": "مغلق",
-  "portal.feedback.filter.chip.board": "اللوحة:",
-  "portal.feedback.filter.chip.status": "الحالة:",
-  "portal.feedback.filter.chip.tag": "الوسم:",
-  "portal.feedback.filter.chip.tags": "الوسوم:",
-  "portal.feedback.filter.chip.votes": "الحد الأدنى للأصوات:",
-  "portal.feedback.filter.chip.date": "التاريخ:",
-  "portal.feedback.filter.chip.response": "رد الفريق:",
+  "portal.unsubscribeBanner.message": "تم إلغاء اشتراكك من هذا المنشور. استخدم أيقونة الجرس لإعادة الاشتراك.",
+  "tickets.audience.internal": "Internal note",
+  "tickets.audience.public": "Public reply",
+  "tickets.audience.shared_team": "Shared with team",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "Email",
+  "tickets.channel.portal": "Portal",
+  "tickets.channel.widget": "Widget",
+  "tickets.notifications.assigned": "Assigned to you: {subject}",
+  "tickets.notifications.opened": "Ticket opened: {subject}",
+  "tickets.notifications.participantAdded": "Added to ticket: {subject}",
+  "tickets.notifications.participantRemoved": "Removed from ticket: {subject}",
+  "tickets.notifications.shared": "Ticket shared: {subject}",
+  "tickets.notifications.slaBreach": "SLA breached: {subject}",
+  "tickets.notifications.slaWarning": "SLA at risk: {subject}",
+  "tickets.notifications.statusChanged": "Status: {subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "New reply: {subject}",
+  "tickets.notifications.unassigned": "Unassigned: {subject}",
+  "tickets.notifications.unshared": "Ticket unshared: {subject}",
+  "tickets.priority.high": "High",
+  "tickets.priority.low": "Low",
+  "tickets.priority.normal": "Normal",
+  "tickets.priority.urgent": "Urgent",
+  "tickets.role.cc": "CC",
+  "tickets.role.collaborator": "Collaborator",
+  "tickets.role.watcher": "Watcher",
+  "tickets.scope.all": "All",
+  "tickets.scope.inbox": "Inbox",
+  "tickets.scope.my_assigned": "Assigned to me",
+  "tickets.scope.my_inbox": "My inbox",
+  "tickets.scope.my_team": "My team",
+  "tickets.scope.shared_with_me": "Shared with me",
+  "tickets.scope.unassigned": "Unassigned",
+  "tickets.share.comment": "Comment",
+  "tickets.share.full": "Full access",
+  "tickets.share.read": "Read",
+  "tickets.sla.kind.first_response": "First response",
+  "tickets.sla.kind.next_response": "Next response",
+  "tickets.sla.kind.resolution": "Resolution",
+  "tickets.sla.state.breached": "Breached",
+  "tickets.sla.state.cancelled": "Cancelled",
+  "tickets.sla.state.met": "Met",
+  "tickets.sla.state.paused": "Paused",
+  "tickets.sla.state.running": "Running",
+  "tickets.status.closed": "Closed",
+  "tickets.status.on_hold": "On hold",
+  "tickets.status.open": "Open",
+  "tickets.status.pending": "Pending",
+  "tickets.status.solved": "Solved",
+  "tickets.subscription.mute": "Mute",
+  "tickets.subscription.muted": "Muted",
+  "tickets.subscription.notify.assignment": "Assignment changes",
+  "tickets.subscription.notify.participants": "Participant changes",
+  "tickets.subscription.notify.shares": "Share grants",
+  "tickets.subscription.notify.sla": "SLA warnings & breaches",
+  "tickets.subscription.notify.status": "Status changes",
+  "tickets.subscription.notify.threads": "New replies",
+  "tickets.subscription.source.auto_assigned": "Auto (assignee)",
+  "tickets.subscription.source.auto_participant": "Auto (participant)",
+  "tickets.subscription.source.auto_team_member": "Auto (team member)",
+  "tickets.subscription.source.manual": "Manual",
+  "tickets.subscription.unmute": "Unmute",
+  "tickets.visibility.org": "Organization",
+  "tickets.visibility.private": "Private",
+  "tickets.visibility.shared": "Shared",
+  "tickets.visibility.team": "Team only",
   "widget.home.posting.selectBoard": "اختر فئة",
-  "portal.feedback.toolbar.filter": "تصفية",
   "portal.roadmap.toolbar.sortBy": "الترتيب حسب",
   "portal.roadmap.toolbar.sortVotes": "الأكثر تصويتًا",
   "portal.roadmap.toolbar.sortNewest": "الأحدث",
@@ -441,5 +507,60 @@
   "portal.hc.contactSupport.body": "ابدأ محادثة مع فريقنا وسنرد عليك.",
   "portal.hc.contactSupport.cta": "تواصل مع الدعم",
   "portal.hc.articleFeedback.stillStuck": "ما زلت عالقًا؟",
-  "portal.hc.articleFeedback.contactSupport": "تواصل مع الدعم"
+  "portal.hc.articleFeedback.contactSupport": "تواصل مع الدعم",
+  "portal.header.nav.tickets": "تذاكري",
+  "portal.tickets.title": "تذاكري",
+  "portal.tickets.subtitle": "التذاكر التي فتحتها أو تمت إضافتك إليها.",
+  "portal.tickets.empty.title": "لا توجد تذاكر بعد",
+  "portal.tickets.empty.description": "عندما يتعامل فريقنا مع طلب منك، سيظهر هنا.",
+  "portal.tickets.filter.all": "الكل",
+  "portal.tickets.filter.open": "مفتوحة",
+  "portal.tickets.filter.pending": "قيد الانتظار",
+  "portal.tickets.filter.solved": "تم حلها",
+  "portal.tickets.filter.closed": "مغلقة",
+  "portal.tickets.row.updated": "آخر تحديث {when}",
+  "portal.tickets.detail.back": "تذاكري",
+  "portal.tickets.detail.description": "الوصف",
+  "portal.tickets.detail.openedAt": "فُتحت {date}",
+  "portal.tickets.detail.lastUpdate": "آخر تحديث {when}",
+  "portal.tickets.detail.noReplies": "لا توجد ردود بعد.",
+  "portal.tickets.detail.supportTeam": "فريق الدعم",
+  "portal.tickets.detail.you": "أنت",
+  "portal.tickets.detail.edited": "تم التعديل",
+  "portal.tickets.composer.placeholder": "اكتب ردك…",
+  "portal.tickets.composer.send": "إرسال الرد",
+  "portal.tickets.composer.sending": "جارٍ الإرسال…",
+  "portal.tickets.composer.closed": "هذه التذكرة مغلقة. افتح تذكرة جديدة للمتابعة.",
+  "widget.support.card.title": "التواصل مع الدعم",
+  "widget.support.card.description": "احصل على المساعدة مباشرةً من فريقنا.",
+  "widget.support.card.cta": "فتح تذكرة",
+  "widget.support.composer.subjectPlaceholder": "الموضوع",
+  "widget.support.composer.bodyPlaceholder": "صِف مشكلتك...",
+  "widget.support.composer.namePlaceholder": "اسمك (اختياري)",
+  "widget.support.composer.emailPlaceholder": "بريدك الإلكتروني",
+  "widget.support.composer.priority.label": "الأولوية",
+  "widget.support.composer.priority.low": "منخفضة",
+  "widget.support.composer.priority.normal": "عادية",
+  "widget.support.composer.priority.high": "عالية",
+  "widget.support.composer.submit": "إرسال",
+  "widget.support.composer.submitting": "جارٍ الإرسال...",
+  "widget.support.composer.errorCreate": "تعذّر إنشاء التذكرة. يرجى المحاولة مرة أخرى.",
+  "widget.support.composer.errorEmail": "تعذّر التحقق من بريدك الإلكتروني. يرجى المحاولة مرة أخرى.",
+  "widget.support.list.heading": "تذاكرك",
+  "widget.support.list.newTicket": "تذكرة جديدة",
+  "widget.support.list.empty": "لم تفتح أي تذكرة بعد.",
+  "widget.support.list.emptyAnonymous": "سجّل الدخول لعرض تذاكرك.",
+  "widget.support.list.errorLoad": "تعذّر تحميل تذاكرك.",
+  "widget.support.detail.errorLoad": "تعذّر تحميل هذه التذكرة.",
+  "widget.support.detail.threadEmpty": "لا توجد ردود بعد.",
+  "widget.support.detail.youLabel": "أنت",
+  "widget.support.detail.replyPlaceholder": "اكتب ردك...",
+  "widget.support.detail.replySend": "رد",
+  "widget.support.detail.replySending": "جارٍ الإرسال...",
+  "widget.support.detail.errorReply": "تعذّر نشر ردك.",
+  "widget.support.detail.resolve": "وضع علامة كمحلولة",
+  "widget.support.detail.resolved": "تم الحل",
+  "widget.support.detail.errorResolve": "تعذّر وضع علامة على هذه التذكرة كمحلولة.",
+  "widget.support.detail.reopen": "إعادة فتح",
+  "widget.support.detail.errorReopen": "تعذّرت إعادة فتح هذه التذكرة."
 }
diff --git a/apps/web/src/locales/de.json b/apps/web/src/locales/de.json
index 4aaa8b91e..22bc425d6 100644
--- a/apps/web/src/locales/de.json
+++ b/apps/web/src/locales/de.json
@@ -1,6 +1,50 @@
 {
+  "portal.changelog.description": "Bleiben Sie auf dem Laufenden über die neuesten Produkt-Updates und veröffentlichten Funktionen.",
+  "portal.changelog.entryNotFound.backLink": "Neuigkeiten",
+  "portal.changelog.entryNotFound.description": "Dieser Eintrag wurde möglicherweise entfernt oder ist noch nicht veröffentlicht.",
+  "portal.changelog.entryNotFound.title": "Eintrag nicht gefunden",
+  "portal.changelog.rssFeed": "RSS-Feed",
+  "portal.changelog.title": "Neuigkeiten",
+  "portal.commentForm.authorFallback": "Anonym",
+  "portal.commentForm.cancel": "Abbrechen",
+  "portal.commentForm.clearStatusChange": "Statusänderung verwerfen",
+  "portal.commentForm.errorPost": "Kommentar konnte nicht veröffentlicht werden",
+  "portal.commentForm.labelSrOnly": "Ihr Kommentar",
+  "portal.commentForm.noStatus": "Kein Status",
+  "portal.commentForm.placeholder": "Kommentar schreiben...",
+  "portal.commentForm.postingAnonymously": "Sie kommentieren anonym",
+  "portal.commentForm.postingAs": "Sie kommentieren als {name}",
+  "portal.commentForm.private": "Privat",
+  "portal.commentForm.privateLockedTooltip": "Antworten auf private Kommentare sind immer privat",
+  "portal.commentForm.privateOffTooltip": "Diesen Kommentar als privat markieren (nur Team)",
+  "portal.commentForm.privateOnTooltip": "Nur für Teammitglieder sichtbar",
+  "portal.commentForm.reply": "Antworten",
+  "portal.commentForm.signOut": "abmelden",
+  "portal.commentForm.submit": "Kommentieren",
+  "portal.commentForm.submitWithStatus": "Kommentieren und als {statusName} markieren",
+  "portal.commentForm.submitting": "Wird gesendet...",
+  "portal.commentForm.updateStatus": "Status aktualisieren",
+  "portal.commentThread.authorAlt": "Autor(in) des Kommentars",
+  "portal.commentThread.authorFallback": "Anonym",
+  "portal.commentThread.changedStatusTo": "hat den Status geändert auf",
+  "portal.commentThread.delete": "Löschen",
+  "portal.commentThread.deleted": "[gelöscht]",
+  "portal.commentThread.deleting": "Wird gelöscht...",
+  "portal.commentThread.empty": "Noch keine Kommentare. Teilen Sie als Erste(r) Ihre Gedanken!",
+  "portal.commentThread.internalNote": "Interne Notiz",
+  "portal.commentThread.internalNoteHint": "nur für Ihr Team sichtbar",
+  "portal.commentThread.pin": "Anheften",
+  "portal.commentThread.pinnedBadge": "Angepinnt",
+  "portal.commentThread.removed": "[entfernt]",
+  "portal.commentThread.reply": "Antworten",
+  "portal.commentThread.restore": "Wiederherstellen",
+  "portal.commentThread.restoring": "Wird wiederhergestellt...",
+  "portal.commentThread.signIn": "Anmelden",
+  "portal.commentThread.signInToComment": "Melden Sie sich an, um zu kommentieren",
+  "portal.commentThread.teamBadge": "Team",
+  "portal.commentThread.unpin": "Loslösen",
   "widget.shell.heading.feedback": "Teilen Sie Ihre Ideen",
-  "widget.shell.heading.help": "Hilfe & Support",
+  "widget.shell.heading.help": "Hilfecenter",
   "widget.shell.heading.changelog": "Neuigkeiten",
   "widget.shell.tab.feedback": "Feedback",
   "widget.shell.tab.changelog": "Neuigkeiten",
@@ -111,209 +155,231 @@
   "portal.header.theme.dark": "Dunkel",
   "portal.feedback.empty.comingSoonTitle": "Demnächst verfügbar",
   "portal.feedback.empty.comingSoonDescription": "{orgName} richtet das Feedback-Portal ein. Schauen Sie bald wieder vorbei, um Ihre Ideen und Vorschläge zu teilen.",
-  "portal.feedback.list.noPostsFiltered": "Keine Beiträge entsprechen Ihren Filtern.",
-  "portal.feedback.list.noPostsYet": "Noch keine Beiträge vorhanden.",
-  "portal.feedback.header.postingTo": "Posten in",
-  "portal.feedback.header.selectBoard": "Kategorie auswählen",
-  "portal.feedback.header.titlePlaceholder": "Was ist Ihre Idee?",
-  "portal.feedback.header.detailsPlaceholder": "Weitere Details hinzufügen... / eingeben für Befehle",
-  "portal.feedback.header.postingAs": "Sie posten als",
-  "portal.feedback.header.signOut": "abmelden",
-  "portal.feedback.header.postingAnonymously": "Sie posten anonym",
-  "portal.feedback.header.signInToPost": "Melden Sie sich an, um zu posten",
+  "portal.feedback.filter.addFilter": "Filter hinzufügen",
+  "portal.feedback.filter.back": "Zurück",
+  "portal.feedback.filter.category.board": "Board",
+  "portal.feedback.filter.category.date": "Erstellungsdatum",
+  "portal.feedback.filter.category.response": "Team-Antwort",
+  "portal.feedback.filter.category.status": "Status",
+  "portal.feedback.filter.category.tag": "Tag",
+  "portal.feedback.filter.category.votes": "Stimmenanzahl",
+  "portal.feedback.filter.chip.board": "Board:",
+  "portal.feedback.filter.chip.date": "Datum:",
+  "portal.feedback.filter.chip.response": "Team-Antwort:",
+  "portal.feedback.filter.chip.status": "Status:",
+  "portal.feedback.filter.chip.tag": "Tag:",
+  "portal.feedback.filter.chip.tags": "Tags:",
+  "portal.feedback.filter.chip.votes": "Mindest-Stimmen:",
+  "portal.feedback.filter.clearAll": "Alle löschen",
+  "portal.feedback.filter.statusGroup.active": "Aktiv",
+  "portal.feedback.filter.statusGroup.closed": "Geschlossen",
+  "portal.feedback.filter.statusGroup.complete": "Abgeschlossen",
   "portal.feedback.header.cancel": "Abbrechen",
-  "portal.feedback.header.submit": "Absenden",
-  "portal.feedback.header.submitting": "Wird gesendet...",
-  "portal.feedback.header.errorSelectBoard": "Bitte wählen Sie eine Kategorie",
+  "portal.feedback.header.detailsPlaceholder": "Weitere Details hinzufügen... / eingeben für Befehle",
   "portal.feedback.header.errorAddTitle": "Bitte fügen Sie einen Titel hinzu",
-  "portal.feedback.header.errorSignIn": "Bitte melden Sie sich an, um Feedback einzureichen",
+  "portal.feedback.header.errorSelectBoard": "Bitte wählen Sie eine Kategorie",
   "portal.feedback.header.errorSession": "Sitzung konnte nicht erstellt werden",
+  "portal.feedback.header.errorSignIn": "Bitte melden Sie sich an, um Feedback einzureichen",
   "portal.feedback.header.errorSubmit": "Feedback konnte nicht gesendet werden",
+  "portal.feedback.header.postingAnonymously": "Sie posten anonym",
+  "portal.feedback.header.postingAs": "Sie posten als",
+  "portal.feedback.header.postingTo": "Posten in",
+  "portal.feedback.header.selectBoard": "Kategorie auswählen",
+  "portal.feedback.header.signInToPost": "Melden Sie sich an, um zu posten",
+  "portal.feedback.header.signOut": "abmelden",
+  "portal.feedback.header.submit": "Absenden",
   "portal.feedback.header.submitTooltipSignIn": "Bitte melden Sie sich an, um Feedback einzureichen",
+  "portal.feedback.header.submitting": "Wird gesendet...",
+  "portal.feedback.header.titlePlaceholder": "Was ist Ihre Idee?",
   "portal.feedback.header.toastSubmitted": "Feedback gesendet",
   "portal.feedback.header.toastView": "Ansehen",
-  "portal.feedback.toolbar.sortTop": "Top",
-  "portal.feedback.toolbar.sortNew": "Neu",
-  "portal.feedback.toolbar.sortTrending": "Trends",
-  "portal.feedback.toolbar.search": "Suchen",
-  "portal.feedback.toolbar.searchPlaceholder": "Beiträge suchen...",
-  "portal.feedback.toolbar.searchSubmit": "Suchen",
-  "portal.feedback.toolbar.clearSearch": "Suche löschen",
-  "portal.feedback.filter.clearAll": "Alle löschen",
+  "portal.feedback.list.noPostsFiltered": "Keine Beiträge entsprechen Ihren Filtern.",
+  "portal.feedback.list.noPostsYet": "Noch keine Beiträge vorhanden.",
   "portal.feedback.sidebar.boards": "Kategorien",
-  "portal.feedback.sidebar.viewAllPosts": "Alle Beiträge anzeigen",
   "portal.feedback.sidebar.poweredBy": "Bereitgestellt von {brand}",
+  "portal.feedback.sidebar.viewAllPosts": "Alle Beiträge anzeigen",
   "portal.feedback.similarPosts.heading": "Ähnliche Ideen",
+  "portal.feedback.toolbar.clearSearch": "Suche löschen",
+  "portal.feedback.toolbar.filter": "Filtern",
+  "portal.feedback.toolbar.search": "Suchen",
+  "portal.feedback.toolbar.searchPlaceholder": "Beiträge suchen...",
+  "portal.feedback.toolbar.searchSubmit": "Suchen",
+  "portal.feedback.toolbar.sortNew": "Neu",
+  "portal.feedback.toolbar.sortTop": "Top",
+  "portal.feedback.toolbar.sortTrending": "Trends",
+  "portal.help.articleNotFound.backLink": "Hilfecenter",
+  "portal.help.articleNotFound.description": "Dieser Artikel wurde möglicherweise entfernt oder ist noch nicht veröffentlicht.",
+  "portal.help.articleNotFound.title": "Artikel nicht gefunden",
+  "portal.help.categoryNotFound.backLink": "Hilfecenter",
+  "portal.help.categoryNotFound.description": "Diese Kategorie wurde möglicherweise entfernt oder existiert nicht.",
+  "portal.help.categoryNotFound.title": "Kategorie nicht gefunden",
+  "portal.help.description": "Finden Sie Antworten auf Ihre Fragen und erfahren Sie, wie Sie unser Produkt optimal nutzen.",
+  "portal.help.title": "Hilfecenter",
+  "portal.notifications.empty.description": "Stimmen Sie ab oder kommentieren Sie Beiträge, um diese zu abonnieren. Sie werden bei Statusänderungen oder neuer Aktivität benachrichtigt.",
+  "portal.notifications.empty.title": "Sie sind auf dem neuesten Stand!",
+  "portal.notifications.groupEarlier": "Älter",
+  "portal.notifications.groupToday": "Heute",
+  "portal.notifications.groupYesterday": "Gestern",
+  "portal.notifications.markAllRead": "Alle als gelesen markieren",
+  "portal.notifications.readAll": "Alle lesen",
+  "portal.notifications.subtitle": "Neuigkeiten zu Beiträgen, die Sie abonniert haben",
+  "portal.notifications.title": "Benachrichtigungen",
+  "portal.pinnedComment.pinnedBadge": "Angepinnt",
+  "portal.postCard.authorFallback": "Anonym",
+  "portal.postCard.deleteNotAllowed": "Löschen nicht erlaubt",
+  "portal.postCard.editNotAllowed": "Bearbeitung nicht erlaubt",
+  "portal.postCard.quickActions.copyLink": "Link kopieren",
+  "portal.postCard.quickActions.delete": "Löschen",
+  "portal.postCard.quickActions.edit": "Bearbeiten",
+  "portal.postCard.quickActions.options": "Beitragsoptionen",
+  "portal.postCard.quickActions.viewInPortal": "Im Portal ansehen",
+  "portal.postCard.toast.linkCopied": "Link in die Zwischenablage kopiert",
+  "portal.postCard.toast.linkCopyFailed": "Link konnte nicht kopiert werden",
+  "portal.postCard.vote.ariaRemoveVote": "Stimme zurücknehmen ({count, plural, one {# Stimme} other {# Stimmen}})",
+  "portal.postCard.vote.ariaVote": "Für diesen Beitrag abstimmen ({count, plural, one {# Stimme} other {# Stimmen}})",
   "portal.postDetail.comments": "{count, plural, one {# Kommentar} other {# Kommentare}}",
-  "portal.postDetail.postActions.ariaLabel": "Beitragsaktionen",
-  "portal.postDetail.postActions.edit": "Bearbeiten",
-  "portal.postDetail.postActions.delete": "Löschen",
-  "portal.postDetail.edit.titlePlaceholder": "Was ist Ihre Idee?",
-  "portal.postDetail.edit.detailsPlaceholder": "Weitere Details hinzufügen... / eingeben für Befehle",
+  "portal.postDetail.commentsLocked": "Die Kommentare zu diesem Beitrag sind gesperrt",
+  "portal.postDetail.deleteDialog.confirmLabel": "Beitrag löschen",
+  "portal.postDetail.deleteDialog.deleting": "Wird gelöscht...",
+  "portal.postDetail.deleteDialog.description": "Sind Sie sicher, dass Sie „{title}“ löschen möchten? Diese Aktion kann nicht rückgängig gemacht werden.",
+  "portal.postDetail.deleteDialog.errorLinks": "Verknüpfte Integrationen konnten nicht geladen werden. Bitte schließen Sie das Fenster und versuchen Sie es erneut.",
+  "portal.postDetail.deleteDialog.loading": "Wird geladen...",
+  "portal.postDetail.deleteDialog.title": "Beitrag löschen",
   "portal.postDetail.edit.cancel": "Abbrechen",
+  "portal.postDetail.edit.detailsPlaceholder": "Weitere Details hinzufügen... / eingeben für Befehle",
   "portal.postDetail.edit.save": "Speichern",
   "portal.postDetail.edit.saving": "Wird gespeichert...",
-  "portal.postDetail.related": "Ähnliche Beiträge",
+  "portal.postDetail.edit.titlePlaceholder": "Was ist Ihre Idee?",
   "portal.postDetail.mergeBanner.mergedInto": "Dieses Feedback wurde zusammengeführt mit",
   "portal.postDetail.mergeBanner.votesCount": "Stimmen und Aktivität werden jetzt dem verknüpften Eintrag zugerechnet.",
-  "portal.postDetail.metadata.upvotes": "Stimmen",
-  "portal.postDetail.metadata.status": "Status",
+  "portal.postDetail.metadata.author": "Autor(in)",
+  "portal.postDetail.metadata.authorFallback": "Anonym",
   "portal.postDetail.metadata.board": "Kategorie",
-  "portal.postDetail.metadata.tags": "Tags",
-  "portal.postDetail.metadata.tagAdd": "Hinzufügen",
+  "portal.postDetail.metadata.date": "Datum",
+  "portal.postDetail.metadata.deletePost": "Beitrag löschen",
+  "portal.postDetail.metadata.lockComments": "Kommentare sperren",
+  "portal.postDetail.metadata.manage": "Verwalten",
+  "portal.postDetail.metadata.managePost": "Beitrag verwalten",
+  "portal.postDetail.metadata.merge": "Zusammenführen",
+  "portal.postDetail.metadata.mergeIntoAnother": "In einen anderen zusammenführen...",
+  "portal.postDetail.metadata.mergeIntoThis": "In diesen zusammenführen",
+  "portal.postDetail.metadata.restorePost": "Beitrag wiederherstellen",
   "portal.postDetail.metadata.roadmap": "Roadmap",
   "portal.postDetail.metadata.roadmapAdd": "Hinzufügen",
-  "portal.postDetail.metadata.date": "Datum",
   "portal.postDetail.metadata.source": "Quelle",
+  "portal.postDetail.metadata.sourceOpenIn": "Öffnen in {name}",
   "portal.postDetail.metadata.sourceOriginalFeedback": "Ursprüngliches Feedback",
   "portal.postDetail.metadata.sourceUnknownAuthor": "Unbekannte(r) Autor(in)",
-  "portal.postDetail.metadata.sourceOpenIn": "Öffnen in {name}",
-  "portal.postDetail.metadata.author": "Autor(in)",
-  "portal.postDetail.metadata.authorFallback": "Anonym",
+  "portal.postDetail.metadata.status": "Status",
   "portal.postDetail.metadata.subscribe": "Abonnieren",
   "portal.postDetail.metadata.subscribeHint": "Benachrichtigung erhalten, wenn es Neuigkeiten zu diesem Beitrag gibt",
-  "portal.postDetail.metadata.manage": "Verwalten",
-  "portal.postDetail.metadata.managePost": "Beitrag verwalten",
-  "portal.postDetail.metadata.merge": "Zusammenführen",
-  "portal.postDetail.metadata.mergeIntoThis": "In diesen zusammenführen",
-  "portal.postDetail.metadata.mergeIntoAnother": "In einen anderen zusammenführen...",
-  "portal.postDetail.metadata.lockComments": "Kommentare sperren",
+  "portal.postDetail.metadata.tagAdd": "Hinzufügen",
+  "portal.postDetail.metadata.tags": "Tags",
   "portal.postDetail.metadata.unlockComments": "Kommentare entsperren",
-  "portal.postDetail.metadata.restorePost": "Beitrag wiederherstellen",
-  "portal.postDetail.metadata.deletePost": "Beitrag löschen",
-  "portal.postDetail.deleteDialog.title": "Beitrag löschen",
-  "portal.postDetail.deleteDialog.description": "Sind Sie sicher, dass Sie „{title}“ löschen möchten? Diese Aktion kann nicht rückgängig gemacht werden.",
-  "portal.postDetail.deleteDialog.confirmLabel": "Beitrag löschen",
-  "portal.postDetail.deleteDialog.deleting": "Wird gelöscht...",
-  "portal.postDetail.deleteDialog.loading": "Wird geladen...",
-  "portal.postDetail.deleteDialog.errorLinks": "Verknüpfte Integrationen konnten nicht geladen werden. Bitte schließen Sie das Fenster und versuchen Sie es erneut.",
+  "portal.postDetail.metadata.upvotes": "Stimmen",
   "portal.postDetail.notFound": "Beitrag nicht gefunden",
-  "portal.postDetail.commentsLocked": "Die Kommentare zu diesem Beitrag sind gesperrt",
-  "portal.changelog.title": "Neuigkeiten",
-  "portal.changelog.description": "Bleiben Sie auf dem Laufenden über die neuesten Produkt-Updates und veröffentlichten Funktionen.",
-  "portal.changelog.rssFeed": "RSS-Feed",
+  "portal.postDetail.postActions.ariaLabel": "Beitragsaktionen",
+  "portal.postDetail.postActions.delete": "Löschen",
+  "portal.postDetail.postActions.edit": "Bearbeiten",
+  "portal.postDetail.related": "Ähnliche Beiträge",
   "portal.changelog.loading": "Neuigkeiten werden geladen...",
   "portal.changelog.loadMore": "Mehr laden",
   "portal.changelog.loadingMore": "Wird geladen...",
   "portal.changelog.empty.title": "Noch keine Neuigkeiten vorhanden",
   "portal.changelog.empty.description": "Schauen Sie bald wieder vorbei für die neuesten Produkt-Updates und veröffentlichten Funktionen.",
-  "portal.changelog.entryNotFound.title": "Eintrag nicht gefunden",
-  "portal.changelog.entryNotFound.description": "Dieser Eintrag wurde möglicherweise entfernt oder ist noch nicht veröffentlicht.",
-  "portal.changelog.entryNotFound.backLink": "Neuigkeiten",
   "portal.roadmap.title": "Roadmap",
   "portal.roadmap.description": "Sehen Sie, woran wir arbeiten und was als Nächstes kommt.",
   "portal.roadmap.empty.title": "Keine Roadmaps verfügbar",
   "portal.roadmap.empty.description": "Schauen Sie später wieder vorbei, um zu sehen, woran wir arbeiten.",
   "portal.roadmap.column.empty": "Noch keine Einträge",
-  "portal.help.title": "Hilfecenter",
-  "portal.help.description": "Finden Sie Antworten auf Ihre Fragen und erfahren Sie, wie Sie unser Produkt optimal nutzen.",
-  "portal.help.categoryNotFound.title": "Kategorie nicht gefunden",
-  "portal.help.categoryNotFound.description": "Diese Kategorie wurde möglicherweise entfernt oder existiert nicht.",
-  "portal.help.categoryNotFound.backLink": "Hilfecenter",
-  "portal.help.articleNotFound.title": "Artikel nicht gefunden",
-  "portal.help.articleNotFound.description": "Dieser Artikel wurde möglicherweise entfernt oder ist noch nicht veröffentlicht.",
-  "portal.help.articleNotFound.backLink": "Hilfecenter",
-  "portal.notifications.title": "Benachrichtigungen",
-  "portal.notifications.subtitle": "Neuigkeiten zu Beiträgen, die Sie abonniert haben",
-  "portal.notifications.markAllRead": "Alle als gelesen markieren",
-  "portal.notifications.readAll": "Alle lesen",
-  "portal.notifications.groupToday": "Heute",
-  "portal.notifications.groupYesterday": "Gestern",
-  "portal.notifications.groupEarlier": "Älter",
-  "portal.notifications.empty.title": "Sie sind auf dem neuesten Stand!",
-  "portal.notifications.empty.description": "Stimmen Sie ab oder kommentieren Sie Beiträge, um diese zu abonnieren. Sie werden bei Statusänderungen oder neuer Aktivität benachrichtigt.",
-  "portal.settings.profile.title": "Profil",
-  "portal.settings.profile.description": "Verwalten Sie Ihre persönlichen Daten",
-  "portal.settings.preferences.title": "Einstellungen",
-  "portal.settings.preferences.description": "Passen Sie Ihr Erlebnis an",
-  "portal.settings.preferences.appearance.title": "Erscheinungsbild",
   "portal.settings.preferences.appearance.description": "Passen Sie das Aussehen der App an",
   "portal.settings.preferences.appearance.themeLabel": "Design",
-  "portal.settings.preferences.notifications.title": "E-Mail-Benachrichtigungen",
+  "portal.settings.preferences.appearance.title": "Erscheinungsbild",
+  "portal.settings.preferences.description": "Passen Sie Ihr Erlebnis an",
   "portal.settings.preferences.notifications.description": "Verwalten Sie E-Mail-Benachrichtigungen für Beiträge, die Sie abonniert haben",
+  "portal.settings.preferences.notifications.title": "E-Mail-Benachrichtigungen",
+  "portal.settings.preferences.title": "Einstellungen",
+  "portal.settings.profile.description": "Verwalten Sie Ihre persönlichen Daten",
+  "portal.settings.profile.title": "Profil",
   "portal.subscriptionBell.aria.subscribe": "Benachrichtigungen abonnieren",
-  "portal.subscriptionBell.aria.subscribedStatusOnly": "Nur Statusänderungen abonniert",
   "portal.subscriptionBell.aria.subscribedAll": "Alle Aktivitäten abonniert",
-  "portal.subscriptionBell.menu.title": "Benachrichtigungen",
-  "portal.subscriptionBell.menu.subtitle": "Wählen Sie, was Sie abonnieren möchten",
+  "portal.subscriptionBell.aria.subscribedStatusOnly": "Nur Statusänderungen abonniert",
   "portal.subscriptionBell.level.all": "Alle Aktivitäten",
   "portal.subscriptionBell.level.allHint": "Kommentare und Statusänderungen",
   "portal.subscriptionBell.level.statusOnly": "Statusänderungen",
   "portal.subscriptionBell.level.statusOnlyHint": "Wenn der Status aktualisiert wird",
   "portal.subscriptionBell.level.unsubscribe": "Abbestellen",
-  "portal.unsubscribeBanner.message": "Sie haben diesen Beitrag abbestellt. Verwenden Sie das Glockensymbol, um ihn erneut zu abonnieren.",
+  "portal.subscriptionBell.menu.subtitle": "Wählen Sie, was Sie abonnieren möchten",
+  "portal.subscriptionBell.menu.title": "Benachrichtigungen",
   "portal.unsubscribeBanner.dismiss": "Schließen",
-  "portal.pinnedComment.pinnedBadge": "Angepinnt",
-  "portal.postCard.authorFallback": "Anonym",
-  "portal.postCard.editNotAllowed": "Bearbeitung nicht erlaubt",
-  "portal.postCard.deleteNotAllowed": "Löschen nicht erlaubt",
-  "portal.postCard.quickActions.viewInPortal": "Im Portal ansehen",
-  "portal.postCard.quickActions.copyLink": "Link kopieren",
-  "portal.postCard.quickActions.edit": "Bearbeiten",
-  "portal.postCard.quickActions.delete": "Löschen",
-  "portal.postCard.quickActions.options": "Beitragsoptionen",
-  "portal.postCard.vote.ariaVote": "Für diesen Beitrag abstimmen ({count, plural, one {# Stimme} other {# Stimmen}})",
-  "portal.postCard.vote.ariaRemoveVote": "Stimme zurücknehmen ({count, plural, one {# Stimme} other {# Stimmen}})",
-  "portal.postCard.toast.linkCopied": "Link in die Zwischenablage kopiert",
-  "portal.postCard.toast.linkCopyFailed": "Link konnte nicht kopiert werden",
-  "portal.commentThread.empty": "Noch keine Kommentare. Teilen Sie als Erste(r) Ihre Gedanken!",
-  "portal.commentThread.signInToComment": "Melden Sie sich an, um zu kommentieren",
-  "portal.commentThread.signIn": "Anmelden",
-  "portal.commentThread.deleted": "[gelöscht]",
-  "portal.commentThread.removed": "[entfernt]",
-  "portal.commentThread.authorFallback": "Anonym",
-  "portal.commentThread.authorAlt": "Autor(in) des Kommentars",
-  "portal.commentThread.teamBadge": "Team",
-  "portal.commentThread.internalNote": "Interne Notiz",
-  "portal.commentThread.internalNoteHint": "nur für Ihr Team sichtbar",
-  "portal.commentThread.pinnedBadge": "Angepinnt",
-  "portal.commentThread.changedStatusTo": "hat den Status geändert auf",
-  "portal.commentThread.reply": "Antworten",
-  "portal.commentThread.pin": "Anheften",
-  "portal.commentThread.unpin": "Loslösen",
-  "portal.commentThread.restore": "Wiederherstellen",
-  "portal.commentThread.restoring": "Wird wiederhergestellt...",
-  "portal.commentThread.delete": "Löschen",
-  "portal.commentThread.deleting": "Wird gelöscht...",
-  "portal.commentForm.labelSrOnly": "Ihr Kommentar",
-  "portal.commentForm.placeholder": "Kommentar schreiben...",
-  "portal.commentForm.authorFallback": "Anonym",
-  "portal.commentForm.noStatus": "Kein Status",
-  "portal.commentForm.updateStatus": "Status aktualisieren",
-  "portal.commentForm.clearStatusChange": "Statusänderung verwerfen",
-  "portal.commentForm.postingAnonymously": "Sie kommentieren anonym",
-  "portal.commentForm.postingAs": "Sie kommentieren als {name}",
-  "portal.commentForm.signOut": "abmelden",
-  "portal.commentForm.cancel": "Abbrechen",
-  "portal.commentForm.private": "Privat",
-  "portal.commentForm.privateLockedTooltip": "Antworten auf private Kommentare sind immer privat",
-  "portal.commentForm.privateOnTooltip": "Nur für Teammitglieder sichtbar",
-  "portal.commentForm.privateOffTooltip": "Diesen Kommentar als privat markieren (nur Team)",
-  "portal.commentForm.submit": "Kommentieren",
-  "portal.commentForm.submitWithStatus": "Kommentieren und als {statusName} markieren",
-  "portal.commentForm.reply": "Antworten",
-  "portal.commentForm.submitting": "Wird gesendet...",
-  "portal.commentForm.errorPost": "Kommentar konnte nicht veröffentlicht werden",
-  "portal.feedback.filter.addFilter": "Filter hinzufügen",
-  "portal.feedback.filter.back": "Zurück",
-  "portal.feedback.filter.category.board": "Board",
-  "portal.feedback.filter.category.status": "Status",
-  "portal.feedback.filter.category.tag": "Tag",
-  "portal.feedback.filter.category.votes": "Stimmenanzahl",
-  "portal.feedback.filter.category.date": "Erstellungsdatum",
-  "portal.feedback.filter.category.response": "Team-Antwort",
-  "portal.feedback.filter.statusGroup.active": "Aktiv",
-  "portal.feedback.filter.statusGroup.complete": "Abgeschlossen",
-  "portal.feedback.filter.statusGroup.closed": "Geschlossen",
-  "portal.feedback.filter.chip.board": "Board:",
-  "portal.feedback.filter.chip.status": "Status:",
-  "portal.feedback.filter.chip.tag": "Tag:",
-  "portal.feedback.filter.chip.tags": "Tags:",
-  "portal.feedback.filter.chip.votes": "Mindest-Stimmen:",
-  "portal.feedback.filter.chip.date": "Datum:",
-  "portal.feedback.filter.chip.response": "Team-Antwort:",
+  "portal.unsubscribeBanner.message": "Sie haben diesen Beitrag abbestellt. Verwenden Sie das Glockensymbol, um ihn erneut zu abonnieren.",
+  "tickets.audience.internal": "Internal note",
+  "tickets.audience.public": "Public reply",
+  "tickets.audience.shared_team": "Shared with team",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "Email",
+  "tickets.channel.portal": "Portal",
+  "tickets.channel.widget": "Widget",
+  "tickets.notifications.assigned": "Assigned to you: {subject}",
+  "tickets.notifications.opened": "Ticket opened: {subject}",
+  "tickets.notifications.participantAdded": "Added to ticket: {subject}",
+  "tickets.notifications.participantRemoved": "Removed from ticket: {subject}",
+  "tickets.notifications.shared": "Ticket shared: {subject}",
+  "tickets.notifications.slaBreach": "SLA breached: {subject}",
+  "tickets.notifications.slaWarning": "SLA at risk: {subject}",
+  "tickets.notifications.statusChanged": "Status: {subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "New reply: {subject}",
+  "tickets.notifications.unassigned": "Unassigned: {subject}",
+  "tickets.notifications.unshared": "Ticket unshared: {subject}",
+  "tickets.priority.high": "High",
+  "tickets.priority.low": "Low",
+  "tickets.priority.normal": "Normal",
+  "tickets.priority.urgent": "Urgent",
+  "tickets.role.cc": "CC",
+  "tickets.role.collaborator": "Collaborator",
+  "tickets.role.watcher": "Watcher",
+  "tickets.scope.all": "All",
+  "tickets.scope.inbox": "Inbox",
+  "tickets.scope.my_assigned": "Assigned to me",
+  "tickets.scope.my_inbox": "My inbox",
+  "tickets.scope.my_team": "My team",
+  "tickets.scope.shared_with_me": "Shared with me",
+  "tickets.scope.unassigned": "Unassigned",
+  "tickets.share.comment": "Comment",
+  "tickets.share.full": "Full access",
+  "tickets.share.read": "Read",
+  "tickets.sla.kind.first_response": "First response",
+  "tickets.sla.kind.next_response": "Next response",
+  "tickets.sla.kind.resolution": "Resolution",
+  "tickets.sla.state.breached": "Breached",
+  "tickets.sla.state.cancelled": "Cancelled",
+  "tickets.sla.state.met": "Met",
+  "tickets.sla.state.paused": "Paused",
+  "tickets.sla.state.running": "Running",
+  "tickets.status.closed": "Closed",
+  "tickets.status.on_hold": "On hold",
+  "tickets.status.open": "Open",
+  "tickets.status.pending": "Pending",
+  "tickets.status.solved": "Solved",
+  "tickets.subscription.mute": "Mute",
+  "tickets.subscription.muted": "Muted",
+  "tickets.subscription.notify.assignment": "Assignment changes",
+  "tickets.subscription.notify.participants": "Participant changes",
+  "tickets.subscription.notify.shares": "Share grants",
+  "tickets.subscription.notify.sla": "SLA warnings & breaches",
+  "tickets.subscription.notify.status": "Status changes",
+  "tickets.subscription.notify.threads": "New replies",
+  "tickets.subscription.source.auto_assigned": "Auto (assignee)",
+  "tickets.subscription.source.auto_participant": "Auto (participant)",
+  "tickets.subscription.source.auto_team_member": "Auto (team member)",
+  "tickets.subscription.source.manual": "Manual",
+  "tickets.subscription.unmute": "Unmute",
+  "tickets.visibility.org": "Organization",
+  "tickets.visibility.private": "Private",
+  "tickets.visibility.shared": "Shared",
+  "tickets.visibility.team": "Team only",
   "widget.home.posting.selectBoard": "Kategorie auswählen",
-  "portal.feedback.toolbar.filter": "Filtern",
   "portal.roadmap.toolbar.sortBy": "Sortieren nach",
   "portal.roadmap.toolbar.sortVotes": "Meiste Stimmen",
   "portal.roadmap.toolbar.sortNewest": "Neueste",
@@ -441,5 +507,60 @@
   "portal.hc.contactSupport.body": "Starten Sie eine Unterhaltung mit unserem Team und wir melden uns bei Ihnen.",
   "portal.hc.contactSupport.cta": "Support kontaktieren",
   "portal.hc.articleFeedback.stillStuck": "Kommen Sie nicht weiter?",
-  "portal.hc.articleFeedback.contactSupport": "Support kontaktieren"
+  "portal.hc.articleFeedback.contactSupport": "Support kontaktieren",
+  "portal.header.nav.tickets": "Meine Tickets",
+  "portal.tickets.title": "Meine Tickets",
+  "portal.tickets.subtitle": "Tickets, die Sie eröffnet haben oder zu denen Sie hinzugefügt wurden.",
+  "portal.tickets.empty.title": "Noch keine Tickets",
+  "portal.tickets.empty.description": "Sobald unser Team eine Anfrage von Ihnen bearbeitet, erscheint sie hier.",
+  "portal.tickets.filter.all": "Alle",
+  "portal.tickets.filter.open": "Offen",
+  "portal.tickets.filter.pending": "Ausstehend",
+  "portal.tickets.filter.solved": "Gelöst",
+  "portal.tickets.filter.closed": "Geschlossen",
+  "portal.tickets.row.updated": "Aktualisiert {when}",
+  "portal.tickets.detail.back": "Meine Tickets",
+  "portal.tickets.detail.description": "Beschreibung",
+  "portal.tickets.detail.openedAt": "Eröffnet {date}",
+  "portal.tickets.detail.lastUpdate": "Letzte Aktualisierung {when}",
+  "portal.tickets.detail.noReplies": "Noch keine Antworten.",
+  "portal.tickets.detail.supportTeam": "Support-Team",
+  "portal.tickets.detail.you": "Sie",
+  "portal.tickets.detail.edited": "bearbeitet",
+  "portal.tickets.composer.placeholder": "Geben Sie Ihre Antwort ein…",
+  "portal.tickets.composer.send": "Antwort senden",
+  "portal.tickets.composer.sending": "Wird gesendet…",
+  "portal.tickets.composer.closed": "Dieses Ticket ist geschlossen. Eröffnen Sie ein neues, um nachzufassen.",
+  "widget.support.card.title": "Support kontaktieren",
+  "widget.support.card.description": "Erhalten Sie direkt Hilfe von unserem Team.",
+  "widget.support.card.cta": "Ticket eröffnen",
+  "widget.support.composer.subjectPlaceholder": "Betreff",
+  "widget.support.composer.bodyPlaceholder": "Beschreiben Sie Ihr Anliegen...",
+  "widget.support.composer.namePlaceholder": "Ihr Name (optional)",
+  "widget.support.composer.emailPlaceholder": "Ihre E-Mail-Adresse",
+  "widget.support.composer.priority.label": "Priorität",
+  "widget.support.composer.priority.low": "Niedrig",
+  "widget.support.composer.priority.normal": "Normal",
+  "widget.support.composer.priority.high": "Hoch",
+  "widget.support.composer.submit": "Senden",
+  "widget.support.composer.submitting": "Wird gesendet...",
+  "widget.support.composer.errorCreate": "Das Ticket konnte nicht erstellt werden. Bitte versuchen Sie es erneut.",
+  "widget.support.composer.errorEmail": "Ihre E-Mail-Adresse konnte nicht überprüft werden. Bitte versuchen Sie es erneut.",
+  "widget.support.list.heading": "Ihre Tickets",
+  "widget.support.list.newTicket": "Neues Ticket",
+  "widget.support.list.empty": "Sie haben noch keine Tickets eröffnet.",
+  "widget.support.list.emptyAnonymous": "Melden Sie sich an, um Ihre Tickets anzuzeigen.",
+  "widget.support.list.errorLoad": "Ihre Tickets konnten nicht geladen werden.",
+  "widget.support.detail.errorLoad": "Dieses Ticket konnte nicht geladen werden.",
+  "widget.support.detail.threadEmpty": "Noch keine Antworten.",
+  "widget.support.detail.youLabel": "Sie",
+  "widget.support.detail.replyPlaceholder": "Geben Sie Ihre Antwort ein...",
+  "widget.support.detail.replySend": "Antworten",
+  "widget.support.detail.replySending": "Wird gesendet...",
+  "widget.support.detail.errorReply": "Ihre Antwort konnte nicht gesendet werden.",
+  "widget.support.detail.resolve": "Als gelöst markieren",
+  "widget.support.detail.resolved": "Gelöst",
+  "widget.support.detail.errorResolve": "Dieses Ticket konnte nicht als gelöst markiert werden.",
+  "widget.support.detail.reopen": "Wieder öffnen",
+  "widget.support.detail.errorReopen": "Dieses Ticket konnte nicht wieder geöffnet werden."
 }
diff --git a/apps/web/src/locales/en.json b/apps/web/src/locales/en.json
index bffa98869..fc4fc51ca 100644
--- a/apps/web/src/locales/en.json
+++ b/apps/web/src/locales/en.json
@@ -1,4 +1,48 @@
 {
+  "portal.changelog.description": "Stay up to date with the latest product updates and shipped features.",
+  "portal.changelog.entryNotFound.backLink": "Changelog",
+  "portal.changelog.entryNotFound.description": "This entry may have been removed or is not yet published.",
+  "portal.changelog.entryNotFound.title": "Changelog entry not found",
+  "portal.changelog.rssFeed": "RSS Feed",
+  "portal.changelog.title": "Changelog",
+  "portal.commentForm.authorFallback": "Anonymous",
+  "portal.commentForm.cancel": "Cancel",
+  "portal.commentForm.clearStatusChange": "Clear status change",
+  "portal.commentForm.errorPost": "Failed to post comment",
+  "portal.commentForm.labelSrOnly": "Your comment",
+  "portal.commentForm.noStatus": "No status",
+  "portal.commentForm.placeholder": "Write a comment...",
+  "portal.commentForm.postingAnonymously": "Posting anonymously",
+  "portal.commentForm.postingAs": "Posting as {name}",
+  "portal.commentForm.private": "Private",
+  "portal.commentForm.privateLockedTooltip": "Replies to private comments are always private",
+  "portal.commentForm.privateOffTooltip": "Make this comment private (team-only)",
+  "portal.commentForm.privateOnTooltip": "Only visible to team members",
+  "portal.commentForm.reply": "Reply",
+  "portal.commentForm.signOut": "sign out",
+  "portal.commentForm.submit": "Comment",
+  "portal.commentForm.submitWithStatus": "Comment & mark {statusName}",
+  "portal.commentForm.submitting": "Posting...",
+  "portal.commentForm.updateStatus": "Update status",
+  "portal.commentThread.authorAlt": "Comment author",
+  "portal.commentThread.authorFallback": "Anonymous",
+  "portal.commentThread.changedStatusTo": "changed status to",
+  "portal.commentThread.delete": "Delete",
+  "portal.commentThread.deleted": "[deleted]",
+  "portal.commentThread.deleting": "Deleting...",
+  "portal.commentThread.empty": "No comments yet. Be the first to share your thoughts!",
+  "portal.commentThread.internalNote": "Internal note",
+  "portal.commentThread.internalNoteHint": "only visible to your team",
+  "portal.commentThread.pin": "Pin",
+  "portal.commentThread.pinnedBadge": "Pinned",
+  "portal.commentThread.removed": "[removed]",
+  "portal.commentThread.reply": "Reply",
+  "portal.commentThread.restore": "Restore",
+  "portal.commentThread.restoring": "Restoring...",
+  "portal.commentThread.signIn": "Sign in",
+  "portal.commentThread.signInToComment": "Sign in to comment",
+  "portal.commentThread.teamBadge": "Team",
+  "portal.commentThread.unpin": "Unpin",
   "widget.shell.heading.feedback": "Share your ideas",
   "widget.shell.heading.help": "Help & Support",
   "widget.shell.heading.changelog": "What's new",
@@ -111,83 +155,148 @@
   "portal.header.theme.dark": "Dark",
   "portal.feedback.empty.comingSoonTitle": "Coming Soon",
   "portal.feedback.empty.comingSoonDescription": "{orgName} is setting up their feedback portal. Check back soon to share your ideas and suggestions.",
-  "portal.feedback.list.noPostsFiltered": "No posts match your filters.",
-  "portal.feedback.list.noPostsYet": "No posts yet.",
-  "portal.feedback.header.postingTo": "Posting to",
-  "portal.feedback.header.selectBoard": "Select a board",
-  "portal.feedback.header.titlePlaceholder": "What's your idea?",
-  "portal.feedback.header.detailsPlaceholder": "Add more details... Type / for commands",
-  "portal.feedback.header.postingAs": "Posting as",
-  "portal.feedback.header.signOut": "sign out",
-  "portal.feedback.header.postingAnonymously": "Posting anonymously",
-  "portal.feedback.header.signInToPost": "Sign in to post",
+  "portal.feedback.empty.comingSoonTitle": "Coming Soon",
+  "portal.feedback.filter.addFilter": "Add filter",
+  "portal.feedback.filter.back": "Back",
+  "portal.feedback.filter.category.board": "Board",
+  "portal.feedback.filter.category.date": "Created date",
+  "portal.feedback.filter.category.response": "Team response",
+  "portal.feedback.filter.category.status": "Status",
+  "portal.feedback.filter.category.tag": "Tag",
+  "portal.feedback.filter.category.votes": "Vote count",
+  "portal.feedback.filter.chip.board": "Board:",
+  "portal.feedback.filter.chip.date": "Date:",
+  "portal.feedback.filter.chip.response": "Team response:",
+  "portal.feedback.filter.chip.status": "Status:",
+  "portal.feedback.filter.chip.tag": "Tag:",
+  "portal.feedback.filter.chip.tags": "Tags:",
+  "portal.feedback.filter.chip.votes": "Min votes:",
+  "portal.feedback.filter.clearAll": "Clear all",
+  "portal.feedback.filter.statusGroup.active": "Active",
+  "portal.feedback.filter.statusGroup.closed": "Closed",
+  "portal.feedback.filter.statusGroup.complete": "Complete",
   "portal.feedback.header.cancel": "Cancel",
-  "portal.feedback.header.submit": "Submit",
-  "portal.feedback.header.submitting": "Submitting...",
-  "portal.feedback.header.errorSelectBoard": "Please select a board",
+  "portal.feedback.header.detailsPlaceholder": "Add more details... Type / for commands",
   "portal.feedback.header.errorAddTitle": "Please add a title",
-  "portal.feedback.header.errorSignIn": "Please sign in to submit feedback",
+  "portal.feedback.header.errorSelectBoard": "Please select a board",
   "portal.feedback.header.errorSession": "Failed to create session",
+  "portal.feedback.header.errorSignIn": "Please sign in to submit feedback",
   "portal.feedback.header.errorSubmit": "Failed to submit feedback",
+  "portal.feedback.header.postingAnonymously": "Posting anonymously",
+  "portal.feedback.header.postingAs": "Posting as",
+  "portal.feedback.header.postingTo": "Posting to",
+  "portal.feedback.header.selectBoard": "Select a board",
+  "portal.feedback.header.signInToPost": "Sign in to post",
+  "portal.feedback.header.signOut": "sign out",
+  "portal.feedback.header.submit": "Submit",
   "portal.feedback.header.submitTooltipSignIn": "Please sign in to submit feedback",
+  "portal.feedback.header.submitting": "Submitting...",
+  "portal.feedback.header.titlePlaceholder": "What's your idea?",
   "portal.feedback.header.toastSubmitted": "Feedback submitted",
   "portal.feedback.header.toastView": "View",
-  "portal.feedback.toolbar.sortTop": "Top",
-  "portal.feedback.toolbar.sortNew": "New",
-  "portal.feedback.toolbar.sortTrending": "Trending",
-  "portal.feedback.toolbar.search": "Search",
-  "portal.feedback.toolbar.searchPlaceholder": "Search posts...",
-  "portal.feedback.toolbar.searchSubmit": "Search",
-  "portal.feedback.toolbar.clearSearch": "Clear search",
-  "portal.feedback.filter.clearAll": "Clear all",
+  "portal.feedback.list.noPostsFiltered": "No posts match your filters.",
+  "portal.feedback.list.noPostsYet": "No posts yet.",
   "portal.feedback.sidebar.boards": "Boards",
-  "portal.feedback.sidebar.viewAllPosts": "View all posts",
   "portal.feedback.sidebar.poweredBy": "Powered by {brand}",
+  "portal.feedback.sidebar.viewAllPosts": "View all posts",
   "portal.feedback.similarPosts.heading": "Similar ideas",
+  "portal.feedback.toolbar.clearSearch": "Clear search",
+  "portal.feedback.toolbar.filter": "Filter",
+  "portal.feedback.toolbar.search": "Search",
+  "portal.feedback.toolbar.searchPlaceholder": "Search posts...",
+  "portal.feedback.toolbar.searchSubmit": "Search",
+  "portal.feedback.toolbar.sortNew": "New",
+  "portal.feedback.toolbar.sortTop": "Top",
+  "portal.feedback.toolbar.sortTrending": "Trending",
+  "portal.header.auth.admin": "Admin",
+  "portal.header.auth.logIn": "Log in",
+  "portal.header.auth.settings": "Settings",
+  "portal.header.auth.signOut": "Sign out",
+  "portal.header.auth.signUp": "Sign up",
+  "portal.header.nav.changelog": "Changelog",
+  "portal.header.nav.feedback": "Feedback",
+  "portal.header.nav.helpCenter": "Help Center",
+  "portal.header.nav.roadmap": "Roadmap",
+  "portal.header.nav.tickets": "My tickets",
+  "portal.header.theme.dark": "Dark",
+  "portal.header.theme.light": "Light",
+  "portal.header.theme.system": "System",
+  "portal.header.theme.toggleLabel": "Toggle theme",
+  "portal.help.articleNotFound.backLink": "Help Center",
+  "portal.help.articleNotFound.description": "This article may have been removed or is not yet published.",
+  "portal.help.articleNotFound.title": "Article not found",
+  "portal.help.categoryNotFound.backLink": "Help Center",
+  "portal.help.categoryNotFound.description": "This category may have been removed or does not exist.",
+  "portal.help.categoryNotFound.title": "Category not found",
+  "portal.help.description": "Find answers to your questions and learn how to get the most out of our product.",
+  "portal.help.title": "Help Center",
+  "portal.notifications.empty.description": "Vote or comment on posts to subscribe. You'll get notified when there are status changes or new activity.",
+  "portal.notifications.empty.title": "All caught up!",
+  "portal.notifications.groupEarlier": "Earlier",
+  "portal.notifications.groupToday": "Today",
+  "portal.notifications.groupYesterday": "Yesterday",
+  "portal.notifications.markAllRead": "Mark all read",
+  "portal.notifications.readAll": "Read all",
+  "portal.notifications.subtitle": "Updates on posts you've subscribed to",
+  "portal.notifications.title": "Notifications",
+  "portal.pinnedComment.pinnedBadge": "Pinned",
+  "portal.postCard.authorFallback": "Anonymous",
+  "portal.postCard.deleteNotAllowed": "Delete not allowed",
+  "portal.postCard.editNotAllowed": "Edit not allowed",
+  "portal.postCard.quickActions.copyLink": "Copy Link",
+  "portal.postCard.quickActions.delete": "Delete",
+  "portal.postCard.quickActions.edit": "Edit",
+  "portal.postCard.quickActions.options": "Post options",
+  "portal.postCard.quickActions.viewInPortal": "View in Portal",
+  "portal.postCard.toast.linkCopied": "Link copied to clipboard",
+  "portal.postCard.toast.linkCopyFailed": "Failed to copy link",
+  "portal.postCard.vote.ariaRemoveVote": "Remove vote ({count, plural, one {# vote} other {# votes}})",
+  "portal.postCard.vote.ariaVote": "Vote for this post ({count, plural, one {# vote} other {# votes}})",
   "portal.postDetail.comments": "{count, plural, one {# Comment} other {# Comments}}",
-  "portal.postDetail.postActions.ariaLabel": "Post actions",
-  "portal.postDetail.postActions.edit": "Edit",
-  "portal.postDetail.postActions.delete": "Delete",
-  "portal.postDetail.edit.titlePlaceholder": "What's your idea?",
-  "portal.postDetail.edit.detailsPlaceholder": "Add more details... Type / for commands",
+  "portal.postDetail.commentsLocked": "Comments are locked on this post",
+  "portal.postDetail.deleteDialog.confirmLabel": "Delete Post",
+  "portal.postDetail.deleteDialog.deleting": "Deleting...",
+  "portal.postDetail.deleteDialog.description": "Are you sure you want to delete \"{title}\"? This action cannot be undone.",
+  "portal.postDetail.deleteDialog.errorLinks": "Failed to load linked integrations. Please close and try again.",
+  "portal.postDetail.deleteDialog.loading": "Loading...",
+  "portal.postDetail.deleteDialog.title": "Delete Post",
   "portal.postDetail.edit.cancel": "Cancel",
+  "portal.postDetail.edit.detailsPlaceholder": "Add more details... Type / for commands",
   "portal.postDetail.edit.save": "Save",
   "portal.postDetail.edit.saving": "Saving...",
-  "portal.postDetail.related": "Related",
+  "portal.postDetail.edit.titlePlaceholder": "What's your idea?",
   "portal.postDetail.mergeBanner.mergedInto": "This feedback has been merged into",
   "portal.postDetail.mergeBanner.votesCount": "Votes and activity now count toward the linked item.",
-  "portal.postDetail.metadata.upvotes": "Upvotes",
-  "portal.postDetail.metadata.status": "Status",
+  "portal.postDetail.metadata.author": "Author",
+  "portal.postDetail.metadata.authorFallback": "Anonymous",
   "portal.postDetail.metadata.board": "Board",
-  "portal.postDetail.metadata.tags": "Tags",
-  "portal.postDetail.metadata.tagAdd": "Add",
+  "portal.postDetail.metadata.date": "Date",
+  "portal.postDetail.metadata.deletePost": "Delete post",
+  "portal.postDetail.metadata.lockComments": "Lock comments",
+  "portal.postDetail.metadata.manage": "Manage",
+  "portal.postDetail.metadata.managePost": "Manage post",
+  "portal.postDetail.metadata.merge": "Merge",
+  "portal.postDetail.metadata.mergeIntoAnother": "Merge into another...",
+  "portal.postDetail.metadata.mergeIntoThis": "Merge into this",
+  "portal.postDetail.metadata.restorePost": "Restore post",
   "portal.postDetail.metadata.roadmap": "Roadmap",
   "portal.postDetail.metadata.roadmapAdd": "Add",
-  "portal.postDetail.metadata.date": "Date",
   "portal.postDetail.metadata.source": "Source",
+  "portal.postDetail.metadata.sourceOpenIn": "Open in {name}",
   "portal.postDetail.metadata.sourceOriginalFeedback": "Original feedback",
   "portal.postDetail.metadata.sourceUnknownAuthor": "Unknown author",
-  "portal.postDetail.metadata.sourceOpenIn": "Open in {name}",
-  "portal.postDetail.metadata.author": "Author",
-  "portal.postDetail.metadata.authorFallback": "Anonymous",
+  "portal.postDetail.metadata.status": "Status",
   "portal.postDetail.metadata.subscribe": "Subscribe",
   "portal.postDetail.metadata.subscribeHint": "Get notified when there are updates to this post",
-  "portal.postDetail.metadata.manage": "Manage",
-  "portal.postDetail.metadata.managePost": "Manage post",
-  "portal.postDetail.metadata.merge": "Merge",
-  "portal.postDetail.metadata.mergeIntoThis": "Merge into this",
-  "portal.postDetail.metadata.mergeIntoAnother": "Merge into another...",
-  "portal.postDetail.metadata.lockComments": "Lock comments",
+  "portal.postDetail.metadata.tagAdd": "Add",
+  "portal.postDetail.metadata.tags": "Tags",
   "portal.postDetail.metadata.unlockComments": "Unlock comments",
-  "portal.postDetail.metadata.restorePost": "Restore post",
-  "portal.postDetail.metadata.deletePost": "Delete post",
-  "portal.postDetail.deleteDialog.title": "Delete Post",
-  "portal.postDetail.deleteDialog.description": "Are you sure you want to delete \"{title}\"? This action cannot be undone.",
-  "portal.postDetail.deleteDialog.confirmLabel": "Delete Post",
-  "portal.postDetail.deleteDialog.deleting": "Deleting...",
-  "portal.postDetail.deleteDialog.loading": "Loading...",
-  "portal.postDetail.deleteDialog.errorLinks": "Failed to load linked integrations. Please close and try again.",
+  "portal.postDetail.metadata.upvotes": "Upvotes",
   "portal.postDetail.notFound": "Post not found",
+  "portal.postDetail.postActions.ariaLabel": "Post actions",
+  "portal.postDetail.postActions.delete": "Delete",
+  "portal.postDetail.postActions.edit": "Edit",
+  "portal.postDetail.related": "Related",
   "portal.postDetail.commentsLocked": "Comments are locked on this post",
   "portal.changelog.title": "Changelog",
   "portal.changelog.description": "Stay up to date with the latest product updates and shipped features.",
@@ -205,44 +314,249 @@
   "portal.roadmap.empty.title": "No roadmaps available",
   "portal.roadmap.empty.description": "Check back later to see what we're working on.",
   "portal.roadmap.column.empty": "No items yet",
-  "portal.help.title": "Help Center",
-  "portal.help.description": "Find answers to your questions and learn how to get the most out of our product.",
-  "portal.help.categoryNotFound.title": "Category not found",
-  "portal.help.categoryNotFound.description": "This category may have been removed or does not exist.",
-  "portal.help.categoryNotFound.backLink": "Help Center",
-  "portal.help.articleNotFound.title": "Article not found",
-  "portal.help.articleNotFound.description": "This article may have been removed or is not yet published.",
-  "portal.help.articleNotFound.backLink": "Help Center",
-  "portal.notifications.title": "Notifications",
-  "portal.notifications.subtitle": "Updates on posts you've subscribed to",
-  "portal.notifications.markAllRead": "Mark all read",
-  "portal.notifications.readAll": "Read all",
-  "portal.notifications.groupToday": "Today",
-  "portal.notifications.groupYesterday": "Yesterday",
-  "portal.notifications.groupEarlier": "Earlier",
-  "portal.notifications.empty.title": "All caught up!",
-  "portal.notifications.empty.description": "Vote or comment on posts to subscribe. You'll get notified when there are status changes or new activity.",
-  "portal.settings.profile.title": "Profile",
-  "portal.settings.profile.description": "Manage your personal information",
-  "portal.settings.preferences.title": "Preferences",
-  "portal.settings.preferences.description": "Customize your experience",
-  "portal.settings.preferences.appearance.title": "Appearance",
+  "portal.roadmap.description": "See what we're working on and what's coming next.",
+  "portal.roadmap.empty.description": "Check back later to see what we're working on.",
+  "portal.roadmap.empty.title": "No roadmaps available",
+  "portal.roadmap.filter.category.board": "Board",
+  "portal.roadmap.filter.category.segment": "Segment",
+  "portal.roadmap.filter.category.tag": "Tag",
+  "portal.roadmap.filter.chip.board": "Board:",
+  "portal.roadmap.filter.chip.segment": "Segment:",
+  "portal.roadmap.filter.chip.tag": "Tag:",
+  "portal.roadmap.selector.aria": "Choose roadmap",
+  "portal.roadmap.selector.placeholder": "Select a roadmap…",
+  "portal.roadmap.selector.search": "Search roadmaps…",
+  "portal.roadmap.title": "Roadmap",
+  "portal.roadmap.toolbar.sortBy": "Sort by",
+  "portal.roadmap.toolbar.sortNewest": "Newest",
+  "portal.roadmap.toolbar.sortOldest": "Oldest",
+  "portal.roadmap.toolbar.sortVotes": "Most votes",
   "portal.settings.preferences.appearance.description": "Customize how the app looks",
   "portal.settings.preferences.appearance.themeLabel": "Theme",
-  "portal.settings.preferences.notifications.title": "Email Notifications",
+  "portal.settings.preferences.appearance.title": "Appearance",
+  "portal.settings.preferences.description": "Customize your experience",
   "portal.settings.preferences.notifications.description": "Manage email notifications for posts you're subscribed to",
+  "portal.settings.preferences.notifications.title": "Email Notifications",
+  "portal.settings.preferences.title": "Preferences",
+  "portal.settings.profile.description": "Manage your personal information",
+  "portal.settings.profile.title": "Profile",
   "portal.subscriptionBell.aria.subscribe": "Subscribe to notifications",
-  "portal.subscriptionBell.aria.subscribedStatusOnly": "Subscribed to status changes only",
   "portal.subscriptionBell.aria.subscribedAll": "Subscribed to all activity",
-  "portal.subscriptionBell.menu.title": "Notifications",
-  "portal.subscriptionBell.menu.subtitle": "Choose what to subscribe to",
+  "portal.subscriptionBell.aria.subscribedStatusOnly": "Subscribed to status changes only",
   "portal.subscriptionBell.level.all": "All activity",
   "portal.subscriptionBell.level.allHint": "Comments & status changes",
   "portal.subscriptionBell.level.statusOnly": "Status changes",
   "portal.subscriptionBell.level.statusOnlyHint": "When status is updated",
   "portal.subscriptionBell.level.unsubscribe": "Unsubscribe",
-  "portal.unsubscribeBanner.message": "You've been unsubscribed from this post. Use the bell icon to resubscribe.",
+  "portal.subscriptionBell.menu.subtitle": "Choose what to subscribe to",
+  "portal.subscriptionBell.menu.title": "Notifications",
+  "portal.tickets.composer.closed": "This ticket is closed. Open a new one to follow up.",
+  "portal.tickets.composer.placeholder": "Type your reply\u2026",
+  "portal.tickets.composer.send": "Send reply",
+  "portal.tickets.composer.sending": "Sending\u2026",
+  "portal.tickets.detail.back": "My tickets",
+  "portal.tickets.detail.description": "Description",
+  "portal.tickets.detail.edited": "edited",
+  "portal.tickets.detail.lastUpdate": "Last update {when}",
+  "portal.tickets.detail.noReplies": "No replies yet.",
+  "portal.tickets.detail.openedAt": "Opened {date}",
+  "portal.tickets.detail.supportTeam": "Support team",
+  "portal.tickets.detail.you": "You",
+  "portal.tickets.empty.description": "When our team handles a request from you, it'll appear here.",
+  "portal.tickets.empty.title": "No tickets yet",
+  "portal.tickets.filter.all": "All",
+  "portal.tickets.filter.closed": "Closed",
+  "portal.tickets.filter.open": "Open",
+  "portal.tickets.filter.pending": "Pending",
+  "portal.tickets.filter.solved": "Solved",
+  "portal.tickets.row.updated": "Updated {when}",
+  "portal.tickets.subtitle": "Tickets you opened or were added to.",
+  "portal.tickets.title": "My tickets",
   "portal.unsubscribeBanner.dismiss": "Dismiss",
+  "portal.unsubscribeBanner.message": "You've been unsubscribed from this post. Use the bell icon to resubscribe.",
+  "tickets.audience.internal": "Internal note",
+  "tickets.audience.public": "Public reply",
+  "tickets.audience.shared_team": "Shared with team",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "Email",
+  "tickets.channel.portal": "Portal",
+  "tickets.channel.widget": "Widget",
+  "tickets.notifications.assigned": "Assigned to you: {subject}",
+  "tickets.notifications.opened": "Ticket opened: {subject}",
+  "tickets.notifications.participantAdded": "Added to ticket: {subject}",
+  "tickets.notifications.participantRemoved": "Removed from ticket: {subject}",
+  "tickets.notifications.shared": "Ticket shared: {subject}",
+  "tickets.notifications.slaBreach": "SLA breached: {subject}",
+  "tickets.notifications.slaWarning": "SLA at risk: {subject}",
+  "tickets.notifications.statusChanged": "Status: {subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "New reply: {subject}",
+  "tickets.notifications.unassigned": "Unassigned: {subject}",
+  "tickets.notifications.unshared": "Ticket unshared: {subject}",
+  "tickets.priority.high": "High",
+  "tickets.priority.low": "Low",
+  "tickets.priority.normal": "Normal",
+  "tickets.priority.urgent": "Urgent",
+  "tickets.role.cc": "CC",
+  "tickets.role.collaborator": "Collaborator",
+  "tickets.role.watcher": "Watcher",
+  "tickets.scope.all": "All",
+  "tickets.scope.inbox": "Inbox",
+  "tickets.scope.my_assigned": "Assigned to me",
+  "tickets.scope.my_inbox": "My inbox",
+  "tickets.scope.my_team": "My team",
+  "tickets.scope.shared_with_me": "Shared with me",
+  "tickets.scope.unassigned": "Unassigned",
+  "tickets.share.comment": "Comment",
+  "tickets.share.full": "Full access",
+  "tickets.share.read": "Read",
+  "tickets.sla.kind.first_response": "First response",
+  "tickets.sla.kind.next_response": "Next response",
+  "tickets.sla.kind.resolution": "Resolution",
+  "tickets.sla.state.breached": "Breached",
+  "tickets.sla.state.cancelled": "Cancelled",
+  "tickets.sla.state.met": "Met",
+  "tickets.sla.state.paused": "Paused",
+  "tickets.sla.state.running": "Running",
+  "tickets.status.closed": "Closed",
+  "tickets.status.on_hold": "On hold",
+  "tickets.status.open": "Open",
+  "tickets.status.pending": "Pending",
+  "tickets.status.solved": "Solved",
+  "tickets.subscription.mute": "Mute",
+  "tickets.subscription.muted": "Muted",
+  "tickets.subscription.notify.assignment": "Assignment changes",
+  "tickets.subscription.notify.participants": "Participant changes",
+  "tickets.subscription.notify.shares": "Share grants",
+  "tickets.subscription.notify.sla": "SLA warnings & breaches",
+  "tickets.subscription.notify.status": "Status changes",
+  "tickets.subscription.notify.threads": "New replies",
+  "tickets.subscription.source.auto_assigned": "Auto (assignee)",
+  "tickets.subscription.source.auto_participant": "Auto (participant)",
+  "tickets.subscription.source.auto_team_member": "Auto (team member)",
+  "tickets.subscription.source.manual": "Manual",
+  "tickets.subscription.unmute": "Unmute",
+  "tickets.visibility.org": "Organization",
+  "tickets.visibility.private": "Private",
+  "tickets.visibility.shared": "Shared",
+  "tickets.visibility.team": "Team only",
+  "ui.combobox.empty": "No results found.",
+  "ui.combobox.placeholder": "Select…",
+  "ui.combobox.search": "Search…",
+  "widget.changelog.empty": "No updates yet",
+  "widget.changelog.emptyHint": "Check back soon for the latest product updates.",
+  "widget.changelog.loading": "Loading changelog...",
+  "widget.changelog.loadingMore": "Loading...",
+  "widget.changelogDetail.loading": "Loading...",
+  "widget.changelogDetail.notFound": "Entry not found",
+  "widget.commentForm.emailPlaceholder": "Email",
+  "widget.commentForm.errorEmail": "Could not verify email. Please try again.",
+  "widget.commentForm.namePlaceholder": "Name (optional)",
+  "widget.commentForm.placeholder": "Write a comment...",
+  "widget.commentForm.post": "Post",
+  "widget.commentForm.postingAs": "Posting as {name}",
+  "widget.commentList.authorFallback": "Anonymous",
+  "widget.commentList.cancel": "Cancel",
+  "widget.commentList.deleted": "[deleted]",
+  "widget.commentList.empty": "No comments yet. Be the first to share your thoughts!",
+  "widget.commentList.pinnedBadge": "Pinned",
+  "widget.commentList.post": "Post",
+  "widget.commentList.removed": "[removed]",
+  "widget.commentList.reply": "Reply",
+  "widget.commentList.replyPlaceholder": "Reply to {name}...",
+  "widget.commentList.teamBadge": "Team",
+  "widget.emailCapture.error": "Something went wrong. Please try again.",
+  "widget.emailCapture.heading": "Enter your email to continue",
+  "widget.emailCapture.placeholder": "you@example.com",
+  "widget.emailCapture.submit": "Go",
+  "widget.help.emptyHeading": "Search for help",
+  "widget.help.emptyHint": "Type a question or keyword above to find help articles.",
+  "widget.help.noResults": "No results found",
+  "widget.help.noResultsHint": "Try different keywords or browse categories.",
+  "widget.help.searchPlaceholder": "Search help articles...",
+  "widget.help.searching": "Searching...",
+  "widget.helpDetail.loading": "Loading...",
+  "widget.helpDetail.notFound": "Article not found",
+  "widget.home.form.cancel": "Cancel",
+  "widget.home.form.emailPlaceholder": "Your email",
+  "widget.home.form.errorEmail": "Could not verify your email. Please try again.",
+  "widget.home.form.errorNetwork": "Network error. Please try again.",
+  "widget.home.form.errorSession": "Could not create session. Please try again.",
+  "widget.home.form.namePlaceholder": "Name (optional)",
+  "widget.home.form.submit": "Submit",
+  "widget.home.form.submitting": "Submitting...",
+  "widget.home.input.details": "Add more details...",
+  "widget.home.input.placeholder": "What's your idea?",
+  "widget.home.popular.empty": "No ideas yet",
+  "widget.home.popular.emptyBoard": "No ideas in this board yet",
+  "widget.home.popular.emptyHint": "Be the first to share one!",
+  "widget.home.popular.heading": "Popular ideas",
+  "widget.home.popular.loading": "Loading...",
+  "widget.home.popular.search.aria": "Search ideas",
+  "widget.home.popular.search.noResults": "No ideas found",
+  "widget.home.popular.search.noResultsHint": "Try a different search term",
+  "widget.home.popular.search.placeholder": "Search ideas...",
+  "widget.home.popular.search.searching": "Searching...",
+  "widget.home.posting.emailRequired": "Your email is required",
+  "widget.home.posting.postingAnonymously": "Posting anonymously",
+  "widget.home.posting.postingAs": "Posting as {name}",
+  "widget.home.posting.postingTo": "Posting to",
+  "widget.home.posting.selectBoard": "Select a board",
+  "widget.home.scroll.ariaLeft": "Scroll left",
+  "widget.home.scroll.ariaRight": "Scroll right",
+  "widget.home.similar.heading": "Similar ideas",
+  "widget.postDetail.authorFallback": "Anonymous",
+  "widget.postDetail.comments": "{count, plural, one {# comment} other {# comments}}",
+  "widget.postDetail.commentsLocked": "Comments are locked on this post",
+  "widget.postDetail.error.couldNotLoad": "Could not load post",
+  "widget.postDetail.error.somethingWrong": "Something went wrong",
+  "widget.postDetail.loginToComment": "Log in to join the conversation",
+  "widget.postDetail.officialResponse": "Official response",
+  "widget.postDetail.teamAuthorFallback": "Team",
+  "widget.shell.aria.close": "Close feedback widget",
+  "widget.shell.aria.goBack": "Go back",
+  "widget.shell.aria.userMenu": "User menu",
+  "widget.shell.heading.changelog": "What's new",
+  "widget.shell.heading.feedback": "Share your ideas",
+  "widget.shell.heading.help": "Help Center",
+  "widget.shell.poweredBy": "Powered by {brand}",
+  "widget.shell.tab.changelog": "Changelog",
+  "widget.shell.tab.feedback": "Feedback",
+  "widget.shell.tab.help": "Help",
+  "widget.support.card.cta": "Open a ticket",
+  "widget.support.card.description": "Get help directly from our team.",
+  "widget.support.card.title": "Contact support",
+  "widget.support.composer.bodyPlaceholder": "Describe your issue...",
+  "widget.support.composer.emailPlaceholder": "Your email",
+  "widget.support.composer.errorCreate": "Could not create the ticket. Please try again.",
+  "widget.support.composer.errorEmail": "Could not verify your email. Please try again.",
+  "widget.support.composer.namePlaceholder": "Your name (optional)",
+  "widget.support.composer.priority.high": "High",
+  "widget.support.composer.priority.label": "Priority",
+  "widget.support.composer.priority.low": "Low",
+  "widget.support.composer.priority.normal": "Normal",
+  "widget.support.composer.subjectPlaceholder": "Subject",
+  "widget.support.composer.submit": "Send",
+  "widget.support.composer.submitting": "Sending...",
+  "widget.support.detail.errorLoad": "Could not load this ticket.",
+  "widget.support.detail.errorReopen": "Could not reopen this ticket.",
+  "widget.support.detail.errorReply": "Could not post your reply.",
+  "widget.support.detail.errorResolve": "Could not mark this ticket as resolved.",
+  "widget.support.detail.reopen": "Reopen",
+  "widget.support.detail.replyPlaceholder": "Type your reply...",
+  "widget.support.detail.replySend": "Reply",
+  "widget.support.detail.replySending": "Sending...",
+  "widget.support.detail.resolve": "Mark as resolved",
+  "widget.support.detail.resolved": "Resolved",
+  "widget.support.detail.threadEmpty": "No replies yet.",
+  "widget.support.detail.youLabel": "You",
+  "widget.support.list.empty": "You haven't opened any tickets yet.",
+  "widget.support.list.emptyAnonymous": "Sign in to view your tickets.",
+  "widget.support.list.errorLoad": "Could not load your tickets.",
+  "widget.support.list.heading": "Your tickets",
+  "widget.support.list.newTicket": "New ticket",
+  "widget.voteButton.ariaRemoveVote": "Remove vote ({count, plural, one {# vote} other {# votes}})",
+  "widget.voteButton.ariaVote": "Vote ({count, plural, one {# vote} other {# votes}})",
   "portal.pinnedComment.pinnedBadge": "Pinned",
   "portal.postCard.authorFallback": "Anonymous",
   "portal.postCard.editNotAllowed": "Edit not allowed",
diff --git a/apps/web/src/locales/es.json b/apps/web/src/locales/es.json
index 794ab7a7a..1c6d06fcd 100644
--- a/apps/web/src/locales/es.json
+++ b/apps/web/src/locales/es.json
@@ -1,6 +1,50 @@
 {
+  "portal.changelog.description": "Mantente al día con las últimas actualizaciones del producto y funcionalidades lanzadas.",
+  "portal.changelog.entryNotFound.backLink": "Novedades",
+  "portal.changelog.entryNotFound.description": "Esta entrada puede haber sido eliminada o aún no está publicada.",
+  "portal.changelog.entryNotFound.title": "Entrada no encontrada",
+  "portal.changelog.rssFeed": "Feed RSS",
+  "portal.changelog.title": "Novedades",
+  "portal.commentForm.authorFallback": "Anónimo/a",
+  "portal.commentForm.cancel": "Cancelar",
+  "portal.commentForm.clearStatusChange": "Deshacer cambio de estado",
+  "portal.commentForm.errorPost": "No se pudo publicar el comentario",
+  "portal.commentForm.labelSrOnly": "Tu comentario",
+  "portal.commentForm.noStatus": "Sin estado",
+  "portal.commentForm.placeholder": "Escribe un comentario...",
+  "portal.commentForm.postingAnonymously": "Comentando de forma anónima",
+  "portal.commentForm.postingAs": "Comentando como {name}",
+  "portal.commentForm.private": "Privado",
+  "portal.commentForm.privateLockedTooltip": "Las respuestas a comentarios privados siempre son privadas",
+  "portal.commentForm.privateOffTooltip": "Hacer este comentario privado (solo equipo)",
+  "portal.commentForm.privateOnTooltip": "Visible solo para miembros del equipo",
+  "portal.commentForm.reply": "Responder",
+  "portal.commentForm.signOut": "cerrar sesión",
+  "portal.commentForm.submit": "Comentar",
+  "portal.commentForm.submitWithStatus": "Comentar y marcar {statusName}",
+  "portal.commentForm.submitting": "Publicando...",
+  "portal.commentForm.updateStatus": "Actualizar estado",
+  "portal.commentThread.authorAlt": "Autor/a del comentario",
+  "portal.commentThread.authorFallback": "Anónimo/a",
+  "portal.commentThread.changedStatusTo": "cambió el estado a",
+  "portal.commentThread.delete": "Eliminar",
+  "portal.commentThread.deleted": "[eliminado]",
+  "portal.commentThread.deleting": "Eliminando...",
+  "portal.commentThread.empty": "Aún no hay comentarios. ¡Sé el primero en compartir tus ideas!",
+  "portal.commentThread.internalNote": "Nota interna",
+  "portal.commentThread.internalNoteHint": "visible solo para tu equipo",
+  "portal.commentThread.pin": "Fijar",
+  "portal.commentThread.pinnedBadge": "Fijado",
+  "portal.commentThread.removed": "[retirado]",
+  "portal.commentThread.reply": "Responder",
+  "portal.commentThread.restore": "Restaurar",
+  "portal.commentThread.restoring": "Restaurando...",
+  "portal.commentThread.signIn": "Iniciar sesión",
+  "portal.commentThread.signInToComment": "Inicia sesión para comentar",
+  "portal.commentThread.teamBadge": "Equipo",
+  "portal.commentThread.unpin": "Desfijar",
   "widget.shell.heading.feedback": "Comparte tus ideas",
-  "widget.shell.heading.help": "Ayuda y soporte",
+  "widget.shell.heading.help": "Centro de ayuda",
   "widget.shell.heading.changelog": "Novedades",
   "widget.shell.tab.feedback": "Feedback",
   "widget.shell.tab.changelog": "Novedades",
@@ -111,209 +155,231 @@
   "portal.header.theme.dark": "Oscuro",
   "portal.feedback.empty.comingSoonTitle": "Próximamente",
   "portal.feedback.empty.comingSoonDescription": "{orgName} está configurando su portal de feedback. Vuelve pronto para compartir tus ideas y sugerencias.",
-  "portal.feedback.list.noPostsFiltered": "Ninguna publicación coincide con tus filtros.",
-  "portal.feedback.list.noPostsYet": "Aún no hay publicaciones.",
-  "portal.feedback.header.postingTo": "Publicando en",
-  "portal.feedback.header.selectBoard": "Seleccionar una categoría",
-  "portal.feedback.header.titlePlaceholder": "¿Cuál es tu idea?",
-  "portal.feedback.header.detailsPlaceholder": "Añade más detalles... Escribe / para comandos",
-  "portal.feedback.header.postingAs": "Publicando como",
-  "portal.feedback.header.signOut": "cerrar sesión",
-  "portal.feedback.header.postingAnonymously": "Publicando de forma anónima",
-  "portal.feedback.header.signInToPost": "Inicia sesión para publicar",
+  "portal.feedback.filter.addFilter": "Añadir filtro",
+  "portal.feedback.filter.back": "Volver",
+  "portal.feedback.filter.category.board": "Tablero",
+  "portal.feedback.filter.category.date": "Fecha de creación",
+  "portal.feedback.filter.category.response": "Respuesta del equipo",
+  "portal.feedback.filter.category.status": "Estado",
+  "portal.feedback.filter.category.tag": "Etiqueta",
+  "portal.feedback.filter.category.votes": "Número de votos",
+  "portal.feedback.filter.chip.board": "Tablero:",
+  "portal.feedback.filter.chip.date": "Fecha:",
+  "portal.feedback.filter.chip.response": "Respuesta del equipo:",
+  "portal.feedback.filter.chip.status": "Estado:",
+  "portal.feedback.filter.chip.tag": "Etiqueta:",
+  "portal.feedback.filter.chip.tags": "Etiquetas:",
+  "portal.feedback.filter.chip.votes": "Votos mínimos:",
+  "portal.feedback.filter.clearAll": "Borrar todo",
+  "portal.feedback.filter.statusGroup.active": "Activo",
+  "portal.feedback.filter.statusGroup.closed": "Cerrado",
+  "portal.feedback.filter.statusGroup.complete": "Completado",
   "portal.feedback.header.cancel": "Cancelar",
-  "portal.feedback.header.submit": "Enviar",
-  "portal.feedback.header.submitting": "Enviando...",
-  "portal.feedback.header.errorSelectBoard": "Selecciona una categoría",
+  "portal.feedback.header.detailsPlaceholder": "Añade más detalles... Escribe / para comandos",
   "portal.feedback.header.errorAddTitle": "Añade un título",
-  "portal.feedback.header.errorSignIn": "Inicia sesión para enviar feedback",
+  "portal.feedback.header.errorSelectBoard": "Selecciona una categoría",
   "portal.feedback.header.errorSession": "No se pudo crear la sesión",
+  "portal.feedback.header.errorSignIn": "Inicia sesión para enviar feedback",
   "portal.feedback.header.errorSubmit": "No se pudo enviar el feedback",
+  "portal.feedback.header.postingAnonymously": "Publicando de forma anónima",
+  "portal.feedback.header.postingAs": "Publicando como",
+  "portal.feedback.header.postingTo": "Publicando en",
+  "portal.feedback.header.selectBoard": "Seleccionar una categoría",
+  "portal.feedback.header.signInToPost": "Inicia sesión para publicar",
+  "portal.feedback.header.signOut": "cerrar sesión",
+  "portal.feedback.header.submit": "Enviar",
   "portal.feedback.header.submitTooltipSignIn": "Inicia sesión para enviar feedback",
+  "portal.feedback.header.submitting": "Enviando...",
+  "portal.feedback.header.titlePlaceholder": "¿Cuál es tu idea?",
   "portal.feedback.header.toastSubmitted": "Feedback enviado",
   "portal.feedback.header.toastView": "Ver",
-  "portal.feedback.toolbar.sortTop": "Top",
-  "portal.feedback.toolbar.sortNew": "Reciente",
-  "portal.feedback.toolbar.sortTrending": "Tendencias",
-  "portal.feedback.toolbar.search": "Buscar",
-  "portal.feedback.toolbar.searchPlaceholder": "Buscar publicaciones...",
-  "portal.feedback.toolbar.searchSubmit": "Buscar",
-  "portal.feedback.toolbar.clearSearch": "Borrar búsqueda",
-  "portal.feedback.filter.clearAll": "Borrar todo",
+  "portal.feedback.list.noPostsFiltered": "Ninguna publicación coincide con tus filtros.",
+  "portal.feedback.list.noPostsYet": "Aún no hay publicaciones.",
   "portal.feedback.sidebar.boards": "Categorías",
-  "portal.feedback.sidebar.viewAllPosts": "Ver todas las publicaciones",
   "portal.feedback.sidebar.poweredBy": "Desarrollado con {brand}",
+  "portal.feedback.sidebar.viewAllPosts": "Ver todas las publicaciones",
   "portal.feedback.similarPosts.heading": "Ideas similares",
+  "portal.feedback.toolbar.clearSearch": "Borrar búsqueda",
+  "portal.feedback.toolbar.filter": "Filtrar",
+  "portal.feedback.toolbar.search": "Buscar",
+  "portal.feedback.toolbar.searchPlaceholder": "Buscar publicaciones...",
+  "portal.feedback.toolbar.searchSubmit": "Buscar",
+  "portal.feedback.toolbar.sortNew": "Reciente",
+  "portal.feedback.toolbar.sortTop": "Top",
+  "portal.feedback.toolbar.sortTrending": "Tendencias",
+  "portal.help.articleNotFound.backLink": "Centro de ayuda",
+  "portal.help.articleNotFound.description": "Este artículo puede haber sido eliminado o aún no está publicado.",
+  "portal.help.articleNotFound.title": "Artículo no encontrado",
+  "portal.help.categoryNotFound.backLink": "Centro de ayuda",
+  "portal.help.categoryNotFound.description": "Esta categoría puede haber sido eliminada o no existe.",
+  "portal.help.categoryNotFound.title": "Categoría no encontrada",
+  "portal.help.description": "Encuentra respuestas a tus preguntas y aprende a sacar el máximo partido a nuestro producto.",
+  "portal.help.title": "Centro de ayuda",
+  "portal.notifications.empty.description": "Vota o comenta en publicaciones para suscribirte. Recibirás notificaciones cuando haya cambios de estado o nueva actividad.",
+  "portal.notifications.empty.title": "¡Estás al día!",
+  "portal.notifications.groupEarlier": "Anteriores",
+  "portal.notifications.groupToday": "Hoy",
+  "portal.notifications.groupYesterday": "Ayer",
+  "portal.notifications.markAllRead": "Marcar todo como leído",
+  "portal.notifications.readAll": "Leer todo",
+  "portal.notifications.subtitle": "Actualizaciones sobre publicaciones a las que te has suscrito",
+  "portal.notifications.title": "Notificaciones",
+  "portal.pinnedComment.pinnedBadge": "Fijado",
+  "portal.postCard.authorFallback": "Anónimo/a",
+  "portal.postCard.deleteNotAllowed": "Eliminación no permitida",
+  "portal.postCard.editNotAllowed": "Edición no permitida",
+  "portal.postCard.quickActions.copyLink": "Copiar enlace",
+  "portal.postCard.quickActions.delete": "Eliminar",
+  "portal.postCard.quickActions.edit": "Editar",
+  "portal.postCard.quickActions.options": "Opciones de la publicación",
+  "portal.postCard.quickActions.viewInPortal": "Ver en el portal",
+  "portal.postCard.toast.linkCopied": "Enlace copiado al portapapeles",
+  "portal.postCard.toast.linkCopyFailed": "No se pudo copiar el enlace",
+  "portal.postCard.vote.ariaRemoveVote": "Quitar voto ({count, plural, one {# voto} other {# votos}})",
+  "portal.postCard.vote.ariaVote": "Votar por esta publicación ({count, plural, one {# voto} other {# votos}})",
   "portal.postDetail.comments": "{count, plural, one {# comentario} other {# comentarios}}",
-  "portal.postDetail.postActions.ariaLabel": "Acciones de la publicación",
-  "portal.postDetail.postActions.edit": "Editar",
-  "portal.postDetail.postActions.delete": "Eliminar",
-  "portal.postDetail.edit.titlePlaceholder": "¿Cuál es tu idea?",
-  "portal.postDetail.edit.detailsPlaceholder": "Añade más detalles... Escribe / para comandos",
+  "portal.postDetail.commentsLocked": "Los comentarios están bloqueados en esta publicación",
+  "portal.postDetail.deleteDialog.confirmLabel": "Eliminar publicación",
+  "portal.postDetail.deleteDialog.deleting": "Eliminando...",
+  "portal.postDetail.deleteDialog.description": "¿Seguro que quieres eliminar «{title}»? Esta acción no se puede deshacer.",
+  "portal.postDetail.deleteDialog.errorLinks": "No se pudieron cargar las integraciones vinculadas. Cierra e inténtalo de nuevo.",
+  "portal.postDetail.deleteDialog.loading": "Cargando...",
+  "portal.postDetail.deleteDialog.title": "Eliminar publicación",
   "portal.postDetail.edit.cancel": "Cancelar",
+  "portal.postDetail.edit.detailsPlaceholder": "Añade más detalles... Escribe / para comandos",
   "portal.postDetail.edit.save": "Guardar",
   "portal.postDetail.edit.saving": "Guardando...",
-  "portal.postDetail.related": "Relacionados",
+  "portal.postDetail.edit.titlePlaceholder": "¿Cuál es tu idea?",
   "portal.postDetail.mergeBanner.mergedInto": "Este feedback se ha fusionado con",
   "portal.postDetail.mergeBanner.votesCount": "Los votos y la actividad ahora cuentan para el elemento vinculado.",
-  "portal.postDetail.metadata.upvotes": "Votos positivos",
-  "portal.postDetail.metadata.status": "Estado",
+  "portal.postDetail.metadata.author": "Autor/a",
+  "portal.postDetail.metadata.authorFallback": "Anónimo/a",
   "portal.postDetail.metadata.board": "Categoría",
-  "portal.postDetail.metadata.tags": "Etiquetas",
-  "portal.postDetail.metadata.tagAdd": "Añadir",
+  "portal.postDetail.metadata.date": "Fecha",
+  "portal.postDetail.metadata.deletePost": "Eliminar publicación",
+  "portal.postDetail.metadata.lockComments": "Bloquear comentarios",
+  "portal.postDetail.metadata.manage": "Gestionar",
+  "portal.postDetail.metadata.managePost": "Gestionar publicación",
+  "portal.postDetail.metadata.merge": "Fusionar",
+  "portal.postDetail.metadata.mergeIntoAnother": "Fusionar en otra...",
+  "portal.postDetail.metadata.mergeIntoThis": "Fusionar en esta",
+  "portal.postDetail.metadata.restorePost": "Restaurar publicación",
   "portal.postDetail.metadata.roadmap": "Roadmap",
   "portal.postDetail.metadata.roadmapAdd": "Añadir",
-  "portal.postDetail.metadata.date": "Fecha",
   "portal.postDetail.metadata.source": "Origen",
+  "portal.postDetail.metadata.sourceOpenIn": "Abrir en {name}",
   "portal.postDetail.metadata.sourceOriginalFeedback": "Feedback original",
   "portal.postDetail.metadata.sourceUnknownAuthor": "Autor/a desconocido/a",
-  "portal.postDetail.metadata.sourceOpenIn": "Abrir en {name}",
-  "portal.postDetail.metadata.author": "Autor/a",
-  "portal.postDetail.metadata.authorFallback": "Anónimo/a",
+  "portal.postDetail.metadata.status": "Estado",
   "portal.postDetail.metadata.subscribe": "Suscribirse",
   "portal.postDetail.metadata.subscribeHint": "Recibe notificaciones cuando haya actualizaciones en esta publicación",
-  "portal.postDetail.metadata.manage": "Gestionar",
-  "portal.postDetail.metadata.managePost": "Gestionar publicación",
-  "portal.postDetail.metadata.merge": "Fusionar",
-  "portal.postDetail.metadata.mergeIntoThis": "Fusionar en esta",
-  "portal.postDetail.metadata.mergeIntoAnother": "Fusionar en otra...",
-  "portal.postDetail.metadata.lockComments": "Bloquear comentarios",
+  "portal.postDetail.metadata.tagAdd": "Añadir",
+  "portal.postDetail.metadata.tags": "Etiquetas",
   "portal.postDetail.metadata.unlockComments": "Desbloquear comentarios",
-  "portal.postDetail.metadata.restorePost": "Restaurar publicación",
-  "portal.postDetail.metadata.deletePost": "Eliminar publicación",
-  "portal.postDetail.deleteDialog.title": "Eliminar publicación",
-  "portal.postDetail.deleteDialog.description": "¿Seguro que quieres eliminar «{title}»? Esta acción no se puede deshacer.",
-  "portal.postDetail.deleteDialog.confirmLabel": "Eliminar publicación",
-  "portal.postDetail.deleteDialog.deleting": "Eliminando...",
-  "portal.postDetail.deleteDialog.loading": "Cargando...",
-  "portal.postDetail.deleteDialog.errorLinks": "No se pudieron cargar las integraciones vinculadas. Cierra e inténtalo de nuevo.",
+  "portal.postDetail.metadata.upvotes": "Votos positivos",
   "portal.postDetail.notFound": "Publicación no encontrada",
-  "portal.postDetail.commentsLocked": "Los comentarios están bloqueados en esta publicación",
-  "portal.changelog.title": "Novedades",
-  "portal.changelog.description": "Mantente al día con las últimas actualizaciones del producto y funcionalidades lanzadas.",
-  "portal.changelog.rssFeed": "Feed RSS",
+  "portal.postDetail.postActions.ariaLabel": "Acciones de la publicación",
+  "portal.postDetail.postActions.delete": "Eliminar",
+  "portal.postDetail.postActions.edit": "Editar",
+  "portal.postDetail.related": "Relacionados",
   "portal.changelog.loading": "Cargando novedades...",
   "portal.changelog.loadMore": "Cargar más",
   "portal.changelog.loadingMore": "Cargando...",
   "portal.changelog.empty.title": "Aún no hay novedades",
   "portal.changelog.empty.description": "Vuelve pronto para ver las últimas actualizaciones del producto y las funcionalidades lanzadas.",
-  "portal.changelog.entryNotFound.title": "Entrada no encontrada",
-  "portal.changelog.entryNotFound.description": "Esta entrada puede haber sido eliminada o aún no está publicada.",
-  "portal.changelog.entryNotFound.backLink": "Novedades",
   "portal.roadmap.title": "Roadmap",
   "portal.roadmap.description": "Consulta en qué estamos trabajando y qué viene a continuación.",
   "portal.roadmap.empty.title": "No hay roadmaps disponibles",
   "portal.roadmap.empty.description": "Vuelve más tarde para ver en qué estamos trabajando.",
   "portal.roadmap.column.empty": "Aún no hay elementos",
-  "portal.help.title": "Centro de ayuda",
-  "portal.help.description": "Encuentra respuestas a tus preguntas y aprende a sacar el máximo partido a nuestro producto.",
-  "portal.help.categoryNotFound.title": "Categoría no encontrada",
-  "portal.help.categoryNotFound.description": "Esta categoría puede haber sido eliminada o no existe.",
-  "portal.help.categoryNotFound.backLink": "Centro de ayuda",
-  "portal.help.articleNotFound.title": "Artículo no encontrado",
-  "portal.help.articleNotFound.description": "Este artículo puede haber sido eliminado o aún no está publicado.",
-  "portal.help.articleNotFound.backLink": "Centro de ayuda",
-  "portal.notifications.title": "Notificaciones",
-  "portal.notifications.subtitle": "Actualizaciones sobre publicaciones a las que te has suscrito",
-  "portal.notifications.markAllRead": "Marcar todo como leído",
-  "portal.notifications.readAll": "Leer todo",
-  "portal.notifications.groupToday": "Hoy",
-  "portal.notifications.groupYesterday": "Ayer",
-  "portal.notifications.groupEarlier": "Anteriores",
-  "portal.notifications.empty.title": "¡Estás al día!",
-  "portal.notifications.empty.description": "Vota o comenta en publicaciones para suscribirte. Recibirás notificaciones cuando haya cambios de estado o nueva actividad.",
-  "portal.settings.profile.title": "Perfil",
-  "portal.settings.profile.description": "Gestiona tu información personal",
-  "portal.settings.preferences.title": "Preferencias",
-  "portal.settings.preferences.description": "Personaliza tu experiencia",
-  "portal.settings.preferences.appearance.title": "Apariencia",
   "portal.settings.preferences.appearance.description": "Personaliza el aspecto de la aplicación",
   "portal.settings.preferences.appearance.themeLabel": "Tema",
-  "portal.settings.preferences.notifications.title": "Notificaciones por correo electrónico",
+  "portal.settings.preferences.appearance.title": "Apariencia",
+  "portal.settings.preferences.description": "Personaliza tu experiencia",
   "portal.settings.preferences.notifications.description": "Gestiona las notificaciones por correo electrónico de las publicaciones a las que te has suscrito",
+  "portal.settings.preferences.notifications.title": "Notificaciones por correo electrónico",
+  "portal.settings.preferences.title": "Preferencias",
+  "portal.settings.profile.description": "Gestiona tu información personal",
+  "portal.settings.profile.title": "Perfil",
   "portal.subscriptionBell.aria.subscribe": "Suscribirse a notificaciones",
-  "portal.subscriptionBell.aria.subscribedStatusOnly": "Suscrito/a solo a cambios de estado",
   "portal.subscriptionBell.aria.subscribedAll": "Suscrito/a a toda la actividad",
-  "portal.subscriptionBell.menu.title": "Notificaciones",
-  "portal.subscriptionBell.menu.subtitle": "Elige a qué suscribirte",
+  "portal.subscriptionBell.aria.subscribedStatusOnly": "Suscrito/a solo a cambios de estado",
   "portal.subscriptionBell.level.all": "Toda la actividad",
   "portal.subscriptionBell.level.allHint": "Comentarios y cambios de estado",
   "portal.subscriptionBell.level.statusOnly": "Cambios de estado",
   "portal.subscriptionBell.level.statusOnlyHint": "Cuando se actualiza el estado",
   "portal.subscriptionBell.level.unsubscribe": "Cancelar suscripción",
-  "portal.unsubscribeBanner.message": "Te has dado de baja de esta publicación. Usa el icono de campana para volver a suscribirte.",
+  "portal.subscriptionBell.menu.subtitle": "Elige a qué suscribirte",
+  "portal.subscriptionBell.menu.title": "Notificaciones",
   "portal.unsubscribeBanner.dismiss": "Cerrar",
-  "portal.pinnedComment.pinnedBadge": "Fijado",
-  "portal.postCard.authorFallback": "Anónimo/a",
-  "portal.postCard.editNotAllowed": "Edición no permitida",
-  "portal.postCard.deleteNotAllowed": "Eliminación no permitida",
-  "portal.postCard.quickActions.viewInPortal": "Ver en el portal",
-  "portal.postCard.quickActions.copyLink": "Copiar enlace",
-  "portal.postCard.quickActions.edit": "Editar",
-  "portal.postCard.quickActions.delete": "Eliminar",
-  "portal.postCard.quickActions.options": "Opciones de la publicación",
-  "portal.postCard.vote.ariaVote": "Votar por esta publicación ({count, plural, one {# voto} other {# votos}})",
-  "portal.postCard.vote.ariaRemoveVote": "Quitar voto ({count, plural, one {# voto} other {# votos}})",
-  "portal.postCard.toast.linkCopied": "Enlace copiado al portapapeles",
-  "portal.postCard.toast.linkCopyFailed": "No se pudo copiar el enlace",
-  "portal.commentThread.empty": "Aún no hay comentarios. ¡Sé el primero en compartir tus ideas!",
-  "portal.commentThread.signInToComment": "Inicia sesión para comentar",
-  "portal.commentThread.signIn": "Iniciar sesión",
-  "portal.commentThread.deleted": "[eliminado]",
-  "portal.commentThread.removed": "[retirado]",
-  "portal.commentThread.authorFallback": "Anónimo/a",
-  "portal.commentThread.authorAlt": "Autor/a del comentario",
-  "portal.commentThread.teamBadge": "Equipo",
-  "portal.commentThread.internalNote": "Nota interna",
-  "portal.commentThread.internalNoteHint": "visible solo para tu equipo",
-  "portal.commentThread.pinnedBadge": "Fijado",
-  "portal.commentThread.changedStatusTo": "cambió el estado a",
-  "portal.commentThread.reply": "Responder",
-  "portal.commentThread.pin": "Fijar",
-  "portal.commentThread.unpin": "Desfijar",
-  "portal.commentThread.restore": "Restaurar",
-  "portal.commentThread.restoring": "Restaurando...",
-  "portal.commentThread.delete": "Eliminar",
-  "portal.commentThread.deleting": "Eliminando...",
-  "portal.commentForm.labelSrOnly": "Tu comentario",
-  "portal.commentForm.placeholder": "Escribe un comentario...",
-  "portal.commentForm.authorFallback": "Anónimo/a",
-  "portal.commentForm.noStatus": "Sin estado",
-  "portal.commentForm.updateStatus": "Actualizar estado",
-  "portal.commentForm.clearStatusChange": "Deshacer cambio de estado",
-  "portal.commentForm.postingAnonymously": "Comentando de forma anónima",
-  "portal.commentForm.postingAs": "Comentando como {name}",
-  "portal.commentForm.signOut": "cerrar sesión",
-  "portal.commentForm.cancel": "Cancelar",
-  "portal.commentForm.private": "Privado",
-  "portal.commentForm.privateLockedTooltip": "Las respuestas a comentarios privados siempre son privadas",
-  "portal.commentForm.privateOnTooltip": "Visible solo para miembros del equipo",
-  "portal.commentForm.privateOffTooltip": "Hacer este comentario privado (solo equipo)",
-  "portal.commentForm.submit": "Comentar",
-  "portal.commentForm.submitWithStatus": "Comentar y marcar {statusName}",
-  "portal.commentForm.reply": "Responder",
-  "portal.commentForm.submitting": "Publicando...",
-  "portal.commentForm.errorPost": "No se pudo publicar el comentario",
-  "portal.feedback.filter.addFilter": "Añadir filtro",
-  "portal.feedback.filter.back": "Volver",
-  "portal.feedback.filter.category.board": "Tablero",
-  "portal.feedback.filter.category.status": "Estado",
-  "portal.feedback.filter.category.tag": "Etiqueta",
-  "portal.feedback.filter.category.votes": "Número de votos",
-  "portal.feedback.filter.category.date": "Fecha de creación",
-  "portal.feedback.filter.category.response": "Respuesta del equipo",
-  "portal.feedback.filter.statusGroup.active": "Activo",
-  "portal.feedback.filter.statusGroup.complete": "Completado",
-  "portal.feedback.filter.statusGroup.closed": "Cerrado",
-  "portal.feedback.filter.chip.board": "Tablero:",
-  "portal.feedback.filter.chip.status": "Estado:",
-  "portal.feedback.filter.chip.tag": "Etiqueta:",
-  "portal.feedback.filter.chip.tags": "Etiquetas:",
-  "portal.feedback.filter.chip.votes": "Votos mínimos:",
-  "portal.feedback.filter.chip.date": "Fecha:",
-  "portal.feedback.filter.chip.response": "Respuesta del equipo:",
+  "portal.unsubscribeBanner.message": "Te has dado de baja de esta publicación. Usa el icono de campana para volver a suscribirte.",
+  "tickets.audience.internal": "Internal note",
+  "tickets.audience.public": "Public reply",
+  "tickets.audience.shared_team": "Shared with team",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "Email",
+  "tickets.channel.portal": "Portal",
+  "tickets.channel.widget": "Widget",
+  "tickets.notifications.assigned": "Assigned to you: {subject}",
+  "tickets.notifications.opened": "Ticket opened: {subject}",
+  "tickets.notifications.participantAdded": "Added to ticket: {subject}",
+  "tickets.notifications.participantRemoved": "Removed from ticket: {subject}",
+  "tickets.notifications.shared": "Ticket shared: {subject}",
+  "tickets.notifications.slaBreach": "SLA breached: {subject}",
+  "tickets.notifications.slaWarning": "SLA at risk: {subject}",
+  "tickets.notifications.statusChanged": "Status: {subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "New reply: {subject}",
+  "tickets.notifications.unassigned": "Unassigned: {subject}",
+  "tickets.notifications.unshared": "Ticket unshared: {subject}",
+  "tickets.priority.high": "High",
+  "tickets.priority.low": "Low",
+  "tickets.priority.normal": "Normal",
+  "tickets.priority.urgent": "Urgent",
+  "tickets.role.cc": "CC",
+  "tickets.role.collaborator": "Collaborator",
+  "tickets.role.watcher": "Watcher",
+  "tickets.scope.all": "All",
+  "tickets.scope.inbox": "Inbox",
+  "tickets.scope.my_assigned": "Assigned to me",
+  "tickets.scope.my_inbox": "My inbox",
+  "tickets.scope.my_team": "My team",
+  "tickets.scope.shared_with_me": "Shared with me",
+  "tickets.scope.unassigned": "Unassigned",
+  "tickets.share.comment": "Comment",
+  "tickets.share.full": "Full access",
+  "tickets.share.read": "Read",
+  "tickets.sla.kind.first_response": "First response",
+  "tickets.sla.kind.next_response": "Next response",
+  "tickets.sla.kind.resolution": "Resolution",
+  "tickets.sla.state.breached": "Breached",
+  "tickets.sla.state.cancelled": "Cancelled",
+  "tickets.sla.state.met": "Met",
+  "tickets.sla.state.paused": "Paused",
+  "tickets.sla.state.running": "Running",
+  "tickets.status.closed": "Closed",
+  "tickets.status.on_hold": "On hold",
+  "tickets.status.open": "Open",
+  "tickets.status.pending": "Pending",
+  "tickets.status.solved": "Solved",
+  "tickets.subscription.mute": "Mute",
+  "tickets.subscription.muted": "Muted",
+  "tickets.subscription.notify.assignment": "Assignment changes",
+  "tickets.subscription.notify.participants": "Participant changes",
+  "tickets.subscription.notify.shares": "Share grants",
+  "tickets.subscription.notify.sla": "SLA warnings & breaches",
+  "tickets.subscription.notify.status": "Status changes",
+  "tickets.subscription.notify.threads": "New replies",
+  "tickets.subscription.source.auto_assigned": "Auto (assignee)",
+  "tickets.subscription.source.auto_participant": "Auto (participant)",
+  "tickets.subscription.source.auto_team_member": "Auto (team member)",
+  "tickets.subscription.source.manual": "Manual",
+  "tickets.subscription.unmute": "Unmute",
+  "tickets.visibility.org": "Organization",
+  "tickets.visibility.private": "Private",
+  "tickets.visibility.shared": "Shared",
+  "tickets.visibility.team": "Team only",
   "widget.home.posting.selectBoard": "Seleccionar una categoría",
-  "portal.feedback.toolbar.filter": "Filtrar",
   "portal.roadmap.toolbar.sortBy": "Ordenar por",
   "portal.roadmap.toolbar.sortVotes": "Más votos",
   "portal.roadmap.toolbar.sortNewest": "Más recientes",
@@ -441,5 +507,60 @@
   "portal.hc.contactSupport.body": "Inicia una conversación con nuestro equipo y te responderemos.",
   "portal.hc.contactSupport.cta": "Contactar con soporte",
   "portal.hc.articleFeedback.stillStuck": "¿Sigues atascado?",
-  "portal.hc.articleFeedback.contactSupport": "Contactar con soporte"
+  "portal.hc.articleFeedback.contactSupport": "Contactar con soporte",
+  "portal.header.nav.tickets": "Mis tickets",
+  "portal.tickets.title": "Mis tickets",
+  "portal.tickets.subtitle": "Tickets que has abierto o a los que te han añadido.",
+  "portal.tickets.empty.title": "Aún no hay tickets",
+  "portal.tickets.empty.description": "Cuando nuestro equipo gestione una solicitud tuya, aparecerá aquí.",
+  "portal.tickets.filter.all": "Todos",
+  "portal.tickets.filter.open": "Abiertos",
+  "portal.tickets.filter.pending": "Pendientes",
+  "portal.tickets.filter.solved": "Resueltos",
+  "portal.tickets.filter.closed": "Cerrados",
+  "portal.tickets.row.updated": "Actualizado {when}",
+  "portal.tickets.detail.back": "Mis tickets",
+  "portal.tickets.detail.description": "Descripción",
+  "portal.tickets.detail.openedAt": "Abierto {date}",
+  "portal.tickets.detail.lastUpdate": "Última actualización {when}",
+  "portal.tickets.detail.noReplies": "Aún no hay respuestas.",
+  "portal.tickets.detail.supportTeam": "Equipo de soporte",
+  "portal.tickets.detail.you": "Tú",
+  "portal.tickets.detail.edited": "editado",
+  "portal.tickets.composer.placeholder": "Escribe tu respuesta…",
+  "portal.tickets.composer.send": "Enviar respuesta",
+  "portal.tickets.composer.sending": "Enviando…",
+  "portal.tickets.composer.closed": "Este ticket está cerrado. Abre uno nuevo para hacer seguimiento.",
+  "widget.support.card.title": "Contactar con soporte",
+  "widget.support.card.description": "Recibe ayuda directamente de nuestro equipo.",
+  "widget.support.card.cta": "Abrir un ticket",
+  "widget.support.composer.subjectPlaceholder": "Asunto",
+  "widget.support.composer.bodyPlaceholder": "Describe tu problema...",
+  "widget.support.composer.namePlaceholder": "Tu nombre (opcional)",
+  "widget.support.composer.emailPlaceholder": "Tu correo electrónico",
+  "widget.support.composer.priority.label": "Prioridad",
+  "widget.support.composer.priority.low": "Baja",
+  "widget.support.composer.priority.normal": "Normal",
+  "widget.support.composer.priority.high": "Alta",
+  "widget.support.composer.submit": "Enviar",
+  "widget.support.composer.submitting": "Enviando...",
+  "widget.support.composer.errorCreate": "No se pudo crear el ticket. Inténtalo de nuevo.",
+  "widget.support.composer.errorEmail": "No se pudo verificar tu correo electrónico. Inténtalo de nuevo.",
+  "widget.support.list.heading": "Tus tickets",
+  "widget.support.list.newTicket": "Nuevo ticket",
+  "widget.support.list.empty": "Aún no has abierto ningún ticket.",
+  "widget.support.list.emptyAnonymous": "Inicia sesión para ver tus tickets.",
+  "widget.support.list.errorLoad": "No se pudieron cargar tus tickets.",
+  "widget.support.detail.errorLoad": "No se pudo cargar este ticket.",
+  "widget.support.detail.threadEmpty": "Aún no hay respuestas.",
+  "widget.support.detail.youLabel": "Tú",
+  "widget.support.detail.replyPlaceholder": "Escribe tu respuesta...",
+  "widget.support.detail.replySend": "Responder",
+  "widget.support.detail.replySending": "Enviando...",
+  "widget.support.detail.errorReply": "No se pudo publicar tu respuesta.",
+  "widget.support.detail.resolve": "Marcar como resuelto",
+  "widget.support.detail.resolved": "Resuelto",
+  "widget.support.detail.errorResolve": "No se pudo marcar este ticket como resuelto.",
+  "widget.support.detail.reopen": "Reabrir",
+  "widget.support.detail.errorReopen": "No se pudo reabrir este ticket."
 }
diff --git a/apps/web/src/locales/fr.json b/apps/web/src/locales/fr.json
index 1ff609f24..e320b43c4 100644
--- a/apps/web/src/locales/fr.json
+++ b/apps/web/src/locales/fr.json
@@ -1,6 +1,50 @@
 {
+  "portal.changelog.description": "Restez informé des dernières mises à jour produit et fonctionnalités livrées.",
+  "portal.changelog.entryNotFound.backLink": "Nouveautés",
+  "portal.changelog.entryNotFound.description": "Cette entrée a peut-être été supprimée ou n'est pas encore publiée.",
+  "portal.changelog.entryNotFound.title": "Entrée introuvable",
+  "portal.changelog.rssFeed": "Flux RSS",
+  "portal.changelog.title": "Nouveautés",
+  "portal.commentForm.authorFallback": "Anonyme",
+  "portal.commentForm.cancel": "Annuler",
+  "portal.commentForm.clearStatusChange": "Annuler le changement de statut",
+  "portal.commentForm.errorPost": "Impossible de publier le commentaire",
+  "portal.commentForm.labelSrOnly": "Votre commentaire",
+  "portal.commentForm.noStatus": "Aucun statut",
+  "portal.commentForm.placeholder": "Écrire un commentaire...",
+  "portal.commentForm.postingAnonymously": "Vous commentez de manière anonyme",
+  "portal.commentForm.postingAs": "Vous commentez en tant que {name}",
+  "portal.commentForm.private": "Privé",
+  "portal.commentForm.privateLockedTooltip": "Les réponses aux commentaires privés sont toujours privées",
+  "portal.commentForm.privateOffTooltip": "Rendre ce commentaire privé (équipe uniquement)",
+  "portal.commentForm.privateOnTooltip": "Visible uniquement par les membres de l'équipe",
+  "portal.commentForm.reply": "Répondre",
+  "portal.commentForm.signOut": "se déconnecter",
+  "portal.commentForm.submit": "Commenter",
+  "portal.commentForm.submitWithStatus": "Commenter et marquer {statusName}",
+  "portal.commentForm.submitting": "Envoi...",
+  "portal.commentForm.updateStatus": "Mettre à jour le statut",
+  "portal.commentThread.authorAlt": "Auteur du commentaire",
+  "portal.commentThread.authorFallback": "Anonyme",
+  "portal.commentThread.changedStatusTo": "a changé le statut en",
+  "portal.commentThread.delete": "Supprimer",
+  "portal.commentThread.deleted": "[supprimé]",
+  "portal.commentThread.deleting": "Suppression...",
+  "portal.commentThread.empty": "Aucun commentaire pour le moment. Soyez le premier à partager vos réflexions !",
+  "portal.commentThread.internalNote": "Note interne",
+  "portal.commentThread.internalNoteHint": "visible uniquement par votre équipe",
+  "portal.commentThread.pin": "Épingler",
+  "portal.commentThread.pinnedBadge": "Épinglé",
+  "portal.commentThread.removed": "[retiré]",
+  "portal.commentThread.reply": "Répondre",
+  "portal.commentThread.restore": "Restaurer",
+  "portal.commentThread.restoring": "Restauration...",
+  "portal.commentThread.signIn": "Se connecter",
+  "portal.commentThread.signInToComment": "Connectez-vous pour commenter",
+  "portal.commentThread.teamBadge": "Équipe",
+  "portal.commentThread.unpin": "Désépingler",
   "widget.shell.heading.feedback": "Partagez vos idées",
-  "widget.shell.heading.help": "Aide et assistance",
+  "widget.shell.heading.help": "Centre d'aide",
   "widget.shell.heading.changelog": "Nouveautés",
   "widget.shell.tab.feedback": "Feedback",
   "widget.shell.tab.changelog": "Nouveautés",
@@ -111,209 +155,231 @@
   "portal.header.theme.dark": "Sombre",
   "portal.feedback.empty.comingSoonTitle": "Bientôt disponible",
   "portal.feedback.empty.comingSoonDescription": "{orgName} prépare son portail de feedback. Revenez bientôt pour partager vos idées et suggestions.",
-  "portal.feedback.list.noPostsFiltered": "Aucune publication ne correspond à vos filtres.",
-  "portal.feedback.list.noPostsYet": "Aucune publication pour le moment.",
-  "portal.feedback.header.postingTo": "Publier dans",
-  "portal.feedback.header.selectBoard": "Sélectionner une catégorie",
-  "portal.feedback.header.titlePlaceholder": "Quelle est votre idée ?",
-  "portal.feedback.header.detailsPlaceholder": "Ajoutez plus de détails... Tapez / pour les commandes",
-  "portal.feedback.header.postingAs": "Vous publiez en tant que",
-  "portal.feedback.header.signOut": "se déconnecter",
-  "portal.feedback.header.postingAnonymously": "Vous publiez de manière anonyme",
-  "portal.feedback.header.signInToPost": "Connectez-vous pour publier",
+  "portal.feedback.filter.addFilter": "Ajouter un filtre",
+  "portal.feedback.filter.back": "Retour",
+  "portal.feedback.filter.category.board": "Tableau",
+  "portal.feedback.filter.category.date": "Date de création",
+  "portal.feedback.filter.category.response": "Réponse de l'équipe",
+  "portal.feedback.filter.category.status": "Statut",
+  "portal.feedback.filter.category.tag": "Tag",
+  "portal.feedback.filter.category.votes": "Nombre de votes",
+  "portal.feedback.filter.chip.board": "Tableau :",
+  "portal.feedback.filter.chip.date": "Date :",
+  "portal.feedback.filter.chip.response": "Réponse de l'équipe :",
+  "portal.feedback.filter.chip.status": "Statut :",
+  "portal.feedback.filter.chip.tag": "Tag :",
+  "portal.feedback.filter.chip.tags": "Tags :",
+  "portal.feedback.filter.chip.votes": "Votes min. :",
+  "portal.feedback.filter.clearAll": "Tout effacer",
+  "portal.feedback.filter.statusGroup.active": "Actif",
+  "portal.feedback.filter.statusGroup.closed": "Fermé",
+  "portal.feedback.filter.statusGroup.complete": "Terminé",
   "portal.feedback.header.cancel": "Annuler",
-  "portal.feedback.header.submit": "Envoyer",
-  "portal.feedback.header.submitting": "Envoi en cours...",
-  "portal.feedback.header.errorSelectBoard": "Veuillez sélectionner une catégorie",
+  "portal.feedback.header.detailsPlaceholder": "Ajoutez plus de détails... Tapez / pour les commandes",
   "portal.feedback.header.errorAddTitle": "Veuillez ajouter un titre",
-  "portal.feedback.header.errorSignIn": "Veuillez vous connecter pour soumettre un feedback",
+  "portal.feedback.header.errorSelectBoard": "Veuillez sélectionner une catégorie",
   "portal.feedback.header.errorSession": "Impossible de créer la session",
+  "portal.feedback.header.errorSignIn": "Veuillez vous connecter pour soumettre un feedback",
   "portal.feedback.header.errorSubmit": "Impossible de soumettre le feedback",
+  "portal.feedback.header.postingAnonymously": "Vous publiez de manière anonyme",
+  "portal.feedback.header.postingAs": "Vous publiez en tant que",
+  "portal.feedback.header.postingTo": "Publier dans",
+  "portal.feedback.header.selectBoard": "Sélectionner une catégorie",
+  "portal.feedback.header.signInToPost": "Connectez-vous pour publier",
+  "portal.feedback.header.signOut": "se déconnecter",
+  "portal.feedback.header.submit": "Envoyer",
   "portal.feedback.header.submitTooltipSignIn": "Veuillez vous connecter pour soumettre un feedback",
+  "portal.feedback.header.submitting": "Envoi en cours...",
+  "portal.feedback.header.titlePlaceholder": "Quelle est votre idée ?",
   "portal.feedback.header.toastSubmitted": "Feedback envoyé",
   "portal.feedback.header.toastView": "Voir",
-  "portal.feedback.toolbar.sortTop": "Top",
-  "portal.feedback.toolbar.sortNew": "Récent",
-  "portal.feedback.toolbar.sortTrending": "Tendances",
-  "portal.feedback.toolbar.search": "Rechercher",
-  "portal.feedback.toolbar.searchPlaceholder": "Rechercher des publications...",
-  "portal.feedback.toolbar.searchSubmit": "Rechercher",
-  "portal.feedback.toolbar.clearSearch": "Effacer la recherche",
-  "portal.feedback.filter.clearAll": "Tout effacer",
+  "portal.feedback.list.noPostsFiltered": "Aucune publication ne correspond à vos filtres.",
+  "portal.feedback.list.noPostsYet": "Aucune publication pour le moment.",
   "portal.feedback.sidebar.boards": "Catégories",
-  "portal.feedback.sidebar.viewAllPosts": "Voir toutes les publications",
   "portal.feedback.sidebar.poweredBy": "Propulsé par {brand}",
+  "portal.feedback.sidebar.viewAllPosts": "Voir toutes les publications",
   "portal.feedback.similarPosts.heading": "Idées similaires",
+  "portal.feedback.toolbar.clearSearch": "Effacer la recherche",
+  "portal.feedback.toolbar.filter": "Filtrer",
+  "portal.feedback.toolbar.search": "Rechercher",
+  "portal.feedback.toolbar.searchPlaceholder": "Rechercher des publications...",
+  "portal.feedback.toolbar.searchSubmit": "Rechercher",
+  "portal.feedback.toolbar.sortNew": "Récent",
+  "portal.feedback.toolbar.sortTop": "Top",
+  "portal.feedback.toolbar.sortTrending": "Tendances",
+  "portal.help.articleNotFound.backLink": "Centre d'aide",
+  "portal.help.articleNotFound.description": "Cet article a peut-être été supprimé ou n'est pas encore publié.",
+  "portal.help.articleNotFound.title": "Article introuvable",
+  "portal.help.categoryNotFound.backLink": "Centre d'aide",
+  "portal.help.categoryNotFound.description": "Cette catégorie a peut-être été supprimée ou n'existe pas.",
+  "portal.help.categoryNotFound.title": "Catégorie introuvable",
+  "portal.help.description": "Trouvez des réponses à vos questions et apprenez à tirer le meilleur parti de notre produit.",
+  "portal.help.title": "Centre d'aide",
+  "portal.notifications.empty.description": "Votez ou commentez des publications pour vous abonner. Vous serez notifié en cas de changement de statut ou de nouvelle activité.",
+  "portal.notifications.empty.title": "Vous êtes à jour !",
+  "portal.notifications.groupEarlier": "Plus ancien",
+  "portal.notifications.groupToday": "Aujourd'hui",
+  "portal.notifications.groupYesterday": "Hier",
+  "portal.notifications.markAllRead": "Tout marquer comme lu",
+  "portal.notifications.readAll": "Tout lire",
+  "portal.notifications.subtitle": "Mises à jour sur les publications auxquelles vous êtes abonné",
+  "portal.notifications.title": "Notifications",
+  "portal.pinnedComment.pinnedBadge": "Épinglé",
+  "portal.postCard.authorFallback": "Anonyme",
+  "portal.postCard.deleteNotAllowed": "Suppression non autorisée",
+  "portal.postCard.editNotAllowed": "Modification non autorisée",
+  "portal.postCard.quickActions.copyLink": "Copier le lien",
+  "portal.postCard.quickActions.delete": "Supprimer",
+  "portal.postCard.quickActions.edit": "Modifier",
+  "portal.postCard.quickActions.options": "Options de la publication",
+  "portal.postCard.quickActions.viewInPortal": "Voir dans le portail",
+  "portal.postCard.toast.linkCopied": "Lien copié dans le presse-papiers",
+  "portal.postCard.toast.linkCopyFailed": "Impossible de copier le lien",
+  "portal.postCard.vote.ariaRemoveVote": "Retirer le vote ({count, plural, one {# vote} other {# votes}})",
+  "portal.postCard.vote.ariaVote": "Voter pour cette publication ({count, plural, one {# vote} other {# votes}})",
   "portal.postDetail.comments": "{count, plural, one {# commentaire} other {# commentaires}}",
-  "portal.postDetail.postActions.ariaLabel": "Actions sur la publication",
-  "portal.postDetail.postActions.edit": "Modifier",
-  "portal.postDetail.postActions.delete": "Supprimer",
-  "portal.postDetail.edit.titlePlaceholder": "Quelle est votre idée ?",
-  "portal.postDetail.edit.detailsPlaceholder": "Ajoutez plus de détails... Tapez / pour les commandes",
+  "portal.postDetail.commentsLocked": "Les commentaires sont verrouillés sur cette publication",
+  "portal.postDetail.deleteDialog.confirmLabel": "Supprimer la publication",
+  "portal.postDetail.deleteDialog.deleting": "Suppression...",
+  "portal.postDetail.deleteDialog.description": "Êtes-vous sûr de vouloir supprimer « {title} » ? Cette action est irréversible.",
+  "portal.postDetail.deleteDialog.errorLinks": "Impossible de charger les intégrations liées. Veuillez fermer et réessayer.",
+  "portal.postDetail.deleteDialog.loading": "Chargement...",
+  "portal.postDetail.deleteDialog.title": "Supprimer la publication",
   "portal.postDetail.edit.cancel": "Annuler",
+  "portal.postDetail.edit.detailsPlaceholder": "Ajoutez plus de détails... Tapez / pour les commandes",
   "portal.postDetail.edit.save": "Enregistrer",
   "portal.postDetail.edit.saving": "Enregistrement...",
-  "portal.postDetail.related": "Similaires",
+  "portal.postDetail.edit.titlePlaceholder": "Quelle est votre idée ?",
   "portal.postDetail.mergeBanner.mergedInto": "Ce feedback a été fusionné avec",
   "portal.postDetail.mergeBanner.votesCount": "Les votes et l'activité comptent désormais pour l'élément associé.",
-  "portal.postDetail.metadata.upvotes": "Votes positifs",
-  "portal.postDetail.metadata.status": "Statut",
+  "portal.postDetail.metadata.author": "Auteur",
+  "portal.postDetail.metadata.authorFallback": "Anonyme",
   "portal.postDetail.metadata.board": "Catégorie",
-  "portal.postDetail.metadata.tags": "Tags",
-  "portal.postDetail.metadata.tagAdd": "Ajouter",
+  "portal.postDetail.metadata.date": "Date",
+  "portal.postDetail.metadata.deletePost": "Supprimer la publication",
+  "portal.postDetail.metadata.lockComments": "Verrouiller les commentaires",
+  "portal.postDetail.metadata.manage": "Gérer",
+  "portal.postDetail.metadata.managePost": "Gérer la publication",
+  "portal.postDetail.metadata.merge": "Fusionner",
+  "portal.postDetail.metadata.mergeIntoAnother": "Fusionner dans une autre...",
+  "portal.postDetail.metadata.mergeIntoThis": "Fusionner dans celle-ci",
+  "portal.postDetail.metadata.restorePost": "Restaurer la publication",
   "portal.postDetail.metadata.roadmap": "Feuille de route",
   "portal.postDetail.metadata.roadmapAdd": "Ajouter",
-  "portal.postDetail.metadata.date": "Date",
   "portal.postDetail.metadata.source": "Source",
+  "portal.postDetail.metadata.sourceOpenIn": "Ouvrir dans {name}",
   "portal.postDetail.metadata.sourceOriginalFeedback": "Feedback original",
   "portal.postDetail.metadata.sourceUnknownAuthor": "Auteur inconnu",
-  "portal.postDetail.metadata.sourceOpenIn": "Ouvrir dans {name}",
-  "portal.postDetail.metadata.author": "Auteur",
-  "portal.postDetail.metadata.authorFallback": "Anonyme",
+  "portal.postDetail.metadata.status": "Statut",
   "portal.postDetail.metadata.subscribe": "S'abonner",
   "portal.postDetail.metadata.subscribeHint": "Recevez des notifications lors des mises à jour de cette publication",
-  "portal.postDetail.metadata.manage": "Gérer",
-  "portal.postDetail.metadata.managePost": "Gérer la publication",
-  "portal.postDetail.metadata.merge": "Fusionner",
-  "portal.postDetail.metadata.mergeIntoThis": "Fusionner dans celle-ci",
-  "portal.postDetail.metadata.mergeIntoAnother": "Fusionner dans une autre...",
-  "portal.postDetail.metadata.lockComments": "Verrouiller les commentaires",
+  "portal.postDetail.metadata.tagAdd": "Ajouter",
+  "portal.postDetail.metadata.tags": "Tags",
   "portal.postDetail.metadata.unlockComments": "Déverrouiller les commentaires",
-  "portal.postDetail.metadata.restorePost": "Restaurer la publication",
-  "portal.postDetail.metadata.deletePost": "Supprimer la publication",
-  "portal.postDetail.deleteDialog.title": "Supprimer la publication",
-  "portal.postDetail.deleteDialog.description": "Êtes-vous sûr de vouloir supprimer « {title} » ? Cette action est irréversible.",
-  "portal.postDetail.deleteDialog.confirmLabel": "Supprimer la publication",
-  "portal.postDetail.deleteDialog.deleting": "Suppression...",
-  "portal.postDetail.deleteDialog.loading": "Chargement...",
-  "portal.postDetail.deleteDialog.errorLinks": "Impossible de charger les intégrations liées. Veuillez fermer et réessayer.",
+  "portal.postDetail.metadata.upvotes": "Votes positifs",
   "portal.postDetail.notFound": "Publication introuvable",
-  "portal.postDetail.commentsLocked": "Les commentaires sont verrouillés sur cette publication",
-  "portal.changelog.title": "Nouveautés",
-  "portal.changelog.description": "Restez informé des dernières mises à jour produit et fonctionnalités livrées.",
-  "portal.changelog.rssFeed": "Flux RSS",
+  "portal.postDetail.postActions.ariaLabel": "Actions sur la publication",
+  "portal.postDetail.postActions.delete": "Supprimer",
+  "portal.postDetail.postActions.edit": "Modifier",
+  "portal.postDetail.related": "Similaires",
   "portal.changelog.loading": "Chargement des nouveautés...",
   "portal.changelog.loadMore": "Charger plus",
   "portal.changelog.loadingMore": "Chargement...",
   "portal.changelog.empty.title": "Aucune mise à jour pour le moment",
   "portal.changelog.empty.description": "Revenez bientôt pour découvrir les dernières mises à jour produit et fonctionnalités livrées.",
-  "portal.changelog.entryNotFound.title": "Entrée introuvable",
-  "portal.changelog.entryNotFound.description": "Cette entrée a peut-être été supprimée ou n'est pas encore publiée.",
-  "portal.changelog.entryNotFound.backLink": "Nouveautés",
   "portal.roadmap.title": "Feuille de route",
   "portal.roadmap.description": "Découvrez ce sur quoi nous travaillons et ce qui arrive bientôt.",
   "portal.roadmap.empty.title": "Aucune feuille de route disponible",
   "portal.roadmap.empty.description": "Revenez plus tard pour voir ce sur quoi nous travaillons.",
   "portal.roadmap.column.empty": "Aucun élément pour le moment",
-  "portal.help.title": "Centre d'aide",
-  "portal.help.description": "Trouvez des réponses à vos questions et apprenez à tirer le meilleur parti de notre produit.",
-  "portal.help.categoryNotFound.title": "Catégorie introuvable",
-  "portal.help.categoryNotFound.description": "Cette catégorie a peut-être été supprimée ou n'existe pas.",
-  "portal.help.categoryNotFound.backLink": "Centre d'aide",
-  "portal.help.articleNotFound.title": "Article introuvable",
-  "portal.help.articleNotFound.description": "Cet article a peut-être été supprimé ou n'est pas encore publié.",
-  "portal.help.articleNotFound.backLink": "Centre d'aide",
-  "portal.notifications.title": "Notifications",
-  "portal.notifications.subtitle": "Mises à jour sur les publications auxquelles vous êtes abonné",
-  "portal.notifications.markAllRead": "Tout marquer comme lu",
-  "portal.notifications.readAll": "Tout lire",
-  "portal.notifications.groupToday": "Aujourd'hui",
-  "portal.notifications.groupYesterday": "Hier",
-  "portal.notifications.groupEarlier": "Plus ancien",
-  "portal.notifications.empty.title": "Vous êtes à jour !",
-  "portal.notifications.empty.description": "Votez ou commentez des publications pour vous abonner. Vous serez notifié en cas de changement de statut ou de nouvelle activité.",
-  "portal.settings.profile.title": "Profil",
-  "portal.settings.profile.description": "Gérez vos informations personnelles",
-  "portal.settings.preferences.title": "Préférences",
-  "portal.settings.preferences.description": "Personnalisez votre expérience",
-  "portal.settings.preferences.appearance.title": "Apparence",
   "portal.settings.preferences.appearance.description": "Personnalisez l'apparence de l'application",
   "portal.settings.preferences.appearance.themeLabel": "Thème",
-  "portal.settings.preferences.notifications.title": "Notifications par e-mail",
+  "portal.settings.preferences.appearance.title": "Apparence",
+  "portal.settings.preferences.description": "Personnalisez votre expérience",
   "portal.settings.preferences.notifications.description": "Gérez les notifications par e-mail pour les publications auxquelles vous êtes abonné",
+  "portal.settings.preferences.notifications.title": "Notifications par e-mail",
+  "portal.settings.preferences.title": "Préférences",
+  "portal.settings.profile.description": "Gérez vos informations personnelles",
+  "portal.settings.profile.title": "Profil",
   "portal.subscriptionBell.aria.subscribe": "S'abonner aux notifications",
-  "portal.subscriptionBell.aria.subscribedStatusOnly": "Abonné(e) aux changements de statut uniquement",
   "portal.subscriptionBell.aria.subscribedAll": "Abonné(e) à toute l'activité",
-  "portal.subscriptionBell.menu.title": "Notifications",
-  "portal.subscriptionBell.menu.subtitle": "Choisissez à quoi vous abonner",
+  "portal.subscriptionBell.aria.subscribedStatusOnly": "Abonné(e) aux changements de statut uniquement",
   "portal.subscriptionBell.level.all": "Toute l'activité",
   "portal.subscriptionBell.level.allHint": "Commentaires et changements de statut",
   "portal.subscriptionBell.level.statusOnly": "Changements de statut",
   "portal.subscriptionBell.level.statusOnlyHint": "Lorsque le statut est mis à jour",
   "portal.subscriptionBell.level.unsubscribe": "Se désabonner",
-  "portal.unsubscribeBanner.message": "Vous avez été désabonné(e) de cette publication. Utilisez l'icône de cloche pour vous réabonner.",
+  "portal.subscriptionBell.menu.subtitle": "Choisissez à quoi vous abonner",
+  "portal.subscriptionBell.menu.title": "Notifications",
   "portal.unsubscribeBanner.dismiss": "Fermer",
-  "portal.pinnedComment.pinnedBadge": "Épinglé",
-  "portal.postCard.authorFallback": "Anonyme",
-  "portal.postCard.editNotAllowed": "Modification non autorisée",
-  "portal.postCard.deleteNotAllowed": "Suppression non autorisée",
-  "portal.postCard.quickActions.viewInPortal": "Voir dans le portail",
-  "portal.postCard.quickActions.copyLink": "Copier le lien",
-  "portal.postCard.quickActions.edit": "Modifier",
-  "portal.postCard.quickActions.delete": "Supprimer",
-  "portal.postCard.quickActions.options": "Options de la publication",
-  "portal.postCard.vote.ariaVote": "Voter pour cette publication ({count, plural, one {# vote} other {# votes}})",
-  "portal.postCard.vote.ariaRemoveVote": "Retirer le vote ({count, plural, one {# vote} other {# votes}})",
-  "portal.postCard.toast.linkCopied": "Lien copié dans le presse-papiers",
-  "portal.postCard.toast.linkCopyFailed": "Impossible de copier le lien",
-  "portal.commentThread.empty": "Aucun commentaire pour le moment. Soyez le premier à partager vos réflexions !",
-  "portal.commentThread.signInToComment": "Connectez-vous pour commenter",
-  "portal.commentThread.signIn": "Se connecter",
-  "portal.commentThread.deleted": "[supprimé]",
-  "portal.commentThread.removed": "[retiré]",
-  "portal.commentThread.authorFallback": "Anonyme",
-  "portal.commentThread.authorAlt": "Auteur du commentaire",
-  "portal.commentThread.teamBadge": "Équipe",
-  "portal.commentThread.internalNote": "Note interne",
-  "portal.commentThread.internalNoteHint": "visible uniquement par votre équipe",
-  "portal.commentThread.pinnedBadge": "Épinglé",
-  "portal.commentThread.changedStatusTo": "a changé le statut en",
-  "portal.commentThread.reply": "Répondre",
-  "portal.commentThread.pin": "Épingler",
-  "portal.commentThread.unpin": "Désépingler",
-  "portal.commentThread.restore": "Restaurer",
-  "portal.commentThread.restoring": "Restauration...",
-  "portal.commentThread.delete": "Supprimer",
-  "portal.commentThread.deleting": "Suppression...",
-  "portal.commentForm.labelSrOnly": "Votre commentaire",
-  "portal.commentForm.placeholder": "Écrire un commentaire...",
-  "portal.commentForm.authorFallback": "Anonyme",
-  "portal.commentForm.noStatus": "Aucun statut",
-  "portal.commentForm.updateStatus": "Mettre à jour le statut",
-  "portal.commentForm.clearStatusChange": "Annuler le changement de statut",
-  "portal.commentForm.postingAnonymously": "Vous commentez de manière anonyme",
-  "portal.commentForm.postingAs": "Vous commentez en tant que {name}",
-  "portal.commentForm.signOut": "se déconnecter",
-  "portal.commentForm.cancel": "Annuler",
-  "portal.commentForm.private": "Privé",
-  "portal.commentForm.privateLockedTooltip": "Les réponses aux commentaires privés sont toujours privées",
-  "portal.commentForm.privateOnTooltip": "Visible uniquement par les membres de l'équipe",
-  "portal.commentForm.privateOffTooltip": "Rendre ce commentaire privé (équipe uniquement)",
-  "portal.commentForm.submit": "Commenter",
-  "portal.commentForm.submitWithStatus": "Commenter et marquer {statusName}",
-  "portal.commentForm.reply": "Répondre",
-  "portal.commentForm.submitting": "Envoi...",
-  "portal.commentForm.errorPost": "Impossible de publier le commentaire",
-  "portal.feedback.filter.addFilter": "Ajouter un filtre",
-  "portal.feedback.filter.back": "Retour",
-  "portal.feedback.filter.category.board": "Tableau",
-  "portal.feedback.filter.category.status": "Statut",
-  "portal.feedback.filter.category.tag": "Tag",
-  "portal.feedback.filter.category.votes": "Nombre de votes",
-  "portal.feedback.filter.category.date": "Date de création",
-  "portal.feedback.filter.category.response": "Réponse de l'équipe",
-  "portal.feedback.filter.statusGroup.active": "Actif",
-  "portal.feedback.filter.statusGroup.complete": "Terminé",
-  "portal.feedback.filter.statusGroup.closed": "Fermé",
-  "portal.feedback.filter.chip.board": "Tableau :",
-  "portal.feedback.filter.chip.status": "Statut :",
-  "portal.feedback.filter.chip.tag": "Tag :",
-  "portal.feedback.filter.chip.tags": "Tags :",
-  "portal.feedback.filter.chip.votes": "Votes min. :",
-  "portal.feedback.filter.chip.date": "Date :",
-  "portal.feedback.filter.chip.response": "Réponse de l'équipe :",
+  "portal.unsubscribeBanner.message": "Vous avez été désabonné(e) de cette publication. Utilisez l'icône de cloche pour vous réabonner.",
+  "tickets.audience.internal": "Internal note",
+  "tickets.audience.public": "Public reply",
+  "tickets.audience.shared_team": "Shared with team",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "Email",
+  "tickets.channel.portal": "Portal",
+  "tickets.channel.widget": "Widget",
+  "tickets.notifications.assigned": "Assigned to you: {subject}",
+  "tickets.notifications.opened": "Ticket opened: {subject}",
+  "tickets.notifications.participantAdded": "Added to ticket: {subject}",
+  "tickets.notifications.participantRemoved": "Removed from ticket: {subject}",
+  "tickets.notifications.shared": "Ticket shared: {subject}",
+  "tickets.notifications.slaBreach": "SLA breached: {subject}",
+  "tickets.notifications.slaWarning": "SLA at risk: {subject}",
+  "tickets.notifications.statusChanged": "Status: {subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "New reply: {subject}",
+  "tickets.notifications.unassigned": "Unassigned: {subject}",
+  "tickets.notifications.unshared": "Ticket unshared: {subject}",
+  "tickets.priority.high": "High",
+  "tickets.priority.low": "Low",
+  "tickets.priority.normal": "Normal",
+  "tickets.priority.urgent": "Urgent",
+  "tickets.role.cc": "CC",
+  "tickets.role.collaborator": "Collaborator",
+  "tickets.role.watcher": "Watcher",
+  "tickets.scope.all": "All",
+  "tickets.scope.inbox": "Inbox",
+  "tickets.scope.my_assigned": "Assigned to me",
+  "tickets.scope.my_inbox": "My inbox",
+  "tickets.scope.my_team": "My team",
+  "tickets.scope.shared_with_me": "Shared with me",
+  "tickets.scope.unassigned": "Unassigned",
+  "tickets.share.comment": "Comment",
+  "tickets.share.full": "Full access",
+  "tickets.share.read": "Read",
+  "tickets.sla.kind.first_response": "First response",
+  "tickets.sla.kind.next_response": "Next response",
+  "tickets.sla.kind.resolution": "Resolution",
+  "tickets.sla.state.breached": "Breached",
+  "tickets.sla.state.cancelled": "Cancelled",
+  "tickets.sla.state.met": "Met",
+  "tickets.sla.state.paused": "Paused",
+  "tickets.sla.state.running": "Running",
+  "tickets.status.closed": "Closed",
+  "tickets.status.on_hold": "On hold",
+  "tickets.status.open": "Open",
+  "tickets.status.pending": "Pending",
+  "tickets.status.solved": "Solved",
+  "tickets.subscription.mute": "Mute",
+  "tickets.subscription.muted": "Muted",
+  "tickets.subscription.notify.assignment": "Assignment changes",
+  "tickets.subscription.notify.participants": "Participant changes",
+  "tickets.subscription.notify.shares": "Share grants",
+  "tickets.subscription.notify.sla": "SLA warnings & breaches",
+  "tickets.subscription.notify.status": "Status changes",
+  "tickets.subscription.notify.threads": "New replies",
+  "tickets.subscription.source.auto_assigned": "Auto (assignee)",
+  "tickets.subscription.source.auto_participant": "Auto (participant)",
+  "tickets.subscription.source.auto_team_member": "Auto (team member)",
+  "tickets.subscription.source.manual": "Manual",
+  "tickets.subscription.unmute": "Unmute",
+  "tickets.visibility.org": "Organization",
+  "tickets.visibility.private": "Private",
+  "tickets.visibility.shared": "Shared",
+  "tickets.visibility.team": "Team only",
   "widget.home.posting.selectBoard": "Sélectionner une catégorie",
-  "portal.feedback.toolbar.filter": "Filtrer",
   "portal.roadmap.toolbar.sortBy": "Trier par",
   "portal.roadmap.toolbar.sortVotes": "Plus de votes",
   "portal.roadmap.toolbar.sortNewest": "Plus récent",
@@ -441,5 +507,60 @@
   "portal.hc.contactSupport.body": "Démarrez une conversation avec notre équipe et nous vous répondrons.",
   "portal.hc.contactSupport.cta": "Contacter le support",
   "portal.hc.articleFeedback.stillStuck": "Toujours bloqué ?",
-  "portal.hc.articleFeedback.contactSupport": "Contacter le support"
+  "portal.hc.articleFeedback.contactSupport": "Contacter le support",
+  "portal.header.nav.tickets": "Mes tickets",
+  "portal.tickets.title": "Mes tickets",
+  "portal.tickets.subtitle": "Tickets que vous avez ouverts ou auxquels vous avez été ajouté.",
+  "portal.tickets.empty.title": "Aucun ticket pour le moment",
+  "portal.tickets.empty.description": "Lorsque notre équipe traitera une de vos demandes, elle apparaîtra ici.",
+  "portal.tickets.filter.all": "Tous",
+  "portal.tickets.filter.open": "Ouverts",
+  "portal.tickets.filter.pending": "En attente",
+  "portal.tickets.filter.solved": "Résolus",
+  "portal.tickets.filter.closed": "Fermés",
+  "portal.tickets.row.updated": "Mis à jour {when}",
+  "portal.tickets.detail.back": "Mes tickets",
+  "portal.tickets.detail.description": "Description",
+  "portal.tickets.detail.openedAt": "Ouvert {date}",
+  "portal.tickets.detail.lastUpdate": "Dernière mise à jour {when}",
+  "portal.tickets.detail.noReplies": "Aucune réponse pour le moment.",
+  "portal.tickets.detail.supportTeam": "Équipe de support",
+  "portal.tickets.detail.you": "Vous",
+  "portal.tickets.detail.edited": "modifié",
+  "portal.tickets.composer.placeholder": "Saisissez votre réponse…",
+  "portal.tickets.composer.send": "Envoyer la réponse",
+  "portal.tickets.composer.sending": "Envoi en cours…",
+  "portal.tickets.composer.closed": "Ce ticket est fermé. Ouvrez-en un nouveau pour faire un suivi.",
+  "widget.support.card.title": "Contacter le support",
+  "widget.support.card.description": "Obtenez de l'aide directement auprès de notre équipe.",
+  "widget.support.card.cta": "Ouvrir un ticket",
+  "widget.support.composer.subjectPlaceholder": "Objet",
+  "widget.support.composer.bodyPlaceholder": "Décrivez votre problème...",
+  "widget.support.composer.namePlaceholder": "Votre nom (facultatif)",
+  "widget.support.composer.emailPlaceholder": "Votre adresse e-mail",
+  "widget.support.composer.priority.label": "Priorité",
+  "widget.support.composer.priority.low": "Basse",
+  "widget.support.composer.priority.normal": "Normale",
+  "widget.support.composer.priority.high": "Élevée",
+  "widget.support.composer.submit": "Envoyer",
+  "widget.support.composer.submitting": "Envoi en cours...",
+  "widget.support.composer.errorCreate": "Impossible de créer le ticket. Veuillez réessayer.",
+  "widget.support.composer.errorEmail": "Impossible de vérifier votre adresse e-mail. Veuillez réessayer.",
+  "widget.support.list.heading": "Vos tickets",
+  "widget.support.list.newTicket": "Nouveau ticket",
+  "widget.support.list.empty": "Vous n'avez encore ouvert aucun ticket.",
+  "widget.support.list.emptyAnonymous": "Connectez-vous pour voir vos tickets.",
+  "widget.support.list.errorLoad": "Impossible de charger vos tickets.",
+  "widget.support.detail.errorLoad": "Impossible de charger ce ticket.",
+  "widget.support.detail.threadEmpty": "Aucune réponse pour le moment.",
+  "widget.support.detail.youLabel": "Vous",
+  "widget.support.detail.replyPlaceholder": "Saisissez votre réponse...",
+  "widget.support.detail.replySend": "Répondre",
+  "widget.support.detail.replySending": "Envoi en cours...",
+  "widget.support.detail.errorReply": "Impossible de publier votre réponse.",
+  "widget.support.detail.resolve": "Marquer comme résolu",
+  "widget.support.detail.resolved": "Résolu",
+  "widget.support.detail.errorResolve": "Impossible de marquer ce ticket comme résolu.",
+  "widget.support.detail.reopen": "Rouvrir",
+  "widget.support.detail.errorReopen": "Impossible de rouvrir ce ticket."
 }
diff --git a/apps/web/src/locales/pt-br.json b/apps/web/src/locales/pt-br.json
index 6223bf957..831f93f54 100644
--- a/apps/web/src/locales/pt-br.json
+++ b/apps/web/src/locales/pt-br.json
@@ -441,5 +441,126 @@
   "portal.hc.contactSupport.body": "Inicie uma conversa com nossa equipe e retornaremos para você.",
   "portal.hc.contactSupport.cta": "Falar com o suporte",
   "portal.hc.articleFeedback.stillStuck": "Ainda com dificuldades?",
-  "portal.hc.articleFeedback.contactSupport": "Falar com o suporte"
+  "portal.hc.articleFeedback.contactSupport": "Falar com o suporte",
+  "portal.header.nav.tickets": "Meus tickets",
+  "portal.tickets.title": "Meus tickets",
+  "portal.tickets.subtitle": "Tickets que você abriu ou aos quais foi adicionado.",
+  "portal.tickets.empty.title": "Nenhum ticket ainda",
+  "portal.tickets.empty.description": "Quando nossa equipe atender a uma solicitação sua, ela aparecerá aqui.",
+  "portal.tickets.filter.all": "Todos",
+  "portal.tickets.filter.open": "Abertos",
+  "portal.tickets.filter.pending": "Pendentes",
+  "portal.tickets.filter.solved": "Resolvidos",
+  "portal.tickets.filter.closed": "Fechados",
+  "portal.tickets.row.updated": "Atualizado {when}",
+  "portal.tickets.detail.back": "Meus tickets",
+  "portal.tickets.detail.description": "Descrição",
+  "portal.tickets.detail.openedAt": "Aberto {date}",
+  "portal.tickets.detail.lastUpdate": "Última atualização {when}",
+  "portal.tickets.detail.noReplies": "Nenhuma resposta ainda.",
+  "portal.tickets.detail.supportTeam": "Equipe de suporte",
+  "portal.tickets.detail.you": "Você",
+  "portal.tickets.detail.edited": "editado",
+  "portal.tickets.composer.placeholder": "Digite sua resposta…",
+  "portal.tickets.composer.send": "Enviar resposta",
+  "portal.tickets.composer.sending": "Enviando…",
+  "portal.tickets.composer.closed": "Este ticket está fechado. Abra um novo para dar continuidade.",
+  "widget.support.card.title": "Falar com o suporte",
+  "widget.support.card.description": "Receba ajuda diretamente da nossa equipe.",
+  "widget.support.card.cta": "Abrir um ticket",
+  "widget.support.composer.subjectPlaceholder": "Assunto",
+  "widget.support.composer.bodyPlaceholder": "Descreva seu problema...",
+  "widget.support.composer.namePlaceholder": "Seu nome (opcional)",
+  "widget.support.composer.emailPlaceholder": "Seu email",
+  "widget.support.composer.priority.label": "Prioridade",
+  "widget.support.composer.priority.low": "Baixa",
+  "widget.support.composer.priority.normal": "Normal",
+  "widget.support.composer.priority.high": "Alta",
+  "widget.support.composer.submit": "Enviar",
+  "widget.support.composer.submitting": "Enviando...",
+  "widget.support.composer.errorCreate": "Não foi possível criar o ticket. Tente novamente.",
+  "widget.support.composer.errorEmail": "Não foi possível verificar seu email. Tente novamente.",
+  "widget.support.list.heading": "Seus tickets",
+  "widget.support.list.newTicket": "Novo ticket",
+  "widget.support.list.empty": "Você ainda não abriu nenhum ticket.",
+  "widget.support.list.emptyAnonymous": "Entre para ver seus tickets.",
+  "widget.support.list.errorLoad": "Não foi possível carregar seus tickets.",
+  "widget.support.detail.errorLoad": "Não foi possível carregar este ticket.",
+  "widget.support.detail.threadEmpty": "Nenhuma resposta ainda.",
+  "widget.support.detail.youLabel": "Você",
+  "widget.support.detail.replyPlaceholder": "Digite sua resposta...",
+  "widget.support.detail.replySend": "Responder",
+  "widget.support.detail.replySending": "Enviando...",
+  "widget.support.detail.errorReply": "Não foi possível publicar sua resposta.",
+  "widget.support.detail.resolve": "Marcar como resolvido",
+  "widget.support.detail.resolved": "Resolvido",
+  "widget.support.detail.errorResolve": "Não foi possível marcar este ticket como resolvido.",
+  "widget.support.detail.reopen": "Reabrir",
+  "widget.support.detail.errorReopen": "Não foi possível reabrir este ticket.",
+  "tickets.audience.internal": "Nota interna",
+  "tickets.audience.public": "Resposta pública",
+  "tickets.audience.shared_team": "Compartilhado com a equipe",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "Email",
+  "tickets.channel.portal": "Portal",
+  "tickets.channel.widget": "Widget",
+  "tickets.notifications.assigned": "Atribuído a você: {subject}",
+  "tickets.notifications.opened": "Ticket aberto: {subject}",
+  "tickets.notifications.participantAdded": "Adicionado ao ticket: {subject}",
+  "tickets.notifications.participantRemoved": "Removido do ticket: {subject}",
+  "tickets.notifications.shared": "Ticket compartilhado: {subject}",
+  "tickets.notifications.slaBreach": "SLA violado: {subject}",
+  "tickets.notifications.slaWarning": "SLA em risco: {subject}",
+  "tickets.notifications.statusChanged": "Status: {subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "Nova resposta: {subject}",
+  "tickets.notifications.unassigned": "Não atribuído: {subject}",
+  "tickets.notifications.unshared": "Compartilhamento removido: {subject}",
+  "tickets.priority.high": "Alta",
+  "tickets.priority.low": "Baixa",
+  "tickets.priority.normal": "Normal",
+  "tickets.priority.urgent": "Urgente",
+  "tickets.role.cc": "CC",
+  "tickets.role.collaborator": "Colaborador",
+  "tickets.role.watcher": "Observador",
+  "tickets.scope.all": "Todos",
+  "tickets.scope.inbox": "Caixa de entrada",
+  "tickets.scope.my_assigned": "Atribuídos a mim",
+  "tickets.scope.my_inbox": "Minha caixa de entrada",
+  "tickets.scope.my_team": "Minha equipe",
+  "tickets.scope.shared_with_me": "Compartilhados comigo",
+  "tickets.scope.unassigned": "Não atribuídos",
+  "tickets.share.comment": "Comentar",
+  "tickets.share.full": "Acesso total",
+  "tickets.share.read": "Leitura",
+  "tickets.sla.kind.first_response": "Primeira resposta",
+  "tickets.sla.kind.next_response": "Próxima resposta",
+  "tickets.sla.kind.resolution": "Resolução",
+  "tickets.sla.state.breached": "Violado",
+  "tickets.sla.state.cancelled": "Cancelado",
+  "tickets.sla.state.met": "Cumprido",
+  "tickets.sla.state.paused": "Pausado",
+  "tickets.sla.state.running": "Em andamento",
+  "tickets.status.closed": "Fechado",
+  "tickets.status.on_hold": "Em espera",
+  "tickets.status.open": "Aberto",
+  "tickets.status.pending": "Pendente",
+  "tickets.status.solved": "Resolvido",
+  "tickets.subscription.mute": "Silenciar",
+  "tickets.subscription.muted": "Silenciado",
+  "tickets.subscription.notify.assignment": "Mudanças de atribuição",
+  "tickets.subscription.notify.participants": "Mudanças de participantes",
+  "tickets.subscription.notify.shares": "Concessões de compartilhamento",
+  "tickets.subscription.notify.sla": "Avisos e violações de SLA",
+  "tickets.subscription.notify.status": "Mudanças de status",
+  "tickets.subscription.notify.threads": "Novas respostas",
+  "tickets.subscription.source.auto_assigned": "Auto (responsável)",
+  "tickets.subscription.source.auto_participant": "Auto (participante)",
+  "tickets.subscription.source.auto_team_member": "Auto (membro da equipe)",
+  "tickets.subscription.source.manual": "Manual",
+  "tickets.subscription.unmute": "Reativar som",
+  "tickets.visibility.org": "Organização",
+  "tickets.visibility.private": "Privado",
+  "tickets.visibility.shared": "Compartilhado",
+  "tickets.visibility.team": "Somente equipe"
 }
diff --git a/apps/web/src/locales/ru.json b/apps/web/src/locales/ru.json
index cea410d43..aa8d36573 100644
--- a/apps/web/src/locales/ru.json
+++ b/apps/web/src/locales/ru.json
@@ -1,6 +1,50 @@
 {
+  "portal.changelog.description": "Следите за новыми релизами и обновлениями продукта.",
+  "portal.changelog.entryNotFound.backLink": "Журнал изменений",
+  "portal.changelog.entryNotFound.description": "Эта запись могла быть удалена или ещё не опубликована.",
+  "portal.changelog.entryNotFound.title": "Запись в журнале изменений не найдена",
+  "portal.changelog.rssFeed": "RSS-лента",
+  "portal.changelog.title": "Журнал изменений",
+  "portal.commentForm.authorFallback": "Аноним",
+  "portal.commentForm.cancel": "Отмена",
+  "portal.commentForm.clearStatusChange": "Отменить изменение статуса",
+  "portal.commentForm.errorPost": "Не удалось отправить комментарий",
+  "portal.commentForm.labelSrOnly": "Ваш комментарий",
+  "portal.commentForm.noStatus": "Без статуса",
+  "portal.commentForm.placeholder": "Напишите комментарий...",
+  "portal.commentForm.postingAnonymously": "Анонимно",
+  "portal.commentForm.postingAs": "Вы публикуете как {name}",
+  "portal.commentForm.private": "Только для команды",
+  "portal.commentForm.privateLockedTooltip": "Ответы на такие комментарии тоже видны только команде",
+  "portal.commentForm.privateOffTooltip": "Сделать комментарий видимым только команде",
+  "portal.commentForm.privateOnTooltip": "Видно только команде",
+  "portal.commentForm.reply": "Ответить",
+  "portal.commentForm.signOut": "выйти",
+  "portal.commentForm.submit": "Отправить",
+  "portal.commentForm.submitWithStatus": "Отправить и установить статус {statusName}",
+  "portal.commentForm.submitting": "Отправка...",
+  "portal.commentForm.updateStatus": "Изменить статус",
+  "portal.commentThread.authorAlt": "Автор комментария",
+  "portal.commentThread.authorFallback": "Аноним",
+  "portal.commentThread.changedStatusTo": "изменил статус на",
+  "portal.commentThread.delete": "Удалить",
+  "portal.commentThread.deleted": "[удалено]",
+  "portal.commentThread.deleting": "Удаление...",
+  "portal.commentThread.empty": "Комментариев пока нет. Оставьте первый.",
+  "portal.commentThread.internalNote": "Внутренняя заметка",
+  "portal.commentThread.internalNoteHint": "Видно только команде",
+  "portal.commentThread.pin": "Закрепить",
+  "portal.commentThread.pinnedBadge": "Закреплено",
+  "portal.commentThread.removed": "[скрыто]",
+  "portal.commentThread.reply": "Ответить",
+  "portal.commentThread.restore": "Восстановить",
+  "portal.commentThread.restoring": "Восстановление...",
+  "portal.commentThread.signIn": "Войти",
+  "portal.commentThread.signInToComment": "Войдите, чтобы комментировать",
+  "portal.commentThread.teamBadge": "Команда",
+  "portal.commentThread.unpin": "Открепить",
   "widget.shell.heading.feedback": "Поделитесь предложением",
-  "widget.shell.heading.help": "Помощь и поддержка",
+  "widget.shell.heading.help": "Помощь",
   "widget.shell.heading.changelog": "Что нового",
   "widget.shell.tab.feedback": "Обратная связь",
   "widget.shell.tab.changelog": "Журнал изменений",
@@ -111,209 +155,231 @@
   "portal.header.theme.dark": "Тёмная",
   "portal.feedback.empty.comingSoonTitle": "Скоро откроется",
   "portal.feedback.empty.comingSoonDescription": "{orgName} еще настраивает портал обратной связи. Загляните позже, чтобы оставить предложение.",
-  "portal.feedback.list.noPostsFiltered": "По выбранным фильтрам ничего не найдено.",
-  "portal.feedback.list.noPostsYet": "Предложений пока нет.",
-  "portal.feedback.header.postingTo": "В категории",
-  "portal.feedback.header.selectBoard": "Выберите категорию",
-  "portal.feedback.header.titlePlaceholder": "Опишите ваше предложение",
-  "portal.feedback.header.detailsPlaceholder": "Расскажите подробнее... Введите / для команд",
-  "portal.feedback.header.postingAs": "Вы публикуете как",
-  "portal.feedback.header.signOut": "Выйти",
-  "portal.feedback.header.postingAnonymously": "Анонимно",
-  "portal.feedback.header.signInToPost": "Войдите, чтобы оставить предложение",
+  "portal.feedback.filter.addFilter": "Добавить фильтр",
+  "portal.feedback.filter.back": "Назад",
+  "portal.feedback.filter.category.board": "Доска",
+  "portal.feedback.filter.category.date": "Дата создания",
+  "portal.feedback.filter.category.response": "Ответ команды",
+  "portal.feedback.filter.category.status": "Статус",
+  "portal.feedback.filter.category.tag": "Тег",
+  "portal.feedback.filter.category.votes": "Количество голосов",
+  "portal.feedback.filter.chip.board": "Доска:",
+  "portal.feedback.filter.chip.date": "Дата:",
+  "portal.feedback.filter.chip.response": "Ответ команды:",
+  "portal.feedback.filter.chip.status": "Статус:",
+  "portal.feedback.filter.chip.tag": "Тег:",
+  "portal.feedback.filter.chip.tags": "Теги:",
+  "portal.feedback.filter.chip.votes": "Мин. голосов:",
+  "portal.feedback.filter.clearAll": "Сбросить всё",
+  "portal.feedback.filter.statusGroup.active": "Активные",
+  "portal.feedback.filter.statusGroup.closed": "Закрытые",
+  "portal.feedback.filter.statusGroup.complete": "Завершённые",
   "portal.feedback.header.cancel": "Отмена",
-  "portal.feedback.header.submit": "Отправить",
-  "portal.feedback.header.submitting": "Отправка...",
-  "portal.feedback.header.errorSelectBoard": "Выберите категорию",
+  "portal.feedback.header.detailsPlaceholder": "Расскажите подробнее... Введите / для команд",
   "portal.feedback.header.errorAddTitle": "Добавьте заголовок",
-  "portal.feedback.header.errorSignIn": "Войдите, чтобы оставить предложение",
+  "portal.feedback.header.errorSelectBoard": "Выберите категорию",
   "portal.feedback.header.errorSession": "Не удалось создать сессию",
+  "portal.feedback.header.errorSignIn": "Войдите, чтобы оставить предложение",
   "portal.feedback.header.errorSubmit": "Не удалось отправить предложение",
+  "portal.feedback.header.postingAnonymously": "Анонимно",
+  "portal.feedback.header.postingAs": "Вы публикуете как",
+  "portal.feedback.header.postingTo": "В категории",
+  "portal.feedback.header.selectBoard": "Выберите категорию",
+  "portal.feedback.header.signInToPost": "Войдите, чтобы оставить предложение",
+  "portal.feedback.header.signOut": "Выйти",
+  "portal.feedback.header.submit": "Отправить",
   "portal.feedback.header.submitTooltipSignIn": "Войдите, чтобы оставить предложение",
+  "portal.feedback.header.submitting": "Отправка...",
+  "portal.feedback.header.titlePlaceholder": "Опишите ваше предложение",
   "portal.feedback.header.toastSubmitted": "Предложение отправлено",
   "portal.feedback.header.toastView": "Открыть",
-  "portal.feedback.toolbar.sortTop": "Популярные",
-  "portal.feedback.toolbar.sortNew": "Новые",
-  "portal.feedback.toolbar.sortTrending": "Обсуждаемые",
-  "portal.feedback.toolbar.search": "Поиск",
-  "portal.feedback.toolbar.searchPlaceholder": "Поиск предложений...",
-  "portal.feedback.toolbar.searchSubmit": "Поиск",
-  "portal.feedback.toolbar.clearSearch": "Очистить поиск",
-  "portal.feedback.filter.clearAll": "Сбросить всё",
+  "portal.feedback.list.noPostsFiltered": "По выбранным фильтрам ничего не найдено.",
+  "portal.feedback.list.noPostsYet": "Предложений пока нет.",
   "portal.feedback.sidebar.boards": "Категории",
-  "portal.feedback.sidebar.viewAllPosts": "Все предложения",
   "portal.feedback.sidebar.poweredBy": "На базе {brand}",
+  "portal.feedback.sidebar.viewAllPosts": "Все предложения",
   "portal.feedback.similarPosts.heading": "Похожие предложения",
+  "portal.feedback.toolbar.clearSearch": "Очистить поиск",
+  "portal.feedback.toolbar.filter": "Фильтр",
+  "portal.feedback.toolbar.search": "Поиск",
+  "portal.feedback.toolbar.searchPlaceholder": "Поиск предложений...",
+  "portal.feedback.toolbar.searchSubmit": "Поиск",
+  "portal.feedback.toolbar.sortNew": "Новые",
+  "portal.feedback.toolbar.sortTop": "Популярные",
+  "portal.feedback.toolbar.sortTrending": "Обсуждаемые",
+  "portal.help.articleNotFound.backLink": "Помощь",
+  "portal.help.articleNotFound.description": "Эта статья могла быть удалена или ещё не опубликована.",
+  "portal.help.articleNotFound.title": "Статья не найдена",
+  "portal.help.categoryNotFound.backLink": "Помощь",
+  "portal.help.categoryNotFound.description": "Эта категория могла быть удалена или не существует.",
+  "portal.help.categoryNotFound.title": "Категория не найдена",
+  "portal.help.description": "Найдите ответы на вопросы и узнайте, как получить максимум от нашего продукта.",
+  "portal.help.title": "Помощь",
+  "portal.notifications.empty.description": "Голосуйте или комментируйте чтобы подписаться. Мы сообщим об изменениях статуса и новой активности.",
+  "portal.notifications.empty.title": "Все прочитано",
+  "portal.notifications.groupEarlier": "Ранее",
+  "portal.notifications.groupToday": "Сегодня",
+  "portal.notifications.groupYesterday": "Вчера",
+  "portal.notifications.markAllRead": "Отметить всё прочитанным",
+  "portal.notifications.readAll": "Прочитать всё",
+  "portal.notifications.subtitle": "Обновления по предложениям, на которые вы подписаны",
+  "portal.notifications.title": "Уведомления",
+  "portal.pinnedComment.pinnedBadge": "Закреплено",
+  "portal.postCard.authorFallback": "Аноним",
+  "portal.postCard.deleteNotAllowed": "Удаление недоступно",
+  "portal.postCard.editNotAllowed": "Редактирование недоступно",
+  "portal.postCard.quickActions.copyLink": "Копировать ссылку",
+  "portal.postCard.quickActions.delete": "Удалить",
+  "portal.postCard.quickActions.edit": "Редактировать",
+  "portal.postCard.quickActions.options": "Действия",
+  "portal.postCard.quickActions.viewInPortal": "Открыть в портале",
+  "portal.postCard.toast.linkCopied": "Ссылка скопирована в буфер обмена",
+  "portal.postCard.toast.linkCopyFailed": "Не удалось скопировать ссылку",
+  "portal.postCard.vote.ariaRemoveVote": "Убрать голос ({count, plural, one {# голос} few {# голоса} many {# голосов} other {# голоса}})",
+  "portal.postCard.vote.ariaVote": "Проголосовать за это предложение ({count, plural, one {# голос} few {# голоса} many {# голосов} other {# голоса}})",
   "portal.postDetail.comments": "{count, plural, one {# комментарий} few {# комментария} many {# комментариев} other {# комментария}}",
-  "portal.postDetail.postActions.ariaLabel": "Действия",
-  "portal.postDetail.postActions.edit": "Редактировать",
-  "portal.postDetail.postActions.delete": "Удалить",
-  "portal.postDetail.edit.titlePlaceholder": "Опишите ваше предложение",
-  "portal.postDetail.edit.detailsPlaceholder": "Расскажите подробнее... Нажмите / для команд",
+  "portal.postDetail.commentsLocked": "Комментарии закрыты",
+  "portal.postDetail.deleteDialog.confirmLabel": "Удалить предложение",
+  "portal.postDetail.deleteDialog.deleting": "Удаление...",
+  "portal.postDetail.deleteDialog.description": "Вы уверены, что хотите удалить \"{title}\"? Это действие нельзя отменить.",
+  "portal.postDetail.deleteDialog.errorLinks": "Не удалось загрузить связанные интеграции. Закройте окно и попробуйте снова.",
+  "portal.postDetail.deleteDialog.loading": "Загрузка...",
+  "portal.postDetail.deleteDialog.title": "Удалить предложение",
   "portal.postDetail.edit.cancel": "Отмена",
+  "portal.postDetail.edit.detailsPlaceholder": "Расскажите подробнее... Нажмите / для команд",
   "portal.postDetail.edit.save": "Сохранить",
   "portal.postDetail.edit.saving": "Сохранение...",
-  "portal.postDetail.related": "Похожие",
+  "portal.postDetail.edit.titlePlaceholder": "Опишите ваше предложение",
   "portal.postDetail.mergeBanner.mergedInto": "Это предложение объединено с",
   "portal.postDetail.mergeBanner.votesCount": "Голоса и активность теперь учитываются у связанного предложения.",
-  "portal.postDetail.metadata.upvotes": "Голоса",
-  "portal.postDetail.metadata.status": "Статус",
+  "portal.postDetail.metadata.author": "Автор",
+  "portal.postDetail.metadata.authorFallback": "Аноним",
   "portal.postDetail.metadata.board": "Категория",
-  "portal.postDetail.metadata.tags": "Теги",
-  "portal.postDetail.metadata.tagAdd": "Добавить",
+  "portal.postDetail.metadata.date": "Дата",
+  "portal.postDetail.metadata.deletePost": "Удалить предложение",
+  "portal.postDetail.metadata.lockComments": "Закрыть комментарии",
+  "portal.postDetail.metadata.manage": "Управление",
+  "portal.postDetail.metadata.managePost": "Управление",
+  "portal.postDetail.metadata.merge": "Объединить",
+  "portal.postDetail.metadata.mergeIntoAnother": "Объединить с другим...",
+  "portal.postDetail.metadata.mergeIntoThis": "Объединить с этим",
+  "portal.postDetail.metadata.restorePost": "Восстановить предложение",
   "portal.postDetail.metadata.roadmap": "Дорожная карта",
   "portal.postDetail.metadata.roadmapAdd": "Добавить",
-  "portal.postDetail.metadata.date": "Дата",
   "portal.postDetail.metadata.source": "Источник",
+  "portal.postDetail.metadata.sourceOpenIn": "Открыть в {name}",
   "portal.postDetail.metadata.sourceOriginalFeedback": "Исходное предложение",
   "portal.postDetail.metadata.sourceUnknownAuthor": "Неизвестный автор",
-  "portal.postDetail.metadata.sourceOpenIn": "Открыть в {name}",
-  "portal.postDetail.metadata.author": "Автор",
-  "portal.postDetail.metadata.authorFallback": "Аноним",
+  "portal.postDetail.metadata.status": "Статус",
   "portal.postDetail.metadata.subscribe": "Подписаться",
   "portal.postDetail.metadata.subscribeHint": "Получайте уведомления об обновлениях этого предложения",
-  "portal.postDetail.metadata.manage": "Управление",
-  "portal.postDetail.metadata.managePost": "Управление",
-  "portal.postDetail.metadata.merge": "Объединить",
-  "portal.postDetail.metadata.mergeIntoThis": "Объединить с этим",
-  "portal.postDetail.metadata.mergeIntoAnother": "Объединить с другим...",
-  "portal.postDetail.metadata.lockComments": "Закрыть комментарии",
+  "portal.postDetail.metadata.tagAdd": "Добавить",
+  "portal.postDetail.metadata.tags": "Теги",
   "portal.postDetail.metadata.unlockComments": "Открыть комментарии",
-  "portal.postDetail.metadata.restorePost": "Восстановить предложение",
-  "portal.postDetail.metadata.deletePost": "Удалить предложение",
-  "portal.postDetail.deleteDialog.title": "Удалить предложение",
-  "portal.postDetail.deleteDialog.description": "Вы уверены, что хотите удалить \"{title}\"? Это действие нельзя отменить.",
-  "portal.postDetail.deleteDialog.confirmLabel": "Удалить предложение",
-  "portal.postDetail.deleteDialog.deleting": "Удаление...",
-  "portal.postDetail.deleteDialog.loading": "Загрузка...",
-  "portal.postDetail.deleteDialog.errorLinks": "Не удалось загрузить связанные интеграции. Закройте окно и попробуйте снова.",
+  "portal.postDetail.metadata.upvotes": "Голоса",
   "portal.postDetail.notFound": "Предложение не найдено",
-  "portal.postDetail.commentsLocked": "Комментарии закрыты",
-  "portal.changelog.title": "Журнал изменений",
-  "portal.changelog.description": "Следите за новыми релизами и обновлениями продукта.",
-  "portal.changelog.rssFeed": "RSS-лента",
+  "portal.postDetail.postActions.ariaLabel": "Действия",
+  "portal.postDetail.postActions.delete": "Удалить",
+  "portal.postDetail.postActions.edit": "Редактировать",
+  "portal.postDetail.related": "Похожие",
   "portal.changelog.loading": "Загрузка журнала изменений...",
   "portal.changelog.loadMore": "Показать ещё",
   "portal.changelog.loadingMore": "Загрузка...",
   "portal.changelog.empty.title": "Пока нет обновлений",
   "portal.changelog.empty.description": "Загляните позже, чтобы увидеть последние обновления и новые возможности.",
-  "portal.changelog.entryNotFound.title": "Запись в журнале изменений не найдена",
-  "portal.changelog.entryNotFound.description": "Эта запись могла быть удалена или ещё не опубликована.",
-  "portal.changelog.entryNotFound.backLink": "Журнал изменений",
   "portal.roadmap.title": "Дорожная карта",
   "portal.roadmap.description": "Посмотрите, над чем мы работаем и что будет дальше.",
   "portal.roadmap.empty.title": "Дорожные карты недоступны",
   "portal.roadmap.empty.description": "Загляните позже, чтобы посмотреть, над чем мы работаем.",
   "portal.roadmap.column.empty": "Пока пусто",
-  "portal.help.title": "Помощь",
-  "portal.help.description": "Найдите ответы на вопросы и узнайте, как получить максимум от нашего продукта.",
-  "portal.help.categoryNotFound.title": "Категория не найдена",
-  "portal.help.categoryNotFound.description": "Эта категория могла быть удалена или не существует.",
-  "portal.help.categoryNotFound.backLink": "Помощь",
-  "portal.help.articleNotFound.title": "Статья не найдена",
-  "portal.help.articleNotFound.description": "Эта статья могла быть удалена или ещё не опубликована.",
-  "portal.help.articleNotFound.backLink": "Помощь",
-  "portal.notifications.title": "Уведомления",
-  "portal.notifications.subtitle": "Обновления по предложениям, на которые вы подписаны",
-  "portal.notifications.markAllRead": "Отметить всё прочитанным",
-  "portal.notifications.readAll": "Прочитать всё",
-  "portal.notifications.groupToday": "Сегодня",
-  "portal.notifications.groupYesterday": "Вчера",
-  "portal.notifications.groupEarlier": "Ранее",
-  "portal.notifications.empty.title": "Все прочитано",
-  "portal.notifications.empty.description": "Голосуйте или комментируйте чтобы подписаться. Мы сообщим об изменениях статуса и новой активности.",
-  "portal.settings.profile.title": "Профиль",
-  "portal.settings.profile.description": "Управляйте личной информацией",
-  "portal.settings.preferences.title": "Настройки",
-  "portal.settings.preferences.description": "Настройте работу приложения под себя",
-  "portal.settings.preferences.appearance.title": "Внешний вид",
   "portal.settings.preferences.appearance.description": "Настройте внешний вид приложения",
   "portal.settings.preferences.appearance.themeLabel": "Цветовая схема",
-  "portal.settings.preferences.notifications.title": "Уведомления по почте",
+  "portal.settings.preferences.appearance.title": "Внешний вид",
+  "portal.settings.preferences.description": "Настройте работу приложения под себя",
   "portal.settings.preferences.notifications.description": "Настройте уведомления по предложениям, на которые вы подписаны",
+  "portal.settings.preferences.notifications.title": "Уведомления по почте",
+  "portal.settings.preferences.title": "Настройки",
+  "portal.settings.profile.description": "Управляйте личной информацией",
+  "portal.settings.profile.title": "Профиль",
   "portal.subscriptionBell.aria.subscribe": "Подписаться на уведомления",
-  "portal.subscriptionBell.aria.subscribedStatusOnly": "Вы подписаны только на изменения статуса",
   "portal.subscriptionBell.aria.subscribedAll": "Вы подписаны на всю активность",
-  "portal.subscriptionBell.menu.title": "Уведомления",
-  "portal.subscriptionBell.menu.subtitle": "Выберите тип уведомлений",
+  "portal.subscriptionBell.aria.subscribedStatusOnly": "Вы подписаны только на изменения статуса",
   "portal.subscriptionBell.level.all": "Все обновления",
   "portal.subscriptionBell.level.allHint": "Комментарии и изменения статуса",
   "portal.subscriptionBell.level.statusOnly": "Только статус",
   "portal.subscriptionBell.level.statusOnlyHint": "Когда меняется статус",
   "portal.subscriptionBell.level.unsubscribe": "Отписаться",
-  "portal.unsubscribeBanner.message": "Вы отписались от этого предложения. Нажмите на колокольчик, чтобы подписаться снова.",
+  "portal.subscriptionBell.menu.subtitle": "Выберите тип уведомлений",
+  "portal.subscriptionBell.menu.title": "Уведомления",
   "portal.unsubscribeBanner.dismiss": "Скрыть",
-  "portal.pinnedComment.pinnedBadge": "Закреплено",
-  "portal.postCard.authorFallback": "Аноним",
-  "portal.postCard.editNotAllowed": "Редактирование недоступно",
-  "portal.postCard.deleteNotAllowed": "Удаление недоступно",
-  "portal.postCard.quickActions.viewInPortal": "Открыть в портале",
-  "portal.postCard.quickActions.copyLink": "Копировать ссылку",
-  "portal.postCard.quickActions.edit": "Редактировать",
-  "portal.postCard.quickActions.delete": "Удалить",
-  "portal.postCard.quickActions.options": "Действия",
-  "portal.postCard.vote.ariaVote": "Проголосовать за это предложение ({count, plural, one {# голос} few {# голоса} many {# голосов} other {# голоса}})",
-  "portal.postCard.vote.ariaRemoveVote": "Убрать голос ({count, plural, one {# голос} few {# голоса} many {# голосов} other {# голоса}})",
-  "portal.postCard.toast.linkCopied": "Ссылка скопирована в буфер обмена",
-  "portal.postCard.toast.linkCopyFailed": "Не удалось скопировать ссылку",
-  "portal.commentThread.empty": "Комментариев пока нет. Оставьте первый.",
-  "portal.commentThread.signInToComment": "Войдите, чтобы комментировать",
-  "portal.commentThread.signIn": "Войти",
-  "portal.commentThread.deleted": "[удалено]",
-  "portal.commentThread.removed": "[скрыто]",
-  "portal.commentThread.authorFallback": "Аноним",
-  "portal.commentThread.authorAlt": "Автор комментария",
-  "portal.commentThread.teamBadge": "Команда",
-  "portal.commentThread.internalNote": "Внутренняя заметка",
-  "portal.commentThread.internalNoteHint": "Видно только команде",
-  "portal.commentThread.pinnedBadge": "Закреплено",
-  "portal.commentThread.changedStatusTo": "изменил статус на",
-  "portal.commentThread.reply": "Ответить",
-  "portal.commentThread.pin": "Закрепить",
-  "portal.commentThread.unpin": "Открепить",
-  "portal.commentThread.restore": "Восстановить",
-  "portal.commentThread.restoring": "Восстановление...",
-  "portal.commentThread.delete": "Удалить",
-  "portal.commentThread.deleting": "Удаление...",
-  "portal.commentForm.labelSrOnly": "Ваш комментарий",
-  "portal.commentForm.placeholder": "Напишите комментарий...",
-  "portal.commentForm.authorFallback": "Аноним",
-  "portal.commentForm.noStatus": "Без статуса",
-  "portal.commentForm.updateStatus": "Изменить статус",
-  "portal.commentForm.clearStatusChange": "Отменить изменение статуса",
-  "portal.commentForm.postingAnonymously": "Анонимно",
-  "portal.commentForm.postingAs": "Вы публикуете как {name}",
-  "portal.commentForm.signOut": "выйти",
-  "portal.commentForm.cancel": "Отмена",
-  "portal.commentForm.private": "Только для команды",
-  "portal.commentForm.privateLockedTooltip": "Ответы на такие комментарии тоже видны только команде",
-  "portal.commentForm.privateOnTooltip": "Видно только команде",
-  "portal.commentForm.privateOffTooltip": "Сделать комментарий видимым только команде",
-  "portal.commentForm.submit": "Отправить",
-  "portal.commentForm.submitWithStatus": "Отправить и установить статус {statusName}",
-  "portal.commentForm.reply": "Ответить",
-  "portal.commentForm.submitting": "Отправка...",
-  "portal.commentForm.errorPost": "Не удалось отправить комментарий",
-  "portal.feedback.filter.addFilter": "Добавить фильтр",
-  "portal.feedback.filter.back": "Назад",
-  "portal.feedback.filter.category.board": "Доска",
-  "portal.feedback.filter.category.status": "Статус",
-  "portal.feedback.filter.category.tag": "Тег",
-  "portal.feedback.filter.category.votes": "Количество голосов",
-  "portal.feedback.filter.category.date": "Дата создания",
-  "portal.feedback.filter.category.response": "Ответ команды",
-  "portal.feedback.filter.statusGroup.active": "Активные",
-  "portal.feedback.filter.statusGroup.complete": "Завершённые",
-  "portal.feedback.filter.statusGroup.closed": "Закрытые",
-  "portal.feedback.filter.chip.board": "Доска:",
-  "portal.feedback.filter.chip.status": "Статус:",
-  "portal.feedback.filter.chip.tag": "Тег:",
-  "portal.feedback.filter.chip.tags": "Теги:",
-  "portal.feedback.filter.chip.votes": "Мин. голосов:",
-  "portal.feedback.filter.chip.date": "Дата:",
-  "portal.feedback.filter.chip.response": "Ответ команды:",
+  "portal.unsubscribeBanner.message": "Вы отписались от этого предложения. Нажмите на колокольчик, чтобы подписаться снова.",
+  "tickets.audience.internal": "Internal note",
+  "tickets.audience.public": "Public reply",
+  "tickets.audience.shared_team": "Shared with team",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "Email",
+  "tickets.channel.portal": "Portal",
+  "tickets.channel.widget": "Widget",
+  "tickets.notifications.assigned": "Assigned to you: {subject}",
+  "tickets.notifications.opened": "Ticket opened: {subject}",
+  "tickets.notifications.participantAdded": "Added to ticket: {subject}",
+  "tickets.notifications.participantRemoved": "Removed from ticket: {subject}",
+  "tickets.notifications.shared": "Ticket shared: {subject}",
+  "tickets.notifications.slaBreach": "SLA breached: {subject}",
+  "tickets.notifications.slaWarning": "SLA at risk: {subject}",
+  "tickets.notifications.statusChanged": "Status: {subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "New reply: {subject}",
+  "tickets.notifications.unassigned": "Unassigned: {subject}",
+  "tickets.notifications.unshared": "Ticket unshared: {subject}",
+  "tickets.priority.high": "High",
+  "tickets.priority.low": "Low",
+  "tickets.priority.normal": "Normal",
+  "tickets.priority.urgent": "Urgent",
+  "tickets.role.cc": "CC",
+  "tickets.role.collaborator": "Collaborator",
+  "tickets.role.watcher": "Watcher",
+  "tickets.scope.all": "All",
+  "tickets.scope.inbox": "Inbox",
+  "tickets.scope.my_assigned": "Assigned to me",
+  "tickets.scope.my_inbox": "My inbox",
+  "tickets.scope.my_team": "My team",
+  "tickets.scope.shared_with_me": "Shared with me",
+  "tickets.scope.unassigned": "Unassigned",
+  "tickets.share.comment": "Comment",
+  "tickets.share.full": "Full access",
+  "tickets.share.read": "Read",
+  "tickets.sla.kind.first_response": "First response",
+  "tickets.sla.kind.next_response": "Next response",
+  "tickets.sla.kind.resolution": "Resolution",
+  "tickets.sla.state.breached": "Breached",
+  "tickets.sla.state.cancelled": "Cancelled",
+  "tickets.sla.state.met": "Met",
+  "tickets.sla.state.paused": "Paused",
+  "tickets.sla.state.running": "Running",
+  "tickets.status.closed": "Closed",
+  "tickets.status.on_hold": "On hold",
+  "tickets.status.open": "Open",
+  "tickets.status.pending": "Pending",
+  "tickets.status.solved": "Solved",
+  "tickets.subscription.mute": "Mute",
+  "tickets.subscription.muted": "Muted",
+  "tickets.subscription.notify.assignment": "Assignment changes",
+  "tickets.subscription.notify.participants": "Participant changes",
+  "tickets.subscription.notify.shares": "Share grants",
+  "tickets.subscription.notify.sla": "SLA warnings & breaches",
+  "tickets.subscription.notify.status": "Status changes",
+  "tickets.subscription.notify.threads": "New replies",
+  "tickets.subscription.source.auto_assigned": "Auto (assignee)",
+  "tickets.subscription.source.auto_participant": "Auto (participant)",
+  "tickets.subscription.source.auto_team_member": "Auto (team member)",
+  "tickets.subscription.source.manual": "Manual",
+  "tickets.subscription.unmute": "Unmute",
+  "tickets.visibility.org": "Organization",
+  "tickets.visibility.private": "Private",
+  "tickets.visibility.shared": "Shared",
+  "tickets.visibility.team": "Team only",
   "widget.home.posting.selectBoard": "Выберите категорию",
-  "portal.feedback.toolbar.filter": "Фильтр",
   "portal.roadmap.toolbar.sortBy": "Сортировка",
   "portal.roadmap.toolbar.sortVotes": "По голосам",
   "portal.roadmap.toolbar.sortNewest": "Сначала новые",
@@ -441,5 +507,60 @@
   "portal.hc.contactSupport.body": "Начните переписку с нашей командой, и мы вам ответим.",
   "portal.hc.contactSupport.cta": "Связаться с поддержкой",
   "portal.hc.articleFeedback.stillStuck": "Все еще не получается?",
-  "portal.hc.articleFeedback.contactSupport": "Связаться с поддержкой"
+  "portal.hc.articleFeedback.contactSupport": "Связаться с поддержкой",
+  "portal.header.nav.tickets": "Мои обращения",
+  "portal.tickets.title": "Мои обращения",
+  "portal.tickets.subtitle": "Обращения, которые вы создали или к которым вас добавили.",
+  "portal.tickets.empty.title": "Обращений пока нет",
+  "portal.tickets.empty.description": "Когда наша команда возьмет ваш запрос в работу, он появится здесь.",
+  "portal.tickets.filter.all": "Все",
+  "portal.tickets.filter.open": "Открытые",
+  "portal.tickets.filter.pending": "В ожидании",
+  "portal.tickets.filter.solved": "Решенные",
+  "portal.tickets.filter.closed": "Закрытые",
+  "portal.tickets.row.updated": "Обновлено {when}",
+  "portal.tickets.detail.back": "Мои обращения",
+  "portal.tickets.detail.description": "Описание",
+  "portal.tickets.detail.openedAt": "Создано {date}",
+  "portal.tickets.detail.lastUpdate": "Последнее обновление {when}",
+  "portal.tickets.detail.noReplies": "Ответов пока нет.",
+  "portal.tickets.detail.supportTeam": "Команда поддержки",
+  "portal.tickets.detail.you": "Вы",
+  "portal.tickets.detail.edited": "изменено",
+  "portal.tickets.composer.placeholder": "Введите ваш ответ…",
+  "portal.tickets.composer.send": "Отправить ответ",
+  "portal.tickets.composer.sending": "Отправка…",
+  "portal.tickets.composer.closed": "Это обращение закрыто. Создайте новое, чтобы продолжить.",
+  "widget.support.card.title": "Связаться с поддержкой",
+  "widget.support.card.description": "Получите помощь напрямую от нашей команды.",
+  "widget.support.card.cta": "Создать обращение",
+  "widget.support.composer.subjectPlaceholder": "Тема",
+  "widget.support.composer.bodyPlaceholder": "Опишите вашу проблему...",
+  "widget.support.composer.namePlaceholder": "Ваше имя (необязательно)",
+  "widget.support.composer.emailPlaceholder": "Ваш email",
+  "widget.support.composer.priority.label": "Приоритет",
+  "widget.support.composer.priority.low": "Низкий",
+  "widget.support.composer.priority.normal": "Обычный",
+  "widget.support.composer.priority.high": "Высокий",
+  "widget.support.composer.submit": "Отправить",
+  "widget.support.composer.submitting": "Отправка...",
+  "widget.support.composer.errorCreate": "Не удалось создать обращение. Попробуйте еще раз.",
+  "widget.support.composer.errorEmail": "Не удалось проверить ваш email. Попробуйте еще раз.",
+  "widget.support.list.heading": "Ваши обращения",
+  "widget.support.list.newTicket": "Новое обращение",
+  "widget.support.list.empty": "Вы еще не создали ни одного обращения.",
+  "widget.support.list.emptyAnonymous": "Войдите, чтобы просмотреть свои обращения.",
+  "widget.support.list.errorLoad": "Не удалось загрузить ваши обращения.",
+  "widget.support.detail.errorLoad": "Не удалось загрузить это обращение.",
+  "widget.support.detail.threadEmpty": "Ответов пока нет.",
+  "widget.support.detail.youLabel": "Вы",
+  "widget.support.detail.replyPlaceholder": "Введите ваш ответ...",
+  "widget.support.detail.replySend": "Ответить",
+  "widget.support.detail.replySending": "Отправка...",
+  "widget.support.detail.errorReply": "Не удалось отправить ваш ответ.",
+  "widget.support.detail.resolve": "Отметить как решенное",
+  "widget.support.detail.resolved": "Решено",
+  "widget.support.detail.errorResolve": "Не удалось отметить это обращение как решенное.",
+  "widget.support.detail.reopen": "Открыть снова",
+  "widget.support.detail.errorReopen": "Не удалось открыть это обращение снова."
 }
diff --git a/apps/web/src/locales/zh-cn.json b/apps/web/src/locales/zh-cn.json
index fc2b07da7..fe879f2c5 100644
--- a/apps/web/src/locales/zh-cn.json
+++ b/apps/web/src/locales/zh-cn.json
@@ -441,5 +441,126 @@
   "portal.hc.contactSupport.body": "与我们的团队发起对话，我们会尽快回复你。",
   "portal.hc.contactSupport.cta": "联系支持",
   "portal.hc.articleFeedback.stillStuck": "还没解决？",
-  "portal.hc.articleFeedback.contactSupport": "联系支持"
+  "portal.hc.articleFeedback.contactSupport": "联系支持",
+  "portal.header.nav.tickets": "我的工单",
+  "portal.tickets.title": "我的工单",
+  "portal.tickets.subtitle": "你创建的或被添加进来的工单。",
+  "portal.tickets.empty.title": "暂无工单",
+  "portal.tickets.empty.description": "当我们的团队处理你的请求时，会显示在这里。",
+  "portal.tickets.filter.all": "全部",
+  "portal.tickets.filter.open": "未处理",
+  "portal.tickets.filter.pending": "待处理",
+  "portal.tickets.filter.solved": "已解决",
+  "portal.tickets.filter.closed": "已关闭",
+  "portal.tickets.row.updated": "更新于 {when}",
+  "portal.tickets.detail.back": "我的工单",
+  "portal.tickets.detail.description": "描述",
+  "portal.tickets.detail.openedAt": "创建于 {date}",
+  "portal.tickets.detail.lastUpdate": "最后更新 {when}",
+  "portal.tickets.detail.noReplies": "暂无回复。",
+  "portal.tickets.detail.supportTeam": "支持团队",
+  "portal.tickets.detail.you": "你",
+  "portal.tickets.detail.edited": "已编辑",
+  "portal.tickets.composer.placeholder": "输入你的回复…",
+  "portal.tickets.composer.send": "发送回复",
+  "portal.tickets.composer.sending": "发送中…",
+  "portal.tickets.composer.closed": "此工单已关闭。如需跟进，请创建新工单。",
+  "widget.support.card.title": "联系支持",
+  "widget.support.card.description": "直接从我们的团队获得帮助。",
+  "widget.support.card.cta": "创建工单",
+  "widget.support.composer.subjectPlaceholder": "主题",
+  "widget.support.composer.bodyPlaceholder": "描述你的问题…",
+  "widget.support.composer.namePlaceholder": "你的姓名（选填）",
+  "widget.support.composer.emailPlaceholder": "你的邮箱",
+  "widget.support.composer.priority.label": "优先级",
+  "widget.support.composer.priority.low": "低",
+  "widget.support.composer.priority.normal": "普通",
+  "widget.support.composer.priority.high": "高",
+  "widget.support.composer.submit": "发送",
+  "widget.support.composer.submitting": "发送中…",
+  "widget.support.composer.errorCreate": "无法创建工单。请重试。",
+  "widget.support.composer.errorEmail": "无法验证你的邮箱。请重试。",
+  "widget.support.list.heading": "你的工单",
+  "widget.support.list.newTicket": "新建工单",
+  "widget.support.list.empty": "你还没有创建任何工单。",
+  "widget.support.list.emptyAnonymous": "登录以查看你的工单。",
+  "widget.support.list.errorLoad": "无法加载你的工单。",
+  "widget.support.detail.errorLoad": "无法加载此工单。",
+  "widget.support.detail.threadEmpty": "暂无回复。",
+  "widget.support.detail.youLabel": "你",
+  "widget.support.detail.replyPlaceholder": "输入你的回复…",
+  "widget.support.detail.replySend": "回复",
+  "widget.support.detail.replySending": "发送中…",
+  "widget.support.detail.errorReply": "无法发布你的回复。",
+  "widget.support.detail.resolve": "标记为已解决",
+  "widget.support.detail.resolved": "已解决",
+  "widget.support.detail.errorResolve": "无法将此工单标记为已解决。",
+  "widget.support.detail.reopen": "重新打开",
+  "widget.support.detail.errorReopen": "无法重新打开此工单。",
+  "tickets.audience.internal": "内部备注",
+  "tickets.audience.public": "公开回复",
+  "tickets.audience.shared_team": "与团队共享",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "邮件",
+  "tickets.channel.portal": "门户",
+  "tickets.channel.widget": "小组件",
+  "tickets.notifications.assigned": "已指派给你：{subject}",
+  "tickets.notifications.opened": "工单已创建：{subject}",
+  "tickets.notifications.participantAdded": "已添加到工单：{subject}",
+  "tickets.notifications.participantRemoved": "已从工单移除：{subject}",
+  "tickets.notifications.shared": "工单已共享：{subject}",
+  "tickets.notifications.slaBreach": "SLA 已违约：{subject}",
+  "tickets.notifications.slaWarning": "SLA 存在风险：{subject}",
+  "tickets.notifications.statusChanged": "状态：{subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "新回复：{subject}",
+  "tickets.notifications.unassigned": "已取消指派：{subject}",
+  "tickets.notifications.unshared": "已取消共享：{subject}",
+  "tickets.priority.high": "高",
+  "tickets.priority.low": "低",
+  "tickets.priority.normal": "普通",
+  "tickets.priority.urgent": "紧急",
+  "tickets.role.cc": "抄送",
+  "tickets.role.collaborator": "协作者",
+  "tickets.role.watcher": "关注者",
+  "tickets.scope.all": "全部",
+  "tickets.scope.inbox": "收件箱",
+  "tickets.scope.my_assigned": "指派给我的",
+  "tickets.scope.my_inbox": "我的收件箱",
+  "tickets.scope.my_team": "我的团队",
+  "tickets.scope.shared_with_me": "与我共享的",
+  "tickets.scope.unassigned": "未指派",
+  "tickets.share.comment": "评论",
+  "tickets.share.full": "完全访问",
+  "tickets.share.read": "只读",
+  "tickets.sla.kind.first_response": "首次响应",
+  "tickets.sla.kind.next_response": "下次响应",
+  "tickets.sla.kind.resolution": "解决",
+  "tickets.sla.state.breached": "已违约",
+  "tickets.sla.state.cancelled": "已取消",
+  "tickets.sla.state.met": "已达成",
+  "tickets.sla.state.paused": "已暂停",
+  "tickets.sla.state.running": "进行中",
+  "tickets.status.closed": "已关闭",
+  "tickets.status.on_hold": "搁置中",
+  "tickets.status.open": "未处理",
+  "tickets.status.pending": "待处理",
+  "tickets.status.solved": "已解决",
+  "tickets.subscription.mute": "静音",
+  "tickets.subscription.muted": "已静音",
+  "tickets.subscription.notify.assignment": "指派变更",
+  "tickets.subscription.notify.participants": "参与者变更",
+  "tickets.subscription.notify.shares": "共享授权",
+  "tickets.subscription.notify.sla": "SLA 警告与违约",
+  "tickets.subscription.notify.status": "状态变更",
+  "tickets.subscription.notify.threads": "新回复",
+  "tickets.subscription.source.auto_assigned": "自动（负责人）",
+  "tickets.subscription.source.auto_participant": "自动（参与者）",
+  "tickets.subscription.source.auto_team_member": "自动（团队成员）",
+  "tickets.subscription.source.manual": "手动",
+  "tickets.subscription.unmute": "取消静音",
+  "tickets.visibility.org": "组织",
+  "tickets.visibility.private": "私密",
+  "tickets.visibility.shared": "已共享",
+  "tickets.visibility.team": "仅团队"
 }
diff --git a/apps/web/src/locales/zh-tw.json b/apps/web/src/locales/zh-tw.json
index 05208b7cb..adfd2cbf9 100644
--- a/apps/web/src/locales/zh-tw.json
+++ b/apps/web/src/locales/zh-tw.json
@@ -441,5 +441,126 @@
   "portal.hc.contactSupport.body": "與我們的團隊開始對話，我們會盡快回覆你。",
   "portal.hc.contactSupport.cta": "聯絡支援",
   "portal.hc.articleFeedback.stillStuck": "還有問題嗎？",
-  "portal.hc.articleFeedback.contactSupport": "聯絡支援"
+  "portal.hc.articleFeedback.contactSupport": "聯絡支援",
+  "portal.header.nav.tickets": "我的工單",
+  "portal.tickets.title": "我的工單",
+  "portal.tickets.subtitle": "你建立的或被加入的工單。",
+  "portal.tickets.empty.title": "尚無工單",
+  "portal.tickets.empty.description": "當我們的團隊處理你的請求時，會顯示在這裡。",
+  "portal.tickets.filter.all": "全部",
+  "portal.tickets.filter.open": "處理中",
+  "portal.tickets.filter.pending": "待處理",
+  "portal.tickets.filter.solved": "已解決",
+  "portal.tickets.filter.closed": "已關閉",
+  "portal.tickets.row.updated": "更新於 {when}",
+  "portal.tickets.detail.back": "我的工單",
+  "portal.tickets.detail.description": "描述",
+  "portal.tickets.detail.openedAt": "建立於 {date}",
+  "portal.tickets.detail.lastUpdate": "最後更新 {when}",
+  "portal.tickets.detail.noReplies": "尚無回覆。",
+  "portal.tickets.detail.supportTeam": "支援團隊",
+  "portal.tickets.detail.you": "你",
+  "portal.tickets.detail.edited": "已編輯",
+  "portal.tickets.composer.placeholder": "輸入你的回覆…",
+  "portal.tickets.composer.send": "傳送回覆",
+  "portal.tickets.composer.sending": "傳送中…",
+  "portal.tickets.composer.closed": "此工單已關閉。如需後續處理，請建立新工單。",
+  "widget.support.card.title": "聯絡支援",
+  "widget.support.card.description": "直接向我們的團隊尋求協助。",
+  "widget.support.card.cta": "建立工單",
+  "widget.support.composer.subjectPlaceholder": "主旨",
+  "widget.support.composer.bodyPlaceholder": "描述你的問題…",
+  "widget.support.composer.namePlaceholder": "你的名稱（選填）",
+  "widget.support.composer.emailPlaceholder": "你的電子郵件",
+  "widget.support.composer.priority.label": "優先順序",
+  "widget.support.composer.priority.low": "低",
+  "widget.support.composer.priority.normal": "一般",
+  "widget.support.composer.priority.high": "高",
+  "widget.support.composer.submit": "傳送",
+  "widget.support.composer.submitting": "傳送中…",
+  "widget.support.composer.errorCreate": "無法建立工單。請再試一次。",
+  "widget.support.composer.errorEmail": "無法驗證你的電子郵件。請再試一次。",
+  "widget.support.list.heading": "你的工單",
+  "widget.support.list.newTicket": "新增工單",
+  "widget.support.list.empty": "你還沒有建立任何工單。",
+  "widget.support.list.emptyAnonymous": "登入以查看你的工單。",
+  "widget.support.list.errorLoad": "無法載入你的工單。",
+  "widget.support.detail.errorLoad": "無法載入此工單。",
+  "widget.support.detail.threadEmpty": "尚無回覆。",
+  "widget.support.detail.youLabel": "你",
+  "widget.support.detail.replyPlaceholder": "輸入你的回覆…",
+  "widget.support.detail.replySend": "回覆",
+  "widget.support.detail.replySending": "傳送中…",
+  "widget.support.detail.errorReply": "無法張貼你的回覆。",
+  "widget.support.detail.resolve": "標記為已解決",
+  "widget.support.detail.resolved": "已解決",
+  "widget.support.detail.errorResolve": "無法將此工單標記為已解決。",
+  "widget.support.detail.reopen": "重新開啟",
+  "widget.support.detail.errorReopen": "無法重新開啟此工單。",
+  "tickets.audience.internal": "內部備註",
+  "tickets.audience.public": "公開回覆",
+  "tickets.audience.shared_team": "與團隊共用",
+  "tickets.channel.api": "API",
+  "tickets.channel.email": "電子郵件",
+  "tickets.channel.portal": "入口網站",
+  "tickets.channel.widget": "小工具",
+  "tickets.notifications.assigned": "已指派給你：{subject}",
+  "tickets.notifications.opened": "工單已建立：{subject}",
+  "tickets.notifications.participantAdded": "已加入工單：{subject}",
+  "tickets.notifications.participantRemoved": "已從工單移除：{subject}",
+  "tickets.notifications.shared": "工單已共用：{subject}",
+  "tickets.notifications.slaBreach": "SLA 已違反：{subject}",
+  "tickets.notifications.slaWarning": "SLA 有風險：{subject}",
+  "tickets.notifications.statusChanged": "狀態：{subject}",
+  "tickets.notifications.statusChangedBody": "{from} → {to}",
+  "tickets.notifications.threadAdded": "新回覆：{subject}",
+  "tickets.notifications.unassigned": "已取消指派：{subject}",
+  "tickets.notifications.unshared": "已取消共用：{subject}",
+  "tickets.priority.high": "高",
+  "tickets.priority.low": "低",
+  "tickets.priority.normal": "一般",
+  "tickets.priority.urgent": "緊急",
+  "tickets.role.cc": "副本",
+  "tickets.role.collaborator": "協作者",
+  "tickets.role.watcher": "關注者",
+  "tickets.scope.all": "全部",
+  "tickets.scope.inbox": "收件匣",
+  "tickets.scope.my_assigned": "指派給我的",
+  "tickets.scope.my_inbox": "我的收件匣",
+  "tickets.scope.my_team": "我的團隊",
+  "tickets.scope.shared_with_me": "與我共用的",
+  "tickets.scope.unassigned": "未指派",
+  "tickets.share.comment": "留言",
+  "tickets.share.full": "完整存取",
+  "tickets.share.read": "唯讀",
+  "tickets.sla.kind.first_response": "首次回應",
+  "tickets.sla.kind.next_response": "下次回應",
+  "tickets.sla.kind.resolution": "解決",
+  "tickets.sla.state.breached": "已違反",
+  "tickets.sla.state.cancelled": "已取消",
+  "tickets.sla.state.met": "已達成",
+  "tickets.sla.state.paused": "已暫停",
+  "tickets.sla.state.running": "進行中",
+  "tickets.status.closed": "已關閉",
+  "tickets.status.on_hold": "擱置中",
+  "tickets.status.open": "處理中",
+  "tickets.status.pending": "待處理",
+  "tickets.status.solved": "已解決",
+  "tickets.subscription.mute": "靜音",
+  "tickets.subscription.muted": "已靜音",
+  "tickets.subscription.notify.assignment": "指派變更",
+  "tickets.subscription.notify.participants": "參與者變更",
+  "tickets.subscription.notify.shares": "共用授權",
+  "tickets.subscription.notify.sla": "SLA 警告與違反",
+  "tickets.subscription.notify.status": "狀態變更",
+  "tickets.subscription.notify.threads": "新回覆",
+  "tickets.subscription.source.auto_assigned": "自動（負責人）",
+  "tickets.subscription.source.auto_participant": "自動（參與者）",
+  "tickets.subscription.source.auto_team_member": "自動（團隊成員）",
+  "tickets.subscription.source.manual": "手動",
+  "tickets.subscription.unmute": "取消靜音",
+  "tickets.visibility.org": "組織",
+  "tickets.visibility.private": "私人",
+  "tickets.visibility.shared": "已共用",
+  "tickets.visibility.team": "僅團隊"
 }
diff --git a/apps/web/src/routes/[.]well-known.oauth-protected-resource.ts b/apps/web/src/routes/[.]well-known.oauth-protected-resource.ts
index ab7f46b75..6cb0e13bc 100644
--- a/apps/web/src/routes/[.]well-known.oauth-protected-resource.ts
+++ b/apps/web/src/routes/[.]well-known.oauth-protected-resource.ts
@@ -16,6 +16,7 @@ export const Route = createFileRoute('/.well-known/oauth-protected-resource')({
     handlers: {
       GET: async () => {
         const { config } = await import('@/lib/server/config')
+        const { MCP_SCOPES } = await import('@/lib/server/mcp/types')
         const baseUrl = config.baseUrl
 
         return new Response(
@@ -23,19 +24,7 @@ export const Route = createFileRoute('/.well-known/oauth-protected-resource')({
             resource: `${baseUrl}/api/mcp`,
             authorization_servers: [baseUrl],
             bearer_methods_supported: ['header'],
-            scopes_supported: [
-              'openid',
-              'profile',
-              'email',
-              'offline_access',
-              'read:feedback',
-              'write:feedback',
-              'write:changelog',
-              'read:article',
-              'write:article',
-              'read:chat',
-              'write:chat',
-            ],
+            scopes_supported: ['openid', 'profile', 'email', 'offline_access', ...MCP_SCOPES],
           }),
           {
             headers: {
diff --git a/apps/web/src/routes/__tests__/[.]well-known.oauth-protected-resource.gap.test.ts b/apps/web/src/routes/__tests__/[.]well-known.oauth-protected-resource.gap.test.ts
new file mode 100644
index 000000000..c4699bed5
--- /dev/null
+++ b/apps/web/src/routes/__tests__/[.]well-known.oauth-protected-resource.gap.test.ts
@@ -0,0 +1,53 @@
+import { describe, it, expect, vi } from 'vitest'
+
+// Mock createFileRoute so Route exposes the handler config under .options.
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (cfg: unknown) => ({ options: cfg }),
+}))
+
+// Source dynamically imports these inside the handler.
+vi.mock('@/lib/server/config', () => ({
+  config: { baseUrl: 'https://example.test' },
+}))
+vi.mock('@/lib/server/mcp/types', () => ({
+  MCP_SCOPES: ['mcp:read', 'mcp:write'],
+}))
+
+import { Route } from '../[.]well-known.oauth-protected-resource'
+
+function getGET() {
+  return (
+    Route as unknown as {
+      options: { server: { handlers: { GET: (a: { request: Request }) => Promise<Response> } } }
+    }
+  ).options.server.handlers.GET
+}
+
+describe('GET /.well-known/oauth-protected-resource', () => {
+  it('returns RFC 9728 metadata derived from config.baseUrl', async () => {
+    const res = await getGET()({
+      request: new Request('https://example.test/.well-known/oauth-protected-resource'),
+    })
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Content-Type')).toBe('application/json')
+    expect(res.headers.get('Cache-Control')).toBe('public, max-age=3600')
+
+    const body = (await res.json()) as {
+      resource: string
+      authorization_servers: string[]
+      bearer_methods_supported: string[]
+      scopes_supported: string[]
+    }
+    expect(body.resource).toBe('https://example.test/api/mcp')
+    expect(body.authorization_servers).toEqual(['https://example.test'])
+    expect(body.bearer_methods_supported).toEqual(['header'])
+    expect(body.scopes_supported).toEqual([
+      'openid',
+      'profile',
+      'email',
+      'offline_access',
+      'mcp:read',
+      'mcp:write',
+    ])
+  })
+})
diff --git a/apps/web/src/routes/_portal/__tests__/tickets.$ticketId.diffcov.test.tsx b/apps/web/src/routes/_portal/__tests__/tickets.$ticketId.diffcov.test.tsx
new file mode 100644
index 000000000..b28cfe44c
--- /dev/null
+++ b/apps/web/src/routes/_portal/__tests__/tickets.$ticketId.diffcov.test.tsx
@@ -0,0 +1,478 @@
+// @vitest-environment happy-dom
+
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+  disabled?: boolean
+  variant?: string
+  size?: string
+}
+
+type QueryOptions = { queryKey: readonly unknown[] }
+
+type MutationOptions<TVars, TResult> = {
+  mutationFn: (vars: TVars) => Promise<TResult>
+  onSuccess?: (result: TResult) => void
+  onError?: (error: Error) => void
+}
+
+type RouteOptions = {
+  parseParams: (params: { ticketId: string }) => { ticketId: string }
+  loader: (input: {
+    context: {
+      session?: { user?: { id?: string } } | null
+      queryClient: { ensureQueryData: (query: unknown) => Promise<unknown> }
+      settings?: { name?: string }
+    }
+    params: { ticketId: string }
+  }) => Promise<{ workspaceName: string }>
+  head: (input: { loaderData?: { workspaceName?: string } }) => { meta: Array<{ title: string }> }
+  component: () => ReactElement
+}
+
+type TicketData = {
+  ticket: {
+    subject: string
+    statusName: string
+    statusCategory: 'open' | 'pending' | 'on_hold' | 'solved' | 'closed'
+    createdAt: Date
+    lastActivityAt: Date
+    updatedAt: Date
+    descriptionText: string | null
+    descriptionJson: unknown
+  }
+  threads: unknown[]
+  principalNames: Record<string, string>
+  viewerPrincipalId: string
+  viewerRelationship: 'requester' | 'collaborator' | 'watcher'
+}
+
+const mocks = vi.hoisted(() => ({
+  isValidTypeId: vi.fn((_value: string, _prefix?: string) => true),
+  ensureQueryData: vi.fn(async () => undefined),
+  invalidateQueries: vi.fn(),
+  getQueryData: vi.fn(),
+  setQueryData: vi.fn(),
+  closeMyTicketFn: vi.fn(async () => ({})),
+  reopenMyTicketFn: vi.fn(async () => ({})),
+  updateMyTicketDescriptionFn: vi.fn(async () => ({ updatedAt: new Date('2026-02-02T00:00:00Z') })),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  data: null as TicketData | null,
+  // record props passed to the thread feed so we can invoke its callbacks
+  threadFeedProps: null as {
+    onDescriptionUpdate?: (json: unknown, text: string | null) => void
+    isDescriptionSaving?: boolean
+  } | null,
+}))
+
+function freshData(
+  overrides: Partial<TicketData['ticket']> & {
+    viewerRelationship?: TicketData['viewerRelationship']
+  } = {}
+): TicketData {
+  const { viewerRelationship, ...ticketOverrides } = overrides
+  return {
+    ticket: {
+      subject: 'Broken billing',
+      statusName: 'Open',
+      statusCategory: 'open',
+      createdAt: new Date('2026-01-01T00:00:00Z'),
+      lastActivityAt: new Date('2026-01-02T00:00:00Z'),
+      updatedAt: new Date('2026-01-03T00:00:00Z'),
+      descriptionText: 'A description',
+      descriptionJson: { type: 'doc', content: [] },
+      ...ticketOverrides,
+    },
+    threads: [],
+    principalNames: { 'principal-1': 'Alice' },
+    viewerPrincipalId: 'principal-1',
+    viewerRelationship: viewerRelationship ?? 'requester',
+  }
+}
+
+vi.mock('@quackback/ids', () => ({
+  isValidTypeId: (value: string, prefix?: string) => mocks.isValidTypeId(value, prefix),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useParams: () => ({ ticketId: 'ticket_abc' }),
+  }),
+  redirect: (input: unknown) => {
+    throw { redirect: input }
+  },
+  notFound: () => {
+    throw { notFound: true }
+  },
+  Link: ({ children, to }: ComponentProps & { to?: string }) => <a href={to}>{children}</a>,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: () => ({ data: mocks.data }),
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+    getQueryData: mocks.getQueryData,
+    setQueryData: mocks.setQueryData,
+  }),
+  useMutation: <TVars, TResult>(options: MutationOptions<TVars, TResult>) => ({
+    isPending: false,
+    mutate: async (vars: TVars) => {
+      try {
+        const result = await options.mutationFn(vars)
+        options.onSuccess?.(result)
+      } catch (error) {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)))
+      }
+    },
+  }),
+}))
+
+vi.mock('react-intl', () => ({
+  FormattedMessage: ({ defaultMessage }: { defaultMessage: string }) => <>{defaultMessage}</>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArrowLeftIcon: () => <svg data-testid="arrow-left" />,
+}))
+
+vi.mock('sonner', () => ({
+  toast: { success: mocks.toastSuccess, error: mocks.toastError },
+}))
+
+vi.mock('@/lib/client/queries/portal-tickets', () => ({
+  portalTicketQueries: {
+    detail: (ticketId: string): QueryOptions => ({
+      queryKey: ['portal', 'tickets', 'detail', ticketId],
+    }),
+  },
+}))
+
+vi.mock('@/lib/server/functions/portal-tickets', () => ({
+  updateMyTicketDescriptionFn: mocks.updateMyTicketDescriptionFn,
+  closeMyTicketFn: mocks.closeMyTicketFn,
+  reopenMyTicketFn: mocks.reopenMyTicketFn,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children, onClick, disabled }: ComponentProps) => (
+    <button type="button" onClick={onClick} disabled={disabled}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/public/tickets/portal-ticket-detail-header', () => ({
+  PortalTicketDetailHeader: ({ subject }: { subject: string }) => <h1>{subject}</h1>,
+}))
+
+vi.mock('@/components/public/tickets/portal-ticket-thread-feed', () => ({
+  PortalTicketThreadFeed: (props: {
+    onDescriptionUpdate?: (json: unknown, text: string | null) => void
+    isDescriptionSaving?: boolean
+  }) => {
+    mocks.threadFeedProps = props
+    return (
+      <div data-testid="thread-feed">
+        saving:{String(props.isDescriptionSaving)} editable:
+        {String(Boolean(props.onDescriptionUpdate))}
+      </div>
+    )
+  },
+}))
+
+vi.mock('@/components/public/tickets/portal-ticket-reply-composer', () => ({
+  PortalTicketReplyComposer: ({ ticketId, isClosed }: { ticketId: string; isClosed: boolean }) => (
+    <div data-testid="composer">
+      composer:{ticketId}:{String(isClosed)}
+    </div>
+  ),
+}))
+
+const { Route } = await import('../tickets.$ticketId')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.isValidTypeId.mockReturnValue(true)
+  mocks.ensureQueryData.mockResolvedValue(undefined)
+  mocks.getQueryData.mockReturnValue(undefined)
+  mocks.closeMyTicketFn.mockResolvedValue({})
+  mocks.reopenMyTicketFn.mockResolvedValue({})
+  mocks.updateMyTicketDescriptionFn.mockResolvedValue({
+    updatedAt: new Date('2026-02-02T00:00:00Z'),
+  })
+  mocks.data = freshData()
+  mocks.threadFeedProps = null
+})
+
+describe('portal ticket detail route — parseParams', () => {
+  it('returns the typed ticketId for a valid id', () => {
+    mocks.isValidTypeId.mockReturnValue(true)
+    expect(routeOptions().parseParams({ ticketId: 'ticket_abc' })).toEqual({
+      ticketId: 'ticket_abc',
+    })
+  })
+
+  it('throws notFound for an invalid id', () => {
+    mocks.isValidTypeId.mockReturnValue(false)
+    expect(() => routeOptions().parseParams({ ticketId: 'nope' })).toThrow()
+    try {
+      routeOptions().parseParams({ ticketId: 'nope' })
+    } catch (e) {
+      expect(e).toEqual({ notFound: true })
+    }
+  })
+})
+
+describe('portal ticket detail route — loader', () => {
+  it('redirects anonymous users to portal login', async () => {
+    await expect(
+      routeOptions().loader({
+        context: {
+          session: null,
+          queryClient: { ensureQueryData: mocks.ensureQueryData },
+          settings: { name: 'Acme' },
+        },
+        params: { ticketId: 'ticket_abc' },
+      })
+    ).rejects.toEqual({ redirect: { to: '/auth/login', search: { next: '/tickets/ticket_abc' } } })
+    expect(mocks.ensureQueryData).not.toHaveBeenCalled()
+  })
+
+  it('prefetches the ticket and returns the workspace name on success', async () => {
+    const result = await routeOptions().loader({
+      context: {
+        session: { user: { id: 'user-1' } },
+        queryClient: { ensureQueryData: mocks.ensureQueryData },
+        settings: { name: 'Acme' },
+      },
+      params: { ticketId: 'ticket_abc' },
+    })
+
+    expect(result).toEqual({ workspaceName: 'Acme' })
+    expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+      queryKey: ['portal', 'tickets', 'detail', 'ticket_abc'],
+    })
+  })
+
+  it('defaults workspace name to empty string when settings are absent', async () => {
+    const result = await routeOptions().loader({
+      context: {
+        session: { user: { id: 'user-1' } },
+        queryClient: { ensureQueryData: mocks.ensureQueryData },
+      },
+      params: { ticketId: 'ticket_abc' },
+    })
+    expect(result).toEqual({ workspaceName: '' })
+  })
+
+  it('converts a TICKET_NOT_FOUND domain error into a notFound', async () => {
+    mocks.ensureQueryData.mockRejectedValueOnce({ code: 'TICKET_NOT_FOUND' })
+    await expect(
+      routeOptions().loader({
+        context: {
+          session: { user: { id: 'user-1' } },
+          queryClient: { ensureQueryData: mocks.ensureQueryData },
+          settings: { name: 'Acme' },
+        },
+        params: { ticketId: 'ticket_abc' },
+      })
+    ).rejects.toEqual({ notFound: true })
+  })
+
+  it('rethrows non-notFound errors', async () => {
+    const boom = new Error('boom')
+    mocks.ensureQueryData.mockRejectedValueOnce(boom)
+    await expect(
+      routeOptions().loader({
+        context: {
+          session: { user: { id: 'user-1' } },
+          queryClient: { ensureQueryData: mocks.ensureQueryData },
+          settings: { name: 'Acme' },
+        },
+        params: { ticketId: 'ticket_abc' },
+      })
+    ).rejects.toBe(boom)
+  })
+})
+
+describe('portal ticket detail route — head', () => {
+  it('builds a workspace-scoped title when a name is present', () => {
+    expect(routeOptions().head({ loaderData: { workspaceName: 'Acme' } })).toEqual({
+      meta: [{ title: 'Ticket · Acme' }],
+    })
+  })
+
+  it('falls back to a plain title when there is no workspace name', () => {
+    expect(routeOptions().head({ loaderData: { workspaceName: '' } })).toEqual({
+      meta: [{ title: 'Ticket' }],
+    })
+    expect(routeOptions().head({})).toEqual({ meta: [{ title: 'Ticket' }] })
+  })
+})
+
+describe('portal ticket detail route — component', () => {
+  it('renders the active requester view with a solve action and editable description', async () => {
+    mocks.data = freshData({ statusCategory: 'open', viewerRelationship: 'requester' })
+    renderPage()
+
+    expect(screen.getByText('Broken billing')).toBeTruthy()
+    expect(screen.getByText('My tickets')).toBeTruthy()
+    // requester + active → composer rendered, editable description
+    expect(screen.getByTestId('composer').textContent).toContain('false')
+    expect(screen.getByTestId('thread-feed').textContent).toContain('editable:true')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Mark as solved' }))
+    await waitFor(() =>
+      expect(mocks.closeMyTicketFn).toHaveBeenCalledWith({ data: { ticketId: 'ticket_abc' } })
+    )
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Ticket marked as solved')
+    expect(mocks.invalidateQueries).toHaveBeenCalledWith({
+      queryKey: ['portal', 'tickets', 'list'],
+    })
+  })
+
+  it('surfaces a close failure through a toast error', async () => {
+    mocks.data = freshData({ statusCategory: 'open', viewerRelationship: 'requester' })
+    mocks.closeMyTicketFn.mockRejectedValueOnce(new Error('cannot close'))
+    renderPage()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Mark as solved' }))
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith('cannot close'))
+  })
+
+  it('renders a reopen action for a solved requester ticket', async () => {
+    mocks.data = freshData({ statusCategory: 'solved', viewerRelationship: 'requester' })
+    renderPage()
+
+    // solved → not active, so no "Mark as solved"; reopen present
+    expect(screen.queryByRole('button', { name: 'Mark as solved' })).toBeNull()
+    fireEvent.click(screen.getByRole('button', { name: 'Reopen' }))
+    await waitFor(() =>
+      expect(mocks.reopenMyTicketFn).toHaveBeenCalledWith({ data: { ticketId: 'ticket_abc' } })
+    )
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Ticket reopened')
+  })
+
+  it('surfaces a reopen failure through a toast error', async () => {
+    mocks.data = freshData({ statusCategory: 'solved', viewerRelationship: 'requester' })
+    mocks.reopenMyTicketFn.mockRejectedValueOnce(new Error('cannot reopen'))
+    renderPage()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Reopen' }))
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith('cannot reopen'))
+  })
+
+  it('renders a collaborator view: composer present, description not editable', () => {
+    mocks.data = freshData({ statusCategory: 'open', viewerRelationship: 'collaborator' })
+    renderPage()
+
+    expect(screen.queryByRole('button', { name: 'Mark as solved' })).toBeNull()
+    expect(screen.queryByRole('button', { name: 'Reopen' })).toBeNull()
+    expect(screen.getByTestId('composer')).toBeTruthy()
+    expect(screen.getByTestId('thread-feed').textContent).toContain('editable:false')
+  })
+
+  it('renders a watcher view with the watching notice instead of a composer', () => {
+    mocks.data = freshData({ statusCategory: 'open', viewerRelationship: 'watcher' })
+    renderPage()
+
+    expect(screen.queryByTestId('composer')).toBeNull()
+    expect(
+      screen.getByText('You are watching this ticket. Only requesters and collaborators can reply.')
+    ).toBeTruthy()
+  })
+
+  it('keeps the description read-only when a requester ticket is closed', () => {
+    mocks.data = freshData({ statusCategory: 'closed', viewerRelationship: 'requester' })
+    renderPage()
+
+    // closed → composer flagged closed, description not editable, no solve/reopen
+    expect(screen.getByTestId('composer').textContent).toContain('true')
+    expect(screen.getByTestId('thread-feed').textContent).toContain('editable:false')
+    expect(screen.queryByRole('button', { name: 'Mark as solved' })).toBeNull()
+    expect(screen.queryByRole('button', { name: 'Reopen' })).toBeNull()
+  })
+
+  it('saves a description edit using the cached expectedUpdatedAt and updates the cache', async () => {
+    mocks.data = freshData({ statusCategory: 'open', viewerRelationship: 'requester' })
+    const cached = freshData({ updatedAt: new Date('2026-05-05T00:00:00Z') })
+    mocks.getQueryData.mockReturnValue(cached)
+    renderPage()
+
+    const json = { type: 'doc', content: [] }
+    mocks.threadFeedProps?.onDescriptionUpdate?.(json, 'updated text')
+
+    await waitFor(() => expect(mocks.updateMyTicketDescriptionFn).toHaveBeenCalled())
+    expect(mocks.updateMyTicketDescriptionFn).toHaveBeenCalledWith({
+      data: {
+        ticketId: 'ticket_abc',
+        expectedUpdatedAt: cached.ticket.updatedAt,
+        descriptionJson: json,
+        descriptionText: 'updated text',
+      },
+    })
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Description updated')
+    // setQueryData updater runs both with current and (in fallback) without
+    expect(mocks.setQueryData).toHaveBeenCalled()
+    const updater = mocks.setQueryData.mock.calls[0][1] as (c: TicketData | undefined) => unknown
+    expect(updater(cached)).toMatchObject({
+      ticket: { updatedAt: new Date('2026-02-02T00:00:00Z') },
+    })
+    expect(updater(undefined)).toBeUndefined()
+  })
+
+  it('falls back to the loaded updatedAt when no detail is cached', async () => {
+    mocks.data = freshData({ statusCategory: 'open', viewerRelationship: 'requester' })
+    mocks.getQueryData.mockReturnValue(undefined)
+    renderPage()
+
+    mocks.threadFeedProps?.onDescriptionUpdate?.(null, null)
+
+    await waitFor(() =>
+      expect(mocks.updateMyTicketDescriptionFn).toHaveBeenCalledWith({
+        data: {
+          ticketId: 'ticket_abc',
+          expectedUpdatedAt: new Date('2026-01-03T00:00:00Z'),
+          descriptionJson: null,
+          descriptionText: null,
+        },
+      })
+    )
+  })
+
+  it('shows a refresh-specific toast when a description save conflicts', async () => {
+    mocks.data = freshData({ statusCategory: 'open', viewerRelationship: 'requester' })
+    mocks.updateMyTicketDescriptionFn.mockRejectedValueOnce(new Error('stale write detected'))
+    renderPage()
+
+    mocks.threadFeedProps?.onDescriptionUpdate?.({ type: 'doc' }, 'x')
+    await waitFor(() =>
+      expect(mocks.toastError).toHaveBeenCalledWith('Ticket changed — please refresh')
+    )
+  })
+
+  it('shows the raw error toast for a non-conflict description save failure', async () => {
+    mocks.data = freshData({ statusCategory: 'open', viewerRelationship: 'requester' })
+    mocks.updateMyTicketDescriptionFn.mockRejectedValueOnce(new Error('server exploded'))
+    renderPage()
+
+    mocks.threadFeedProps?.onDescriptionUpdate?.({ type: 'doc' }, 'x')
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith('server exploded'))
+  })
+})
diff --git a/apps/web/src/routes/_portal/__tests__/tickets.index.test.tsx b/apps/web/src/routes/_portal/__tests__/tickets.index.test.tsx
new file mode 100644
index 000000000..44727c66a
--- /dev/null
+++ b/apps/web/src/routes/_portal/__tests__/tickets.index.test.tsx
@@ -0,0 +1,349 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+  disabled?: boolean
+}
+
+type RouteOptions = {
+  beforeLoad: (input: { context: Record<string, unknown> }) => Promise<void>
+  loader: (input: {
+    context: {
+      session?: { user?: { id?: string } } | null
+      queryClient: { ensureQueryData: (query: unknown) => Promise<unknown> }
+      settings?: { name?: string }
+    }
+    deps: { status: 'open' | 'pending' | 'solved' | 'closed' | 'all' }
+  }) => Promise<{ workspaceName: string }>
+  head: (input: { loaderData?: { workspaceName?: string } }) => { meta: Array<{ title: string }> }
+  component: () => ReactElement
+}
+
+const mocks = vi.hoisted(() => ({
+  search: { status: 'open' as 'open' | 'pending' | 'solved' | 'closed' | 'all' },
+  navigate: vi.fn(),
+  ensureQueryData: vi.fn(async () => undefined),
+  rows: [] as Array<{ id: string; subject: string }>,
+  createTicket: vi.fn(async () => ({ id: 'ticket-1' })),
+  createTicketInitialThreadFn: vi.fn(async () => ({ id: 'thread-1' })),
+  uploadImage: vi.fn(),
+  fetch: vi.fn(async () => ({ ok: true, text: async () => '' })),
+  consoleError: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useSearch: () => mocks.search,
+    useNavigate: () => mocks.navigate,
+  }),
+  redirect: (input: unknown) => {
+    throw { redirect: input }
+  },
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: () => ({ data: { rows: mocks.rows } }),
+}))
+
+vi.mock('react-intl', () => ({
+  useIntl: () => ({
+    formatMessage: ({ defaultMessage }: { defaultMessage: string }) => defaultMessage,
+  }),
+  FormattedMessage: ({ defaultMessage }: { defaultMessage: string }) => <>{defaultMessage}</>,
+}))
+
+vi.mock('@/lib/client/queries/portal-tickets', () => ({
+  portalTicketQueries: {
+    list: (params: unknown) => ({ queryKey: ['portalTickets', params], params }),
+  },
+  useCreateMyTicket: () => ({
+    isPending: false,
+    mutateAsync: mocks.createTicket,
+  }),
+}))
+
+vi.mock('@/lib/server/functions/portal-tickets', () => ({
+  createTicketInitialThreadFn: mocks.createTicketInitialThreadFn,
+}))
+
+vi.mock('@/lib/client/hooks/use-image-upload', () => ({
+  usePortalImageUpload: () => ({ upload: mocks.uploadImage }),
+}))
+
+vi.mock('@/components/tickets/ticket-create-editor-features', () => ({
+  TICKET_CREATE_EDITOR_FEATURES: ['bold'],
+}))
+
+vi.mock('@/components/shared/empty-state', () => ({
+  EmptyState: ({ title, description }: { title: string; description: string }) => (
+    <div>
+      <h2>{title}</h2>
+      <p>{description}</p>
+    </div>
+  ),
+}))
+
+vi.mock('@/components/public/tickets/portal-ticket-row', () => ({
+  PortalTicketRowItem: ({ ticket }: { ticket: { id: string; subject: string } }) => (
+    <article>
+      Row {ticket.id} {ticket.subject}
+    </article>
+  ),
+}))
+
+vi.mock('@/components/public/tickets/portal-ticket-status-filter', () => ({
+  PortalTicketStatusFilter: ({ value }: { value: string }) => <div>Filter {value}</div>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    disabled,
+    type,
+  }: ComponentProps & { type?: 'button' | 'submit' }) => (
+    <button type={type ?? 'button'} onClick={onClick} disabled={disabled}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    type,
+    multiple,
+    disabled,
+    placeholder,
+    maxLength,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    type?: string
+    multiple?: boolean
+    disabled?: boolean
+    placeholder?: string
+    maxLength?: number
+  }) => (
+    <input
+      id={id}
+      value={type === 'file' ? undefined : value}
+      onChange={onChange}
+      type={type}
+      multiple={multiple}
+      disabled={disabled}
+      placeholder={placeholder}
+      maxLength={maxLength}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: ComponentProps & { htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/rich-text-editor', () => ({
+  RichTextEditor: ({
+    onChange,
+    placeholder,
+  }: {
+    onChange: (json: unknown, html?: string, markdown?: string) => void
+    placeholder?: string
+  }) => (
+    <textarea
+      aria-label="Details editor"
+      placeholder={placeholder}
+      onChange={(event) =>
+        onChange({
+          type: 'doc',
+          content: [
+            {
+              type: 'paragraph',
+              content: [{ type: 'text', text: event.currentTarget.value }],
+            },
+          ],
+        })
+      }
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/card', () => ({
+  Card: ({ children, className }: ComponentProps) => (
+    <section className={className}>{children}</section>
+  ),
+  CardHeader: ({ children, className }: ComponentProps) => (
+    <header className={className}>{children}</header>
+  ),
+  CardTitle: ({ children }: ComponentProps) => <h2>{children}</h2>,
+  CardDescription: ({ children }: ComponentProps) => <p>{children}</p>,
+  CardAction: ({ children }: ComponentProps) => <div>{children}</div>,
+  CardContent: ({ children, className }: ComponentProps) => (
+    <div className={className}>{children}</div>
+  ),
+}))
+
+const { Route } = await import('../tickets.index')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.search = { status: 'open' }
+  mocks.rows = []
+  mocks.createTicket.mockResolvedValue({ id: 'ticket-1' })
+  mocks.createTicketInitialThreadFn.mockResolvedValue({ id: 'thread-1' })
+  mocks.fetch.mockResolvedValue({ ok: true, text: async () => '' })
+  vi.stubGlobal('fetch', mocks.fetch)
+  vi.spyOn(console, 'error').mockImplementation(mocks.consoleError)
+})
+
+describe('portal tickets index route', () => {
+  it('redirects before load when the My tickets tab is disabled', async () => {
+    await expect(
+      routeOptions().beforeLoad({ context: { enabledTabs: { myTickets: false } } })
+    ).rejects.toEqual({ redirect: { to: '/' } })
+  })
+
+  it('redirects anonymous users to portal login', async () => {
+    await expect(
+      routeOptions().loader({
+        context: {
+          session: null,
+          queryClient: { ensureQueryData: mocks.ensureQueryData },
+          settings: { name: 'Acme' },
+        },
+        deps: { status: 'open' },
+      })
+    ).rejects.toEqual({
+      redirect: { to: '/auth/login', search: { next: '/tickets' } },
+    })
+  })
+
+  it('prefetches filtered tickets and builds the page title', async () => {
+    const result = await routeOptions().loader({
+      context: {
+        session: { user: { id: 'user-1' } },
+        queryClient: { ensureQueryData: mocks.ensureQueryData },
+        settings: { name: 'Acme' },
+      },
+      deps: { status: 'all' },
+    })
+
+    expect(result).toEqual({ workspaceName: 'Acme' })
+    expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+      queryKey: ['portalTickets', { statusCategory: undefined }],
+      params: { statusCategory: undefined },
+    })
+    expect(routeOptions().head({ loaderData: result })).toEqual({
+      meta: [{ title: 'My tickets · Acme' }],
+    })
+  })
+
+  it('opens the composer by default for an empty ticket list and creates a ticket with attachments', async () => {
+    renderPage()
+
+    expect(screen.getByText('My tickets')).toBeTruthy()
+    expect(screen.getByText('Open a ticket')).toBeTruthy()
+    expect(screen.getByText('No tickets yet')).toBeTruthy()
+
+    fireEvent.change(screen.getByLabelText('Subject'), { target: { value: ' Broken billing ' } })
+    fireEvent.change(screen.getByLabelText('Priority'), { target: { value: 'urgent' } })
+    fireEvent.change(screen.getByLabelText('Details editor'), {
+      target: { value: 'Invoices fail to load' },
+    })
+    const file = new File(['log'], 'error.log', { type: 'text/plain' })
+    fireEvent.change(screen.getByLabelText('Attachments (optional)'), {
+      target: { files: [file] },
+    })
+
+    expect(screen.getByText('error.log')).toBeTruthy()
+    fireEvent.click(screen.getByRole('button', { name: 'Create ticket' }))
+
+    await waitFor(() =>
+      expect(mocks.createTicket).toHaveBeenCalledWith({
+        subject: 'Broken billing',
+        priority: 'urgent',
+        descriptionJson: expect.objectContaining({ type: 'doc' }),
+        descriptionText: 'Invoices fail to load',
+      })
+    )
+    expect(mocks.createTicketInitialThreadFn).toHaveBeenCalledWith({
+      data: { ticketId: 'ticket-1' },
+    })
+    expect(mocks.fetch).toHaveBeenCalledWith(
+      '/api/v1/tickets/ticket-1/threads/thread-1/attachments',
+      expect.objectContaining({ method: 'POST', body: expect.any(FormData) })
+    )
+    expect(mocks.navigate).toHaveBeenCalledWith({
+      to: '/tickets/$ticketId',
+      params: { ticketId: 'ticket-1' },
+    })
+  })
+
+  it('renders existing tickets with composer closed until requested', () => {
+    mocks.rows = [{ id: 'ticket-2', subject: 'Existing ticket' }]
+    mocks.search = { status: 'closed' }
+
+    renderPage()
+
+    expect(screen.getByText('Row ticket-2 Existing ticket')).toBeTruthy()
+    expect(screen.getByText('Filter closed')).toBeTruthy()
+    expect(screen.queryByText('Open a ticket')).toBeNull()
+
+    fireEvent.click(screen.getByRole('button', { name: 'New ticket' }))
+    expect(screen.getByText('Open a ticket')).toBeTruthy()
+    fireEvent.click(screen.getByRole('button', { name: 'Hide form' }))
+    expect(screen.queryByText('Open a ticket')).toBeNull()
+  })
+
+  it('keeps the created ticket flow moving when attachment upload fails', async () => {
+    mocks.fetch.mockResolvedValueOnce({ ok: false, text: async () => 'bad upload' })
+    renderPage()
+
+    fireEvent.change(screen.getByLabelText('Subject'), { target: { value: 'Upload warning' } })
+    fireEvent.change(screen.getByLabelText('Details editor'), { target: { value: 'Details' } })
+    fireEvent.change(screen.getByLabelText('Attachments (optional)'), {
+      target: { files: [new File(['x'], 'x.txt')] },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Create ticket' }))
+
+    await waitFor(() => expect(mocks.fetch).toHaveBeenCalledTimes(1))
+    expect(mocks.navigate).toHaveBeenCalledWith({
+      to: '/tickets/$ticketId',
+      params: { ticketId: 'ticket-1' },
+    })
+  })
+
+  it('logs ticket creation failures and stays on the form', async () => {
+    mocks.createTicket.mockRejectedValueOnce(new Error('Denied'))
+    renderPage()
+
+    fireEvent.change(screen.getByLabelText('Subject'), { target: { value: 'Denied ticket' } })
+    fireEvent.change(screen.getByLabelText('Details editor'), { target: { value: 'Details' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create ticket' }))
+
+    await waitFor(() =>
+      expect(mocks.consoleError).toHaveBeenCalledWith('Ticket creation failed:', expect.any(Error))
+    )
+    expect(mocks.navigate).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/_portal/tickets.$ticketId.tsx b/apps/web/src/routes/_portal/tickets.$ticketId.tsx
new file mode 100644
index 000000000..aca029dda
--- /dev/null
+++ b/apps/web/src/routes/_portal/tickets.$ticketId.tsx
@@ -0,0 +1,196 @@
+import { createFileRoute, redirect, notFound, Link } from '@tanstack/react-router'
+import { useSuspenseQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import { useCallback } from 'react'
+import { ArrowLeftIcon } from '@heroicons/react/24/outline'
+import { FormattedMessage } from 'react-intl'
+import type { JSONContent } from '@tiptap/react'
+import { isValidTypeId, type TicketId } from '@quackback/ids'
+import { portalTicketQueries } from '@/lib/client/queries/portal-tickets'
+import {
+  updateMyTicketDescriptionFn,
+  closeMyTicketFn,
+  reopenMyTicketFn,
+} from '@/lib/server/functions/portal-tickets'
+import { Button } from '@/components/ui/button'
+import { PortalTicketDetailHeader } from '@/components/public/tickets/portal-ticket-detail-header'
+import {
+  PortalTicketThreadFeed,
+  type PortalThread,
+} from '@/components/public/tickets/portal-ticket-thread-feed'
+import { PortalTicketReplyComposer } from '@/components/public/tickets/portal-ticket-reply-composer'
+import { toast } from 'sonner'
+
+export const Route = createFileRoute('/_portal/tickets/$ticketId')({
+  parseParams: ({ ticketId }) => {
+    if (!isValidTypeId(ticketId, 'ticket')) throw notFound()
+    return { ticketId: ticketId as TicketId }
+  },
+  loader: async ({ context, params }) => {
+    if (!context.session?.user) {
+      throw redirect({
+        to: '/auth/login',
+        search: { next: `/tickets/${params.ticketId}` } as never,
+      })
+    }
+    try {
+      await context.queryClient.ensureQueryData(portalTicketQueries.detail(params.ticketId))
+    } catch (err) {
+      // Domain layer throws NotFoundError for tickets the user doesn't own;
+      // surface as a 404 rather than an error page.
+      const code = (err as { code?: string })?.code
+      if (code === 'TICKET_NOT_FOUND') throw notFound()
+      throw err
+    }
+    return { workspaceName: context.settings?.name ?? '' }
+  },
+  head: ({ loaderData }) => {
+    const title = loaderData?.workspaceName ? `Ticket · ${loaderData.workspaceName}` : 'Ticket'
+    return { meta: [{ title }] }
+  },
+  component: TicketDetailPage,
+})
+
+function TicketDetailPage() {
+  const { ticketId } = Route.useParams()
+  const { data } = useSuspenseQuery(portalTicketQueries.detail(ticketId))
+  const isClosed = data.ticket.statusCategory === 'closed'
+  const isSolved = data.ticket.statusCategory === 'solved'
+  const isActive = !isClosed && !isSolved
+  const relationship = data.viewerRelationship
+  const isRequester = relationship === 'requester'
+  const canReply = relationship === 'requester' || relationship === 'collaborator'
+  const qc = useQueryClient()
+
+  const invalidate = () =>
+    qc.invalidateQueries({ queryKey: portalTicketQueries.detail(ticketId).queryKey })
+
+  const latestExpectedUpdatedAt = useCallback(() => {
+    const latest = qc.getQueryData<typeof data>(portalTicketQueries.detail(ticketId).queryKey)
+    return latest?.ticket.updatedAt ?? data.ticket.updatedAt
+  }, [data, qc, ticketId])
+
+  const closeMutation = useMutation({
+    mutationFn: () => closeMyTicketFn({ data: { ticketId } }),
+    onSuccess: () => {
+      invalidate()
+      qc.invalidateQueries({ queryKey: ['portal', 'tickets', 'list'] })
+      toast.success('Ticket marked as solved')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const reopenMutation = useMutation({
+    mutationFn: () => reopenMyTicketFn({ data: { ticketId } }),
+    onSuccess: () => {
+      invalidate()
+      qc.invalidateQueries({ queryKey: ['portal', 'tickets', 'list'] })
+      toast.success('Ticket reopened')
+    },
+    onError: (e: Error) => toast.error(e.message),
+  })
+
+  const descriptionMutation = useMutation({
+    mutationFn: (patch: { descriptionJson: JSONContent | null; descriptionText: string | null }) =>
+      updateMyTicketDescriptionFn({
+        data: {
+          ticketId,
+          expectedUpdatedAt: latestExpectedUpdatedAt(),
+          descriptionJson: patch.descriptionJson as { type: 'doc'; content?: unknown[] } | null,
+          descriptionText: patch.descriptionText,
+        },
+      }),
+    onSuccess: (updated) => {
+      qc.setQueryData<typeof data>(portalTicketQueries.detail(ticketId).queryKey, (current) =>
+        current
+          ? { ...current, ticket: { ...current.ticket, updatedAt: updated.updatedAt } }
+          : current
+      )
+      qc.invalidateQueries({ queryKey: portalTicketQueries.detail(ticketId).queryKey })
+      toast.success('Description updated')
+    },
+    onError: (e: Error) => {
+      if (/conflict|stale/i.test(e.message)) {
+        toast.error('Ticket changed — please refresh')
+      } else {
+        toast.error(e.message)
+      }
+    },
+  })
+
+  const handleDescriptionUpdate = useCallback(
+    (json: JSONContent | null, text: string | null) => {
+      descriptionMutation.mutate({ descriptionJson: json, descriptionText: text })
+    },
+    [descriptionMutation]
+  )
+
+  return (
+    <div className="mx-auto w-full max-w-6xl space-y-6 px-4 py-8 sm:px-6">
+      <Link
+        to="/tickets"
+        className="inline-flex items-center gap-1 text-sm text-muted-foreground hover:text-foreground"
+      >
+        <ArrowLeftIcon className="h-4 w-4" />
+        <FormattedMessage id="portal.tickets.detail.back" defaultMessage="My tickets" />
+      </Link>
+
+      <PortalTicketDetailHeader
+        subject={data.ticket.subject}
+        statusName={data.ticket.statusName}
+        statusCategory={data.ticket.statusCategory}
+        createdAt={data.ticket.createdAt}
+        lastActivityAt={data.ticket.lastActivityAt}
+      />
+
+      {isRequester && isActive && (
+        <div className="flex justify-end">
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => closeMutation.mutate()}
+            disabled={closeMutation.isPending}
+          >
+            <FormattedMessage id="portal.tickets.action.solve" defaultMessage="Mark as solved" />
+          </Button>
+        </div>
+      )}
+
+      {isRequester && isSolved && (
+        <div className="flex justify-end">
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => reopenMutation.mutate()}
+            disabled={reopenMutation.isPending}
+          >
+            <FormattedMessage id="portal.tickets.action.reopen" defaultMessage="Reopen" />
+          </Button>
+        </div>
+      )}
+
+      <PortalTicketThreadFeed
+        threads={data.threads as PortalThread[]}
+        principalNames={data.principalNames}
+        viewerPrincipalId={data.viewerPrincipalId}
+        description={
+          data.ticket.descriptionText || data.ticket.descriptionJson
+            ? { text: data.ticket.descriptionText, json: data.ticket.descriptionJson }
+            : null
+        }
+        onDescriptionUpdate={isRequester && !isClosed ? handleDescriptionUpdate : undefined}
+        isDescriptionSaving={descriptionMutation.isPending}
+      />
+
+      {canReply ? (
+        <PortalTicketReplyComposer ticketId={ticketId} isClosed={isClosed} />
+      ) : (
+        <div className="rounded-md border border-dashed border-border/60 bg-muted/30 p-4 text-sm text-muted-foreground">
+          <FormattedMessage
+            id="portal.tickets.composer.watching"
+            defaultMessage="You are watching this ticket. Only requesters and collaborators can reply."
+          />
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/_portal/tickets.index.tsx b/apps/web/src/routes/_portal/tickets.index.tsx
new file mode 100644
index 000000000..13525c50f
--- /dev/null
+++ b/apps/web/src/routes/_portal/tickets.index.tsx
@@ -0,0 +1,383 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { useState, useMemo, useCallback } from 'react'
+import type { JSONContent } from '@tiptap/react'
+import { z } from 'zod'
+import { useIntl, FormattedMessage } from 'react-intl'
+import { ChatBubbleLeftRightIcon, PlusIcon } from '@heroicons/react/24/outline'
+import { EmptyState } from '@/components/shared/empty-state'
+import { portalTicketQueries, type PortalStatusCategory } from '@/lib/client/queries/portal-tickets'
+import { PortalTicketRowItem } from '@/components/public/tickets/portal-ticket-row'
+import {
+  PortalTicketStatusFilter,
+  type StatusFilterValue,
+} from '@/components/public/tickets/portal-ticket-status-filter'
+import { useCreateMyTicket } from '@/lib/client/queries/portal-tickets'
+import { createTicketInitialThreadFn } from '@/lib/server/functions/portal-tickets'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { RichTextEditor } from '@/components/ui/rich-text-editor'
+import { usePortalImageUpload } from '@/lib/client/hooks/use-image-upload'
+import { TICKET_CREATE_EDITOR_FEATURES } from '@/components/tickets/ticket-create-editor-features'
+import {
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@/components/ui/card'
+
+const searchSchema = z.object({
+  status: z.enum(['open', 'pending', 'solved', 'closed', 'all']).optional().default('open'),
+})
+
+function statusToCategory(s: StatusFilterValue): PortalStatusCategory | undefined {
+  return s === 'all' ? undefined : s
+}
+
+function plainTextFromJson(json: JSONContent | null): string {
+  if (!json) return ''
+  let out = ''
+  const walk = (node: JSONContent) => {
+    if (node.type === 'text' && typeof node.text === 'string') out += node.text
+    if (node.content) node.content.forEach(walk)
+    if (node.type === 'paragraph' || node.type === 'heading') out += '\n'
+  }
+  walk(json)
+  return out.trim()
+}
+
+export const Route = createFileRoute('/_portal/tickets/')({
+  validateSearch: searchSchema,
+  loaderDeps: ({ search }) => ({ status: search.status }),
+  beforeLoad: async ({ context }) => {
+    // Check if myTickets tab is enabled for the user
+    const parentData = context as any
+    const enabledTabs = parentData.enabledTabs || {}
+    if (enabledTabs.myTickets === false) {
+      throw redirect({ to: '/' })
+    }
+  },
+  loader: async ({ context, deps }) => {
+    if (!context.session?.user) {
+      throw redirect({ to: '/auth/login', search: { next: '/tickets' } as never })
+    }
+    await context.queryClient.ensureQueryData(
+      portalTicketQueries.list({ statusCategory: statusToCategory(deps.status) })
+    )
+    return { workspaceName: context.settings?.name ?? '' }
+  },
+  head: ({ loaderData }) => {
+    const title = loaderData?.workspaceName
+      ? `My tickets · ${loaderData.workspaceName}`
+      : 'My tickets'
+    return { meta: [{ title }] }
+  },
+  component: TicketsListPage,
+})
+
+function TicketsListPage() {
+  const search = Route.useSearch()
+  const navigate = Route.useNavigate()
+  const intl = useIntl()
+  const { data } = useSuspenseQuery(
+    portalTicketQueries.list({ statusCategory: statusToCategory(search.status) })
+  )
+  const createTicket = useCreateMyTicket()
+  const [isComposerOpen, setIsComposerOpen] = useState(data.rows.length === 0)
+  const [subject, setSubject] = useState('')
+  const [priority, setPriority] = useState<'low' | 'normal' | 'high' | 'urgent'>('normal')
+  const [descriptionJson, setDescriptionJson] = useState<JSONContent | null>(null)
+  const [selectedFiles, setSelectedFiles] = useState<File[]>([])
+  const { upload: uploadImage } = usePortalImageUpload()
+
+  const descriptionText = useMemo(() => plainTextFromJson(descriptionJson), [descriptionJson])
+  const canSubmit =
+    subject.trim().length > 0 && descriptionText.length > 0 && !createTicket.isPending
+
+  const handleFileSelect = useCallback((e: React.ChangeEvent<HTMLInputElement>) => {
+    const files = Array.from(e.currentTarget.files || [])
+    setSelectedFiles((prev) => [...prev, ...files])
+    e.currentTarget.value = '' // Reset input so same file can be selected again
+  }, [])
+
+  const removeFile = useCallback((index: number) => {
+    setSelectedFiles((prev) => prev.filter((_, i) => i !== index))
+  }, [])
+
+  const handleCreate = useCallback(async () => {
+    if (!canSubmit) return
+
+    try {
+      // Step 1: Create the ticket
+      const created = await createTicket.mutateAsync({
+        subject: subject.trim(),
+        priority,
+        descriptionJson,
+        descriptionText,
+      })
+
+      // Step 2: If files are selected, create initial thread and upload files
+      if (selectedFiles.length > 0) {
+        try {
+          const threadResponse = await createTicketInitialThreadFn({
+            data: { ticketId: created.id },
+          })
+
+          // Step 3: Upload files to the thread
+          for (let i = 0; i < selectedFiles.length; i++) {
+            const file = selectedFiles[i]
+            try {
+              const formData = new FormData()
+              formData.append('file', file)
+
+              // Use the attachment endpoint directly
+              const attachmentRes = await fetch(
+                `/api/v1/tickets/${created.id}/threads/${threadResponse.id}/attachments`,
+                {
+                  method: 'POST',
+                  body: formData,
+                }
+              )
+
+              if (!attachmentRes.ok) {
+                await attachmentRes.text()
+              }
+            } catch {
+              // Best-effort upload: ticket is already created.
+            }
+          }
+        } catch (err) {
+          // File upload failed but ticket was created - show warning
+          console.error('File upload failed:', err)
+          // Don't prevent navigation; show errors but let user proceed
+        }
+      }
+
+      // Reset form and navigate
+      setSubject('')
+      setDescriptionJson(null)
+      setPriority('normal')
+      setSelectedFiles([])
+      setIsComposerOpen(false)
+      navigate({ to: '/tickets/$ticketId', params: { ticketId: created.id } })
+    } catch (err) {
+      console.error('Ticket creation failed:', err)
+    }
+  }, [
+    canSubmit,
+    createTicket,
+    descriptionJson,
+    descriptionText,
+    navigate,
+    priority,
+    subject,
+    selectedFiles,
+  ])
+
+  return (
+    <div className="mx-auto w-full max-w-6xl space-y-6 px-4 py-8 sm:px-6">
+      <div className="flex flex-wrap items-start justify-between gap-3">
+        <div className="space-y-1">
+          <h1 className="text-2xl font-semibold tracking-tight">
+            <FormattedMessage id="portal.tickets.title" defaultMessage="My tickets" />
+          </h1>
+          <p className="text-sm text-muted-foreground">
+            <FormattedMessage
+              id="portal.tickets.subtitle"
+              defaultMessage="Tickets you opened or were added to."
+            />
+          </p>
+        </div>
+        <Button size="sm" onClick={() => setIsComposerOpen((prev) => !prev)}>
+          <PlusIcon className="me-1.5 h-4 w-4" />
+          {isComposerOpen ? (
+            <FormattedMessage id="portal.tickets.create.hide" defaultMessage="Hide form" />
+          ) : (
+            <FormattedMessage id="portal.tickets.create.cta" defaultMessage="New ticket" />
+          )}
+        </Button>
+      </div>
+
+      {isComposerOpen && (
+        <Card className="gap-0">
+          <CardHeader className="border-b">
+            <CardTitle>
+              <FormattedMessage id="portal.tickets.create.title" defaultMessage="Open a ticket" />
+            </CardTitle>
+            <CardDescription>
+              <FormattedMessage
+                id="portal.tickets.create.subtitle"
+                defaultMessage="Share what went wrong and our team will follow up."
+              />
+            </CardDescription>
+            <CardAction>
+              <span className="rounded-full bg-muted px-2 py-1 text-xs text-muted-foreground">
+                <FormattedMessage
+                  id="portal.tickets.create.response"
+                  defaultMessage="Usually replies within 1 business day"
+                />
+              </span>
+            </CardAction>
+          </CardHeader>
+          <CardContent className="space-y-4 pt-6">
+            <div className="grid gap-2">
+              <Label htmlFor="portal-ticket-subject">
+                <FormattedMessage id="portal.tickets.create.subject" defaultMessage="Subject" />
+              </Label>
+              <Input
+                id="portal-ticket-subject"
+                maxLength={500}
+                value={subject}
+                onChange={(e) => setSubject(e.target.value)}
+                placeholder={intl.formatMessage({
+                  id: 'portal.tickets.create.subject.placeholder',
+                  defaultMessage: 'Briefly summarize your issue',
+                })}
+                disabled={createTicket.isPending}
+              />
+            </div>
+
+            <div className="grid gap-2 sm:max-w-xs">
+              <Label htmlFor="portal-ticket-priority">
+                <FormattedMessage id="portal.tickets.create.priority" defaultMessage="Priority" />
+              </Label>
+              <select
+                id="portal-ticket-priority"
+                value={priority}
+                onChange={(e) =>
+                  setPriority(e.target.value as 'low' | 'normal' | 'high' | 'urgent')
+                }
+                disabled={createTicket.isPending}
+                className="h-9 rounded-md border border-input bg-background px-3 text-sm text-foreground shadow-xs outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px]"
+              >
+                <option value="low">
+                  {intl.formatMessage({ id: 'portal.tickets.priority.low', defaultMessage: 'Low' })}
+                </option>
+                <option value="normal">
+                  {intl.formatMessage({
+                    id: 'portal.tickets.priority.normal',
+                    defaultMessage: 'Normal',
+                  })}
+                </option>
+                <option value="high">
+                  {intl.formatMessage({
+                    id: 'portal.tickets.priority.high',
+                    defaultMessage: 'High',
+                  })}
+                </option>
+                <option value="urgent">
+                  {intl.formatMessage({
+                    id: 'portal.tickets.priority.urgent',
+                    defaultMessage: 'Urgent',
+                  })}
+                </option>
+              </select>
+            </div>
+
+            <div className="grid gap-2">
+              <Label>
+                <FormattedMessage id="portal.tickets.create.details" defaultMessage="Details" />
+              </Label>
+              <RichTextEditor
+                value={descriptionJson ?? undefined}
+                onChange={(json) => setDescriptionJson(json)}
+                minHeight="140px"
+                features={TICKET_CREATE_EDITOR_FEATURES}
+                onImageUpload={uploadImage}
+                placeholder={intl.formatMessage({
+                  id: 'portal.tickets.create.details.placeholder',
+                  defaultMessage:
+                    'What were you trying to do, what happened, and what did you expect?',
+                })}
+              />
+            </div>
+
+            <div className="grid gap-2">
+              <Label htmlFor="portal-ticket-attachments">
+                <FormattedMessage
+                  id="portal.tickets.create.attachments"
+                  defaultMessage="Attachments (optional)"
+                />
+              </Label>
+              <Input
+                id="portal-ticket-attachments"
+                type="file"
+                multiple
+                onChange={handleFileSelect}
+                disabled={createTicket.isPending}
+              />
+              {selectedFiles.length > 0 && (
+                <div className="space-y-2 pt-2">
+                  {selectedFiles.map((file, index) => (
+                    <div
+                      key={`${file.name}-${index}`}
+                      className="flex items-center justify-between rounded-md border border-input bg-muted/50 px-3 py-2 text-sm"
+                    >
+                      <span className="truncate">{file.name}</span>
+                      <button
+                        type="button"
+                        onClick={() => removeFile(index)}
+                        className="ml-2 text-muted-foreground hover:text-foreground"
+                      >
+                        ×
+                      </button>
+                    </div>
+                  ))}
+                </div>
+              )}
+            </div>
+
+            <div className="flex items-center justify-between gap-3">
+              <p className="text-xs text-muted-foreground">
+                <FormattedMessage
+                  id="portal.tickets.create.guidance"
+                  defaultMessage="Include steps to reproduce and any error messages for faster help."
+                />
+              </p>
+              <Button type="button" onClick={handleCreate} disabled={!canSubmit}>
+                {createTicket.isPending ? (
+                  <FormattedMessage
+                    id="portal.tickets.create.submitting"
+                    defaultMessage="Creating..."
+                  />
+                ) : (
+                  <FormattedMessage
+                    id="portal.tickets.create.submit"
+                    defaultMessage="Create ticket"
+                  />
+                )}
+              </Button>
+            </div>
+          </CardContent>
+        </Card>
+      )}
+
+      <PortalTicketStatusFilter value={search.status} />
+
+      {data.rows.length === 0 ? (
+        <EmptyState
+          icon={ChatBubbleLeftRightIcon}
+          title={intl.formatMessage({
+            id: 'portal.tickets.empty.title',
+            defaultMessage: 'No tickets yet',
+          })}
+          description={intl.formatMessage({
+            id: 'portal.tickets.empty.description',
+            defaultMessage: "When our team handles a request from you, it'll appear here.",
+          })}
+        />
+      ) : (
+        <ul className="space-y-2">
+          {data.rows.map((row) => (
+            <li key={row.id}>
+              <PortalTicketRowItem ticket={row} />
+            </li>
+          ))}
+        </ul>
+      )}
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/__tests__/contacts.gap.test.tsx b/apps/web/src/routes/admin/__tests__/contacts.gap.test.tsx
new file mode 100644
index 000000000..5fedb6fa4
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/contacts.gap.test.tsx
@@ -0,0 +1,93 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  component: () => ReactElement
+}
+
+type LinkProps = {
+  to: string
+  className?: string
+  children?: ReactNode
+}
+
+const mocks = vi.hoisted(() => ({
+  pathname: '/admin/customers/people',
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  Link: ({ to, className, children }: LinkProps) => (
+    <a href={to} className={className} data-testid={`link-${to}`}>
+      {children}
+    </a>
+  ),
+  Outlet: () => <div data-testid="outlet" />,
+  useRouterState: ({ select }: { select: (s: { location: { pathname: string } }) => string }) =>
+    select({ location: { pathname: mocks.pathname } }),
+}))
+
+vi.mock('@/lib/shared/utils', () => ({
+  cn: (...args: unknown[]) => args.filter(Boolean).join(' '),
+}))
+
+const { Route } = await import('../contacts')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.pathname = '/admin/customers/people'
+})
+
+describe('admin contacts legacy layout route', () => {
+  it('renders heading, both tabs, and the outlet', () => {
+    renderPage()
+    expect(screen.getByText('Customers')).toBeInTheDocument()
+    expect(screen.getByText('People, organizations, and segments.')).toBeInTheDocument()
+    expect(screen.getByText('People')).toBeInTheDocument()
+    expect(screen.getByText('Organizations')).toBeInTheDocument()
+    expect(screen.getByTestId('outlet')).toBeInTheDocument()
+  })
+
+  it('marks a tab active on exact pathname match (active branch)', () => {
+    mocks.pathname = '/admin/customers/organizations'
+    renderPage()
+    const active = screen.getByTestId('link-/admin/customers/organizations')
+    expect(active.className).toContain('border-primary')
+    expect(active.className).toContain('text-foreground')
+    const inactive = screen.getByTestId('link-/admin/customers/people')
+    expect(inactive.className).toContain('border-transparent')
+    expect(inactive.className).toContain('text-muted-foreground')
+  })
+
+  it('marks a tab active on a nested customers child route (startsWith branch)', () => {
+    mocks.pathname = '/admin/customers/people/contact-123'
+    renderPage()
+    const active = screen.getByTestId('link-/admin/customers/people')
+    expect(active.className).toContain('border-primary')
+  })
+
+  it('marks the People tab active on the legacy /admin/contacts/people path', () => {
+    mocks.pathname = '/admin/contacts/people/abc'
+    renderPage()
+    const active = screen.getByTestId('link-/admin/customers/people')
+    expect(active.className).toContain('border-primary')
+  })
+
+  it('marks the Organizations tab active on the legacy /admin/contacts/organizations path', () => {
+    mocks.pathname = '/admin/contacts/organizations/abc'
+    renderPage()
+    const active = screen.getByTestId('link-/admin/customers/organizations')
+    expect(active.className).toContain('border-primary')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/contacts.index.gap.test.tsx b/apps/web/src/routes/admin/__tests__/contacts.index.gap.test.tsx
new file mode 100644
index 000000000..e48b2879d
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/contacts.index.gap.test.tsx
@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  redirect: vi.fn((opts: unknown) => {
+    const err = new Error('REDIRECT') as Error & { __redirect: unknown }
+    err.__redirect = opts
+    return err
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  redirect: mocks.redirect,
+}))
+
+const { Route } = await import('../contacts.index')
+
+type LoaderFn = () => unknown
+function loader(): LoaderFn {
+  return (Route.options as unknown as { loader: LoaderFn }).loader
+}
+
+describe('admin contacts.index redirect route', () => {
+  it('throws a redirect to /admin/customers/organizations', () => {
+    expect(() => loader()()).toThrow('REDIRECT')
+    expect(mocks.redirect).toHaveBeenCalledWith({ to: '/admin/customers/organizations' })
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/contacts.organizations.gap.test.tsx b/apps/web/src/routes/admin/__tests__/contacts.organizations.gap.test.tsx
new file mode 100644
index 000000000..b5cc66327
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/contacts.organizations.gap.test.tsx
@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  redirect: vi.fn((opts: unknown) => {
+    const err = new Error('REDIRECT') as Error & { __redirect: unknown }
+    err.__redirect = opts
+    return err
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  redirect: mocks.redirect,
+}))
+
+const { Route } = await import('../contacts.organizations')
+
+type LoaderFn = () => unknown
+function loader(): LoaderFn {
+  return (Route.options as unknown as { loader: LoaderFn }).loader
+}
+
+describe('admin contacts.organizations redirect route', () => {
+  it('throws a redirect to /admin/customers/organizations', () => {
+    expect(() => loader()()).toThrow('REDIRECT')
+    expect(mocks.redirect).toHaveBeenCalledWith({ to: '/admin/customers/organizations' })
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/contacts.organizations_.$organizationId.gap.test.tsx b/apps/web/src/routes/admin/__tests__/contacts.organizations_.$organizationId.gap.test.tsx
new file mode 100644
index 000000000..7e42ad237
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/contacts.organizations_.$organizationId.gap.test.tsx
@@ -0,0 +1,165 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    params: { organizationId: string }
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  to?: string
+  variant?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async (q: { queryKey: readonly unknown[] }) => {
+    // detail query resolves to the current org, others to []
+    if (q.queryKey[1] === 'detail') return mocks.detailData
+    return []
+  }),
+  notFound: vi.fn(() => new Error('not-found')),
+  detailData: {} as Record<string, unknown> | undefined,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useParams: () => ({ organizationId: 'org-1' }),
+  }),
+  Link: ({ children, to }: ComponentProps) => <a href={to}>{children}</a>,
+  notFound: mocks.notFound,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: () => ({ data: mocks.detailData }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/organizations', () => ({
+  organizationQueries: {
+    detail: (id: string) => ({ queryKey: ['organizations', 'detail', id] }),
+  },
+}))
+
+vi.mock('@/lib/client/queries/contacts', () => ({
+  contactQueries: {
+    byOrg: (id: string, opts: unknown) => ({ queryKey: ['contacts', 'byOrg', id, opts] }),
+  },
+}))
+
+vi.mock('@/components/ui/tabs', () => ({
+  Tabs: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsList: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsTrigger: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+  TabsContent: ({ children }: ComponentProps) => <div>{children}</div>,
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: ComponentProps) => <span data-testid="badge">{children}</span>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: ComponentProps) => <span>{children}</span>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArrowLeftIcon: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@/components/admin/contacts/organization-overview-tab', () => ({
+  OrganizationOverviewTab: () => <div data-testid="overview-tab" />,
+}))
+
+vi.mock('@/components/admin/contacts/organization-contacts-tab', () => ({
+  OrganizationContactsTab: () => <div data-testid="contacts-tab" />,
+}))
+
+vi.mock('@/components/admin/contacts/organization-tickets-tab', () => ({
+  OrganizationTicketsTab: () => <div data-testid="tickets-tab" />,
+}))
+
+const { Route } = await import('../contacts.organizations_.$organizationId')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.detailData = { name: 'Acme Inc', domain: 'acme.com', archivedAt: null }
+})
+
+describe('admin contacts organization detail route — loader', () => {
+  it('prefetches detail + contacts and does not throw when detail exists', async () => {
+    mocks.detailData = { name: 'Acme Inc' }
+    await routeOptions().loader({
+      params: { organizationId: 'org-1' },
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData as never } },
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(2)
+    expect(mocks.notFound).not.toHaveBeenCalled()
+  })
+
+  it('throws notFound when detail resolves to undefined', async () => {
+    mocks.detailData = undefined
+    await expect(
+      routeOptions().loader({
+        params: { organizationId: 'missing' },
+        context: { queryClient: { ensureQueryData: mocks.ensureQueryData as never } },
+      })
+    ).rejects.toThrow('not-found')
+    expect(mocks.notFound).toHaveBeenCalledTimes(1)
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load organization')).toBeInTheDocument()
+  })
+})
+
+describe('admin contacts organization detail route — component', () => {
+  it('returns null when org is missing', () => {
+    mocks.detailData = undefined
+    const Component = routeOptions().component
+    const { container } = render(<Component />)
+    expect(container.querySelector('h1')).toBeNull()
+  })
+
+  it('renders name, domain, Active badge, tabs and overview tab', () => {
+    mocks.detailData = { name: 'Acme Inc', domain: 'acme.com', archivedAt: null }
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('Acme Inc')).toBeInTheDocument()
+    expect(screen.getByText('acme.com')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.getByText('Overview')).toBeInTheDocument()
+    expect(screen.getByText('Contacts')).toBeInTheDocument()
+    expect(screen.getByText('Tickets')).toBeInTheDocument()
+    expect(screen.getByTestId('overview-tab')).toBeInTheDocument()
+  })
+
+  it('renders Archived badge and omits domain when archived and no domain', () => {
+    mocks.detailData = { name: 'Old Co', domain: null, archivedAt: '2026-01-01' }
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('Old Co')).toBeInTheDocument()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+    expect(screen.queryByText('acme.com')).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/contacts.people.gap.test.tsx b/apps/web/src/routes/admin/__tests__/contacts.people.gap.test.tsx
new file mode 100644
index 000000000..3b5f063e3
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/contacts.people.gap.test.tsx
@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  redirect: vi.fn((opts: unknown) => {
+    const err = new Error('REDIRECT') as Error & { __redirect: unknown }
+    err.__redirect = opts
+    return err
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  redirect: mocks.redirect,
+}))
+
+const { Route } = await import('../contacts.people')
+
+type LoaderFn = () => unknown
+function loader(): LoaderFn {
+  return (Route.options as unknown as { loader: LoaderFn }).loader
+}
+
+describe('admin contacts.people redirect route', () => {
+  it('throws a redirect to /admin/customers/people', () => {
+    expect(() => loader()()).toThrow('REDIRECT')
+    expect(mocks.redirect).toHaveBeenCalledWith({ to: '/admin/customers/people' })
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/contacts.people_.$contactId.gap.test.tsx b/apps/web/src/routes/admin/__tests__/contacts.people_.$contactId.gap.test.tsx
new file mode 100644
index 000000000..7ab5d4349
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/contacts.people_.$contactId.gap.test.tsx
@@ -0,0 +1,195 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    params: { contactId: string }
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  to?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  notFound: vi.fn(() => new Error('not-found')),
+  queryData: {} as Record<string, unknown>,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useParams: () => ({ contactId: 'contact-1' }),
+  }),
+  Link: ({ children, to }: ComponentProps) => <a href={to}>{children}</a>,
+  notFound: mocks.notFound,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: (query: { queryKey: readonly unknown[] }) => ({
+    data: mocks.queryData[query.queryKey[1] as string],
+  }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/contacts', () => ({
+  contactQueries: {
+    detail: (contactId: string) => ({ queryKey: ['contacts', 'detail', contactId] }),
+    links: (contactId: string) => ({ queryKey: ['contacts', 'links', contactId] }),
+  },
+}))
+
+vi.mock('@/components/ui/tabs', () => ({
+  Tabs: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsList: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsTrigger: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+  TabsContent: ({ children }: ComponentProps) => <div>{children}</div>,
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: ComponentProps) => <span data-testid="badge">{children}</span>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: ComponentProps) => <span>{children}</span>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArrowLeftIcon: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@/components/admin/contacts/contact-overview-tab', () => ({
+  ContactOverviewTab: ({ contact }: { contact: { id: string } }) => (
+    <div data-testid="overview">{contact.id}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/contacts/contact-linked-users-tab', () => ({
+  ContactLinkedUsersTab: ({ contactId }: { contactId: string }) => (
+    <div data-testid="linked">{contactId}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/contacts/contact-tickets-tab', () => ({
+  ContactTicketsTab: ({ contactId }: { contactId: string }) => (
+    <div data-testid="tickets">{contactId}</div>
+  ),
+}))
+
+const { Route } = await import('../contacts.people_.$contactId')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function seedContact(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'contact-1',
+    name: 'Ada Lovelace',
+    email: 'ada@example.com',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.queryData = { detail: seedContact(), links: [] }
+})
+
+describe('admin contact detail route — loader', () => {
+  it('prefetches detail and links queries when detail exists', async () => {
+    mocks.ensureQueryData.mockResolvedValue(seedContact() as never)
+    await routeOptions().loader({
+      params: { contactId: 'contact-1' },
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(2)
+    expect(mocks.notFound).not.toHaveBeenCalled()
+  })
+
+  it('throws notFound when detail is missing', async () => {
+    mocks.ensureQueryData.mockResolvedValue(undefined)
+    await expect(
+      routeOptions().loader({
+        params: { contactId: 'contact-1' },
+        context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+      })
+    ).rejects.toThrow()
+    expect(mocks.notFound).toHaveBeenCalled()
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load contact')).toBeInTheDocument()
+  })
+})
+
+describe('admin contact detail route — component', () => {
+  it('returns null when contact data is absent', () => {
+    mocks.queryData = { detail: undefined, links: [] }
+    const { container } = renderPage()
+    expect(container.firstChild).toBeNull()
+  })
+
+  it('renders name as display, email, Active badge and tabs', () => {
+    renderPage()
+    expect(screen.getByText('Ada Lovelace')).toBeInTheDocument()
+    expect(screen.getByText('ada@example.com')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.getByTestId('overview').textContent).toBe('contact-1')
+    expect(screen.getByTestId('linked').textContent).toBe('contact-1')
+    expect(screen.getByTestId('tickets').textContent).toBe('contact-1')
+  })
+
+  it('falls back to email as display when name is absent', () => {
+    mocks.queryData = {
+      detail: seedContact({ name: null }),
+      links: [],
+    }
+    renderPage()
+    // email appears both as display heading and as the muted email span
+    expect(screen.getAllByText('ada@example.com').length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('falls back to id as display when name and email are absent', () => {
+    mocks.queryData = {
+      detail: seedContact({ name: null, email: null }),
+      links: [],
+    }
+    renderPage()
+    // id is used as the display heading (and also echoed by tab mocks)
+    expect(screen.getAllByText('contact-1').length).toBeGreaterThanOrEqual(1)
+    expect(screen.queryByText('ada@example.com')).not.toBeInTheDocument()
+  })
+
+  it('shows the Archived badge when contact is archived', () => {
+    mocks.queryData = {
+      detail: seedContact({ archivedAt: '2026-01-01T00:00:00.000Z' }),
+      links: [],
+    }
+    renderPage()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/customers.diffcov.test.tsx b/apps/web/src/routes/admin/__tests__/customers.diffcov.test.tsx
new file mode 100644
index 000000000..3ab5b4a5c
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/customers.diffcov.test.tsx
@@ -0,0 +1,83 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  component: () => ReactElement
+}
+
+type LinkProps = {
+  to: string
+  className?: string
+  children?: ReactNode
+}
+
+const mocks = vi.hoisted(() => ({
+  pathname: '/admin/customers/people',
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  Link: ({ to, className, children }: LinkProps) => (
+    <a href={to} className={className} data-testid={`link-${to}`}>
+      {children}
+    </a>
+  ),
+  Outlet: () => <div data-testid="outlet" />,
+  useRouterState: ({ select }: { select: (s: { location: { pathname: string } }) => string }) =>
+    select({ location: { pathname: mocks.pathname } }),
+}))
+
+vi.mock('@/lib/shared/utils', () => ({
+  cn: (...args: unknown[]) => args.filter(Boolean).join(' '),
+}))
+
+const { Route } = await import('../customers')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.pathname = '/admin/customers/people'
+})
+
+describe('admin customers layout route', () => {
+  it('renders heading, all three tabs, and the outlet', () => {
+    renderPage()
+    expect(screen.getByText('Customers')).toBeInTheDocument()
+    expect(screen.getByText('People, organizations, and segments.')).toBeInTheDocument()
+    expect(screen.getByText('People')).toBeInTheDocument()
+    expect(screen.getByText('Organizations')).toBeInTheDocument()
+    expect(screen.getByText('Segments')).toBeInTheDocument()
+    expect(screen.getByTestId('outlet')).toBeInTheDocument()
+  })
+
+  it('marks a tab active when the pathname exactly matches its target (active branch)', () => {
+    mocks.pathname = '/admin/customers/organizations'
+    renderPage()
+    const active = screen.getByTestId('link-/admin/customers/organizations')
+    expect(active.className).toContain('border-primary')
+    expect(active.className).toContain('text-foreground')
+    // a non-matching tab takes the inactive branch
+    const inactive = screen.getByTestId('link-/admin/customers/people')
+    expect(inactive.className).toContain('border-transparent')
+    expect(inactive.className).toContain('text-muted-foreground')
+  })
+
+  it('marks a tab active when the pathname is a nested child route (startsWith branch)', () => {
+    mocks.pathname = '/admin/customers/people/contact-123'
+    renderPage()
+    const active = screen.getByTestId('link-/admin/customers/people')
+    expect(active.className).toContain('border-primary')
+    const inactive = screen.getByTestId('link-/admin/customers/segments')
+    expect(inactive.className).toContain('border-transparent')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/customers.index.gap.test.tsx b/apps/web/src/routes/admin/__tests__/customers.index.gap.test.tsx
new file mode 100644
index 000000000..e48c3b429
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/customers.index.gap.test.tsx
@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  redirect: vi.fn((opts: unknown) => {
+    const err = new Error('REDIRECT') as Error & { __redirect: unknown }
+    err.__redirect = opts
+    return err
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  redirect: mocks.redirect,
+}))
+
+const { Route } = await import('../customers.index')
+
+type LoaderFn = () => unknown
+function loader(): LoaderFn {
+  return (Route.options as unknown as { loader: LoaderFn }).loader
+}
+
+describe('admin customers.index redirect route', () => {
+  it('throws a redirect to /admin/customers/people', () => {
+    expect(() => loader()()).toThrow('REDIRECT')
+    expect(mocks.redirect).toHaveBeenCalledWith({ to: '/admin/customers/people' })
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/customers.organizations.gap.test.tsx b/apps/web/src/routes/admin/__tests__/customers.organizations.gap.test.tsx
new file mode 100644
index 000000000..7dbe7bd59
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/customers.organizations.gap.test.tsx
@@ -0,0 +1,191 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  listQuery: vi.fn((params: { includeArchived?: boolean }) => ({
+    queryKey: ['organizations', 'list', params],
+  })),
+  listProps: { search: '' as string, showArchived: false as boolean },
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/organizations', () => ({
+  organizationQueries: {
+    list: mocks.listQuery,
+  },
+}))
+
+vi.mock('@/components/admin/contacts/organization-list', () => ({
+  OrganizationList: ({ search, showArchived }: { search: string; showArchived: boolean }) => {
+    mocks.listProps.search = search
+    mocks.listProps.showArchived = showArchived
+    return <div data-testid="org-list" data-search={search} data-archived={String(showArchived)} />
+  },
+}))
+
+vi.mock('@/components/admin/contacts/organization-create-dialog', () => ({
+  OrganizationCreateDialog: ({ trigger }: { trigger?: ReactNode }) => (
+    <div data-testid="org-create-dialog">{trigger}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: ComponentProps) => <div data-testid="gate">{children}</div>,
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ORG_MANAGE: 'org.manage',
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children, onClick }: ComponentProps) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    placeholder,
+    value,
+    onChange,
+    className,
+  }: {
+    placeholder?: string
+    value?: string
+    onChange?: (event: { target: { value: string } }) => void
+    className?: string
+  }) => (
+    <input
+      placeholder={placeholder}
+      value={value}
+      onChange={onChange}
+      className={className}
+      aria-label="search"
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: { children?: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    id,
+    checked,
+    onCheckedChange,
+  }: {
+    id?: string
+    checked?: boolean
+    onCheckedChange?: (next: boolean) => void
+  }) => (
+    <button
+      type="button"
+      id={id}
+      role="switch"
+      aria-checked={checked}
+      data-testid="archived-switch"
+      onClick={() => onCheckedChange?.(!checked)}
+    />
+  ),
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  PlusIcon: () => <span />,
+}))
+
+const { Route } = await import('../customers.organizations')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.listProps.search = ''
+  mocks.listProps.showArchived = false
+})
+
+describe('admin customers.organizations route — loader', () => {
+  it('prefetches the organizations list including archived', async () => {
+    await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.listQuery).toHaveBeenCalledWith({ includeArchived: true })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(1)
+    expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+      queryKey: ['organizations', 'list', { includeArchived: true }],
+    })
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load organizations')).toBeInTheDocument()
+  })
+})
+
+describe('admin customers.organizations route — component', () => {
+  it('renders search, switch, gate, and list with defaults', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByPlaceholderText('Search organizations...')).toBeInTheDocument()
+    expect(screen.getByText('Show archived')).toBeInTheDocument()
+    expect(screen.getByTestId('gate')).toBeInTheDocument()
+    expect(screen.getByText('New organization')).toBeInTheDocument()
+    const list = screen.getByTestId('org-list')
+    expect(list.getAttribute('data-search')).toBe('')
+    expect(list.getAttribute('data-archived')).toBe('false')
+  })
+
+  it('updates the search term passed to the list', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    fireEvent.change(screen.getByPlaceholderText('Search organizations...'), {
+      target: { value: 'acme' },
+    })
+    expect(screen.getByTestId('org-list').getAttribute('data-search')).toBe('acme')
+  })
+
+  it('toggles the show-archived switch', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByTestId('org-list').getAttribute('data-archived')).toBe('false')
+    fireEvent.click(screen.getByTestId('archived-switch'))
+    expect(screen.getByTestId('org-list').getAttribute('data-archived')).toBe('true')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/customers.people.gap.test.tsx b/apps/web/src/routes/admin/__tests__/customers.people.gap.test.tsx
new file mode 100644
index 000000000..aefa2d3b5
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/customers.people.gap.test.tsx
@@ -0,0 +1,169 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: unknown
+}
+
+type ChildProps = {
+  children?: ReactNode
+  trigger?: ReactNode
+  permission?: unknown
+  search?: string
+  showArchived?: boolean
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  customerPeople: vi.fn((args: unknown) => ({ queryKey: ['customerPeople', args] })),
+  errorComponentSentinel: () => null,
+  createRouteErrorComponent: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (...args: unknown[]) => {
+    mocks.createRouteErrorComponent(...args)
+    return mocks.errorComponentSentinel
+  },
+}))
+
+vi.mock('@/lib/client/queries/admin', () => ({
+  adminQueries: {
+    customerPeople: mocks.customerPeople,
+  },
+}))
+
+vi.mock('@/components/admin/customers/customer-people-table', () => ({
+  CustomerPeopleTable: ({ search, showArchived }: ChildProps) => (
+    <div data-testid="people-table" data-search={search} data-archived={String(showArchived)} />
+  ),
+}))
+
+vi.mock('@/components/admin/contacts/contact-create-dialog', () => ({
+  ContactCreateDialog: ({ trigger }: ChildProps) => (
+    <div data-testid="contact-create-dialog">{trigger}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children, permission }: ChildProps) => (
+    <div data-testid="permission-gate" data-permission={String(permission)}>
+      {children}
+    </div>
+  ),
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: { ORG_MANAGE: 'org.manage' },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: ChildProps) => <button type="button">{children}</button>,
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    value,
+    onChange,
+    placeholder,
+  }: {
+    value?: string
+    onChange?: (e: { target: { value: string } }) => void
+    placeholder?: string
+  }) => (
+    <input data-testid="search-input" placeholder={placeholder} value={value} onChange={onChange} />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children }: ChildProps) => <label>{children}</label>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: () => <div data-testid="skeleton" />,
+}))
+
+vi.mock('@/components/ui/switch', () => ({
+  Switch: ({
+    checked,
+    onCheckedChange,
+  }: {
+    checked?: boolean
+    onCheckedChange?: (v: boolean) => void
+  }) => (
+    <button
+      type="button"
+      role="switch"
+      aria-checked={checked}
+      data-testid="archived-switch"
+      onClick={() => onCheckedChange?.(!checked)}
+    />
+  ),
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  PlusIcon: () => <svg data-testid="plus-icon" />,
+}))
+
+const { Route } = await import('../customers.people')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('admin customers people route', () => {
+  it('loader ensures customerPeople query data with default args', async () => {
+    await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.customerPeople).toHaveBeenCalledWith({ includeArchived: false, limit: 100 })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(1)
+  })
+
+  it('wires the error component sentinel', () => {
+    expect(routeOptions().errorComponent).toBe(mocks.errorComponentSentinel)
+  })
+
+  it('renders the page chrome with default state', () => {
+    renderPage()
+    expect(screen.getByTestId('search-input')).toHaveValue('')
+    const table = screen.getByTestId('people-table')
+    expect(table).toHaveAttribute('data-search', '')
+    expect(table).toHaveAttribute('data-archived', 'false')
+    expect(screen.getByTestId('permission-gate')).toHaveAttribute('data-permission', 'org.manage')
+    expect(screen.getByTestId('contact-create-dialog')).toBeInTheDocument()
+    expect(screen.getByTestId('plus-icon')).toBeInTheDocument()
+  })
+
+  it('updates search state on input change', () => {
+    renderPage()
+    fireEvent.change(screen.getByTestId('search-input'), { target: { value: 'acme' } })
+    expect(screen.getByTestId('search-input')).toHaveValue('acme')
+    expect(screen.getByTestId('people-table')).toHaveAttribute('data-search', 'acme')
+  })
+
+  it('toggles the show-archived switch and forwards it to the table', () => {
+    renderPage()
+    fireEvent.click(screen.getByTestId('archived-switch'))
+    expect(screen.getByTestId('people-table')).toHaveAttribute('data-archived', 'true')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/customers.segments.gap.test.tsx b/apps/web/src/routes/admin/__tests__/customers.segments.gap.test.tsx
new file mode 100644
index 000000000..290ed9c05
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/customers.segments.gap.test.tsx
@@ -0,0 +1,76 @@
+// @vitest-environment happy-dom
+import type { ReactElement } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  userAttributesQuery: vi.fn(() => ({ queryKey: ['admin', 'user-attributes'] })),
+  segmentsQuery: vi.fn(() => ({ queryKey: ['admin', 'segments'] })),
+  useSuspenseQuery: vi.fn(() => ({ data: [{ id: 'attr_1', key: 'plan' }] })),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: mocks.useSuspenseQuery,
+}))
+
+vi.mock('@/lib/client/queries/admin', () => ({
+  adminQueries: {
+    userAttributes: mocks.userAttributesQuery,
+    segments: mocks.segmentsQuery,
+  },
+}))
+
+vi.mock('@/components/admin/settings/user-attributes/user-attributes-list', () => ({
+  UserAttributesList: ({ initialAttributes }: { initialAttributes: unknown }) => (
+    <div data-testid="attrs-list" data-attrs={JSON.stringify(initialAttributes)} />
+  ),
+}))
+
+vi.mock('@/components/admin/segments/segment-list', () => ({
+  SegmentList: () => <div data-testid="segment-list" />,
+}))
+
+const { Route } = await import('../customers.segments')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.useSuspenseQuery.mockReturnValue({ data: [{ id: 'attr_1', key: 'plan' }] })
+})
+
+describe('admin customers.segments route — loader', () => {
+  it('prefetches user attributes and segments', async () => {
+    const result = await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.userAttributesQuery).toHaveBeenCalledTimes(1)
+    expect(mocks.segmentsQuery).toHaveBeenCalledTimes(1)
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(2)
+    expect(result).toEqual({})
+  })
+})
+
+describe('admin customers.segments route — component', () => {
+  it('renders the attributes list with suspense data and the segment list', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    const attrs = screen.getByTestId('attrs-list')
+    expect(attrs.getAttribute('data-attrs')).toBe(JSON.stringify([{ id: 'attr_1', key: 'plan' }]))
+    expect(screen.getByTestId('segment-list')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/notifications.diffcov.test.tsx b/apps/web/src/routes/admin/__tests__/notifications.diffcov.test.tsx
new file mode 100644
index 000000000..24ce6a62e
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/notifications.diffcov.test.tsx
@@ -0,0 +1,193 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  component: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+  disabled?: boolean
+}
+
+const mocks = vi.hoisted(() => ({
+  notificationsResult: {
+    data: undefined as unknown,
+    isLoading: false as boolean,
+  },
+  markAsReadMutate: vi.fn(),
+  markAllMutate: vi.fn(),
+  markAllPending: false as boolean,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/lib/client/hooks/use-notifications-queries', () => ({
+  useNotifications: () => mocks.notificationsResult,
+}))
+
+vi.mock('@/lib/client/mutations', () => ({
+  useMarkNotificationAsRead: () => ({ mutate: mocks.markAsReadMutate }),
+  useMarkAllNotificationsAsRead: () => ({
+    mutate: mocks.markAllMutate,
+    isPending: mocks.markAllPending,
+  }),
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  InboxIcon: () => <span />,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  BellIcon: () => <span />,
+}))
+
+vi.mock('@/components/shared/empty-state', () => ({
+  EmptyState: ({ title, description }: { title: string; description?: string }) => (
+    <div data-testid="empty-state">
+      <span>{title}</span>
+      <span>{description}</span>
+    </div>
+  ),
+}))
+
+vi.mock('@/components/shared/spinner', () => ({
+  Spinner: ({ size }: { size?: string }) => <span data-testid="spinner">{size}</span>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children, onClick, disabled }: ComponentProps) => (
+    <button type="button" onClick={onClick} disabled={disabled}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/scroll-area', () => ({
+  ScrollArea: ({ children }: ComponentProps) => <div data-testid="scroll-area">{children}</div>,
+}))
+
+vi.mock('@/components/ui/tabs', () => ({
+  Tabs: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsList: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsTrigger: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+  TabsContent: ({ children }: ComponentProps) => <div>{children}</div>,
+}))
+
+vi.mock('@/components/notifications/notification-item', () => ({
+  NotificationItem: ({
+    notification,
+    onMarkAsRead,
+  }: {
+    notification: { id: string }
+    onMarkAsRead: (id: string) => void
+  }) => (
+    <button
+      type="button"
+      data-testid={`notification-${notification.id}`}
+      onClick={() => onMarkAsRead(notification.id)}
+    >
+      {notification.id}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/notifications/my-ticket-subscriptions-panel', () => ({
+  MyTicketSubscriptionsPanel: () => <div data-testid="subscriptions-panel" />,
+}))
+
+const { Route } = await import('../notifications')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.notificationsResult = { data: undefined, isLoading: false }
+  mocks.markAllPending = false
+})
+
+describe('admin notifications route', () => {
+  it('renders the loading spinner while notifications are loading', () => {
+    mocks.notificationsResult = { data: undefined, isLoading: true }
+    renderPage()
+    expect(screen.getByTestId('spinner')).toBeInTheDocument()
+    // header reflects no totals -> "No notifications"
+    expect(screen.getByText('No notifications')).toBeInTheDocument()
+    // no "Mark all as read" button when unreadCount is 0
+    expect(screen.queryByRole('button', { name: 'Mark all as read' })).toBeNull()
+  })
+
+  it('renders the empty state when there are no notifications', () => {
+    mocks.notificationsResult = {
+      data: { notifications: [], unreadCount: 0, total: 0 },
+      isLoading: false,
+    }
+    renderPage()
+    expect(screen.getByTestId('empty-state')).toBeInTheDocument()
+    expect(screen.getByText('No notifications yet')).toBeInTheDocument()
+    expect(screen.getByTestId('subscriptions-panel')).toBeInTheDocument()
+  })
+
+  it('renders the notification list and marks an item as read on click', () => {
+    mocks.notificationsResult = {
+      data: {
+        notifications: [{ id: 'notif-1' }, { id: 'notif-2' }],
+        unreadCount: 2,
+        total: 5,
+      },
+      isLoading: false,
+    }
+    renderPage()
+    expect(screen.getByTestId('scroll-area')).toBeInTheDocument()
+    // unreadCount > 0 -> header shows "X unread of Y"
+    expect(screen.getByText('2 unread of 5')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByTestId('notification-notif-1'))
+    expect(mocks.markAsReadMutate).toHaveBeenCalledWith('notif-1')
+  })
+
+  it('shows the all-caught-up header and triggers mark-all-as-read', () => {
+    mocks.notificationsResult = {
+      data: {
+        notifications: [{ id: 'notif-1' }],
+        unreadCount: 0,
+        total: 3,
+      },
+      isLoading: false,
+    }
+    renderPage()
+    expect(screen.getByText('3 notifications — all caught up')).toBeInTheDocument()
+    // unreadCount is 0 so no mark-all button is rendered
+    expect(screen.queryByRole('button', { name: 'Mark all as read' })).toBeNull()
+  })
+
+  it('renders and fires the mark-all button when there are unread notifications', () => {
+    mocks.notificationsResult = {
+      data: {
+        notifications: [{ id: 'notif-1' }],
+        unreadCount: 1,
+        total: 1,
+      },
+      isLoading: false,
+    }
+    mocks.markAllPending = false
+    renderPage()
+    const button = screen.getByRole('button', { name: 'Mark all as read' })
+    expect(button).not.toBeDisabled()
+    fireEvent.click(button)
+    expect(mocks.markAllMutate).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.audit.gap.test.tsx b/apps/web/src/routes/admin/__tests__/settings.audit.gap.test.tsx
new file mode 100644
index 000000000..bda74cd00
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.audit.gap.test.tsx
@@ -0,0 +1,124 @@
+// @vitest-environment happy-dom
+import type { ReactElement } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { act, render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: {
+      queryClient: {
+        ensureInfiniteQueryData: (query: unknown) => unknown
+        ensureQueryData: (query: unknown) => unknown
+      }
+    }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type FilterBarProps = {
+  value: unknown
+  onChange: (next: unknown) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureInfiniteQueryData: vi.fn(async () => undefined),
+  ensureQueryData: vi.fn(async () => undefined),
+  defaultAuditFilters: vi.fn(() => ({ action: 'all' })),
+  listQuery: vi.fn((filters: unknown) => ({ queryKey: ['audit', 'list', filters] })),
+  actionsQuery: vi.fn(() => ({ queryKey: ['audit', 'actions'] })),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@/lib/client/queries/audit', () => ({
+  auditQueries: {
+    list: mocks.listQuery,
+    actions: mocks.actionsQuery,
+  },
+  defaultAuditFilters: mocks.defaultAuditFilters,
+}))
+
+vi.mock('@/components/admin/settings/audit/audit-filter-bar', () => ({
+  AuditFilterBar: ({ value, onChange }: FilterBarProps) => (
+    <button
+      type="button"
+      data-testid="filter-bar"
+      data-value={JSON.stringify(value)}
+      onClick={() => onChange({ action: 'login' })}
+    >
+      filter
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/settings/audit/audit-event-table', () => ({
+  AuditEventTable: ({ filters }: { filters: unknown }) => (
+    <div data-testid="event-table" data-filters={JSON.stringify(filters)} />
+  ),
+}))
+
+const { Route } = await import('../settings.audit')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('admin settings.audit route — loader', () => {
+  it('prefetches the audit list and action options', async () => {
+    await routeOptions().loader({
+      context: {
+        queryClient: {
+          ensureInfiniteQueryData: mocks.ensureInfiniteQueryData,
+          ensureQueryData: mocks.ensureQueryData,
+        },
+      },
+    })
+    expect(mocks.defaultAuditFilters).toHaveBeenCalled()
+    expect(mocks.listQuery).toHaveBeenCalledWith({ action: 'all' })
+    expect(mocks.actionsQuery).toHaveBeenCalled()
+    expect(mocks.ensureInfiniteQueryData).toHaveBeenCalledTimes(1)
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(1)
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load audit log')).toBeInTheDocument()
+  })
+})
+
+describe('admin settings.audit route — component', () => {
+  it('renders header, filter bar, and event table with default filters', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('Audit log')).toBeInTheDocument()
+    expect(screen.getByTestId('filter-bar')).toBeInTheDocument()
+    const table = screen.getByTestId('event-table')
+    expect(table.getAttribute('data-filters')).toBe(JSON.stringify({ action: 'all' }))
+  })
+
+  it('updates filters via the filter bar onChange (setState branch)', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    act(() => {
+      screen.getByTestId('filter-bar').click()
+    })
+    const table = screen.getByTestId('event-table')
+    expect(table.getAttribute('data-filters')).toBe(JSON.stringify({ action: 'login' }))
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.business-hours.diffcov.test.tsx b/apps/web/src/routes/admin/__tests__/settings.business-hours.diffcov.test.tsx
new file mode 100644
index 000000000..6ba4150a5
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.business-hours.diffcov.test.tsx
@@ -0,0 +1,131 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  listQuery: vi.fn((params: { includeArchived?: boolean }) => ({
+    queryKey: ['business-hours', 'list', params],
+  })),
+  dialogState: { open: false as boolean },
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/business-hours', () => ({
+  businessHoursQueries: {
+    list: mocks.listQuery,
+  },
+}))
+
+vi.mock('@/components/admin/settings/sla/business-hours-list', () => ({
+  BusinessHoursList: () => <div data-testid="bh-list" />,
+}))
+
+vi.mock('@/components/admin/settings/sla/business-hours-dialog', () => ({
+  BusinessHoursDialog: ({ open }: { open: boolean; onOpenChange: (open: boolean) => void }) => {
+    mocks.dialogState.open = open
+    return <div data-testid="bh-dialog" data-open={String(open)} />
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children, onClick }: ComponentProps) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  PlusIcon: () => <span />,
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: ComponentProps) => <div data-testid="gate">{children}</div>,
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    BUSINESS_HOURS_MANAGE: 'business_hours.manage',
+  },
+}))
+
+const { Route } = await import('../settings.business-hours')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.dialogState.open = false
+})
+
+describe('admin settings.business-hours route — loader', () => {
+  it('prefetches the business-hours list including archived', async () => {
+    await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.listQuery).toHaveBeenCalledWith({ includeArchived: true })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(1)
+    expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+      queryKey: ['business-hours', 'list', { includeArchived: true }],
+    })
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load business hours')).toBeInTheDocument()
+  })
+})
+
+describe('admin settings.business-hours route — component', () => {
+  it('renders header, list, and closed dialog by default', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('Business hours')).toBeInTheDocument()
+    expect(
+      screen.getByText(
+        'Calendars define working hours and holidays. Used by SLA policies to compute due times.'
+      )
+    ).toBeInTheDocument()
+    expect(screen.getByTestId('gate')).toBeInTheDocument()
+    expect(screen.getByTestId('bh-list')).toBeInTheDocument()
+    expect(screen.getByTestId('bh-dialog').getAttribute('data-open')).toBe('false')
+  })
+
+  it('opens the create dialog when the New calendar button is clicked', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByTestId('bh-dialog').getAttribute('data-open')).toBe('false')
+    fireEvent.click(screen.getByRole('button', { name: 'New calendar' }))
+    expect(screen.getByTestId('bh-dialog').getAttribute('data-open')).toBe('true')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.inboxes.gap.test.tsx b/apps/web/src/routes/admin/__tests__/settings.inboxes.gap.test.tsx
new file mode 100644
index 000000000..f892761fb
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.inboxes.gap.test.tsx
@@ -0,0 +1,103 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  listQuery: vi.fn((filters: { includeArchived?: boolean }) => ({
+    queryKey: ['inboxes', 'list', filters],
+  })),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    list: mocks.listQuery,
+  },
+}))
+
+vi.mock('@/components/admin/settings/inboxes/inbox-list', () => ({
+  InboxList: () => <div data-testid="inbox-list" />,
+}))
+
+vi.mock('@/components/admin/settings/inboxes/inbox-create-dialog', () => ({
+  InboxCreateDialog: ({ trigger }: { trigger: ReactNode }) => (
+    <div data-testid="create-dialog">{trigger}</div>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  PlusIcon: () => <span />,
+}))
+
+const { Route } = await import('../settings.inboxes')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('admin settings.inboxes route — loader', () => {
+  it('prefetches the inbox list including archived', async () => {
+    await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.listQuery).toHaveBeenCalledWith({ includeArchived: true })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(1)
+    expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+      queryKey: ['inboxes', 'list', { includeArchived: true }],
+    })
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load inboxes')).toBeInTheDocument()
+  })
+})
+
+describe('admin settings.inboxes route — component', () => {
+  it('renders the header, create dialog trigger, and inbox list', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('Inboxes')).toBeInTheDocument()
+    expect(
+      screen.getByText('Named queues with channels, members, and routing defaults.')
+    ).toBeInTheDocument()
+    expect(screen.getByText('New inbox')).toBeInTheDocument()
+    expect(screen.getByTestId('create-dialog')).toBeInTheDocument()
+    expect(screen.getByTestId('inbox-list')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.inboxes_.$inboxId.gap.test.tsx b/apps/web/src/routes/admin/__tests__/settings.inboxes_.$inboxId.gap.test.tsx
new file mode 100644
index 000000000..dbec3ded1
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.inboxes_.$inboxId.gap.test.tsx
@@ -0,0 +1,186 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    params: { inboxId: string }
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  to?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  notFound: vi.fn(() => new Error('not-found')),
+  queryData: {} as Record<string, unknown>,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useParams: () => ({ inboxId: 'inbox-1' }),
+  }),
+  Link: ({ children, to }: ComponentProps) => <a href={to}>{children}</a>,
+  notFound: mocks.notFound,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: (query: { queryKey: readonly unknown[] }) => ({
+    data: mocks.queryData[query.queryKey[1] as string],
+  }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/inboxes', () => ({
+  inboxQueries: {
+    detail: (inboxId: string) => ({ queryKey: ['inboxes', 'detail', inboxId] }),
+    channels: (inboxId: string) => ({ queryKey: ['inboxes', 'channels', inboxId] }),
+    memberships: (inboxId: string) => ({ queryKey: ['inboxes', 'memberships', inboxId] }),
+  },
+}))
+
+vi.mock('@/components/ui/tabs', () => ({
+  Tabs: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsList: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsTrigger: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+  TabsContent: ({ children }: ComponentProps) => <div>{children}</div>,
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: ComponentProps) => <span data-testid="badge">{children}</span>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: ComponentProps) => <span>{children}</span>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArrowLeftIcon: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@/components/admin/settings/inboxes/inbox-overview-tab', () => ({
+  InboxOverviewTab: ({ inbox }: { inbox: { id: string } }) => (
+    <div data-testid="overview">{inbox.id}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/settings/inboxes/inbox-channels-tab', () => ({
+  InboxChannelsTab: ({ inboxId }: { inboxId: string }) => (
+    <div data-testid="channels">{inboxId}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/settings/inboxes/inbox-members-tab', () => ({
+  InboxMembersTab: ({ inboxId }: { inboxId: string }) => <div data-testid="members">{inboxId}</div>,
+}))
+
+const { Route } = await import('../settings.inboxes_.$inboxId')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function seedInbox(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'inbox-1',
+    name: 'Support Inbox',
+    slug: 'support',
+    description: 'Main support inbox',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.queryData = { detail: seedInbox(), channels: [], memberships: [] }
+})
+
+describe('admin inbox detail route — loader', () => {
+  it('prefetches detail, channels and memberships queries when detail exists', async () => {
+    mocks.ensureQueryData.mockResolvedValue(seedInbox() as never)
+    await routeOptions().loader({
+      params: { inboxId: 'inbox-1' },
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(3)
+    expect(mocks.notFound).not.toHaveBeenCalled()
+  })
+
+  it('throws notFound when detail is missing', async () => {
+    mocks.ensureQueryData.mockResolvedValue(undefined)
+    await expect(
+      routeOptions().loader({
+        params: { inboxId: 'inbox-1' },
+        context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+      })
+    ).rejects.toThrow()
+    expect(mocks.notFound).toHaveBeenCalled()
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load inbox')).toBeInTheDocument()
+  })
+})
+
+describe('admin inbox detail route — component', () => {
+  it('returns null when inbox data is absent', () => {
+    mocks.queryData = { detail: undefined, channels: [], memberships: [] }
+    const { container } = renderPage()
+    expect(container.firstChild).toBeNull()
+  })
+
+  it('renders header, slug, description, and the Active badge', () => {
+    renderPage()
+    expect(screen.getByText('Support Inbox')).toBeInTheDocument()
+    expect(screen.getByText('support')).toBeInTheDocument()
+    expect(screen.getByText('Main support inbox')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.getByTestId('overview').textContent).toBe('inbox-1')
+    expect(screen.getByTestId('channels').textContent).toBe('inbox-1')
+    expect(screen.getByTestId('members').textContent).toBe('inbox-1')
+  })
+
+  it('shows the Archived badge when inbox is archived', () => {
+    mocks.queryData = {
+      detail: seedInbox({ archivedAt: '2026-01-01T00:00:00.000Z' }),
+      channels: [],
+      memberships: [],
+    }
+    renderPage()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+  })
+
+  it('omits the description when not provided', () => {
+    mocks.queryData = {
+      detail: seedInbox({ description: null }),
+      channels: [],
+      memberships: [],
+    }
+    renderPage()
+    expect(screen.queryByText('Main support inbox')).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.people.gap.test.tsx b/apps/web/src/routes/admin/__tests__/settings.people.gap.test.tsx
new file mode 100644
index 000000000..371154200
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.people.gap.test.tsx
@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  redirect: vi.fn((opts: unknown) => {
+    const err = new Error('REDIRECT') as Error & { __redirect: unknown }
+    err.__redirect = opts
+    return err
+  }),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  redirect: mocks.redirect,
+}))
+
+const { Route } = await import('../settings.people')
+
+type LoaderFn = () => unknown
+function loader(): LoaderFn {
+  return (Route.options as unknown as { loader: LoaderFn }).loader
+}
+
+describe('admin settings.people redirect route', () => {
+  it('throws a redirect to /admin/customers/segments', () => {
+    expect(() => loader()()).toThrow('REDIRECT')
+    expect(mocks.redirect).toHaveBeenCalledWith({ to: '/admin/customers/segments' })
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.roles.gap.test.tsx b/apps/web/src/routes/admin/__tests__/settings.roles.gap.test.tsx
new file mode 100644
index 000000000..8fdf79022
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.roles.gap.test.tsx
@@ -0,0 +1,90 @@
+// @vitest-environment happy-dom
+import type { ReactElement } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  listRolesFn: vi.fn(async () => [{ id: 'role_1', name: 'Admin' }]),
+  useSuspenseQuery: vi.fn(() => ({ data: [{ id: 'role_1', name: 'Admin' }] })),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: mocks.useSuspenseQuery,
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/server/functions/roles', () => ({
+  listRolesFn: mocks.listRolesFn,
+}))
+
+vi.mock('@/components/admin/settings/roles/roles-settings', () => ({
+  RolesSettings: ({ roles }: { roles: unknown }) => (
+    <div data-testid="roles-settings" data-roles={JSON.stringify(roles)} />
+  ),
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+const { Route } = await import('../settings.roles')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.useSuspenseQuery.mockReturnValue({ data: [{ id: 'role_1', name: 'Admin' }] })
+})
+
+describe('admin settings.roles route — loader/query', () => {
+  it('prefetches the roles list and the query fn calls listRolesFn', async () => {
+    await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(1)
+    const query = (mocks.ensureQueryData.mock.calls[0] as unknown[])[0] as unknown as {
+      queryKey: readonly string[]
+      queryFn: () => unknown
+    }
+    expect(query.queryKey).toEqual(['admin', 'roles', 'list'])
+    query.queryFn()
+    expect(mocks.listRolesFn).toHaveBeenCalledTimes(1)
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load roles')).toBeInTheDocument()
+  })
+})
+
+describe('admin settings.roles route — component', () => {
+  it('renders header and forwards suspense data into RolesSettings', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('Roles & permissions')).toBeInTheDocument()
+    const settings = screen.getByTestId('roles-settings')
+    expect(settings.getAttribute('data-roles')).toBe(
+      JSON.stringify([{ id: 'role_1', name: 'Admin' }])
+    )
+    expect(mocks.useSuspenseQuery).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.routing-rules.gap.test.tsx b/apps/web/src/routes/admin/__tests__/settings.routing-rules.gap.test.tsx
new file mode 100644
index 000000000..8deddf02e
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.routing-rules.gap.test.tsx
@@ -0,0 +1,198 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  listQuery: vi.fn((params: unknown) => ({ queryKey: ['routing-rules', 'list', params] })),
+  lastListScope: undefined as unknown,
+  lastEditorOpen: false as boolean,
+  lastInboxPickerValue: null as unknown,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/routing-rules', () => ({
+  routingRuleQueries: {
+    list: mocks.listQuery,
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children, onClick }: ComponentProps) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  PlusIcon: () => <span />,
+}))
+
+vi.mock('@/components/admin/shared/inbox-picker', () => ({
+  InboxPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: unknown
+    onValueChange: (v: unknown) => void
+  }) => {
+    mocks.lastInboxPickerValue = value
+    return (
+      <button type="button" data-testid="inbox-picker" onClick={() => onValueChange('inbox-9')}>
+        pick
+      </button>
+    )
+  },
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: ComponentProps) => <div data-testid="gate">{children}</div>,
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ROUTING_RULE_MANAGE: 'routing_rule.manage',
+  },
+}))
+
+vi.mock('@/components/admin/settings/routing/routing-rule-list', () => ({
+  RoutingRuleList: ({ inboxIdScope }: { inboxIdScope: unknown }) => {
+    mocks.lastListScope = inboxIdScope
+    return <div data-testid="rule-list" data-scope={String(inboxIdScope)} />
+  },
+}))
+
+vi.mock('@/components/admin/settings/routing/routing-rule-editor-sheet', () => ({
+  RoutingRuleEditorSheet: ({ open }: { open: boolean; onOpenChange: (o: boolean) => void }) => {
+    mocks.lastEditorOpen = open
+    return <div data-testid="editor-sheet" data-open={String(open)} />
+  },
+}))
+
+vi.mock('@/components/ui/select', () => ({
+  Select: ({
+    value,
+    onValueChange,
+    children,
+  }: {
+    value: string
+    onValueChange: (v: string) => void
+    children?: ReactNode
+  }) => (
+    <div data-testid="select" data-value={value}>
+      <button
+        type="button"
+        data-testid="select-workspace"
+        onClick={() => onValueChange('workspace')}
+      >
+        workspace
+      </button>
+      <button type="button" data-testid="select-inbox" onClick={() => onValueChange('inbox')}>
+        inbox
+      </button>
+      <button type="button" data-testid="select-all" onClick={() => onValueChange('all')}>
+        all
+      </button>
+      {children}
+    </div>
+  ),
+  SelectContent: ({ children }: ComponentProps) => <div>{children}</div>,
+  SelectItem: ({ children }: ComponentProps) => <div>{children}</div>,
+  SelectTrigger: ({ children }: ComponentProps) => <div>{children}</div>,
+  SelectValue: () => <span />,
+}))
+
+const { Route } = await import('../settings.routing-rules')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.lastListScope = undefined
+  mocks.lastEditorOpen = false
+  mocks.lastInboxPickerValue = null
+})
+
+describe('admin settings.routing-rules route — loader', () => {
+  it('prefetches the routing-rule list', async () => {
+    await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.listQuery).toHaveBeenCalledWith({})
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(1)
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load routing rules')).toBeInTheDocument()
+  })
+})
+
+describe('admin settings.routing-rules route — component', () => {
+  it('renders default (all) scope: list scope undefined, no inbox picker, editor closed', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('Routing rules')).toBeInTheDocument()
+    expect(screen.getByTestId('rule-list').getAttribute('data-scope')).toBe('undefined')
+    expect(screen.queryByTestId('inbox-picker')).not.toBeInTheDocument()
+    expect(screen.getByTestId('editor-sheet').getAttribute('data-open')).toBe('false')
+  })
+
+  it('opens the editor sheet when New rule is clicked', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    fireEvent.click(screen.getByRole('button', { name: 'New rule' }))
+    expect(screen.getByTestId('editor-sheet').getAttribute('data-open')).toBe('true')
+  })
+
+  it('workspace scope passes "workspace" to the list', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    fireEvent.click(screen.getByTestId('select-workspace'))
+    expect(screen.getByTestId('rule-list').getAttribute('data-scope')).toBe('workspace')
+    expect(screen.queryByTestId('inbox-picker')).not.toBeInTheDocument()
+  })
+
+  it('inbox scope shows the picker; undefined until an inbox is chosen, then the inbox id', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    fireEvent.click(screen.getByTestId('select-inbox'))
+    // inbox mode but no inboxScope yet -> undefined branch
+    expect(screen.getByTestId('rule-list').getAttribute('data-scope')).toBe('undefined')
+    const picker = screen.getByTestId('inbox-picker')
+    expect(picker).toBeInTheDocument()
+    fireEvent.click(picker)
+    // now inboxScope set -> resolves to the inbox id
+    expect(screen.getByTestId('rule-list').getAttribute('data-scope')).toBe('inbox-9')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.security.audit-log.test.tsx b/apps/web/src/routes/admin/__tests__/settings.security.audit-log.test.tsx
new file mode 100644
index 000000000..f465edf8b
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.security.audit-log.test.tsx
@@ -0,0 +1,31 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const redirectMock = vi.fn((input: unknown) => ({ kind: 'redirect', input }))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  redirect: redirectMock,
+}))
+
+const { Route } = await import('../settings.security.audit-log')
+
+describe('settings.security.audit-log route', () => {
+  it('redirects to the canonical audit log URL', () => {
+    let thrown: unknown
+
+    try {
+      ;(Route.options as { beforeLoad: () => void }).beforeLoad()
+    } catch (error) {
+      thrown = error
+    }
+
+    expect(redirectMock).toHaveBeenCalledWith({
+      to: '/admin/settings/audit',
+      replace: true,
+    })
+    expect(thrown).toEqual({
+      kind: 'redirect',
+      input: { to: '/admin/settings/audit', replace: true },
+    })
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.sla.gap.test.tsx b/apps/web/src/routes/admin/__tests__/settings.sla.gap.test.tsx
new file mode 100644
index 000000000..1a8e3730e
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.sla.gap.test.tsx
@@ -0,0 +1,141 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  policiesQuery: vi.fn((params: { includeArchived?: boolean }) => ({
+    queryKey: ['sla', 'policies', params],
+  })),
+  bhListQuery: vi.fn((params: Record<string, unknown>) => ({
+    queryKey: ['business-hours', 'list', params],
+  })),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/sla', () => ({
+  slaQueries: {
+    policies: mocks.policiesQuery,
+  },
+}))
+
+vi.mock('@/lib/client/queries/business-hours', () => ({
+  businessHoursQueries: {
+    list: mocks.bhListQuery,
+  },
+}))
+
+vi.mock('@/components/admin/settings/sla/sla-policy-list', () => ({
+  SlaPolicyList: () => <div data-testid="sla-list" />,
+}))
+
+vi.mock('@/components/admin/settings/sla/sla-policy-create-dialog', () => ({
+  SlaPolicyCreateDialog: ({ open }: { open: boolean; onOpenChange: (open: boolean) => void }) => (
+    <div data-testid="sla-create-dialog" data-open={String(open)} />
+  ),
+}))
+
+vi.mock('@/components/admin/settings/sla/sla-tick-trigger', () => ({
+  SlaTickTrigger: () => <div data-testid="sla-tick" />,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children, onClick }: ComponentProps) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  PlusIcon: () => <span />,
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: ComponentProps) => <div data-testid="gate">{children}</div>,
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    SLA_MANAGE: 'sla.manage',
+  },
+}))
+
+const { Route } = await import('../settings.sla')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('admin settings.sla route — loader', () => {
+  it('prefetches policies (including archived) and the business-hours list', async () => {
+    await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.policiesQuery).toHaveBeenCalledWith({ includeArchived: true })
+    expect(mocks.bhListQuery).toHaveBeenCalledWith({})
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(2)
+    expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+      queryKey: ['sla', 'policies', { includeArchived: true }],
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+      queryKey: ['business-hours', 'list', {}],
+    })
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load SLA policies')).toBeInTheDocument()
+  })
+})
+
+describe('admin settings.sla route — component', () => {
+  it('renders header, tick trigger, list, and closed dialog by default', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('SLA policies')).toBeInTheDocument()
+    expect(screen.getByTestId('sla-tick')).toBeInTheDocument()
+    expect(screen.getByTestId('gate')).toBeInTheDocument()
+    expect(screen.getByTestId('sla-list')).toBeInTheDocument()
+    expect(screen.getByTestId('sla-create-dialog').getAttribute('data-open')).toBe('false')
+  })
+
+  it('opens the create dialog when the New policy button is clicked', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByTestId('sla-create-dialog').getAttribute('data-open')).toBe('false')
+    fireEvent.click(screen.getByRole('button', { name: 'New policy' }))
+    expect(screen.getByTestId('sla-create-dialog').getAttribute('data-open')).toBe('true')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.sla_.$policyId.diffcov.test.tsx b/apps/web/src/routes/admin/__tests__/settings.sla_.$policyId.diffcov.test.tsx
new file mode 100644
index 000000000..f02809354
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.sla_.$policyId.diffcov.test.tsx
@@ -0,0 +1,205 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    params: { policyId: string }
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  to?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  notFound: vi.fn(() => new Error('not-found')),
+  queryData: {} as Record<string, unknown>,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useParams: () => ({ policyId: 'policy-1' }),
+  }),
+  Link: ({ children, to }: ComponentProps) => <a href={to}>{children}</a>,
+  notFound: mocks.notFound,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: (query: { queryKey: readonly unknown[] }) => ({
+    data: mocks.queryData[query.queryKey[1] as string],
+  }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/sla', () => ({
+  slaQueries: {
+    policy: (id: string) => ({ queryKey: ['sla', 'policy', id] }),
+    escalations: (id: string) => ({ queryKey: ['sla', 'escalations', id] }),
+  },
+}))
+
+vi.mock('@/lib/client/queries/business-hours', () => ({
+  businessHoursQueries: {
+    list: (params: unknown) => ({ queryKey: ['business-hours', 'list', params] }),
+  },
+}))
+
+vi.mock('@/components/ui/tabs', () => ({
+  Tabs: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsList: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsTrigger: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+  TabsContent: ({ children }: ComponentProps) => <div>{children}</div>,
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: ComponentProps) => <span data-testid="badge">{children}</span>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: ComponentProps) => <span>{children}</span>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArrowLeftIcon: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@/components/admin/settings/sla/sla-policy-overview-tab', () => ({
+  SlaPolicyOverviewTab: ({ policy }: { policy: { id: string } }) => (
+    <div data-testid="overview">{policy.id}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/settings/sla/sla-targets-tab', () => ({
+  SlaTargetsTab: ({
+    policyId,
+    initialTargets,
+  }: {
+    policyId: string
+    initialTargets: unknown[]
+  }) => (
+    <div data-testid="targets">
+      {policyId}-{initialTargets.length}
+    </div>
+  ),
+}))
+
+vi.mock('@/components/admin/settings/sla/sla-escalations-tab', () => ({
+  SlaEscalationsTab: ({ policyId }: { policyId: string }) => (
+    <div data-testid="escalations">{policyId}</div>
+  ),
+}))
+
+const { Route } = await import('../settings.sla_.$policyId')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function seedDetail(
+  policyOverrides: Record<string, unknown> = {},
+  targets: unknown[] = [{ id: 't-1' }]
+) {
+  return {
+    policy: {
+      id: 'policy-1',
+      name: 'Gold SLA',
+      scope: 'workspace',
+      description: 'Premium response times',
+      archivedAt: null,
+      ...policyOverrides,
+    },
+    targets,
+  }
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.queryData = { policy: seedDetail(), escalations: [] }
+})
+
+describe('admin SLA policy detail route — loader', () => {
+  it('prefetches policy, escalations, and business hours when detail exists', async () => {
+    mocks.ensureQueryData.mockResolvedValue(seedDetail() as never)
+    await routeOptions().loader({
+      params: { policyId: 'policy-1' },
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(3)
+    expect(mocks.notFound).not.toHaveBeenCalled()
+  })
+
+  it('throws notFound when detail is missing', async () => {
+    mocks.ensureQueryData.mockResolvedValue(undefined)
+    await expect(
+      routeOptions().loader({
+        params: { policyId: 'policy-1' },
+        context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+      })
+    ).rejects.toThrow()
+    expect(mocks.notFound).toHaveBeenCalled()
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load SLA policy')).toBeInTheDocument()
+  })
+})
+
+describe('admin SLA policy detail route — component', () => {
+  it('returns null when detail is absent', () => {
+    mocks.queryData = { policy: undefined, escalations: [] }
+    const { container } = renderPage()
+    expect(container.firstChild).toBeNull()
+  })
+
+  it('renders header, scope badge, description, Active badge, and tabs', () => {
+    renderPage()
+    expect(screen.getByText('Gold SLA')).toBeInTheDocument()
+    expect(screen.getByText('workspace')).toBeInTheDocument()
+    expect(screen.getByText('Premium response times')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.getByTestId('overview').textContent).toBe('policy-1')
+    expect(screen.getByTestId('targets').textContent).toBe('policy-1-1')
+    expect(screen.getByTestId('escalations').textContent).toBe('policy-1')
+  })
+
+  it('shows the Archived badge when the policy is archived', () => {
+    mocks.queryData = {
+      policy: seedDetail({ archivedAt: '2026-01-01T00:00:00.000Z' }),
+      escalations: [],
+    }
+    renderPage()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+  })
+
+  it('omits the description when not provided', () => {
+    mocks.queryData = {
+      policy: seedDetail({ description: null }),
+      escalations: [],
+    }
+    renderPage()
+    expect(screen.queryByText('Premium response times')).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.teams.diffcov.test.tsx b/apps/web/src/routes/admin/__tests__/settings.teams.diffcov.test.tsx
new file mode 100644
index 000000000..76410c146
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.teams.diffcov.test.tsx
@@ -0,0 +1,114 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  listQuery: vi.fn((filters: { includeArchived?: boolean }) => ({
+    queryKey: ['teams', 'list', filters],
+  })),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/teams', () => ({
+  teamQueries: {
+    list: mocks.listQuery,
+  },
+}))
+
+vi.mock('@/components/admin/settings/teams/team-list', () => ({
+  TeamList: () => <div data-testid="team-list" />,
+}))
+
+vi.mock('@/components/admin/settings/teams/team-create-dialog', () => ({
+  TeamCreateDialog: ({ trigger }: { trigger: ReactNode }) => (
+    <div data-testid="create-dialog">{trigger}</div>
+  ),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  PlusIcon: () => <span />,
+}))
+
+vi.mock('@/components/admin/shared/permission-gate', () => ({
+  PermissionGate: ({ children }: ComponentProps) => <div data-testid="gate">{children}</div>,
+}))
+
+vi.mock('@/lib/server/domains/authz', () => ({
+  PERMISSIONS: {
+    ADMIN_MANAGE_USERS: 'admin.manage_users',
+  },
+}))
+
+const { Route } = await import('../settings.teams')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('admin settings.teams route — loader', () => {
+  it('prefetches the team list including archived teams', async () => {
+    await routeOptions().loader({
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.listQuery).toHaveBeenCalledWith({ includeArchived: true })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(1)
+    expect(mocks.ensureQueryData).toHaveBeenCalledWith({
+      queryKey: ['teams', 'list', { includeArchived: true }],
+    })
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load teams')).toBeInTheDocument()
+  })
+})
+
+describe('admin settings.teams route — component', () => {
+  it('renders the header, gated create dialog, and team list', () => {
+    const Component = routeOptions().component
+    render(<Component />)
+    expect(screen.getByText('Teams')).toBeInTheDocument()
+    expect(
+      screen.getByText('Workspace teams used for routing, ticket sharing, and SLA scopes.')
+    ).toBeInTheDocument()
+    expect(screen.getByText('New team')).toBeInTheDocument()
+    expect(screen.getByTestId('gate')).toBeInTheDocument()
+    expect(screen.getByTestId('create-dialog')).toBeInTheDocument()
+    expect(screen.getByTestId('team-list')).toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/settings.teams_.$teamId.diffcov.test.tsx b/apps/web/src/routes/admin/__tests__/settings.teams_.$teamId.diffcov.test.tsx
new file mode 100644
index 000000000..8bfb2a684
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/settings.teams_.$teamId.diffcov.test.tsx
@@ -0,0 +1,180 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    params: { teamId: string }
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  to?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  notFound: vi.fn(() => new Error('not-found')),
+  queryData: {} as Record<string, unknown>,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useParams: () => ({ teamId: 'team-1' }),
+  }),
+  Link: ({ children, to }: ComponentProps) => <a href={to}>{children}</a>,
+  notFound: mocks.notFound,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: (query: { queryKey: readonly unknown[] }) => ({
+    data: mocks.queryData[query.queryKey[1] as string],
+  }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/teams', () => ({
+  teamQueries: {
+    detail: (teamId: string) => ({ queryKey: ['teams', 'detail', teamId] }),
+    members: (teamId: string) => ({ queryKey: ['teams', 'members', teamId] }),
+  },
+}))
+
+vi.mock('@/components/ui/tabs', () => ({
+  Tabs: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsList: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsTrigger: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+  TabsContent: ({ children }: ComponentProps) => <div>{children}</div>,
+}))
+
+vi.mock('@/components/ui/badge', () => ({
+  Badge: ({ children }: ComponentProps) => <span data-testid="badge">{children}</span>,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: ComponentProps) => <span>{children}</span>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  ArrowLeftIcon: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@/components/admin/settings/teams/team-overview-tab', () => ({
+  TeamOverviewTab: ({ team }: { team: { id: string } }) => (
+    <div data-testid="overview">{team.id}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/settings/teams/team-members-tab', () => ({
+  TeamMembersTab: ({ teamId }: { teamId: string }) => <div data-testid="members">{teamId}</div>,
+}))
+
+const { Route } = await import('../settings.teams_.$teamId')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function seedTeam(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'team-1',
+    name: 'Support',
+    slug: 'support',
+    shortLabel: 'SUP',
+    color: '#123456',
+    description: 'Front-line support team',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.queryData = { detail: seedTeam(), members: [] }
+})
+
+describe('admin team detail route — loader', () => {
+  it('prefetches detail and members queries when detail exists', async () => {
+    mocks.ensureQueryData.mockResolvedValue(seedTeam() as never)
+    await routeOptions().loader({
+      params: { teamId: 'team-1' },
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(2)
+    expect(mocks.notFound).not.toHaveBeenCalled()
+  })
+
+  it('throws notFound when detail is missing', async () => {
+    mocks.ensureQueryData.mockResolvedValue(undefined)
+    await expect(
+      routeOptions().loader({
+        params: { teamId: 'team-1' },
+        context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+      })
+    ).rejects.toThrow()
+    expect(mocks.notFound).toHaveBeenCalled()
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load team')).toBeInTheDocument()
+  })
+})
+
+describe('admin team detail route — component', () => {
+  it('returns null when team data is absent', () => {
+    mocks.queryData = { detail: undefined, members: [] }
+    const { container } = renderPage()
+    expect(container.firstChild).toBeNull()
+  })
+
+  it('renders header, short label, description, and the Active badge', () => {
+    renderPage()
+    expect(screen.getByText('Support')).toBeInTheDocument()
+    expect(screen.getByText('support')).toBeInTheDocument()
+    expect(screen.getByText('SUP')).toBeInTheDocument()
+    expect(screen.getByText('Front-line support team')).toBeInTheDocument()
+    expect(screen.getByText('Active')).toBeInTheDocument()
+    expect(screen.getByTestId('overview').textContent).toBe('team-1')
+    expect(screen.getByTestId('members').textContent).toBe('team-1')
+  })
+
+  it('shows the Archived badge and falls back color when team is archived', () => {
+    mocks.queryData = {
+      detail: seedTeam({ archivedAt: '2026-01-01T00:00:00.000Z', color: null }),
+      members: [],
+    }
+    renderPage()
+    expect(screen.getByText('Archived')).toBeInTheDocument()
+  })
+
+  it('omits the short label and description when not provided', () => {
+    mocks.queryData = {
+      detail: seedTeam({ shortLabel: null, description: null }),
+      members: [],
+    }
+    renderPage()
+    expect(screen.queryByText('SUP')).not.toBeInTheDocument()
+    expect(screen.queryByText('Front-line support team')).not.toBeInTheDocument()
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/tickets.$ticketId.diffcov.test.tsx b/apps/web/src/routes/admin/__tests__/tickets.$ticketId.diffcov.test.tsx
new file mode 100644
index 000000000..1a308e047
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/tickets.$ticketId.diffcov.test.tsx
@@ -0,0 +1,449 @@
+// @vitest-environment happy-dom
+
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+
+type RouteOptions = {
+  loader: (input: {
+    params: { ticketId: string }
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+}
+
+type MutationOptions<T> = {
+  mutationFn: (vars: unknown) => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  invalidateQueries: vi.fn(),
+  setQueryData: vi.fn(),
+  getQueryData: vi.fn<(key: unknown) => unknown>(() => undefined),
+  updateTicketFn: vi.fn(async () => ({ id: 'ticket-1', updatedAt: '2026-06-20T00:00:00.000Z' })),
+  handleTicketConflict: vi.fn(),
+  toastSuccess: vi.fn(),
+  myPermissions: { data: undefined as unknown },
+  // suspense query data, keyed by the third queryKey segment ('detail' etc. are
+  // index 1, but we just key by a label we attach in the queries mock)
+  queryData: {} as Record<string, unknown>,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useParams: () => ({ ticketId: 'ticket-1' }),
+  }),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mocks.invalidateQueries,
+    setQueryData: mocks.setQueryData,
+    getQueryData: mocks.getQueryData,
+  }),
+  useSuspenseQuery: (query: { queryKey: readonly unknown[] }) => ({
+    data: mocks.queryData[query.queryKey[1] as string],
+  }),
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: (vars: unknown) => {
+      void options
+        .mutationFn(vars)
+        .then((result) => options.onSuccess?.(result))
+        .catch((error: Error) => options.onError?.(error))
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    detail: (ticketId: string) => ({ queryKey: ['tickets', 'detail', ticketId] }),
+    threads: (ticketId: string) => ({ queryKey: ['tickets', 'threads', ticketId] }),
+    participants: (ticketId: string) => ({ queryKey: ['tickets', 'participants', ticketId] }),
+    shares: (ticketId: string) => ({ queryKey: ['tickets', 'shares', ticketId] }),
+    statuses: () => ({ queryKey: ['tickets', 'statuses'] }),
+    activity: (ticketId: string) => ({ queryKey: ['tickets', 'activity', ticketId] }),
+  },
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  updateTicketFn: mocks.updateTicketFn,
+}))
+
+vi.mock('@/lib/client/hooks/use-authz-queries', () => ({
+  useMyPermissions: () => mocks.myPermissions,
+}))
+
+vi.mock('@/lib/client/utils/handle-ticket-conflict', () => ({
+  handleTicketConflict: mocks.handleTicketConflict,
+}))
+
+vi.mock('sonner', () => ({
+  toast: { success: mocks.toastSuccess },
+}))
+
+vi.mock('@/components/ui/tabs', () => ({
+  Tabs: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsList: ({ children }: ComponentProps) => <div>{children}</div>,
+  TabsTrigger: ({ children }: ComponentProps) => <button type="button">{children}</button>,
+  TabsContent: ({ children }: ComponentProps) => <div>{children}</div>,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => <span className={className} />,
+}))
+
+vi.mock('@/components/admin/tickets/ticket-detail-header', () => ({
+  TicketDetailHeader: ({
+    currentPrincipalId,
+    ticket,
+  }: {
+    currentPrincipalId: string
+    ticket: { subject: string }
+  }) => (
+    <header>
+      <span>subject:{ticket.subject}</span>
+      <span data-testid="current-principal">{String(currentPrincipalId)}</span>
+    </header>
+  ),
+}))
+
+vi.mock('@/components/admin/tickets/ticket-thread-feed', () => ({
+  TicketThreadFeed: ({
+    principalNames,
+    onDescriptionUpdate,
+    isDescriptionSaving,
+  }: {
+    principalNames: Record<string, string>
+    onDescriptionUpdate?: (json: unknown, text: string | null) => void
+    isDescriptionSaving: boolean
+  }) => (
+    <div>
+      <span data-testid="principal-names">{JSON.stringify(principalNames)}</span>
+      <span data-testid="can-edit">{onDescriptionUpdate ? 'editable' : 'readonly'}</span>
+      <span data-testid="saving">{String(isDescriptionSaving)}</span>
+      {onDescriptionUpdate ? (
+        <button
+          type="button"
+          onClick={() => onDescriptionUpdate({ type: 'doc', content: [] }, 'new description text')}
+        >
+          Update description
+        </button>
+      ) : null}
+    </div>
+  ),
+}))
+
+vi.mock('@/components/admin/tickets/ticket-thread-composer', () => ({
+  TicketThreadComposer: ({
+    canPublic,
+    canInternal,
+    canShared,
+  }: {
+    canPublic: boolean
+    canInternal: boolean
+    canShared: boolean
+  }) => (
+    <div data-testid="composer">
+      {String(canPublic)}-{String(canInternal)}-{String(canShared)}
+    </div>
+  ),
+}))
+
+vi.mock('@/components/admin/tickets/ticket-properties-panel', () => ({
+  TicketPropertiesPanel: ({ ticket }: { ticket: { id: string } }) => (
+    <div data-testid="properties">{ticket.id}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/tickets/ticket-participants-list', () => ({
+  TicketParticipantsList: ({ participants }: { participants: unknown[] }) => (
+    <div data-testid="participants">{participants.length}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/tickets/ticket-shares-panel', () => ({
+  TicketSharesPanel: ({ canShare }: { canShare: boolean }) => (
+    <div data-testid="shares">{String(canShare)}</div>
+  ),
+}))
+
+vi.mock('@/components/admin/tickets/ticket-sla-panel', () => ({
+  TicketSlaPanel: () => <div data-testid="sla" />,
+}))
+
+vi.mock('@/components/admin/tickets/ticket-activity-timeline', () => ({
+  TicketActivityTimeline: () => <div data-testid="activity" />,
+}))
+
+const { Route } = await import('../tickets.$ticketId')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function seedTicket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'ticket-1',
+    subject: 'My ticket',
+    channel: 'email',
+    priority: 'normal',
+    visibilityScope: 'public',
+    statusId: 'status-1',
+    primaryTeamId: 'team-primary',
+    assigneeTeamId: 'team-assignee',
+    inboxId: 'inbox-1',
+    organizationId: 'org-1',
+    requesterContactId: 'contact-1',
+    assigneePrincipalId: 'principal-assignee',
+    descriptionText: 'desc',
+    descriptionJson: null,
+    updatedAt: '2026-06-19T00:00:00.000Z',
+    ...overrides,
+  }
+}
+
+function seedQueries(overrides: Record<string, unknown> = {}) {
+  mocks.queryData = {
+    detail: seedTicket(),
+    threads: [
+      {
+        id: 'thread-1',
+        ticketId: 'ticket-1',
+        principalId: 'principal-a',
+        principalName: '  Alice  ',
+        audience: 'public',
+        bodyJson: null,
+        bodyText: 'hi',
+        sharedWithTeamId: null,
+        createdAt: '2026-06-19T00:00:00.000Z',
+        editedAt: null,
+      },
+      {
+        id: 'thread-2',
+        ticketId: 'ticket-1',
+        principalId: 'principal-b',
+        principalName: null,
+        audience: 'internal',
+        bodyJson: null,
+        bodyText: 'note',
+        sharedWithTeamId: null,
+        createdAt: '2026-06-19T00:00:00.000Z',
+        editedAt: null,
+      },
+      {
+        id: 'thread-3',
+        ticketId: 'ticket-1',
+        principalId: null,
+        principalName: 'System',
+        audience: 'public',
+        bodyJson: null,
+        bodyText: 'system',
+        sharedWithTeamId: null,
+        createdAt: '2026-06-19T00:00:00.000Z',
+        editedAt: null,
+      },
+    ],
+    participants: [
+      {
+        id: 'p-1',
+        ticketId: 'ticket-1',
+        principalId: 'principal-a',
+        contactId: null,
+        role: 'agent',
+      },
+    ],
+    shares: [{ id: 's-1', ticketId: 'ticket-1', teamId: 'team-shared', accessLevel: 'read' }],
+    ...overrides,
+  }
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.myPermissions = { data: undefined }
+  mocks.getQueryData.mockReturnValue(undefined)
+  seedQueries()
+})
+
+describe('admin ticket detail route — loader', () => {
+  it('prefetches all five ticket queries', async () => {
+    await routeOptions().loader({
+      params: { ticketId: 'ticket-1' },
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(5)
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load ticket')).toBeInTheDocument()
+  })
+})
+
+describe('admin ticket detail route — component (no permissions)', () => {
+  it('renders read-only with all permissions denied and falls back currentPrincipalId to assignee', () => {
+    renderPage()
+
+    // perms.data undefined -> hasAnyPermission false for all three
+    expect(screen.getByTestId('composer').textContent).toBe('false-false-false')
+    // canEditDescription false -> feed is read-only
+    expect(screen.getByTestId('can-edit').textContent).toBe('readonly')
+    // currentPrincipalId falls back to assigneePrincipalId
+    expect(screen.getByTestId('current-principal').textContent).toBe('principal-assignee')
+    expect(screen.getByTestId('saving').textContent).toBe('false')
+  })
+
+  it('builds principalNames trimming names and skipping null principals', () => {
+    renderPage()
+    const names = JSON.parse(screen.getByTestId('principal-names').textContent ?? '{}')
+    expect(names).toEqual({ 'principal-a': 'Alice', 'principal-b': 'Unknown' })
+  })
+
+  it('falls back currentPrincipalId to ticket.id when no assignee and no principal', () => {
+    seedQueries({ detail: seedTicket({ assigneePrincipalId: null }) })
+    renderPage()
+    expect(screen.getByTestId('current-principal').textContent).toBe('ticket-1')
+  })
+})
+
+describe('admin ticket detail route — component (workspace permissions)', () => {
+  beforeEach(() => {
+    mocks.myPermissions = {
+      data: {
+        principalId: 'principal-current',
+        workspacePermissions: [
+          'ticket.reply_public',
+          'ticket.comment_internal',
+          'ticket.share_cross_team',
+          'ticket.edit_fields',
+        ],
+        teamPermissions: [],
+      },
+    }
+  })
+
+  it('grants all composer permissions and editable description via workspace scope', () => {
+    renderPage()
+    expect(screen.getByTestId('composer').textContent).toBe('true-true-true')
+    expect(screen.getByTestId('can-edit').textContent).toBe('editable')
+    expect(screen.getByTestId('shares').textContent).toBe('true')
+    // currentPrincipalId now from perms
+    expect(screen.getByTestId('current-principal').textContent).toBe('principal-current')
+  })
+
+  it('runs the description mutation success path and invalidates queries', async () => {
+    renderPage()
+    fireEvent.click(screen.getByRole('button', { name: 'Update description' }))
+
+    await waitFor(() =>
+      expect(mocks.updateTicketFn).toHaveBeenCalledWith({
+        data: expect.objectContaining({
+          ticketId: 'ticket-1',
+          expectedUpdatedAt: '2026-06-19T00:00:00.000Z',
+          descriptionText: 'new description text',
+        }),
+      })
+    )
+    expect(mocks.setQueryData).toHaveBeenCalled()
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Description updated')
+    // invalidateTicket fires three invalidations
+    expect(mocks.invalidateQueries).toHaveBeenCalledTimes(3)
+  })
+
+  it('uses cached updatedAt from queryClient for expectedUpdatedAt when present', async () => {
+    mocks.getQueryData.mockReturnValue({ updatedAt: '2026-06-20T12:00:00.000Z' })
+    renderPage()
+    fireEvent.click(screen.getByRole('button', { name: 'Update description' }))
+
+    await waitFor(() =>
+      expect(mocks.updateTicketFn).toHaveBeenCalledWith({
+        data: expect.objectContaining({
+          expectedUpdatedAt: '2026-06-20T12:00:00.000Z',
+        }),
+      })
+    )
+  })
+
+  it('routes mutation errors to the conflict handler', async () => {
+    mocks.updateTicketFn.mockRejectedValueOnce(new Error('stale'))
+    renderPage()
+    fireEvent.click(screen.getByRole('button', { name: 'Update description' }))
+
+    await waitFor(() =>
+      expect(mocks.handleTicketConflict).toHaveBeenCalledWith(
+        expect.any(Error),
+        expect.anything(),
+        'ticket-1'
+      )
+    )
+    expect(mocks.toastSuccess).not.toHaveBeenCalled()
+  })
+})
+
+describe('admin ticket detail route — component (team-scoped permissions)', () => {
+  it('grants permission only when the team matches a ticket-related team', () => {
+    mocks.myPermissions = {
+      data: {
+        principalId: 'principal-current',
+        workspacePermissions: [],
+        teamPermissions: [
+          { teamId: 'team-primary', permissions: ['ticket.edit_fields', 'ticket.reply_public'] },
+          // a team that holds the perm but is unrelated to this ticket -> no grant
+          { teamId: 'team-unrelated', permissions: ['ticket.comment_internal'] },
+        ],
+      },
+    }
+    renderPage()
+    // edit_fields granted because team-primary === ticket.primaryTeamId
+    expect(screen.getByTestId('can-edit').textContent).toBe('editable')
+    // reply_public granted via hasAnyPermission (team has the key, team-agnostic)
+    // comment_internal granted via hasAnyPermission too (team-unrelated has it)
+    expect(screen.getByTestId('composer').textContent).toBe('true-true-false')
+  })
+
+  it('denies resource permission when team holds key but is unrelated to ticket', () => {
+    mocks.myPermissions = {
+      data: {
+        principalId: 'principal-current',
+        workspacePermissions: [],
+        teamPermissions: [{ teamId: 'team-unrelated', permissions: ['ticket.edit_fields'] }],
+      },
+    }
+    renderPage()
+    // edit_fields denied -> read-only because team-unrelated is not primary/assignee/shared
+    expect(screen.getByTestId('can-edit').textContent).toBe('readonly')
+  })
+
+  it('grants resource permission via the shared team id', () => {
+    mocks.myPermissions = {
+      data: {
+        principalId: 'principal-current',
+        workspacePermissions: [],
+        teamPermissions: [{ teamId: 'team-shared', permissions: ['ticket.edit_fields'] }],
+      },
+    }
+    renderPage()
+    expect(screen.getByTestId('can-edit').textContent).toBe('editable')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/tickets.gap.test.tsx b/apps/web/src/routes/admin/__tests__/tickets.gap.test.tsx
new file mode 100644
index 000000000..804c5df74
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/tickets.gap.test.tsx
@@ -0,0 +1,130 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  validateSearch: (input: unknown) => unknown
+  component: () => ReactElement
+}
+
+type LinkProps = {
+  to: string
+  children?: ReactNode
+}
+
+type SidebarProps = {
+  activeScope?: string
+  activeInboxId?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  pathname: '/admin/tickets',
+  search: { scope: 'my_assigned', inboxId: undefined } as {
+    scope?: string
+    inboxId?: string
+  },
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useSearch: () => mocks.search,
+  }),
+  Link: ({ to, children }: LinkProps) => (
+    <a href={to} data-testid={`link-${to}`}>
+      {children}
+    </a>
+  ),
+  Outlet: () => <div data-testid="outlet" />,
+  useRouterState: ({ select }: { select: (s: { location: { pathname: string } }) => string }) =>
+    select({ location: { pathname: mocks.pathname } }),
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: { children?: ReactNode }) => <div data-testid="button">{children}</div>,
+}))
+
+vi.mock('@heroicons/react/24/outline', () => ({
+  PlusIcon: () => <svg data-testid="plus-icon" />,
+}))
+
+vi.mock('@/components/admin/tickets/ticket-queue-sidebar', () => ({
+  TicketQueueSidebar: ({ activeScope, activeInboxId }: SidebarProps) => (
+    <div data-testid="queue-sidebar" data-scope={activeScope} data-inbox={String(activeInboxId)} />
+  ),
+}))
+
+const { Route, ticketsSearchSchema } = await import('../tickets')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.pathname = '/admin/tickets'
+  mocks.search = { scope: 'my_assigned', inboxId: undefined }
+})
+
+describe('admin tickets layout route — search schema', () => {
+  it('validateSearch applies the my_assigned default scope', () => {
+    const parsed = ticketsSearchSchema.parse({})
+    expect(parsed.scope).toBe('my_assigned')
+    expect(routeOptions().validateSearch).toBe(ticketsSearchSchema)
+  })
+
+  it('accepts the full set of valid scopes/statuses/sorts', () => {
+    const parsed = ticketsSearchSchema.parse({
+      scope: 'unassigned',
+      statusCategory: 'on_hold',
+      search: 'bug',
+      inboxId: 'inbox-1',
+      sort: 'created_asc',
+    })
+    expect(parsed).toEqual({
+      scope: 'unassigned',
+      statusCategory: 'on_hold',
+      search: 'bug',
+      inboxId: 'inbox-1',
+      sort: 'created_asc',
+    })
+  })
+
+  it('rejects an unknown scope', () => {
+    expect(() => ticketsSearchSchema.parse({ scope: 'nope' })).toThrow()
+  })
+})
+
+describe('admin tickets layout route — component', () => {
+  it('renders the bare outlet on a detail/new route (isDetailOrNew branch)', () => {
+    mocks.pathname = '/admin/tickets/ticket-123'
+    renderPage()
+    expect(screen.getByTestId('outlet')).toBeInTheDocument()
+    expect(screen.queryByTestId('queue-sidebar')).not.toBeInTheDocument()
+    expect(screen.queryByTestId('link-/admin/tickets/new')).not.toBeInTheDocument()
+  })
+
+  it('renders the queue layout on the list route with default scope fallback', () => {
+    mocks.search = { scope: undefined, inboxId: undefined }
+    renderPage()
+    const sidebar = screen.getByTestId('queue-sidebar')
+    expect(sidebar).toHaveAttribute('data-scope', 'my_assigned')
+    expect(sidebar).toHaveAttribute('data-inbox', 'undefined')
+    expect(screen.getByTestId('link-/admin/tickets/new')).toBeInTheDocument()
+    expect(screen.getByTestId('plus-icon')).toBeInTheDocument()
+  })
+
+  it('forwards an explicit scope and inboxId to the sidebar', () => {
+    mocks.search = { scope: 'unassigned', inboxId: 'inbox-9' }
+    renderPage()
+    const sidebar = screen.getByTestId('queue-sidebar')
+    expect(sidebar).toHaveAttribute('data-scope', 'unassigned')
+    expect(sidebar).toHaveAttribute('data-inbox', 'inbox-9')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/tickets.index.gap.test.tsx b/apps/web/src/routes/admin/__tests__/tickets.index.gap.test.tsx
new file mode 100644
index 000000000..7860c62d4
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/tickets.index.gap.test.tsx
@@ -0,0 +1,310 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+
+type RouteOptions = {
+  loaderDeps: (input: { search: Record<string, unknown> }) => Record<string, unknown>
+  loader: (input: {
+    deps: Record<string, unknown>
+    context: { queryClient: { ensureQueryData: (query: unknown) => unknown } }
+  }) => Promise<unknown>
+  component: () => ReactElement
+  pendingComponent: () => ReactElement
+  errorComponent: () => ReactElement
+}
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+}
+
+const mocks = vi.hoisted(() => ({
+  ensureQueryData: vi.fn(async () => undefined),
+  navigate: vi.fn(),
+  search: {} as Record<string, unknown>,
+  listData: {} as { total: number; rows: unknown[] },
+  statusesData: [] as unknown[],
+  lastListParams: undefined as unknown,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({
+    options,
+    useSearch: () => mocks.search,
+    useNavigate: () => mocks.navigate,
+  }),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: (query: { queryKey: readonly unknown[] }) => ({
+    data: query.queryKey[1] === 'statuses' ? mocks.statusesData : mocks.listData,
+  }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/client/queries/tickets', () => ({
+  ticketQueries: {
+    list: (params: unknown) => {
+      mocks.lastListParams = params
+      return { queryKey: ['tickets', 'list', params] }
+    },
+    statuses: () => ({ queryKey: ['tickets', 'statuses'] }),
+  },
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: (props: Record<string, unknown>) => <input {...(props as object)} />,
+}))
+
+vi.mock('@/components/ui/skeleton', () => ({
+  Skeleton: ({ className }: { className?: string }) => (
+    <span data-testid="skeleton" className={className} />
+  ),
+}))
+
+vi.mock('@/lib/shared/utils', () => ({
+  cn: (...args: unknown[]) => args.filter(Boolean).join(' '),
+}))
+
+vi.mock('@/components/admin/tickets/ticket-queue-table', () => ({
+  TicketQueueTable: ({
+    rows,
+    statuses,
+    invalidateKey,
+  }: {
+    rows: unknown[]
+    statuses: unknown[]
+    invalidateKey: unknown
+  } & ComponentProps) => (
+    <div data-testid="queue-table">
+      <span data-testid="rows">{JSON.stringify(rows)}</span>
+      <span data-testid="statuses">{JSON.stringify(statuses)}</span>
+      <span data-testid="invalidate-key">{JSON.stringify(invalidateKey)}</span>
+    </div>
+  ),
+}))
+
+const { Route } = await import('../tickets.index')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+function seedListData(overrides: Partial<{ total: number; rows: unknown[] }> = {}) {
+  mocks.listData = {
+    total: 2,
+    rows: [
+      {
+        id: 'ticket-1',
+        subject: 'First',
+        statusId: 'status-1',
+        priority: 'high',
+        channel: 'email',
+        lastActivityAt: '2026-06-20T00:00:00.000Z',
+        assigneePrincipalId: 'principal-1',
+      },
+      {
+        id: 'ticket-2',
+        subject: 'Second',
+        statusId: 'status-2',
+        priority: 'low',
+        channel: 'web',
+        lastActivityAt: '2026-06-19T00:00:00.000Z',
+        assigneePrincipalId: null,
+      },
+    ],
+    ...overrides,
+  }
+  mocks.statusesData = [
+    { id: 'status-1', name: 'Open', category: 'open' },
+    { id: 'status-2', name: 'Closed', category: 'closed' },
+  ]
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.search = {}
+  mocks.lastListParams = undefined
+  seedListData()
+})
+
+describe('admin tickets index route — loader & deps', () => {
+  it('loaderDeps extracts search fields', () => {
+    const deps = routeOptions().loaderDeps({
+      search: {
+        scope: 'all',
+        statusCategory: 'open',
+        search: 'bug',
+        inboxId: 'inbox-1',
+        sort: 'newest',
+      },
+    })
+    expect(deps).toEqual({
+      scope: 'all',
+      statusCategory: 'open',
+      search: 'bug',
+      inboxId: 'inbox-1',
+      sort: 'newest',
+    })
+  })
+
+  it('loader prefetches list and statuses with provided deps', async () => {
+    await routeOptions().loader({
+      deps: {
+        scope: 'all',
+        statusCategory: 'open',
+        search: 'x',
+        inboxId: 'inbox-1',
+        sort: 'newest',
+      },
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(2)
+    expect(mocks.lastListParams).toEqual({
+      scope: 'all',
+      statusCategory: 'open',
+      search: 'x',
+      inboxId: 'inbox-1',
+      sort: 'newest',
+    })
+  })
+
+  it('loader applies defaults for missing scope and inboxId', async () => {
+    await routeOptions().loader({
+      deps: {},
+      context: { queryClient: { ensureQueryData: mocks.ensureQueryData } },
+    })
+    expect(mocks.lastListParams).toEqual({
+      scope: 'my_assigned',
+      statusCategory: undefined,
+      search: undefined,
+      inboxId: null,
+      sort: undefined,
+    })
+  })
+
+  it('exposes the error component', () => {
+    const ErrorComponent = routeOptions().errorComponent
+    render(<ErrorComponent />)
+    expect(screen.getByText('Failed to load tickets')).toBeInTheDocument()
+  })
+
+  it('renders the pending component skeletons', () => {
+    const Pending = routeOptions().pendingComponent
+    render(<Pending />)
+    expect(screen.getAllByTestId('skeleton')).toHaveLength(6)
+  })
+})
+
+describe('admin tickets index route — component', () => {
+  it('renders the queue table with mapped rows and statuses', () => {
+    renderPage()
+    const rows = JSON.parse(screen.getByTestId('rows').textContent ?? '[]')
+    expect(rows).toEqual([
+      {
+        id: 'ticket-1',
+        subject: 'First',
+        statusId: 'status-1',
+        priority: 'high',
+        channel: 'email',
+        lastActivityAt: '2026-06-20T00:00:00.000Z',
+        assigneePrincipalId: 'principal-1',
+      },
+      {
+        id: 'ticket-2',
+        subject: 'Second',
+        statusId: 'status-2',
+        priority: 'low',
+        channel: 'web',
+        lastActivityAt: '2026-06-19T00:00:00.000Z',
+        assigneePrincipalId: null,
+      },
+    ])
+    const statuses = JSON.parse(screen.getByTestId('statuses').textContent ?? '[]')
+    expect(statuses).toEqual([
+      { id: 'status-1', name: 'Open', category: 'open' },
+      { id: 'status-2', name: 'Closed', category: 'closed' },
+    ])
+  })
+
+  it('renders pluralized ticket count', () => {
+    renderPage()
+    expect(screen.getByText('2 tickets')).toBeInTheDocument()
+  })
+
+  it('renders singular ticket count when total is 1', () => {
+    seedListData({ total: 1, rows: [mocks.listData.rows[0]] })
+    renderPage()
+    expect(screen.getByText('1 ticket')).toBeInTheDocument()
+  })
+
+  it('initializes search input from search.search', () => {
+    mocks.search = { search: 'preset' }
+    renderPage()
+    expect(screen.getByPlaceholderText('Search subject…')).toHaveValue('preset')
+  })
+
+  it('navigates on Enter with the typed search value', () => {
+    renderPage()
+    const input = screen.getByPlaceholderText('Search subject…') as HTMLInputElement
+    fireEvent.change(input, { target: { value: 'crash' } })
+    fireEvent.keyDown(input, { key: 'Enter' })
+    expect(mocks.navigate).toHaveBeenCalledTimes(1)
+    const updater = mocks.navigate.mock.calls[0][0].search
+    expect(updater({ scope: 'all' })).toEqual({ scope: 'all', search: 'crash' })
+  })
+
+  it('navigates with undefined search when input is empty', () => {
+    renderPage()
+    const input = screen.getByPlaceholderText('Search subject…')
+    fireEvent.keyDown(input, { key: 'Enter' })
+    const updater = mocks.navigate.mock.calls[0][0].search
+    expect(updater({ scope: 'all' })).toEqual({ scope: 'all', search: undefined })
+  })
+
+  it('does not navigate on non-Enter keys', () => {
+    renderPage()
+    const input = screen.getByPlaceholderText('Search subject…')
+    fireEvent.keyDown(input, { key: 'a' })
+    expect(mocks.navigate).not.toHaveBeenCalled()
+  })
+
+  it('activates a status category filter when none is active', () => {
+    renderPage()
+    fireEvent.click(screen.getByRole('button', { name: 'open' }))
+    const updater = mocks.navigate.mock.calls[0][0].search
+    expect(updater({ scope: 'all' })).toEqual({ scope: 'all', statusCategory: 'open' })
+  })
+
+  it('clears the active status category when its button is clicked again', () => {
+    mocks.search = { statusCategory: 'pending' }
+    renderPage()
+    fireEvent.click(screen.getByRole('button', { name: 'pending' }))
+    const updater = mocks.navigate.mock.calls[0][0].search
+    expect(updater({ scope: 'all', statusCategory: 'pending' })).toEqual({
+      scope: 'all',
+      statusCategory: undefined,
+    })
+  })
+
+  it('renders the on_hold category label with a space', () => {
+    renderPage()
+    expect(screen.getByRole('button', { name: 'on hold' })).toBeInTheDocument()
+  })
+
+  it('passes the list query key as the table invalidateKey', () => {
+    renderPage()
+    const key = JSON.parse(screen.getByTestId('invalidate-key').textContent ?? '[]')
+    expect(key[0]).toBe('tickets')
+    expect(key[1]).toBe('list')
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/tickets.new.test.tsx b/apps/web/src/routes/admin/__tests__/tickets.new.test.tsx
new file mode 100644
index 000000000..bd8da9bc2
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/tickets.new.test.tsx
@@ -0,0 +1,400 @@
+// @vitest-environment happy-dom
+import type { ReactElement, ReactNode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+
+type ComponentProps = {
+  children?: ReactNode
+  className?: string
+  onClick?: () => void
+  disabled?: boolean
+}
+
+type RouteOptions = {
+  component: () => ReactElement
+}
+
+type MutationOptions<T> = {
+  mutationFn: () => Promise<T>
+  onSuccess?: (result: T) => void
+  onError?: (error: Error) => void
+}
+
+const mocks = vi.hoisted(() => ({
+  navigate: vi.fn(),
+  createTicketFn: vi.fn(async () => ({ id: 'ticket-1' })),
+  createTicketInitialThreadFn: vi.fn(async () => ({ id: 'thread-1' })),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  uploadImage: vi.fn(),
+  fetch: vi.fn(async () => ({ ok: true })),
+  consoleError: vi.fn(),
+  myPermissions: {
+    data: { principalId: 'principal-current' },
+  },
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  Link: ({ to, children }: ComponentProps & { to: string }) => <a href={to}>{children}</a>,
+  useRouter: () => ({ navigate: mocks.navigate }),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useMutation: <T,>(options: MutationOptions<T>) => ({
+    isPending: false,
+    mutate: () => {
+      void options
+        .mutationFn()
+        .then((result) => options.onSuccess?.(result))
+        .catch((error: Error) => options.onError?.(error))
+    },
+  }),
+}))
+
+vi.mock('@/components/admin/shared', () => ({
+  createRouteErrorComponent: (message: string) => () => <div>{message}</div>,
+}))
+
+vi.mock('@/lib/server/functions/tickets', () => ({
+  createTicketFn: mocks.createTicketFn,
+  createTicketInitialThreadFn: mocks.createTicketInitialThreadFn,
+}))
+
+vi.mock('@/lib/client/hooks/use-authz-queries', () => ({
+  useMyPermissions: () => mocks.myPermissions,
+}))
+
+vi.mock('@/lib/client/hooks/use-image-upload', () => ({
+  useImageUpload: () => ({ upload: mocks.uploadImage }),
+}))
+
+vi.mock('sonner', () => ({
+  toast: {
+    success: mocks.toastSuccess,
+    error: mocks.toastError,
+  },
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: ({
+    children,
+    onClick,
+    disabled,
+    type,
+    asChild,
+  }: ComponentProps & { type?: 'button' | 'submit'; asChild?: boolean }) =>
+    asChild ? (
+      <>{children}</>
+    ) : (
+      <button type={type ?? 'button'} onClick={onClick} disabled={disabled}>
+        {children}
+      </button>
+    ),
+}))
+
+vi.mock('@/components/ui/input', () => ({
+  Input: ({
+    id,
+    value,
+    onChange,
+    type,
+    multiple,
+    disabled,
+    required,
+    maxLength,
+  }: {
+    id?: string
+    value?: string
+    onChange?: (event: React.ChangeEvent<HTMLInputElement>) => void
+    type?: string
+    multiple?: boolean
+    disabled?: boolean
+    required?: boolean
+    maxLength?: number
+  }) => (
+    <input
+      id={id}
+      value={type === 'file' ? undefined : value}
+      onChange={onChange}
+      type={type}
+      multiple={multiple}
+      disabled={disabled}
+      required={required}
+      maxLength={maxLength}
+    />
+  ),
+}))
+
+vi.mock('@/components/ui/label', () => ({
+  Label: ({ children, htmlFor }: ComponentProps & { htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+}))
+
+vi.mock('@/components/ui/select', async () => {
+  const React = await import('react')
+  const SelectContext = React.createContext<{ onValueChange?: (value: string) => void }>({})
+
+  return {
+    Select: ({
+      value,
+      onValueChange,
+      children,
+    }: {
+      value?: string
+      onValueChange?: (value: string) => void
+      children?: ReactNode
+    }) => (
+      <SelectContext.Provider value={{ onValueChange }}>
+        <div data-value={value}>{children}</div>
+      </SelectContext.Provider>
+    ),
+    SelectContent: ({ children }: ComponentProps) => <div>{children}</div>,
+    SelectTrigger: ({ children }: ComponentProps) => <div>{children}</div>,
+    SelectValue: () => <span />,
+    SelectItem: ({ value, children }: ComponentProps & { value: string }) => {
+      const context = React.useContext(SelectContext)
+      return (
+        <button type="button" onClick={() => context.onValueChange?.(value)}>
+          {children}
+        </button>
+      )
+    },
+  }
+})
+
+vi.mock('@/components/ui/rich-text-editor', () => ({
+  RichTextEditor: ({
+    onChange,
+    placeholder,
+  }: {
+    onChange: (json: unknown, html: string, markdown: string) => void
+    placeholder?: string
+  }) => (
+    <div>
+      <textarea
+        aria-label="Description editor"
+        placeholder={placeholder}
+        onChange={(event) =>
+          onChange(
+            {
+              type: 'doc',
+              content: [
+                {
+                  type: 'paragraph',
+                  content: [{ type: 'text', text: event.currentTarget.value }],
+                },
+              ],
+            },
+            '',
+            event.currentTarget.value
+          )
+        }
+      />
+      <button
+        type="button"
+        onClick={() =>
+          onChange(
+            {
+              type: 'doc',
+              content: [
+                {
+                  type: 'paragraph',
+                  content: [{ type: 'text', text: 'JSON only description' }],
+                },
+              ],
+            },
+            '',
+            ''
+          )
+        }
+      >
+        Use JSON description
+      </button>
+    </div>
+  ),
+}))
+
+vi.mock('@/components/tickets/ticket-create-editor-features', () => ({
+  TICKET_CREATE_EDITOR_FEATURES: ['bold'],
+}))
+
+vi.mock('@/components/admin/shared/inbox-picker', () => ({
+  InboxPicker: ({ onValueChange }: { onValueChange: (value: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('inbox-1')}>
+      Pick inbox
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/org-picker', () => ({
+  OrgPicker: ({ onValueChange }: { onValueChange: (value: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('org-1')}>
+      Pick org
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/contact-picker', () => ({
+  ContactPicker: ({ onValueChange }: { onValueChange: (value: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('contact-1')}>
+      Pick contact
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/principal-picker', () => ({
+  PrincipalPicker: ({
+    value,
+    onValueChange,
+  }: {
+    value: string | null
+    onValueChange: (value: string | null) => void
+  }) => (
+    <button type="button" onClick={() => onValueChange(value ? null : 'principal-2')}>
+      {value ? `Assignee ${value}` : 'Unassigned'}
+    </button>
+  ),
+}))
+
+vi.mock('@/components/admin/shared/team-picker', () => ({
+  TeamPicker: ({ onValueChange }: { onValueChange: (value: string | null) => void }) => (
+    <button type="button" onClick={() => onValueChange('team-1')}>
+      Pick team
+    </button>
+  ),
+}))
+
+const { Route } = await import('../tickets.new')
+
+function routeOptions(): RouteOptions {
+  return Route.options as unknown as RouteOptions
+}
+
+function renderPage() {
+  const Component = routeOptions().component
+  return render(<Component />)
+}
+
+function submitForm() {
+  fireEvent.submit(screen.getByRole('button', { name: 'Create ticket' }).closest('form')!)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.myPermissions = { data: { principalId: 'principal-current' } }
+  vi.stubGlobal('fetch', mocks.fetch)
+  vi.spyOn(console, 'error').mockImplementation(mocks.consoleError)
+})
+
+describe('admin new ticket route', () => {
+  it('renders the ticket create form with default assignee from permissions', () => {
+    renderPage()
+
+    expect(screen.getByText('New ticket')).toBeTruthy()
+    expect(screen.getByLabelText('Subject')).toBeTruthy()
+    expect(screen.getByText('Assignee principal-current')).toBeTruthy()
+    expect(screen.getByRole('button', { name: 'Create ticket' })).toBeTruthy()
+  })
+
+  it('rejects submit without a subject before calling createTicketFn', () => {
+    renderPage()
+
+    submitForm()
+
+    expect(mocks.toastError).toHaveBeenCalledWith('Subject is required')
+    expect(mocks.createTicketFn).not.toHaveBeenCalled()
+  })
+
+  it('creates a ticket with selected metadata and falls back to plain text from JSON', async () => {
+    renderPage()
+
+    fireEvent.change(screen.getByLabelText('Subject'), { target: { value: '  Billing issue  ' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Use JSON description' }))
+    fireEvent.click(screen.getByRole('button', { name: 'high' }))
+    fireEvent.click(screen.getByRole('button', { name: 'email' }))
+    fireEvent.click(screen.getByRole('button', { name: 'private' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick inbox' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick team' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Assignee principal-current' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick org' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Pick contact' }))
+
+    submitForm()
+
+    await waitFor(() =>
+      expect(mocks.createTicketFn).toHaveBeenCalledWith({
+        data: expect.objectContaining({
+          subject: 'Billing issue',
+          descriptionText: 'JSON only description',
+          priority: 'high',
+          channel: 'email',
+          visibilityScope: 'private',
+          inboxId: 'inbox-1',
+          organizationId: 'org-1',
+          requesterContactId: 'contact-1',
+          primaryTeamId: 'team-1',
+          assigneePrincipalId: null,
+        }),
+      })
+    )
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Ticket created')
+    expect(mocks.navigate).toHaveBeenCalledWith({
+      to: '/admin/tickets/$ticketId',
+      params: { ticketId: 'ticket-1' },
+    })
+  })
+
+  it('creates an initial thread and uploads selected attachments', async () => {
+    renderPage()
+
+    fireEvent.change(screen.getByLabelText('Subject'), { target: { value: 'Attachment ticket' } })
+    fireEvent.change(screen.getByLabelText('Description editor'), {
+      target: { value: 'Attach this file' },
+    })
+    const file = new File(['hello'], 'hello.txt', { type: 'text/plain' })
+    fireEvent.change(screen.getByLabelText('Attachments (optional)'), {
+      target: { files: [file] },
+    })
+
+    expect(screen.getByText('hello.txt')).toBeTruthy()
+
+    submitForm()
+
+    await waitFor(() =>
+      expect(mocks.createTicketInitialThreadFn).toHaveBeenCalledWith({
+        data: { ticketId: 'ticket-1' },
+      })
+    )
+    expect(mocks.fetch).toHaveBeenCalledWith(
+      '/api/v1/tickets/ticket-1/threads/thread-1/attachments',
+      expect.objectContaining({ method: 'POST', body: expect.any(FormData) })
+    )
+  })
+
+  it('logs attachment upload failures without blocking ticket creation', async () => {
+    mocks.fetch.mockResolvedValueOnce({ ok: false })
+    renderPage()
+
+    fireEvent.change(screen.getByLabelText('Subject'), { target: { value: 'Upload failure' } })
+    fireEvent.change(screen.getByLabelText('Attachments (optional)'), {
+      target: { files: [new File(['bad'], 'bad.txt')] },
+    })
+
+    submitForm()
+
+    await waitFor(() => expect(mocks.consoleError).toHaveBeenCalledWith('Failed to upload bad.txt'))
+    expect(mocks.toastSuccess).toHaveBeenCalledWith('Ticket created')
+  })
+
+  it('surfaces createTicketFn errors through the mutation error handler', async () => {
+    mocks.createTicketFn.mockRejectedValueOnce(new Error('No permission'))
+    renderPage()
+
+    fireEvent.change(screen.getByLabelText('Subject'), { target: { value: 'Denied' } })
+    submitForm()
+
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith('No permission'))
+  })
+})
diff --git a/apps/web/src/routes/admin/__tests__/users.gap.test.tsx b/apps/web/src/routes/admin/__tests__/users.gap.test.tsx
new file mode 100644
index 000000000..4b4dad0fb
--- /dev/null
+++ b/apps/web/src/routes/admin/__tests__/users.gap.test.tsx
@@ -0,0 +1,184 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+type LoaderDepsFn = (input: { search: Record<string, unknown> }) => Record<string, unknown>
+type LoaderFn = (input: {
+  deps: Record<string, unknown>
+  context: {
+    principal: { role: string }
+    queryClient: { ensureQueryData: (q: unknown) => unknown }
+  }
+}) => Promise<unknown>
+
+type RouteOptions = {
+  loaderDeps: LoaderDepsFn
+  loader: LoaderFn
+}
+
+const mocks = vi.hoisted(() => ({
+  redirect: vi.fn((opts: unknown) => {
+    const err = new Error('REDIRECT') as Error & { __redirect: unknown }
+    err.__redirect = opts
+    return err
+  }),
+  ensureQueryData: vi.fn(async () => undefined),
+  portalUsers: vi.fn((p: unknown) => ({ queryKey: ['admin', 'portal-users', p] })),
+  segments: vi.fn(() => ({ queryKey: ['admin', 'segments'] })),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: unknown) => ({ options }),
+  redirect: mocks.redirect,
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useSuspenseQuery: vi.fn(() => ({ data: [] })),
+}))
+
+vi.mock('@/lib/client/queries/admin', () => ({
+  adminQueries: {
+    portalUsers: mocks.portalUsers,
+    segments: mocks.segments,
+  },
+}))
+
+vi.mock('@/components/admin/users/users-container', () => ({
+  UsersContainer: () => null,
+}))
+
+vi.mock('@/components/ui/alert', () => ({
+  Alert: ({ children }: { children?: unknown }) => children,
+  AlertDescription: ({ children }: { children?: unknown }) => children,
+  AlertTitle: ({ children }: { children?: unknown }) => children,
+}))
+
+vi.mock('@heroicons/react/24/solid', () => ({
+  ExclamationCircleIcon: () => null,
+}))
+
+vi.mock('@/components/ui/button', () => ({
+  Button: () => null,
+}))
+
+const mod = await import('../users')
+const { parseSearchToQueryParams, Route } = mod
+
+function routeOptions(): RouteOptions {
+  return (Route as unknown as { options: RouteOptions }).options
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('users.tsx parseSearchToQueryParams', () => {
+  it('maps verified=true and parses dates/segments/activity/custom attrs', () => {
+    const result = parseSearchToQueryParams({
+      search: 'jane',
+      verified: 'true',
+      dateFrom: '2024-01-01',
+      dateTo: '2024-02-01',
+      emailDomain: 'acme.com',
+      postCount: 'gt:5',
+      voteCount: 'gte:2',
+      commentCount: 'lt:9',
+      customAttrs: 'plan:eq:pro,tier:gte:3',
+      includeAnonymous: 'true',
+      sort: 'name',
+      segments: 'seg_1,seg_2',
+    } as never)
+    expect(result.verified).toBe(true)
+    expect(result.dateFrom).toBeInstanceOf(Date)
+    expect(result.dateTo).toBeInstanceOf(Date)
+    expect(result.emailDomain).toBe('acme.com')
+    expect(result.postCount).toEqual({ op: 'gt', value: 5 })
+    expect(result.voteCount).toEqual({ op: 'gte', value: 2 })
+    expect(result.commentCount).toEqual({ op: 'lt', value: 9 })
+    expect(result.customAttrs).toEqual([
+      { key: 'plan', op: 'eq', value: 'pro' },
+      { key: 'tier', op: 'gte', value: '3' },
+    ])
+    expect(result.includeAnonymous).toBe(true)
+    expect(result.segmentIds).toEqual(['seg_1', 'seg_2'])
+    expect(result.page).toBe(1)
+    expect(result.limit).toBe(20)
+  })
+
+  it('maps verified=false and leaves optional filters undefined', () => {
+    const result = parseSearchToQueryParams({ verified: 'false', sort: 'newest' } as never)
+    expect(result.verified).toBe(false)
+    expect(result.dateFrom).toBeUndefined()
+    expect(result.dateTo).toBeUndefined()
+    expect(result.postCount).toBeUndefined()
+    expect(result.customAttrs).toBeUndefined()
+    expect(result.segmentIds).toBeUndefined()
+    expect(result.includeAnonymous).toBe(false)
+  })
+
+  it('drops malformed activity and custom-attr fragments', () => {
+    const result = parseSearchToQueryParams({
+      postCount: 'noColonHere',
+      customAttrs: 'missingop,key:op:val',
+    } as never)
+    // "noColonHere".split(':') => val undefined -> undefined
+    expect(result.postCount).toBeUndefined()
+    expect(result.customAttrs).toEqual([{ key: 'key', op: 'op', value: 'val' }])
+  })
+})
+
+describe('users.tsx loaderDeps', () => {
+  it('selects the search fields including selected and invites', () => {
+    const deps = routeOptions().loaderDeps({
+      search: {
+        search: 'q',
+        verified: 'true',
+        dateFrom: 'd',
+        dateTo: 'd2',
+        emailDomain: 'e',
+        postCount: 'p',
+        voteCount: 'v',
+        commentCount: 'c',
+        customAttrs: 'ca',
+        includeAnonymous: 'true',
+        sort: 'name',
+        segments: 's',
+        selected: 'sel_1',
+        invites: 'pending',
+      },
+    })
+    expect(deps.selected).toBe('sel_1')
+    expect(deps.invites).toBe('pending')
+    expect(deps.sort).toBe('name')
+  })
+})
+
+describe('users.tsx loader', () => {
+  it('redirects to /admin/customers/people when no filters are set', async () => {
+    await expect(
+      routeOptions().loader({
+        deps: { sort: 'newest' },
+        context: {
+          principal: { role: 'admin' },
+          queryClient: { ensureQueryData: mocks.ensureQueryData },
+        },
+      })
+    ).rejects.toThrow('REDIRECT')
+    expect(mocks.redirect).toHaveBeenCalledWith({ to: '/admin/customers/people' })
+    expect(mocks.ensureQueryData).not.toHaveBeenCalled()
+  })
+
+  it('prefetches data and returns the member role when filters are present', async () => {
+    const result = await routeOptions().loader({
+      deps: { search: 'jane', sort: 'newest' },
+      context: {
+        principal: { role: 'admin' },
+        queryClient: { ensureQueryData: mocks.ensureQueryData },
+      },
+    })
+    expect(mocks.redirect).not.toHaveBeenCalled()
+    expect(mocks.portalUsers).toHaveBeenCalledTimes(1)
+    expect(mocks.segments).toHaveBeenCalledTimes(1)
+    expect(mocks.ensureQueryData).toHaveBeenCalledTimes(2)
+    expect(result).toEqual({ currentMemberRole: 'admin' })
+  })
+})
diff --git a/apps/web/src/routes/admin/contacts.index.tsx b/apps/web/src/routes/admin/contacts.index.tsx
new file mode 100644
index 000000000..e203c212b
--- /dev/null
+++ b/apps/web/src/routes/admin/contacts.index.tsx
@@ -0,0 +1,7 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+export const Route = createFileRoute('/admin/contacts/')({
+  loader: () => {
+    throw redirect({ to: '/admin/customers/organizations' })
+  },
+})
diff --git a/apps/web/src/routes/admin/contacts.organizations.tsx b/apps/web/src/routes/admin/contacts.organizations.tsx
new file mode 100644
index 000000000..259897275
--- /dev/null
+++ b/apps/web/src/routes/admin/contacts.organizations.tsx
@@ -0,0 +1,7 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+export const Route = createFileRoute('/admin/contacts/organizations')({
+  loader: () => {
+    throw redirect({ to: '/admin/customers/organizations' })
+  },
+})
diff --git a/apps/web/src/routes/admin/contacts.organizations_.$organizationId.tsx b/apps/web/src/routes/admin/contacts.organizations_.$organizationId.tsx
new file mode 100644
index 000000000..1ffb27842
--- /dev/null
+++ b/apps/web/src/routes/admin/contacts.organizations_.$organizationId.tsx
@@ -0,0 +1,91 @@
+/**
+ * Organization detail — Tabs shell with Overview / Contacts / Tickets.
+ */
+import { Suspense } from 'react'
+import { createFileRoute, Link, notFound } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { OrganizationId } from '@quackback/ids'
+import { organizationQueries } from '@/lib/client/queries/organizations'
+import { contactQueries } from '@/lib/client/queries/contacts'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { ArrowLeftIcon } from '@heroicons/react/24/outline'
+import { OrganizationOverviewTab } from '@/components/admin/contacts/organization-overview-tab'
+import { OrganizationContactsTab } from '@/components/admin/contacts/organization-contacts-tab'
+import { OrganizationTicketsTab } from '@/components/admin/contacts/organization-tickets-tab'
+
+export const Route = createFileRoute('/admin/contacts/organizations_/$organizationId')({
+  loader: async ({ params, context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    const organizationId = params.organizationId as OrganizationId
+    const [detail] = await Promise.all([
+      queryClient.ensureQueryData(organizationQueries.detail(organizationId)),
+      queryClient.ensureQueryData(contactQueries.byOrg(organizationId, {})),
+    ])
+    if (!detail) throw notFound()
+  },
+  errorComponent: createRouteErrorComponent('Failed to load organization'),
+  component: OrganizationDetailPage,
+})
+
+function OrganizationDetailPage() {
+  const { organizationId: rawId } = Route.useParams()
+  const organizationId = rawId as OrganizationId
+  const { data: org } = useSuspenseQuery(organizationQueries.detail(organizationId))
+
+  if (!org) return null
+
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center gap-3">
+        <Button asChild variant="ghost" size="sm">
+          <Link to="/admin/contacts/organizations">
+            <ArrowLeftIcon className="h-4 w-4 mr-1" />
+            Organizations
+          </Link>
+        </Button>
+        <div className="flex-1">
+          <div className="flex items-center gap-2">
+            <h1 className="text-lg font-semibold">{org.name}</h1>
+            {org.domain && (
+              <span className="font-mono text-xs text-muted-foreground">{org.domain}</span>
+            )}
+            {org.archivedAt ? (
+              <Badge variant="outline" className="text-muted-foreground">
+                Archived
+              </Badge>
+            ) : (
+              <Badge variant="outline">Active</Badge>
+            )}
+          </div>
+        </div>
+      </div>
+
+      <Tabs defaultValue="overview">
+        <TabsList>
+          <TabsTrigger value="overview">Overview</TabsTrigger>
+          <TabsTrigger value="contacts">Contacts</TabsTrigger>
+          <TabsTrigger value="tickets">Tickets</TabsTrigger>
+        </TabsList>
+        <TabsContent value="overview" className="pt-4">
+          <OrganizationOverviewTab organization={org} />
+        </TabsContent>
+        <TabsContent value="contacts" className="pt-4">
+          <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+            <OrganizationContactsTab organizationId={organizationId} />
+          </Suspense>
+        </TabsContent>
+        <TabsContent value="tickets" className="pt-4">
+          <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+            <OrganizationTicketsTab organizationId={organizationId} />
+          </Suspense>
+        </TabsContent>
+      </Tabs>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/contacts.people.tsx b/apps/web/src/routes/admin/contacts.people.tsx
new file mode 100644
index 000000000..5cb3d4c51
--- /dev/null
+++ b/apps/web/src/routes/admin/contacts.people.tsx
@@ -0,0 +1,7 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+export const Route = createFileRoute('/admin/contacts/people')({
+  loader: () => {
+    throw redirect({ to: '/admin/customers/people' })
+  },
+})
diff --git a/apps/web/src/routes/admin/contacts.people_.$contactId.tsx b/apps/web/src/routes/admin/contacts.people_.$contactId.tsx
new file mode 100644
index 000000000..758a4bf4a
--- /dev/null
+++ b/apps/web/src/routes/admin/contacts.people_.$contactId.tsx
@@ -0,0 +1,92 @@
+/**
+ * Contact detail — Tabs shell with Overview / Linked users / Tickets.
+ */
+import { Suspense } from 'react'
+import { createFileRoute, Link, notFound } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { ContactId } from '@quackback/ids'
+import { contactQueries } from '@/lib/client/queries/contacts'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { ArrowLeftIcon } from '@heroicons/react/24/outline'
+import { ContactOverviewTab } from '@/components/admin/contacts/contact-overview-tab'
+import { ContactLinkedUsersTab } from '@/components/admin/contacts/contact-linked-users-tab'
+import { ContactTicketsTab } from '@/components/admin/contacts/contact-tickets-tab'
+
+export const Route = createFileRoute('/admin/contacts/people_/$contactId')({
+  loader: async ({ params, context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    const contactId = params.contactId as ContactId
+    const [detail] = await Promise.all([
+      queryClient.ensureQueryData(contactQueries.detail(contactId)),
+      queryClient.ensureQueryData(contactQueries.links(contactId)),
+    ])
+    if (!detail) throw notFound()
+  },
+  errorComponent: createRouteErrorComponent('Failed to load contact'),
+  component: ContactDetailPage,
+})
+
+function ContactDetailPage() {
+  const { contactId: rawId } = Route.useParams()
+  const contactId = rawId as ContactId
+  const { data: contact } = useSuspenseQuery(contactQueries.detail(contactId))
+
+  if (!contact) return null
+
+  const display = contact.name ?? contact.email ?? contact.id
+
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center gap-3">
+        <Button asChild variant="ghost" size="sm">
+          <Link to="/admin/contacts/people">
+            <ArrowLeftIcon className="h-4 w-4 mr-1" />
+            People
+          </Link>
+        </Button>
+        <div className="flex-1">
+          <div className="flex items-center gap-2">
+            <h1 className="text-lg font-semibold">{display}</h1>
+            {contact.email && (
+              <span className="text-xs text-muted-foreground">{contact.email}</span>
+            )}
+            {contact.archivedAt ? (
+              <Badge variant="outline" className="text-muted-foreground">
+                Archived
+              </Badge>
+            ) : (
+              <Badge variant="outline">Active</Badge>
+            )}
+          </div>
+        </div>
+      </div>
+
+      <Tabs defaultValue="overview">
+        <TabsList>
+          <TabsTrigger value="overview">Overview</TabsTrigger>
+          <TabsTrigger value="linked-users">Linked users</TabsTrigger>
+          <TabsTrigger value="tickets">Tickets</TabsTrigger>
+        </TabsList>
+        <TabsContent value="overview" className="pt-4">
+          <ContactOverviewTab contact={contact} />
+        </TabsContent>
+        <TabsContent value="linked-users" className="pt-4">
+          <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+            <ContactLinkedUsersTab contactId={contactId} />
+          </Suspense>
+        </TabsContent>
+        <TabsContent value="tickets" className="pt-4">
+          <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+            <ContactTicketsTab contactId={contactId} />
+          </Suspense>
+        </TabsContent>
+      </Tabs>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/contacts.tsx b/apps/web/src/routes/admin/contacts.tsx
new file mode 100644
index 000000000..a7c5b593b
--- /dev/null
+++ b/apps/web/src/routes/admin/contacts.tsx
@@ -0,0 +1,55 @@
+/**
+ * Legacy contacts detail shell. List routes redirect to Customers; detail
+ * routes still render here until they move to canonical Customers paths.
+ */
+import { createFileRoute, Link, Outlet, useRouterState } from '@tanstack/react-router'
+import { cn } from '@/lib/shared/utils'
+
+export const Route = createFileRoute('/admin/contacts')({
+  component: ContactsLayout,
+})
+
+function ContactsLayout() {
+  const pathname = useRouterState({ select: (s) => s.location.pathname })
+
+  const tabs: { label: string; to: string }[] = [
+    { label: 'People', to: '/admin/customers/people' },
+    { label: 'Organizations', to: '/admin/customers/organizations' },
+  ]
+
+  return (
+    <div className="space-y-4">
+      <div>
+        <h1 className="text-lg font-semibold">Customers</h1>
+        <p className="text-sm text-muted-foreground">People, organizations, and segments.</p>
+      </div>
+
+      <div className="flex items-center gap-1 border-b border-border/60">
+        {tabs.map((t) => {
+          const active =
+            pathname === t.to ||
+            pathname.startsWith(t.to + '/') ||
+            (t.to === '/admin/customers/people' && pathname.startsWith('/admin/contacts/people')) ||
+            (t.to === '/admin/customers/organizations' &&
+              pathname.startsWith('/admin/contacts/organizations'))
+          return (
+            <Link
+              key={t.to}
+              to={t.to}
+              className={cn(
+                'px-3 py-2 text-sm border-b-2 -mb-px transition-colors',
+                active
+                  ? 'border-primary text-foreground'
+                  : 'border-transparent text-muted-foreground hover:text-foreground'
+              )}
+            >
+              {t.label}
+            </Link>
+          )
+        })}
+      </div>
+
+      <Outlet />
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/customers.index.tsx b/apps/web/src/routes/admin/customers.index.tsx
new file mode 100644
index 000000000..f42e3c9d6
--- /dev/null
+++ b/apps/web/src/routes/admin/customers.index.tsx
@@ -0,0 +1,7 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+export const Route = createFileRoute('/admin/customers/')({
+  loader: () => {
+    throw redirect({ to: '/admin/customers/people' })
+  },
+})
diff --git a/apps/web/src/routes/admin/customers.organizations.tsx b/apps/web/src/routes/admin/customers.organizations.tsx
new file mode 100644
index 000000000..0e5fa8622
--- /dev/null
+++ b/apps/web/src/routes/admin/customers.organizations.tsx
@@ -0,0 +1,69 @@
+import { Suspense, useState } from 'react'
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { organizationQueries } from '@/lib/client/queries/organizations'
+import { OrganizationList } from '@/components/admin/contacts/organization-list'
+import { OrganizationCreateDialog } from '@/components/admin/contacts/organization-create-dialog'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Skeleton } from '@/components/ui/skeleton'
+import { Switch } from '@/components/ui/switch'
+import { PlusIcon } from '@heroicons/react/24/solid'
+
+export const Route = createFileRoute('/admin/customers/organizations')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await queryClient.ensureQueryData(organizationQueries.list({ includeArchived: true }))
+  },
+  errorComponent: createRouteErrorComponent('Failed to load organizations'),
+  component: CustomerOrganizationsPage,
+})
+
+function CustomerOrganizationsPage() {
+  const [search, setSearch] = useState('')
+  const [showArchived, setShowArchived] = useState(false)
+
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center justify-between gap-3">
+        <Input
+          placeholder="Search organizations..."
+          value={search}
+          onChange={(event) => setSearch(event.target.value)}
+          className="max-w-sm"
+        />
+        <div className="flex items-center gap-3">
+          <div className="flex items-center gap-2">
+            <Switch
+              id="customer-orgs-show-archived"
+              checked={showArchived}
+              onCheckedChange={setShowArchived}
+            />
+            <Label htmlFor="customer-orgs-show-archived" className="text-xs font-normal">
+              Show archived
+            </Label>
+          </div>
+          <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+            <OrganizationCreateDialog
+              trigger={
+                <Button size="sm">
+                  <PlusIcon className="mr-1 h-4 w-4" />
+                  New organization
+                </Button>
+              }
+            />
+          </PermissionGate>
+        </div>
+      </div>
+
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <OrganizationList search={search} showArchived={showArchived} />
+      </Suspense>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/customers.people.tsx b/apps/web/src/routes/admin/customers.people.tsx
new file mode 100644
index 000000000..e1fa9893a
--- /dev/null
+++ b/apps/web/src/routes/admin/customers.people.tsx
@@ -0,0 +1,71 @@
+import { Suspense, useState } from 'react'
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { adminQueries } from '@/lib/client/queries/admin'
+import { CustomerPeopleTable } from '@/components/admin/customers/customer-people-table'
+import { ContactCreateDialog } from '@/components/admin/contacts/contact-create-dialog'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Skeleton } from '@/components/ui/skeleton'
+import { Switch } from '@/components/ui/switch'
+import { PlusIcon } from '@heroicons/react/24/solid'
+
+export const Route = createFileRoute('/admin/customers/people')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await queryClient.ensureQueryData(
+      adminQueries.customerPeople({ includeArchived: false, limit: 100 })
+    )
+  },
+  errorComponent: createRouteErrorComponent('Failed to load people'),
+  component: CustomerPeoplePage,
+})
+
+function CustomerPeoplePage() {
+  const [search, setSearch] = useState('')
+  const [showArchived, setShowArchived] = useState(false)
+
+  return (
+    <div className="space-y-4 max-w-6xl">
+      <div className="flex items-center justify-between gap-3">
+        <Input
+          placeholder="Search people..."
+          value={search}
+          onChange={(event) => setSearch(event.target.value)}
+          className="max-w-sm"
+        />
+        <div className="flex items-center gap-3">
+          <div className="flex items-center gap-2">
+            <Switch
+              id="customers-show-archived"
+              checked={showArchived}
+              onCheckedChange={setShowArchived}
+            />
+            <Label htmlFor="customers-show-archived" className="text-xs font-normal">
+              Show archived
+            </Label>
+          </div>
+          <PermissionGate permission={PERMISSIONS.ORG_MANAGE}>
+            <ContactCreateDialog
+              trigger={
+                <Button size="sm">
+                  <PlusIcon className="mr-1 h-4 w-4" />
+                  New contact
+                </Button>
+              }
+            />
+          </PermissionGate>
+        </div>
+      </div>
+
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <CustomerPeopleTable search={search} showArchived={showArchived} />
+      </Suspense>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/customers.segments.tsx b/apps/web/src/routes/admin/customers.segments.tsx
new file mode 100644
index 000000000..10c21b5fb
--- /dev/null
+++ b/apps/web/src/routes/admin/customers.segments.tsx
@@ -0,0 +1,30 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { adminQueries } from '@/lib/client/queries/admin'
+import { UserAttributesList } from '@/components/admin/settings/user-attributes/user-attributes-list'
+import { SegmentList } from '@/components/admin/segments/segment-list'
+
+export const Route = createFileRoute('/admin/customers/segments')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await Promise.all([
+      queryClient.ensureQueryData(adminQueries.userAttributes()),
+      queryClient.ensureQueryData(adminQueries.segments()),
+    ])
+    return {}
+  },
+  component: CustomerSegmentsPage,
+})
+
+function CustomerSegmentsPage() {
+  const attrsQuery = useSuspenseQuery(adminQueries.userAttributes())
+
+  return (
+    <div className="space-y-6 max-w-5xl">
+      <UserAttributesList initialAttributes={attrsQuery.data} />
+      <SegmentList />
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/customers.tsx b/apps/web/src/routes/admin/customers.tsx
new file mode 100644
index 000000000..18e78c2fe
--- /dev/null
+++ b/apps/web/src/routes/admin/customers.tsx
@@ -0,0 +1,46 @@
+import { createFileRoute, Link, Outlet, useRouterState } from '@tanstack/react-router'
+import { cn } from '@/lib/shared/utils'
+
+export const Route = createFileRoute('/admin/customers')({
+  component: CustomersLayout,
+})
+
+function CustomersLayout() {
+  const pathname = useRouterState({ select: (s) => s.location.pathname })
+  const tabs: { label: string; to: string }[] = [
+    { label: 'People', to: '/admin/customers/people' },
+    { label: 'Organizations', to: '/admin/customers/organizations' },
+    { label: 'Segments', to: '/admin/customers/segments' },
+  ]
+
+  return (
+    <div className="space-y-4">
+      <div>
+        <h1 className="text-lg font-semibold">Customers</h1>
+        <p className="text-sm text-muted-foreground">People, organizations, and segments.</p>
+      </div>
+
+      <div className="flex items-center gap-1 border-b border-border/60">
+        {tabs.map((tab) => {
+          const active = pathname === tab.to || pathname.startsWith(tab.to + '/')
+          return (
+            <Link
+              key={tab.to}
+              to={tab.to}
+              className={cn(
+                'px-3 py-2 text-sm border-b-2 -mb-px transition-colors',
+                active
+                  ? 'border-primary text-foreground'
+                  : 'border-transparent text-muted-foreground hover:text-foreground'
+              )}
+            >
+              {tab.label}
+            </Link>
+          )
+        })}
+      </div>
+
+      <Outlet />
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/notifications.tsx b/apps/web/src/routes/admin/notifications.tsx
index 8d9e0a481..ee4b39133 100644
--- a/apps/web/src/routes/admin/notifications.tsx
+++ b/apps/web/src/routes/admin/notifications.tsx
@@ -5,7 +5,9 @@ import { EmptyState } from '@/components/shared/empty-state'
 import { Spinner } from '@/components/shared/spinner'
 import { Button } from '@/components/ui/button'
 import { ScrollArea } from '@/components/ui/scroll-area'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
 import { NotificationItem } from '@/components/notifications/notification-item'
+import { MyTicketSubscriptionsPanel } from '@/components/admin/notifications/my-ticket-subscriptions-panel'
 import { useNotifications } from '@/lib/client/hooks/use-notifications-queries'
 import { useMarkNotificationAsRead, useMarkAllNotificationsAsRead } from '@/lib/client/mutations'
 
@@ -53,32 +55,42 @@ function NotificationsPage() {
         )}
       </div>
 
-      {/* Content */}
-      {isLoading ? (
-        <div className="flex items-center justify-center py-24">
-          <Spinner size="xl" />
-        </div>
-      ) : notifications.length > 0 ? (
-        <ScrollArea className="flex-1">
-          <div className="divide-y divide-border/50">
-            {notifications.map((notification) => (
-              <NotificationItem
-                key={notification.id}
-                notification={notification}
-                onMarkAsRead={(id) => markAsRead.mutate(id)}
-                variant="full"
-              />
-            ))}
-          </div>
-        </ScrollArea>
-      ) : (
-        <EmptyState
-          icon={InboxIcon}
-          title="No notifications yet"
-          description="You'll see notifications here when there are status changes or new comments on posts you're subscribed to."
-          className="py-24"
-        />
-      )}
+      <Tabs defaultValue="all" className="flex-1 flex flex-col">
+        <TabsList className="mx-6 mt-3 self-start">
+          <TabsTrigger value="all">All notifications</TabsTrigger>
+          <TabsTrigger value="ticket-subscriptions">Ticket subscriptions</TabsTrigger>
+        </TabsList>
+        <TabsContent value="all" className="flex-1 mt-0">
+          {isLoading ? (
+            <div className="flex items-center justify-center py-24">
+              <Spinner size="xl" />
+            </div>
+          ) : notifications.length > 0 ? (
+            <ScrollArea className="flex-1">
+              <div className="divide-y divide-border/50">
+                {notifications.map((notification) => (
+                  <NotificationItem
+                    key={notification.id}
+                    notification={notification}
+                    onMarkAsRead={(id) => markAsRead.mutate(id)}
+                    variant="full"
+                  />
+                ))}
+              </div>
+            </ScrollArea>
+          ) : (
+            <EmptyState
+              icon={InboxIcon}
+              title="No notifications yet"
+              description="You'll see notifications here when there are status changes or new comments on posts you're subscribed to."
+              className="py-24"
+            />
+          )}
+        </TabsContent>
+        <TabsContent value="ticket-subscriptions" className="flex-1 mt-0">
+          <MyTicketSubscriptionsPanel />
+        </TabsContent>
+      </Tabs>
     </div>
   )
 }
diff --git a/apps/web/src/routes/admin/settings.audit.tsx b/apps/web/src/routes/admin/settings.audit.tsx
new file mode 100644
index 000000000..dae607ffe
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.audit.tsx
@@ -0,0 +1,47 @@
+/**
+ * Audit log admin — read-only paginated timeline. Gated server-side by
+ * `AUDIT_VIEW`; server fns return 403 for unauthorized actors.
+ */
+import { useState, Suspense } from 'react'
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { Skeleton } from '@/components/ui/skeleton'
+import { auditQueries, defaultAuditFilters, type AuditFilters } from '@/lib/client/queries/audit'
+import { AuditFilterBar } from '@/components/admin/settings/audit/audit-filter-bar'
+import { AuditEventTable } from '@/components/admin/settings/audit/audit-event-table'
+
+export const Route = createFileRoute('/admin/settings/audit')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    const filters = defaultAuditFilters()
+    await Promise.all([
+      queryClient.ensureInfiniteQueryData(auditQueries.list(filters)),
+      queryClient.ensureQueryData(auditQueries.actions()),
+    ])
+  },
+  errorComponent: createRouteErrorComponent('Failed to load audit log'),
+  component: AuditPage,
+})
+
+function AuditPage() {
+  const [filters, setFilters] = useState<AuditFilters>(() => defaultAuditFilters())
+
+  return (
+    <div className="space-y-4 max-w-7xl">
+      <div>
+        <h1 className="text-lg font-semibold">Audit log</h1>
+        <p className="text-xs text-muted-foreground">
+          Workspace-wide append-only record of operational, security, and admin-relevant events.
+        </p>
+      </div>
+
+      <AuditFilterBar value={filters} onChange={setFilters} />
+
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <AuditEventTable filters={filters} />
+      </Suspense>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/settings.business-hours.tsx b/apps/web/src/routes/admin/settings.business-hours.tsx
new file mode 100644
index 000000000..4d5bde56a
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.business-hours.tsx
@@ -0,0 +1,54 @@
+/**
+ * Business hours admin route. Lists calendars and opens the create/edit
+ * dialog. Used as the `businessHoursId` reference on SLA policies.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { Suspense, useState } from 'react'
+import { businessHoursQueries } from '@/lib/client/queries/business-hours'
+import { BusinessHoursList } from '@/components/admin/settings/sla/business-hours-list'
+import { BusinessHoursDialog } from '@/components/admin/settings/sla/business-hours-dialog'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { PlusIcon } from '@heroicons/react/24/solid'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export const Route = createFileRoute('/admin/settings/business-hours')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await queryClient.ensureQueryData(businessHoursQueries.list({ includeArchived: true }))
+  },
+  errorComponent: createRouteErrorComponent('Failed to load business hours'),
+  component: BusinessHoursPage,
+})
+
+function BusinessHoursPage() {
+  const [createOpen, setCreateOpen] = useState(false)
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center justify-between">
+        <div>
+          <h1 className="text-lg font-semibold">Business hours</h1>
+          <p className="text-sm text-muted-foreground">
+            Calendars define working hours and holidays. Used by SLA policies to compute due times.
+          </p>
+        </div>
+        <PermissionGate permission={PERMISSIONS.BUSINESS_HOURS_MANAGE}>
+          <Button size="sm" onClick={() => setCreateOpen(true)}>
+            <PlusIcon className="h-4 w-4 mr-1" />
+            New calendar
+          </Button>
+        </PermissionGate>
+      </div>
+
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <BusinessHoursList />
+      </Suspense>
+
+      <BusinessHoursDialog open={createOpen} onOpenChange={setCreateOpen} />
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/settings.inboxes.tsx b/apps/web/src/routes/admin/settings.inboxes.tsx
new file mode 100644
index 000000000..607ec2209
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.inboxes.tsx
@@ -0,0 +1,51 @@
+/**
+ * Inbox-list settings route. Pre-fetches inboxes (including archived) and
+ * renders `<InboxList />` plus a "New inbox" trigger.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { Suspense } from 'react'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import { InboxList } from '@/components/admin/settings/inboxes/inbox-list'
+import { InboxCreateDialog } from '@/components/admin/settings/inboxes/inbox-create-dialog'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { PlusIcon } from '@heroicons/react/24/solid'
+
+export const Route = createFileRoute('/admin/settings/inboxes')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await queryClient.ensureQueryData(inboxQueries.list({ includeArchived: true }))
+  },
+  errorComponent: createRouteErrorComponent('Failed to load inboxes'),
+  component: InboxesSettingsPage,
+})
+
+function InboxesSettingsPage() {
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center justify-between">
+        <div>
+          <h1 className="text-lg font-semibold">Inboxes</h1>
+          <p className="text-sm text-muted-foreground">
+            Named queues with channels, members, and routing defaults.
+          </p>
+        </div>
+        <InboxCreateDialog
+          trigger={
+            <Button size="sm">
+              <PlusIcon className="h-4 w-4 mr-1" />
+              New inbox
+            </Button>
+          }
+        />
+      </div>
+
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <InboxList />
+      </Suspense>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/settings.inboxes_.$inboxId.tsx b/apps/web/src/routes/admin/settings.inboxes_.$inboxId.tsx
new file mode 100644
index 000000000..e450199b4
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.inboxes_.$inboxId.tsx
@@ -0,0 +1,94 @@
+/**
+ * Inbox detail route. Pre-fetches detail/channels/memberships in parallel,
+ * shows a header with name + slug + active/archived chip, and a tabbed body
+ * (Overview / Channels / Members).
+ */
+import { Suspense } from 'react'
+import { createFileRoute, Link, notFound } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { InboxId } from '@quackback/ids'
+import { inboxQueries } from '@/lib/client/queries/inboxes'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { ArrowLeftIcon } from '@heroicons/react/24/outline'
+import { InboxOverviewTab } from '@/components/admin/settings/inboxes/inbox-overview-tab'
+import { InboxChannelsTab } from '@/components/admin/settings/inboxes/inbox-channels-tab'
+import { InboxMembersTab } from '@/components/admin/settings/inboxes/inbox-members-tab'
+
+export const Route = createFileRoute('/admin/settings/inboxes_/$inboxId')({
+  loader: async ({ params, context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    const inboxId = params.inboxId as InboxId
+    const [detail] = await Promise.all([
+      queryClient.ensureQueryData(inboxQueries.detail(inboxId)),
+      queryClient.ensureQueryData(inboxQueries.channels(inboxId)),
+      queryClient.ensureQueryData(inboxQueries.memberships(inboxId)),
+    ])
+    if (!detail) throw notFound()
+  },
+  errorComponent: createRouteErrorComponent('Failed to load inbox'),
+  component: InboxDetailPage,
+})
+
+function InboxDetailPage() {
+  const { inboxId: rawId } = Route.useParams()
+  const inboxId = rawId as InboxId
+  const { data: inbox } = useSuspenseQuery(inboxQueries.detail(inboxId))
+
+  if (!inbox) return null
+
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center gap-3">
+        <Button asChild variant="ghost" size="sm">
+          <Link to="/admin/settings/inboxes">
+            <ArrowLeftIcon className="h-4 w-4 mr-1" />
+            Inboxes
+          </Link>
+        </Button>
+        <div className="flex-1">
+          <div className="flex items-center gap-2">
+            <h1 className="text-lg font-semibold">{inbox.name}</h1>
+            <span className="font-mono text-xs text-muted-foreground">{inbox.slug}</span>
+            {inbox.archivedAt ? (
+              <Badge variant="outline" className="text-muted-foreground">
+                Archived
+              </Badge>
+            ) : (
+              <Badge variant="outline">Active</Badge>
+            )}
+          </div>
+          {inbox.description && (
+            <p className="text-xs text-muted-foreground mt-0.5">{inbox.description}</p>
+          )}
+        </div>
+      </div>
+
+      <Tabs defaultValue="overview">
+        <TabsList>
+          <TabsTrigger value="overview">Overview</TabsTrigger>
+          <TabsTrigger value="channels">Channels</TabsTrigger>
+          <TabsTrigger value="members">Members</TabsTrigger>
+        </TabsList>
+        <TabsContent value="overview" className="pt-4">
+          <InboxOverviewTab inbox={inbox} />
+        </TabsContent>
+        <TabsContent value="channels" className="pt-4">
+          <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+            <InboxChannelsTab inboxId={inboxId} />
+          </Suspense>
+        </TabsContent>
+        <TabsContent value="members" className="pt-4">
+          <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+            <InboxMembersTab inboxId={inboxId} />
+          </Suspense>
+        </TabsContent>
+      </Tabs>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/settings.people.tsx b/apps/web/src/routes/admin/settings.people.tsx
index cf0726d4c..7756c86e4 100644
--- a/apps/web/src/routes/admin/settings.people.tsx
+++ b/apps/web/src/routes/admin/settings.people.tsx
@@ -1,43 +1,7 @@
-import { createFileRoute } from '@tanstack/react-router'
-import { useSuspenseQuery } from '@tanstack/react-query'
-import { adminQueries } from '@/lib/client/queries/admin'
-import { UserGroupIcon } from '@heroicons/react/24/solid'
-import { BackLink } from '@/components/ui/back-link'
-import { PageHeader } from '@/components/shared/page-header'
-import { UserAttributesList } from '@/components/admin/settings/user-attributes/user-attributes-list'
-import { SegmentList } from '@/components/admin/segments/segment-list'
+import { createFileRoute, redirect } from '@tanstack/react-router'
 
 export const Route = createFileRoute('/admin/settings/people')({
-  loader: async ({ context }) => {
-    const { queryClient } = context
-    await Promise.all([
-      queryClient.ensureQueryData(adminQueries.userAttributes()),
-      queryClient.ensureQueryData(adminQueries.segments()),
-    ])
-    return {}
+  loader: () => {
+    throw redirect({ to: '/admin/customers/segments' })
   },
-  component: PeoplePage,
 })
-
-function PeoplePage() {
-  const attrsQuery = useSuspenseQuery(adminQueries.userAttributes())
-
-  return (
-    <div className="space-y-6 max-w-5xl">
-      <div className="lg:hidden">
-        <BackLink to="/admin/settings">Settings</BackLink>
-      </div>
-      <PageHeader
-        icon={UserGroupIcon}
-        title="People"
-        description="Custom attributes and segments for the people who use your portal."
-      />
-
-      {/* Both lists render their own SettingsCard internally so the
-       *  header actions (New attribute / New segment / Re-evaluate)
-       *  live in the card header next to the title. */}
-      <UserAttributesList initialAttributes={attrsQuery.data} />
-      <SegmentList />
-    </div>
-  )
-}
diff --git a/apps/web/src/routes/admin/settings.roles.tsx b/apps/web/src/routes/admin/settings.roles.tsx
new file mode 100644
index 000000000..790f6447b
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.roles.tsx
@@ -0,0 +1,49 @@
+/**
+ * Roles & permissions admin route.
+ * Gated server-side by `requireAuth({ roles: ['admin'] })`.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { Suspense } from 'react'
+import { listRolesFn } from '@/lib/server/functions/roles'
+import { RolesSettings } from '@/components/admin/settings/roles/roles-settings'
+import { Skeleton } from '@/components/ui/skeleton'
+
+const rolesListQuery = () => ({
+  queryKey: ['admin', 'roles', 'list'] as const,
+  queryFn: () => listRolesFn(),
+})
+
+export const Route = createFileRoute('/admin/settings/roles')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await queryClient.ensureQueryData(rolesListQuery())
+  },
+  errorComponent: createRouteErrorComponent('Failed to load roles'),
+  component: RolesPage,
+})
+
+function RolesPage() {
+  return (
+    <div className="space-y-4 max-w-6xl">
+      <div>
+        <h1 className="text-lg font-semibold">Roles &amp; permissions</h1>
+        <p className="text-xs text-muted-foreground">
+          Manage role bundles and the permissions they grant. System roles (lock icon) are seeded by
+          the platform and cannot be edited.
+        </p>
+      </div>
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <RolesSettingsLoader />
+      </Suspense>
+    </div>
+  )
+}
+
+function RolesSettingsLoader() {
+  const { data } = useSuspenseQuery(rolesListQuery())
+  return <RolesSettings roles={data} />
+}
diff --git a/apps/web/src/routes/admin/settings.routing-rules.tsx b/apps/web/src/routes/admin/settings.routing-rules.tsx
new file mode 100644
index 000000000..54314affe
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.routing-rules.tsx
@@ -0,0 +1,99 @@
+/**
+ * Routing rules admin — list page with drag-reorder, inline enable toggle,
+ * and a Sheet drawer for create/edit.
+ */
+import { Suspense, useState } from 'react'
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import type { InboxId } from '@quackback/ids'
+import { routingRuleQueries } from '@/lib/client/queries/routing-rules'
+import { Button } from '@/components/ui/button'
+import { PlusIcon } from '@heroicons/react/24/outline'
+import { InboxPicker } from '@/components/admin/shared/inbox-picker'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { RoutingRuleList } from '@/components/admin/settings/routing/routing-rule-list'
+import { RoutingRuleEditorSheet } from '@/components/admin/settings/routing/routing-rule-editor-sheet'
+import { Skeleton } from '@/components/ui/skeleton'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+
+export const Route = createFileRoute('/admin/settings/routing-rules')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await queryClient.ensureQueryData(routingRuleQueries.list({}))
+  },
+  errorComponent: createRouteErrorComponent('Failed to load routing rules'),
+  component: RoutingRulesPage,
+})
+
+type ScopeMode = 'all' | 'workspace' | 'inbox'
+
+function RoutingRulesPage() {
+  const [scopeMode, setScopeMode] = useState<ScopeMode>('all')
+  const [inboxScope, setInboxScope] = useState<InboxId | null>(null)
+  const [createOpen, setCreateOpen] = useState(false)
+
+  const inboxIdScope =
+    scopeMode === 'workspace'
+      ? ('workspace' as const)
+      : scopeMode === 'inbox' && inboxScope
+        ? inboxScope
+        : undefined
+
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-start justify-between gap-4">
+        <div>
+          <h1 className="text-lg font-semibold">Routing rules</h1>
+          <p className="text-xs text-muted-foreground">
+            Evaluated first-match-wins on incoming tickets, ordered by priority.
+          </p>
+        </div>
+        <PermissionGate permission={PERMISSIONS.ROUTING_RULE_MANAGE}>
+          <Button size="sm" onClick={() => setCreateOpen(true)}>
+            <PlusIcon className="h-4 w-4 mr-1" />
+            New rule
+          </Button>
+        </PermissionGate>
+      </div>
+
+      <div className="flex items-center gap-2">
+        <span className="text-xs font-medium text-muted-foreground">Scope:</span>
+        <Select value={scopeMode} onValueChange={(v) => setScopeMode(v as ScopeMode)}>
+          <SelectTrigger className="h-8 w-40 text-xs">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="all">All</SelectItem>
+            <SelectItem value="workspace">Workspace-wide</SelectItem>
+            <SelectItem value="inbox">Specific inbox…</SelectItem>
+          </SelectContent>
+        </Select>
+        {scopeMode === 'inbox' && (
+          <div className="w-64">
+            <InboxPicker
+              value={inboxScope}
+              onValueChange={setInboxScope}
+              allowClear
+              placeholder="Pick inbox…"
+            />
+          </div>
+        )}
+      </div>
+
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <RoutingRuleList inboxIdScope={inboxIdScope} />
+      </Suspense>
+
+      <RoutingRuleEditorSheet open={createOpen} onOpenChange={setCreateOpen} />
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/settings.security.audit-log.tsx b/apps/web/src/routes/admin/settings.security.audit-log.tsx
index aa211cc9b..d2b0a37e9 100644
--- a/apps/web/src/routes/admin/settings.security.audit-log.tsx
+++ b/apps/web/src/routes/admin/settings.security.audit-log.tsx
@@ -1,43 +1,7 @@
-import { createFileRoute } from '@tanstack/react-router'
-import { ShieldCheckIcon } from '@heroicons/react/24/solid'
-import { BackLink } from '@/components/ui/back-link'
-import { PageHeader } from '@/components/shared/page-header'
-import { adminQueries } from '@/lib/client/queries/admin'
-import { AuditLogPage, rangeToFromIso } from '@/components/admin/settings/security/audit-log-page'
+import { createFileRoute, redirect } from '@tanstack/react-router'
 
 export const Route = createFileRoute('/admin/settings/security/audit-log')({
-  loader: async ({ context }) => {
-    const { requireWorkspaceRole } = await import('@/lib/server/functions/workspace-utils')
-    await requireWorkspaceRole({ data: { allowedRoles: ['admin'] } })
-
-    // Prefetch the default-filter view so the table renders without a
-    // suspended flash. Match the default in <AuditLogPage>: last 30
-    // days, all event types, limit 200. The shared rangeToFromIso
-    // helper floors `from` to the current minute so the loader and the
-    // mount call agree on the same React Query cache key.
-    const defaultFilters = {
-      from: rangeToFromIso('30d'),
-      limit: 200,
-    }
-    await context.queryClient.ensureQueryData(adminQueries.auditEvents(defaultFilters))
-
-    return {}
+  beforeLoad: () => {
+    throw redirect({ to: '/admin/settings/audit', replace: true })
   },
-  component: AuditLogRoute,
 })
-
-function AuditLogRoute() {
-  return (
-    <div className="space-y-6 max-w-5xl">
-      <div className="lg:hidden">
-        <BackLink to="/admin/settings">Settings</BackLink>
-      </div>
-      <PageHeader
-        icon={ShieldCheckIcon}
-        title="Audit log"
-        description="Security-sensitive changes made by admins. Used for compliance review."
-      />
-      <AuditLogPage />
-    </div>
-  )
-}
diff --git a/apps/web/src/routes/admin/settings.sla.tsx b/apps/web/src/routes/admin/settings.sla.tsx
new file mode 100644
index 000000000..e14f46f03
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.sla.tsx
@@ -0,0 +1,61 @@
+/**
+ * SLA policies list route.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { Suspense, useState } from 'react'
+import { slaQueries } from '@/lib/client/queries/sla'
+import { businessHoursQueries } from '@/lib/client/queries/business-hours'
+import { SlaPolicyList } from '@/components/admin/settings/sla/sla-policy-list'
+import { SlaPolicyCreateDialog } from '@/components/admin/settings/sla/sla-policy-create-dialog'
+import { SlaTickTrigger } from '@/components/admin/settings/sla/sla-tick-trigger'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { PlusIcon } from '@heroicons/react/24/solid'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export const Route = createFileRoute('/admin/settings/sla')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await Promise.all([
+      queryClient.ensureQueryData(slaQueries.policies({ includeArchived: true })),
+      queryClient.ensureQueryData(businessHoursQueries.list({})),
+    ])
+  },
+  errorComponent: createRouteErrorComponent('Failed to load SLA policies'),
+  component: SlaPoliciesPage,
+})
+
+function SlaPoliciesPage() {
+  const [createOpen, setCreateOpen] = useState(false)
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center justify-between gap-2">
+        <div>
+          <h1 className="text-lg font-semibold">SLA policies</h1>
+          <p className="text-sm text-muted-foreground">
+            Service-level targets and escalations applied to tickets by scope and priority.
+          </p>
+        </div>
+        <div className="flex items-center gap-2">
+          <SlaTickTrigger />
+          <PermissionGate permission={PERMISSIONS.SLA_MANAGE}>
+            <Button size="sm" onClick={() => setCreateOpen(true)}>
+              <PlusIcon className="h-4 w-4 mr-1" />
+              New policy
+            </Button>
+          </PermissionGate>
+        </div>
+      </div>
+
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <SlaPolicyList />
+      </Suspense>
+
+      <SlaPolicyCreateDialog open={createOpen} onOpenChange={setCreateOpen} />
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/settings.sla_.$policyId.tsx b/apps/web/src/routes/admin/settings.sla_.$policyId.tsx
new file mode 100644
index 000000000..acd7d31b9
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.sla_.$policyId.tsx
@@ -0,0 +1,94 @@
+/**
+ * SLA policy detail — Tabs shell with Overview / Targets / Escalations.
+ */
+import { Suspense } from 'react'
+import { createFileRoute, Link, notFound } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { SlaPolicyId } from '@quackback/ids'
+import { slaQueries } from '@/lib/client/queries/sla'
+import { businessHoursQueries } from '@/lib/client/queries/business-hours'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { ArrowLeftIcon } from '@heroicons/react/24/outline'
+import { SlaPolicyOverviewTab } from '@/components/admin/settings/sla/sla-policy-overview-tab'
+import { SlaTargetsTab } from '@/components/admin/settings/sla/sla-targets-tab'
+import { SlaEscalationsTab } from '@/components/admin/settings/sla/sla-escalations-tab'
+
+export const Route = createFileRoute('/admin/settings/sla_/$policyId')({
+  loader: async ({ params, context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    const policyId = params.policyId as SlaPolicyId
+    const [detail] = await Promise.all([
+      queryClient.ensureQueryData(slaQueries.policy(policyId)),
+      queryClient.ensureQueryData(slaQueries.escalations(policyId)),
+      queryClient.ensureQueryData(businessHoursQueries.list({})),
+    ])
+    if (!detail) throw notFound()
+  },
+  errorComponent: createRouteErrorComponent('Failed to load SLA policy'),
+  component: SlaPolicyDetailPage,
+})
+
+function SlaPolicyDetailPage() {
+  const { policyId: rawId } = Route.useParams()
+  const policyId = rawId as SlaPolicyId
+  const { data: detail } = useSuspenseQuery(slaQueries.policy(policyId))
+
+  if (!detail) return null
+  const { policy, targets } = detail
+
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center gap-3">
+        <Button asChild variant="ghost" size="sm">
+          <Link to="/admin/settings/sla">
+            <ArrowLeftIcon className="h-4 w-4 mr-1" />
+            SLA policies
+          </Link>
+        </Button>
+        <div className="flex-1">
+          <div className="flex items-center gap-2">
+            <h1 className="text-lg font-semibold">{policy.name}</h1>
+            <Badge variant="outline" className="text-[10px]">
+              {policy.scope}
+            </Badge>
+            {policy.archivedAt ? (
+              <Badge variant="outline" className="text-muted-foreground">
+                Archived
+              </Badge>
+            ) : (
+              <Badge variant="outline">Active</Badge>
+            )}
+          </div>
+          {policy.description && (
+            <p className="text-xs text-muted-foreground mt-0.5">{policy.description}</p>
+          )}
+        </div>
+      </div>
+
+      <Tabs defaultValue="overview">
+        <TabsList>
+          <TabsTrigger value="overview">Overview</TabsTrigger>
+          <TabsTrigger value="targets">Targets</TabsTrigger>
+          <TabsTrigger value="escalations">Escalations</TabsTrigger>
+        </TabsList>
+        <TabsContent value="overview" className="pt-4">
+          <SlaPolicyOverviewTab policy={policy} />
+        </TabsContent>
+        <TabsContent value="targets" className="pt-4">
+          <SlaTargetsTab policyId={policyId} initialTargets={targets} />
+        </TabsContent>
+        <TabsContent value="escalations" className="pt-4">
+          <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+            <SlaEscalationsTab policyId={policyId} />
+          </Suspense>
+        </TabsContent>
+      </Tabs>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/settings.teams.tsx b/apps/web/src/routes/admin/settings.teams.tsx
new file mode 100644
index 000000000..15ccba8f6
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.teams.tsx
@@ -0,0 +1,54 @@
+/**
+ * Teams settings route — list workspace teams + create dialog.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { Suspense } from 'react'
+import { teamQueries } from '@/lib/client/queries/teams'
+import { TeamList } from '@/components/admin/settings/teams/team-list'
+import { TeamCreateDialog } from '@/components/admin/settings/teams/team-create-dialog'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { PlusIcon } from '@heroicons/react/24/solid'
+import { PermissionGate } from '@/components/admin/shared/permission-gate'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+export const Route = createFileRoute('/admin/settings/teams')({
+  loader: async ({ context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    await queryClient.ensureQueryData(teamQueries.list({ includeArchived: true }))
+  },
+  errorComponent: createRouteErrorComponent('Failed to load teams'),
+  component: TeamsSettingsPage,
+})
+
+function TeamsSettingsPage() {
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center justify-between">
+        <div>
+          <h1 className="text-lg font-semibold">Teams</h1>
+          <p className="text-sm text-muted-foreground">
+            Workspace teams used for routing, ticket sharing, and SLA scopes.
+          </p>
+        </div>
+        <PermissionGate permission={PERMISSIONS.ADMIN_MANAGE_USERS}>
+          <TeamCreateDialog
+            trigger={
+              <Button size="sm">
+                <PlusIcon className="h-4 w-4 mr-1" />
+                New team
+              </Button>
+            }
+          />
+        </PermissionGate>
+      </div>
+
+      <Suspense fallback={<Skeleton className="h-64 w-full" />}>
+        <TeamList />
+      </Suspense>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/settings.teams_.$teamId.tsx b/apps/web/src/routes/admin/settings.teams_.$teamId.tsx
new file mode 100644
index 000000000..acbebf36e
--- /dev/null
+++ b/apps/web/src/routes/admin/settings.teams_.$teamId.tsx
@@ -0,0 +1,95 @@
+/**
+ * Team detail route — Tabs shell with Overview / Members.
+ */
+import { Suspense } from 'react'
+import { createFileRoute, Link, notFound } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import type { TeamId } from '@quackback/ids'
+import { teamQueries } from '@/lib/client/queries/teams'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Skeleton } from '@/components/ui/skeleton'
+import { ArrowLeftIcon } from '@heroicons/react/24/outline'
+import { TeamOverviewTab } from '@/components/admin/settings/teams/team-overview-tab'
+import { TeamMembersTab } from '@/components/admin/settings/teams/team-members-tab'
+
+export const Route = createFileRoute('/admin/settings/teams_/$teamId')({
+  loader: async ({ params, context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    const teamId = params.teamId as TeamId
+    const [detail] = await Promise.all([
+      queryClient.ensureQueryData(teamQueries.detail(teamId)),
+      queryClient.ensureQueryData(teamQueries.members(teamId)),
+    ])
+    if (!detail) throw notFound()
+  },
+  errorComponent: createRouteErrorComponent('Failed to load team'),
+  component: TeamDetailPage,
+})
+
+function TeamDetailPage() {
+  const { teamId: rawId } = Route.useParams()
+  const teamId = rawId as TeamId
+  const { data: team } = useSuspenseQuery(teamQueries.detail(teamId))
+
+  if (!team) return null
+
+  return (
+    <div className="space-y-4 max-w-5xl">
+      <div className="flex items-center gap-3">
+        <Button asChild variant="ghost" size="sm">
+          <Link to="/admin/settings/teams">
+            <ArrowLeftIcon className="h-4 w-4 mr-1" />
+            Teams
+          </Link>
+        </Button>
+        <div className="flex-1">
+          <div className="flex items-center gap-2">
+            <h1 className="text-lg font-semibold">{team.name}</h1>
+            <span className="font-mono text-xs text-muted-foreground">{team.slug}</span>
+            {team.shortLabel && (
+              <span
+                className="inline-flex items-center rounded px-1.5 py-0.5 text-[10px] font-medium"
+                style={{
+                  backgroundColor: team.color ?? 'var(--muted)',
+                  color: team.color ? '#fff' : undefined,
+                }}
+              >
+                {team.shortLabel}
+              </span>
+            )}
+            {team.archivedAt ? (
+              <Badge variant="outline" className="text-muted-foreground">
+                Archived
+              </Badge>
+            ) : (
+              <Badge variant="outline">Active</Badge>
+            )}
+          </div>
+          {team.description && (
+            <p className="text-xs text-muted-foreground mt-0.5">{team.description}</p>
+          )}
+        </div>
+      </div>
+
+      <Tabs defaultValue="overview">
+        <TabsList>
+          <TabsTrigger value="overview">Overview</TabsTrigger>
+          <TabsTrigger value="members">Members</TabsTrigger>
+        </TabsList>
+        <TabsContent value="overview" className="pt-4">
+          <TeamOverviewTab team={team} />
+        </TabsContent>
+        <TabsContent value="members" className="pt-4">
+          <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+            <TeamMembersTab teamId={teamId} />
+          </Suspense>
+        </TabsContent>
+      </Tabs>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/tickets.$ticketId.tsx b/apps/web/src/routes/admin/tickets.$ticketId.tsx
new file mode 100644
index 000000000..e9767845b
--- /dev/null
+++ b/apps/web/src/routes/admin/tickets.$ticketId.tsx
@@ -0,0 +1,274 @@
+/**
+ * Ticket detail page.
+ *
+ * Layout: full-width, no queue sidebar (handled at parent route). Top row =
+ * <TicketDetailHeader>. Below: left column = thread feed + composer; right
+ * column = tabs (Properties / Participants / Shares / SLA / Activity). All
+ * mutations live inside the per-tab components.
+ */
+import { Suspense, useCallback, useMemo } from 'react'
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useMutation, useQueryClient, useSuspenseQuery } from '@tanstack/react-query'
+import type { JSONContent } from '@tiptap/react'
+import type { TicketId, TeamId } from '@quackback/ids'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import { updateTicketFn } from '@/lib/server/functions/tickets'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { Skeleton } from '@/components/ui/skeleton'
+import { useMyPermissions } from '@/lib/client/hooks/use-authz-queries'
+import type { MyPermissionsResult } from '@/lib/server/functions/authz'
+import { TicketDetailHeader } from '@/components/admin/tickets/ticket-detail-header'
+import { TicketThreadFeed } from '@/components/admin/tickets/ticket-thread-feed'
+import { TicketThreadComposer } from '@/components/admin/tickets/ticket-thread-composer'
+import { TicketPropertiesPanel } from '@/components/admin/tickets/ticket-properties-panel'
+import { TicketParticipantsList } from '@/components/admin/tickets/ticket-participants-list'
+import { TicketSharesPanel } from '@/components/admin/tickets/ticket-shares-panel'
+import { TicketSlaPanel } from '@/components/admin/tickets/ticket-sla-panel'
+import { TicketActivityTimeline } from '@/components/admin/tickets/ticket-activity-timeline'
+import { handleTicketConflict } from '@/lib/client/utils/handle-ticket-conflict'
+import { toast } from 'sonner'
+
+export const Route = createFileRoute('/admin/tickets/$ticketId')({
+  loader: async ({ params, context }) => {
+    const { queryClient } = context as {
+      queryClient: import('@tanstack/react-query').QueryClient
+    }
+    const ticketId = params.ticketId as TicketId
+    await Promise.all([
+      queryClient.ensureQueryData(ticketQueries.detail(ticketId)),
+      queryClient.ensureQueryData(ticketQueries.threads(ticketId)),
+      queryClient.ensureQueryData(ticketQueries.participants(ticketId)),
+      queryClient.ensureQueryData(ticketQueries.shares(ticketId)),
+      queryClient.ensureQueryData(ticketQueries.statuses()),
+    ])
+  },
+  errorComponent: createRouteErrorComponent('Failed to load ticket'),
+  component: TicketDetailPage,
+})
+
+function hasAnyPermission(
+  perms: ReturnType<typeof useMyPermissions>['data'] | undefined,
+  key: string
+): boolean {
+  if (!perms) return false
+  if (perms.workspacePermissions.includes(key as never)) return true
+  return perms.teamPermissions.some((tp) => tp.permissions.includes(key as never))
+}
+
+function hasTicketResourcePermission(
+  perms: MyPermissionsResult | undefined,
+  key: string,
+  resource: {
+    primaryTeamId: TeamId | null
+    assigneeTeamId: TeamId | null
+    sharedTeamIds: readonly TeamId[]
+  }
+): boolean {
+  if (!perms) return false
+  if (perms.workspacePermissions.includes(key as never)) return true
+  return perms.teamPermissions.some((tp) => {
+    if (!tp.permissions.includes(key as never)) return false
+    return (
+      tp.teamId === resource.primaryTeamId ||
+      tp.teamId === resource.assigneeTeamId ||
+      resource.sharedTeamIds.includes(tp.teamId)
+    )
+  })
+}
+
+function TicketDetailPage() {
+  const { ticketId: rawId } = Route.useParams()
+  const ticketId = rawId as TicketId
+  const qc = useQueryClient()
+
+  const { data: ticket } = useSuspenseQuery(ticketQueries.detail(ticketId))
+  const { data: threads } = useSuspenseQuery(ticketQueries.threads(ticketId))
+  const { data: participants } = useSuspenseQuery(ticketQueries.participants(ticketId))
+  const { data: shares } = useSuspenseQuery(ticketQueries.shares(ticketId))
+  const perms = useMyPermissions()
+  const principalNames = useMemo(() => {
+    const names: Record<string, string> = {}
+    for (const thread of threads) {
+      if (!thread.principalId) continue
+      names[thread.principalId] = thread.principalName?.trim() || 'Unknown'
+    }
+    return names
+  }, [threads])
+
+  const currentPrincipalId = perms.data?.principalId ?? ticket.assigneePrincipalId ?? ticket.id
+  const canPublic = hasAnyPermission(perms.data, 'ticket.reply_public')
+  const canInternal = hasAnyPermission(perms.data, 'ticket.comment_internal')
+  const canShared = hasAnyPermission(perms.data, 'ticket.share_cross_team')
+  const sharedTeamIds = shares.map((s) => s.teamId as TeamId)
+  const canEditDescription = hasTicketResourcePermission(perms.data, 'ticket.edit_fields', {
+    primaryTeamId: ticket.primaryTeamId as TeamId | null,
+    assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+    sharedTeamIds,
+  })
+
+  const invalidateTicket = useCallback(() => {
+    qc.invalidateQueries({ queryKey: ticketQueries.detail(ticketId).queryKey })
+    qc.invalidateQueries({ queryKey: ticketQueries.activity(ticketId).queryKey })
+    qc.invalidateQueries({ queryKey: ['tickets', 'list'] })
+  }, [qc, ticketId])
+
+  const latestExpectedUpdatedAt = useCallback(() => {
+    const latest = qc.getQueryData<{ updatedAt: Date | string }>(
+      ticketQueries.detail(ticketId).queryKey
+    )
+    return new Date(latest?.updatedAt ?? ticket.updatedAt).toISOString()
+  }, [qc, ticket.updatedAt, ticketId])
+
+  const descriptionMutation = useMutation({
+    mutationFn: (patch: { descriptionJson: JSONContent | null; descriptionText: string | null }) =>
+      updateTicketFn({
+        data: {
+          ticketId,
+          expectedUpdatedAt: latestExpectedUpdatedAt(),
+          descriptionJson: patch.descriptionJson as { type: 'doc'; content?: unknown[] } | null,
+          descriptionText: patch.descriptionText,
+        },
+      }),
+    onSuccess: (updated) => {
+      qc.setQueryData(ticketQueries.detail(ticketId).queryKey, updated)
+      invalidateTicket()
+      toast.success('Description updated')
+    },
+    onError: (error) => handleTicketConflict(error, qc, ticketId),
+  })
+
+  const handleDescriptionUpdate = useCallback(
+    (descriptionJson: JSONContent | null, descriptionText: string | null) => {
+      descriptionMutation.mutate({ descriptionJson, descriptionText })
+    },
+    [descriptionMutation]
+  )
+
+  return (
+    <div className="flex h-full flex-col">
+      <TicketDetailHeader
+        ticket={{
+          id: ticket.id,
+          subject: ticket.subject,
+          channel: ticket.channel,
+          priority: ticket.priority,
+          visibilityScope: ticket.visibilityScope,
+          updatedAt: ticket.updatedAt,
+          assigneePrincipalId: ticket.assigneePrincipalId,
+        }}
+        currentPrincipalId={currentPrincipalId as never}
+      />
+
+      <div className="flex flex-1 min-h-0">
+        <div className="flex-1 flex flex-col min-w-0 border-r border-border/50">
+          <div className="flex-1 overflow-auto p-4">
+            <TicketThreadFeed
+              threads={threads.map((t) => ({
+                id: t.id,
+                ticketId: t.ticketId,
+                principalId: t.principalId,
+                audience: t.audience as 'public' | 'internal' | 'shared_team',
+                bodyJson: t.bodyJson,
+                bodyText: t.bodyText,
+                sharedWithTeamId: t.sharedWithTeamId,
+                createdAt: t.createdAt,
+                editedAt: t.editedAt,
+              }))}
+              fallbackTicketId={ticketId}
+              principalNames={principalNames}
+              description={
+                ticket.descriptionText || ticket.descriptionJson
+                  ? { text: ticket.descriptionText, json: ticket.descriptionJson }
+                  : null
+              }
+              onDescriptionUpdate={canEditDescription ? handleDescriptionUpdate : undefined}
+              isDescriptionSaving={descriptionMutation.isPending}
+            />
+          </div>
+          <TicketThreadComposer
+            ticketId={ticketId}
+            canPublic={canPublic}
+            canInternal={canInternal}
+            canShared={canShared}
+          />
+        </div>
+
+        <aside className="w-80 shrink-0 overflow-hidden bg-background xl:w-96">
+          <Tabs defaultValue="properties" className="flex h-full min-h-0 flex-col gap-0">
+            <div className="shrink-0 border-b border-border/50 px-3 py-2">
+              <TabsList className="grid h-8 w-full grid-cols-5 rounded-md bg-muted/30 p-0.5">
+                <TabsTrigger value="properties" className="min-w-0 px-1.5 text-xs">
+                  Properties
+                </TabsTrigger>
+                <TabsTrigger value="participants" className="min-w-0 px-1.5 text-xs">
+                  People
+                </TabsTrigger>
+                <TabsTrigger value="shares" className="min-w-0 px-1.5 text-xs">
+                  Shares
+                </TabsTrigger>
+                <TabsTrigger value="sla" className="min-w-0 px-1.5 text-xs">
+                  SLA
+                </TabsTrigger>
+                <TabsTrigger value="activity" className="min-w-0 px-1.5 text-xs">
+                  Activity
+                </TabsTrigger>
+              </TabsList>
+            </div>
+            <TabsContent value="properties" className="m-0 min-h-0 overflow-auto p-4">
+              <TicketPropertiesPanel
+                ticket={{
+                  id: ticket.id,
+                  subject: ticket.subject,
+                  statusId: ticket.statusId,
+                  priority: ticket.priority,
+                  visibilityScope: ticket.visibilityScope,
+                  primaryTeamId: ticket.primaryTeamId,
+                  inboxId: ticket.inboxId,
+                  organizationId: ticket.organizationId,
+                  requesterContactId: ticket.requesterContactId,
+                  assigneePrincipalId: ticket.assigneePrincipalId,
+                  updatedAt: ticket.updatedAt,
+                }}
+              />
+            </TabsContent>
+            <TabsContent value="participants" className="m-0 min-h-0 overflow-auto p-4">
+              <TicketParticipantsList
+                ticketId={ticketId}
+                participants={participants.map((p) => ({
+                  id: p.id,
+                  ticketId: p.ticketId,
+                  principalId: p.principalId,
+                  contactId: p.contactId,
+                  role: p.role,
+                }))}
+              />
+            </TabsContent>
+            <TabsContent value="shares" className="m-0 min-h-0 overflow-auto p-4">
+              <TicketSharesPanel
+                ticketId={ticketId}
+                shares={shares.map((s) => ({
+                  id: s.id,
+                  ticketId: s.ticketId,
+                  teamId: s.teamId,
+                  accessLevel: s.accessLevel,
+                }))}
+                canShare={canShared}
+              />
+            </TabsContent>
+            <TabsContent value="sla" className="m-0 min-h-0 overflow-auto p-4">
+              <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+                <TicketSlaPanel ticketId={ticketId} />
+              </Suspense>
+            </TabsContent>
+            <TabsContent value="activity" className="m-0 min-h-0 overflow-auto p-4">
+              <Suspense fallback={<Skeleton className="h-24 w-full" />}>
+                <TicketActivityTimeline ticketId={ticketId} />
+              </Suspense>
+            </TabsContent>
+          </Tabs>
+        </aside>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/tickets.index.tsx b/apps/web/src/routes/admin/tickets.index.tsx
new file mode 100644
index 000000000..85a37bda9
--- /dev/null
+++ b/apps/web/src/routes/admin/tickets.index.tsx
@@ -0,0 +1,138 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { useState, useMemo } from 'react'
+import { ticketQueries } from '@/lib/client/queries/tickets'
+import type { TicketsSearch } from './tickets'
+import { Input } from '@/components/ui/input'
+import { Skeleton } from '@/components/ui/skeleton'
+import { TicketQueueTable } from '@/components/admin/tickets/ticket-queue-table'
+import { cn } from '@/lib/shared/utils'
+
+export const Route = createFileRoute('/admin/tickets/')({
+  loaderDeps: ({ search }) => ({
+    scope: search.scope,
+    statusCategory: search.statusCategory,
+    search: search.search,
+    inboxId: search.inboxId,
+    sort: search.sort,
+  }),
+  loader: async ({ deps, context }) => {
+    const { queryClient } = context as { queryClient: import('@tanstack/react-query').QueryClient }
+    await Promise.all([
+      queryClient.ensureQueryData(
+        ticketQueries.list({
+          scope: deps.scope ?? 'my_assigned',
+          statusCategory: deps.statusCategory,
+          search: deps.search,
+          inboxId: deps.inboxId ?? null,
+          sort: deps.sort,
+        })
+      ),
+      queryClient.ensureQueryData(ticketQueries.statuses()),
+    ])
+  },
+  pendingComponent: TicketsQueuePending,
+  errorComponent: createRouteErrorComponent('Failed to load tickets'),
+  component: TicketsQueuePage,
+})
+
+function TicketsQueuePending() {
+  return (
+    <div className="p-4 space-y-2">
+      {Array.from({ length: 6 }).map((_, i) => (
+        <Skeleton key={i} className="h-10 w-full" />
+      ))}
+    </div>
+  )
+}
+
+function TicketsQueuePage() {
+  const search = Route.useSearch()
+  const navigate = Route.useNavigate()
+  const [searchInput, setSearchInput] = useState(search.search ?? '')
+
+  const params = useMemo(
+    () => ({
+      scope: search.scope ?? 'my_assigned',
+      statusCategory: search.statusCategory,
+      search: search.search,
+      inboxId: search.inboxId ?? null,
+      sort: search.sort,
+    }),
+    [search]
+  )
+
+  const queryOpts = ticketQueries.list(params)
+  const { data } = useSuspenseQuery(queryOpts)
+  const { data: statuses } = useSuspenseQuery(ticketQueries.statuses())
+
+  return (
+    <div className="flex h-full flex-col">
+      <div className="flex items-center gap-2 border-b border-border/50 px-4 py-2">
+        <Input
+          placeholder="Search subject…"
+          value={searchInput}
+          onChange={(e) => setSearchInput(e.target.value)}
+          onKeyDown={(e) => {
+            if (e.key === 'Enter') {
+              navigate({
+                search: (s: TicketsSearch) => ({ ...s, search: searchInput || undefined }),
+              })
+            }
+          }}
+          className="max-w-xs h-8"
+        />
+        <div className="flex items-center gap-1 ml-2">
+          {(['open', 'pending', 'on_hold', 'solved', 'closed'] as const).map((cat) => {
+            const isActive = search.statusCategory === cat
+            return (
+              <button
+                key={cat}
+                onClick={() =>
+                  navigate({
+                    search: (s: TicketsSearch) => ({
+                      ...s,
+                      statusCategory: isActive ? undefined : cat,
+                    }),
+                  })
+                }
+                className={cn(
+                  'px-2 py-1 text-xs font-medium rounded transition-colors',
+                  isActive
+                    ? 'bg-foreground text-background'
+                    : 'text-muted-foreground hover:bg-muted'
+                )}
+              >
+                {cat.replace('_', ' ')}
+              </button>
+            )
+          })}
+        </div>
+        <div className="ml-auto text-xs text-muted-foreground">
+          {data.total} ticket{data.total === 1 ? '' : 's'}
+        </div>
+      </div>
+
+      <div className="flex-1 min-h-0">
+        <TicketQueueTable
+          rows={data.rows.map((r) => ({
+            id: r.id,
+            subject: r.subject,
+            statusId: r.statusId as string,
+            priority: r.priority,
+            channel: r.channel,
+            lastActivityAt: r.lastActivityAt,
+            assigneePrincipalId: (r.assigneePrincipalId as string | null) ?? null,
+          }))}
+          statuses={statuses.map((s) => ({
+            id: s.id as string,
+            name: s.name,
+            category: s.category as 'open' | 'pending' | 'on_hold' | 'solved' | 'closed',
+          }))}
+          invalidateKey={queryOpts.queryKey}
+        />
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/tickets.new.tsx b/apps/web/src/routes/admin/tickets.new.tsx
new file mode 100644
index 000000000..141ba4618
--- /dev/null
+++ b/apps/web/src/routes/admin/tickets.new.tsx
@@ -0,0 +1,346 @@
+/**
+ * Create-ticket page.
+ *
+ * Wraps `createTicketFn` in a richer form than the v1 placeholder: subject,
+ * RichTextEditor description, channel/priority/visibility, plus inbox /
+ * requester / organization / assignee / primary-team pickers. Inbox is a
+ * normal optional field — when empty, the routing engine resolves it.
+ */
+import { createFileRoute, Link, useRouter } from '@tanstack/react-router'
+import { createRouteErrorComponent } from '@/components/admin/shared'
+import { useState, useCallback } from 'react'
+import { useMutation } from '@tanstack/react-query'
+import type { JSONContent } from '@tiptap/react'
+import type {
+  TicketId,
+  PrincipalId,
+  InboxId,
+  OrganizationId,
+  ContactId,
+  TeamId,
+} from '@quackback/ids'
+import { createTicketFn, createTicketInitialThreadFn } from '@/lib/server/functions/tickets'
+import { useMyPermissions } from '@/lib/client/hooks/use-authz-queries'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { RichTextEditor } from '@/components/ui/rich-text-editor'
+import { useImageUpload } from '@/lib/client/hooks/use-image-upload'
+import { TICKET_CREATE_EDITOR_FEATURES } from '@/components/tickets/ticket-create-editor-features'
+import { InboxPicker } from '@/components/admin/shared/inbox-picker'
+import { OrgPicker } from '@/components/admin/shared/org-picker'
+import { ContactPicker } from '@/components/admin/shared/contact-picker'
+import { PrincipalPicker } from '@/components/admin/shared/principal-picker'
+import { TeamPicker } from '@/components/admin/shared/team-picker'
+import { ArrowLeftIcon } from '@heroicons/react/24/outline'
+import { toast } from 'sonner'
+
+export const Route = createFileRoute('/admin/tickets/new')({
+  errorComponent: createRouteErrorComponent('Failed to load form'),
+  component: NewTicketPage,
+})
+
+const PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+const CHANNELS = ['portal', 'email', 'api', 'widget'] as const
+const VISIBILITY = ['team', 'org', 'shared', 'private'] as const
+
+function plainTextFromJson(json: JSONContent | null): string {
+  if (!json) return ''
+  let out = ''
+  const walk = (n: JSONContent) => {
+    if (n.type === 'text' && typeof n.text === 'string') out += n.text
+    if (n.content) n.content.forEach(walk)
+    if (n.type === 'paragraph' || n.type === 'heading') out += '\n'
+  }
+  walk(json)
+  return out.trim()
+}
+
+function NewTicketPage() {
+  const router = useRouter()
+  const perms = useMyPermissions()
+  const { upload: uploadImage } = useImageUpload({ prefix: 'uploads' })
+
+  const [subject, setSubject] = useState('')
+  const [descJson, setDescJson] = useState<JSONContent | null>(null)
+  const [descText, setDescText] = useState('')
+  const [priority, setPriority] = useState<(typeof PRIORITIES)[number]>('normal')
+  const [channel, setChannel] = useState<(typeof CHANNELS)[number]>('portal')
+  const [visibilityScope, setVisibilityScope] = useState<(typeof VISIBILITY)[number]>('team')
+  const [selectedFiles, setSelectedFiles] = useState<File[]>([])
+
+  const [inboxId, setInboxId] = useState<InboxId | null>(null)
+  const [organizationId, setOrganizationId] = useState<OrganizationId | null>(null)
+  const [contactId, setContactId] = useState<ContactId | null>(null)
+  const [primaryTeamId, setPrimaryTeamId] = useState<TeamId | null>(null)
+  const [assigneeId, setAssigneeId] = useState<PrincipalId | null>(perms.data?.principalId ?? null)
+
+  const handleFileSelect = useCallback((e: React.ChangeEvent<HTMLInputElement>) => {
+    const files = Array.from(e.currentTarget.files || [])
+    setSelectedFiles((prev) => [...prev, ...files])
+    e.currentTarget.value = ''
+  }, [])
+
+  const removeFile = useCallback((index: number) => {
+    setSelectedFiles((prev) => prev.filter((_, i) => i !== index))
+  }, [])
+
+  const createMutation = useMutation({
+    mutationFn: async () => {
+      const ticket = await createTicketFn({
+        data: {
+          subject: subject.trim(),
+          descriptionJson: descJson as unknown as { type: 'doc'; content?: unknown[] } | null,
+          descriptionText: descText.trim() || plainTextFromJson(descJson) || null,
+          priority,
+          channel,
+          visibilityScope,
+          inboxId: inboxId ?? null,
+          organizationId: organizationId ?? null,
+          requesterContactId: contactId ?? null,
+          primaryTeamId: primaryTeamId ?? null,
+          assigneePrincipalId: assigneeId ?? null,
+        },
+      })
+
+      // Upload files if selected
+      if (selectedFiles.length > 0) {
+        try {
+          const threadResponse = await createTicketInitialThreadFn({
+            data: { ticketId: ticket.id },
+          })
+
+          for (let i = 0; i < selectedFiles.length; i++) {
+            const file = selectedFiles[i]
+            try {
+              const formData = new FormData()
+              formData.append('file', file)
+
+              const res = await fetch(
+                `/api/v1/tickets/${ticket.id}/threads/${threadResponse.id}/attachments`,
+                {
+                  method: 'POST',
+                  body: formData,
+                }
+              )
+
+              if (!res.ok) {
+                console.error(`Failed to upload ${file.name}`)
+              }
+            } catch (err) {
+              console.error(`Error uploading ${file.name}:`, err)
+            }
+          }
+        } catch (err) {
+          console.error('Failed to create thread for attachments:', err)
+        }
+      }
+
+      return ticket
+    },
+    onSuccess: (ticket) => {
+      toast.success('Ticket created')
+      router.navigate({
+        to: '/admin/tickets/$ticketId',
+        params: { ticketId: ticket.id as TicketId },
+      })
+    },
+    onError: (err: Error) => toast.error(err.message),
+  })
+
+  return (
+    <div className="flex h-full flex-col">
+      <div className="flex items-center gap-3 border-b border-border/50 px-4 py-2">
+        <Button asChild variant="ghost" size="sm">
+          <Link to="/admin/tickets">
+            <ArrowLeftIcon className="h-4 w-4 mr-1" />
+            Back
+          </Link>
+        </Button>
+        <h1 className="text-sm font-semibold">New ticket</h1>
+      </div>
+
+      <form
+        onSubmit={(e) => {
+          e.preventDefault()
+          if (!subject.trim()) {
+            toast.error('Subject is required')
+            return
+          }
+          createMutation.mutate()
+        }}
+        className="max-w-3xl mx-auto w-full p-6 space-y-4"
+      >
+        <div className="space-y-2">
+          <Label htmlFor="subject">Subject</Label>
+          <Input
+            id="subject"
+            value={subject}
+            onChange={(e) => setSubject(e.target.value)}
+            maxLength={500}
+            required
+          />
+        </div>
+
+        <div className="space-y-2">
+          <Label>Description</Label>
+          <RichTextEditor
+            value={descJson ?? undefined}
+            onChange={(json, _html, markdown) => {
+              setDescJson(json)
+              setDescText(markdown)
+            }}
+            features={TICKET_CREATE_EDITOR_FEATURES}
+            onImageUpload={uploadImage}
+            placeholder="Describe the issue…"
+            minHeight="160px"
+          />
+        </div>
+
+        <div className="space-y-2">
+          <Label htmlFor="admin-ticket-attachments">Attachments (optional)</Label>
+          <Input
+            id="admin-ticket-attachments"
+            type="file"
+            multiple
+            onChange={handleFileSelect}
+            disabled={createMutation.isPending}
+          />
+          {selectedFiles.length > 0 && (
+            <div className="space-y-2 pt-2">
+              {selectedFiles.map((file, index) => (
+                <div
+                  key={`${file.name}-${index}`}
+                  className="flex items-center justify-between rounded-md border border-input bg-muted/50 px-3 py-2 text-sm"
+                >
+                  <span className="truncate">{file.name}</span>
+                  <button
+                    type="button"
+                    onClick={() => removeFile(index)}
+                    className="ml-2 text-muted-foreground hover:text-foreground"
+                  >
+                    ×
+                  </button>
+                </div>
+              ))}
+            </div>
+          )}
+        </div>
+
+        <div className="grid grid-cols-2 gap-4">
+          <div className="space-y-2">
+            <Label>Priority</Label>
+            <Select value={priority} onValueChange={(v) => setPriority(v as typeof priority)}>
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {PRIORITIES.map((p) => (
+                  <SelectItem key={p} value={p}>
+                    {p}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+
+          <div className="space-y-2">
+            <Label>Channel</Label>
+            <Select value={channel} onValueChange={(v) => setChannel(v as typeof channel)}>
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {CHANNELS.map((c) => (
+                  <SelectItem key={c} value={c}>
+                    {c}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+
+          <div className="space-y-2">
+            <Label>Visibility</Label>
+            <Select
+              value={visibilityScope}
+              onValueChange={(v) => setVisibilityScope(v as typeof visibilityScope)}
+            >
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {VISIBILITY.map((v) => (
+                  <SelectItem key={v} value={v}>
+                    {v}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+
+          <div className="space-y-2">
+            <Label>Inbox</Label>
+            <InboxPicker
+              value={inboxId}
+              onValueChange={setInboxId}
+              placeholder="Auto (route by rules)…"
+              allowClear
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label>Primary team</Label>
+            <TeamPicker
+              value={primaryTeamId}
+              onValueChange={setPrimaryTeamId}
+              allowClear
+              placeholder="Pick team…"
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label>Assignee</Label>
+            <PrincipalPicker value={assigneeId} onValueChange={setAssigneeId} allowUnassigned />
+          </div>
+
+          <div className="space-y-2">
+            <Label>Organization</Label>
+            <OrgPicker
+              value={organizationId}
+              onValueChange={setOrganizationId}
+              allowClear
+              placeholder="Pick org…"
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label>Requester contact</Label>
+            <ContactPicker
+              value={contactId}
+              onValueChange={setContactId}
+              allowClear
+              placeholder="Pick contact…"
+            />
+          </div>
+        </div>
+
+        <div className="flex justify-end gap-2 pt-2">
+          <Button asChild variant="outline" type="button">
+            <Link to="/admin/tickets">Cancel</Link>
+          </Button>
+          <Button type="submit" disabled={createMutation.isPending}>
+            {createMutation.isPending ? 'Creating…' : 'Create ticket'}
+          </Button>
+        </div>
+      </form>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/tickets.tsx b/apps/web/src/routes/admin/tickets.tsx
new file mode 100644
index 000000000..353ee7d9b
--- /dev/null
+++ b/apps/web/src/routes/admin/tickets.tsx
@@ -0,0 +1,68 @@
+import { createFileRoute, Link, Outlet, useRouterState } from '@tanstack/react-router'
+import { z } from 'zod'
+import { Button } from '@/components/ui/button'
+import { PlusIcon } from '@heroicons/react/24/outline'
+import { TicketQueueSidebar } from '@/components/admin/tickets/ticket-queue-sidebar'
+
+const scopeSchema = z.enum([
+  'all',
+  'my_assigned',
+  'my_team',
+  'shared_with_me',
+  'unassigned',
+  'my_inbox',
+  'inbox',
+])
+
+const statusCategorySchema = z.enum(['open', 'pending', 'on_hold', 'solved', 'closed'])
+
+export const ticketsSearchSchema = z.object({
+  scope: scopeSchema.optional().default('my_assigned'),
+  statusCategory: statusCategorySchema.optional(),
+  search: z.string().optional(),
+  inboxId: z.string().optional(),
+  sort: z.enum(['last_activity_desc', 'created_desc', 'created_asc']).optional(),
+})
+
+export type TicketsSearch = z.infer<typeof ticketsSearchSchema>
+
+export const Route = createFileRoute('/admin/tickets')({
+  validateSearch: ticketsSearchSchema,
+  component: TicketsLayout,
+})
+
+function TicketsLayout() {
+  const search = Route.useSearch()
+  const pathname = useRouterState({ select: (s) => s.location.pathname })
+  const isDetailOrNew = /\/admin\/tickets\/.+/.test(pathname)
+
+  if (isDetailOrNew) {
+    return (
+      <div className="flex h-full flex-col">
+        <Outlet />
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex h-full">
+      <TicketQueueSidebar
+        activeScope={search.scope ?? 'my_assigned'}
+        activeInboxId={search.inboxId}
+      />
+      <div className="flex-1 min-w-0 flex flex-col">
+        <div className="flex items-center justify-end border-b border-border/50 px-4 py-2">
+          <Button asChild size="sm">
+            <Link to="/admin/tickets/new">
+              <PlusIcon className="h-4 w-4 mr-1" />
+              New ticket
+            </Link>
+          </Button>
+        </div>
+        <div className="flex-1 min-h-0 overflow-hidden">
+          <Outlet />
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/apps/web/src/routes/admin/users.tsx b/apps/web/src/routes/admin/users.tsx
index 41901083d..0a5a91ced 100644
--- a/apps/web/src/routes/admin/users.tsx
+++ b/apps/web/src/routes/admin/users.tsx
@@ -1,4 +1,4 @@
-import { createFileRoute } from '@tanstack/react-router'
+import { createFileRoute, redirect } from '@tanstack/react-router'
 import { z } from 'zod'
 import type { SegmentId } from '@quackback/ids'
 import { useSuspenseQuery } from '@tanstack/react-query'
@@ -34,7 +34,7 @@ const searchSchema = z.object({
 
 type SearchParams = z.infer<typeof searchSchema>
 
-function parseSearchToQueryParams(deps: SearchParams) {
+export function parseSearchToQueryParams(deps: SearchParams) {
   let verified: boolean | undefined
   if (deps.verified === 'true') verified = true
   else if (deps.verified === 'false') verified = false
@@ -81,6 +81,25 @@ function parseSearchToQueryParams(deps: SearchParams) {
   }
 }
 
+function shouldRedirectToCustomers(deps: SearchParams): boolean {
+  return (
+    !deps.search &&
+    !deps.verified &&
+    !deps.dateFrom &&
+    !deps.dateTo &&
+    !deps.emailDomain &&
+    !deps.postCount &&
+    !deps.voteCount &&
+    !deps.commentCount &&
+    !deps.customAttrs &&
+    !deps.includeAnonymous &&
+    !deps.selected &&
+    !deps.segments &&
+    !deps.invites &&
+    (!deps.sort || deps.sort === 'newest')
+  )
+}
+
 export const Route = createFileRoute('/admin/users')({
   validateSearch: searchSchema,
   loaderDeps: ({
@@ -97,6 +116,8 @@ export const Route = createFileRoute('/admin/users')({
       includeAnonymous,
       sort,
       segments,
+      selected,
+      invites,
     },
   }) => ({
     search,
@@ -111,9 +132,15 @@ export const Route = createFileRoute('/admin/users')({
     includeAnonymous,
     sort,
     segments,
+    selected,
+    invites,
   }),
   errorComponent: UsersErrorComponent,
   loader: async ({ deps, context }) => {
+    if (shouldRedirectToCustomers(deps)) {
+      throw redirect({ to: '/admin/customers/people' })
+    }
+
     // Protected route - principal is guaranteed by parent's beforeLoad auth check
     const { principal, queryClient } = context as {
       principal: NonNullable<typeof context.principal>
diff --git a/apps/web/src/routes/api/auth/$.ts b/apps/web/src/routes/api/auth/$.ts
index c1be78f09..82438dc0b 100644
--- a/apps/web/src/routes/api/auth/$.ts
+++ b/apps/web/src/routes/api/auth/$.ts
@@ -1,4 +1,6 @@
 import { createFileRoute } from '@tanstack/react-router'
+import { SSO_OAUTH_CALLBACK_PATH } from '@/lib/shared/sso-test-keys'
+import { rewriteUrlToPublicBaseUrl } from '@/lib/server/public-url'
 import { SSO_OAUTH_CALLBACK_PREFIX } from '@/lib/shared/sso-test-keys'
 
 /**
@@ -27,6 +29,36 @@ function isRegistrationRateLimited(request: Request): boolean {
   return entry.count > REG_MAX
 }
 
+/**
+ * Rewrite localhost redirects to use the public origin from forwarded
+ * headers. When accessed via a tunnel (Cloudflare, ngrok, etc), Better Auth
+ * may redirect to the configured localhost baseUrl instead of the actual
+ * public origin where the request came from.
+ */
+async function rewriteAuthRedirect(response: Response, request: Request): Promise<Response> {
+  // Only handle redirect responses
+  const status = response.status
+  if (status < 300 || status >= 400) {
+    return response
+  }
+
+  const location = response.headers.get('location')
+  if (!location) {
+    return response
+  }
+
+  // Rewrite localhost URLs to use public origin
+  const rewritten = rewriteUrlToPublicBaseUrl(location, request.headers)
+  if (rewritten !== location) {
+    // Clone the response and update the Location header
+    const newResponse = new Response(response.body, response)
+    newResponse.headers.set('location', rewritten)
+    return newResponse
+  }
+
+  return response
+}
+
 export const Route = createFileRoute('/api/auth/$')({
   server: {
     handlers: {
@@ -60,7 +92,9 @@ export const Route = createFileRoute('/api/auth/$')({
         }
 
         const { auth } = await import('@/lib/server/auth/index')
-        return await auth.handler(request)
+        let response = await auth.handler(request)
+        response = await rewriteAuthRedirect(response, request)
+        return response
       },
 
       /**
@@ -103,7 +137,9 @@ export const Route = createFileRoute('/api/auth/$')({
         }
 
         const { auth } = await import('@/lib/server/auth/index')
-        return await auth.handler(request)
+        let response = await auth.handler(request)
+        response = await rewriteAuthRedirect(response, request)
+        return response
       },
     },
   },
diff --git a/apps/web/src/routes/api/auth/__tests__/auth-catchall.gap.test.ts b/apps/web/src/routes/api/auth/__tests__/auth-catchall.gap.test.ts
new file mode 100644
index 000000000..ff8305c5e
--- /dev/null
+++ b/apps/web/src/routes/api/auth/__tests__/auth-catchall.gap.test.ts
@@ -0,0 +1,111 @@
+/**
+ * Differential-coverage tests for the /api/auth/$ catch-all — SSO test-callback
+ * interception, redirect rewriting, OAuth register rate-limiting, and the
+ * token-exchange `resource` injection.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const m = vi.hoisted(() => ({
+  authHandler: vi.fn(),
+  handleSso: vi.fn(),
+  renderSso: vi.fn(() => new Response('html')),
+  rewrite: vi.fn((v: string) => v),
+}))
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (cfg: unknown) => ({ options: cfg }),
+}))
+vi.mock('@/lib/shared/sso-test-keys', () => ({
+  SSO_OAUTH_CALLBACK_PATH: '/api/auth/sso-test/callback',
+}))
+vi.mock('@/lib/server/public-url', () => ({
+  rewriteUrlToPublicBaseUrl: (...a: unknown[]) => m.rewrite(...(a as [string])),
+}))
+vi.mock('@/lib/server/auth/index', () => ({ auth: { handler: m.authHandler } }))
+vi.mock('@/lib/server/auth/sso-test-callback', () => ({
+  handleSsoTestCallback: m.handleSso,
+  renderSsoTestCallbackHtml: m.renderSso,
+}))
+vi.mock('@/lib/server/config', () => ({ config: { baseUrl: 'https://app.test' } }))
+
+import { Route } from '../$'
+
+type H = {
+  options: {
+    server: {
+      handlers: {
+        GET: (c: { request: Request }) => Promise<Response>
+        POST: (c: { request: Request }) => Promise<Response>
+      }
+    }
+  }
+}
+const { GET, POST } = (Route as unknown as H).options.server.handlers
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  m.authHandler.mockResolvedValue(new Response('ok', { status: 200 }))
+  m.handleSso.mockResolvedValue(null)
+  m.rewrite.mockImplementation((v: string) => v)
+})
+
+describe('GET', () => {
+  it('renders the SSO test callback when handled', async () => {
+    m.handleSso.mockResolvedValueOnce({ testId: 't', result: 'ok', identityMatched: true })
+    const res = await GET({
+      request: new Request('https://app.test/api/auth/sso-test/callback?state=s&code=c'),
+    })
+    expect(await res.text()).toBe('html')
+  })
+  it('delegates to better-auth and rewrites a redirect Location', async () => {
+    m.authHandler.mockResolvedValueOnce(
+      new Response(null, { status: 302, headers: { location: 'http://localhost/x' } })
+    )
+    m.rewrite.mockReturnValueOnce('https://public.test/x')
+    const res = await GET({ request: new Request('https://app.test/api/auth/session') })
+    expect(res.headers.get('location')).toBe('https://public.test/x')
+  })
+  it('passes non-redirect responses through unchanged', async () => {
+    const res = await GET({ request: new Request('https://app.test/api/auth/session') })
+    expect(res.status).toBe(200)
+  })
+})
+
+describe('POST', () => {
+  it('rate-limits oauth2/register after the cap', async () => {
+    const reg = () =>
+      POST({
+        request: new Request('https://app.test/api/auth/oauth2/register', {
+          method: 'POST',
+          headers: { 'x-forwarded-for': '9.9.9.9' },
+        }),
+      })
+    let last: Response | undefined
+    for (let i = 0; i < 12; i++) last = await reg()
+    expect(last!.status).toBe(429)
+  })
+  it('injects resource into a token exchange missing it', async () => {
+    const res = await POST({
+      request: new Request('https://app.test/api/auth/oauth2/token', {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: 'grant_type=authorization_code',
+      }),
+    })
+    expect(res.status).toBe(200)
+    expect(m.authHandler).toHaveBeenCalled()
+  })
+  it('leaves a token request that already has resource', async () => {
+    await POST({
+      request: new Request('https://app.test/api/auth/oauth2/token', {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: 'resource=https://x/api/mcp',
+      }),
+    })
+    expect(m.authHandler).toHaveBeenCalled()
+  })
+  it('delegates other POSTs', async () => {
+    await POST({ request: new Request('https://app.test/api/auth/sign-in', { method: 'POST' }) })
+    expect(m.authHandler).toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/v1/__tests__/admin-authz-routes.test.ts b/apps/web/src/routes/api/v1/__tests__/admin-authz-routes.test.ts
new file mode 100644
index 000000000..f8feb2c8f
--- /dev/null
+++ b/apps/web/src/routes/api/v1/__tests__/admin-authz-routes.test.ts
@@ -0,0 +1,226 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  listAuditEventsMock: vi.fn(),
+  revokeRoleAssignmentMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  listAuditEvents: (...args: unknown[]) => hoisted.listAuditEventsMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/role.service', () => ({
+  revokeRoleAssignment: (...args: unknown[]) => hoisted.revokeRoleAssignmentMock(...args),
+}))
+
+import { Route as AuditEventsRoute } from '../audit-events/index'
+import { Route as PermissionsRoute } from '../permissions'
+import { Route as RoleAssignmentRoute } from '../role-assignments/$assignmentId'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const auditHandlers = (AuditEventsRoute as unknown as RouteWithHandlers).options.server.handlers
+const permissionHandlers = (PermissionsRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const roleAssignmentHandlers = (RoleAssignmentRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+
+function args(
+  params: Record<string, string> = {},
+  request = new Request('http://test/api/v1/permissions')
+) {
+  return { request, params }
+}
+
+async function json(response: Response) {
+  return response.json() as Promise<{ data?: unknown; error?: unknown }>
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: 'principal_admin',
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.listAuditEventsMock.mockResolvedValue({
+    items: [{ id: 'audit_evt_1', action: 'ticket.created' }],
+    nextCursor: 'cursor_next',
+    hasMore: true,
+  })
+  hoisted.revokeRoleAssignmentMock.mockResolvedValue(undefined)
+})
+
+describe('GET /api/v1/audit-events', () => {
+  it('lists audit events after scope and permission checks with parsed filters', async () => {
+    const response = await auditHandlers.GET(
+      args(
+        {},
+        new Request(
+          'http://test/api/v1/audit-events?principalId=principal_1&action=ticket.created&actionPrefix=ticket.&targetType=ticket&targetId=ticket_1&source=mcp&from=2026-01-01T00:00:00.000Z&to=2026-01-02T00:00:00.000Z&cursor=abc&limit=50'
+        )
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect((await json(response)).data).toEqual({
+      items: [{ id: 'audit_evt_1', action: 'ticket.created' }],
+      nextCursor: 'cursor_next',
+      hasMore: true,
+    })
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.AUDIT_VIEW
+    )
+    expect(hoisted.loadPermissionSetMock).toHaveBeenCalledWith('principal_admin')
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(expect.any(Set), PERMISSIONS.AUDIT_VIEW)
+    expect(hoisted.listAuditEventsMock).toHaveBeenCalledWith({
+      principalId: 'principal_1',
+      action: 'ticket.created',
+      actionPrefix: 'ticket.',
+      targetType: 'ticket',
+      targetId: 'ticket_1',
+      source: 'mcp',
+      from: new Date('2026-01-01T00:00:00.000Z'),
+      to: new Date('2026-01-02T00:00:00.000Z'),
+      cursor: 'abc',
+      limit: 50,
+    })
+  })
+
+  it('lists audit events with omitted optional date filters as undefined', async () => {
+    const response = await auditHandlers.GET(
+      args({}, new Request('http://test/api/v1/audit-events'))
+    )
+
+    expect(response.status).toBe(200)
+    expect(hoisted.listAuditEventsMock).toHaveBeenCalledWith({
+      principalId: undefined,
+      action: undefined,
+      actionPrefix: undefined,
+      targetType: undefined,
+      targetId: undefined,
+      source: undefined,
+      from: undefined,
+      to: undefined,
+      cursor: undefined,
+      limit: undefined,
+    })
+  })
+
+  it('rejects invalid query params and denies missing audit.view permission before listing', async () => {
+    const invalid = await auditHandlers.GET(
+      args({}, new Request('http://test/api/v1/audit-events?source=browser&limit=500'))
+    )
+    expect(invalid.status).toBe(400)
+    expect(hoisted.listAuditEventsMock).not.toHaveBeenCalled()
+
+    vi.clearAllMocks()
+    hoisted.withApiKeyAuthMock.mockResolvedValue({ principalId: 'principal_admin', role: 'team' })
+    hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const denied = await auditHandlers.GET(args({}, new Request('http://test/api/v1/audit-events')))
+    expect(denied.status).toBe(403)
+    expect(hoisted.listAuditEventsMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('GET /api/v1/permissions', () => {
+  it('returns permission catalogue and categories after admin.manage_roles checks', async () => {
+    const response = await permissionHandlers.GET(args())
+
+    expect(response.status).toBe(200)
+    const body = await json(response)
+    expect(body.data).toEqual({
+      permissions: expect.arrayContaining([PERMISSIONS.ADMIN_MANAGE_ROLES]),
+      categories: expect.objectContaining({
+        admin: expect.arrayContaining([PERMISSIONS.ADMIN_MANAGE_ROLES]),
+      }),
+    })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ADMIN_MANAGE_ROLES
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.ADMIN_MANAGE_ROLES
+    )
+  })
+
+  it('returns 403 when the caller lacks admin.manage_roles', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await permissionHandlers.GET(args())
+
+    expect(response.status).toBe(403)
+  })
+})
+
+describe('DELETE /api/v1/role-assignments/:assignmentId', () => {
+  it('revokes a role assignment after admin.manage_roles checks', async () => {
+    hoisted.parseTypeIdMock.mockReturnValue('role_asgn_123')
+
+    const response = await roleAssignmentHandlers.DELETE(
+      args(
+        { assignmentId: 'role_asgn_123' },
+        new Request('http://test/api/v1/role-assignments/role_asgn_123', { method: 'DELETE' })
+      )
+    )
+
+    expect(response.status).toBe(204)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(
+      'role_asgn_123',
+      'role_asgn',
+      'role assignment ID'
+    )
+    expect(hoisted.revokeRoleAssignmentMock).toHaveBeenCalledWith({
+      assignmentId: 'role_asgn_123',
+      actorPrincipalId: 'principal_admin',
+    })
+  })
+
+  it('returns 403 before revocation when the caller lacks admin.manage_roles', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await roleAssignmentHandlers.DELETE(
+      args(
+        { assignmentId: 'role_asgn_123' },
+        new Request('http://test/api/v1/role-assignments/role_asgn_123', { method: 'DELETE' })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.revokeRoleAssignmentMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/v1/audit-events/index.ts b/apps/web/src/routes/api/v1/audit-events/index.ts
new file mode 100644
index 000000000..8f1030431
--- /dev/null
+++ b/apps/web/src/routes/api/v1/audit-events/index.ts
@@ -0,0 +1,71 @@
+/**
+ * GET /api/v1/audit-events — paginated list of audit events.
+ *
+ * Requires API key with `audit.view` scope (or legacy compat key).
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { listAuditEvents } from '@/lib/server/domains/audit'
+import type { PrincipalId } from '@quackback/ids'
+
+const querySchema = z.object({
+  principalId: z.string().optional(),
+  action: z.string().optional(),
+  actionPrefix: z.string().optional(),
+  targetType: z.string().optional(),
+  targetId: z.string().optional(),
+  source: z.enum(['web', 'api', 'integration', 'system', 'mcp']).optional(),
+  from: z.string().datetime().optional(),
+  to: z.string().datetime().optional(),
+  cursor: z.string().optional(),
+  limit: z.coerce.number().int().min(1).max(200).optional(),
+})
+
+export const Route = createFileRoute('/api/v1/audit-events/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.AUDIT_VIEW)
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.AUDIT_VIEW)
+          if (!hasPermission(set, PERMISSIONS.AUDIT_VIEW)) {
+            return forbiddenResponse('audit.view permission required')
+          }
+          const url = new URL(request.url)
+          const params = Object.fromEntries(url.searchParams.entries())
+          const parsed = querySchema.safeParse(params)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid query parameters', { issues: parsed.error.issues })
+          }
+          const data = parsed.data
+          const page = await listAuditEvents({
+            principalId: data.principalId as PrincipalId | undefined,
+            action: data.action,
+            actionPrefix: data.actionPrefix,
+            targetType: data.targetType,
+            targetId: data.targetId,
+            source: data.source,
+            from: data.from ? new Date(data.from) : undefined,
+            to: data.to ? new Date(data.to) : undefined,
+            cursor: data.cursor,
+            limit: data.limit,
+          })
+          return successResponse(page)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/business-hours/$id.ts b/apps/web/src/routes/api/v1/business-hours/$id.ts
new file mode 100644
index 000000000..2cc81730f
--- /dev/null
+++ b/apps/web/src/routes/api/v1/business-hours/$id.ts
@@ -0,0 +1,107 @@
+/**
+ * GET    /api/v1/business-hours/:id
+ * PATCH  /api/v1/business-hours/:id
+ * DELETE /api/v1/business-hours/:id (archive)
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  notFoundResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  noContentResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  archiveBusinessHours,
+  getBusinessHours,
+  updateBusinessHours,
+} from '@/lib/server/domains/sla'
+import type { BusinessHoursId } from '@quackback/ids'
+
+const rangeSchema = z.object({
+  start: z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),
+  end: z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),
+})
+const scheduleSchema = z.object({
+  mon: z.array(rangeSchema),
+  tue: z.array(rangeSchema),
+  wed: z.array(rangeSchema),
+  thu: z.array(rangeSchema),
+  fri: z.array(rangeSchema),
+  sat: z.array(rangeSchema),
+  sun: z.array(rangeSchema),
+})
+const holidaySchema = z.object({
+  date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  label: z.string().max(200).optional(),
+})
+
+const patchSchema = z.object({
+  name: z.string().min(1).max(200).optional(),
+  timezone: z.string().min(1).max(64).optional(),
+  schedule: scheduleSchema.optional(),
+  holidays: z.array(holidaySchema).optional(),
+})
+
+export const Route = createFileRoute('/api/v1/business-hours/$id')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_VIEW)
+          if (!hasPermission(set, PERMISSIONS.SLA_VIEW)) {
+            return forbiddenResponse('sla.view permission required')
+          }
+          const id = parseTypeId<BusinessHoursId>(params.id, 'bizhrs', 'business hours ID')
+          const row = await getBusinessHours(id)
+          if (!row) return notFoundResponse('Business hours not found')
+          return successResponse(row)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.BUSINESS_HOURS_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.BUSINESS_HOURS_MANAGE)) {
+            return forbiddenResponse('business_hours.manage permission required')
+          }
+          const id = parseTypeId<BusinessHoursId>(params.id, 'bizhrs', 'business hours ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          return successResponse(await updateBusinessHours(id, parsed.data))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.BUSINESS_HOURS_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.BUSINESS_HOURS_MANAGE)) {
+            return forbiddenResponse('business_hours.manage permission required')
+          }
+          const id = parseTypeId<BusinessHoursId>(params.id, 'bizhrs', 'business hours ID')
+          await archiveBusinessHours(id)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/business-hours/__tests__/business-hours.test.ts b/apps/web/src/routes/api/v1/business-hours/__tests__/business-hours.test.ts
new file mode 100644
index 000000000..c53fe24a9
--- /dev/null
+++ b/apps/web/src/routes/api/v1/business-hours/__tests__/business-hours.test.ts
@@ -0,0 +1,267 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  listBusinessHoursMock: vi.fn(),
+  createBusinessHoursMock: vi.fn(),
+  getBusinessHoursMock: vi.fn(),
+  updateBusinessHoursMock: vi.fn(),
+  archiveBusinessHoursMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/sla', () => ({
+  listBusinessHours: (...args: unknown[]) => hoisted.listBusinessHoursMock(...args),
+  createBusinessHours: (...args: unknown[]) => hoisted.createBusinessHoursMock(...args),
+  getBusinessHours: (...args: unknown[]) => hoisted.getBusinessHoursMock(...args),
+  updateBusinessHours: (...args: unknown[]) => hoisted.updateBusinessHoursMock(...args),
+  archiveBusinessHours: (...args: unknown[]) => hoisted.archiveBusinessHoursMock(...args),
+}))
+
+import { Route as DetailRoute } from '../$id'
+import { Route as IndexRoute } from '../index'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const indexHandlers = (IndexRoute as unknown as RouteWithHandlers).options.server.handlers
+const detailHandlers = (DetailRoute as unknown as RouteWithHandlers).options.server.handlers
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  params: Record<string, string> = {},
+  request = new Request('http://test/api/v1/business-hours')
+) {
+  return { request, params }
+}
+
+async function data(response: Response) {
+  return ((await response.json()) as { data: unknown }).data
+}
+
+function schedule() {
+  return {
+    mon: [{ start: '09:00', end: '17:00' }],
+    tue: [{ start: '09:00', end: '17:00' }],
+    wed: [{ start: '09:00', end: '17:00' }],
+    thu: [{ start: '09:00', end: '17:00' }],
+    fri: [{ start: '09:00', end: '17:00' }],
+    sat: [],
+    sun: [],
+  }
+}
+
+function businessHours(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'bizhrs_support',
+    name: 'Support hours',
+    timezone: 'Europe/Berlin',
+    schedule: schedule(),
+    holidays: [],
+    archivedAt: null,
+    createdAt: new Date('2026-01-01T10:00:00.000Z'),
+    updatedAt: new Date('2026-01-01T11:00:00.000Z'),
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: 'principal_agent',
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.listBusinessHoursMock.mockResolvedValue([businessHours()])
+  hoisted.createBusinessHoursMock.mockResolvedValue(businessHours({ id: 'bizhrs_new' }))
+  hoisted.getBusinessHoursMock.mockResolvedValue(businessHours())
+  hoisted.updateBusinessHoursMock.mockResolvedValue(businessHours({ name: 'Updated hours' }))
+  hoisted.archiveBusinessHoursMock.mockResolvedValue(businessHours({ archivedAt: new Date() }))
+})
+
+describe('/api/v1/business-hours routes', () => {
+  it('lists calendars with SLA view scope, permission, and includeArchived query support', async () => {
+    const response = await indexHandlers.GET(
+      args({}, new Request('http://test/api/v1/business-hours?includeArchived=true'))
+    )
+
+    expect(response.status).toBe(200)
+    // Dates are serialized to ISO strings through the JSON response body.
+    expect(await data(response)).toEqual(JSON.parse(JSON.stringify([businessHours()])))
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.loadPermissionSetMock).toHaveBeenCalledWith('principal_agent')
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_VIEW
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(expect.any(Set), PERMISSIONS.SLA_VIEW)
+    expect(hoisted.listBusinessHoursMock).toHaveBeenCalledWith({ includeArchived: true })
+  })
+
+  it('creates calendars after business-hours manage checks and rejects invalid create bodies', async () => {
+    const body = {
+      name: 'Support hours',
+      timezone: 'Europe/Berlin',
+      schedule: schedule(),
+      holidays: [{ date: '2026-12-25', label: 'Christmas' }],
+    }
+
+    const response = await indexHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/business-hours', 'POST', body))
+    )
+
+    expect(response.status).toBe(201)
+    expect(await data(response)).toMatchObject({ id: 'bizhrs_new' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.BUSINESS_HOURS_MANAGE
+    )
+    expect(hoisted.createBusinessHoursMock).toHaveBeenCalledWith(body)
+
+    vi.clearAllMocks()
+    hoisted.withApiKeyAuthMock.mockResolvedValue({ principalId: 'principal_agent', role: 'team' })
+    hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+    hoisted.hasPermissionMock.mockReturnValue(true)
+
+    const invalid = await indexHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/business-hours', 'POST', {
+          name: '',
+          schedule: { mon: [{ start: '99:99', end: '17:00' }] },
+        })
+      )
+    )
+    expect(invalid.status).toBe(400)
+    expect(hoisted.createBusinessHoursMock).not.toHaveBeenCalled()
+  })
+
+  it('gets, patches, archives, and returns not found for one calendar', async () => {
+    hoisted.parseTypeIdMock.mockReturnValue('bizhrs_support')
+
+    const getResponse = await detailHandlers.GET(
+      args(
+        { id: 'bizhrs_support' },
+        new Request('http://test/api/v1/business-hours/bizhrs_support')
+      )
+    )
+    expect(getResponse.status).toBe(200)
+    expect(await data(getResponse)).toMatchObject({ id: 'bizhrs_support' })
+    expect(hoisted.getBusinessHoursMock).toHaveBeenCalledWith('bizhrs_support')
+
+    hoisted.getBusinessHoursMock.mockResolvedValueOnce(null)
+    const missing = await detailHandlers.GET(
+      args(
+        { id: 'bizhrs_missing' },
+        new Request('http://test/api/v1/business-hours/bizhrs_missing')
+      )
+    )
+    expect(missing.status).toBe(404)
+
+    const patchBody = {
+      name: 'Updated hours',
+      timezone: 'Europe/London',
+      holidays: [{ date: '2026-01-01' }],
+    }
+    const patchResponse = await detailHandlers.PATCH(
+      args(
+        { id: 'bizhrs_support' },
+        jsonRequest('http://test/api/v1/business-hours/bizhrs_support', 'PATCH', patchBody)
+      )
+    )
+    expect(patchResponse.status).toBe(200)
+    expect(await data(patchResponse)).toMatchObject({ name: 'Updated hours' })
+    expect(hoisted.updateBusinessHoursMock).toHaveBeenCalledWith('bizhrs_support', patchBody)
+
+    const deleteResponse = await detailHandlers.DELETE(
+      args(
+        { id: 'bizhrs_support' },
+        new Request('http://test/api/v1/business-hours/bizhrs_support', { method: 'DELETE' })
+      )
+    )
+    expect(deleteResponse.status).toBe(204)
+    expect(hoisted.archiveBusinessHoursMock).toHaveBeenCalledWith('bizhrs_support')
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(
+      'bizhrs_support',
+      'bizhrs',
+      'business hours ID'
+    )
+  })
+
+  it('rejects invalid patch bodies before mutating', async () => {
+    const response = await detailHandlers.PATCH(
+      args(
+        { id: 'bizhrs_support' },
+        jsonRequest('http://test/api/v1/business-hours/bizhrs_support', 'PATCH', {
+          timezone: '',
+          holidays: [{ date: 'tomorrow' }],
+        })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.updateBusinessHoursMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 before service calls when route-level permissions are missing', async () => {
+    const cases = [
+      [indexHandlers.GET, args()],
+      [indexHandlers.POST, args({}, jsonRequest('http://test/api/v1/business-hours', 'POST', {}))],
+      [detailHandlers.GET, args({ id: 'bizhrs_support' })],
+      [
+        detailHandlers.PATCH,
+        args(
+          { id: 'bizhrs_support' },
+          jsonRequest('http://test/api/v1/business-hours/bizhrs_support', 'PATCH', {})
+        ),
+      ],
+      [detailHandlers.DELETE, args({ id: 'bizhrs_support' })],
+    ] as const
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    for (const [handler, handlerArgs] of cases) {
+      const response = await handler(handlerArgs)
+      expect(response.status).toBe(403)
+    }
+
+    expect(hoisted.listBusinessHoursMock).not.toHaveBeenCalled()
+    expect(hoisted.createBusinessHoursMock).not.toHaveBeenCalled()
+    expect(hoisted.getBusinessHoursMock).not.toHaveBeenCalled()
+    expect(hoisted.updateBusinessHoursMock).not.toHaveBeenCalled()
+    expect(hoisted.archiveBusinessHoursMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/v1/business-hours/index.ts b/apps/web/src/routes/api/v1/business-hours/index.ts
new file mode 100644
index 000000000..c51925093
--- /dev/null
+++ b/apps/web/src/routes/api/v1/business-hours/index.ts
@@ -0,0 +1,83 @@
+/**
+ * GET  /api/v1/business-hours — list calendars
+ * POST /api/v1/business-hours — create calendar
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createBusinessHours, listBusinessHours } from '@/lib/server/domains/sla'
+
+const rangeSchema = z.object({
+  start: z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),
+  end: z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),
+})
+const scheduleSchema = z.object({
+  mon: z.array(rangeSchema),
+  tue: z.array(rangeSchema),
+  wed: z.array(rangeSchema),
+  thu: z.array(rangeSchema),
+  fri: z.array(rangeSchema),
+  sat: z.array(rangeSchema),
+  sun: z.array(rangeSchema),
+})
+const holidaySchema = z.object({
+  date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  label: z.string().max(200).optional(),
+})
+
+const createSchema = z.object({
+  name: z.string().min(1).max(200),
+  timezone: z.string().min(1).max(64).optional(),
+  schedule: scheduleSchema,
+  holidays: z.array(holidaySchema).optional(),
+})
+
+export const Route = createFileRoute('/api/v1/business-hours/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_VIEW)
+          if (!hasPermission(set, PERMISSIONS.SLA_VIEW)) {
+            return forbiddenResponse('sla.view permission required')
+          }
+          const url = new URL(request.url)
+          const includeArchived = url.searchParams.get('includeArchived') === 'true'
+          return successResponse(await listBusinessHours({ includeArchived }))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.BUSINESS_HOURS_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.BUSINESS_HOURS_MANAGE)) {
+            return forbiddenResponse('business_hours.manage permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const row = await createBusinessHours(parsed.data)
+          return createdResponse(row)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/contacts/$contactId.links.ts b/apps/web/src/routes/api/v1/contacts/$contactId.links.ts
new file mode 100644
index 000000000..700187a8e
--- /dev/null
+++ b/apps/web/src/routes/api/v1/contacts/$contactId.links.ts
@@ -0,0 +1,108 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  noContentResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  linkContactToUser,
+  listLinksForContact,
+  unlinkContactFromUser,
+} from '@/lib/server/domains/organizations'
+import { recordEvent } from '@/lib/server/domains/audit'
+import type { ContactId, UserId } from '@quackback/ids'
+
+const linkSchema = z.object({ userId: z.string().min(1) })
+
+export const Route = createFileRoute('/api/v1/contacts/$contactId/links')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_VIEW)
+          if (!hasPermission(set, PERMISSIONS.ORG_VIEW)) {
+            return forbiddenResponse('org.view permission required')
+          }
+          const id = parseTypeId<ContactId>(params.contactId, 'contact', 'contact ID')
+          const links = await listLinksForContact(id)
+          return successResponse(links)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ORG_MANAGE)) {
+            return forbiddenResponse('org.manage permission required')
+          }
+          const id = parseTypeId<ContactId>(params.contactId, 'contact', 'contact ID')
+          const body = await request.json().catch(() => null)
+          const parsed = linkSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const userId = parseTypeId<UserId>(parsed.data.userId, 'user', 'user ID')
+          const link = await linkContactToUser(
+            {
+              contactId: id,
+              userId,
+              linkedByPrincipalId: auth.principalId,
+            },
+            { principalId: auth.principalId }
+          )
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'contact.linked_user',
+            targetType: 'contact',
+            targetId: id,
+            source: 'api',
+            diff: { context: { userId } },
+          })
+          return createdResponse(link)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ORG_MANAGE)) {
+            return forbiddenResponse('org.manage permission required')
+          }
+          const id = parseTypeId<ContactId>(params.contactId, 'contact', 'contact ID')
+          const url = new URL(request.url)
+          const userIdParam = url.searchParams.get('userId')
+          if (!userIdParam) return badRequestResponse('userId query param required')
+          const userId = parseTypeId<UserId>(userIdParam, 'user', 'user ID')
+          await unlinkContactFromUser(id, userId, { principalId: auth.principalId })
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'contact.unlinked_user',
+            targetType: 'contact',
+            targetId: id,
+            source: 'api',
+            diff: { context: { userId } },
+          })
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/contacts/$contactId.ts b/apps/web/src/routes/api/v1/contacts/$contactId.ts
new file mode 100644
index 000000000..3e7565d45
--- /dev/null
+++ b/apps/web/src/routes/api/v1/contacts/$contactId.ts
@@ -0,0 +1,111 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  noContentResponse,
+  notFoundResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { archiveContact, getContact, updateContact } from '@/lib/server/domains/organizations'
+import { recordEvent } from '@/lib/server/domains/audit'
+import type { ContactId, OrganizationId } from '@quackback/ids'
+
+const patchSchema = z.object({
+  name: z.string().min(1).max(200).nullable().optional(),
+  email: z.string().max(320).nullable().optional(),
+  phone: z.string().max(64).nullable().optional(),
+  title: z.string().max(120).nullable().optional(),
+  externalId: z.string().max(255).nullable().optional(),
+  organizationId: z.string().min(1).nullable().optional(),
+  avatarUrl: z.string().max(2048).nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/contacts/$contactId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_VIEW)
+          if (!hasPermission(set, PERMISSIONS.ORG_VIEW)) {
+            return forbiddenResponse('org.view permission required')
+          }
+          const id = parseTypeId<ContactId>(params.contactId, 'contact', 'contact ID')
+          const contact = await getContact(id)
+          if (!contact) return notFoundResponse('Contact not found')
+          return successResponse(contact)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ORG_MANAGE)) {
+            return forbiddenResponse('org.manage permission required')
+          }
+          const id = parseTypeId<ContactId>(params.contactId, 'contact', 'contact ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const before = await getContact(id)
+          const contact = await updateContact(
+            id,
+            {
+              ...parsed.data,
+              organizationId: parsed.data.organizationId as OrganizationId | null | undefined,
+            },
+            { principalId: auth.principalId }
+          )
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'contact.updated',
+            targetType: 'contact',
+            targetId: contact.id,
+            source: 'api',
+            diff: {
+              before: before ? { name: before.name, email: before.email } : undefined,
+              after: { name: contact.name, email: contact.email },
+            },
+          })
+          return successResponse(contact)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ORG_MANAGE)) {
+            return forbiddenResponse('org.manage permission required')
+          }
+          const id = parseTypeId<ContactId>(params.contactId, 'contact', 'contact ID')
+          await archiveContact(id, { principalId: auth.principalId })
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'contact.archived',
+            targetType: 'contact',
+            targetId: id,
+            source: 'api',
+          })
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/contacts/__tests__/contacts.coverage.test.ts b/apps/web/src/routes/api/v1/contacts/__tests__/contacts.coverage.test.ts
new file mode 100644
index 000000000..e541cecef
--- /dev/null
+++ b/apps/web/src/routes/api/v1/contacts/__tests__/contacts.coverage.test.ts
@@ -0,0 +1,590 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { decodeCursor, encodeCursor } from '@/lib/server/domains/api/responses'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  searchContactsMock: vi.fn(),
+  createContactMock: vi.fn(),
+  getContactMock: vi.fn(),
+  updateContactMock: vi.fn(),
+  archiveContactMock: vi.fn(),
+  linkContactToUserMock: vi.fn(),
+  listLinksForContactMock: vi.fn(),
+  unlinkContactFromUserMock: vi.fn(),
+  recordEventMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/organizations', () => ({
+  searchContacts: (...args: unknown[]) => hoisted.searchContactsMock(...args),
+  createContact: (...args: unknown[]) => hoisted.createContactMock(...args),
+  getContact: (...args: unknown[]) => hoisted.getContactMock(...args),
+  updateContact: (...args: unknown[]) => hoisted.updateContactMock(...args),
+  archiveContact: (...args: unknown[]) => hoisted.archiveContactMock(...args),
+  linkContactToUser: (...args: unknown[]) => hoisted.linkContactToUserMock(...args),
+  listLinksForContact: (...args: unknown[]) => hoisted.listLinksForContactMock(...args),
+  unlinkContactFromUser: (...args: unknown[]) => hoisted.unlinkContactFromUserMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.recordEventMock(...args),
+}))
+
+import { Route as ContactsRoute } from '../index'
+import { Route as ContactDetailRoute } from '../$contactId'
+import { Route as ContactLinksRoute } from '../$contactId.links'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const contactHandlers = (ContactsRoute as unknown as RouteWithHandlers).options.server.handlers
+const contactDetailHandlers = (ContactDetailRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const contactLinksHandlers = (ContactLinksRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+
+const PRINCIPAL = 'principal_admin'
+const CONTACT = 'contact_123'
+const USER = 'user_123'
+const ORG = 'org_123'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/contacts')
+) {
+  return { request, params: handlerParams }
+}
+
+function contact(overrides: Record<string, unknown> = {}) {
+  return {
+    id: CONTACT,
+    name: 'Ada Lovelace',
+    email: 'ada@example.com',
+    phone: null,
+    title: null,
+    organizationId: null,
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.recordEventMock.mockResolvedValue(undefined)
+})
+
+describe('/api/v1/contacts collection routes', () => {
+  it('lists contacts with default query params and no further page', async () => {
+    const row = contact()
+    // Single item, limit 25 → items.length (1) <= limit so hasMore is false.
+    hoisted.searchContactsMock.mockResolvedValue([row])
+
+    const response = await contactHandlers.GET(args())
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual([row])
+
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_VIEW
+    )
+    // No query string → query/email/organizationId undefined, includeArchived false,
+    // offset 0 (no cursor), limit default 25 → searchContacts asked for limit + 1.
+    expect(hoisted.searchContactsMock).toHaveBeenCalledWith({
+      query: undefined,
+      email: undefined,
+      organizationId: undefined,
+      includeArchived: false,
+      limit: 26,
+      offset: 0,
+    })
+
+    const body = await (await contactHandlers.GET(args())).json()
+    expect(body.meta.pagination).toEqual({ cursor: null, hasMore: false })
+  })
+
+  it('applies query params, decodes cursor, and returns a next cursor when more remain', async () => {
+    // Request limit 2 with a cursor encoding offset 4. The service returns 3 rows
+    // (limit + 1) so hasMore is true: the page is sliced to 2 and a next cursor is set.
+    const rows = [
+      contact({ id: 'contact_a' }),
+      contact({ id: 'contact_b' }),
+      contact({ id: 'contact_c' }),
+    ]
+    hoisted.searchContactsMock.mockResolvedValue(rows)
+
+    const cursor = encodeCursor(4)
+    const url =
+      `http://test/api/v1/contacts?q=ada&email=ada@example.com&organizationId=${ORG}` +
+      `&includeArchived=true&limit=2&cursor=${cursor}`
+    const response = await contactHandlers.GET(args({}, new Request(url)))
+    expect(response.status).toBe(200)
+
+    expect(hoisted.searchContactsMock).toHaveBeenCalledWith({
+      query: 'ada',
+      email: 'ada@example.com',
+      organizationId: ORG,
+      includeArchived: true,
+      limit: 3,
+      offset: 4,
+    })
+
+    const body = await response.json()
+    expect(body.data).toHaveLength(2)
+    expect(body.meta.pagination.hasMore).toBe(true)
+    // Next offset = previous offset (4) + limit (2) = 6.
+    expect(decodeCursor(body.meta.pagination.cursor)).toBe(6)
+  })
+
+  it('caps the limit at 100', async () => {
+    hoisted.searchContactsMock.mockResolvedValue([])
+    const response = await contactHandlers.GET(
+      args({}, new Request('http://test/api/v1/contacts?limit=500'))
+    )
+    expect(response.status).toBe(200)
+    // limit capped at 100 → service asked for 101.
+    expect(hoisted.searchContactsMock).toHaveBeenCalledWith(expect.objectContaining({ limit: 101 }))
+  })
+
+  it('denies listing without org.view permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await contactHandlers.GET(args())
+    expect(response.status).toBe(403)
+    expect(hoisted.searchContactsMock).not.toHaveBeenCalled()
+  })
+
+  it('creates a contact and records an audit event', async () => {
+    const row = contact()
+    hoisted.createContactMock.mockResolvedValue(row)
+
+    const response = await contactHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/contacts', 'POST', {
+          name: 'Ada Lovelace',
+          email: 'ada@example.com',
+          organizationId: ORG,
+        })
+      )
+    )
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(row)
+
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_MANAGE
+    )
+    expect(hoisted.createContactMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'Ada Lovelace',
+        email: 'ada@example.com',
+        organizationId: ORG,
+      }),
+      { principalId: PRINCIPAL }
+    )
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principalId: PRINCIPAL,
+        action: 'contact.created',
+        targetType: 'contact',
+        targetId: row.id,
+        source: 'api',
+        diff: { after: { name: row.name, email: row.email } },
+      })
+    )
+  })
+
+  it('denies creating without org.manage permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await contactHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/contacts', 'POST', { name: 'Ada' }))
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.createContactMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects an invalid create body before calling the service', async () => {
+    // name min length is 1 → empty string fails the zod schema.
+    const response = await contactHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/contacts', 'POST', { name: '' }))
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.createContactMock).not.toHaveBeenCalled()
+  })
+
+  it('treats unparseable JSON as a 400 on create', async () => {
+    // request.json() rejects → caught as null → safeParse(null) fails the object schema.
+    const badRequest = new Request('http://test/api/v1/contacts', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+    const response = await contactHandlers.POST(args({}, badRequest))
+    expect(response.status).toBe(400)
+    expect(hoisted.createContactMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown errors through handleDomainError on list and create', async () => {
+    // A bare Error has no `code`/`statusCode` → handleDomainError falls back to 500.
+    hoisted.searchContactsMock.mockRejectedValue(new Error('boom'))
+    const listResponse = await contactHandlers.GET(args())
+    expect(listResponse.status).toBe(500)
+
+    hoisted.createContactMock.mockRejectedValue(new Error('boom'))
+    const createResponse = await contactHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/contacts', 'POST', { name: 'Ada' }))
+    )
+    expect(createResponse.status).toBe(500)
+  })
+})
+
+describe('/api/v1/contacts/$contactId detail routes', () => {
+  it('gets a contact by id', async () => {
+    const row = contact()
+    hoisted.getContactMock.mockResolvedValue(row)
+
+    const response = await contactDetailHandlers.GET(args({ contactId: CONTACT }))
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(row)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_VIEW
+    )
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(CONTACT, 'contact', 'contact ID')
+    expect(hoisted.getContactMock).toHaveBeenCalledWith(CONTACT)
+  })
+
+  it('returns 404 when the contact does not exist', async () => {
+    hoisted.getContactMock.mockResolvedValue(null)
+    const response = await contactDetailHandlers.GET(args({ contactId: CONTACT }))
+    expect(response.status).toBe(404)
+  })
+
+  it('denies getting a contact without org.view permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await contactDetailHandlers.GET(args({ contactId: CONTACT }))
+    expect(response.status).toBe(403)
+    expect(hoisted.getContactMock).not.toHaveBeenCalled()
+  })
+
+  it('patches a contact and records the before/after diff', async () => {
+    const before = contact({ name: 'Old name', email: 'old@example.com' })
+    const after = contact({ name: 'New name', email: 'new@example.com' })
+    hoisted.getContactMock.mockResolvedValue(before)
+    hoisted.updateContactMock.mockResolvedValue(after)
+
+    const response = await contactDetailHandlers.PATCH(
+      args(
+        { contactId: CONTACT },
+        jsonRequest('http://test/api/v1/contacts/contact_123', 'PATCH', {
+          name: 'New name',
+          organizationId: ORG,
+        })
+      )
+    )
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(after)
+
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_MANAGE
+    )
+    expect(hoisted.updateContactMock).toHaveBeenCalledWith(
+      CONTACT,
+      expect.objectContaining({ name: 'New name', organizationId: ORG }),
+      { principalId: PRINCIPAL }
+    )
+    // before is truthy → diff.before populated.
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'contact.updated',
+        diff: {
+          before: { name: 'Old name', email: 'old@example.com' },
+          after: { name: 'New name', email: 'new@example.com' },
+        },
+      })
+    )
+  })
+
+  it('patches when the prior contact lookup returns null (diff.before undefined)', async () => {
+    const after = contact({ name: 'New name' })
+    hoisted.getContactMock.mockResolvedValue(null)
+    hoisted.updateContactMock.mockResolvedValue(after)
+
+    const response = await contactDetailHandlers.PATCH(
+      args(
+        { contactId: CONTACT },
+        jsonRequest('http://test/api/v1/contacts/contact_123', 'PATCH', { name: 'New name' })
+      )
+    )
+    expect(response.status).toBe(200)
+    // before is null → ternary yields undefined for diff.before.
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        diff: { before: undefined, after: { name: after.name, email: after.email } },
+      })
+    )
+  })
+
+  it('denies patching without org.manage permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await contactDetailHandlers.PATCH(
+      args(
+        { contactId: CONTACT },
+        jsonRequest('http://test/api/v1/contacts/contact_123', 'PATCH', { name: 'X' })
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.updateContactMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects an invalid patch body before calling the service', async () => {
+    const response = await contactDetailHandlers.PATCH(
+      args(
+        { contactId: CONTACT },
+        jsonRequest('http://test/api/v1/contacts/contact_123', 'PATCH', { name: '' })
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.updateContactMock).not.toHaveBeenCalled()
+  })
+
+  it('archives a contact and records an audit event', async () => {
+    hoisted.archiveContactMock.mockResolvedValue(undefined)
+
+    const response = await contactDetailHandlers.DELETE(args({ contactId: CONTACT }))
+    expect(response.status).toBe(204)
+    expect(hoisted.archiveContactMock).toHaveBeenCalledWith(CONTACT, { principalId: PRINCIPAL })
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'contact.archived',
+        targetType: 'contact',
+        targetId: CONTACT,
+        source: 'api',
+      })
+    )
+  })
+
+  it('denies archiving without org.manage permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await contactDetailHandlers.DELETE(args({ contactId: CONTACT }))
+    expect(response.status).toBe(403)
+    expect(hoisted.archiveContactMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown errors through handleDomainError on get, patch, and delete', async () => {
+    hoisted.getContactMock.mockRejectedValueOnce(new Error('boom'))
+    expect((await contactDetailHandlers.GET(args({ contactId: CONTACT }))).status).toBe(500)
+
+    hoisted.updateContactMock.mockRejectedValueOnce(new Error('boom'))
+    expect(
+      (
+        await contactDetailHandlers.PATCH(
+          args(
+            { contactId: CONTACT },
+            jsonRequest('http://test/api/v1/contacts/contact_123', 'PATCH', { name: 'X' })
+          )
+        )
+      ).status
+    ).toBe(500)
+
+    hoisted.archiveContactMock.mockRejectedValueOnce(new Error('boom'))
+    expect((await contactDetailHandlers.DELETE(args({ contactId: CONTACT }))).status).toBe(500)
+  })
+})
+
+describe('/api/v1/contacts/$contactId/links routes', () => {
+  it('lists links for a contact', async () => {
+    const links = [{ contactId: CONTACT, userId: USER }]
+    hoisted.listLinksForContactMock.mockResolvedValue(links)
+
+    const response = await contactLinksHandlers.GET(args({ contactId: CONTACT }))
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(links)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_VIEW
+    )
+    expect(hoisted.listLinksForContactMock).toHaveBeenCalledWith(CONTACT)
+  })
+
+  it('denies listing links without org.view permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await contactLinksHandlers.GET(args({ contactId: CONTACT }))
+    expect(response.status).toBe(403)
+    expect(hoisted.listLinksForContactMock).not.toHaveBeenCalled()
+  })
+
+  it('links a contact to a user and records an audit event', async () => {
+    const link = { contactId: CONTACT, userId: USER }
+    hoisted.linkContactToUserMock.mockResolvedValue(link)
+
+    const response = await contactLinksHandlers.POST(
+      args(
+        { contactId: CONTACT },
+        jsonRequest('http://test/api/v1/contacts/contact_123/links', 'POST', { userId: USER })
+      )
+    )
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(link)
+
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_MANAGE
+    )
+    // parseTypeId is invoked for both the contact id and the user id.
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(CONTACT, 'contact', 'contact ID')
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(USER, 'user', 'user ID')
+    expect(hoisted.linkContactToUserMock).toHaveBeenCalledWith(
+      { contactId: CONTACT, userId: USER, linkedByPrincipalId: PRINCIPAL },
+      { principalId: PRINCIPAL }
+    )
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'contact.linked_user',
+        targetId: CONTACT,
+        diff: { context: { userId: USER } },
+      })
+    )
+  })
+
+  it('denies linking without org.manage permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await contactLinksHandlers.POST(
+      args(
+        { contactId: CONTACT },
+        jsonRequest('http://test/api/v1/contacts/contact_123/links', 'POST', { userId: USER })
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects an invalid link body before calling the service', async () => {
+    // userId min length is 1 → empty string fails the zod schema.
+    const response = await contactLinksHandlers.POST(
+      args(
+        { contactId: CONTACT },
+        jsonRequest('http://test/api/v1/contacts/contact_123/links', 'POST', { userId: '' })
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.linkContactToUserMock).not.toHaveBeenCalled()
+  })
+
+  it('unlinks a contact from a user and records an audit event', async () => {
+    hoisted.unlinkContactFromUserMock.mockResolvedValue(undefined)
+
+    const response = await contactLinksHandlers.DELETE(
+      args(
+        { contactId: CONTACT },
+        new Request(`http://test/api/v1/contacts/contact_123/links?userId=${USER}`)
+      )
+    )
+    expect(response.status).toBe(204)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(USER, 'user', 'user ID')
+    expect(hoisted.unlinkContactFromUserMock).toHaveBeenCalledWith(CONTACT, USER, {
+      principalId: PRINCIPAL,
+    })
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'contact.unlinked_user',
+        targetId: CONTACT,
+        diff: { context: { userId: USER } },
+      })
+    )
+  })
+
+  it('returns 400 when the userId query param is missing on unlink', async () => {
+    const response = await contactLinksHandlers.DELETE(
+      args({ contactId: CONTACT }, new Request('http://test/api/v1/contacts/contact_123/links'))
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.unlinkContactFromUserMock).not.toHaveBeenCalled()
+  })
+
+  it('denies unlinking without org.manage permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await contactLinksHandlers.DELETE(
+      args(
+        { contactId: CONTACT },
+        new Request(`http://test/api/v1/contacts/contact_123/links?userId=${USER}`)
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.unlinkContactFromUserMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown errors through handleDomainError on list, link, and unlink', async () => {
+    hoisted.listLinksForContactMock.mockRejectedValueOnce(new Error('boom'))
+    expect((await contactLinksHandlers.GET(args({ contactId: CONTACT }))).status).toBe(500)
+
+    hoisted.linkContactToUserMock.mockRejectedValueOnce(new Error('boom'))
+    expect(
+      (
+        await contactLinksHandlers.POST(
+          args(
+            { contactId: CONTACT },
+            jsonRequest('http://test/api/v1/contacts/contact_123/links', 'POST', { userId: USER })
+          )
+        )
+      ).status
+    ).toBe(500)
+
+    hoisted.unlinkContactFromUserMock.mockRejectedValueOnce(new Error('boom'))
+    expect(
+      (
+        await contactLinksHandlers.DELETE(
+          args(
+            { contactId: CONTACT },
+            new Request(`http://test/api/v1/contacts/contact_123/links?userId=${USER}`)
+          )
+        )
+      ).status
+    ).toBe(500)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/contacts/index.ts b/apps/web/src/routes/api/v1/contacts/index.ts
new file mode 100644
index 000000000..baf71ada9
--- /dev/null
+++ b/apps/web/src/routes/api/v1/contacts/index.ts
@@ -0,0 +1,101 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+  decodeCursor,
+  encodeCursor,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createContact, searchContacts } from '@/lib/server/domains/organizations'
+import { recordEvent } from '@/lib/server/domains/audit'
+import type { OrganizationId } from '@quackback/ids'
+
+const createSchema = z.object({
+  name: z.string().min(1).max(200).nullable().optional(),
+  email: z.string().max(320).nullable().optional(),
+  phone: z.string().max(64).nullable().optional(),
+  title: z.string().max(120).nullable().optional(),
+  externalId: z.string().max(255).nullable().optional(),
+  organizationId: z.string().min(1).nullable().optional(),
+  avatarUrl: z.string().max(2048).nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/contacts/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_VIEW)
+          if (!hasPermission(set, PERMISSIONS.ORG_VIEW)) {
+            return forbiddenResponse('org.view permission required')
+          }
+          const url = new URL(request.url)
+          const query = url.searchParams.get('q') ?? undefined
+          const email = url.searchParams.get('email') ?? undefined
+          const organizationId = (url.searchParams.get('organizationId') ?? undefined) as
+            | OrganizationId
+            | undefined
+          const includeArchived = url.searchParams.get('includeArchived') === 'true'
+          const cursor = url.searchParams.get('cursor') ?? undefined
+          const limit = Math.min(parseInt(url.searchParams.get('limit') || '25', 10), 100)
+          const offset = decodeCursor(cursor)
+          const items = await searchContacts({
+            query,
+            email,
+            organizationId,
+            includeArchived,
+            limit: limit + 1,
+            offset,
+          })
+          const hasMore = items.length > limit
+          const page = hasMore ? items.slice(0, limit) : items
+          const nextCursor = hasMore ? encodeCursor(offset + limit) : null
+          return successResponse(page, { pagination: { cursor: nextCursor, hasMore } })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ORG_MANAGE)) {
+            return forbiddenResponse('org.manage permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const contact = await createContact(
+            {
+              ...parsed.data,
+              organizationId: parsed.data.organizationId as OrganizationId | null | undefined,
+            },
+            { principalId: auth.principalId }
+          )
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'contact.created',
+            targetType: 'contact',
+            targetId: contact.id,
+            source: 'api',
+            diff: { after: { name: contact.name, email: contact.email } },
+          })
+          return createdResponse(contact)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/inboxes/$inboxId.channels.$channelId.ts b/apps/web/src/routes/api/v1/inboxes/$inboxId.channels.$channelId.ts
new file mode 100644
index 000000000..0e609235b
--- /dev/null
+++ b/apps/web/src/routes/api/v1/inboxes/$inboxId.channels.$channelId.ts
@@ -0,0 +1,67 @@
+/**
+ * PATCH  /api/v1/inboxes/:inboxId/channels/:channelId
+ * DELETE /api/v1/inboxes/:inboxId/channels/:channelId — archive
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  noContentResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { archiveInboxChannel, updateInboxChannel } from '@/lib/server/domains/inboxes'
+import type { InboxChannelId } from '@quackback/ids'
+
+const patchSchema = z.object({
+  label: z.string().min(1).max(200).optional(),
+  config: z.record(z.string(), z.unknown()).optional(),
+  externalId: z.string().max(200).nullable().optional(),
+  enabled: z.boolean().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/inboxes/$inboxId/channels/$channelId')({
+  server: {
+    handlers: {
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_CHANNEL_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_CHANNEL_MANAGE)) {
+            return forbiddenResponse('inbox.channel.manage permission required')
+          }
+          const id = parseTypeId<InboxChannelId>(params.channelId, 'inbox_ch', 'channel ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          return successResponse(await updateInboxChannel(id, parsed.data as never))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_CHANNEL_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_CHANNEL_MANAGE)) {
+            return forbiddenResponse('inbox.channel.manage permission required')
+          }
+          const id = parseTypeId<InboxChannelId>(params.channelId, 'inbox_ch', 'channel ID')
+          await archiveInboxChannel(id)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/inboxes/$inboxId.channels.ts b/apps/web/src/routes/api/v1/inboxes/$inboxId.channels.ts
new file mode 100644
index 000000000..3c33c53ab
--- /dev/null
+++ b/apps/web/src/routes/api/v1/inboxes/$inboxId.channels.ts
@@ -0,0 +1,69 @@
+/**
+ * GET  /api/v1/inboxes/:inboxId/channels — list channels
+ * POST /api/v1/inboxes/:inboxId/channels — add channel
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { addInboxChannel, listChannelsForInbox } from '@/lib/server/domains/inboxes'
+import { INBOX_CHANNEL_KINDS } from '@/lib/server/db'
+import type { InboxId } from '@quackback/ids'
+
+const addSchema = z.object({
+  kind: z.enum(INBOX_CHANNEL_KINDS),
+  label: z.string().min(1).max(200),
+  config: z.record(z.string(), z.unknown()).optional(),
+  externalId: z.string().max(200).nullable().optional(),
+  enabled: z.boolean().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/inboxes/$inboxId/channels')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_VIEW)
+          if (!hasPermission(set, PERMISSIONS.INBOX_VIEW)) {
+            return forbiddenResponse('inbox.view permission required')
+          }
+          const id = parseTypeId<InboxId>(params.inboxId, 'inbox', 'inbox ID')
+          return successResponse(await listChannelsForInbox(id))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_CHANNEL_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_CHANNEL_MANAGE)) {
+            return forbiddenResponse('inbox.channel.manage permission required')
+          }
+          const inboxId = parseTypeId<InboxId>(params.inboxId, 'inbox', 'inbox ID')
+          const body = await request.json().catch(() => null)
+          const parsed = addSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const channel = await addInboxChannel({ inboxId, ...parsed.data } as never)
+          return createdResponse(channel)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/inboxes/$inboxId.memberships.$membershipId.ts b/apps/web/src/routes/api/v1/inboxes/$inboxId.memberships.$membershipId.ts
new file mode 100644
index 000000000..3052baf31
--- /dev/null
+++ b/apps/web/src/routes/api/v1/inboxes/$inboxId.memberships.$membershipId.ts
@@ -0,0 +1,71 @@
+/**
+ * PATCH  /api/v1/inboxes/:inboxId/memberships/:membershipId — change role
+ * DELETE /api/v1/inboxes/:inboxId/memberships/:membershipId
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  noContentResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { removeInboxMembership, updateInboxMembershipRole } from '@/lib/server/domains/inboxes'
+import { INBOX_MEMBERSHIP_ROLES } from '@/lib/server/db'
+import type { InboxMembershipId } from '@quackback/ids'
+
+const patchSchema = z.object({ role: z.enum(INBOX_MEMBERSHIP_ROLES) })
+
+export const Route = createFileRoute('/api/v1/inboxes/$inboxId/memberships/$membershipId')({
+  server: {
+    handlers: {
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_MANAGE)) {
+            return forbiddenResponse('inbox.manage permission required')
+          }
+          const id = parseTypeId<InboxMembershipId>(
+            params.membershipId,
+            'inbox_mem',
+            'membership ID'
+          )
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          return successResponse(await updateInboxMembershipRole(id, parsed.data.role))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_MANAGE)) {
+            return forbiddenResponse('inbox.manage permission required')
+          }
+          const id = parseTypeId<InboxMembershipId>(
+            params.membershipId,
+            'inbox_mem',
+            'membership ID'
+          )
+          await removeInboxMembership(id)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/inboxes/$inboxId.memberships.ts b/apps/web/src/routes/api/v1/inboxes/$inboxId.memberships.ts
new file mode 100644
index 000000000..ba6d9a069
--- /dev/null
+++ b/apps/web/src/routes/api/v1/inboxes/$inboxId.memberships.ts
@@ -0,0 +1,70 @@
+/**
+ * GET  /api/v1/inboxes/:inboxId/memberships
+ * POST /api/v1/inboxes/:inboxId/memberships
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { addInboxMembership, listMembershipsForInbox } from '@/lib/server/domains/inboxes'
+import { INBOX_MEMBERSHIP_ROLES } from '@/lib/server/db'
+import type { InboxId, PrincipalId } from '@quackback/ids'
+
+const addSchema = z.object({
+  principalId: z.string().min(1),
+  role: z.enum(INBOX_MEMBERSHIP_ROLES),
+})
+
+export const Route = createFileRoute('/api/v1/inboxes/$inboxId/memberships')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_VIEW)
+          if (!hasPermission(set, PERMISSIONS.INBOX_VIEW)) {
+            return forbiddenResponse('inbox.view permission required')
+          }
+          const id = parseTypeId<InboxId>(params.inboxId, 'inbox', 'inbox ID')
+          return successResponse(await listMembershipsForInbox(id))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_MANAGE)) {
+            return forbiddenResponse('inbox.manage permission required')
+          }
+          const inboxId = parseTypeId<InboxId>(params.inboxId, 'inbox', 'inbox ID')
+          const body = await request.json().catch(() => null)
+          const parsed = addSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const m = await addInboxMembership({
+            inboxId,
+            principalId: parsed.data.principalId as PrincipalId,
+            role: parsed.data.role,
+          })
+          return createdResponse(m)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/inboxes/$inboxId.ts b/apps/web/src/routes/api/v1/inboxes/$inboxId.ts
new file mode 100644
index 000000000..7335c72e4
--- /dev/null
+++ b/apps/web/src/routes/api/v1/inboxes/$inboxId.ts
@@ -0,0 +1,93 @@
+/**
+ * GET    /api/v1/inboxes/:inboxId
+ * PATCH  /api/v1/inboxes/:inboxId
+ * DELETE /api/v1/inboxes/:inboxId — archive
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  notFoundResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  noContentResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { archiveInbox, getInbox, updateInbox } from '@/lib/server/domains/inboxes'
+import { TICKET_PRIORITIES, TICKET_VISIBILITY_SCOPES } from '@/lib/server/db'
+import type { InboxId } from '@quackback/ids'
+
+const patchSchema = z.object({
+  name: z.string().min(1).max(200).optional(),
+  description: z.string().max(1000).nullable().optional(),
+  primaryTeamId: z.string().nullable().optional(),
+  defaultVisibilityScope: z.enum(TICKET_VISIBILITY_SCOPES).optional(),
+  defaultPriority: z.enum(TICKET_PRIORITIES).optional(),
+  defaultStatusId: z.string().nullable().optional(),
+  color: z.string().max(16).nullable().optional(),
+  icon: z.string().max(64).nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/inboxes/$inboxId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_VIEW)
+          if (!hasPermission(set, PERMISSIONS.INBOX_VIEW)) {
+            return forbiddenResponse('inbox.view permission required')
+          }
+          const id = parseTypeId<InboxId>(params.inboxId, 'inbox', 'inbox ID')
+          const inbox = await getInbox(id)
+          if (!inbox) return notFoundResponse('Inbox not found')
+          return successResponse(inbox)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_MANAGE)) {
+            return forbiddenResponse('inbox.manage permission required')
+          }
+          const id = parseTypeId<InboxId>(params.inboxId, 'inbox', 'inbox ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const inbox = await updateInbox(id, parsed.data as never, {
+            principalId: auth.principalId,
+          })
+          return successResponse(inbox)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_MANAGE)) {
+            return forbiddenResponse('inbox.manage permission required')
+          }
+          const id = parseTypeId<InboxId>(params.inboxId, 'inbox', 'inbox ID')
+          await archiveInbox(id, { principalId: auth.principalId })
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/inboxes/__tests__/inboxes.test.ts b/apps/web/src/routes/api/v1/inboxes/__tests__/inboxes.test.ts
new file mode 100644
index 000000000..2f754d096
--- /dev/null
+++ b/apps/web/src/routes/api/v1/inboxes/__tests__/inboxes.test.ts
@@ -0,0 +1,454 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  createInboxMock: vi.fn(),
+  updateInboxMock: vi.fn(),
+  archiveInboxMock: vi.fn(),
+  getInboxMock: vi.fn(),
+  listInboxesMock: vi.fn(),
+  addInboxMembershipMock: vi.fn(),
+  updateInboxMembershipRoleMock: vi.fn(),
+  removeInboxMembershipMock: vi.fn(),
+  listMembershipsForInboxMock: vi.fn(),
+  addInboxChannelMock: vi.fn(),
+  updateInboxChannelMock: vi.fn(),
+  archiveInboxChannelMock: vi.fn(),
+  listChannelsForInboxMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/inboxes', () => ({
+  createInbox: (...args: unknown[]) => hoisted.createInboxMock(...args),
+  updateInbox: (...args: unknown[]) => hoisted.updateInboxMock(...args),
+  archiveInbox: (...args: unknown[]) => hoisted.archiveInboxMock(...args),
+  getInbox: (...args: unknown[]) => hoisted.getInboxMock(...args),
+  listInboxes: (...args: unknown[]) => hoisted.listInboxesMock(...args),
+  addInboxMembership: (...args: unknown[]) => hoisted.addInboxMembershipMock(...args),
+  updateInboxMembershipRole: (...args: unknown[]) => hoisted.updateInboxMembershipRoleMock(...args),
+  removeInboxMembership: (...args: unknown[]) => hoisted.removeInboxMembershipMock(...args),
+  listMembershipsForInbox: (...args: unknown[]) => hoisted.listMembershipsForInboxMock(...args),
+  addInboxChannel: (...args: unknown[]) => hoisted.addInboxChannelMock(...args),
+  updateInboxChannel: (...args: unknown[]) => hoisted.updateInboxChannelMock(...args),
+  archiveInboxChannel: (...args: unknown[]) => hoisted.archiveInboxChannelMock(...args),
+  listChannelsForInbox: (...args: unknown[]) => hoisted.listChannelsForInboxMock(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  TICKET_VISIBILITY_SCOPES: ['workspace', 'team', 'private'],
+  INBOX_CHANNEL_KINDS: ['email', 'widget', 'api'],
+  INBOX_MEMBERSHIP_ROLES: ['owner', 'agent', 'observer'],
+}))
+
+import { Route as ChannelDetailRoute } from '../$inboxId.channels.$channelId'
+import { Route as ChannelsRoute } from '../$inboxId.channels'
+import { Route as InboxDetailRoute } from '../$inboxId'
+import { Route as MembershipDetailRoute } from '../$inboxId.memberships.$membershipId'
+import { Route as MembershipsRoute } from '../$inboxId.memberships'
+import { Route as InboxesRoute } from '../index'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const inboxHandlers = (InboxesRoute as unknown as RouteWithHandlers).options.server.handlers
+const inboxDetailHandlers = (InboxDetailRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const channelHandlers = (ChannelsRoute as unknown as RouteWithHandlers).options.server.handlers
+const channelDetailHandlers = (ChannelDetailRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const membershipHandlers = (MembershipsRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const membershipDetailHandlers = (MembershipDetailRoute as unknown as RouteWithHandlers).options
+  .server.handlers
+
+const PRINCIPAL = 'principal_admin'
+const INBOX = 'inbox_123'
+const CHANNEL = 'inbox_ch_123'
+const MEMBERSHIP = 'inbox_mem_123'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/inboxes')
+) {
+  return { request, params: handlerParams }
+}
+
+function inbox(overrides: Record<string, unknown> = {}) {
+  return {
+    id: INBOX,
+    slug: 'support',
+    name: 'Support',
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function channel(overrides: Record<string, unknown> = {}) {
+  return {
+    id: CHANNEL,
+    inboxId: INBOX,
+    kind: 'email',
+    label: 'Support email',
+    enabled: true,
+    ...overrides,
+  }
+}
+
+function membership(overrides: Record<string, unknown> = {}) {
+  return {
+    id: MEMBERSHIP,
+    inboxId: INBOX,
+    principalId: 'principal_agent',
+    role: 'agent',
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+})
+
+describe('/api/v1/inboxes routes', () => {
+  it('lists and creates inboxes after scope and permission checks', async () => {
+    const row = inbox()
+    hoisted.listInboxesMock.mockResolvedValue([row])
+    hoisted.createInboxMock.mockResolvedValue(row)
+
+    const listResponse = await inboxHandlers.GET(
+      args({}, new Request('http://test/api/v1/inboxes?includeArchived=true'))
+    )
+    expect(listResponse.status).toBe(200)
+    expect(await expectJsonData(listResponse)).toEqual([row])
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.INBOX_VIEW
+    )
+    expect(hoisted.listInboxesMock).toHaveBeenCalledWith({ includeArchived: true })
+
+    const createResponse = await inboxHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/inboxes', 'POST', {
+          slug: 'support',
+          name: 'Support',
+          description: null,
+          primaryTeamId: null,
+          defaultVisibilityScope: 'team',
+          defaultPriority: 'urgent',
+          defaultStatusId: null,
+          color: null,
+          icon: null,
+        })
+      )
+    )
+    expect(createResponse.status).toBe(201)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.INBOX_MANAGE
+    )
+    expect(hoisted.createInboxMock).toHaveBeenCalledWith(
+      expect.objectContaining({ slug: 'support', name: 'Support', defaultPriority: 'urgent' }),
+      { principalId: PRINCIPAL }
+    )
+  })
+
+  it('gets, patches, archives, and returns not found for inbox details', async () => {
+    const row = inbox({ name: 'Priority support' })
+    hoisted.getInboxMock.mockResolvedValueOnce(row).mockResolvedValueOnce(null)
+    hoisted.updateInboxMock.mockResolvedValue(row)
+    hoisted.archiveInboxMock.mockResolvedValue(row)
+
+    const getResponse = await inboxDetailHandlers.GET(args({ inboxId: INBOX }))
+    expect(getResponse.status).toBe(200)
+    expect(await expectJsonData(getResponse)).toEqual(row)
+    expect(hoisted.getInboxMock).toHaveBeenCalledWith(INBOX)
+
+    const notFoundResponse = await inboxDetailHandlers.GET(args({ inboxId: INBOX }))
+    expect(notFoundResponse.status).toBe(404)
+
+    const patchResponse = await inboxDetailHandlers.PATCH(
+      args(
+        { inboxId: INBOX },
+        jsonRequest('http://test/api/v1/inboxes/inbox_123', 'PATCH', {
+          name: 'Priority support',
+          defaultStatusId: null,
+        })
+      )
+    )
+    expect(patchResponse.status).toBe(200)
+    expect(hoisted.updateInboxMock).toHaveBeenCalledWith(
+      INBOX,
+      { name: 'Priority support', defaultStatusId: null },
+      { principalId: PRINCIPAL }
+    )
+
+    const deleteResponse = await inboxDetailHandlers.DELETE(args({ inboxId: INBOX }))
+    expect(deleteResponse.status).toBe(204)
+    expect(hoisted.archiveInboxMock).toHaveBeenCalledWith(INBOX, { principalId: PRINCIPAL })
+  })
+
+  it('lists, creates, patches, and archives inbox channels', async () => {
+    const row = channel()
+    hoisted.listChannelsForInboxMock.mockResolvedValue([row])
+    hoisted.addInboxChannelMock.mockResolvedValue(row)
+    hoisted.updateInboxChannelMock.mockResolvedValue(row)
+    hoisted.archiveInboxChannelMock.mockResolvedValue(row)
+
+    const listResponse = await channelHandlers.GET(args({ inboxId: INBOX }))
+    expect(listResponse.status).toBe(200)
+    expect(await expectJsonData(listResponse)).toEqual([row])
+    expect(hoisted.listChannelsForInboxMock).toHaveBeenCalledWith(INBOX)
+
+    const createResponse = await channelHandlers.POST(
+      args(
+        { inboxId: INBOX },
+        jsonRequest('http://test/api/v1/inboxes/inbox_123/channels', 'POST', {
+          kind: 'email',
+          label: 'Support email',
+          config: { address: 'support@example.com' },
+          externalId: null,
+          enabled: true,
+        })
+      )
+    )
+    expect(createResponse.status).toBe(201)
+    expect(hoisted.addInboxChannelMock).toHaveBeenCalledWith({
+      inboxId: INBOX,
+      kind: 'email',
+      label: 'Support email',
+      config: { address: 'support@example.com' },
+      externalId: null,
+      enabled: true,
+    })
+
+    const patchResponse = await channelDetailHandlers.PATCH(
+      args(
+        { inboxId: INBOX, channelId: CHANNEL },
+        jsonRequest('http://test/api/v1/inboxes/inbox_123/channels/inbox_ch_123', 'PATCH', {
+          label: 'Renamed channel',
+          enabled: false,
+        })
+      )
+    )
+    expect(patchResponse.status).toBe(200)
+    expect(hoisted.updateInboxChannelMock).toHaveBeenCalledWith(CHANNEL, {
+      label: 'Renamed channel',
+      enabled: false,
+    })
+
+    const deleteResponse = await channelDetailHandlers.DELETE(
+      args({ inboxId: INBOX, channelId: CHANNEL })
+    )
+    expect(deleteResponse.status).toBe(204)
+    expect(hoisted.archiveInboxChannelMock).toHaveBeenCalledWith(CHANNEL)
+  })
+
+  it('lists, creates, patches, and removes inbox memberships', async () => {
+    const row = membership()
+    hoisted.listMembershipsForInboxMock.mockResolvedValue([row])
+    hoisted.addInboxMembershipMock.mockResolvedValue(row)
+    hoisted.updateInboxMembershipRoleMock.mockResolvedValue(row)
+    hoisted.removeInboxMembershipMock.mockResolvedValue(undefined)
+
+    const listResponse = await membershipHandlers.GET(args({ inboxId: INBOX }))
+    expect(listResponse.status).toBe(200)
+    expect(await expectJsonData(listResponse)).toEqual([row])
+    expect(hoisted.listMembershipsForInboxMock).toHaveBeenCalledWith(INBOX)
+
+    const createResponse = await membershipHandlers.POST(
+      args(
+        { inboxId: INBOX },
+        jsonRequest('http://test/api/v1/inboxes/inbox_123/memberships', 'POST', {
+          principalId: 'principal_agent',
+          role: 'agent',
+        })
+      )
+    )
+    expect(createResponse.status).toBe(201)
+    expect(hoisted.addInboxMembershipMock).toHaveBeenCalledWith({
+      inboxId: INBOX,
+      principalId: 'principal_agent',
+      role: 'agent',
+    })
+
+    const patchResponse = await membershipDetailHandlers.PATCH(
+      args(
+        { inboxId: INBOX, membershipId: MEMBERSHIP },
+        jsonRequest('http://test/api/v1/inboxes/inbox_123/memberships/inbox_mem_123', 'PATCH', {
+          role: 'owner',
+        })
+      )
+    )
+    expect(patchResponse.status).toBe(200)
+    expect(hoisted.updateInboxMembershipRoleMock).toHaveBeenCalledWith(MEMBERSHIP, 'owner')
+
+    const deleteResponse = await membershipDetailHandlers.DELETE(
+      args({ inboxId: INBOX, membershipId: MEMBERSHIP })
+    )
+    expect(deleteResponse.status).toBe(204)
+    expect(hoisted.removeInboxMembershipMock).toHaveBeenCalledWith(MEMBERSHIP)
+  })
+
+  it('returns 403 before domain calls when each handler permission check fails', async () => {
+    const cases = [
+      [inboxHandlers.GET, args()],
+      [inboxHandlers.POST, args({}, jsonRequest('http://test/api/v1/inboxes', 'POST', {}))],
+      [inboxDetailHandlers.GET, args({ inboxId: INBOX })],
+      [
+        inboxDetailHandlers.PATCH,
+        args({ inboxId: INBOX }, jsonRequest('http://test/api/v1/inboxes/inbox_123', 'PATCH', {})),
+      ],
+      [inboxDetailHandlers.DELETE, args({ inboxId: INBOX })],
+      [channelHandlers.GET, args({ inboxId: INBOX })],
+      [
+        channelHandlers.POST,
+        args(
+          { inboxId: INBOX },
+          jsonRequest('http://test/api/v1/inboxes/inbox_123/channels', 'POST', {})
+        ),
+      ],
+      [channelDetailHandlers.PATCH, args({ inboxId: INBOX, channelId: CHANNEL })],
+      [channelDetailHandlers.DELETE, args({ inboxId: INBOX, channelId: CHANNEL })],
+      [membershipHandlers.GET, args({ inboxId: INBOX })],
+      [
+        membershipHandlers.POST,
+        args(
+          { inboxId: INBOX },
+          jsonRequest('http://test/api/v1/inboxes/inbox_123/memberships', 'POST', {})
+        ),
+      ],
+      [membershipDetailHandlers.PATCH, args({ inboxId: INBOX, membershipId: MEMBERSHIP })],
+      [membershipDetailHandlers.DELETE, args({ inboxId: INBOX, membershipId: MEMBERSHIP })],
+    ] as const
+
+    for (const [handler, handlerArgs] of cases) {
+      hoisted.hasPermissionMock.mockReturnValueOnce(false)
+      const response = await handler(handlerArgs)
+      expect(response.status).toBe(403)
+    }
+
+    expect(hoisted.createInboxMock).not.toHaveBeenCalled()
+    expect(hoisted.updateInboxMock).not.toHaveBeenCalled()
+    expect(hoisted.archiveInboxMock).not.toHaveBeenCalled()
+    expect(hoisted.addInboxChannelMock).not.toHaveBeenCalled()
+    expect(hoisted.updateInboxChannelMock).not.toHaveBeenCalled()
+    expect(hoisted.archiveInboxChannelMock).not.toHaveBeenCalled()
+    expect(hoisted.addInboxMembershipMock).not.toHaveBeenCalled()
+    expect(hoisted.updateInboxMembershipRoleMock).not.toHaveBeenCalled()
+    expect(hoisted.removeInboxMembershipMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects invalid request bodies before mutating inbox resources', async () => {
+    const cases = [
+      [
+        inboxHandlers.POST,
+        args({}, jsonRequest('http://test/api/v1/inboxes', 'POST', { name: '' })),
+      ],
+      [
+        inboxDetailHandlers.PATCH,
+        args(
+          { inboxId: INBOX },
+          jsonRequest('http://test/api/v1/inboxes/inbox_123', 'PATCH', {
+            name: '',
+          })
+        ),
+      ],
+      [
+        channelHandlers.POST,
+        args(
+          { inboxId: INBOX },
+          jsonRequest('http://test/api/v1/inboxes/inbox_123/channels', 'POST', {
+            kind: 'email',
+            label: '',
+          })
+        ),
+      ],
+      [
+        channelDetailHandlers.PATCH,
+        args(
+          { inboxId: INBOX, channelId: CHANNEL },
+          jsonRequest('http://test/api/v1/inboxes/inbox_123/channels/inbox_ch_123', 'PATCH', {
+            label: '',
+          })
+        ),
+      ],
+      [
+        membershipHandlers.POST,
+        args(
+          { inboxId: INBOX },
+          jsonRequest('http://test/api/v1/inboxes/inbox_123/memberships', 'POST', {
+            principalId: '',
+            role: 'agent',
+          })
+        ),
+      ],
+      [
+        membershipDetailHandlers.PATCH,
+        args(
+          { inboxId: INBOX, membershipId: MEMBERSHIP },
+          jsonRequest('http://test/api/v1/inboxes/inbox_123/memberships/inbox_mem_123', 'PATCH', {
+            role: 'invalid',
+          })
+        ),
+      ],
+    ] as const
+
+    for (const [handler, handlerArgs] of cases) {
+      const response = await handler(handlerArgs)
+      expect(response.status).toBe(400)
+    }
+
+    expect(hoisted.createInboxMock).not.toHaveBeenCalled()
+    expect(hoisted.updateInboxMock).not.toHaveBeenCalled()
+    expect(hoisted.addInboxChannelMock).not.toHaveBeenCalled()
+    expect(hoisted.updateInboxChannelMock).not.toHaveBeenCalled()
+    expect(hoisted.addInboxMembershipMock).not.toHaveBeenCalled()
+    expect(hoisted.updateInboxMembershipRoleMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/v1/inboxes/index.ts b/apps/web/src/routes/api/v1/inboxes/index.ts
new file mode 100644
index 000000000..23bfe1a01
--- /dev/null
+++ b/apps/web/src/routes/api/v1/inboxes/index.ts
@@ -0,0 +1,74 @@
+/**
+ * GET  /api/v1/inboxes — list inboxes
+ * POST /api/v1/inboxes — create inbox
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createInbox, listInboxes } from '@/lib/server/domains/inboxes'
+import { TICKET_PRIORITIES, TICKET_VISIBILITY_SCOPES } from '@/lib/server/db'
+
+const createSchema = z.object({
+  slug: z.string().min(1).max(100),
+  name: z.string().min(1).max(200),
+  description: z.string().max(1000).nullable().optional(),
+  primaryTeamId: z.string().nullable().optional(),
+  defaultVisibilityScope: z.enum(TICKET_VISIBILITY_SCOPES).optional(),
+  defaultPriority: z.enum(TICKET_PRIORITIES).optional(),
+  defaultStatusId: z.string().nullable().optional(),
+  color: z.string().max(16).nullable().optional(),
+  icon: z.string().max(64).nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/inboxes/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_VIEW)
+          if (!hasPermission(set, PERMISSIONS.INBOX_VIEW)) {
+            return forbiddenResponse('inbox.view permission required')
+          }
+          const url = new URL(request.url)
+          const includeArchived = url.searchParams.get('includeArchived') === 'true'
+          const rows = await listInboxes({ includeArchived })
+          return successResponse(rows)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.INBOX_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.INBOX_MANAGE)) {
+            return forbiddenResponse('inbox.manage permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const inbox = await createInbox(parsed.data as never, {
+            principalId: auth.principalId,
+          })
+          return createdResponse(inbox)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/internal/__tests__/sla-tick.test.ts b/apps/web/src/routes/api/v1/internal/__tests__/sla-tick.test.ts
new file mode 100644
index 000000000..a32e63d7c
--- /dev/null
+++ b/apps/web/src/routes/api/v1/internal/__tests__/sla-tick.test.ts
@@ -0,0 +1,139 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  runEscalationTickMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/sla', () => ({
+  runEscalationTick: (...args: unknown[]) => hoisted.runEscalationTickMock(...args),
+}))
+
+import { Route } from '../sla-tick'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const handlers = (Route as unknown as RouteWithHandlers).options.server.handlers
+const originalSecret = process.env.INTERNAL_TASK_SECRET
+
+function jsonRequest(body?: unknown, secret?: string) {
+  const headers = new Headers()
+  headers.set('Content-Type', 'application/json')
+  if (secret !== undefined) headers.set('x-internal-secret', secret)
+
+  return new Request('http://test/api/v1/internal/sla-tick', {
+    method: 'POST',
+    headers,
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function rawRequest(body: string, secret: string) {
+  return new Request('http://test/api/v1/internal/sla-tick', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'x-internal-secret': secret,
+    },
+    body,
+  })
+}
+
+async function post(request: Request) {
+  return handlers.POST({ request, params: {} })
+}
+
+async function body(response: Response) {
+  return response.json() as Promise<Record<string, unknown>>
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  process.env.INTERNAL_TASK_SECRET = 'secret_test'
+  hoisted.runEscalationTickMock.mockResolvedValue({
+    considered: 2,
+    breached: 1,
+    escalated: 1,
+  })
+})
+
+afterEach(() => {
+  if (originalSecret === undefined) {
+    delete process.env.INTERNAL_TASK_SECRET
+  } else {
+    process.env.INTERNAL_TASK_SECRET = originalSecret
+  }
+})
+
+describe('/api/v1/internal/sla-tick', () => {
+  it('rejects requests when the internal secret is not configured', async () => {
+    delete process.env.INTERNAL_TASK_SECRET
+
+    const response = await post(jsonRequest({ batchSize: 10 }, 'secret_test'))
+
+    expect(response.status).toBe(403)
+    expect(await body(response)).toEqual({
+      error: {
+        code: 'FORBIDDEN',
+        message: 'INTERNAL_TASK_SECRET is not configured',
+      },
+    })
+    expect(hoisted.runEscalationTickMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects missing and invalid internal secrets', async () => {
+    const missing = await post(jsonRequest({ batchSize: 10 }))
+    const invalid = await post(jsonRequest({ batchSize: 10 }, 'wrong_secret'))
+
+    expect(missing.status).toBe(403)
+    expect(await body(missing)).toEqual({
+      error: { code: 'FORBIDDEN', message: 'Invalid internal secret' },
+    })
+    expect(invalid.status).toBe(403)
+    expect(await body(invalid)).toEqual({
+      error: { code: 'FORBIDDEN', message: 'Invalid internal secret' },
+    })
+    expect(hoisted.runEscalationTickMock).not.toHaveBeenCalled()
+  })
+
+  it('runs the escalation tick with a parsed batch size', async () => {
+    const response = await post(jsonRequest({ batchSize: 25 }, 'secret_test'))
+
+    expect(response.status).toBe(200)
+    expect(await body(response)).toEqual({
+      data: {
+        considered: 2,
+        breached: 1,
+        escalated: 1,
+      },
+    })
+    expect(hoisted.runEscalationTickMock).toHaveBeenCalledWith({ batchSize: 25 })
+  })
+
+  it('runs the escalation tick without a batch size when the body is absent or invalid', async () => {
+    const empty = await post(jsonRequest(undefined, 'secret_test'))
+    const invalid = await post(rawRequest('{', 'secret_test'))
+
+    expect(empty.status).toBe(200)
+    expect(invalid.status).toBe(200)
+    expect(hoisted.runEscalationTickMock).toHaveBeenNthCalledWith(1, { batchSize: undefined })
+    expect(hoisted.runEscalationTickMock).toHaveBeenNthCalledWith(2, { batchSize: undefined })
+  })
+
+  it('maps escalation service failures through the API error envelope', async () => {
+    hoisted.runEscalationTickMock.mockRejectedValueOnce(new Error('boom'))
+
+    const response = await post(jsonRequest({ batchSize: 1 }, 'secret_test'))
+
+    expect(response.status).toBe(500)
+    expect(await body(response)).toEqual({
+      error: { code: 'INTERNAL_ERROR', message: 'Internal server error' },
+    })
+  })
+})
diff --git a/apps/web/src/routes/api/v1/internal/sla-tick.ts b/apps/web/src/routes/api/v1/internal/sla-tick.ts
new file mode 100644
index 000000000..50fd54fde
--- /dev/null
+++ b/apps/web/src/routes/api/v1/internal/sla-tick.ts
@@ -0,0 +1,45 @@
+/**
+ * POST /api/v1/internal/sla-tick
+ *
+ * Internal endpoint that runs one SLA escalation tick. Protected by a shared
+ * secret; intended to be invoked by an external scheduler (Railway cron, an
+ * external HTTP cron service, or pg_cron + pg_net).
+ *
+ * Header: `x-internal-secret: <env.INTERNAL_TASK_SECRET>`
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import {
+  successResponse,
+  forbiddenResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { runEscalationTick } from '@/lib/server/domains/sla'
+
+export const Route = createFileRoute('/api/v1/internal/sla-tick')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        try {
+          const expected = process.env.INTERNAL_TASK_SECRET
+          if (!expected) {
+            return forbiddenResponse('INTERNAL_TASK_SECRET is not configured')
+          }
+          const provided = request.headers.get('x-internal-secret')
+          if (!provided || provided !== expected) {
+            return forbiddenResponse('Invalid internal secret')
+          }
+          let body: { batchSize?: number } | null = null
+          try {
+            body = (await request.json()) as { batchSize?: number } | null
+          } catch {
+            body = null
+          }
+          const result = await runEscalationTick({ batchSize: body?.batchSize })
+          return successResponse(result)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/organizations/$organizationId.contacts.ts b/apps/web/src/routes/api/v1/organizations/$organizationId.contacts.ts
new file mode 100644
index 000000000..3e8340e34
--- /dev/null
+++ b/apps/web/src/routes/api/v1/organizations/$organizationId.contacts.ts
@@ -0,0 +1,47 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  handleDomainError,
+  decodeCursor,
+  encodeCursor,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { listContactsForOrganization } from '@/lib/server/domains/organizations'
+import type { OrganizationId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/organizations/$organizationId/contacts')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_VIEW)
+          if (!hasPermission(set, PERMISSIONS.ORG_VIEW)) {
+            return forbiddenResponse('org.view permission required')
+          }
+          const id = parseTypeId<OrganizationId>(params.organizationId, 'org', 'organization ID')
+          const url = new URL(request.url)
+          const includeArchived = url.searchParams.get('includeArchived') === 'true'
+          const limit = Math.min(parseInt(url.searchParams.get('limit') || '50', 10), 200)
+          const offset = decodeCursor(url.searchParams.get('cursor') ?? undefined)
+          const items = await listContactsForOrganization(id, {
+            includeArchived,
+            limit: limit + 1,
+            offset,
+          })
+          const hasMore = items.length > limit
+          const page = hasMore ? items.slice(0, limit) : items
+          const nextCursor = hasMore ? encodeCursor(offset + limit) : null
+          return successResponse(page, { pagination: { cursor: nextCursor, hasMore } })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/organizations/$organizationId.ts b/apps/web/src/routes/api/v1/organizations/$organizationId.ts
new file mode 100644
index 000000000..463d4fc4b
--- /dev/null
+++ b/apps/web/src/routes/api/v1/organizations/$organizationId.ts
@@ -0,0 +1,107 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  noContentResponse,
+  notFoundResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  archiveOrganization,
+  getOrganization,
+  updateOrganization,
+} from '@/lib/server/domains/organizations'
+import { recordEvent } from '@/lib/server/domains/audit'
+import type { OrganizationId } from '@quackback/ids'
+
+const patchSchema = z.object({
+  name: z.string().min(1).max(200).optional(),
+  domain: z.string().max(255).nullable().optional(),
+  externalId: z.string().max(255).nullable().optional(),
+  website: z.string().max(500).nullable().optional(),
+  notes: z.string().max(5000).nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/organizations/$organizationId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_VIEW)
+          if (!hasPermission(set, PERMISSIONS.ORG_VIEW)) {
+            return forbiddenResponse('org.view permission required')
+          }
+          const id = parseTypeId<OrganizationId>(params.organizationId, 'org', 'organization ID')
+          const org = await getOrganization(id)
+          if (!org) return notFoundResponse('Organization not found')
+          return successResponse(org)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ORG_MANAGE)) {
+            return forbiddenResponse('org.manage permission required')
+          }
+          const id = parseTypeId<OrganizationId>(params.organizationId, 'org', 'organization ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const before = await getOrganization(id)
+          const org = await updateOrganization(id, parsed.data, { principalId: auth.principalId })
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'organization.updated',
+            targetType: 'organization',
+            targetId: org.id,
+            source: 'api',
+            diff: {
+              before: before ? { name: before.name, domain: before.domain } : undefined,
+              after: { name: org.name, domain: org.domain },
+            },
+          })
+          return successResponse(org)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      /** DELETE = archive (soft) */
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ORG_MANAGE)) {
+            return forbiddenResponse('org.manage permission required')
+          }
+          const id = parseTypeId<OrganizationId>(params.organizationId, 'org', 'organization ID')
+          await archiveOrganization(id, { principalId: auth.principalId })
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'organization.archived',
+            targetType: 'organization',
+            targetId: id,
+            source: 'api',
+          })
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/organizations/__tests__/organizations.coverage.test.ts b/apps/web/src/routes/api/v1/organizations/__tests__/organizations.coverage.test.ts
new file mode 100644
index 000000000..de26fa4c6
--- /dev/null
+++ b/apps/web/src/routes/api/v1/organizations/__tests__/organizations.coverage.test.ts
@@ -0,0 +1,557 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  createOrganizationMock: vi.fn(),
+  listOrganizationsMock: vi.fn(),
+  getOrganizationMock: vi.fn(),
+  updateOrganizationMock: vi.fn(),
+  archiveOrganizationMock: vi.fn(),
+  listContactsForOrganizationMock: vi.fn(),
+  recordEventMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/organizations', () => ({
+  createOrganization: (...args: unknown[]) => hoisted.createOrganizationMock(...args),
+  listOrganizations: (...args: unknown[]) => hoisted.listOrganizationsMock(...args),
+  getOrganization: (...args: unknown[]) => hoisted.getOrganizationMock(...args),
+  updateOrganization: (...args: unknown[]) => hoisted.updateOrganizationMock(...args),
+  archiveOrganization: (...args: unknown[]) => hoisted.archiveOrganizationMock(...args),
+  listContactsForOrganization: (...args: unknown[]) =>
+    hoisted.listContactsForOrganizationMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.recordEventMock(...args),
+}))
+
+import { Route as OrganizationsRoute } from '../index'
+import { Route as OrganizationDetailRoute } from '../$organizationId'
+import { Route as OrganizationContactsRoute } from '../$organizationId.contacts'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const orgHandlers = (OrganizationsRoute as unknown as RouteWithHandlers).options.server.handlers
+const orgDetailHandlers = (OrganizationDetailRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const orgContactsHandlers = (OrganizationContactsRoute as unknown as RouteWithHandlers).options
+  .server.handlers
+
+const PRINCIPAL = 'principal_admin'
+const ORG = 'org_123'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/organizations')
+) {
+  return { request, params: handlerParams }
+}
+
+function organisation(overrides: Record<string, unknown> = {}) {
+  return {
+    id: ORG,
+    name: 'Acme',
+    domain: 'acme.example',
+    externalId: null,
+    website: null,
+    notes: null,
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function contact(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'contact_1',
+    organizationId: ORG,
+    name: 'Jane Doe',
+    email: 'jane@acme.example',
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.recordEventMock.mockResolvedValue(undefined)
+})
+
+describe('/api/v1/organizations index', () => {
+  it('lists organisations without search and without more pages', async () => {
+    const row = organisation()
+    // Service returns exactly `limit` rows so hasMore is false (page === items, cursor null).
+    hoisted.listOrganizationsMock.mockResolvedValue([row])
+
+    const response = await orgHandlers.GET(args())
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual([row])
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_VIEW
+    )
+    // Default branch: no search param (?? undefined), includeArchived false, default limit 50.
+    expect(hoisted.listOrganizationsMock).toHaveBeenCalledWith({
+      search: undefined,
+      includeArchived: false,
+      limit: 51,
+      offset: 0,
+    })
+  })
+
+  it('returns pagination cursor when there are more pages and honours search/includeArchived/limit', async () => {
+    // Two rows with limit=1 means hasMore true -> page sliced to 1 and nextCursor encoded.
+    const rows = [organisation(), organisation({ id: 'org_456', name: 'Beta' })]
+    hoisted.listOrganizationsMock.mockResolvedValue(rows)
+
+    const response = await orgHandlers.GET(
+      args(
+        {},
+        new Request('http://test/api/v1/organizations?search=ac&includeArchived=true&limit=1')
+      )
+    )
+
+    expect(response.status).toBe(200)
+    const data = await response.clone().json()
+    expect(data.data).toHaveLength(1)
+    expect(data.meta.pagination.hasMore).toBe(true)
+    expect(typeof data.meta.pagination.cursor).toBe('string')
+    expect(data.meta.pagination.cursor).not.toBeNull()
+    expect(hoisted.listOrganizationsMock).toHaveBeenCalledWith({
+      search: 'ac',
+      includeArchived: true,
+      limit: 2,
+      offset: 0,
+    })
+  })
+
+  it('clamps limit above the 200 maximum and decodes a provided cursor offset', async () => {
+    hoisted.listOrganizationsMock.mockResolvedValue([])
+    // Cursor encodes offset 200 (base64url of {"offset":200}).
+    const cursor = Buffer.from(JSON.stringify({ offset: 200 })).toString('base64url')
+
+    const response = await orgHandlers.GET(
+      args({}, new Request(`http://test/api/v1/organizations?limit=9999&cursor=${cursor}`))
+    )
+
+    expect(response.status).toBe(200)
+    const body = await response.json()
+    expect(body.data).toEqual([])
+    expect(hoisted.listOrganizationsMock).toHaveBeenCalledWith({
+      search: undefined,
+      includeArchived: false,
+      limit: 201,
+      offset: 200,
+    })
+    expect(body.meta.pagination.hasMore).toBe(false)
+    expect(body.meta.pagination.cursor).toBeNull()
+  })
+
+  it('denies listing without org.view permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await orgHandlers.GET(args())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.listOrganizationsMock).not.toHaveBeenCalled()
+  })
+
+  it('creates an organisation and records an audit event', async () => {
+    const row = organisation()
+    hoisted.createOrganizationMock.mockResolvedValue(row)
+
+    const response = await orgHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/organizations', 'POST', {
+          name: 'Acme',
+          domain: 'acme.example',
+          externalId: null,
+          website: null,
+          notes: null,
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(row)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_MANAGE
+    )
+    expect(hoisted.createOrganizationMock).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'Acme', domain: 'acme.example' }),
+      { principalId: PRINCIPAL }
+    )
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principalId: PRINCIPAL,
+        action: 'organization.created',
+        targetType: 'organization',
+        targetId: row.id,
+        source: 'api',
+        diff: { after: { name: row.name, domain: row.domain } },
+      })
+    )
+  })
+
+  it('denies creation without org.manage permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await orgHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/organizations', 'POST', { name: 'Acme' }))
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.createOrganizationMock).not.toHaveBeenCalled()
+    expect(hoisted.recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects an invalid create body (zod failure) before calling the service', async () => {
+    const response = await orgHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/organizations', 'POST', { name: '' }))
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.createOrganizationMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects a non-JSON create body (json parse rejects -> null) before calling the service', async () => {
+    // Body is not valid JSON so request.json() rejects and is caught as null, failing safeParse.
+    const badRequest = new Request('http://test/api/v1/organizations', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+
+    const response = await orgHandlers.POST(args({}, badRequest))
+
+    expect(response.status).toBe(400)
+    expect(hoisted.createOrganizationMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown service error through handleDomainError on list', async () => {
+    hoisted.listOrganizationsMock.mockRejectedValue(new Error('boom'))
+
+    const response = await orgHandlers.GET(args())
+
+    expect(response.status).toBe(500)
+  })
+
+  it('routes a thrown service error through handleDomainError on create', async () => {
+    hoisted.createOrganizationMock.mockRejectedValue(new Error('boom'))
+
+    const response = await orgHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/organizations', 'POST', { name: 'Acme' }))
+    )
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('/api/v1/organizations/$organizationId detail', () => {
+  it('gets an organisation', async () => {
+    const row = organisation()
+    hoisted.getOrganizationMock.mockResolvedValue(row)
+
+    const response = await orgDetailHandlers.GET(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(row)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(ORG, 'org', 'organization ID')
+    expect(hoisted.getOrganizationMock).toHaveBeenCalledWith(ORG)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_VIEW
+    )
+  })
+
+  it('returns 404 when the organisation does not exist', async () => {
+    hoisted.getOrganizationMock.mockResolvedValue(null)
+
+    const response = await orgDetailHandlers.GET(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(404)
+  })
+
+  it('denies get without org.view permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await orgDetailHandlers.GET(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.getOrganizationMock).not.toHaveBeenCalled()
+  })
+
+  it('patches an organisation and records the before/after diff when a prior record exists', async () => {
+    const before = organisation({ name: 'Old name', domain: 'old.example' })
+    const after = organisation({ name: 'New name', domain: 'new.example' })
+    hoisted.getOrganizationMock.mockResolvedValue(before)
+    hoisted.updateOrganizationMock.mockResolvedValue(after)
+
+    const response = await orgDetailHandlers.PATCH(
+      args(
+        { organizationId: ORG },
+        jsonRequest('http://test/api/v1/organizations/org_123', 'PATCH', {
+          name: 'New name',
+          domain: 'new.example',
+        })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(after)
+    expect(hoisted.updateOrganizationMock).toHaveBeenCalledWith(
+      ORG,
+      { name: 'New name', domain: 'new.example' },
+      { principalId: PRINCIPAL }
+    )
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'organization.updated',
+        diff: {
+          before: { name: 'Old name', domain: 'old.example' },
+          after: { name: 'New name', domain: 'new.example' },
+        },
+      })
+    )
+  })
+
+  it('patches an organisation with an undefined before-diff when no prior record exists', async () => {
+    // getOrganization returns null so the `before ? ... : undefined` branch hits undefined.
+    const after = organisation({ name: 'New name', domain: 'new.example' })
+    hoisted.getOrganizationMock.mockResolvedValue(null)
+    hoisted.updateOrganizationMock.mockResolvedValue(after)
+
+    const response = await orgDetailHandlers.PATCH(
+      args(
+        { organizationId: ORG },
+        jsonRequest('http://test/api/v1/organizations/org_123', 'PATCH', { name: 'New name' })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'organization.updated',
+        diff: {
+          before: undefined,
+          after: { name: 'New name', domain: 'new.example' },
+        },
+      })
+    )
+  })
+
+  it('denies patch without org.manage permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await orgDetailHandlers.PATCH(
+      args(
+        { organizationId: ORG },
+        jsonRequest('http://test/api/v1/organizations/org_123', 'PATCH', { name: 'New name' })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.updateOrganizationMock).not.toHaveBeenCalled()
+    expect(hoisted.recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects an invalid patch body before calling the service', async () => {
+    const response = await orgDetailHandlers.PATCH(
+      args(
+        { organizationId: ORG },
+        jsonRequest('http://test/api/v1/organizations/org_123', 'PATCH', { name: '' })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.updateOrganizationMock).not.toHaveBeenCalled()
+    expect(hoisted.getOrganizationMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects a non-JSON patch body (json parse rejects -> null) before calling the service', async () => {
+    // Invalid JSON makes request.json() reject; the .catch(() => null) arrow yields null,
+    // which then fails safeParse with a 400.
+    const badRequest = new Request('http://test/api/v1/organizations/org_123', {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+
+    const response = await orgDetailHandlers.PATCH(args({ organizationId: ORG }, badRequest))
+
+    expect(response.status).toBe(400)
+    expect(hoisted.updateOrganizationMock).not.toHaveBeenCalled()
+  })
+
+  it('archives an organisation (soft delete) and records the event', async () => {
+    hoisted.archiveOrganizationMock.mockResolvedValue(undefined)
+
+    const response = await orgDetailHandlers.DELETE(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(204)
+    expect(hoisted.archiveOrganizationMock).toHaveBeenCalledWith(ORG, { principalId: PRINCIPAL })
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'organization.archived',
+        targetType: 'organization',
+        targetId: ORG,
+        source: 'api',
+      })
+    )
+  })
+
+  it('denies archive without org.manage permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await orgDetailHandlers.DELETE(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.archiveOrganizationMock).not.toHaveBeenCalled()
+    expect(hoisted.recordEventMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown service error through handleDomainError on get', async () => {
+    hoisted.getOrganizationMock.mockRejectedValue(new Error('boom'))
+
+    const response = await orgDetailHandlers.GET(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(500)
+  })
+
+  it('routes a thrown service error through handleDomainError on patch', async () => {
+    hoisted.getOrganizationMock.mockResolvedValue(organisation())
+    hoisted.updateOrganizationMock.mockRejectedValue(new Error('boom'))
+
+    const response = await orgDetailHandlers.PATCH(
+      args(
+        { organizationId: ORG },
+        jsonRequest('http://test/api/v1/organizations/org_123', 'PATCH', { name: 'New name' })
+      )
+    )
+
+    expect(response.status).toBe(500)
+  })
+
+  it('routes a thrown service error through handleDomainError on archive', async () => {
+    hoisted.archiveOrganizationMock.mockRejectedValue(new Error('boom'))
+
+    const response = await orgDetailHandlers.DELETE(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('/api/v1/organizations/$organizationId/contacts', () => {
+  it('lists contacts for an organisation without more pages', async () => {
+    const row = contact()
+    hoisted.listContactsForOrganizationMock.mockResolvedValue([row])
+
+    const response = await orgContactsHandlers.GET(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(200)
+    const body = await response.json()
+    expect(body.data).toEqual([row])
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ORG_VIEW
+    )
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(ORG, 'org', 'organization ID')
+    expect(hoisted.listContactsForOrganizationMock).toHaveBeenCalledWith(ORG, {
+      includeArchived: false,
+      limit: 51,
+      offset: 0,
+    })
+    expect(body.meta.pagination.hasMore).toBe(false)
+    expect(body.meta.pagination.cursor).toBeNull()
+  })
+
+  it('returns a pagination cursor and honours includeArchived/limit when there are more pages', async () => {
+    const rows = [contact(), contact({ id: 'contact_2', name: 'John Roe' })]
+    hoisted.listContactsForOrganizationMock.mockResolvedValue(rows)
+
+    const response = await orgContactsHandlers.GET(
+      args(
+        { organizationId: ORG },
+        new Request(
+          'http://test/api/v1/organizations/org_123/contacts?includeArchived=true&limit=1'
+        )
+      )
+    )
+
+    expect(response.status).toBe(200)
+    const data = await response.clone().json()
+    expect(data.data).toHaveLength(1)
+    expect(data.meta.pagination.hasMore).toBe(true)
+    expect(typeof data.meta.pagination.cursor).toBe('string')
+    expect(hoisted.listContactsForOrganizationMock).toHaveBeenCalledWith(ORG, {
+      includeArchived: true,
+      limit: 2,
+      offset: 0,
+    })
+  })
+
+  it('denies listing contacts without org.view permission', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await orgContactsHandlers.GET(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.listContactsForOrganizationMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown service error through handleDomainError on list contacts', async () => {
+    hoisted.listContactsForOrganizationMock.mockRejectedValue(new Error('boom'))
+
+    const response = await orgContactsHandlers.GET(args({ organizationId: ORG }))
+
+    expect(response.status).toBe(500)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/organizations/index.ts b/apps/web/src/routes/api/v1/organizations/index.ts
new file mode 100644
index 000000000..35d59a512
--- /dev/null
+++ b/apps/web/src/routes/api/v1/organizations/index.ts
@@ -0,0 +1,90 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+  decodeCursor,
+  encodeCursor,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createOrganization, listOrganizations } from '@/lib/server/domains/organizations'
+import { recordEvent } from '@/lib/server/domains/audit'
+
+const createSchema = z.object({
+  name: z.string().min(1).max(200),
+  domain: z.string().max(255).nullable().optional(),
+  externalId: z.string().max(255).nullable().optional(),
+  website: z.string().max(500).nullable().optional(),
+  notes: z.string().max(5000).nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/organizations/')({
+  server: {
+    handlers: {
+      /** GET /api/v1/organizations — list with cursor pagination + search */
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_VIEW)
+          if (!hasPermission(set, PERMISSIONS.ORG_VIEW)) {
+            return forbiddenResponse('org.view permission required')
+          }
+          const url = new URL(request.url)
+          const search = url.searchParams.get('search') ?? undefined
+          const includeArchived = url.searchParams.get('includeArchived') === 'true'
+          const cursor = url.searchParams.get('cursor') ?? undefined
+          const limit = Math.min(parseInt(url.searchParams.get('limit') || '50', 10), 200)
+          const offset = decodeCursor(cursor)
+          const items = await listOrganizations({
+            search,
+            includeArchived,
+            limit: limit + 1,
+            offset,
+          })
+          const hasMore = items.length > limit
+          const page = hasMore ? items.slice(0, limit) : items
+          const nextCursor = hasMore ? encodeCursor(offset + limit) : null
+          return successResponse(page, {
+            pagination: { cursor: nextCursor, hasMore },
+          })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      /** POST /api/v1/organizations — create */
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ORG_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ORG_MANAGE)) {
+            return forbiddenResponse('org.manage permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const org = await createOrganization(parsed.data, { principalId: auth.principalId })
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'organization.created',
+            targetType: 'organization',
+            targetId: org.id,
+            source: 'api',
+            diff: { after: { name: org.name, domain: org.domain } },
+          })
+          return createdResponse(org)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/permissions.ts b/apps/web/src/routes/api/v1/permissions.ts
new file mode 100644
index 000000000..cffc6f4de
--- /dev/null
+++ b/apps/web/src/routes/api/v1/permissions.ts
@@ -0,0 +1,39 @@
+/**
+ * GET /api/v1/permissions — list the RBAC permission catalogue (all permission
+ * keys grouped by category). Reference data for building role payloads.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS, PERMISSION_CATEGORIES } from '@/lib/server/domains/authz'
+import { ALL_PERMISSIONS } from '@/lib/server/domains/authz/authz.permissions'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+
+export const Route = createFileRoute('/api/v1/permissions')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.ADMIN_MANAGE_ROLES)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.ADMIN_MANAGE_ROLES)) {
+            return forbiddenResponse('admin.manage_roles permission required')
+          }
+          return successResponse({
+            permissions: ALL_PERMISSIONS,
+            categories: Object.fromEntries(
+              Object.entries(PERMISSION_CATEGORIES).map(([cat, keys]) => [cat, [...keys]])
+            ),
+          })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/principals/$principalId.roles.ts b/apps/web/src/routes/api/v1/principals/$principalId.roles.ts
new file mode 100644
index 000000000..19ccc041b
--- /dev/null
+++ b/apps/web/src/routes/api/v1/principals/$principalId.roles.ts
@@ -0,0 +1,80 @@
+/**
+ * GET  /api/v1/principals/:principalId/roles — list a principal's role assignments
+ * POST /api/v1/principals/:principalId/roles — assign a role { roleId, teamId? }
+ *
+ * Gated by admin.manage_roles.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { assignRoleSchema } from '@/lib/shared/schemas/roles'
+import type { PrincipalId, RoleId, TeamId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/principals/$principalId/roles')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.ADMIN_MANAGE_ROLES)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.ADMIN_MANAGE_ROLES)) {
+            return forbiddenResponse('admin.manage_roles permission required')
+          }
+          const principalId = parseTypeId<PrincipalId>(
+            params.principalId,
+            'principal',
+            'principal ID'
+          )
+          const { listAssignmentsForPrincipal } =
+            await import('@/lib/server/domains/authz/role.service')
+          return successResponse(await listAssignmentsForPrincipal(principalId))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.ADMIN_MANAGE_ROLES)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.ADMIN_MANAGE_ROLES)) {
+            return forbiddenResponse('admin.manage_roles permission required')
+          }
+          const principalId = parseTypeId<PrincipalId>(
+            params.principalId,
+            'principal',
+            'principal ID'
+          )
+          const parsed = assignRoleSchema.safeParse(await request.json().catch(() => null))
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const roleId = parseTypeId<RoleId>(parsed.data.roleId, 'role', 'role ID')
+          const { assignRole } = await import('@/lib/server/domains/authz/role.service')
+          const assignmentId = await assignRole({
+            principalId,
+            roleId,
+            teamId: (parsed.data.teamId as TeamId | null | undefined) ?? null,
+            actorPrincipalId: auth.principalId,
+          })
+          return createdResponse({ id: assignmentId, principalId, roleId })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/principals/__tests__/principal-roles.test.ts b/apps/web/src/routes/api/v1/principals/__tests__/principal-roles.test.ts
new file mode 100644
index 000000000..7e85ab3d2
--- /dev/null
+++ b/apps/web/src/routes/api/v1/principals/__tests__/principal-roles.test.ts
@@ -0,0 +1,148 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  listAssignmentsForPrincipalMock: vi.fn(),
+  assignRoleMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/role.service', () => ({
+  listAssignmentsForPrincipal: (...args: unknown[]) =>
+    hoisted.listAssignmentsForPrincipalMock(...args),
+  assignRole: (...args: unknown[]) => hoisted.assignRoleMock(...args),
+}))
+
+import { Route } from '../$principalId.roles'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const handlers = (Route as unknown as RouteWithHandlers).options.server.handlers
+
+const PRINCIPAL = 'principal_target'
+const ACTOR = 'principal_admin'
+const ROLE = 'role_agent'
+
+function jsonRequest(body?: unknown) {
+  return new Request('http://test/api/v1/principals/principal_target/roles', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(request = new Request('http://test/api/v1/principals/principal_target/roles')) {
+  return { request, params: { principalId: PRINCIPAL } }
+}
+
+async function data(response: Response) {
+  return ((await response.json()) as { data: unknown }).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({ principalId: ACTOR, role: 'team' })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.listAssignmentsForPrincipalMock.mockResolvedValue([
+    { id: 'role_asgn_1', principalId: PRINCIPAL, roleId: ROLE },
+  ])
+  hoisted.assignRoleMock.mockResolvedValue('role_asgn_2')
+})
+
+describe('/api/v1/principals/:principalId/roles', () => {
+  it('lists role assignments after admin.manage_roles checks', async () => {
+    const response = await handlers.GET(args())
+
+    expect(response.status).toBe(200)
+    expect(await data(response)).toEqual([
+      { id: 'role_asgn_1', principalId: PRINCIPAL, roleId: ROLE },
+    ])
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ADMIN_MANAGE_ROLES
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.ADMIN_MANAGE_ROLES
+    )
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(PRINCIPAL, 'principal', 'principal ID')
+    expect(hoisted.listAssignmentsForPrincipalMock).toHaveBeenCalledWith(PRINCIPAL)
+  })
+
+  it('assigns a scoped role and returns the assignment id', async () => {
+    const response = await handlers.POST(
+      args(jsonRequest({ roleId: ROLE, teamId: 'team_support' }))
+    )
+
+    expect(response.status).toBe(201)
+    expect(await data(response)).toEqual({
+      id: 'role_asgn_2',
+      principalId: PRINCIPAL,
+      roleId: ROLE,
+    })
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(ROLE, 'role', 'role ID')
+    expect(hoisted.assignRoleMock).toHaveBeenCalledWith({
+      principalId: PRINCIPAL,
+      roleId: ROLE,
+      teamId: 'team_support',
+      actorPrincipalId: ACTOR,
+    })
+  })
+
+  it('normalizes missing teamId to null when assigning', async () => {
+    await handlers.POST(args(jsonRequest({ roleId: ROLE })))
+
+    expect(hoisted.assignRoleMock).toHaveBeenCalledWith({
+      principalId: PRINCIPAL,
+      roleId: ROLE,
+      teamId: null,
+      actorPrincipalId: ACTOR,
+    })
+  })
+
+  it('rejects invalid bodies and permission-denied callers before mutating', async () => {
+    const invalid = await handlers.POST(args(jsonRequest({ teamId: 'team_support' })))
+    expect(invalid.status).toBe(400)
+    expect(hoisted.assignRoleMock).not.toHaveBeenCalled()
+
+    vi.clearAllMocks()
+    hoisted.withApiKeyAuthMock.mockResolvedValue({ principalId: ACTOR, role: 'team' })
+    hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const getDenied = await handlers.GET(args())
+    expect(getDenied.status).toBe(403)
+    const postDenied = await handlers.POST(args(jsonRequest({ roleId: ROLE })))
+    expect(postDenied.status).toBe(403)
+    expect(hoisted.listAssignmentsForPrincipalMock).not.toHaveBeenCalled()
+    expect(hoisted.assignRoleMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/v1/role-assignments/$assignmentId.ts b/apps/web/src/routes/api/v1/role-assignments/$assignmentId.ts
new file mode 100644
index 000000000..ff375fc2a
--- /dev/null
+++ b/apps/web/src/routes/api/v1/role-assignments/$assignmentId.ts
@@ -0,0 +1,43 @@
+/**
+ * DELETE /api/v1/role-assignments/:assignmentId — revoke a role assignment.
+ *
+ * Gated by admin.manage_roles.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  noContentResponse,
+  forbiddenResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import type { RoleAssignmentId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/role-assignments/$assignmentId')({
+  server: {
+    handlers: {
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.ADMIN_MANAGE_ROLES)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.ADMIN_MANAGE_ROLES)) {
+            return forbiddenResponse('admin.manage_roles permission required')
+          }
+          const assignmentId = parseTypeId<RoleAssignmentId>(
+            params.assignmentId,
+            'role_asgn',
+            'role assignment ID'
+          )
+          const { revokeRoleAssignment } = await import('@/lib/server/domains/authz/role.service')
+          await revokeRoleAssignment({ assignmentId, actorPrincipalId: auth.principalId })
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/roles/$roleId.permissions.ts b/apps/web/src/routes/api/v1/roles/$roleId.permissions.ts
new file mode 100644
index 000000000..a3b62aac0
--- /dev/null
+++ b/apps/web/src/routes/api/v1/roles/$roleId.permissions.ts
@@ -0,0 +1,51 @@
+/**
+ * PUT /api/v1/roles/:roleId/permissions — replace a role's permission set.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { setRolePermissionsSchema } from '@/lib/shared/schemas/roles'
+import type { PermissionKey } from '@/lib/server/domains/authz/authz.permissions'
+import type { RoleId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/roles/$roleId/permissions')({
+  server: {
+    handlers: {
+      PUT: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.ADMIN_MANAGE_ROLES)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.ADMIN_MANAGE_ROLES)) {
+            return forbiddenResponse('admin.manage_roles permission required')
+          }
+          const roleId = parseTypeId<RoleId>(params.roleId, 'role', 'role ID')
+          const parsed = setRolePermissionsSchema.safeParse(await request.json().catch(() => null))
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const { setRolePermissions, getRoleWithPermissions } =
+            await import('@/lib/server/domains/authz/role.service')
+          await setRolePermissions({
+            roleId,
+            permissionKeys: parsed.data.permissionKeys as PermissionKey[],
+            actorPrincipalId: auth.principalId,
+          })
+          return successResponse(await getRoleWithPermissions(roleId))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/roles/$roleId.ts b/apps/web/src/routes/api/v1/roles/$roleId.ts
new file mode 100644
index 000000000..a57e4a19c
--- /dev/null
+++ b/apps/web/src/routes/api/v1/roles/$roleId.ts
@@ -0,0 +1,83 @@
+/**
+ * GET    /api/v1/roles/:roleId — fetch a role with its permissions
+ * PATCH  /api/v1/roles/:roleId — rename / re-describe a role
+ * DELETE /api/v1/roles/:roleId — delete a custom role (system roles rejected)
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  noContentResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { updateRoleSchema } from '@/lib/shared/schemas/roles'
+import type { RoleId } from '@quackback/ids'
+
+async function gate(request: Request) {
+  const auth = await withApiKeyAuth(request, { role: 'team' })
+  assertScopeAllowed(auth, PERMISSIONS.ADMIN_MANAGE_ROLES)
+  const set = await loadPermissionSet(auth.principalId)
+  if (!hasPermission(set, PERMISSIONS.ADMIN_MANAGE_ROLES)) return { auth, ok: false as const }
+  return { auth, ok: true as const }
+}
+
+export const Route = createFileRoute('/api/v1/roles/$roleId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const g = await gate(request)
+          if (!g.ok) return forbiddenResponse('admin.manage_roles permission required')
+          const roleId = parseTypeId<RoleId>(params.roleId, 'role', 'role ID')
+          const { getRoleWithPermissions } = await import('@/lib/server/domains/authz/role.service')
+          return successResponse(await getRoleWithPermissions(roleId))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+
+      PATCH: async ({ request, params }) => {
+        try {
+          const g = await gate(request)
+          if (!g.ok) return forbiddenResponse('admin.manage_roles permission required')
+          const roleId = parseTypeId<RoleId>(params.roleId, 'role', 'role ID')
+          const parsed = updateRoleSchema.safeParse(await request.json().catch(() => null))
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const { updateRole, getRoleWithPermissions } =
+            await import('@/lib/server/domains/authz/role.service')
+          await updateRole({
+            id: roleId,
+            name: parsed.data.name,
+            description: parsed.data.description,
+            actorPrincipalId: g.auth.principalId,
+          })
+          return successResponse(await getRoleWithPermissions(roleId))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+
+      DELETE: async ({ request, params }) => {
+        try {
+          const g = await gate(request)
+          if (!g.ok) return forbiddenResponse('admin.manage_roles permission required')
+          const roleId = parseTypeId<RoleId>(params.roleId, 'role', 'role ID')
+          const { deleteRole } = await import('@/lib/server/domains/authz/role.service')
+          await deleteRole({ id: roleId, actorPrincipalId: g.auth.principalId })
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/roles/__tests__/roles.coverage.test.ts b/apps/web/src/routes/api/v1/roles/__tests__/roles.coverage.test.ts
new file mode 100644
index 000000000..9885d2b5c
--- /dev/null
+++ b/apps/web/src/routes/api/v1/roles/__tests__/roles.coverage.test.ts
@@ -0,0 +1,480 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { NotFoundError } from '@/lib/shared/errors'
+
+// All role route handlers dynamically import the role.service module, so we mock
+// that module (along with auth, authz, and validation) and assert behaviour at
+// the request level. Mirrors the canonical inboxes route test structure.
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  listRolesMock: vi.fn(),
+  createRoleMock: vi.fn(),
+  updateRoleMock: vi.fn(),
+  deleteRoleMock: vi.fn(),
+  setRolePermissionsMock: vi.fn(),
+  getRoleWithPermissionsMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/role.service', () => ({
+  listRoles: (...args: unknown[]) => hoisted.listRolesMock(...args),
+  createRole: (...args: unknown[]) => hoisted.createRoleMock(...args),
+  updateRole: (...args: unknown[]) => hoisted.updateRoleMock(...args),
+  deleteRole: (...args: unknown[]) => hoisted.deleteRoleMock(...args),
+  setRolePermissions: (...args: unknown[]) => hoisted.setRolePermissionsMock(...args),
+  getRoleWithPermissions: (...args: unknown[]) => hoisted.getRoleWithPermissionsMock(...args),
+}))
+
+import { Route as RolesRoute } from '../index'
+import { Route as RoleDetailRoute } from '../$roleId'
+import { Route as RolePermissionsRoute } from '../$roleId.permissions'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const rolesHandlers = (RolesRoute as unknown as RouteWithHandlers).options.server.handlers
+const roleDetailHandlers = (RoleDetailRoute as unknown as RouteWithHandlers).options.server.handlers
+const rolePermissionsHandlers = (RolePermissionsRoute as unknown as RouteWithHandlers).options
+  .server.handlers
+
+const PRINCIPAL = 'principal_admin'
+const ROLE = 'role_123'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/roles')
+) {
+  return { request, params: handlerParams }
+}
+
+function role(overrides: Record<string, unknown> = {}) {
+  return {
+    id: ROLE,
+    key: 'support-lead',
+    name: 'Support Lead',
+    description: 'Leads the support team',
+    isSystem: false,
+    permissions: ['ticket.view_all'],
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+})
+
+describe('/api/v1/roles index routes', () => {
+  it('lists roles after scope and permission checks', async () => {
+    const rows = [role()]
+    hoisted.listRolesMock.mockResolvedValue(rows)
+
+    const response = await rolesHandlers.GET(args())
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(rows)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ADMIN_MANAGE_ROLES
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.ADMIN_MANAGE_ROLES
+    )
+    expect(hoisted.listRolesMock).toHaveBeenCalledWith()
+  })
+
+  it('denies listing roles with 403 when permission check fails', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await rolesHandlers.GET(args())
+    expect(response.status).toBe(403)
+    expect(hoisted.listRolesMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a domain error from listRoles through handleDomainError', async () => {
+    hoisted.listRolesMock.mockRejectedValue(new NotFoundError('ROLE_NOT_FOUND', 'Role not found'))
+
+    const response = await rolesHandlers.GET(args())
+    expect(response.status).toBe(404)
+  })
+
+  it('creates a role and returns the created resource', async () => {
+    hoisted.createRoleMock.mockResolvedValue(ROLE)
+    const created = role()
+    hoisted.getRoleWithPermissionsMock.mockResolvedValue(created)
+
+    const response = await rolesHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/roles', 'POST', {
+          key: 'support-lead',
+          name: 'Support Lead',
+          description: 'Leads the support team',
+          permissionKeys: ['ticket.view_all'],
+        })
+      )
+    )
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(created)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ADMIN_MANAGE_ROLES
+    )
+    expect(hoisted.createRoleMock).toHaveBeenCalledWith({
+      key: 'support-lead',
+      name: 'Support Lead',
+      description: 'Leads the support team',
+      permissionKeys: ['ticket.view_all'],
+      actorPrincipalId: PRINCIPAL,
+    })
+    expect(hoisted.getRoleWithPermissionsMock).toHaveBeenCalledWith(ROLE)
+  })
+
+  it('creates a role with the schema default for omitted permissionKeys', async () => {
+    hoisted.createRoleMock.mockResolvedValue(ROLE)
+    hoisted.getRoleWithPermissionsMock.mockResolvedValue(role({ permissions: [] }))
+
+    const response = await rolesHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/roles', 'POST', {
+          key: 'support-lead',
+          name: 'Support Lead',
+        })
+      )
+    )
+    expect(response.status).toBe(201)
+    expect(hoisted.createRoleMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        key: 'support-lead',
+        name: 'Support Lead',
+        description: undefined,
+        permissionKeys: [],
+        actorPrincipalId: PRINCIPAL,
+      })
+    )
+  })
+
+  it('denies creating a role with 403 when permission check fails', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await rolesHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/roles', 'POST', { key: 'k', name: 'n' }))
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.createRoleMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects invalid create body with 400 and a non-parsable body', async () => {
+    // Invalid: empty key fails z.string().min(1)
+    const invalidResponse = await rolesHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/roles', 'POST', { key: '', name: 'n' }))
+    )
+    expect(invalidResponse.status).toBe(400)
+
+    // Non-JSON body: request.json() throws → .catch(() => null) → safeParse(null) fails
+    const nonJsonResponse = await rolesHandlers.POST(
+      args(
+        {},
+        new Request('http://test/api/v1/roles', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: 'not-json',
+        })
+      )
+    )
+    expect(nonJsonResponse.status).toBe(400)
+    expect(hoisted.createRoleMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a domain error from createRole through handleDomainError', async () => {
+    hoisted.createRoleMock.mockRejectedValue(new NotFoundError('ROLE_NOT_FOUND', 'Role not found'))
+
+    const response = await rolesHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/roles', 'POST', { key: 'k', name: 'n' }))
+    )
+    expect(response.status).toBe(404)
+  })
+})
+
+describe('/api/v1/roles/$roleId routes', () => {
+  it('fetches a role with its permissions', async () => {
+    const row = role()
+    hoisted.getRoleWithPermissionsMock.mockResolvedValue(row)
+
+    const response = await roleDetailHandlers.GET(args({ roleId: ROLE }))
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(row)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(ROLE, 'role', 'role ID')
+    expect(hoisted.getRoleWithPermissionsMock).toHaveBeenCalledWith(ROLE)
+  })
+
+  it('returns 404 when fetching a missing role', async () => {
+    hoisted.getRoleWithPermissionsMock.mockRejectedValue(
+      new NotFoundError('ROLE_NOT_FOUND', 'Role not found')
+    )
+
+    const response = await roleDetailHandlers.GET(args({ roleId: ROLE }))
+    expect(response.status).toBe(404)
+  })
+
+  it('denies fetching a role with 403 when permission check fails', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await roleDetailHandlers.GET(args({ roleId: ROLE }))
+    expect(response.status).toBe(403)
+    expect(hoisted.getRoleWithPermissionsMock).not.toHaveBeenCalled()
+  })
+
+  it('patches a role and returns the refreshed resource', async () => {
+    hoisted.updateRoleMock.mockResolvedValue(undefined)
+    const updated = role({ name: 'Renamed role' })
+    hoisted.getRoleWithPermissionsMock.mockResolvedValue(updated)
+
+    const response = await roleDetailHandlers.PATCH(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123', 'PATCH', {
+          name: 'Renamed role',
+          description: 'New description',
+        })
+      )
+    )
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(updated)
+    expect(hoisted.updateRoleMock).toHaveBeenCalledWith({
+      id: ROLE,
+      name: 'Renamed role',
+      description: 'New description',
+      actorPrincipalId: PRINCIPAL,
+    })
+    expect(hoisted.getRoleWithPermissionsMock).toHaveBeenCalledWith(ROLE)
+  })
+
+  it('returns 404 when patching a missing role', async () => {
+    hoisted.updateRoleMock.mockRejectedValue(new NotFoundError('ROLE_NOT_FOUND', 'Role not found'))
+
+    const response = await roleDetailHandlers.PATCH(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123', 'PATCH', { name: 'Renamed role' })
+      )
+    )
+    expect(response.status).toBe(404)
+  })
+
+  it('denies patching a role with 403 when permission check fails', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await roleDetailHandlers.PATCH(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123', 'PATCH', { name: 'Renamed role' })
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.updateRoleMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects an invalid patch body with 400 and a non-parsable body', async () => {
+    // Invalid: empty name fails z.string().min(1)
+    const invalidResponse = await roleDetailHandlers.PATCH(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123', 'PATCH', { name: '' })
+      )
+    )
+    expect(invalidResponse.status).toBe(400)
+
+    // Non-JSON body: request.json() throws → .catch(() => null) → safeParse(null) fails
+    const nonJsonResponse = await roleDetailHandlers.PATCH(
+      args(
+        { roleId: ROLE },
+        new Request('http://test/api/v1/roles/role_123', {
+          method: 'PATCH',
+          headers: { 'Content-Type': 'application/json' },
+          body: 'not-json',
+        })
+      )
+    )
+    expect(nonJsonResponse.status).toBe(400)
+    expect(hoisted.updateRoleMock).not.toHaveBeenCalled()
+  })
+
+  it('deletes a custom role and returns no content', async () => {
+    hoisted.deleteRoleMock.mockResolvedValue(undefined)
+
+    const response = await roleDetailHandlers.DELETE(args({ roleId: ROLE }))
+    expect(response.status).toBe(204)
+    expect(hoisted.deleteRoleMock).toHaveBeenCalledWith({
+      id: ROLE,
+      actorPrincipalId: PRINCIPAL,
+    })
+  })
+
+  it('returns 404 when deleting a missing role', async () => {
+    hoisted.deleteRoleMock.mockRejectedValue(new NotFoundError('ROLE_NOT_FOUND', 'Role not found'))
+
+    const response = await roleDetailHandlers.DELETE(args({ roleId: ROLE }))
+    expect(response.status).toBe(404)
+  })
+
+  it('denies deleting a role with 403 when permission check fails', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await roleDetailHandlers.DELETE(args({ roleId: ROLE }))
+    expect(response.status).toBe(403)
+    expect(hoisted.deleteRoleMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('/api/v1/roles/$roleId/permissions routes', () => {
+  it('replaces a role permission set and returns the refreshed resource', async () => {
+    hoisted.setRolePermissionsMock.mockResolvedValue(undefined)
+    const updated = role({ permissions: ['ticket.view_all', 'ticket.edit'] })
+    hoisted.getRoleWithPermissionsMock.mockResolvedValue(updated)
+
+    const response = await rolePermissionsHandlers.PUT(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123/permissions', 'PUT', {
+          permissionKeys: ['ticket.view_all', 'ticket.edit'],
+        })
+      )
+    )
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(updated)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ADMIN_MANAGE_ROLES
+    )
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(ROLE, 'role', 'role ID')
+    expect(hoisted.setRolePermissionsMock).toHaveBeenCalledWith({
+      roleId: ROLE,
+      permissionKeys: ['ticket.view_all', 'ticket.edit'],
+      actorPrincipalId: PRINCIPAL,
+    })
+    expect(hoisted.getRoleWithPermissionsMock).toHaveBeenCalledWith(ROLE)
+  })
+
+  it('replaces a role permission set with an empty array', async () => {
+    hoisted.setRolePermissionsMock.mockResolvedValue(undefined)
+    hoisted.getRoleWithPermissionsMock.mockResolvedValue(role({ permissions: [] }))
+
+    const response = await rolePermissionsHandlers.PUT(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123/permissions', 'PUT', {
+          permissionKeys: [],
+        })
+      )
+    )
+    expect(response.status).toBe(200)
+    expect(hoisted.setRolePermissionsMock).toHaveBeenCalledWith({
+      roleId: ROLE,
+      permissionKeys: [],
+      actorPrincipalId: PRINCIPAL,
+    })
+  })
+
+  it('denies replacing permissions with 403 when permission check fails', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await rolePermissionsHandlers.PUT(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123/permissions', 'PUT', {
+          permissionKeys: [],
+        })
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.setRolePermissionsMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects an invalid permissions body with 400 and a non-parsable body', async () => {
+    // Invalid: permissionKeys must be an array
+    const invalidResponse = await rolePermissionsHandlers.PUT(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123/permissions', 'PUT', {
+          permissionKeys: 'not-an-array',
+        })
+      )
+    )
+    expect(invalidResponse.status).toBe(400)
+
+    // Non-JSON body: request.json() throws → .catch(() => null) → safeParse(null) fails
+    const nonJsonResponse = await rolePermissionsHandlers.PUT(
+      args(
+        { roleId: ROLE },
+        new Request('http://test/api/v1/roles/role_123/permissions', {
+          method: 'PUT',
+          headers: { 'Content-Type': 'application/json' },
+          body: 'not-json',
+        })
+      )
+    )
+    expect(nonJsonResponse.status).toBe(400)
+    expect(hoisted.setRolePermissionsMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when setting permissions on a missing role', async () => {
+    hoisted.setRolePermissionsMock.mockRejectedValue(
+      new NotFoundError('ROLE_NOT_FOUND', 'Role not found')
+    )
+
+    const response = await rolePermissionsHandlers.PUT(
+      args(
+        { roleId: ROLE },
+        jsonRequest('http://test/api/v1/roles/role_123/permissions', 'PUT', {
+          permissionKeys: [],
+        })
+      )
+    )
+    expect(response.status).toBe(404)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/roles/index.ts b/apps/web/src/routes/api/v1/roles/index.ts
new file mode 100644
index 000000000..5aec473ce
--- /dev/null
+++ b/apps/web/src/routes/api/v1/roles/index.ts
@@ -0,0 +1,69 @@
+/**
+ * GET  /api/v1/roles — list roles (with permission counts)
+ * POST /api/v1/roles — create a custom role
+ *
+ * Gated by admin.manage_roles.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createRoleSchema } from '@/lib/shared/schemas/roles'
+import type { PermissionKey } from '@/lib/server/domains/authz/authz.permissions'
+
+export const Route = createFileRoute('/api/v1/roles/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.ADMIN_MANAGE_ROLES)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.ADMIN_MANAGE_ROLES)) {
+            return forbiddenResponse('admin.manage_roles permission required')
+          }
+          const { listRoles } = await import('@/lib/server/domains/authz/role.service')
+          return successResponse(await listRoles())
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.ADMIN_MANAGE_ROLES)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.ADMIN_MANAGE_ROLES)) {
+            return forbiddenResponse('admin.manage_roles permission required')
+          }
+          const parsed = createRoleSchema.safeParse(await request.json().catch(() => null))
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const { createRole, getRoleWithPermissions } =
+            await import('@/lib/server/domains/authz/role.service')
+          const roleId = await createRole({
+            key: parsed.data.key,
+            name: parsed.data.name,
+            description: parsed.data.description,
+            permissionKeys: parsed.data.permissionKeys as PermissionKey[],
+            actorPrincipalId: auth.principalId,
+          })
+          return createdResponse(await getRoleWithPermissions(roleId))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/routing-rules/$ruleId.ts b/apps/web/src/routes/api/v1/routing-rules/$ruleId.ts
new file mode 100644
index 000000000..5aeddd73b
--- /dev/null
+++ b/apps/web/src/routes/api/v1/routing-rules/$ruleId.ts
@@ -0,0 +1,88 @@
+/**
+ * GET    /api/v1/routing-rules/:ruleId
+ * PATCH  /api/v1/routing-rules/:ruleId
+ * DELETE /api/v1/routing-rules/:ruleId
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  notFoundResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  noContentResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { deleteRoutingRule, getRoutingRule, updateRoutingRule } from '@/lib/server/domains/inboxes'
+import type { RoutingRuleId } from '@quackback/ids'
+
+const patchSchema = z.object({
+  name: z.string().min(1).max(200).optional(),
+  description: z.string().max(1000).nullable().optional(),
+  priority: z.number().int().min(0).max(1_000_000).optional(),
+  enabled: z.boolean().optional(),
+  conditions: z.unknown().optional(),
+  actions: z.unknown().optional(),
+  inboxIdScope: z.string().nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/routing-rules/$ruleId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ROUTING_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ROUTING_RULE_MANAGE)) {
+            return forbiddenResponse('routing.rule.manage permission required')
+          }
+          const id = parseTypeId<RoutingRuleId>(params.ruleId, 'route_rule', 'rule ID')
+          const rule = await getRoutingRule(id)
+          if (!rule) return notFoundResponse('Rule not found')
+          return successResponse(rule)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ROUTING_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ROUTING_RULE_MANAGE)) {
+            return forbiddenResponse('routing.rule.manage permission required')
+          }
+          const id = parseTypeId<RoutingRuleId>(params.ruleId, 'route_rule', 'rule ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          return successResponse(await updateRoutingRule(id, parsed.data as never))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ROUTING_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ROUTING_RULE_MANAGE)) {
+            return forbiddenResponse('routing.rule.manage permission required')
+          }
+          const id = parseTypeId<RoutingRuleId>(params.ruleId, 'route_rule', 'rule ID')
+          await deleteRoutingRule(id)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/routing-rules/__tests__/routing-rules.test.ts b/apps/web/src/routes/api/v1/routing-rules/__tests__/routing-rules.test.ts
new file mode 100644
index 000000000..097c67228
--- /dev/null
+++ b/apps/web/src/routes/api/v1/routing-rules/__tests__/routing-rules.test.ts
@@ -0,0 +1,310 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  createRoutingRuleMock: vi.fn(),
+  updateRoutingRuleMock: vi.fn(),
+  deleteRoutingRuleMock: vi.fn(),
+  getRoutingRuleMock: vi.fn(),
+  listRoutingRulesMock: vi.fn(),
+  reorderRoutingRulesMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/inboxes', () => ({
+  createRoutingRule: (...args: unknown[]) => hoisted.createRoutingRuleMock(...args),
+  updateRoutingRule: (...args: unknown[]) => hoisted.updateRoutingRuleMock(...args),
+  deleteRoutingRule: (...args: unknown[]) => hoisted.deleteRoutingRuleMock(...args),
+  getRoutingRule: (...args: unknown[]) => hoisted.getRoutingRuleMock(...args),
+  listRoutingRules: (...args: unknown[]) => hoisted.listRoutingRulesMock(...args),
+  reorderRoutingRules: (...args: unknown[]) => hoisted.reorderRoutingRulesMock(...args),
+}))
+
+import { Route as DetailRoute } from '../$ruleId'
+import { Route as IndexRoute } from '../index'
+import { Route as ReorderRoute } from '../reorder'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const indexHandlers = (IndexRoute as unknown as RouteWithHandlers).options.server.handlers
+const detailHandlers = (DetailRoute as unknown as RouteWithHandlers).options.server.handlers
+const reorderHandlers = (ReorderRoute as unknown as RouteWithHandlers).options.server.handlers
+
+const PRINCIPAL = 'principal_admin'
+const RULE = 'route_rule_123'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/routing-rules')
+) {
+  return { request, params: handlerParams }
+}
+
+function conditions() {
+  return {
+    match: 'all',
+    conditions: [{ field: 'subject', op: 'contains', value: 'urgent' }],
+  }
+}
+
+function actions() {
+  return [{ type: 'assignToInbox', value: 'inbox_urgent' }]
+}
+
+function rule(overrides: Record<string, unknown> = {}) {
+  return {
+    id: RULE,
+    name: 'Urgent',
+    enabled: true,
+    priority: 10,
+    conditions: conditions(),
+    actions: actions(),
+    inboxIdScope: null,
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.reorderRoutingRulesMock.mockResolvedValue(undefined)
+  hoisted.deleteRoutingRuleMock.mockResolvedValue(undefined)
+})
+
+describe('/api/v1/routing-rules routes', () => {
+  it('lists and creates routing rules after scope and permission checks', async () => {
+    const row = rule()
+    hoisted.listRoutingRulesMock.mockResolvedValue([row])
+    hoisted.createRoutingRuleMock.mockResolvedValue(row)
+
+    const listResponse = await indexHandlers.GET(
+      args(
+        {},
+        new Request('http://test/api/v1/routing-rules?inboxIdScope=workspace&enabledOnly=true')
+      )
+    )
+    expect(listResponse.status).toBe(200)
+    expect(await expectJsonData(listResponse)).toEqual([row])
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ROUTING_RULE_MANAGE
+    )
+    expect(hoisted.listRoutingRulesMock).toHaveBeenCalledWith({
+      inboxIdScope: 'workspace',
+      enabledOnly: true,
+    })
+
+    const createResponse = await indexHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/routing-rules', 'POST', {
+          name: 'Urgent',
+          description: null,
+          priority: 5,
+          enabled: true,
+          conditions: conditions(),
+          actions: actions(),
+          inboxIdScope: null,
+        })
+      )
+    )
+    expect(createResponse.status).toBe(201)
+    expect(hoisted.createRoutingRuleMock).toHaveBeenCalledWith({
+      name: 'Urgent',
+      description: null,
+      priority: 5,
+      enabled: true,
+      conditions: conditions(),
+      actions: actions(),
+      inboxIdScope: null,
+    })
+  })
+
+  it('lists routing rules with omitted and inbox-specific filters', async () => {
+    const row = rule()
+    hoisted.listRoutingRulesMock.mockResolvedValue([row])
+
+    const defaultResponse = await indexHandlers.GET(
+      args({}, new Request('http://test/api/v1/routing-rules'))
+    )
+    expect(defaultResponse.status).toBe(200)
+    expect(hoisted.listRoutingRulesMock).toHaveBeenLastCalledWith({
+      inboxIdScope: undefined,
+      enabledOnly: false,
+    })
+
+    const inboxResponse = await indexHandlers.GET(
+      args({}, new Request('http://test/api/v1/routing-rules?inboxIdScope=inbox_support'))
+    )
+    expect(inboxResponse.status).toBe(200)
+    expect(hoisted.listRoutingRulesMock).toHaveBeenLastCalledWith({
+      inboxIdScope: 'inbox_support',
+      enabledOnly: false,
+    })
+  })
+
+  it('gets, patches, deletes, and returns not found for a routing rule', async () => {
+    const row = rule({ name: 'Priority support' })
+    hoisted.getRoutingRuleMock.mockResolvedValueOnce(row).mockResolvedValueOnce(null)
+    hoisted.updateRoutingRuleMock.mockResolvedValue(row)
+
+    const getResponse = await detailHandlers.GET(args({ ruleId: RULE }))
+    expect(getResponse.status).toBe(200)
+    expect(await expectJsonData(getResponse)).toEqual(row)
+    expect(hoisted.getRoutingRuleMock).toHaveBeenCalledWith(RULE)
+
+    const notFoundResponse = await detailHandlers.GET(args({ ruleId: RULE }))
+    expect(notFoundResponse.status).toBe(404)
+
+    const patchResponse = await detailHandlers.PATCH(
+      args(
+        { ruleId: RULE },
+        jsonRequest('http://test/api/v1/routing-rules/route_rule_123', 'PATCH', {
+          name: 'Priority support',
+          priority: 1,
+          enabled: false,
+          conditions: conditions(),
+          actions: actions(),
+        })
+      )
+    )
+    expect(patchResponse.status).toBe(200)
+    expect(hoisted.updateRoutingRuleMock).toHaveBeenCalledWith(
+      RULE,
+      expect.objectContaining({ name: 'Priority support', priority: 1, enabled: false })
+    )
+
+    const deleteResponse = await detailHandlers.DELETE(args({ ruleId: RULE }))
+    expect(deleteResponse.status).toBe(204)
+    expect(hoisted.deleteRoutingRuleMock).toHaveBeenCalledWith(RULE)
+  })
+
+  it('reorders rules and returns an ok response', async () => {
+    const response = await reorderHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/routing-rules/reorder', 'POST', {
+          orderedIds: ['route_rule_a', 'route_rule_b'],
+        })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual({ ok: true })
+    expect(hoisted.reorderRoutingRulesMock).toHaveBeenCalledWith(['route_rule_a', 'route_rule_b'])
+  })
+
+  it('returns 403 before domain calls when each handler permission check fails', async () => {
+    const cases = [
+      [indexHandlers.GET, args()],
+      [indexHandlers.POST, args({}, jsonRequest('http://test/api/v1/routing-rules', 'POST', {}))],
+      [detailHandlers.GET, args({ ruleId: RULE })],
+      [
+        detailHandlers.PATCH,
+        args(
+          { ruleId: RULE },
+          jsonRequest('http://test/api/v1/routing-rules/route_rule_123', 'PATCH', {})
+        ),
+      ],
+      [detailHandlers.DELETE, args({ ruleId: RULE })],
+      [
+        reorderHandlers.POST,
+        args({}, jsonRequest('http://test/api/v1/routing-rules/reorder', 'POST', {})),
+      ],
+    ] as const
+
+    for (const [handler, handlerArgs] of cases) {
+      hoisted.hasPermissionMock.mockReturnValueOnce(false)
+      const response = await handler(handlerArgs)
+      expect(response.status).toBe(403)
+    }
+
+    expect(hoisted.listRoutingRulesMock).not.toHaveBeenCalled()
+    expect(hoisted.createRoutingRuleMock).not.toHaveBeenCalled()
+    expect(hoisted.getRoutingRuleMock).not.toHaveBeenCalled()
+    expect(hoisted.updateRoutingRuleMock).not.toHaveBeenCalled()
+    expect(hoisted.deleteRoutingRuleMock).not.toHaveBeenCalled()
+    expect(hoisted.reorderRoutingRulesMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects invalid create, patch, and reorder bodies before mutating', async () => {
+    const cases = [
+      [
+        indexHandlers.POST,
+        args({}, jsonRequest('http://test/api/v1/routing-rules', 'POST', { name: '' })),
+      ],
+      [
+        detailHandlers.PATCH,
+        args(
+          { ruleId: RULE },
+          jsonRequest('http://test/api/v1/routing-rules/route_rule_123', 'PATCH', {
+            priority: -1,
+          })
+        ),
+      ],
+      [
+        reorderHandlers.POST,
+        args(
+          {},
+          jsonRequest('http://test/api/v1/routing-rules/reorder', 'POST', {
+            orderedIds: [],
+          })
+        ),
+      ],
+    ] as const
+
+    for (const [handler, handlerArgs] of cases) {
+      const response = await handler(handlerArgs)
+      expect(response.status).toBe(400)
+    }
+
+    expect(hoisted.createRoutingRuleMock).not.toHaveBeenCalled()
+    expect(hoisted.updateRoutingRuleMock).not.toHaveBeenCalled()
+    expect(hoisted.reorderRoutingRulesMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/v1/routing-rules/index.ts b/apps/web/src/routes/api/v1/routing-rules/index.ts
new file mode 100644
index 000000000..d5c366a99
--- /dev/null
+++ b/apps/web/src/routes/api/v1/routing-rules/index.ts
@@ -0,0 +1,72 @@
+/**
+ * GET  /api/v1/routing-rules — list rules
+ * POST /api/v1/routing-rules — create rule
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createRoutingRule, listRoutingRules } from '@/lib/server/domains/inboxes'
+import type { InboxId } from '@quackback/ids'
+
+const createSchema = z.object({
+  name: z.string().min(1).max(200),
+  description: z.string().max(1000).nullable().optional(),
+  priority: z.number().int().min(0).max(1_000_000).optional(),
+  enabled: z.boolean().optional(),
+  conditions: z.unknown(),
+  actions: z.unknown(),
+  inboxIdScope: z.string().nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/routing-rules/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ROUTING_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ROUTING_RULE_MANAGE)) {
+            return forbiddenResponse('routing.rule.manage permission required')
+          }
+          const url = new URL(request.url)
+          const inboxIdScopeRaw = url.searchParams.get('inboxIdScope') ?? undefined
+          const enabledOnly = url.searchParams.get('enabledOnly') === 'true'
+          const inboxIdScope =
+            inboxIdScopeRaw === 'workspace' ? 'workspace' : (inboxIdScopeRaw as InboxId | undefined)
+          return successResponse(await listRoutingRules({ inboxIdScope, enabledOnly }))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ROUTING_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ROUTING_RULE_MANAGE)) {
+            return forbiddenResponse('routing.rule.manage permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const rule = await createRoutingRule(parsed.data as never)
+          return createdResponse(rule)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/routing-rules/reorder.ts b/apps/web/src/routes/api/v1/routing-rules/reorder.ts
new file mode 100644
index 000000000..3230141e8
--- /dev/null
+++ b/apps/web/src/routes/api/v1/routing-rules/reorder.ts
@@ -0,0 +1,45 @@
+/**
+ * POST /api/v1/routing-rules/reorder — replace ordering by passing all rule
+ * IDs in desired evaluation order.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { reorderRoutingRules } from '@/lib/server/domains/inboxes'
+import type { RoutingRuleId } from '@quackback/ids'
+
+const schema = z.object({ orderedIds: z.array(z.string().min(1)).min(1) })
+
+export const Route = createFileRoute('/api/v1/routing-rules/reorder')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ROUTING_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ROUTING_RULE_MANAGE)) {
+            return forbiddenResponse('routing.rule.manage permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = schema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          await reorderRoutingRules(parsed.data.orderedIds as RoutingRuleId[])
+          return successResponse({ ok: true })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/sla-policies/$policyId.escalation-rules.$ruleId.ts b/apps/web/src/routes/api/v1/sla-policies/$policyId.escalation-rules.$ruleId.ts
new file mode 100644
index 000000000..79f2999a6
--- /dev/null
+++ b/apps/web/src/routes/api/v1/sla-policies/$policyId.escalation-rules.$ruleId.ts
@@ -0,0 +1,72 @@
+/**
+ * PATCH  /api/v1/sla-policies/:policyId/escalation-rules/:ruleId
+ * DELETE /api/v1/sla-policies/:policyId/escalation-rules/:ruleId
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  noContentResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { deleteEscalationRule, updateEscalationRule } from '@/lib/server/domains/sla'
+import { SLA_TARGET_KINDS, ESCALATION_RECIPIENT_TYPES, ESCALATION_CHANNELS } from '@/lib/server/db'
+import type { EscalationRuleId } from '@quackback/ids'
+
+const patchSchema = z.object({
+  name: z.string().min(1).max(200).optional(),
+  leadMinutes: z.number().int().optional(),
+  targetKind: z.enum(SLA_TARGET_KINDS).optional(),
+  recipientType: z.enum(ESCALATION_RECIPIENT_TYPES).optional(),
+  recipientTeamId: z.string().nullable().optional(),
+  recipientPrincipalIds: z.array(z.string()).optional(),
+  channels: z.array(z.enum(ESCALATION_CHANNELS)).optional(),
+  enabled: z.boolean().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/sla-policies/$policyId/escalation-rules/$ruleId')({
+  server: {
+    handlers: {
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ESCALATION_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ESCALATION_RULE_MANAGE)) {
+            return forbiddenResponse('escalation.rule_manage permission required')
+          }
+          const id = parseTypeId<EscalationRuleId>(params.ruleId, 'esc_rule', 'rule ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          return successResponse(await updateEscalationRule(id, parsed.data as never))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ESCALATION_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ESCALATION_RULE_MANAGE)) {
+            return forbiddenResponse('escalation.rule_manage permission required')
+          }
+          const id = parseTypeId<EscalationRuleId>(params.ruleId, 'esc_rule', 'rule ID')
+          await deleteEscalationRule(id)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/sla-policies/$policyId.escalation-rules.ts b/apps/web/src/routes/api/v1/sla-policies/$policyId.escalation-rules.ts
new file mode 100644
index 000000000..2ac8f5a3b
--- /dev/null
+++ b/apps/web/src/routes/api/v1/sla-policies/$policyId.escalation-rules.ts
@@ -0,0 +1,75 @@
+/**
+ * GET  /api/v1/sla-policies/:policyId/escalation-rules
+ * POST /api/v1/sla-policies/:policyId/escalation-rules
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createEscalationRule, listEscalationRulesForPolicy } from '@/lib/server/domains/sla'
+import { SLA_TARGET_KINDS, ESCALATION_RECIPIENT_TYPES, ESCALATION_CHANNELS } from '@/lib/server/db'
+import type { SlaPolicyId } from '@quackback/ids'
+
+const createSchema = z.object({
+  name: z.string().min(1).max(200),
+  leadMinutes: z.number().int(),
+  targetKind: z.enum(SLA_TARGET_KINDS),
+  recipientType: z.enum(ESCALATION_RECIPIENT_TYPES),
+  recipientTeamId: z.string().nullable().optional(),
+  recipientPrincipalIds: z.array(z.string()).optional(),
+  channels: z.array(z.enum(ESCALATION_CHANNELS)).optional(),
+  enabled: z.boolean().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/sla-policies/$policyId/escalation-rules')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_VIEW)
+          if (!hasPermission(set, PERMISSIONS.SLA_VIEW)) {
+            return forbiddenResponse('sla.view permission required')
+          }
+          const id = parseTypeId<SlaPolicyId>(params.policyId, 'sla_pol', 'policy ID')
+          return successResponse(await listEscalationRulesForPolicy(id))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.ESCALATION_RULE_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.ESCALATION_RULE_MANAGE)) {
+            return forbiddenResponse('escalation.rule_manage permission required')
+          }
+          const id = parseTypeId<SlaPolicyId>(params.policyId, 'sla_pol', 'policy ID')
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const rule = await createEscalationRule({
+            ...(parsed.data as Record<string, unknown>),
+            policyId: id,
+          } as never)
+          return createdResponse(rule)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/sla-policies/$policyId.targets.ts b/apps/web/src/routes/api/v1/sla-policies/$policyId.targets.ts
new file mode 100644
index 000000000..dc526f464
--- /dev/null
+++ b/apps/web/src/routes/api/v1/sla-policies/$policyId.targets.ts
@@ -0,0 +1,68 @@
+/**
+ * GET /api/v1/sla-policies/:policyId/targets — list targets
+ * PUT /api/v1/sla-policies/:policyId/targets — replace target set
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { listTargetsForPolicy, replaceTargets } from '@/lib/server/domains/sla'
+import { SLA_TARGET_KINDS } from '@/lib/server/db'
+import type { SlaPolicyId } from '@quackback/ids'
+
+const putSchema = z.object({
+  targets: z.array(
+    z.object({
+      kind: z.enum(SLA_TARGET_KINDS),
+      minutes: z.number().int().positive(),
+    })
+  ),
+})
+
+export const Route = createFileRoute('/api/v1/sla-policies/$policyId/targets')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_VIEW)
+          if (!hasPermission(set, PERMISSIONS.SLA_VIEW)) {
+            return forbiddenResponse('sla.view permission required')
+          }
+          const id = parseTypeId<SlaPolicyId>(params.policyId, 'sla_pol', 'policy ID')
+          return successResponse(await listTargetsForPolicy(id))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PUT: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.SLA_MANAGE)) {
+            return forbiddenResponse('sla.manage permission required')
+          }
+          const id = parseTypeId<SlaPolicyId>(params.policyId, 'sla_pol', 'policy ID')
+          const body = await request.json().catch(() => null)
+          const parsed = putSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          return successResponse(await replaceTargets(id, parsed.data.targets))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/sla-policies/$policyId.ts b/apps/web/src/routes/api/v1/sla-policies/$policyId.ts
new file mode 100644
index 000000000..b989df501
--- /dev/null
+++ b/apps/web/src/routes/api/v1/sla-policies/$policyId.ts
@@ -0,0 +1,98 @@
+/**
+ * GET    /api/v1/sla-policies/:policyId
+ * PATCH  /api/v1/sla-policies/:policyId
+ * DELETE /api/v1/sla-policies/:policyId (archive)
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  notFoundResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  noContentResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  archiveSlaPolicy,
+  getSlaPolicy,
+  listEscalationRulesForPolicy,
+  listTargetsForPolicy,
+  updateSlaPolicy,
+} from '@/lib/server/domains/sla'
+import { TICKET_PRIORITIES } from '@/lib/server/db'
+import type { SlaPolicyId } from '@quackback/ids'
+
+const patchSchema = z.object({
+  name: z.string().min(1).max(200).optional(),
+  description: z.string().max(1000).nullable().optional(),
+  priority: z.number().int().optional(),
+  enabled: z.boolean().optional(),
+  appliesToPriorities: z.array(z.enum(TICKET_PRIORITIES)).optional(),
+  businessHoursId: z.string().nullable().optional(),
+  pauseOnPending: z.boolean().optional(),
+  pauseOnOnHold: z.boolean().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/sla-policies/$policyId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_VIEW)
+          if (!hasPermission(set, PERMISSIONS.SLA_VIEW)) {
+            return forbiddenResponse('sla.view permission required')
+          }
+          const id = parseTypeId<SlaPolicyId>(params.policyId, 'sla_pol', 'policy ID')
+          const policy = await getSlaPolicy(id)
+          if (!policy) return notFoundResponse('Policy not found')
+          const targets = await listTargetsForPolicy(id)
+          const escalations = await listEscalationRulesForPolicy(id)
+          return successResponse({ policy, targets, escalations })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.SLA_MANAGE)) {
+            return forbiddenResponse('sla.manage permission required')
+          }
+          const id = parseTypeId<SlaPolicyId>(params.policyId, 'sla_pol', 'policy ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          return successResponse(await updateSlaPolicy(id, parsed.data as never))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.SLA_MANAGE)) {
+            return forbiddenResponse('sla.manage permission required')
+          }
+          const id = parseTypeId<SlaPolicyId>(params.policyId, 'sla_pol', 'policy ID')
+          await archiveSlaPolicy(id)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/sla-policies/__tests__/sla-policies.coverage.test.ts b/apps/web/src/routes/api/v1/sla-policies/__tests__/sla-policies.coverage.test.ts
new file mode 100644
index 000000000..2744e381d
--- /dev/null
+++ b/apps/web/src/routes/api/v1/sla-policies/__tests__/sla-policies.coverage.test.ts
@@ -0,0 +1,859 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+// Hoisted mock functions for every dependency the SLA policy routes touch.
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  // sla domain service functions
+  listSlaPoliciesMock: vi.fn(),
+  createSlaPolicyMock: vi.fn(),
+  getSlaPolicyMock: vi.fn(),
+  updateSlaPolicyMock: vi.fn(),
+  archiveSlaPolicyMock: vi.fn(),
+  listTargetsForPolicyMock: vi.fn(),
+  replaceTargetsMock: vi.fn(),
+  listEscalationRulesForPolicyMock: vi.fn(),
+  createEscalationRuleMock: vi.fn(),
+  updateEscalationRuleMock: vi.fn(),
+  deleteEscalationRuleMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/sla', () => ({
+  listSlaPolicies: (...args: unknown[]) => hoisted.listSlaPoliciesMock(...args),
+  createSlaPolicy: (...args: unknown[]) => hoisted.createSlaPolicyMock(...args),
+  getSlaPolicy: (...args: unknown[]) => hoisted.getSlaPolicyMock(...args),
+  updateSlaPolicy: (...args: unknown[]) => hoisted.updateSlaPolicyMock(...args),
+  archiveSlaPolicy: (...args: unknown[]) => hoisted.archiveSlaPolicyMock(...args),
+  listTargetsForPolicy: (...args: unknown[]) => hoisted.listTargetsForPolicyMock(...args),
+  replaceTargets: (...args: unknown[]) => hoisted.replaceTargetsMock(...args),
+  listEscalationRulesForPolicy: (...args: unknown[]) =>
+    hoisted.listEscalationRulesForPolicyMock(...args),
+  createEscalationRule: (...args: unknown[]) => hoisted.createEscalationRuleMock(...args),
+  updateEscalationRule: (...args: unknown[]) => hoisted.updateEscalationRuleMock(...args),
+  deleteEscalationRule: (...args: unknown[]) => hoisted.deleteEscalationRuleMock(...args),
+}))
+
+// The routes only import enum constants from the db module, so mock just those.
+vi.mock('@/lib/server/db', () => ({
+  SLA_POLICY_SCOPES: ['workspace', 'team', 'inbox'],
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  SLA_TARGET_KINDS: ['first_response', 'next_response', 'resolution'],
+  ESCALATION_RECIPIENT_TYPES: ['assignee', 'team', 'principals', 'inbox_members'],
+  ESCALATION_CHANNELS: ['in_app', 'email', 'webhook'],
+}))
+
+import { Route as PolicyDetailRoute } from '../$policyId'
+import { Route as EscalationRuleDetailRoute } from '../$policyId.escalation-rules.$ruleId'
+import { Route as EscalationRulesRoute } from '../$policyId.escalation-rules'
+import { Route as TargetsRoute } from '../$policyId.targets'
+import { Route as PoliciesRoute } from '../index'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const policyHandlers = (PoliciesRoute as unknown as RouteWithHandlers).options.server.handlers
+const policyDetailHandlers = (PolicyDetailRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const targetHandlers = (TargetsRoute as unknown as RouteWithHandlers).options.server.handlers
+const escalationRulesHandlers = (EscalationRulesRoute as unknown as RouteWithHandlers).options
+  .server.handlers
+const escalationRuleDetailHandlers = (EscalationRuleDetailRoute as unknown as RouteWithHandlers)
+  .options.server.handlers
+
+const PRINCIPAL = 'principal_admin'
+const POLICY = 'sla_pol_123'
+const RULE = 'esc_rule_123'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/sla-policies')
+) {
+  return { request, params: handlerParams }
+}
+
+function policy(overrides: Record<string, unknown> = {}) {
+  return {
+    id: POLICY,
+    name: 'Standard SLA',
+    description: null,
+    priority: 0,
+    enabled: true,
+    scope: 'workspace',
+    ...overrides,
+  }
+}
+
+function target(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'sla_tgt_123',
+    policyId: POLICY,
+    kind: 'first_response',
+    minutes: 60,
+    ...overrides,
+  }
+}
+
+function escalationRule(overrides: Record<string, unknown> = {}) {
+  return {
+    id: RULE,
+    policyId: POLICY,
+    name: 'Escalate to lead',
+    leadMinutes: 15,
+    targetKind: 'resolution',
+    recipientType: 'team',
+    enabled: true,
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+})
+
+describe('/api/v1/sla-policies index route', () => {
+  it('lists policies and forwards the includeArchived=true query toggle', async () => {
+    const rows = [policy()]
+    hoisted.listSlaPoliciesMock.mockResolvedValue(rows)
+
+    const response = await policyHandlers.GET(
+      args({}, new Request('http://test/api/v1/sla-policies?includeArchived=true'))
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(rows)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_VIEW
+    )
+    expect(hoisted.listSlaPoliciesMock).toHaveBeenCalledWith({ includeArchived: true })
+  })
+
+  it('lists policies with includeArchived=false when the query param is absent', async () => {
+    hoisted.listSlaPoliciesMock.mockResolvedValue([])
+
+    const response = await policyHandlers.GET(args())
+
+    expect(response.status).toBe(200)
+    expect(hoisted.listSlaPoliciesMock).toHaveBeenCalledWith({ includeArchived: false })
+  })
+
+  it('returns 403 when the caller lacks sla.view on list', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await policyHandlers.GET(args())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.listSlaPoliciesMock).not.toHaveBeenCalled()
+  })
+
+  it('creates a policy with the full optional payload', async () => {
+    const row = policy()
+    hoisted.createSlaPolicyMock.mockResolvedValue(row)
+
+    const response = await policyHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/sla-policies', 'POST', {
+          name: 'Standard SLA',
+          description: 'Workspace default',
+          priority: 1,
+          enabled: true,
+          scope: 'team',
+          scopeTeamId: 'team_1',
+          scopeInboxId: null,
+          appliesToPriorities: ['high', 'urgent'],
+          businessHoursId: 'bh_1',
+          pauseOnPending: true,
+          pauseOnOnHold: false,
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(row)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_MANAGE
+    )
+    expect(hoisted.createSlaPolicyMock).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'Standard SLA', scope: 'team', priority: 1 })
+    )
+  })
+
+  it('creates a policy with only the required fields', async () => {
+    const row = policy()
+    hoisted.createSlaPolicyMock.mockResolvedValue(row)
+
+    const response = await policyHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/sla-policies', 'POST', {
+          name: 'Minimal',
+          scope: 'workspace',
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(hoisted.createSlaPolicyMock).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'Minimal', scope: 'workspace' })
+    )
+  })
+
+  it('returns 403 when the caller lacks sla.manage on create', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await policyHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/sla-policies', 'POST', { name: 'x', scope: 'workspace' })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.createSlaPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 on an invalid create body and never calls the service', async () => {
+    const response = await policyHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/sla-policies', 'POST', {
+          name: '',
+          scope: 'invalid-scope',
+        })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.createSlaPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the create body is not valid JSON (null body)', async () => {
+    // request.json() rejects, the .catch(() => null) feeds null into safeParse.
+    const response = await policyHandlers.POST(
+      args(
+        {},
+        new Request('http://test/api/v1/sla-policies', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: 'not-json',
+        })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.createSlaPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown domain error through handleDomainError on list', async () => {
+    hoisted.listSlaPoliciesMock.mockRejectedValue(new Error('boom'))
+
+    const response = await policyHandlers.GET(args())
+
+    expect(response.status).toBe(500)
+  })
+
+  it('routes a thrown domain error through handleDomainError on create', async () => {
+    hoisted.createSlaPolicyMock.mockRejectedValue(new Error('boom'))
+
+    const response = await policyHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/sla-policies', 'POST', {
+          name: 'Standard SLA',
+          scope: 'workspace',
+        })
+      )
+    )
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('/api/v1/sla-policies/$policyId route', () => {
+  it('gets a policy with its targets and escalations', async () => {
+    const policyRow = policy()
+    const targets = [target()]
+    const escalations = [escalationRule()]
+    hoisted.getSlaPolicyMock.mockResolvedValue(policyRow)
+    hoisted.listTargetsForPolicyMock.mockResolvedValue(targets)
+    hoisted.listEscalationRulesForPolicyMock.mockResolvedValue(escalations)
+
+    const response = await policyDetailHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual({ policy: policyRow, targets, escalations })
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(POLICY, 'sla_pol', 'policy ID')
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_VIEW
+    )
+    expect(hoisted.getSlaPolicyMock).toHaveBeenCalledWith(POLICY)
+    expect(hoisted.listTargetsForPolicyMock).toHaveBeenCalledWith(POLICY)
+    expect(hoisted.listEscalationRulesForPolicyMock).toHaveBeenCalledWith(POLICY)
+  })
+
+  it('returns 404 when the policy does not exist and skips the follow-up lookups', async () => {
+    hoisted.getSlaPolicyMock.mockResolvedValue(null)
+
+    const response = await policyDetailHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(404)
+    expect(hoisted.listTargetsForPolicyMock).not.toHaveBeenCalled()
+    expect(hoisted.listEscalationRulesForPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller lacks sla.view on get', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await policyDetailHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.getSlaPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('patches a policy', async () => {
+    const updated = policy({ name: 'Updated' })
+    hoisted.updateSlaPolicyMock.mockResolvedValue(updated)
+
+    const response = await policyDetailHandlers.PATCH(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123', 'PATCH', {
+          name: 'Updated',
+          description: null,
+          priority: 5,
+          enabled: false,
+          appliesToPriorities: ['low'],
+          businessHoursId: null,
+          pauseOnPending: false,
+          pauseOnOnHold: true,
+        })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(updated)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_MANAGE
+    )
+    expect(hoisted.updateSlaPolicyMock).toHaveBeenCalledWith(
+      POLICY,
+      expect.objectContaining({ name: 'Updated', priority: 5 })
+    )
+  })
+
+  it('returns 403 when the caller lacks sla.manage on patch', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await policyDetailHandlers.PATCH(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123', 'PATCH', { name: 'x' })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.updateSlaPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 on an invalid patch body', async () => {
+    const response = await policyDetailHandlers.PATCH(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123', 'PATCH', { name: '' })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.updateSlaPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('archives (deletes) a policy with 204', async () => {
+    hoisted.archiveSlaPolicyMock.mockResolvedValue(undefined)
+
+    const response = await policyDetailHandlers.DELETE(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(204)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_MANAGE
+    )
+    expect(hoisted.archiveSlaPolicyMock).toHaveBeenCalledWith(POLICY)
+  })
+
+  it('returns 403 when the caller lacks sla.manage on delete', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await policyDetailHandlers.DELETE(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.archiveSlaPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown domain error through handleDomainError on get', async () => {
+    hoisted.getSlaPolicyMock.mockRejectedValue(new Error('boom'))
+
+    const response = await policyDetailHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(500)
+  })
+
+  it('routes a thrown domain error through handleDomainError on patch', async () => {
+    hoisted.updateSlaPolicyMock.mockRejectedValue(new Error('boom'))
+
+    const response = await policyDetailHandlers.PATCH(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123', 'PATCH', { name: 'x' })
+      )
+    )
+
+    expect(response.status).toBe(500)
+  })
+
+  it('routes a thrown domain error through handleDomainError on delete', async () => {
+    hoisted.archiveSlaPolicyMock.mockRejectedValue(new Error('boom'))
+
+    const response = await policyDetailHandlers.DELETE(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('/api/v1/sla-policies/$policyId/targets route', () => {
+  it('lists targets for a policy', async () => {
+    const targets = [target()]
+    hoisted.listTargetsForPolicyMock.mockResolvedValue(targets)
+
+    const response = await targetHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(targets)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_VIEW
+    )
+    expect(hoisted.listTargetsForPolicyMock).toHaveBeenCalledWith(POLICY)
+  })
+
+  it('returns 403 when the caller lacks sla.view on target list', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await targetHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.listTargetsForPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('replaces the target set via PUT', async () => {
+    const replaced = [target(), target({ id: 'sla_tgt_456', kind: 'resolution', minutes: 480 })]
+    hoisted.replaceTargetsMock.mockResolvedValue(replaced)
+
+    const response = await targetHandlers.PUT(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/targets', 'PUT', {
+          targets: [
+            { kind: 'first_response', minutes: 60 },
+            { kind: 'resolution', minutes: 480 },
+          ],
+        })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(replaced)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_MANAGE
+    )
+    expect(hoisted.replaceTargetsMock).toHaveBeenCalledWith(POLICY, [
+      { kind: 'first_response', minutes: 60 },
+      { kind: 'resolution', minutes: 480 },
+    ])
+  })
+
+  it('replaces with an empty target set', async () => {
+    hoisted.replaceTargetsMock.mockResolvedValue([])
+
+    const response = await targetHandlers.PUT(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/targets', 'PUT', { targets: [] })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(hoisted.replaceTargetsMock).toHaveBeenCalledWith(POLICY, [])
+  })
+
+  it('returns 403 when the caller lacks sla.manage on PUT', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await targetHandlers.PUT(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/targets', 'PUT', { targets: [] })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.replaceTargetsMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the PUT body is invalid (non-positive minutes)', async () => {
+    const response = await targetHandlers.PUT(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/targets', 'PUT', {
+          targets: [{ kind: 'first_response', minutes: 0 }],
+        })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.replaceTargetsMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown domain error through handleDomainError on target list', async () => {
+    hoisted.listTargetsForPolicyMock.mockRejectedValue(new Error('boom'))
+
+    const response = await targetHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(500)
+  })
+
+  it('routes a thrown domain error through handleDomainError on target replace', async () => {
+    hoisted.replaceTargetsMock.mockRejectedValue(new Error('boom'))
+
+    const response = await targetHandlers.PUT(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/targets', 'PUT', { targets: [] })
+      )
+    )
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('/api/v1/sla-policies/$policyId/escalation-rules route', () => {
+  it('lists escalation rules for a policy', async () => {
+    const rules = [escalationRule()]
+    hoisted.listEscalationRulesForPolicyMock.mockResolvedValue(rules)
+
+    const response = await escalationRulesHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(rules)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_VIEW
+    )
+    expect(hoisted.listEscalationRulesForPolicyMock).toHaveBeenCalledWith(POLICY)
+  })
+
+  it('returns 403 when the caller lacks sla.view on escalation list', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await escalationRulesHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.listEscalationRulesForPolicyMock).not.toHaveBeenCalled()
+  })
+
+  it('creates an escalation rule with the full optional payload and injects policyId', async () => {
+    const row = escalationRule()
+    hoisted.createEscalationRuleMock.mockResolvedValue(row)
+
+    const response = await escalationRulesHandlers.POST(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/escalation-rules', 'POST', {
+          name: 'Escalate to lead',
+          leadMinutes: 15,
+          targetKind: 'resolution',
+          recipientType: 'principals',
+          recipientTeamId: null,
+          recipientPrincipalIds: ['principal_lead'],
+          channels: ['in_app', 'email'],
+          enabled: true,
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(row)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ESCALATION_RULE_MANAGE
+    )
+    expect(hoisted.createEscalationRuleMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'Escalate to lead',
+        leadMinutes: 15,
+        targetKind: 'resolution',
+        recipientType: 'principals',
+        policyId: POLICY,
+      })
+    )
+  })
+
+  it('creates an escalation rule with only the required fields', async () => {
+    const row = escalationRule()
+    hoisted.createEscalationRuleMock.mockResolvedValue(row)
+
+    const response = await escalationRulesHandlers.POST(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/escalation-rules', 'POST', {
+          name: 'Minimal rule',
+          leadMinutes: 0,
+          targetKind: 'first_response',
+          recipientType: 'assignee',
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(hoisted.createEscalationRuleMock).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'Minimal rule', policyId: POLICY })
+    )
+  })
+
+  it('returns 403 when the caller lacks escalation.rule_manage on create', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await escalationRulesHandlers.POST(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/escalation-rules', 'POST', {
+          name: 'x',
+          leadMinutes: 1,
+          targetKind: 'resolution',
+          recipientType: 'team',
+        })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.createEscalationRuleMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 on an invalid escalation create body', async () => {
+    const response = await escalationRulesHandlers.POST(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/escalation-rules', 'POST', {
+          name: '',
+          leadMinutes: 1,
+          targetKind: 'not-a-kind',
+          recipientType: 'team',
+        })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.createEscalationRuleMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown domain error through handleDomainError on escalation list', async () => {
+    hoisted.listEscalationRulesForPolicyMock.mockRejectedValue(new Error('boom'))
+
+    const response = await escalationRulesHandlers.GET(args({ policyId: POLICY }))
+
+    expect(response.status).toBe(500)
+  })
+
+  it('routes a thrown domain error through handleDomainError on escalation create', async () => {
+    hoisted.createEscalationRuleMock.mockRejectedValue(new Error('boom'))
+
+    const response = await escalationRulesHandlers.POST(
+      args(
+        { policyId: POLICY },
+        jsonRequest('http://test/api/v1/sla-policies/sla_pol_123/escalation-rules', 'POST', {
+          name: 'Minimal rule',
+          leadMinutes: 0,
+          targetKind: 'first_response',
+          recipientType: 'assignee',
+        })
+      )
+    )
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('/api/v1/sla-policies/$policyId/escalation-rules/$ruleId route', () => {
+  it('patches an escalation rule', async () => {
+    const updated = escalationRule({ name: 'Updated rule' })
+    hoisted.updateEscalationRuleMock.mockResolvedValue(updated)
+
+    const response = await escalationRuleDetailHandlers.PATCH(
+      args(
+        { policyId: POLICY, ruleId: RULE },
+        jsonRequest(
+          'http://test/api/v1/sla-policies/sla_pol_123/escalation-rules/esc_rule_123',
+          'PATCH',
+          {
+            name: 'Updated rule',
+            leadMinutes: 30,
+            targetKind: 'next_response',
+            recipientType: 'inbox_members',
+            recipientTeamId: null,
+            recipientPrincipalIds: ['principal_x'],
+            channels: ['webhook'],
+            enabled: false,
+          }
+        )
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(updated)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(RULE, 'esc_rule', 'rule ID')
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ESCALATION_RULE_MANAGE
+    )
+    expect(hoisted.updateEscalationRuleMock).toHaveBeenCalledWith(
+      RULE,
+      expect.objectContaining({ name: 'Updated rule', leadMinutes: 30 })
+    )
+  })
+
+  it('returns 403 when the caller lacks escalation.rule_manage on patch', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await escalationRuleDetailHandlers.PATCH(
+      args(
+        { policyId: POLICY, ruleId: RULE },
+        jsonRequest(
+          'http://test/api/v1/sla-policies/sla_pol_123/escalation-rules/esc_rule_123',
+          'PATCH',
+          { name: 'x' }
+        )
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.updateEscalationRuleMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 on an invalid escalation patch body', async () => {
+    const response = await escalationRuleDetailHandlers.PATCH(
+      args(
+        { policyId: POLICY, ruleId: RULE },
+        jsonRequest(
+          'http://test/api/v1/sla-policies/sla_pol_123/escalation-rules/esc_rule_123',
+          'PATCH',
+          { leadMinutes: 1.5 }
+        )
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.updateEscalationRuleMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown domain error through handleDomainError on patch', async () => {
+    hoisted.updateEscalationRuleMock.mockRejectedValue(new Error('boom'))
+
+    const response = await escalationRuleDetailHandlers.PATCH(
+      args(
+        { policyId: POLICY, ruleId: RULE },
+        jsonRequest(
+          'http://test/api/v1/sla-policies/sla_pol_123/escalation-rules/esc_rule_123',
+          'PATCH',
+          { name: 'Updated rule' }
+        )
+      )
+    )
+
+    expect(response.status).toBe(500)
+  })
+
+  it('deletes an escalation rule with 204', async () => {
+    hoisted.deleteEscalationRuleMock.mockResolvedValue(undefined)
+
+    const response = await escalationRuleDetailHandlers.DELETE(
+      args({ policyId: POLICY, ruleId: RULE })
+    )
+
+    expect(response.status).toBe(204)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ESCALATION_RULE_MANAGE
+    )
+    expect(hoisted.deleteEscalationRuleMock).toHaveBeenCalledWith(RULE)
+  })
+
+  it('returns 403 when the caller lacks escalation.rule_manage on delete', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await escalationRuleDetailHandlers.DELETE(
+      args({ policyId: POLICY, ruleId: RULE })
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.deleteEscalationRuleMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown domain error through handleDomainError on delete', async () => {
+    hoisted.deleteEscalationRuleMock.mockRejectedValue(new Error('boom'))
+
+    const response = await escalationRuleDetailHandlers.DELETE(
+      args({ policyId: POLICY, ruleId: RULE })
+    )
+
+    expect(response.status).toBe(500)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/sla-policies/index.ts b/apps/web/src/routes/api/v1/sla-policies/index.ts
new file mode 100644
index 000000000..0c3dffa6c
--- /dev/null
+++ b/apps/web/src/routes/api/v1/sla-policies/index.ts
@@ -0,0 +1,73 @@
+/**
+ * GET  /api/v1/sla-policies — list policies
+ * POST /api/v1/sla-policies — create policy
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createSlaPolicy, listSlaPolicies } from '@/lib/server/domains/sla'
+import { SLA_POLICY_SCOPES, TICKET_PRIORITIES } from '@/lib/server/db'
+
+const createSchema = z.object({
+  name: z.string().min(1).max(200),
+  description: z.string().max(1000).nullable().optional(),
+  priority: z.number().int().optional(),
+  enabled: z.boolean().optional(),
+  scope: z.enum(SLA_POLICY_SCOPES),
+  scopeTeamId: z.string().nullable().optional(),
+  scopeInboxId: z.string().nullable().optional(),
+  appliesToPriorities: z.array(z.enum(TICKET_PRIORITIES)).optional(),
+  businessHoursId: z.string().nullable().optional(),
+  pauseOnPending: z.boolean().optional(),
+  pauseOnOnHold: z.boolean().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/sla-policies/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_VIEW)
+          if (!hasPermission(set, PERMISSIONS.SLA_VIEW)) {
+            return forbiddenResponse('sla.view permission required')
+          }
+          const url = new URL(request.url)
+          const includeArchived = url.searchParams.get('includeArchived') === 'true'
+          return successResponse(await listSlaPolicies({ includeArchived }))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_MANAGE)
+          if (!hasPermission(set, PERMISSIONS.SLA_MANAGE)) {
+            return forbiddenResponse('sla.manage permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const policy = await createSlaPolicy(parsed.data as never)
+          return createdResponse(policy)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/teams/$teamId.members.$principalId.ts b/apps/web/src/routes/api/v1/teams/$teamId.members.$principalId.ts
new file mode 100644
index 000000000..85cc70f88
--- /dev/null
+++ b/apps/web/src/routes/api/v1/teams/$teamId.members.$principalId.ts
@@ -0,0 +1,42 @@
+/**
+ * DELETE /api/v1/teams/:teamId/members/:principalId — remove a team member.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  noContentResponse,
+  forbiddenResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import type { TeamId, PrincipalId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/teams/$teamId/members/$principalId')({
+  server: {
+    handlers: {
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_MANAGE)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_MANAGE)) {
+            return forbiddenResponse('team.manage permission required')
+          }
+          const teamId = parseTypeId<TeamId>(params.teamId, 'team', 'team ID')
+          const principalId = parseTypeId<PrincipalId>(
+            params.principalId,
+            'principal',
+            'principal ID'
+          )
+          const { removeMember } = await import('@/lib/server/domains/teams/team.service')
+          await removeMember(teamId, principalId)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/teams/$teamId.members.ts b/apps/web/src/routes/api/v1/teams/$teamId.members.ts
new file mode 100644
index 000000000..38120514a
--- /dev/null
+++ b/apps/web/src/routes/api/v1/teams/$teamId.members.ts
@@ -0,0 +1,67 @@
+/**
+ * GET  /api/v1/teams/:teamId/members — list team members
+ * POST /api/v1/teams/:teamId/members — add/update a member { principalId, role? }
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { addTeamMemberSchema } from '@/lib/shared/schemas/teams'
+import type { TeamId, PrincipalId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/teams/$teamId/members')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_VIEW)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_VIEW)) {
+            return forbiddenResponse('team.view permission required')
+          }
+          const teamId = parseTypeId<TeamId>(params.teamId, 'team', 'team ID')
+          const { listMembers } = await import('@/lib/server/domains/teams/team.service')
+          return successResponse(await listMembers(teamId))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_MANAGE)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_MANAGE)) {
+            return forbiddenResponse('team.manage permission required')
+          }
+          const teamId = parseTypeId<TeamId>(params.teamId, 'team', 'team ID')
+          const parsed = addTeamMemberSchema.safeParse(await request.json().catch(() => null))
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const principalId = parseTypeId<PrincipalId>(
+            parsed.data.principalId,
+            'principal',
+            'principal ID'
+          )
+          const { addMember } = await import('@/lib/server/domains/teams/team.service')
+          return createdResponse(await addMember(teamId, principalId, parsed.data.role ?? 'member'))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/teams/$teamId.ts b/apps/web/src/routes/api/v1/teams/$teamId.ts
new file mode 100644
index 000000000..ac03ca692
--- /dev/null
+++ b/apps/web/src/routes/api/v1/teams/$teamId.ts
@@ -0,0 +1,84 @@
+/**
+ * GET    /api/v1/teams/:teamId — fetch one team
+ * PATCH  /api/v1/teams/:teamId — update a team
+ * DELETE /api/v1/teams/:teamId — archive a team (use POST /unarchive to restore)
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  noContentResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  notFoundResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { updateTeamSchema } from '@/lib/shared/schemas/teams'
+import type { TeamId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/teams/$teamId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_VIEW)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_VIEW)) {
+            return forbiddenResponse('team.view permission required')
+          }
+          const teamId = parseTypeId<TeamId>(params.teamId, 'team', 'team ID')
+          const { getTeam } = await import('@/lib/server/domains/teams/team.service')
+          const team = await getTeam(teamId)
+          if (!team) return notFoundResponse('Team')
+          return successResponse(team)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_MANAGE)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_MANAGE)) {
+            return forbiddenResponse('team.manage permission required')
+          }
+          const teamId = parseTypeId<TeamId>(params.teamId, 'team', 'team ID')
+          const parsed = updateTeamSchema.safeParse(await request.json().catch(() => null))
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const { updateTeam } = await import('@/lib/server/domains/teams/team.service')
+          const team = await updateTeam(teamId, parsed.data, { principalId: auth.principalId })
+          return successResponse(team)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_MANAGE)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_MANAGE)) {
+            return forbiddenResponse('team.manage permission required')
+          }
+          const teamId = parseTypeId<TeamId>(params.teamId, 'team', 'team ID')
+          const { archiveTeam } = await import('@/lib/server/domains/teams/team.service')
+          await archiveTeam(teamId, { principalId: auth.principalId })
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/teams/$teamId.unarchive.ts b/apps/web/src/routes/api/v1/teams/$teamId.unarchive.ts
new file mode 100644
index 000000000..99b1522f8
--- /dev/null
+++ b/apps/web/src/routes/api/v1/teams/$teamId.unarchive.ts
@@ -0,0 +1,40 @@
+/**
+ * POST /api/v1/teams/:teamId/unarchive — restore an archived team.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import type { TeamId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/teams/$teamId/unarchive')({
+  server: {
+    handlers: {
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_MANAGE)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_MANAGE)) {
+            return forbiddenResponse('team.manage permission required')
+          }
+          const teamId = parseTypeId<TeamId>(params.teamId, 'team', 'team ID')
+          const { unarchiveTeam, getTeam } = await import('@/lib/server/domains/teams/team.service')
+          await unarchiveTeam(teamId, { principalId: auth.principalId })
+          const team = await getTeam(teamId)
+          if (!team) return notFoundResponse('Team')
+          return successResponse(team)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/teams/__tests__/teams.coverage.test.ts b/apps/web/src/routes/api/v1/teams/__tests__/teams.coverage.test.ts
new file mode 100644
index 000000000..03503bc14
--- /dev/null
+++ b/apps/web/src/routes/api/v1/teams/__tests__/teams.coverage.test.ts
@@ -0,0 +1,567 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+/**
+ * Request-level behaviour tests for the teams REST route handlers.
+ * Mirrors the canonical inboxes coverage test. Each route resolves its
+ * domain service through a dynamic `await import(...)`, so we mock the
+ * team.service module — Vitest hoists vi.mock above the route imports,
+ * so the dynamic imports inside the handlers resolve to these mocks.
+ */
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  listTeamsMock: vi.fn(),
+  createTeamMock: vi.fn(),
+  getTeamMock: vi.fn(),
+  updateTeamMock: vi.fn(),
+  archiveTeamMock: vi.fn(),
+  unarchiveTeamMock: vi.fn(),
+  listMembersMock: vi.fn(),
+  addMemberMock: vi.fn(),
+  removeMemberMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/teams/team.service', () => ({
+  listTeams: (...args: unknown[]) => hoisted.listTeamsMock(...args),
+  createTeam: (...args: unknown[]) => hoisted.createTeamMock(...args),
+  getTeam: (...args: unknown[]) => hoisted.getTeamMock(...args),
+  updateTeam: (...args: unknown[]) => hoisted.updateTeamMock(...args),
+  archiveTeam: (...args: unknown[]) => hoisted.archiveTeamMock(...args),
+  unarchiveTeam: (...args: unknown[]) => hoisted.unarchiveTeamMock(...args),
+  listMembers: (...args: unknown[]) => hoisted.listMembersMock(...args),
+  addMember: (...args: unknown[]) => hoisted.addMemberMock(...args),
+  removeMember: (...args: unknown[]) => hoisted.removeMemberMock(...args),
+}))
+
+import { Route as MemberDetailRoute } from '../$teamId.members.$principalId'
+import { Route as MembersRoute } from '../$teamId.members'
+import { Route as TeamDetailRoute } from '../$teamId'
+import { Route as UnarchiveRoute } from '../$teamId.unarchive'
+import { Route as TeamsRoute } from '../index'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const teamHandlers = (TeamsRoute as unknown as RouteWithHandlers).options.server.handlers
+const teamDetailHandlers = (TeamDetailRoute as unknown as RouteWithHandlers).options.server.handlers
+const unarchiveHandlers = (UnarchiveRoute as unknown as RouteWithHandlers).options.server.handlers
+const memberHandlers = (MembersRoute as unknown as RouteWithHandlers).options.server.handlers
+const memberDetailHandlers = (MemberDetailRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+
+const PRINCIPAL = 'principal_admin'
+const TEAM = 'team_123'
+const MEMBER_PRINCIPAL = 'principal_member'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/teams')
+) {
+  return { request, params: handlerParams }
+}
+
+function team(overrides: Record<string, unknown> = {}) {
+  return {
+    id: TEAM,
+    slug: 'support',
+    name: 'Support',
+    description: null,
+    shortLabel: null,
+    color: null,
+    archivedAt: null,
+    ...overrides,
+  }
+}
+
+function member(overrides: Record<string, unknown> = {}) {
+  return {
+    teamId: TEAM,
+    principalId: MEMBER_PRINCIPAL,
+    role: 'member',
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+/**
+ * A request whose body is not valid JSON, so `request.json()` rejects and the
+ * handler's `.catch(() => null)` fallback fires (exercising that callback before
+ * safeParse rejects the null body with a 400).
+ */
+function malformedJsonRequest(url: string, method: string) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: 'not-json{',
+  })
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+})
+
+describe('/api/v1/teams routes', () => {
+  it('lists teams (default and includeArchived) after scope and permission checks', async () => {
+    const row = team()
+    hoisted.listTeamsMock.mockResolvedValue([row])
+
+    // Default: includeArchived omitted -> false branch
+    const listResponse = await teamHandlers.GET(args())
+    expect(listResponse.status).toBe(200)
+    expect(await expectJsonData(listResponse)).toEqual([row])
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_VIEW
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(expect.any(Set), PERMISSIONS.TEAM_VIEW)
+    expect(hoisted.listTeamsMock).toHaveBeenCalledWith({ includeArchived: false })
+
+    // includeArchived=true -> true branch
+    const archivedResponse = await teamHandlers.GET(
+      args({}, new Request('http://test/api/v1/teams?includeArchived=true'))
+    )
+    expect(archivedResponse.status).toBe(200)
+    expect(hoisted.listTeamsMock).toHaveBeenLastCalledWith({ includeArchived: true })
+  })
+
+  it('creates a team after scope and permission checks', async () => {
+    const row = team()
+    hoisted.createTeamMock.mockResolvedValue(row)
+
+    const createResponse = await teamHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/teams', 'POST', {
+          slug: 'support',
+          name: 'Support',
+          description: null,
+          shortLabel: null,
+          color: null,
+        })
+      )
+    )
+    expect(createResponse.status).toBe(201)
+    expect(await expectJsonData(createResponse)).toEqual(row)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_MANAGE
+    )
+    expect(hoisted.createTeamMock).toHaveBeenCalledWith(
+      expect.objectContaining({ slug: 'support', name: 'Support' }),
+      { principalId: PRINCIPAL }
+    )
+  })
+
+  it('rejects an invalid create body before calling the service', async () => {
+    const response = await teamHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/teams', 'POST', { slug: 'support', name: '' }))
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.createTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects a malformed JSON create body via the null fallback', async () => {
+    const response = await teamHandlers.POST(
+      args({}, malformedJsonRequest('http://test/api/v1/teams', 'POST'))
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.createTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('denies list and create with 403 when permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const listResponse = await teamHandlers.GET(args())
+    expect(listResponse.status).toBe(403)
+    expect(hoisted.listTeamsMock).not.toHaveBeenCalled()
+
+    const createResponse = await teamHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/teams', 'POST', { slug: 'support', name: 'Support' })
+      )
+    )
+    expect(createResponse.status).toBe(403)
+    expect(hoisted.createTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('surfaces domain errors raised while listing as a mapped response', async () => {
+    hoisted.listTeamsMock.mockRejectedValue({ code: 'CONFLICT', message: 'boom' })
+    const response = await teamHandlers.GET(args())
+    expect(response.status).toBe(409)
+  })
+
+  it('maps a domain error thrown by createTeam', async () => {
+    hoisted.createTeamMock.mockRejectedValue({ code: 'CONFLICT', message: 'slug taken' })
+    const response = await teamHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/teams', 'POST', { slug: 'support', name: 'Support' })
+      )
+    )
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('/api/v1/teams/:teamId routes', () => {
+  it('gets a team after scope and permission checks', async () => {
+    const row = team({ name: 'Priority support' })
+    hoisted.getTeamMock.mockResolvedValue(row)
+
+    const response = await teamDetailHandlers.GET(args({ teamId: TEAM }))
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(row)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_VIEW
+    )
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TEAM, 'team', 'team ID')
+    expect(hoisted.getTeamMock).toHaveBeenCalledWith(TEAM)
+  })
+
+  it('returns 404 when the team does not exist on GET', async () => {
+    hoisted.getTeamMock.mockResolvedValue(null)
+    const response = await teamDetailHandlers.GET(args({ teamId: TEAM }))
+    expect(response.status).toBe(404)
+  })
+
+  it('patches a team after scope and permission checks', async () => {
+    const row = team({ name: 'Renamed' })
+    hoisted.updateTeamMock.mockResolvedValue(row)
+
+    const response = await teamDetailHandlers.PATCH(
+      args(
+        { teamId: TEAM },
+        jsonRequest('http://test/api/v1/teams/team_123', 'PATCH', { name: 'Renamed' })
+      )
+    )
+    expect(response.status).toBe(200)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_MANAGE
+    )
+    expect(hoisted.updateTeamMock).toHaveBeenCalledWith(
+      TEAM,
+      { name: 'Renamed' },
+      { principalId: PRINCIPAL }
+    )
+  })
+
+  it('rejects an invalid patch body before calling the service', async () => {
+    const response = await teamDetailHandlers.PATCH(
+      args(
+        { teamId: TEAM },
+        jsonRequest('http://test/api/v1/teams/team_123', 'PATCH', { name: '' })
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.updateTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects a malformed JSON patch body via the null fallback', async () => {
+    const response = await teamDetailHandlers.PATCH(
+      args({ teamId: TEAM }, malformedJsonRequest('http://test/api/v1/teams/team_123', 'PATCH'))
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.updateTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('archives a team via DELETE after scope and permission checks', async () => {
+    hoisted.archiveTeamMock.mockResolvedValue(undefined)
+    const response = await teamDetailHandlers.DELETE(args({ teamId: TEAM }))
+    expect(response.status).toBe(204)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_MANAGE
+    )
+    expect(hoisted.archiveTeamMock).toHaveBeenCalledWith(TEAM, { principalId: PRINCIPAL })
+  })
+
+  it('denies GET, PATCH, and DELETE with 403 when permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const getResponse = await teamDetailHandlers.GET(args({ teamId: TEAM }))
+    expect(getResponse.status).toBe(403)
+    expect(hoisted.getTeamMock).not.toHaveBeenCalled()
+
+    const patchResponse = await teamDetailHandlers.PATCH(
+      args({ teamId: TEAM }, jsonRequest('http://test/api/v1/teams/team_123', 'PATCH', {}))
+    )
+    expect(patchResponse.status).toBe(403)
+    expect(hoisted.updateTeamMock).not.toHaveBeenCalled()
+
+    const deleteResponse = await teamDetailHandlers.DELETE(args({ teamId: TEAM }))
+    expect(deleteResponse.status).toBe(403)
+    expect(hoisted.archiveTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a domain error thrown by parseTypeId on GET', async () => {
+    hoisted.parseTypeIdMock.mockImplementation(() => {
+      throw { code: 'VALIDATION_ERROR', message: 'Invalid team ID format' }
+    })
+    const response = await teamDetailHandlers.GET(args({ teamId: 'bad' }))
+    expect(response.status).toBe(400)
+    expect(hoisted.getTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a domain error thrown by updateTeam on PATCH', async () => {
+    hoisted.updateTeamMock.mockRejectedValue({ code: 'NOT_FOUND', message: 'gone' })
+    const response = await teamDetailHandlers.PATCH(
+      args(
+        { teamId: TEAM },
+        jsonRequest('http://test/api/v1/teams/team_123', 'PATCH', { name: 'Renamed' })
+      )
+    )
+    expect(response.status).toBe(404)
+  })
+
+  it('maps a domain error thrown by archiveTeam on DELETE', async () => {
+    hoisted.archiveTeamMock.mockRejectedValue({ code: 'CONFLICT', message: 'cannot archive' })
+    const response = await teamDetailHandlers.DELETE(args({ teamId: TEAM }))
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('/api/v1/teams/:teamId/unarchive route', () => {
+  it('unarchives a team and returns the restored row', async () => {
+    const row = team({ archivedAt: null })
+    hoisted.unarchiveTeamMock.mockResolvedValue(undefined)
+    hoisted.getTeamMock.mockResolvedValue(row)
+
+    const response = await unarchiveHandlers.POST(args({ teamId: TEAM }))
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(row)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_MANAGE
+    )
+    expect(hoisted.unarchiveTeamMock).toHaveBeenCalledWith(TEAM, { principalId: PRINCIPAL })
+    expect(hoisted.getTeamMock).toHaveBeenCalledWith(TEAM)
+  })
+
+  it('returns 404 when the team cannot be reloaded after unarchive', async () => {
+    hoisted.unarchiveTeamMock.mockResolvedValue(undefined)
+    hoisted.getTeamMock.mockResolvedValue(null)
+
+    const response = await unarchiveHandlers.POST(args({ teamId: TEAM }))
+    expect(response.status).toBe(404)
+  })
+
+  it('denies unarchive with 403 when permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await unarchiveHandlers.POST(args({ teamId: TEAM }))
+    expect(response.status).toBe(403)
+    expect(hoisted.unarchiveTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a domain error thrown by unarchiveTeam', async () => {
+    hoisted.unarchiveTeamMock.mockRejectedValue({ code: 'NOT_FOUND', message: 'gone' })
+    const response = await unarchiveHandlers.POST(args({ teamId: TEAM }))
+    expect(response.status).toBe(404)
+  })
+})
+
+describe('/api/v1/teams/:teamId/members routes', () => {
+  it('lists members after scope and permission checks', async () => {
+    const row = member()
+    hoisted.listMembersMock.mockResolvedValue([row])
+
+    const response = await memberHandlers.GET(args({ teamId: TEAM }))
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual([row])
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_VIEW
+    )
+    expect(hoisted.listMembersMock).toHaveBeenCalledWith(TEAM)
+  })
+
+  it('adds a member with an explicit role', async () => {
+    const row = member({ role: 'lead' })
+    hoisted.addMemberMock.mockResolvedValue(row)
+
+    const response = await memberHandlers.POST(
+      args(
+        { teamId: TEAM },
+        jsonRequest('http://test/api/v1/teams/team_123/members', 'POST', {
+          principalId: MEMBER_PRINCIPAL,
+          role: 'lead',
+        })
+      )
+    )
+    expect(response.status).toBe(201)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_MANAGE
+    )
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(
+      MEMBER_PRINCIPAL,
+      'principal',
+      'principal ID'
+    )
+    expect(hoisted.addMemberMock).toHaveBeenCalledWith(TEAM, MEMBER_PRINCIPAL, 'lead')
+  })
+
+  it('adds a member defaulting the role to member when omitted', async () => {
+    const row = member()
+    hoisted.addMemberMock.mockResolvedValue(row)
+
+    const response = await memberHandlers.POST(
+      args(
+        { teamId: TEAM },
+        jsonRequest('http://test/api/v1/teams/team_123/members', 'POST', {
+          principalId: MEMBER_PRINCIPAL,
+        })
+      )
+    )
+    expect(response.status).toBe(201)
+    // role omitted -> nullish-coalescing default branch ('member')
+    expect(hoisted.addMemberMock).toHaveBeenCalledWith(TEAM, MEMBER_PRINCIPAL, 'member')
+  })
+
+  it('rejects an invalid add-member body before calling the service', async () => {
+    const response = await memberHandlers.POST(
+      args(
+        { teamId: TEAM },
+        jsonRequest('http://test/api/v1/teams/team_123/members', 'POST', {
+          principalId: '',
+          role: 'member',
+        })
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.addMemberMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects a malformed JSON add-member body via the null fallback', async () => {
+    const response = await memberHandlers.POST(
+      args(
+        { teamId: TEAM },
+        malformedJsonRequest('http://test/api/v1/teams/team_123/members', 'POST')
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.addMemberMock).not.toHaveBeenCalled()
+  })
+
+  it('denies list and add-member with 403 when permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const listResponse = await memberHandlers.GET(args({ teamId: TEAM }))
+    expect(listResponse.status).toBe(403)
+    expect(hoisted.listMembersMock).not.toHaveBeenCalled()
+
+    const addResponse = await memberHandlers.POST(
+      args(
+        { teamId: TEAM },
+        jsonRequest('http://test/api/v1/teams/team_123/members', 'POST', {
+          principalId: MEMBER_PRINCIPAL,
+        })
+      )
+    )
+    expect(addResponse.status).toBe(403)
+    expect(hoisted.addMemberMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a domain error thrown by listMembers', async () => {
+    hoisted.listMembersMock.mockRejectedValue({ code: 'NOT_FOUND', message: 'gone' })
+    const response = await memberHandlers.GET(args({ teamId: TEAM }))
+    expect(response.status).toBe(404)
+  })
+
+  it('maps a domain error thrown by addMember', async () => {
+    hoisted.addMemberMock.mockRejectedValue({ code: 'CONFLICT', message: 'already a member' })
+    const response = await memberHandlers.POST(
+      args(
+        { teamId: TEAM },
+        jsonRequest('http://test/api/v1/teams/team_123/members', 'POST', {
+          principalId: MEMBER_PRINCIPAL,
+        })
+      )
+    )
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('/api/v1/teams/:teamId/members/:principalId route', () => {
+  it('removes a member after scope and permission checks', async () => {
+    hoisted.removeMemberMock.mockResolvedValue(undefined)
+
+    const response = await memberDetailHandlers.DELETE(
+      args({ teamId: TEAM, principalId: MEMBER_PRINCIPAL })
+    )
+    expect(response.status).toBe(204)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TEAM_MANAGE
+    )
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TEAM, 'team', 'team ID')
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(
+      MEMBER_PRINCIPAL,
+      'principal',
+      'principal ID'
+    )
+    expect(hoisted.removeMemberMock).toHaveBeenCalledWith(TEAM, MEMBER_PRINCIPAL)
+  })
+
+  it('denies member removal with 403 when permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await memberDetailHandlers.DELETE(
+      args({ teamId: TEAM, principalId: MEMBER_PRINCIPAL })
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.removeMemberMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a domain error thrown by removeMember', async () => {
+    hoisted.removeMemberMock.mockRejectedValue({ code: 'NOT_FOUND', message: 'gone' })
+    const response = await memberDetailHandlers.DELETE(
+      args({ teamId: TEAM, principalId: MEMBER_PRINCIPAL })
+    )
+    expect(response.status).toBe(404)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/teams/index.ts b/apps/web/src/routes/api/v1/teams/index.ts
new file mode 100644
index 000000000..500528fee
--- /dev/null
+++ b/apps/web/src/routes/api/v1/teams/index.ts
@@ -0,0 +1,63 @@
+/**
+ * GET  /api/v1/teams — list teams (?includeArchived=true)
+ * POST /api/v1/teams — create a team
+ *
+ * Scope-gated with team.view / team.manage.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createTeamSchema } from '@/lib/shared/schemas/teams'
+
+export const Route = createFileRoute('/api/v1/teams/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_VIEW)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_VIEW)) {
+            return forbiddenResponse('team.view permission required')
+          }
+          const includeArchived =
+            new URL(request.url).searchParams.get('includeArchived') === 'true'
+          const { listTeams } = await import('@/lib/server/domains/teams/team.service')
+          return successResponse(await listTeams({ includeArchived }))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          assertScopeAllowed(auth, PERMISSIONS.TEAM_MANAGE)
+          const set = await loadPermissionSet(auth.principalId)
+          if (!hasPermission(set, PERMISSIONS.TEAM_MANAGE)) {
+            return forbiddenResponse('team.manage permission required')
+          }
+          const parsed = createTeamSchema.safeParse(await request.json().catch(() => null))
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const { createTeam } = await import('@/lib/server/domains/teams/team.service')
+          const team = await createTeam(parsed.data, { principalId: auth.principalId })
+          return createdResponse(team)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/ticket-statuses/$statusId.ts b/apps/web/src/routes/api/v1/ticket-statuses/$statusId.ts
new file mode 100644
index 000000000..07ec7845c
--- /dev/null
+++ b/apps/web/src/routes/api/v1/ticket-statuses/$statusId.ts
@@ -0,0 +1,124 @@
+/**
+ * GET    /api/v1/ticket-statuses/:statusId
+ * PATCH  /api/v1/ticket-statuses/:statusId
+ * DELETE /api/v1/ticket-statuses/:statusId   (archive; rejects if referenced)
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  noContentResponse,
+  notFoundResponse,
+  badRequestResponse,
+  conflictResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { db, tickets, eq, and, isNull, sql } from '@/lib/server/db'
+import {
+  getTicketStatus,
+  updateTicketStatus,
+  archiveTicketStatus,
+} from '@/lib/server/domains/tickets'
+import { TICKET_STATUS_CATEGORIES } from '@/lib/server/db'
+import type { TicketStatusId } from '@quackback/ids'
+
+const updateSchema = z.object({
+  name: z.string().min(1).max(50).optional(),
+  color: z
+    .string()
+    .regex(/^#[0-9A-Fa-f]{6}$/, 'color must be a valid hex color')
+    .optional(),
+  category: z.enum(TICKET_STATUS_CATEGORIES).optional(),
+  position: z.number().int().min(0).optional(),
+  isDefault: z.boolean().optional(),
+})
+
+function serialize(row: {
+  id: string
+  name: string
+  slug: string
+  color: string | null
+  category: string
+  position: number
+  isDefault: boolean
+  isSystem: boolean
+  createdAt: Date
+  deletedAt: Date | null
+}) {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    color: row.color,
+    category: row.category,
+    position: row.position,
+    isDefault: row.isDefault,
+    isSystem: row.isSystem,
+    createdAt: row.createdAt.toISOString(),
+    deletedAt: row.deletedAt ? row.deletedAt.toISOString() : null,
+  }
+}
+
+export const Route = createFileRoute('/api/v1/ticket-statuses/$statusId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          await withApiKeyAuth(request, { role: 'team' })
+          const id = parseTypeId<TicketStatusId>(params.statusId, 'ticket_status', 'status ID')
+          const row = await getTicketStatus(id)
+          if (!row) return notFoundResponse('Ticket status')
+          return successResponse(serialize(row))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'admin' })
+          const id = parseTypeId<TicketStatusId>(params.statusId, 'ticket_status', 'status ID')
+          const body = await request.json().catch(() => null)
+          const parsed = updateSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const row = await updateTicketStatus(id, parsed.data, {
+            principalId: auth.principalId,
+          })
+          return successResponse(serialize(row))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'admin' })
+          const id = parseTypeId<TicketStatusId>(params.statusId, 'ticket_status', 'status ID')
+
+          // Block archive when active tickets still reference this status, so
+          // we don't orphan their `statusId`. Match the behaviour we use for
+          // inboxes archival (no cascade reassign).
+          const refRows = await db
+            .select({ count: sql<number>`count(*)::int` })
+            .from(tickets)
+            .where(and(eq(tickets.statusId, id), isNull(tickets.deletedAt)))
+          const referencedBy = refRows[0]?.count ?? 0
+          if (referencedBy > 0) {
+            return conflictResponse(
+              `ticket status is still referenced by ${referencedBy} active ticket(s)`
+            )
+          }
+
+          await archiveTicketStatus(id, { principalId: auth.principalId })
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/ticket-statuses/__tests__/ticket-statuses.coverage.test.ts b/apps/web/src/routes/api/v1/ticket-statuses/__tests__/ticket-statuses.coverage.test.ts
new file mode 100644
index 000000000..063500f43
--- /dev/null
+++ b/apps/web/src/routes/api/v1/ticket-statuses/__tests__/ticket-statuses.coverage.test.ts
@@ -0,0 +1,528 @@
+/**
+ * Request-level behaviour coverage for the ticket-status workflow catalogue
+ * routes:
+ *   - GET/POST  /api/v1/ticket-statuses          (index.ts)
+ *   - GET/PATCH/DELETE /api/v1/ticket-statuses/:statusId  ($statusId.ts)
+ *
+ * Unlike the inboxes cluster, these handlers gate purely on `withApiKeyAuth`
+ * role checks (no assertScopeAllowed / hasPermission / PERMISSIONS). A denied
+ * caller therefore surfaces as a thrown ForbiddenError routed through
+ * handleDomainError (→ 403). The api/responses and handleDomainError modules
+ * are intentionally left unmocked so real status codes flow.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { ForbiddenError, NotFoundError, ValidationError } from '@/lib/shared/errors'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  listTicketStatusesMock: vi.fn(),
+  createTicketStatusMock: vi.fn(),
+  getTicketStatusMock: vi.fn(),
+  updateTicketStatusMock: vi.fn(),
+  archiveTicketStatusMock: vi.fn(),
+  // db.select() chain stub for the DELETE reference-count guard.
+  dbSelectMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets', () => ({
+  listTicketStatuses: (...args: unknown[]) => hoisted.listTicketStatusesMock(...args),
+  createTicketStatus: (...args: unknown[]) => hoisted.createTicketStatusMock(...args),
+  getTicketStatus: (...args: unknown[]) => hoisted.getTicketStatusMock(...args),
+  updateTicketStatus: (...args: unknown[]) => hoisted.updateTicketStatusMock(...args),
+  archiveTicketStatus: (...args: unknown[]) => hoisted.archiveTicketStatusMock(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  TICKET_STATUS_CATEGORIES: ['open', 'pending', 'on_hold', 'solved', 'closed'],
+  db: {
+    select: (...args: unknown[]) => hoisted.dbSelectMock(...args),
+  },
+  // Tables/operators used only to build the predicate; their identity does not
+  // matter to the assertions, so simple sentinels keep the mock honest.
+  tickets: { statusId: 'tickets.statusId', deletedAt: 'tickets.deletedAt' },
+  eq: vi.fn((col, val) => ({ _eq: [col, val] })),
+  and: vi.fn((...args) => ({ _and: args })),
+  isNull: vi.fn((col) => ({ _isNull: col })),
+  sql: Object.assign(
+    (strings: TemplateStringsArray, ...values: unknown[]) => ({ _sql: { strings, values } }),
+    {}
+  ),
+}))
+
+import { Route as IndexRoute } from '../index'
+import { Route as StatusDetailRoute } from '../$statusId'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const indexHandlers = (IndexRoute as unknown as RouteWithHandlers).options.server.handlers
+const detailHandlers = (StatusDetailRoute as unknown as RouteWithHandlers).options.server.handlers
+
+const PRINCIPAL = 'principal_admin'
+const STATUS_ID = 'ticket_status_123'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/ticket-statuses')
+) {
+  return { request, params: handlerParams }
+}
+
+/** A persisted ticket-status row as the domain service would return it. */
+function statusRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: STATUS_ID,
+    name: 'In progress',
+    slug: 'in-progress',
+    color: '#00AABB',
+    category: 'open',
+    position: 1,
+    isDefault: false,
+    isSystem: false,
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    deletedAt: null,
+    ...overrides,
+  }
+}
+
+/** Shape the route's serialize() output (Dates → ISO strings). */
+function serialized(row: ReturnType<typeof statusRow>) {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    color: row.color,
+    category: row.category,
+    position: row.position,
+    isDefault: row.isDefault,
+    isSystem: row.isSystem,
+    createdAt: (row.createdAt as Date).toISOString(),
+    deletedAt: row.deletedAt ? (row.deletedAt as Date).toISOString() : null,
+  }
+}
+
+/** Stub for `db.select({...}).from(tickets).where(...)` resolving to `rows`. */
+function makeRefChain(rows: unknown[]) {
+  return {
+    from: vi.fn().mockReturnValue({
+      where: vi.fn().mockResolvedValue(rows),
+    }),
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'admin',
+    key: { scopes: [] },
+  })
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+})
+
+describe('GET/POST /api/v1/ticket-statuses (index)', () => {
+  it('lists statuses with includeDeleted=false by default and gates on the team role', async () => {
+    const row = statusRow()
+    hoisted.listTicketStatusesMock.mockResolvedValue([row])
+
+    const response = await indexHandlers.GET(args())
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual([serialized(row)])
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.listTicketStatusesMock).toHaveBeenCalledWith({ includeDeleted: false })
+  })
+
+  it('honours the includeDeleted=true query toggle', async () => {
+    const archived = statusRow({ deletedAt: new Date('2026-02-02T00:00:00.000Z') })
+    hoisted.listTicketStatusesMock.mockResolvedValue([archived])
+
+    const response = await indexHandlers.GET(
+      args({}, new Request('http://test/api/v1/ticket-statuses?includeDeleted=true'))
+    )
+    expect(response.status).toBe(200)
+    // Archived rows serialise deletedAt to an ISO string (the non-null branch).
+    expect(await expectJsonData(response)).toEqual([serialized(archived)])
+    expect(hoisted.listTicketStatusesMock).toHaveBeenCalledWith({ includeDeleted: true })
+  })
+
+  it('treats any non-"true" includeDeleted value as false', async () => {
+    hoisted.listTicketStatusesMock.mockResolvedValue([])
+
+    const response = await indexHandlers.GET(
+      args({}, new Request('http://test/api/v1/ticket-statuses?includeDeleted=yes'))
+    )
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual([])
+    expect(hoisted.listTicketStatusesMock).toHaveBeenCalledWith({ includeDeleted: false })
+  })
+
+  it('returns 403 when the listing caller is not authorised', async () => {
+    hoisted.withApiKeyAuthMock.mockRejectedValueOnce(new ForbiddenError('FORBIDDEN', 'nope'))
+
+    const response = await indexHandlers.GET(args())
+    expect(response.status).toBe(403)
+    expect(hoisted.listTicketStatusesMock).not.toHaveBeenCalled()
+  })
+
+  it('creates a status with all optional fields, gating on the admin role', async () => {
+    const row = statusRow({ name: 'Waiting', slug: 'waiting', category: 'pending', position: 3 })
+    hoisted.createTicketStatusMock.mockResolvedValue(row)
+
+    const response = await indexHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/ticket-statuses', 'POST', {
+          name: 'Waiting',
+          slug: 'waiting',
+          color: '#112233',
+          category: 'pending',
+          position: 3,
+          isDefault: true,
+        })
+      )
+    )
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(serialized(row))
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'admin' })
+    expect(hoisted.createTicketStatusMock).toHaveBeenCalledWith(
+      {
+        name: 'Waiting',
+        slug: 'waiting',
+        color: '#112233',
+        category: 'pending',
+        position: 3,
+        isDefault: true,
+      },
+      { principalId: PRINCIPAL }
+    )
+  })
+
+  it('creates a status with only required fields (optionals resolve to undefined)', async () => {
+    const row = statusRow({ name: 'Minimal', slug: 'minimal', color: null })
+    hoisted.createTicketStatusMock.mockResolvedValue(row)
+
+    const response = await indexHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/ticket-statuses', 'POST', {
+          name: 'Minimal',
+          slug: 'minimal',
+          category: 'open',
+        })
+      )
+    )
+    expect(response.status).toBe(201)
+    expect(hoisted.createTicketStatusMock).toHaveBeenCalledWith(
+      {
+        name: 'Minimal',
+        slug: 'minimal',
+        color: undefined,
+        category: 'open',
+        position: undefined,
+        isDefault: undefined,
+      },
+      { principalId: PRINCIPAL }
+    )
+    // serialize() returns null for a null colour column.
+    expect(await expectJsonData(response)).toEqual(serialized(row))
+  })
+
+  it('rejects an invalid create body with 400 before calling the service', async () => {
+    const response = await indexHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/ticket-statuses', 'POST', {
+          name: '',
+          slug: 'Bad Slug!',
+          category: 'open',
+        })
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.createTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('treats a non-JSON create body as null and returns 400', async () => {
+    // request.json() throws → caught into `null` → safeParse fails.
+    const badRequest = new Request('http://test/api/v1/ticket-statuses', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+    const response = await indexHandlers.POST(args({}, badRequest))
+    expect(response.status).toBe(400)
+    expect(hoisted.createTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the create caller is not an admin', async () => {
+    hoisted.withApiKeyAuthMock.mockRejectedValueOnce(new ForbiddenError('FORBIDDEN', 'nope'))
+
+    const response = await indexHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/ticket-statuses', 'POST', {
+          name: 'Waiting',
+          slug: 'waiting',
+          category: 'pending',
+        })
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.createTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a service conflict (DUPLICATE_SLUG) to 409 on create', async () => {
+    hoisted.createTicketStatusMock.mockRejectedValueOnce({
+      code: 'DUPLICATE_SLUG',
+      message: 'slug already exists',
+    })
+
+    const response = await indexHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/ticket-statuses', 'POST', {
+          name: 'Waiting',
+          slug: 'waiting',
+          category: 'pending',
+        })
+      )
+    )
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('GET/PATCH/DELETE /api/v1/ticket-statuses/:statusId (detail)', () => {
+  it('returns a single status and parses the id with the ticket_status prefix', async () => {
+    const row = statusRow()
+    hoisted.getTicketStatusMock.mockResolvedValue(row)
+
+    const response = await detailHandlers.GET(args({ statusId: STATUS_ID }))
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(serialized(row))
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(STATUS_ID, 'ticket_status', 'status ID')
+    expect(hoisted.getTicketStatusMock).toHaveBeenCalledWith(STATUS_ID)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+  })
+
+  it('serializes archived detail statuses with an ISO deletedAt timestamp', async () => {
+    const row = statusRow({ deletedAt: new Date('2026-02-03T00:00:00.000Z') })
+    hoisted.getTicketStatusMock.mockResolvedValue(row)
+
+    const response = await detailHandlers.GET(args({ statusId: STATUS_ID }))
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(serialized(row))
+  })
+
+  it('returns 404 when the status does not exist', async () => {
+    hoisted.getTicketStatusMock.mockResolvedValue(null)
+
+    const response = await detailHandlers.GET(args({ statusId: STATUS_ID }))
+    expect(response.status).toBe(404)
+  })
+
+  it('returns 403 when the GET caller is not authorised', async () => {
+    hoisted.withApiKeyAuthMock.mockRejectedValueOnce(new ForbiddenError('FORBIDDEN', 'nope'))
+
+    const response = await detailHandlers.GET(args({ statusId: STATUS_ID }))
+    expect(response.status).toBe(403)
+    expect(hoisted.getTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('maps an invalid id (parseTypeId throws) to 400 on GET', async () => {
+    hoisted.parseTypeIdMock.mockImplementationOnce(() => {
+      throw new ValidationError('VALIDATION_ERROR', 'Invalid status ID format')
+    })
+
+    const response = await detailHandlers.GET(args({ statusId: 'not-an-id' }))
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('patches a status, gating on admin and passing the parsed body through', async () => {
+    const row = statusRow({ name: 'Renamed', position: 5 })
+    hoisted.updateTicketStatusMock.mockResolvedValue(row)
+
+    const response = await detailHandlers.PATCH(
+      args(
+        { statusId: STATUS_ID },
+        jsonRequest('http://test/api/v1/ticket-statuses/ticket_status_123', 'PATCH', {
+          name: 'Renamed',
+          color: '#445566',
+          category: 'on_hold',
+          position: 5,
+          isDefault: true,
+        })
+      )
+    )
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(serialized(row))
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'admin' })
+    expect(hoisted.updateTicketStatusMock).toHaveBeenCalledWith(
+      STATUS_ID,
+      {
+        name: 'Renamed',
+        color: '#445566',
+        category: 'on_hold',
+        position: 5,
+        isDefault: true,
+      },
+      { principalId: PRINCIPAL }
+    )
+  })
+
+  it('accepts an empty patch body (all fields optional)', async () => {
+    const row = statusRow()
+    hoisted.updateTicketStatusMock.mockResolvedValue(row)
+
+    const response = await detailHandlers.PATCH(
+      args(
+        { statusId: STATUS_ID },
+        jsonRequest('http://test/api/v1/ticket-statuses/ticket_status_123', 'PATCH', {})
+      )
+    )
+    expect(response.status).toBe(200)
+    expect(hoisted.updateTicketStatusMock).toHaveBeenCalledWith(
+      STATUS_ID,
+      {},
+      {
+        principalId: PRINCIPAL,
+      }
+    )
+  })
+
+  it('rejects an invalid patch body with 400 before calling the service', async () => {
+    const response = await detailHandlers.PATCH(
+      args(
+        { statusId: STATUS_ID },
+        jsonRequest('http://test/api/v1/ticket-statuses/ticket_status_123', 'PATCH', {
+          color: 'red',
+        })
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.updateTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('treats a non-JSON patch body as null and returns 400', async () => {
+    const badRequest = new Request('http://test/api/v1/ticket-statuses/ticket_status_123', {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+    const response = await detailHandlers.PATCH(args({ statusId: STATUS_ID }, badRequest))
+    expect(response.status).toBe(400)
+    expect(hoisted.updateTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the patch caller is not an admin', async () => {
+    hoisted.withApiKeyAuthMock.mockRejectedValueOnce(new ForbiddenError('FORBIDDEN', 'nope'))
+
+    const response = await detailHandlers.PATCH(
+      args(
+        { statusId: STATUS_ID },
+        jsonRequest('http://test/api/v1/ticket-statuses/ticket_status_123', 'PATCH', {
+          name: 'Renamed',
+        })
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.updateTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a service not-found (STATUS_NOT_FOUND) to 404 on patch', async () => {
+    hoisted.updateTicketStatusMock.mockRejectedValueOnce(
+      new NotFoundError('STATUS_NOT_FOUND', 'missing')
+    )
+
+    const response = await detailHandlers.PATCH(
+      args(
+        { statusId: STATUS_ID },
+        jsonRequest('http://test/api/v1/ticket-statuses/ticket_status_123', 'PATCH', {
+          name: 'Renamed',
+        })
+      )
+    )
+    expect(response.status).toBe(404)
+  })
+
+  it('archives a status (204) when no active ticket references it', async () => {
+    hoisted.dbSelectMock.mockReturnValueOnce(makeRefChain([{ count: 0 }]))
+    hoisted.archiveTicketStatusMock.mockResolvedValue(undefined)
+
+    const response = await detailHandlers.DELETE(args({ statusId: STATUS_ID }))
+    expect(response.status).toBe(204)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'admin' })
+    expect(hoisted.archiveTicketStatusMock).toHaveBeenCalledWith(STATUS_ID, {
+      principalId: PRINCIPAL,
+    })
+  })
+
+  it('archives a status when the count row is absent (the ?? 0 nullish fallback)', async () => {
+    // Empty result set → refRows[0] is undefined → referencedBy falls back to 0.
+    hoisted.dbSelectMock.mockReturnValueOnce(makeRefChain([]))
+    hoisted.archiveTicketStatusMock.mockResolvedValue(undefined)
+
+    const response = await detailHandlers.DELETE(args({ statusId: STATUS_ID }))
+    expect(response.status).toBe(204)
+    expect(hoisted.archiveTicketStatusMock).toHaveBeenCalledWith(STATUS_ID, {
+      principalId: PRINCIPAL,
+    })
+  })
+
+  it('returns 409 (without archiving) when active tickets still reference the status', async () => {
+    hoisted.dbSelectMock.mockReturnValueOnce(makeRefChain([{ count: 3 }]))
+
+    const response = await detailHandlers.DELETE(args({ statusId: STATUS_ID }))
+    expect(response.status).toBe(409)
+    const body = await response.json()
+    expect(body.error.message).toContain('3 active ticket(s)')
+    expect(hoisted.archiveTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the delete caller is not an admin (before the ref query)', async () => {
+    hoisted.withApiKeyAuthMock.mockRejectedValueOnce(new ForbiddenError('FORBIDDEN', 'nope'))
+
+    const response = await detailHandlers.DELETE(args({ statusId: STATUS_ID }))
+    expect(response.status).toBe(403)
+    expect(hoisted.dbSelectMock).not.toHaveBeenCalled()
+    expect(hoisted.archiveTicketStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a service error during archive through handleDomainError', async () => {
+    hoisted.dbSelectMock.mockReturnValueOnce(makeRefChain([{ count: 0 }]))
+    hoisted.archiveTicketStatusMock.mockRejectedValueOnce(
+      new NotFoundError('STATUS_NOT_FOUND', 'missing')
+    )
+
+    const response = await detailHandlers.DELETE(args({ statusId: STATUS_ID }))
+    expect(response.status).toBe(404)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/ticket-statuses/index.ts b/apps/web/src/routes/api/v1/ticket-statuses/index.ts
new file mode 100644
index 000000000..f96ab4f2a
--- /dev/null
+++ b/apps/web/src/routes/api/v1/ticket-statuses/index.ts
@@ -0,0 +1,104 @@
+/**
+ * GET  /api/v1/ticket-statuses
+ * POST /api/v1/ticket-statuses
+ *
+ * The workflow status catalogue used by `/api/v1/tickets/:id/transition`.
+ * Distinct from `/api/v1/statuses`, which is for feedback-board posts.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { listTicketStatuses, createTicketStatus } from '@/lib/server/domains/tickets'
+import { TICKET_STATUS_CATEGORIES } from '@/lib/server/db'
+
+const createSchema = z.object({
+  name: z.string().min(1).max(50),
+  slug: z
+    .string()
+    .min(1)
+    .max(50)
+    .regex(/^[a-z0-9_-]+$/, 'slug must match [a-z0-9_-]+'),
+  color: z
+    .string()
+    .regex(/^#[0-9A-Fa-f]{6}$/, 'color must be a valid hex color')
+    .optional(),
+  category: z.enum(TICKET_STATUS_CATEGORIES),
+  position: z.number().int().min(0).optional(),
+  isDefault: z.boolean().optional(),
+})
+
+function serialize(row: {
+  id: string
+  name: string
+  slug: string
+  color: string | null
+  category: string
+  position: number
+  isDefault: boolean
+  isSystem: boolean
+  createdAt: Date
+  deletedAt: Date | null
+}) {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    color: row.color,
+    category: row.category,
+    position: row.position,
+    isDefault: row.isDefault,
+    isSystem: row.isSystem,
+    createdAt: row.createdAt.toISOString(),
+    deletedAt: row.deletedAt ? row.deletedAt.toISOString() : null,
+  }
+}
+
+export const Route = createFileRoute('/api/v1/ticket-statuses/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          await withApiKeyAuth(request, { role: 'team' })
+          const url = new URL(request.url)
+          const includeDeleted = url.searchParams.get('includeDeleted') === 'true'
+          const rows = await listTicketStatuses({ includeDeleted })
+          return successResponse(rows.map(serialize))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'admin' })
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+          const row = await createTicketStatus(
+            {
+              name: parsed.data.name,
+              slug: parsed.data.slug,
+              color: parsed.data.color,
+              category: parsed.data.category,
+              position: parsed.data.position,
+              isDefault: parsed.data.isDefault,
+            },
+            { principalId: auth.principalId }
+          )
+          return createdResponse(serialize(row))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.activity.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.activity.ts
new file mode 100644
index 000000000..9aeeb29a0
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.activity.ts
@@ -0,0 +1,97 @@
+/**
+ * GET /api/v1/tickets/:ticketId/activity
+ *
+ * Read-only timeline feed for a single ticket. Reverse-chronological.
+ *
+ * Query params:
+ *   before  ISO datetime — return rows strictly older than this (cursor)
+ *   limit   1..200, default 50
+ *
+ * Response: `{ data: { activity: [...], nextCursor: string | null } }`
+ * `nextCursor` is the `createdAt` of the oldest returned row when the page
+ * is full, otherwise `null`.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  getTicket,
+  listSharesForTicket,
+  toResourceScope,
+  canViewTicket,
+  listTicketActivity,
+} from '@/lib/server/domains/tickets'
+import type { TicketId, TeamId, PrincipalId } from '@quackback/ids'
+
+const querySchema = z.object({
+  before: z.string().datetime().optional(),
+  limit: z.coerce.number().int().min(1).max(200).optional(),
+})
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/activity')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+
+          const url = new URL(request.url)
+          const parsed = querySchema.safeParse({
+            before: url.searchParams.get('before') ?? undefined,
+            limit: url.searchParams.get('limit') ?? undefined,
+          })
+          if (!parsed.success) {
+            return badRequestResponse('Invalid query params', { issues: parsed.error.issues })
+          }
+
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canViewTicket(set, scope)) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+
+          const limit = parsed.data.limit ?? 50
+          const rows = await listTicketActivity(id, {
+            before: parsed.data.before ? new Date(parsed.data.before) : undefined,
+            limit,
+          })
+          const nextCursor =
+            rows.length === limit ? rows[rows.length - 1].createdAt.toISOString() : null
+          return successResponse({
+            activity: rows.map((row) => ({
+              id: row.id,
+              ticketId: row.ticketId,
+              principalId: row.principalId,
+              type: row.type,
+              metadata: row.metadata,
+              createdAt: row.createdAt.toISOString(),
+              actorName: row.actorName,
+              actorAvatarUrl: row.actorAvatarUrl,
+            })),
+            nextCursor,
+          })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.assign.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.assign.ts
new file mode 100644
index 000000000..70a2e3c5c
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.assign.ts
@@ -0,0 +1,68 @@
+/** POST /api/v1/tickets/:ticketId/assign */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  assignTicket,
+  getTicket,
+  listSharesForTicket,
+  toResourceScope,
+  canAssign,
+  canAssignSelf,
+} from '@/lib/server/domains/tickets'
+import type { TicketId, TeamId, PrincipalId } from '@quackback/ids'
+
+const schema = z.object({
+  expectedUpdatedAt: z.string().datetime(),
+  assigneePrincipalId: z.string().nullable().optional(),
+  assigneeTeamId: z.string().nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/assign')({
+  server: {
+    handlers: {
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const body = await request.json().catch(() => null)
+          const parsed = schema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          const isSelf = parsed.data.assigneePrincipalId === auth.principalId
+          const ok = isSelf ? canAssignSelf(set, scope) : canAssign(set, scope)
+          if (!ok) return forbiddenResponse('ticket.assign_any required')
+          const updated = await assignTicket(id, {
+            expectedUpdatedAt: new Date(parsed.data.expectedUpdatedAt),
+            actorPrincipalId: auth.principalId,
+            assigneePrincipalId: (parsed.data.assigneePrincipalId ?? null) as PrincipalId | null,
+            assigneeTeamId: (parsed.data.assigneeTeamId ?? null) as TeamId | null,
+          })
+          return successResponse(updated)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.participants.$participantId.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.participants.$participantId.ts
new file mode 100644
index 000000000..e9a7c1978
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.participants.$participantId.ts
@@ -0,0 +1,54 @@
+/** DELETE /api/v1/tickets/:ticketId/participants/:participantId */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  noContentResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  removeParticipant,
+  getTicket,
+  listSharesForTicket,
+  toResourceScope,
+  canManageParticipants,
+} from '@/lib/server/domains/tickets'
+import type { TicketId, TicketParticipantId, TeamId, PrincipalId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/participants/$participantId')({
+  server: {
+    handlers: {
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const ticketId = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const participantId = parseTypeId<TicketParticipantId>(
+            params.participantId,
+            'ticket_part',
+            'participant ID'
+          )
+          const ticket = await getTicket(ticketId)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(ticketId)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canManageParticipants(set, scope)) {
+            return forbiddenResponse('ticket.manage_participants required')
+          }
+          await removeParticipant(participantId, auth.principalId)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.participants.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.participants.ts
new file mode 100644
index 000000000..7d3441022
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.participants.ts
@@ -0,0 +1,97 @@
+/**
+ * GET  /api/v1/tickets/:ticketId/participants
+ * POST /api/v1/tickets/:ticketId/participants
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  addParticipant,
+  listParticipants,
+  getTicket,
+  listSharesForTicket,
+  toResourceScope,
+  canViewTicket,
+  canManageParticipants,
+} from '@/lib/server/domains/tickets'
+import { TICKET_PARTICIPANT_ROLES } from '@/lib/server/db'
+import type { TicketId, TeamId, PrincipalId, ContactId } from '@quackback/ids'
+
+const postSchema = z.object({
+  role: z.enum(TICKET_PARTICIPANT_ROLES),
+  principalId: z.string().nullable().optional(),
+  contactId: z.string().nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/participants')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canViewTicket(set, scope)) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+          return successResponse(await listParticipants(id))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const body = await request.json().catch(() => null)
+          const parsed = postSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canManageParticipants(set, scope)) {
+            return forbiddenResponse('ticket.manage_participants required')
+          }
+          const participant = await addParticipant({
+            ticketId: id,
+            role: parsed.data.role,
+            principalId: (parsed.data.principalId ?? null) as PrincipalId | null,
+            contactId: (parsed.data.contactId ?? null) as ContactId | null,
+            addedByPrincipalId: auth.principalId,
+          })
+          return createdResponse(participant)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.restore.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.restore.ts
new file mode 100644
index 000000000..24bd84593
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.restore.ts
@@ -0,0 +1,29 @@
+/**
+ * POST /api/v1/tickets/:ticketId/restore
+ *
+ * Restores a soft-deleted ticket. Pairs with `DELETE /api/v1/tickets/:ticketId`.
+ * Admin-only (deletion is admin-only too).
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import { successResponse, handleDomainError } from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { restoreTicket } from '@/lib/server/domains/tickets'
+import type { TicketId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/restore')({
+  server: {
+    handlers: {
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'admin' })
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const restored = await restoreTicket(id, auth.principalId)
+          return successResponse(restored)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.return.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.return.ts
new file mode 100644
index 000000000..296a2db79
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.return.ts
@@ -0,0 +1,52 @@
+/** POST /api/v1/tickets/:ticketId/return */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  hasPermissionForResource,
+  loadPermissionSet,
+} from '@/lib/server/domains/authz/authz.service'
+import {
+  getTicket,
+  listSharesForTicket,
+  returnTicket,
+  toResourceScope,
+} from '@/lib/server/domains/tickets'
+import type { TicketId, TeamId, PrincipalId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/return')({
+  server: {
+    handlers: {
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          const allowed =
+            hasPermissionForResource(set, PERMISSIONS.TICKET_ASSIGN_ANY, scope) ||
+            hasPermissionForResource(set, PERMISSIONS.TICKET_ASSIGN_SELF, scope)
+          if (!allowed) return forbiddenResponse('cannot return this ticket')
+          return successResponse(await returnTicket(id, auth.principalId as PrincipalId))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.shares.$shareId.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.shares.$shareId.ts
new file mode 100644
index 000000000..eb39201b5
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.shares.$shareId.ts
@@ -0,0 +1,50 @@
+/** DELETE /api/v1/tickets/:ticketId/shares/:shareId — revoke a share */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  noContentResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  revokeShare,
+  getTicket,
+  listSharesForTicket,
+  toResourceScope,
+  canShareCrossTeam,
+} from '@/lib/server/domains/tickets'
+import type { TicketId, TicketShareId, TeamId, PrincipalId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/shares/$shareId')({
+  server: {
+    handlers: {
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const ticketId = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const shareId = parseTypeId<TicketShareId>(params.shareId, 'ticket_share', 'share ID')
+          const ticket = await getTicket(ticketId)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(ticketId)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canShareCrossTeam(set, scope)) {
+            return forbiddenResponse('ticket.share_cross_team required')
+          }
+          await revokeShare(shareId, auth.principalId)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.shares.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.shares.ts
new file mode 100644
index 000000000..462fe1050
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.shares.ts
@@ -0,0 +1,94 @@
+/**
+ * GET  /api/v1/tickets/:ticketId/shares     — list active shares
+ * POST /api/v1/tickets/:ticketId/shares     — share with a team
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  shareTicketWithTeam,
+  listSharesForTicket,
+  getTicket,
+  toResourceScope,
+  canViewTicket,
+  canShareCrossTeam,
+} from '@/lib/server/domains/tickets'
+import { TICKET_SHARE_LEVELS } from '@/lib/server/db'
+import type { TicketId, TeamId, PrincipalId } from '@quackback/ids'
+
+const postSchema = z.object({
+  teamId: z.string().min(1),
+  accessLevel: z.enum(TICKET_SHARE_LEVELS).optional(),
+})
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/shares')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canViewTicket(set, scope)) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+          return successResponse(shares)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const body = await request.json().catch(() => null)
+          const parsed = postSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canShareCrossTeam(set, scope)) {
+            return forbiddenResponse('ticket.share_cross_team required')
+          }
+          const grant = await shareTicketWithTeam({
+            ticketId: id,
+            teamId: parsed.data.teamId as TeamId,
+            accessLevel: parsed.data.accessLevel,
+            grantedByPrincipalId: auth.principalId,
+          })
+          return createdResponse(grant)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.sla.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.sla.ts
new file mode 100644
index 000000000..a2fd9e2a0
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.sla.ts
@@ -0,0 +1,41 @@
+/**
+ * GET /api/v1/tickets/:ticketId/sla — SLA clocks for a ticket
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { getActiveClocksForTicket, getAllClocksForTicket } from '@/lib/server/domains/sla'
+import type { TicketId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/sla')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.SLA_VIEW)
+          if (!hasPermission(set, PERMISSIONS.SLA_VIEW)) {
+            return forbiddenResponse('sla.view permission required')
+          }
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const url = new URL(request.url)
+          const includeAll = url.searchParams.get('includeAll') === 'true'
+          const clocks = includeAll
+            ? await getAllClocksForTicket(id)
+            : await getActiveClocksForTicket(id)
+          return successResponse({ clocks })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.take.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.take.ts
new file mode 100644
index 000000000..7cf6d1d6e
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.take.ts
@@ -0,0 +1,51 @@
+/** POST /api/v1/tickets/:ticketId/take */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  hasPermissionForResource,
+  loadPermissionSet,
+} from '@/lib/server/domains/authz/authz.service'
+import {
+  getTicket,
+  listSharesForTicket,
+  takeTicket,
+  toResourceScope,
+} from '@/lib/server/domains/tickets'
+import type { TicketId, TeamId, PrincipalId } from '@quackback/ids'
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/take')({
+  server: {
+    handlers: {
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!hasPermissionForResource(set, PERMISSIONS.TICKET_ASSIGN_SELF, scope)) {
+            return forbiddenResponse('ticket.assign_self required')
+          }
+          return successResponse(await takeTicket(id, auth.principalId as PrincipalId))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.attachments.$attachmentId.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.attachments.$attachmentId.ts
new file mode 100644
index 000000000..402de595a
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.attachments.$attachmentId.ts
@@ -0,0 +1,101 @@
+/**
+ * DELETE /api/v1/tickets/:ticketId/threads/:threadId/attachments/:attachmentId
+ *
+ * Authorization: uploader OR an agent with `ticket.edit_fields`. The
+ * underlying object in S3 is intentionally NOT deleted here — same
+ * behaviour as the dashboard, which keeps blob retention separate from
+ * metadata removal so we can audit/restore later if needed.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  noContentResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { db, ticketAttachments, ticketThreads, eq } from '@/lib/server/db'
+import {
+  getTicket,
+  removeAttachment,
+  listSharesForTicket,
+  toResourceScope,
+  canViewTicket,
+  canEditFields,
+} from '@/lib/server/domains/tickets'
+import type {
+  TicketId,
+  TicketThreadId,
+  TicketAttachmentId,
+  TeamId,
+  PrincipalId,
+} from '@quackback/ids'
+
+export const Route = createFileRoute(
+  '/api/v1/tickets/$ticketId/threads/$threadId/attachments/$attachmentId'
+)({
+  server: {
+    handlers: {
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const ticketId = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const threadId = parseTypeId<TicketThreadId>(
+            params.threadId,
+            'ticket_thread',
+            'thread ID'
+          )
+          const attachmentId = parseTypeId<TicketAttachmentId>(
+            params.attachmentId,
+            'ticket_att',
+            'attachment ID'
+          )
+
+          const ticket = await getTicket(ticketId)
+          if (!ticket) return notFoundResponse('Ticket')
+          const shares = await listSharesForTicket(ticketId)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canViewTicket(set, scope)) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+
+          const attachment = await db.query.ticketAttachments.findFirst({
+            where: eq(ticketAttachments.id, attachmentId),
+          })
+          if (!attachment || attachment.threadId !== threadId) {
+            return notFoundResponse('Attachment')
+          }
+          // Confirm the thread actually belongs to this ticket — guards
+          // against a caller swapping threadId to leak ownership info.
+          const thread = await db.query.ticketThreads.findFirst({
+            where: eq(ticketThreads.id, threadId),
+            columns: { ticketId: true },
+          })
+          if (!thread || thread.ticketId !== ticketId) {
+            return notFoundResponse('Thread')
+          }
+
+          const isUploader =
+            attachment.uploadedByPrincipalId !== null &&
+            attachment.uploadedByPrincipalId === auth.principalId
+          if (!isUploader && !canEditFields(set, scope)) {
+            return forbiddenResponse('must be the uploader or hold ticket.edit_fields')
+          }
+
+          await removeAttachment(attachmentId, auth.principalId)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.attachments.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.attachments.ts
new file mode 100644
index 000000000..4318fb7cc
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.attachments.ts
@@ -0,0 +1,306 @@
+/**
+ * GET  /api/v1/tickets/:ticketId/threads/:threadId/attachments
+ * POST /api/v1/tickets/:ticketId/threads/:threadId/attachments
+ *
+ * File attachments with flexible auth:
+ * - Session-based: web users with browser cookies
+ * - API key: programmatic access with Authorization: Bearer header
+ *
+ * POST is multipart/form-data with a `file` field. Returns the created
+ * `ticket_attachment` row.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { auth } from '@/lib/server/auth'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import { db, eq, principal } from '@/lib/server/db'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  internalErrorResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { getTicketForPortalUser } from '@/lib/server/domains/tickets/ticket.portal-query'
+import {
+  getTicket,
+  getThread,
+  attachToThread,
+  listForThread,
+  listSharesForTicket,
+  toResourceScope,
+  canViewTicket,
+  canReplyPublic,
+  canCommentInternal,
+  canShareCrossTeam,
+} from '@/lib/server/domains/tickets'
+import {
+  isS3Configured,
+  isAllowedAttachmentType,
+  MAX_ATTACHMENT_FILE_SIZE,
+  generateStorageKey,
+  uploadObject,
+} from '@/lib/server/storage/s3'
+import { getPublicOriginFromRequest } from '@/lib/server/integrations/oauth'
+import type { TicketId, TicketThreadId, TeamId, PrincipalId, UserId } from '@quackback/ids'
+
+const STORAGE_PREFIX = 'ticket-attachments'
+
+async function loadTicketScope(ticketId: TicketId) {
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return null
+  const shares = await listSharesForTicket(ticketId)
+  return {
+    ticket,
+    scope: toResourceScope({
+      primaryTeamId: ticket.primaryTeamId as TeamId | null,
+      assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+      assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+      shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+    }),
+  }
+}
+
+/**
+ * Try to authenticate via session (for web users) or API key (for programmatic access).
+ * Returns { principalId, isSession: true } for web auth, { principalId, isSession: false } for API key.
+ * Throws on auth failure.
+ */
+async function getAuthPrincipal(
+  request: Request
+): Promise<{ principalId: PrincipalId; isSession: boolean; userId: UserId | null }> {
+  // Try session auth first (web users)
+  const session = await auth.api.getSession({ headers: request.headers })
+  if (session?.user) {
+    const principalRow = await db.query.principal.findFirst({
+      where: eq(principal.userId, session.user.id as UserId),
+    })
+    if (principalRow) {
+      return {
+        principalId: principalRow.id as PrincipalId,
+        isSession: true,
+        userId: session.user.id as UserId,
+      }
+    }
+  }
+
+  // Fall back to API key auth (programmatic access)
+  const apiAuth = await withApiKeyAuth(request, { role: 'team' })
+  return { principalId: apiAuth.principalId, isSession: false, userId: null }
+}
+
+async function canPortalUserAccessPublicThread(
+  auth: { principalId: PrincipalId; isSession: boolean; userId: UserId | null },
+  ticketId: TicketId,
+  thread: Awaited<ReturnType<typeof getThread>>
+): Promise<boolean> {
+  if (!auth.isSession || !auth.userId || !thread) return false
+  try {
+    await getTicketForPortalUser({
+      userId: auth.userId,
+      ticketId,
+    })
+    return thread.audience === 'public'
+  } catch {
+    return false
+  }
+}
+
+async function resolveSessionPrincipalForTicket(
+  userId: UserId,
+  scope: ReturnType<typeof toResourceScope>
+): Promise<{ principalId: PrincipalId; canView: boolean }> {
+  const principalRows = await db.query.principal.findMany({
+    where: eq(principal.userId, userId),
+    columns: { id: true },
+  })
+
+  if (principalRows.length === 0) {
+    throw new Error('No principal found for session user')
+  }
+
+  for (const row of principalRows) {
+    const set = await loadPermissionSet(row.id as PrincipalId)
+    if (canViewTicket(set, scope)) {
+      return { principalId: row.id as PrincipalId, canView: true }
+    }
+  }
+
+  return { principalId: principalRows[0].id as PrincipalId, canView: false }
+}
+
+function serialize(row: {
+  id: string
+  threadId: string
+  uploadedByPrincipalId: string | null
+  filename: string
+  mimeType: string
+  sizeBytes: number
+  storageKey: string
+  publicUrl: string | null
+  createdAt: Date
+}) {
+  return {
+    id: row.id,
+    threadId: row.threadId,
+    uploadedByPrincipalId: row.uploadedByPrincipalId,
+    filename: row.filename,
+    mimeType: row.mimeType,
+    sizeBytes: row.sizeBytes,
+    storageKey: row.storageKey,
+    publicUrl: row.publicUrl,
+    createdAt: row.createdAt.toISOString(),
+  }
+}
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/threads/$threadId/attachments')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await getAuthPrincipal(request)
+          const ticketId = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const threadId = parseTypeId<TicketThreadId>(
+            params.threadId,
+            'ticket_thread',
+            'thread ID'
+          )
+
+          const loaded = await loadTicketScope(ticketId)
+          if (!loaded) return notFoundResponse('Ticket')
+          const thread = await getThread(threadId)
+          if (!thread || thread.ticketId !== ticketId) return notFoundResponse('Thread')
+
+          const effectivePrincipal =
+            auth.isSession && auth.userId
+              ? await resolveSessionPrincipalForTicket(auth.userId, loaded.scope)
+              : {
+                  principalId: auth.principalId,
+                  canView: canViewTicket(await loadPermissionSet(auth.principalId), loaded.scope),
+                }
+
+          const canViewViaPermissions = effectivePrincipal.canView
+          const canViewViaPortal = await canPortalUserAccessPublicThread(auth, ticketId, thread)
+          if (!canViewViaPermissions && !canViewViaPortal) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+
+          const rows = await listForThread(threadId)
+          return successResponse(rows.map(serialize))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await getAuthPrincipal(request)
+          const ticketId = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const threadId = parseTypeId<TicketThreadId>(
+            params.threadId,
+            'ticket_thread',
+            'thread ID'
+          )
+
+          const loaded = await loadTicketScope(ticketId)
+          if (!loaded) return notFoundResponse('Ticket')
+          const thread = await getThread(threadId)
+          if (!thread || thread.deletedAt || thread.ticketId !== ticketId) {
+            return notFoundResponse('Thread')
+          }
+
+          const effectivePrincipal =
+            auth.isSession && auth.userId
+              ? await resolveSessionPrincipalForTicket(auth.userId, loaded.scope)
+              : {
+                  principalId: auth.principalId,
+                  canView: canViewTicket(await loadPermissionSet(auth.principalId), loaded.scope),
+                }
+
+          const set = await loadPermissionSet(effectivePrincipal.principalId)
+          const canViewViaPermissions = effectivePrincipal.canView
+
+          if (!canViewViaPermissions) {
+            const canAttachViaPortal = await canPortalUserAccessPublicThread(auth, ticketId, thread)
+            if (!canAttachViaPortal) {
+              return forbiddenResponse('Cannot view this ticket')
+            }
+            if (thread.principalId !== effectivePrincipal.principalId) {
+              return forbiddenResponse("Cannot attach to another author's thread")
+            }
+          }
+
+          // Audience-aware reply permission gate matches the create-thread
+          // route at $ticketId.threads.ts.
+          if (
+            canViewViaPermissions &&
+            thread.audience === 'public' &&
+            !canReplyPublic(set, loaded.scope)
+          ) {
+            return forbiddenResponse('ticket.reply_public required')
+          }
+          if (
+            canViewViaPermissions &&
+            thread.audience === 'internal' &&
+            !canCommentInternal(set, loaded.scope)
+          ) {
+            return forbiddenResponse('ticket.comment_internal required')
+          }
+          if (
+            canViewViaPermissions &&
+            thread.audience === 'shared_team' &&
+            !canShareCrossTeam(set, loaded.scope)
+          ) {
+            return forbiddenResponse('ticket.share_cross_team required')
+          }
+
+          if (!isS3Configured()) {
+            return internalErrorResponse('Storage not configured')
+          }
+
+          let formData: FormData
+          try {
+            formData = await request.formData()
+          } catch {
+            return badRequestResponse('expected multipart/form-data')
+          }
+          const file = formData.get('file')
+          if (!(file instanceof File)) {
+            return badRequestResponse('missing "file" field')
+          }
+          if (!isAllowedAttachmentType(file.type)) {
+            return badRequestResponse(`unsupported file type: ${file.type}`)
+          }
+          if (file.size === 0) {
+            return badRequestResponse('file is empty')
+          }
+          if (file.size > MAX_ATTACHMENT_FILE_SIZE) {
+            return badRequestResponse(`file exceeds ${MAX_ATTACHMENT_FILE_SIZE / 1024 / 1024}MB`)
+          }
+
+          const ext = file.name.split('.').pop() || 'bin'
+          const filename = file.name || `upload-${Date.now()}.${ext}`
+          const key = generateStorageKey(STORAGE_PREFIX, filename)
+          const buffer = Buffer.from(await file.arrayBuffer())
+          const requestOrigin = getPublicOriginFromRequest(request)
+          const publicUrl = await uploadObject(key, buffer, file.type, requestOrigin)
+
+          const created = await attachToThread({
+            threadId,
+            uploadedByPrincipalId: effectivePrincipal.principalId,
+            filename,
+            mimeType: file.type,
+            sizeBytes: file.size,
+            storageKey: key,
+            publicUrl,
+          })
+          return createdResponse(serialize(created))
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.ts
new file mode 100644
index 000000000..52cc62608
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.threads.$threadId.ts
@@ -0,0 +1,148 @@
+/**
+ * PATCH  /api/v1/tickets/:ticketId/threads/:threadId
+ * DELETE /api/v1/tickets/:ticketId/threads/:threadId
+ *
+ * Authorization:
+ *   - PATCH (edit): author only. The thread's original author may rewrite
+ *     `bodyJson` / `bodyText`. We do not allow moderators to silently edit
+ *     someone else's message.
+ *   - DELETE (soft-delete): author OR an agent with `ticket.edit_fields`,
+ *     so a moderator can remove a misposted thread. The action is recorded
+ *     in `ticket_activity` with the calling principal as the actor.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  noContentResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  getTicket,
+  getThread,
+  editThread,
+  softDeleteThread,
+  listSharesForTicket,
+  toResourceScope,
+  canViewTicket,
+  canEditFields,
+} from '@/lib/server/domains/tickets'
+import type { TicketId, TicketThreadId, TeamId, PrincipalId } from '@quackback/ids'
+
+const tiptapDocSchema = z
+  .object({ type: z.literal('doc'), content: z.array(z.unknown()).optional() })
+  .passthrough()
+
+const patchSchema = z
+  .object({
+    bodyJson: tiptapDocSchema.nullable().optional(),
+    bodyText: z.string().max(100_000).nullable().optional(),
+  })
+  .refine(
+    (v) => v.bodyJson !== undefined || v.bodyText !== undefined,
+    'must include bodyJson or bodyText'
+  )
+
+async function loadTicketScope(ticketId: TicketId) {
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return null
+  const shares = await listSharesForTicket(ticketId)
+  return {
+    ticket,
+    scope: toResourceScope({
+      primaryTeamId: ticket.primaryTeamId as TeamId | null,
+      assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+      assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+      shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+    }),
+  }
+}
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/threads/$threadId')({
+  server: {
+    handlers: {
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const ticketId = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const threadId = parseTypeId<TicketThreadId>(
+            params.threadId,
+            'ticket_thread',
+            'thread ID'
+          )
+
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+
+          const loaded = await loadTicketScope(ticketId)
+          if (!loaded) return notFoundResponse('Ticket')
+          if (!canViewTicket(set, loaded.scope)) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+
+          const thread = await getThread(threadId)
+          if (!thread || thread.deletedAt || thread.ticketId !== ticketId) {
+            return notFoundResponse('Thread')
+          }
+
+          const isAuthor = thread.principalId !== null && thread.principalId === auth.principalId
+          if (!isAuthor) {
+            return forbiddenResponse('only the original author may edit this thread')
+          }
+
+          const updated = await editThread({
+            threadId,
+            actorPrincipalId: auth.principalId,
+            bodyJson: (parsed.data.bodyJson ?? null) as never,
+            bodyText: parsed.data.bodyText ?? null,
+          })
+          return successResponse(updated)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const ticketId = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const threadId = parseTypeId<TicketThreadId>(
+            params.threadId,
+            'ticket_thread',
+            'thread ID'
+          )
+
+          const loaded = await loadTicketScope(ticketId)
+          if (!loaded) return notFoundResponse('Ticket')
+          if (!canViewTicket(set, loaded.scope)) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+
+          const thread = await getThread(threadId)
+          if (!thread || thread.ticketId !== ticketId) return notFoundResponse('Thread')
+
+          const isAuthor = thread.principalId !== null && thread.principalId === auth.principalId
+          const canModerate = canEditFields(set, loaded.scope)
+          if (!isAuthor && !canModerate) {
+            return forbiddenResponse('must be the thread author or hold ticket.edit_fields')
+          }
+
+          await softDeleteThread(threadId, auth.principalId)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.threads.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.threads.ts
new file mode 100644
index 000000000..585e0910b
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.threads.ts
@@ -0,0 +1,113 @@
+/**
+ * GET  /api/v1/tickets/:ticketId/threads
+ * POST /api/v1/tickets/:ticketId/threads
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  addThread,
+  listThreads,
+  getTicket,
+  listSharesForTicket,
+  toResourceScope,
+  canViewTicket,
+  canReplyPublic,
+  canCommentInternal,
+  canShareCrossTeam,
+} from '@/lib/server/domains/tickets'
+import { TICKET_THREAD_AUDIENCES } from '@/lib/server/db'
+import type { TicketId, TeamId, PrincipalId } from '@quackback/ids'
+
+const postSchema = z.object({
+  audience: z.enum(TICKET_THREAD_AUDIENCES),
+  bodyJson: z.unknown().nullable().optional(),
+  bodyText: z.string().max(100_000).nullable().optional(),
+  sharedWithTeamId: z.string().nullable().optional(),
+})
+
+async function loadScope(ticketId: TicketId) {
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return null
+  const shares = await listSharesForTicket(ticketId)
+  return {
+    ticket,
+    scope: toResourceScope({
+      primaryTeamId: ticket.primaryTeamId as TeamId | null,
+      assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+      assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+      shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+    }),
+  }
+}
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/threads')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const loaded = await loadScope(id)
+          if (!loaded) return notFoundResponse('Ticket not found')
+          if (!canViewTicket(set, loaded.scope)) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+          const threads = await listThreads(id, {
+            viewerTeamIds: set.teamIds,
+            canSeeInternal: canCommentInternal(set, loaded.scope),
+            isRequester: loaded.ticket.requesterPrincipalId === auth.principalId,
+          })
+          return successResponse(threads)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const body = await request.json().catch(() => null)
+          const parsed = postSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const loaded = await loadScope(id)
+          if (!loaded) return notFoundResponse('Ticket not found')
+          if (parsed.data.audience === 'public' && !canReplyPublic(set, loaded.scope)) {
+            return forbiddenResponse('ticket.reply_public required')
+          }
+          if (parsed.data.audience === 'internal' && !canCommentInternal(set, loaded.scope)) {
+            return forbiddenResponse('ticket.comment_internal required')
+          }
+          if (parsed.data.audience === 'shared_team' && !canShareCrossTeam(set, loaded.scope)) {
+            return forbiddenResponse('ticket.share_cross_team required')
+          }
+          const thread = await addThread({
+            ticketId: id,
+            principalId: auth.principalId,
+            audience: parsed.data.audience,
+            bodyJson: (parsed.data.bodyJson ?? null) as never,
+            bodyText: parsed.data.bodyText ?? null,
+            sharedWithTeamId: (parsed.data.sharedWithTeamId ?? null) as TeamId | null,
+          })
+          return createdResponse(thread)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.transition.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.transition.ts
new file mode 100644
index 000000000..602607e02
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.transition.ts
@@ -0,0 +1,65 @@
+/** POST /api/v1/tickets/:ticketId/transition */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  transitionStatus,
+  getTicket,
+  listSharesForTicket,
+  toResourceScope,
+  canEditFields,
+} from '@/lib/server/domains/tickets'
+import type { TicketId, TicketStatusId, TeamId, PrincipalId } from '@quackback/ids'
+
+const schema = z.object({
+  expectedUpdatedAt: z.string().datetime(),
+  statusId: z.string().min(1),
+})
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId/transition')({
+  server: {
+    handlers: {
+      POST: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const body = await request.json().catch(() => null)
+          const parsed = schema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const ticket = await getTicket(id)
+          if (!ticket) return notFoundResponse('Ticket not found')
+          const shares = await listSharesForTicket(id)
+          const scope = toResourceScope({
+            primaryTeamId: ticket.primaryTeamId as TeamId | null,
+            assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+            assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+            shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+          })
+          if (!canEditFields(set, scope)) {
+            return forbiddenResponse('ticket.edit_fields required')
+          }
+          const updated = await transitionStatus(id, {
+            expectedUpdatedAt: new Date(parsed.data.expectedUpdatedAt),
+            actorPrincipalId: auth.principalId,
+            statusId: parsed.data.statusId as TicketStatusId,
+          })
+          return successResponse(updated)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/$ticketId.ts b/apps/web/src/routes/api/v1/tickets/$ticketId.ts
new file mode 100644
index 000000000..b8b73afea
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/$ticketId.ts
@@ -0,0 +1,124 @@
+/**
+ * GET    /api/v1/tickets/:ticketId
+ * PATCH  /api/v1/tickets/:ticketId
+ * DELETE /api/v1/tickets/:ticketId   (soft delete)
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  noContentResponse,
+  forbiddenResponse,
+  notFoundResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import {
+  getTicket,
+  updateTicket,
+  softDeleteTicket,
+  listSharesForTicket,
+  toResourceScope,
+  canViewTicket,
+  canEditFields,
+} from '@/lib/server/domains/tickets'
+import { TICKET_PRIORITIES, TICKET_VISIBILITY_SCOPES } from '@/lib/server/db'
+import type { TicketId, TeamId, PrincipalId } from '@quackback/ids'
+
+const tiptapDocSchema = z
+  .object({ type: z.literal('doc'), content: z.array(z.unknown()).optional() })
+  .passthrough()
+
+const patchSchema = z.object({
+  expectedUpdatedAt: z.string().datetime(),
+  subject: z.string().min(1).max(500).optional(),
+  descriptionJson: tiptapDocSchema.nullable().optional(),
+  descriptionText: z.string().max(100_000).nullable().optional(),
+  priority: z.enum(TICKET_PRIORITIES).optional(),
+  visibilityScope: z.enum(TICKET_VISIBILITY_SCOPES).optional(),
+  primaryTeamId: z.string().nullable().optional(),
+  organizationId: z.string().nullable().optional(),
+  requesterContactId: z.string().nullable().optional(),
+})
+
+async function loadScope(ticketId: TicketId) {
+  const ticket = await getTicket(ticketId)
+  if (!ticket) return null
+  const shares = await listSharesForTicket(ticketId)
+  return {
+    ticket,
+    scope: toResourceScope({
+      primaryTeamId: ticket.primaryTeamId as TeamId | null,
+      assigneePrincipalId: ticket.assigneePrincipalId as PrincipalId | null,
+      assigneeTeamId: ticket.assigneeTeamId as TeamId | null,
+      shares: shares.map((s) => ({ teamId: s.teamId as TeamId, revokedAt: s.revokedAt })),
+    }),
+  }
+}
+
+export const Route = createFileRoute('/api/v1/tickets/$ticketId')({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const loaded = await loadScope(id)
+          if (!loaded) return notFoundResponse('Ticket not found')
+          if (!canViewTicket(set, loaded.scope)) {
+            return forbiddenResponse('Cannot view this ticket')
+          }
+          return successResponse(loaded.ticket)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      PATCH: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const body = await request.json().catch(() => null)
+          const parsed = patchSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const loaded = await loadScope(id)
+          if (!loaded) return notFoundResponse('Ticket not found')
+          if (!canEditFields(set, loaded.scope)) {
+            return forbiddenResponse('ticket.edit_fields required')
+          }
+          const { expectedUpdatedAt, ...rest } = parsed.data
+          const updated = await updateTicket(id, {
+            ...(rest as Record<string, unknown>),
+            expectedUpdatedAt: new Date(expectedUpdatedAt),
+            actorPrincipalId: auth.principalId,
+          } as never)
+          return successResponse(updated)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      DELETE: async ({ request, params }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const id = parseTypeId<TicketId>(params.ticketId, 'ticket', 'ticket ID')
+          const loaded = await loadScope(id)
+          if (!loaded) return notFoundResponse('Ticket not found')
+          if (!canEditFields(set, loaded.scope)) {
+            return forbiddenResponse('ticket.edit_fields required')
+          }
+          await softDeleteTicket(id, auth.principalId)
+          return noContentResponse()
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/__tests__/thread-attachments.test.ts b/apps/web/src/routes/api/v1/tickets/__tests__/thread-attachments.test.ts
new file mode 100644
index 000000000..ac99bb465
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/__tests__/thread-attachments.test.ts
@@ -0,0 +1,501 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const hoisted = vi.hoisted(() => ({
+  getSessionMock: vi.fn(),
+  withApiKeyAuthMock: vi.fn(),
+  principalFindFirstMock: vi.fn(),
+  principalFindManyMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  getTicketForPortalUserMock: vi.fn(),
+  getTicketMock: vi.fn(),
+  getThreadMock: vi.fn(),
+  attachToThreadMock: vi.fn(),
+  listForThreadMock: vi.fn(),
+  listSharesForTicketMock: vi.fn(),
+  toResourceScopeMock: vi.fn(),
+  canViewTicketMock: vi.fn(),
+  canReplyPublicMock: vi.fn(),
+  canCommentInternalMock: vi.fn(),
+  canEditFieldsMock: vi.fn(),
+  canShareCrossTeamMock: vi.fn(),
+  removeAttachmentMock: vi.fn(),
+  isS3ConfiguredMock: vi.fn(),
+  isAllowedAttachmentTypeMock: vi.fn(),
+  generateStorageKeyMock: vi.fn(),
+  uploadObjectMock: vi.fn(),
+  getPublicOriginFromRequestMock: vi.fn(),
+  eqMock: vi.fn(),
+  ticketAttachmentFindFirstMock: vi.fn(),
+  ticketThreadFindFirstMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/auth', () => ({
+  auth: {
+    api: {
+      getSession: (...args: unknown[]) => hoisted.getSessionMock(...args),
+    },
+  },
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      principal: {
+        findFirst: (...args: unknown[]) => hoisted.principalFindFirstMock(...args),
+        findMany: (...args: unknown[]) => hoisted.principalFindManyMock(...args),
+      },
+      ticketAttachments: {
+        findFirst: (...args: unknown[]) => hoisted.ticketAttachmentFindFirstMock(...args),
+      },
+      ticketThreads: {
+        findFirst: (...args: unknown[]) => hoisted.ticketThreadFindFirstMock(...args),
+      },
+    },
+  },
+  eq: (...args: unknown[]) => hoisted.eqMock(...args),
+  principal: {
+    id: 'principal.id',
+    userId: 'principal.userId',
+  },
+  ticketAttachments: {
+    id: 'ticketAttachments.id',
+  },
+  ticketThreads: {
+    id: 'ticketThreads.id',
+  },
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets/ticket.portal-query', () => ({
+  getTicketForPortalUser: (...args: unknown[]) => hoisted.getTicketForPortalUserMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets', () => ({
+  getTicket: (...args: unknown[]) => hoisted.getTicketMock(...args),
+  getThread: (...args: unknown[]) => hoisted.getThreadMock(...args),
+  attachToThread: (...args: unknown[]) => hoisted.attachToThreadMock(...args),
+  removeAttachment: (...args: unknown[]) => hoisted.removeAttachmentMock(...args),
+  listForThread: (...args: unknown[]) => hoisted.listForThreadMock(...args),
+  listSharesForTicket: (...args: unknown[]) => hoisted.listSharesForTicketMock(...args),
+  toResourceScope: (...args: unknown[]) => hoisted.toResourceScopeMock(...args),
+  canViewTicket: (...args: unknown[]) => hoisted.canViewTicketMock(...args),
+  canReplyPublic: (...args: unknown[]) => hoisted.canReplyPublicMock(...args),
+  canCommentInternal: (...args: unknown[]) => hoisted.canCommentInternalMock(...args),
+  canEditFields: (...args: unknown[]) => hoisted.canEditFieldsMock(...args),
+  canShareCrossTeam: (...args: unknown[]) => hoisted.canShareCrossTeamMock(...args),
+}))
+
+vi.mock('@/lib/server/storage/s3', () => ({
+  isS3Configured: (...args: unknown[]) => hoisted.isS3ConfiguredMock(...args),
+  isAllowedAttachmentType: (...args: unknown[]) => hoisted.isAllowedAttachmentTypeMock(...args),
+  MAX_ATTACHMENT_FILE_SIZE: 10,
+  generateStorageKey: (...args: unknown[]) => hoisted.generateStorageKeyMock(...args),
+  uploadObject: (...args: unknown[]) => hoisted.uploadObjectMock(...args),
+}))
+
+vi.mock('@/lib/server/integrations/oauth', () => ({
+  getPublicOriginFromRequest: (...args: unknown[]) =>
+    hoisted.getPublicOriginFromRequestMock(...args),
+}))
+
+import { Route } from '../$ticketId.threads.$threadId.attachments'
+import { Route as DeleteAttachmentRoute } from '../$ticketId.threads.$threadId.attachments.$attachmentId'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const handlers = (Route as unknown as RouteWithHandlers).options.server.handlers
+const deleteHandlers = (DeleteAttachmentRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+
+const TICKET = 'ticket_123'
+const THREAD = 'ticket_thread_123'
+const ATTACHMENT = 'ticket_att_123'
+const PRINCIPAL = 'principal_agent'
+const USER = 'user_123'
+const SCOPE = { kind: 'ticket-scope' }
+
+function routeArgs(request = new Request('http://test/api/v1/tickets/x/threads/y/attachments')) {
+  return { request, params: { ticketId: TICKET, threadId: THREAD } }
+}
+
+function deleteArgs(
+  request = new Request('http://test/api/v1/tickets/x/threads/y/attachments/z', {
+    method: 'DELETE',
+  })
+) {
+  return { request, params: { ticketId: TICKET, threadId: THREAD, attachmentId: ATTACHMENT } }
+}
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: TICKET,
+    primaryTeamId: 'team_primary',
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    ...overrides,
+  }
+}
+
+function thread(overrides: Record<string, unknown> = {}) {
+  return {
+    id: THREAD,
+    ticketId: TICKET,
+    principalId: PRINCIPAL,
+    audience: 'public',
+    deletedAt: null,
+    ...overrides,
+  }
+}
+
+function attachment(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'att_1',
+    threadId: THREAD,
+    uploadedByPrincipalId: PRINCIPAL,
+    filename: 'note.txt',
+    mimeType: 'text/plain',
+    sizeBytes: 4,
+    storageKey: 'ticket-attachments/note.txt',
+    publicUrl: 'https://cdn.example/note.txt',
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    ...overrides,
+  }
+}
+
+function uploadRequest(file: File | null) {
+  const form = new FormData()
+  if (file) form.set('file', file)
+  return new Request('http://test/api/v1/tickets/x/threads/y/attachments', {
+    method: 'POST',
+    body: form,
+  })
+}
+
+function multipartUploadRequest(filename: string) {
+  const boundary = '----vitest-ticket-attachment'
+  const body = [
+    `--${boundary}`,
+    `Content-Disposition: form-data; name="file"; filename="${filename}"`,
+    'Content-Type: text/plain',
+    '',
+    'x',
+    `--${boundary}--`,
+    '',
+  ].join('\r\n')
+
+  return new Request('http://test/api/v1/tickets/x/threads/y/attachments', {
+    method: 'POST',
+    headers: { 'Content-Type': `multipart/form-data; boundary=${boundary}` },
+    body,
+  })
+}
+
+async function responseData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.eqMock.mockImplementation((left: unknown, right: unknown) => ['eq', left, right])
+  hoisted.getSessionMock.mockResolvedValue(null)
+  hoisted.withApiKeyAuthMock.mockResolvedValue({ principalId: PRINCIPAL, role: 'team' })
+  hoisted.principalFindFirstMock.mockResolvedValue({ id: PRINCIPAL })
+  hoisted.principalFindManyMock.mockResolvedValue([{ id: PRINCIPAL }])
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.getTicketForPortalUserMock.mockResolvedValue(ticket())
+  hoisted.getTicketMock.mockResolvedValue(ticket())
+  hoisted.getThreadMock.mockResolvedValue(thread())
+  hoisted.listSharesForTicketMock.mockResolvedValue([{ teamId: 'team_shared', revokedAt: null }])
+  hoisted.toResourceScopeMock.mockReturnValue(SCOPE)
+  hoisted.canViewTicketMock.mockReturnValue(true)
+  hoisted.canReplyPublicMock.mockReturnValue(true)
+  hoisted.canCommentInternalMock.mockReturnValue(true)
+  hoisted.canEditFieldsMock.mockReturnValue(false)
+  hoisted.canShareCrossTeamMock.mockReturnValue(true)
+  hoisted.listForThreadMock.mockResolvedValue([attachment()])
+  hoisted.ticketAttachmentFindFirstMock.mockResolvedValue(attachment({ id: ATTACHMENT }))
+  hoisted.ticketThreadFindFirstMock.mockResolvedValue({ ticketId: TICKET })
+  hoisted.isS3ConfiguredMock.mockReturnValue(true)
+  hoisted.isAllowedAttachmentTypeMock.mockReturnValue(true)
+  hoisted.generateStorageKeyMock.mockReturnValue('ticket-attachments/generated.txt')
+  hoisted.uploadObjectMock.mockResolvedValue('https://cdn.example/generated.txt')
+  hoisted.getPublicOriginFromRequestMock.mockReturnValue('https://app.example')
+  hoisted.attachToThreadMock.mockResolvedValue(
+    attachment({
+      storageKey: 'ticket-attachments/generated.txt',
+      publicUrl: 'https://cdn.example/generated.txt',
+    })
+  )
+  hoisted.removeAttachmentMock.mockResolvedValue(undefined)
+})
+
+describe('/api/v1/tickets/:ticketId/threads/:threadId/attachments', () => {
+  it('lists attachments for an API-key principal with ticket view permission', async () => {
+    const response = await handlers.GET(routeArgs())
+
+    expect(response.status).toBe(200)
+    expect(await responseData(response)).toEqual([
+      {
+        id: 'att_1',
+        threadId: THREAD,
+        uploadedByPrincipalId: PRINCIPAL,
+        filename: 'note.txt',
+        mimeType: 'text/plain',
+        sizeBytes: 4,
+        storageKey: 'ticket-attachments/note.txt',
+        publicUrl: 'https://cdn.example/note.txt',
+        createdAt: '2026-01-01T00:00:00.000Z',
+      },
+    ])
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.listForThreadMock).toHaveBeenCalledWith(THREAD)
+  })
+
+  it('allows a session portal user to list public-thread attachments without agent permissions', async () => {
+    hoisted.getSessionMock.mockResolvedValueOnce({ user: { id: USER } })
+    hoisted.canViewTicketMock.mockReturnValue(false)
+
+    const response = await handlers.GET(routeArgs())
+
+    expect(response.status).toBe(200)
+    expect(hoisted.withApiKeyAuthMock).not.toHaveBeenCalled()
+    expect(hoisted.getTicketForPortalUserMock).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+    })
+  })
+
+  it('falls back to API-key auth when a session user has no principal row', async () => {
+    hoisted.getSessionMock.mockResolvedValue({ user: { id: USER } })
+    hoisted.principalFindFirstMock.mockResolvedValueOnce(null)
+
+    const response = await handlers.GET(routeArgs())
+
+    expect(response.status).toBe(200)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.listForThreadMock).toHaveBeenCalledWith(THREAD)
+  })
+
+  it('uses a session principal with ticket view permission without portal fallback', async () => {
+    hoisted.getSessionMock.mockResolvedValue({ user: { id: USER } })
+
+    const response = await handlers.GET(routeArgs())
+
+    expect(response.status).toBe(200)
+    expect(hoisted.withApiKeyAuthMock).not.toHaveBeenCalled()
+    expect(hoisted.getTicketForPortalUserMock).toHaveBeenCalledWith({
+      userId: USER,
+      ticketId: TICKET,
+    })
+  })
+
+  it('maps a session user with no ticket principal to an API error', async () => {
+    hoisted.getSessionMock.mockResolvedValue({ user: { id: USER } })
+    hoisted.principalFindManyMock.mockResolvedValueOnce([])
+
+    const response = await handlers.GET(routeArgs())
+
+    expect(response.status).toBe(500)
+    expect(hoisted.listForThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns not found for missing ticket or mismatched thread', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+    const ticketResponse = await handlers.GET(routeArgs())
+    expect(ticketResponse.status).toBe(404)
+
+    hoisted.getTicketMock.mockResolvedValueOnce(ticket())
+    hoisted.getThreadMock.mockResolvedValueOnce(thread({ ticketId: 'ticket_other' }))
+    const threadResponse = await handlers.GET(routeArgs())
+    expect(threadResponse.status).toBe(404)
+  })
+
+  it('forbids GET when neither permissions nor portal ownership allow viewing', async () => {
+    hoisted.canViewTicketMock.mockReturnValue(false)
+
+    const response = await handlers.GET(routeArgs())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.listForThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('uploads an attachment after audience-aware permission and storage validation', async () => {
+    const file = new File([new Uint8Array([1, 2, 3, 4])], 'note.txt', { type: 'text/plain' })
+    const response = await handlers.POST(routeArgs(uploadRequest(file)))
+
+    expect(response.status).toBe(201)
+    expect(hoisted.canReplyPublicMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+    expect(hoisted.uploadObjectMock).toHaveBeenCalledWith(
+      'ticket-attachments/generated.txt',
+      Buffer.from([1, 2, 3, 4]),
+      'text/plain',
+      'https://app.example'
+    )
+    expect(hoisted.attachToThreadMock).toHaveBeenCalledWith({
+      threadId: THREAD,
+      uploadedByPrincipalId: PRINCIPAL,
+      filename: 'note.txt',
+      mimeType: 'text/plain',
+      sizeBytes: 4,
+      storageKey: 'ticket-attachments/generated.txt',
+      publicUrl: 'https://cdn.example/generated.txt',
+    })
+  })
+
+  it('returns not found before upload when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+    const file = new File([new Uint8Array([1])], 'note.txt', { type: 'text/plain' })
+
+    const response = await handlers.POST(routeArgs(uploadRequest(file)))
+
+    expect(response.status).toBe(404)
+    expect(hoisted.attachToThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('allows portal users to attach only to their own public threads', async () => {
+    hoisted.getSessionMock.mockResolvedValue({ user: { id: USER } })
+    hoisted.principalFindManyMock.mockResolvedValue([{ id: 'principal_portal' }])
+    hoisted.canViewTicketMock.mockReturnValue(false)
+    hoisted.getThreadMock.mockResolvedValue(thread({ principalId: 'principal_other' }))
+    const file = new File([new Uint8Array([1])], 'note.txt', { type: 'text/plain' })
+
+    const denied = await handlers.POST(routeArgs(uploadRequest(file)))
+    expect(denied.status).toBe(403)
+    expect(hoisted.attachToThreadMock).not.toHaveBeenCalled()
+
+    hoisted.getThreadMock.mockResolvedValue(thread({ principalId: 'principal_portal' }))
+    const allowed = await handlers.POST(routeArgs(uploadRequest(file)))
+    expect(allowed.status).toBe(201)
+    expect(hoisted.attachToThreadMock).toHaveBeenCalledWith(
+      expect.objectContaining({ uploadedByPrincipalId: 'principal_portal' })
+    )
+  })
+
+  it('rejects portal uploads when portal ownership cannot be proven', async () => {
+    hoisted.getSessionMock.mockResolvedValue({ user: { id: USER } })
+    hoisted.principalFindManyMock.mockResolvedValue([{ id: 'principal_portal' }])
+    hoisted.canViewTicketMock.mockReturnValue(false)
+    hoisted.getThreadMock.mockResolvedValue(thread({ principalId: 'principal_portal' }))
+    hoisted.getTicketForPortalUserMock.mockRejectedValueOnce(new Error('not owned'))
+    const file = new File([new Uint8Array([1])], 'note.txt', { type: 'text/plain' })
+
+    const response = await handlers.POST(routeArgs(uploadRequest(file)))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.attachToThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects POST for deleted threads, missing storage, malformed forms, and invalid files', async () => {
+    const validFile = new File([new Uint8Array([1])], 'note.txt', { type: 'text/plain' })
+
+    hoisted.getThreadMock.mockResolvedValueOnce(thread({ deletedAt: new Date() }))
+    expect(await handlers.POST(routeArgs(uploadRequest(validFile)))).toHaveProperty('status', 404)
+
+    hoisted.getThreadMock.mockResolvedValue(thread())
+    hoisted.isS3ConfiguredMock.mockReturnValueOnce(false)
+    expect(await handlers.POST(routeArgs(uploadRequest(validFile)))).toHaveProperty('status', 500)
+
+    expect(await handlers.POST(routeArgs(uploadRequest(null)))).toHaveProperty('status', 400)
+
+    hoisted.isAllowedAttachmentTypeMock.mockReturnValueOnce(false)
+    expect(await handlers.POST(routeArgs(uploadRequest(validFile)))).toHaveProperty('status', 400)
+
+    const emptyFile = new File([], 'empty.txt', { type: 'text/plain' })
+    expect(await handlers.POST(routeArgs(uploadRequest(emptyFile)))).toHaveProperty('status', 400)
+
+    const largeFile = new File([new Uint8Array(11)], 'large.txt', { type: 'text/plain' })
+    expect(await handlers.POST(routeArgs(uploadRequest(largeFile)))).toHaveProperty('status', 400)
+  })
+
+  it('enforces internal and shared-team attachment permissions for API-key callers', async () => {
+    const file = new File([new Uint8Array([1])], 'note.txt', { type: 'text/plain' })
+
+    hoisted.canReplyPublicMock.mockReturnValueOnce(false)
+    const publicDenied = await handlers.POST(routeArgs(uploadRequest(file)))
+    expect(publicDenied.status).toBe(403)
+
+    hoisted.getThreadMock.mockResolvedValueOnce(thread({ audience: 'internal' }))
+    hoisted.canCommentInternalMock.mockReturnValueOnce(false)
+    const internalDenied = await handlers.POST(routeArgs(uploadRequest(file)))
+    expect(internalDenied.status).toBe(403)
+
+    hoisted.getThreadMock.mockResolvedValueOnce(thread({ audience: 'shared_team' }))
+    hoisted.canShareCrossTeamMock.mockReturnValueOnce(false)
+    const sharedDenied = await handlers.POST(routeArgs(uploadRequest(file)))
+    expect(sharedDenied.status).toBe(403)
+  })
+
+  it('generates fallback filenames for unnamed uploads', async () => {
+    const response = await handlers.POST(routeArgs(multipartUploadRequest('')))
+
+    expect(response.status).toBe(201)
+    expect(hoisted.generateStorageKeyMock).toHaveBeenCalledWith(
+      'ticket-attachments',
+      expect.stringMatching(/^upload-\d+\.bin$/)
+    )
+  })
+
+  it('deletes an attachment when the caller is the uploader or can edit fields', async () => {
+    const uploaderResponse = await deleteHandlers.DELETE(deleteArgs())
+    expect(uploaderResponse.status).toBe(204)
+    expect(hoisted.removeAttachmentMock).toHaveBeenCalledWith(ATTACHMENT, PRINCIPAL)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(ATTACHMENT, 'ticket_att', 'attachment ID')
+
+    hoisted.ticketAttachmentFindFirstMock.mockResolvedValueOnce(
+      attachment({ id: ATTACHMENT, uploadedByPrincipalId: 'principal_other' })
+    )
+    hoisted.canEditFieldsMock.mockReturnValueOnce(true)
+    const editorResponse = await deleteHandlers.DELETE(deleteArgs())
+    expect(editorResponse.status).toBe(204)
+    expect(hoisted.canEditFieldsMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+  })
+
+  it('rejects attachment deletion when ticket, thread, attachment, or permissions do not line up', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+    expect(await deleteHandlers.DELETE(deleteArgs())).toHaveProperty('status', 404)
+
+    hoisted.getTicketMock.mockResolvedValueOnce(ticket())
+    hoisted.canViewTicketMock.mockReturnValueOnce(false)
+    expect(await deleteHandlers.DELETE(deleteArgs())).toHaveProperty('status', 403)
+
+    hoisted.ticketAttachmentFindFirstMock.mockResolvedValueOnce(null)
+    expect(await deleteHandlers.DELETE(deleteArgs())).toHaveProperty('status', 404)
+
+    hoisted.ticketAttachmentFindFirstMock.mockResolvedValueOnce(
+      attachment({ id: ATTACHMENT, threadId: 'ticket_thread_other' })
+    )
+    expect(await deleteHandlers.DELETE(deleteArgs())).toHaveProperty('status', 404)
+
+    hoisted.ticketThreadFindFirstMock.mockResolvedValueOnce(null)
+    expect(await deleteHandlers.DELETE(deleteArgs())).toHaveProperty('status', 404)
+
+    hoisted.ticketThreadFindFirstMock.mockResolvedValueOnce({ ticketId: 'ticket_other' })
+    expect(await deleteHandlers.DELETE(deleteArgs())).toHaveProperty('status', 404)
+
+    hoisted.ticketAttachmentFindFirstMock.mockResolvedValueOnce(
+      attachment({ id: ATTACHMENT, uploadedByPrincipalId: 'principal_other' })
+    )
+    hoisted.canEditFieldsMock.mockReturnValueOnce(false)
+    expect(await deleteHandlers.DELETE(deleteArgs())).toHaveProperty('status', 403)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/tickets/__tests__/tickets-bulk.coverage.test.ts b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-bulk.coverage.test.ts
new file mode 100644
index 000000000..6910d5911
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-bulk.coverage.test.ts
@@ -0,0 +1,418 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  hasPermissionForResourceMock: vi.fn(),
+  bulkAssignMock: vi.fn(),
+  bulkChangeInboxMock: vi.fn(),
+  bulkTransitionMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+  hasPermissionForResource: (...args: unknown[]) => hoisted.hasPermissionForResourceMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets', () => ({
+  bulkAssign: (...args: unknown[]) => hoisted.bulkAssignMock(...args),
+  bulkChangeInbox: (...args: unknown[]) => hoisted.bulkChangeInboxMock(...args),
+  bulkTransition: (...args: unknown[]) => hoisted.bulkTransitionMock(...args),
+}))
+
+import { Route as BulkAssignRoute } from '../bulk.assign'
+import { Route as BulkChangeInboxRoute } from '../bulk.change-inbox'
+import { Route as BulkTransitionRoute } from '../bulk.transition'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const assignHandlers = (BulkAssignRoute as unknown as RouteWithHandlers).options.server.handlers
+const changeInboxHandlers = (BulkChangeInboxRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const transitionHandlers = (BulkTransitionRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+
+const PRINCIPAL = 'principal_admin'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+// Builds a request whose body is invalid JSON so request.json() throws and the
+// route's `.catch(() => null)` branch yields a null body for the zod schema.
+function malformedRequest(url: string) {
+  return new Request(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: '{ not valid json',
+  })
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.hasPermissionForResourceMock.mockReturnValue(true)
+})
+
+describe('POST /api/v1/tickets/bulk/assign', () => {
+  it('assigns tickets after scope and permission checks', async () => {
+    const result = { succeeded: ['ticket_1'], failed: [] }
+    hoisted.bulkAssignMock.mockResolvedValue(result)
+
+    const response = await assignHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/assign', 'POST', {
+        ticketIds: ['ticket_1', 'ticket_2'],
+        assigneePrincipalId: 'principal_agent',
+        assigneeTeamId: null,
+      }),
+    })
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(result)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.loadPermissionSetMock).toHaveBeenCalledWith(PRINCIPAL)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TICKET_BULK_OPERATE
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_BULK_OPERATE
+    )
+    // The route coalesces an explicit null assigneeTeamId to undefined via `?? undefined`.
+    expect(hoisted.bulkAssignMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ticketIds: ['ticket_1', 'ticket_2'],
+        actorPrincipalId: PRINCIPAL,
+        assigneePrincipalId: 'principal_agent',
+        assigneeTeamId: undefined,
+        permit: expect.any(Function),
+      })
+    )
+
+    // Exercise the permit callback so the hasPermissionForResource arrow is covered.
+    const { permit } = hoisted.bulkAssignMock.mock.calls[0][0] as {
+      permit: (scope: unknown) => boolean
+    }
+    const scope = { kind: 'team', teamId: 'team_1' }
+    expect(permit(scope)).toBe(true)
+    expect(hoisted.hasPermissionForResourceMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_ASSIGN_ANY,
+      scope
+    )
+  })
+
+  it('coalesces an omitted assigneePrincipalId to undefined', async () => {
+    hoisted.bulkAssignMock.mockResolvedValue({ succeeded: [], failed: [] })
+
+    const response = await assignHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/assign', 'POST', {
+        ticketIds: ['ticket_1'],
+      }),
+    })
+
+    expect(response.status).toBe(200)
+    expect(hoisted.bulkAssignMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        assigneePrincipalId: undefined,
+        assigneeTeamId: undefined,
+      })
+    )
+  })
+
+  it('returns 403 when bulk-operate permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await assignHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/assign', 'POST', {
+        ticketIds: ['ticket_1'],
+      }),
+    })
+
+    expect(response.status).toBe(403)
+    expect(hoisted.bulkAssignMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 for an invalid request body', async () => {
+    const response = await assignHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/assign', 'POST', {
+        ticketIds: [],
+      }),
+    })
+
+    expect(response.status).toBe(400)
+    expect(hoisted.bulkAssignMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the body is not valid JSON', async () => {
+    const response = await assignHandlers.POST({
+      params: {},
+      request: malformedRequest('http://test/api/v1/tickets/bulk/assign'),
+    })
+
+    expect(response.status).toBe(400)
+    expect(hoisted.bulkAssignMock).not.toHaveBeenCalled()
+  })
+
+  it('delegates thrown domain errors to handleDomainError', async () => {
+    hoisted.withApiKeyAuthMock.mockRejectedValue(new Error('unauthorised'))
+
+    const response = await assignHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/assign', 'POST', {
+        ticketIds: ['ticket_1'],
+      }),
+    })
+
+    expect(response.status).toBe(500)
+    expect(hoisted.bulkAssignMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('POST /api/v1/tickets/bulk/change-inbox', () => {
+  it('changes inbox for tickets after scope and permission checks', async () => {
+    const result = { succeeded: ['ticket_1'], failed: [] }
+    hoisted.bulkChangeInboxMock.mockResolvedValue(result)
+
+    const response = await changeInboxHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/change-inbox', 'POST', {
+        ticketIds: ['ticket_1'],
+        inboxId: 'inbox_1',
+      }),
+    })
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(result)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TICKET_BULK_OPERATE
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_BULK_OPERATE
+    )
+    expect(hoisted.bulkChangeInboxMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ticketIds: ['ticket_1'],
+        actorPrincipalId: PRINCIPAL,
+        inboxId: 'inbox_1',
+        permit: expect.any(Function),
+      })
+    )
+
+    // Exercise the permit callback so the hasPermissionForResource arrow is covered.
+    const { permit } = hoisted.bulkChangeInboxMock.mock.calls[0][0] as {
+      permit: (scope: unknown) => boolean
+    }
+    const scope = { kind: 'team', teamId: 'team_1' }
+    expect(permit(scope)).toBe(true)
+    expect(hoisted.hasPermissionForResourceMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_EDIT_FIELDS,
+      scope
+    )
+  })
+
+  it('accepts a null inboxId (unassigning the inbox)', async () => {
+    hoisted.bulkChangeInboxMock.mockResolvedValue({ succeeded: [], failed: [] })
+
+    const response = await changeInboxHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/change-inbox', 'POST', {
+        ticketIds: ['ticket_1'],
+        inboxId: null,
+      }),
+    })
+
+    expect(response.status).toBe(200)
+    expect(hoisted.bulkChangeInboxMock).toHaveBeenCalledWith(
+      expect.objectContaining({ inboxId: null })
+    )
+  })
+
+  it('returns 403 when bulk-operate permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await changeInboxHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/change-inbox', 'POST', {
+        ticketIds: ['ticket_1'],
+        inboxId: 'inbox_1',
+      }),
+    })
+
+    expect(response.status).toBe(403)
+    expect(hoisted.bulkChangeInboxMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 for an invalid request body', async () => {
+    const response = await changeInboxHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/change-inbox', 'POST', {
+        ticketIds: ['ticket_1'],
+        // inboxId omitted — the schema requires the key (string | null)
+      }),
+    })
+
+    expect(response.status).toBe(400)
+    expect(hoisted.bulkChangeInboxMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the body is not valid JSON', async () => {
+    const response = await changeInboxHandlers.POST({
+      params: {},
+      request: malformedRequest('http://test/api/v1/tickets/bulk/change-inbox'),
+    })
+
+    expect(response.status).toBe(400)
+    expect(hoisted.bulkChangeInboxMock).not.toHaveBeenCalled()
+  })
+
+  it('delegates thrown domain errors to handleDomainError', async () => {
+    hoisted.bulkChangeInboxMock.mockRejectedValue(new Error('boom'))
+
+    const response = await changeInboxHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/change-inbox', 'POST', {
+        ticketIds: ['ticket_1'],
+        inboxId: 'inbox_1',
+      }),
+    })
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('POST /api/v1/tickets/bulk/transition', () => {
+  it('transitions tickets after scope and permission checks', async () => {
+    const result = { succeeded: ['ticket_1'], failed: [] }
+    hoisted.bulkTransitionMock.mockResolvedValue(result)
+
+    const response = await transitionHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/transition', 'POST', {
+        ticketIds: ['ticket_1'],
+        statusId: 'status_1',
+      }),
+    })
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(result)
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TICKET_BULK_OPERATE
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_BULK_OPERATE
+    )
+    expect(hoisted.bulkTransitionMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        ticketIds: ['ticket_1'],
+        actorPrincipalId: PRINCIPAL,
+        statusId: 'status_1',
+        permit: expect.any(Function),
+      })
+    )
+
+    // Exercise the permit callback so the hasPermissionForResource arrow is covered.
+    const { permit } = hoisted.bulkTransitionMock.mock.calls[0][0] as {
+      permit: (scope: unknown) => boolean
+    }
+    const scope = { kind: 'team', teamId: 'team_1' }
+    expect(permit(scope)).toBe(true)
+    expect(hoisted.hasPermissionForResourceMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_EDIT_FIELDS,
+      scope
+    )
+  })
+
+  it('returns 403 when bulk-operate permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await transitionHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/transition', 'POST', {
+        ticketIds: ['ticket_1'],
+        statusId: 'status_1',
+      }),
+    })
+
+    expect(response.status).toBe(403)
+    expect(hoisted.bulkTransitionMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 for an invalid request body', async () => {
+    const response = await transitionHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/transition', 'POST', {
+        ticketIds: ['ticket_1'],
+        statusId: '',
+      }),
+    })
+
+    expect(response.status).toBe(400)
+    expect(hoisted.bulkTransitionMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the body is not valid JSON', async () => {
+    const response = await transitionHandlers.POST({
+      params: {},
+      request: malformedRequest('http://test/api/v1/tickets/bulk/transition'),
+    })
+
+    expect(response.status).toBe(400)
+    expect(hoisted.bulkTransitionMock).not.toHaveBeenCalled()
+  })
+
+  it('delegates thrown domain errors to handleDomainError', async () => {
+    hoisted.bulkTransitionMock.mockRejectedValue(new Error('boom'))
+
+    const response = await transitionHandlers.POST({
+      params: {},
+      request: jsonRequest('http://test/api/v1/tickets/bulk/transition', 'POST', {
+        ticketIds: ['ticket_1'],
+        statusId: 'status_1',
+      }),
+    })
+
+    expect(response.status).toBe(500)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/tickets/__tests__/tickets-core.coverage.test.ts b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-core.coverage.test.ts
new file mode 100644
index 000000000..83618268e
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-core.coverage.test.ts
@@ -0,0 +1,745 @@
+/**
+ * Request-level behaviour coverage for the core ticket REST routes:
+ *   - tickets/index.ts                  (GET queue, POST create)
+ *   - tickets/$ticketId.ts              (GET, PATCH, DELETE)
+ *   - tickets/$ticketId.transition.ts   (POST)
+ *   - tickets/$ticketId.activity.ts     (GET)
+ *
+ * Mirrors the canonical inboxes.test.ts pattern: every dependency is hoisted
+ * and mocked, the Route objects are imported after the mocks, and the raw
+ * handler map is pulled off `Route.options.server.handlers`.
+ *
+ * British spelling is used in comments per repo convention (behaviour,
+ * organisation, authorise).
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  // tickets domain service surface
+  createTicketMock: vi.fn(),
+  listTicketsMock: vi.fn(),
+  getTicketMock: vi.fn(),
+  updateTicketMock: vi.fn(),
+  softDeleteTicketMock: vi.fn(),
+  listSharesForTicketMock: vi.fn(),
+  toResourceScopeMock: vi.fn(),
+  canViewTicketMock: vi.fn(),
+  canEditFieldsMock: vi.fn(),
+  transitionStatusMock: vi.fn(),
+  listTicketActivityMock: vi.fn(),
+  recordEventMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets', () => ({
+  createTicket: (...args: unknown[]) => hoisted.createTicketMock(...args),
+  listTickets: (...args: unknown[]) => hoisted.listTicketsMock(...args),
+  getTicket: (...args: unknown[]) => hoisted.getTicketMock(...args),
+  updateTicket: (...args: unknown[]) => hoisted.updateTicketMock(...args),
+  softDeleteTicket: (...args: unknown[]) => hoisted.softDeleteTicketMock(...args),
+  listSharesForTicket: (...args: unknown[]) => hoisted.listSharesForTicketMock(...args),
+  toResourceScope: (...args: unknown[]) => hoisted.toResourceScopeMock(...args),
+  canViewTicket: (...args: unknown[]) => hoisted.canViewTicketMock(...args),
+  canEditFields: (...args: unknown[]) => hoisted.canEditFieldsMock(...args),
+  transitionStatus: (...args: unknown[]) => hoisted.transitionStatusMock(...args),
+  listTicketActivity: (...args: unknown[]) => hoisted.listTicketActivityMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/audit', () => ({
+  recordEvent: (...args: unknown[]) => hoisted.recordEventMock(...args),
+}))
+
+// Only the enum constants the routes import for their zod schemas.
+vi.mock('@/lib/server/db', () => ({
+  TICKET_PRIORITIES: ['low', 'normal', 'high', 'urgent'],
+  TICKET_CHANNELS: ['portal', 'email', 'api', 'widget'],
+  TICKET_VISIBILITY_SCOPES: ['team', 'org', 'shared', 'private'],
+}))
+
+import { Route as ActivityRoute } from '../$ticketId.activity'
+import { Route as TransitionRoute } from '../$ticketId.transition'
+import { Route as TicketDetailRoute } from '../$ticketId'
+import { Route as TicketsRoute } from '../index'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const ticketsHandlers = (TicketsRoute as unknown as RouteWithHandlers).options.server.handlers
+const detailHandlers = (TicketDetailRoute as unknown as RouteWithHandlers).options.server.handlers
+const transitionHandlers = (TransitionRoute as unknown as RouteWithHandlers).options.server.handlers
+const activityHandlers = (ActivityRoute as unknown as RouteWithHandlers).options.server.handlers
+
+const PRINCIPAL = 'principal_admin'
+const TICKET = 'ticket_123'
+const NOW = '2026-06-19T10:00:00.000Z'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/tickets')
+) {
+  return { request, params: handlerParams }
+}
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: TICKET,
+    subject: 'Need help',
+    priority: 'normal',
+    primaryTeamId: 'team_1',
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    updatedAt: NOW,
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  // Scope helpers default to permissive so success paths flow unless overridden.
+  hoisted.listSharesForTicketMock.mockResolvedValue([])
+  hoisted.toResourceScopeMock.mockReturnValue({ kind: 'team' })
+  hoisted.canViewTicketMock.mockReturnValue(true)
+  hoisted.canEditFieldsMock.mockReturnValue(true)
+})
+
+describe('GET /api/v1/tickets (queue)', () => {
+  it('lists with default scope, applies hasMore slice and emits a nextCursor', async () => {
+    // limit=2 + the extra probe row means listTickets is called with limit 3.
+    const rows = [
+      ticket({ id: 'ticket_a' }),
+      ticket({ id: 'ticket_b' }),
+      ticket({ id: 'ticket_c' }),
+    ]
+    hoisted.listTicketsMock.mockResolvedValue({ rows, total: 9 })
+
+    const response = await ticketsHandlers.GET(
+      args({}, new Request('http://test/api/v1/tickets?limit=2'))
+    )
+
+    expect(response.status).toBe(200)
+    const payload = await response.json()
+    expect(payload.data).toHaveLength(2)
+    expect(payload.data.map((r: { id: string }) => r.id)).toEqual(['ticket_a', 'ticket_b'])
+    expect(payload.meta.pagination.hasMore).toBe(true)
+    expect(payload.meta.pagination.total).toBe(9)
+    expect(typeof payload.meta.pagination.cursor).toBe('string')
+
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.listTicketsMock).toHaveBeenCalledWith(
+      expect.objectContaining({ scope: 'my_team', limit: 3, offset: 0 })
+    )
+  })
+
+  it('returns no nextCursor and the full set when the page is not full', async () => {
+    const rows = [ticket({ id: 'ticket_a' })]
+    hoisted.listTicketsMock.mockResolvedValue({ rows, total: 1 })
+
+    const response = await ticketsHandlers.GET(
+      args({}, new Request('http://test/api/v1/tickets?scope=all&limit=50'))
+    )
+
+    expect(response.status).toBe(200)
+    const payload = await response.json()
+    expect(payload.data).toHaveLength(1)
+    expect(payload.meta.pagination.hasMore).toBe(false)
+    expect(payload.meta.pagination.cursor).toBeNull()
+    expect(hoisted.listTicketsMock).toHaveBeenCalledWith(
+      expect.objectContaining({ scope: 'all', limit: 51, offset: 0 })
+    )
+  })
+
+  it('passes through search, statusCategory and resolves a real inboxId', async () => {
+    hoisted.listTicketsMock.mockResolvedValue({ rows: [], total: 0 })
+
+    await ticketsHandlers.GET(
+      args(
+        {},
+        new Request(
+          'http://test/api/v1/tickets?scope=inbox&statusCategory=open&search=printer&inboxId=inbox_77'
+        )
+      )
+    )
+
+    expect(hoisted.listTicketsMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        scope: 'inbox',
+        statusCategory: 'open',
+        search: 'printer',
+        inboxId: 'inbox_77',
+      })
+    )
+  })
+
+  it('treats inboxId=null and inboxId="" as an explicit null (no inbox)', async () => {
+    hoisted.listTicketsMock.mockResolvedValue({ rows: [], total: 0 })
+
+    await ticketsHandlers.GET(args({}, new Request('http://test/api/v1/tickets?inboxId=null')))
+    expect(hoisted.listTicketsMock).toHaveBeenLastCalledWith(
+      expect.objectContaining({ inboxId: null })
+    )
+
+    await ticketsHandlers.GET(args({}, new Request('http://test/api/v1/tickets?inboxId=')))
+    expect(hoisted.listTicketsMock).toHaveBeenLastCalledWith(
+      expect.objectContaining({ inboxId: null })
+    )
+  })
+
+  it('decodes a provided cursor into the offset and caps the limit at 200', async () => {
+    hoisted.listTicketsMock.mockResolvedValue({ rows: [], total: 0 })
+    // base64url of {"offset":40}
+    const cursor = Buffer.from(JSON.stringify({ offset: 40 })).toString('base64url')
+
+    await ticketsHandlers.GET(
+      args({}, new Request(`http://test/api/v1/tickets?cursor=${cursor}&limit=999`))
+    )
+
+    expect(hoisted.listTicketsMock).toHaveBeenCalledWith(
+      // limit clamps to 200, then +1 probe row = 201; offset from the cursor.
+      expect.objectContaining({ limit: 201, offset: 40 })
+    )
+  })
+
+  it('rejects an unknown scope with 400 before hitting the service', async () => {
+    const response = await ticketsHandlers.GET(
+      args({}, new Request('http://test/api/v1/tickets?scope=bogus'))
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.listTicketsMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects an unknown statusCategory with 400 before hitting the service', async () => {
+    const response = await ticketsHandlers.GET(
+      args({}, new Request('http://test/api/v1/tickets?statusCategory=bogus'))
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.listTicketsMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a thrown domain error to handleDomainError', async () => {
+    hoisted.listTicketsMock.mockRejectedValue({ code: 'FORBIDDEN', message: 'nope' })
+    const response = await ticketsHandlers.GET(args())
+    expect(response.status).toBe(403)
+  })
+})
+
+describe('POST /api/v1/tickets (create)', () => {
+  it('creates a ticket, records the audit event and returns 201', async () => {
+    const created = ticket({ id: 'ticket_new', subject: 'Broken login' })
+    hoisted.createTicketMock.mockResolvedValue(created)
+    hoisted.recordEventMock.mockResolvedValue(undefined)
+
+    const response = await ticketsHandlers.POST(
+      args(
+        {},
+        jsonRequest('http://test/api/v1/tickets', 'POST', {
+          subject: 'Broken login',
+          priority: 'high',
+          channel: 'api',
+          visibilityScope: 'team',
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(JSON.parse(JSON.stringify(created)))
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.TICKET_EDIT_FIELDS
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_EDIT_FIELDS
+    )
+    expect(hoisted.createTicketMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        subject: 'Broken login',
+        priority: 'high',
+        channel: 'api',
+        createdByPrincipalId: PRINCIPAL,
+      })
+    )
+    expect(hoisted.recordEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principalId: PRINCIPAL,
+        action: 'ticket.created',
+        targetType: 'ticket',
+        targetId: 'ticket_new',
+        source: 'api',
+      })
+    )
+  })
+
+  it('returns 403 when the edit-fields permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+    const response = await ticketsHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/tickets', 'POST', { subject: 'Hi' }))
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.createTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 for an invalid body and does not create', async () => {
+    const response = await ticketsHandlers.POST(
+      // subject is required and must be non-empty.
+      args({}, jsonRequest('http://test/api/v1/tickets', 'POST', { subject: '' }))
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.createTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the JSON body cannot be parsed', async () => {
+    const badRequest = new Request('http://test/api/v1/tickets', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+    const response = await ticketsHandlers.POST(args({}, badRequest))
+    expect(response.status).toBe(400)
+    expect(hoisted.createTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown service error through handleDomainError', async () => {
+    hoisted.createTicketMock.mockRejectedValue({ code: 'CONFLICT', message: 'dup' })
+    const response = await ticketsHandlers.POST(
+      args({}, jsonRequest('http://test/api/v1/tickets', 'POST', { subject: 'Broken login' }))
+    )
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('GET /api/v1/tickets/:ticketId', () => {
+  it('returns the ticket when viewable and maps ticket shares into the scope', async () => {
+    const row = ticket()
+    hoisted.getTicketMock.mockResolvedValue(row)
+    // A non-empty shares list exercises the shares.map callback in loadScope.
+    hoisted.listSharesForTicketMock.mockResolvedValue([
+      { teamId: 'team_2', revokedAt: null },
+      { teamId: 'team_3', revokedAt: NOW },
+    ])
+
+    const response = await detailHandlers.GET(args({ ticketId: TICKET }))
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(JSON.parse(JSON.stringify(row)))
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TICKET, 'ticket', 'ticket ID')
+    expect(hoisted.getTicketMock).toHaveBeenCalledWith(TICKET)
+    expect(hoisted.canViewTicketMock).toHaveBeenCalledWith(expect.any(Set), { kind: 'team' })
+    // The mapped shares are forwarded to toResourceScope.
+    expect(hoisted.toResourceScopeMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        shares: [
+          { teamId: 'team_2', revokedAt: null },
+          { teamId: 'team_3', revokedAt: NOW },
+        ],
+      })
+    )
+  })
+
+  it('returns 404 when the ticket does not exist', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+    const response = await detailHandlers.GET(args({ ticketId: TICKET }))
+    expect(response.status).toBe(404)
+    expect(hoisted.canViewTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot view the ticket', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.canViewTicketMock.mockReturnValue(false)
+    const response = await detailHandlers.GET(args({ ticketId: TICKET }))
+    expect(response.status).toBe(403)
+  })
+
+  it('maps a thrown error (e.g. invalid id) via handleDomainError', async () => {
+    hoisted.parseTypeIdMock.mockImplementation(() => {
+      throw { code: 'VALIDATION_ERROR', message: 'Invalid ticket ID format', statusCode: 400 }
+    })
+    const response = await detailHandlers.GET(args({ ticketId: 'bad' }))
+    expect(response.status).toBe(400)
+  })
+})
+
+describe('PATCH /api/v1/tickets/:ticketId', () => {
+  it('updates the ticket and returns 200', async () => {
+    const row = ticket()
+    const updated = ticket({ subject: 'Renamed' })
+    hoisted.getTicketMock.mockResolvedValue(row)
+    hoisted.updateTicketMock.mockResolvedValue(updated)
+
+    const response = await detailHandlers.PATCH(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123', 'PATCH', {
+          expectedUpdatedAt: NOW,
+          subject: 'Renamed',
+          priority: 'urgent',
+        })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(JSON.parse(JSON.stringify(updated)))
+    // expectedUpdatedAt is converted to a Date and the actor stitched in.
+    const callArg = hoisted.updateTicketMock.mock.calls[0]
+    expect(callArg[0]).toBe(TICKET)
+    expect(callArg[1]).toMatchObject({
+      subject: 'Renamed',
+      priority: 'urgent',
+      actorPrincipalId: PRINCIPAL,
+    })
+    expect(callArg[1].expectedUpdatedAt).toBeInstanceOf(Date)
+    expect((callArg[1].expectedUpdatedAt as Date).toISOString()).toBe(NOW)
+  })
+
+  it('returns 400 for an invalid body before loading the ticket', async () => {
+    const response = await detailHandlers.PATCH(
+      // expectedUpdatedAt is required and must be a datetime.
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123', 'PATCH', { subject: 'x' })
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.updateTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the JSON body cannot be parsed', async () => {
+    // Malformed JSON exercises the request.json().catch(() => null) fallback.
+    const badRequest = new Request('http://test/api/v1/tickets/ticket_123', {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+    const response = await detailHandlers.PATCH(args({ ticketId: TICKET }, badRequest))
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.updateTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+    const response = await detailHandlers.PATCH(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123', 'PATCH', {
+          expectedUpdatedAt: NOW,
+        })
+      )
+    )
+    expect(response.status).toBe(404)
+    expect(hoisted.updateTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot edit fields', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.canEditFieldsMock.mockReturnValue(false)
+    const response = await detailHandlers.PATCH(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123', 'PATCH', {
+          expectedUpdatedAt: NOW,
+        })
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.updateTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown service error through handleDomainError', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.updateTicketMock.mockRejectedValue({ code: 'CONFLICT', message: 'stale' })
+    const response = await detailHandlers.PATCH(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123', 'PATCH', {
+          expectedUpdatedAt: NOW,
+        })
+      )
+    )
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('DELETE /api/v1/tickets/:ticketId', () => {
+  it('soft-deletes the ticket and returns 204', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.softDeleteTicketMock.mockResolvedValue(undefined)
+
+    const response = await detailHandlers.DELETE(args({ ticketId: TICKET }))
+    expect(response.status).toBe(204)
+    expect(hoisted.softDeleteTicketMock).toHaveBeenCalledWith(TICKET, PRINCIPAL)
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+    const response = await detailHandlers.DELETE(args({ ticketId: TICKET }))
+    expect(response.status).toBe(404)
+    expect(hoisted.softDeleteTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot edit fields', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.canEditFieldsMock.mockReturnValue(false)
+    const response = await detailHandlers.DELETE(args({ ticketId: TICKET }))
+    expect(response.status).toBe(403)
+    expect(hoisted.softDeleteTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown service error through handleDomainError', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.softDeleteTicketMock.mockRejectedValue({ code: 'CONFLICT', message: 'locked' })
+    const response = await detailHandlers.DELETE(args({ ticketId: TICKET }))
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('POST /api/v1/tickets/:ticketId/transition', () => {
+  it('transitions the status and returns 200', async () => {
+    const row = ticket()
+    const updated = ticket({ statusId: 'tstatus_solved' })
+    hoisted.getTicketMock.mockResolvedValue(row)
+    hoisted.transitionStatusMock.mockResolvedValue(updated)
+    // A non-empty shares list exercises the inline shares.map callback.
+    hoisted.listSharesForTicketMock.mockResolvedValue([{ teamId: 'team_2', revokedAt: null }])
+
+    const response = await transitionHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/transition', 'POST', {
+          expectedUpdatedAt: NOW,
+          statusId: 'tstatus_solved',
+        })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(JSON.parse(JSON.stringify(updated)))
+    const callArg = hoisted.transitionStatusMock.mock.calls[0]
+    expect(callArg[0]).toBe(TICKET)
+    expect(callArg[1]).toMatchObject({
+      actorPrincipalId: PRINCIPAL,
+      statusId: 'tstatus_solved',
+    })
+    expect(callArg[1].expectedUpdatedAt).toBeInstanceOf(Date)
+  })
+
+  it('returns 400 for an invalid body before loading the ticket', async () => {
+    const response = await transitionHandlers.POST(
+      // statusId is required and must be non-empty.
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/transition', 'POST', {
+          expectedUpdatedAt: NOW,
+          statusId: '',
+        })
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.transitionStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+    const response = await transitionHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/transition', 'POST', {
+          expectedUpdatedAt: NOW,
+          statusId: 'tstatus_solved',
+        })
+      )
+    )
+    expect(response.status).toBe(404)
+    expect(hoisted.transitionStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot edit fields', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.canEditFieldsMock.mockReturnValue(false)
+    const response = await transitionHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/transition', 'POST', {
+          expectedUpdatedAt: NOW,
+          statusId: 'tstatus_solved',
+        })
+      )
+    )
+    expect(response.status).toBe(403)
+    expect(hoisted.transitionStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the JSON body cannot be parsed', async () => {
+    // Malformed JSON exercises the request.json().catch(() => null) fallback.
+    const badRequest = new Request('http://test/api/v1/tickets/ticket_123/transition', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+    const response = await transitionHandlers.POST(args({ ticketId: TICKET }, badRequest))
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.transitionStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown service error through handleDomainError', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.transitionStatusMock.mockRejectedValue({ code: 'CONFLICT', message: 'stale' })
+    const response = await transitionHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/transition', 'POST', {
+          expectedUpdatedAt: NOW,
+          statusId: 'tstatus_solved',
+        })
+      )
+    )
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('GET /api/v1/tickets/:ticketId/activity', () => {
+  function activityRow(overrides: Record<string, unknown> = {}) {
+    return {
+      id: 'tactivity_1',
+      ticketId: TICKET,
+      principalId: PRINCIPAL,
+      type: 'status_changed',
+      metadata: { from: 'open', to: 'solved' },
+      createdAt: new Date(NOW),
+      actorName: 'Demo Agent',
+      actorAvatarUrl: null,
+      ...overrides,
+    }
+  }
+
+  it('returns the activity feed with a null cursor when the page is not full', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.listTicketActivityMock.mockResolvedValue([activityRow()])
+    // A non-empty shares list exercises the inline shares.map callback.
+    hoisted.listSharesForTicketMock.mockResolvedValue([{ teamId: 'team_2', revokedAt: null }])
+
+    const response = await activityHandlers.GET(args({ ticketId: TICKET }))
+    expect(response.status).toBe(200)
+    const data = await expectJsonData(response)
+    expect(data.activity).toHaveLength(1)
+    expect(data.activity[0]).toMatchObject({
+      id: 'tactivity_1',
+      ticketId: TICKET,
+      type: 'status_changed',
+      createdAt: NOW,
+    })
+    expect(data.nextCursor).toBeNull()
+    // Default limit of 50 is applied when no limit query param is present.
+    expect(hoisted.listTicketActivityMock).toHaveBeenCalledWith(
+      TICKET,
+      expect.objectContaining({ before: undefined, limit: 50 })
+    )
+  })
+
+  it('emits a nextCursor when the returned page is exactly the requested limit', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    const older = '2026-06-18T08:00:00.000Z'
+    hoisted.listTicketActivityMock.mockResolvedValue([
+      activityRow({ id: 'tactivity_1' }),
+      activityRow({ id: 'tactivity_2', createdAt: new Date(older) }),
+    ])
+
+    const response = await activityHandlers.GET(
+      args(
+        { ticketId: TICKET },
+        new Request(`http://test/api/v1/tickets/ticket_123/activity?limit=2&before=${NOW}`)
+      )
+    )
+    expect(response.status).toBe(200)
+    const data = await expectJsonData(response)
+    expect(data.nextCursor).toBe(older)
+    expect(hoisted.listTicketActivityMock).toHaveBeenCalledWith(
+      TICKET,
+      expect.objectContaining({ limit: 2 })
+    )
+    // `before` is parsed into a Date.
+    const beforeArg = hoisted.listTicketActivityMock.mock.calls[0][1] as { before: Date }
+    expect(beforeArg.before).toBeInstanceOf(Date)
+    expect(beforeArg.before.toISOString()).toBe(NOW)
+  })
+
+  it('returns 400 for invalid query params', async () => {
+    const response = await activityHandlers.GET(
+      args(
+        { ticketId: TICKET },
+        new Request('http://test/api/v1/tickets/ticket_123/activity?limit=0')
+      )
+    )
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.listTicketActivityMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+    const response = await activityHandlers.GET(args({ ticketId: TICKET }))
+    expect(response.status).toBe(404)
+    expect(hoisted.listTicketActivityMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot view the ticket', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.canViewTicketMock.mockReturnValue(false)
+    const response = await activityHandlers.GET(args({ ticketId: TICKET }))
+    expect(response.status).toBe(403)
+    expect(hoisted.listTicketActivityMock).not.toHaveBeenCalled()
+  })
+
+  it('routes a thrown service error through handleDomainError', async () => {
+    hoisted.getTicketMock.mockResolvedValue(ticket())
+    hoisted.listTicketActivityMock.mockRejectedValue({ code: 'FORBIDDEN', message: 'nope' })
+    const response = await activityHandlers.GET(args({ ticketId: TICKET }))
+    expect(response.status).toBe(403)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/tickets/__tests__/tickets-lifecycle.coverage.test.ts b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-lifecycle.coverage.test.ts
new file mode 100644
index 000000000..0692a8e63
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-lifecycle.coverage.test.ts
@@ -0,0 +1,453 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+/**
+ * Request-level behaviour tests for the ticket lifecycle REST routes:
+ *   - POST /api/v1/tickets/:ticketId/assign
+ *   - POST /api/v1/tickets/:ticketId/take
+ *   - POST /api/v1/tickets/:ticketId/return
+ *   - POST /api/v1/tickets/:ticketId/restore
+ *   - GET  /api/v1/tickets/:ticketId/sla
+ *
+ * Each handler is exercised for its success path, permission denials, body
+ * validation and not-found branches, plus every conditional toggle in the
+ * source (self-assignment, includeAll, the assign-any/assign-self OR branch).
+ */
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  hasPermissionMock: vi.fn(),
+  hasPermissionForResourceMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  // tickets domain
+  assignTicketMock: vi.fn(),
+  takeTicketMock: vi.fn(),
+  returnTicketMock: vi.fn(),
+  restoreTicketMock: vi.fn(),
+  getTicketMock: vi.fn(),
+  listSharesForTicketMock: vi.fn(),
+  toResourceScopeMock: vi.fn(),
+  canAssignMock: vi.fn(),
+  canAssignSelfMock: vi.fn(),
+  // sla domain
+  getActiveClocksForTicketMock: vi.fn(),
+  getAllClocksForTicketMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+  hasPermission: (...args: unknown[]) => hoisted.hasPermissionMock(...args),
+  hasPermissionForResource: (...args: unknown[]) => hoisted.hasPermissionForResourceMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets', () => ({
+  assignTicket: (...args: unknown[]) => hoisted.assignTicketMock(...args),
+  takeTicket: (...args: unknown[]) => hoisted.takeTicketMock(...args),
+  returnTicket: (...args: unknown[]) => hoisted.returnTicketMock(...args),
+  restoreTicket: (...args: unknown[]) => hoisted.restoreTicketMock(...args),
+  getTicket: (...args: unknown[]) => hoisted.getTicketMock(...args),
+  listSharesForTicket: (...args: unknown[]) => hoisted.listSharesForTicketMock(...args),
+  toResourceScope: (...args: unknown[]) => hoisted.toResourceScopeMock(...args),
+  canAssign: (...args: unknown[]) => hoisted.canAssignMock(...args),
+  canAssignSelf: (...args: unknown[]) => hoisted.canAssignSelfMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/sla', () => ({
+  getActiveClocksForTicket: (...args: unknown[]) => hoisted.getActiveClocksForTicketMock(...args),
+  getAllClocksForTicket: (...args: unknown[]) => hoisted.getAllClocksForTicketMock(...args),
+}))
+
+import { Route as AssignRoute } from '../$ticketId.assign'
+import { Route as RestoreRoute } from '../$ticketId.restore'
+import { Route as ReturnRoute } from '../$ticketId.return'
+import { Route as SlaRoute } from '../$ticketId.sla'
+import { Route as TakeRoute } from '../$ticketId.take'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const assignHandlers = (AssignRoute as unknown as RouteWithHandlers).options.server.handlers
+const takeHandlers = (TakeRoute as unknown as RouteWithHandlers).options.server.handlers
+const returnHandlers = (ReturnRoute as unknown as RouteWithHandlers).options.server.handlers
+const restoreHandlers = (RestoreRoute as unknown as RouteWithHandlers).options.server.handlers
+const slaHandlers = (SlaRoute as unknown as RouteWithHandlers).options.server.handlers
+
+const PRINCIPAL = 'principal_admin'
+const TICKET = 'ticket_123'
+const SCOPE = { kind: 'ticket-scope' }
+const UPDATED_AT = '2026-01-01T00:00:00.000Z'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = { ticketId: TICKET },
+  request = new Request('http://test/api/v1/tickets/ticket_123/x')
+) {
+  return { request, params: handlerParams }
+}
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: TICKET,
+    primaryTeamId: 'team_primary',
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    updatedAt: new Date(UPDATED_AT),
+    ...overrides,
+  }
+}
+
+async function responseData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.hasPermissionMock.mockReturnValue(true)
+  hoisted.hasPermissionForResourceMock.mockReturnValue(true)
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.getTicketMock.mockResolvedValue(ticket())
+  hoisted.listSharesForTicketMock.mockResolvedValue([{ teamId: 'team_shared', revokedAt: null }])
+  hoisted.toResourceScopeMock.mockReturnValue(SCOPE)
+  hoisted.canAssignMock.mockReturnValue(true)
+  hoisted.canAssignSelfMock.mockReturnValue(true)
+  hoisted.assignTicketMock.mockResolvedValue(ticket({ assigneeTeamId: 'team_other' }))
+  hoisted.takeTicketMock.mockResolvedValue(ticket({ assigneePrincipalId: PRINCIPAL }))
+  hoisted.returnTicketMock.mockResolvedValue(ticket({ assigneePrincipalId: null }))
+  hoisted.restoreTicketMock.mockResolvedValue(ticket({ deletedAt: null }))
+  hoisted.getActiveClocksForTicketMock.mockResolvedValue([{ id: 'clk_active' }])
+  hoisted.getAllClocksForTicketMock.mockResolvedValue([{ id: 'clk_active' }, { id: 'clk_done' }])
+})
+
+describe('POST /api/v1/tickets/:ticketId/assign', () => {
+  it('assigns a ticket to another team after a team-level permission check', async () => {
+    const response = await assignHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/assign', 'POST', {
+          expectedUpdatedAt: UPDATED_AT,
+          assigneePrincipalId: null,
+          assigneeTeamId: 'team_other',
+        })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.toResourceScopeMock).toHaveBeenCalledWith({
+      primaryTeamId: 'team_primary',
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+      shares: [{ teamId: 'team_shared', revokedAt: null }],
+    })
+    // assigneePrincipalId is null (not the caller), so the broad canAssign check is used.
+    expect(hoisted.canAssignMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+    expect(hoisted.canAssignSelfMock).not.toHaveBeenCalled()
+    expect(hoisted.assignTicketMock).toHaveBeenCalledWith(TICKET, {
+      expectedUpdatedAt: new Date(UPDATED_AT),
+      actorPrincipalId: PRINCIPAL,
+      assigneePrincipalId: null,
+      assigneeTeamId: 'team_other',
+    })
+  })
+
+  it('uses the self-assignment check when assigning to the calling principal', async () => {
+    const response = await assignHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/assign', 'POST', {
+          expectedUpdatedAt: UPDATED_AT,
+          assigneePrincipalId: PRINCIPAL,
+        })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(hoisted.canAssignSelfMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+    expect(hoisted.canAssignMock).not.toHaveBeenCalled()
+    // Optional assigneeTeamId is absent, so the handler coalesces it to null.
+    expect(hoisted.assignTicketMock).toHaveBeenCalledWith(
+      TICKET,
+      expect.objectContaining({ assigneePrincipalId: PRINCIPAL, assigneeTeamId: null })
+    )
+  })
+
+  it('returns 403 when the assignment permission check fails', async () => {
+    hoisted.canAssignMock.mockReturnValue(false)
+
+    const response = await assignHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/assign', 'POST', {
+          expectedUpdatedAt: UPDATED_AT,
+          assigneeTeamId: 'team_other',
+        })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.assignTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 for an invalid request body without calling the service', async () => {
+    const response = await assignHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/assign', 'POST', {
+          expectedUpdatedAt: 'not-a-datetime',
+        })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.assignTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the request body is not valid JSON', async () => {
+    // A malformed body makes request.json() reject; the handler's .catch(() => null)
+    // arrow coalesces it to null, which then fails safeParse.
+    const malformed = new Request('http://test/api/v1/tickets/ticket_123/assign', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+
+    const response = await assignHandlers.POST(args({ ticketId: TICKET }, malformed))
+
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.assignTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket does not exist', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+
+    const response = await assignHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/assign', 'POST', {
+          expectedUpdatedAt: UPDATED_AT,
+        })
+      )
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.assignTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('routes domain errors through handleDomainError', async () => {
+    hoisted.withApiKeyAuthMock.mockRejectedValue(new Error('boom'))
+
+    const response = await assignHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/assign', 'POST', {
+          expectedUpdatedAt: UPDATED_AT,
+        })
+      )
+    )
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('POST /api/v1/tickets/:ticketId/take', () => {
+  it('takes a ticket after a resource-scoped self-assign permission check', async () => {
+    const response = await takeHandlers.POST(args())
+
+    expect(response.status).toBe(200)
+    expect(await responseData(response)).toEqual(
+      JSON.parse(JSON.stringify(ticket({ assigneePrincipalId: PRINCIPAL })))
+    )
+    expect(hoisted.hasPermissionForResourceMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_ASSIGN_SELF,
+      SCOPE
+    )
+    expect(hoisted.takeTicketMock).toHaveBeenCalledWith(TICKET, PRINCIPAL)
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+
+    const response = await takeHandlers.POST(args())
+
+    expect(response.status).toBe(404)
+    expect(hoisted.takeTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller lacks the self-assign permission', async () => {
+    hoisted.hasPermissionForResourceMock.mockReturnValue(false)
+
+    const response = await takeHandlers.POST(args())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.takeTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('routes domain errors through handleDomainError', async () => {
+    hoisted.takeTicketMock.mockRejectedValue(new Error('boom'))
+
+    const response = await takeHandlers.POST(args())
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('POST /api/v1/tickets/:ticketId/return', () => {
+  it('returns a ticket when the caller has the assign-any permission', async () => {
+    const response = await returnHandlers.POST(args())
+
+    expect(response.status).toBe(200)
+    expect(hoisted.hasPermissionForResourceMock).toHaveBeenCalledWith(
+      expect.any(Set),
+      PERMISSIONS.TICKET_ASSIGN_ANY,
+      SCOPE
+    )
+    expect(hoisted.returnTicketMock).toHaveBeenCalledWith(TICKET, PRINCIPAL)
+  })
+
+  it('falls back to the assign-self permission when assign-any is missing', async () => {
+    // First call (assign_any) fails, second call (assign_self) succeeds via the OR branch.
+    hoisted.hasPermissionForResourceMock.mockReturnValueOnce(false).mockReturnValueOnce(true)
+
+    const response = await returnHandlers.POST(args())
+
+    expect(response.status).toBe(200)
+    expect(hoisted.hasPermissionForResourceMock).toHaveBeenNthCalledWith(
+      2,
+      expect.any(Set),
+      PERMISSIONS.TICKET_ASSIGN_SELF,
+      SCOPE
+    )
+    expect(hoisted.returnTicketMock).toHaveBeenCalledWith(TICKET, PRINCIPAL)
+  })
+
+  it('returns 403 when neither assign permission is granted', async () => {
+    hoisted.hasPermissionForResourceMock.mockReturnValue(false)
+
+    const response = await returnHandlers.POST(args())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.returnTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+
+    const response = await returnHandlers.POST(args())
+
+    expect(response.status).toBe(404)
+    expect(hoisted.returnTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('routes domain errors through handleDomainError', async () => {
+    hoisted.returnTicketMock.mockRejectedValue(new Error('boom'))
+
+    const response = await returnHandlers.POST(args())
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('POST /api/v1/tickets/:ticketId/restore', () => {
+  it('restores a soft-deleted ticket as an admin API key', async () => {
+    const response = await restoreHandlers.POST(args())
+
+    expect(response.status).toBe(200)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'admin' })
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TICKET, 'ticket', 'ticket ID')
+    expect(hoisted.restoreTicketMock).toHaveBeenCalledWith(TICKET, PRINCIPAL)
+  })
+
+  it('routes domain errors through handleDomainError', async () => {
+    hoisted.restoreTicketMock.mockRejectedValue(new Error('boom'))
+
+    const response = await restoreHandlers.POST(args())
+
+    expect(response.status).toBe(500)
+    expect(hoisted.restoreTicketMock).toHaveBeenCalled()
+  })
+})
+
+describe('GET /api/v1/tickets/:ticketId/sla', () => {
+  it('returns active SLA clocks after scope and permission checks', async () => {
+    const response = await slaHandlers.GET(args())
+
+    expect(response.status).toBe(200)
+    expect(await responseData(response)).toEqual({ clocks: [{ id: 'clk_active' }] })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.SLA_VIEW
+    )
+    expect(hoisted.hasPermissionMock).toHaveBeenCalledWith(expect.any(Set), PERMISSIONS.SLA_VIEW)
+    expect(hoisted.getActiveClocksForTicketMock).toHaveBeenCalledWith(TICKET)
+    expect(hoisted.getAllClocksForTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns all SLA clocks when includeAll=true', async () => {
+    const response = await slaHandlers.GET(
+      args(
+        { ticketId: TICKET },
+        new Request('http://test/api/v1/tickets/ticket_123/sla?includeAll=true')
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(await responseData(response)).toEqual({
+      clocks: [{ id: 'clk_active' }, { id: 'clk_done' }],
+    })
+    expect(hoisted.getAllClocksForTicketMock).toHaveBeenCalledWith(TICKET)
+    expect(hoisted.getActiveClocksForTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the sla.view permission is missing', async () => {
+    hoisted.hasPermissionMock.mockReturnValue(false)
+
+    const response = await slaHandlers.GET(args())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.getActiveClocksForTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.getAllClocksForTicketMock).not.toHaveBeenCalled()
+  })
+
+  it('routes domain errors through handleDomainError', async () => {
+    hoisted.assertScopeAllowedMock.mockImplementation(() => {
+      throw new Error('scope denied')
+    })
+
+    const response = await slaHandlers.GET(args())
+
+    expect(response.status).toBe(500)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/tickets/__tests__/tickets-participants-shares.coverage.test.ts b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-participants-shares.coverage.test.ts
new file mode 100644
index 000000000..1fd3db1d6
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-participants-shares.coverage.test.ts
@@ -0,0 +1,519 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+/**
+ * Request-level behaviour coverage for the ticket participants and shares
+ * REST route handlers. These routes authorise via the tickets-domain
+ * permission helpers (canViewTicket / canManageParticipants /
+ * canShareCrossTeam) rather than the generic assertScopeAllowed +
+ * hasPermission pair, so the mocks mirror the sibling thread-attachments
+ * test rather than the inboxes reference verbatim.
+ */
+
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  getTicketMock: vi.fn(),
+  listSharesForTicketMock: vi.fn(),
+  toResourceScopeMock: vi.fn(),
+  canViewTicketMock: vi.fn(),
+  canManageParticipantsMock: vi.fn(),
+  canShareCrossTeamMock: vi.fn(),
+  addParticipantMock: vi.fn(),
+  listParticipantsMock: vi.fn(),
+  removeParticipantMock: vi.fn(),
+  shareTicketWithTeamMock: vi.fn(),
+  revokeShareMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets', () => ({
+  addParticipant: (...args: unknown[]) => hoisted.addParticipantMock(...args),
+  listParticipants: (...args: unknown[]) => hoisted.listParticipantsMock(...args),
+  removeParticipant: (...args: unknown[]) => hoisted.removeParticipantMock(...args),
+  shareTicketWithTeam: (...args: unknown[]) => hoisted.shareTicketWithTeamMock(...args),
+  revokeShare: (...args: unknown[]) => hoisted.revokeShareMock(...args),
+  getTicket: (...args: unknown[]) => hoisted.getTicketMock(...args),
+  listSharesForTicket: (...args: unknown[]) => hoisted.listSharesForTicketMock(...args),
+  toResourceScope: (...args: unknown[]) => hoisted.toResourceScopeMock(...args),
+  canViewTicket: (...args: unknown[]) => hoisted.canViewTicketMock(...args),
+  canManageParticipants: (...args: unknown[]) => hoisted.canManageParticipantsMock(...args),
+  canShareCrossTeam: (...args: unknown[]) => hoisted.canShareCrossTeamMock(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  TICKET_PARTICIPANT_ROLES: ['watcher', 'collaborator', 'cc'],
+  TICKET_SHARE_LEVELS: ['read', 'comment', 'full'],
+}))
+
+import { Route as ParticipantDetailRoute } from '../$ticketId.participants.$participantId'
+import { Route as ParticipantsRoute } from '../$ticketId.participants'
+import { Route as ShareDetailRoute } from '../$ticketId.shares.$shareId'
+import { Route as SharesRoute } from '../$ticketId.shares'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const participantHandlers = (ParticipantsRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+const participantDetailHandlers = (ParticipantDetailRoute as unknown as RouteWithHandlers).options
+  .server.handlers
+const shareHandlers = (SharesRoute as unknown as RouteWithHandlers).options.server.handlers
+const shareDetailHandlers = (ShareDetailRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+
+const PRINCIPAL = 'principal_agent'
+const TICKET = 'ticket_123'
+const PARTICIPANT = 'ticket_part_123'
+const SHARE = 'ticket_share_123'
+const SCOPE = { kind: 'ticket-scope' }
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(handlerParams: Record<string, string> = {}, request = new Request('http://test/x')) {
+  return { request, params: handlerParams }
+}
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: TICKET,
+    primaryTeamId: 'team_primary',
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    ...overrides,
+  }
+}
+
+function participant(overrides: Record<string, unknown> = {}) {
+  return {
+    id: PARTICIPANT,
+    ticketId: TICKET,
+    role: 'watcher',
+    principalId: null,
+    contactId: null,
+    addedByPrincipalId: PRINCIPAL,
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    ...overrides,
+  }
+}
+
+function share(overrides: Record<string, unknown> = {}) {
+  return {
+    id: SHARE,
+    ticketId: TICKET,
+    teamId: 'team_shared',
+    accessLevel: 'read',
+    revokedAt: null,
+    grantedByPrincipalId: PRINCIPAL,
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    ...overrides,
+  }
+}
+
+async function responseData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue(new Set<string>())
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.getTicketMock.mockResolvedValue(ticket())
+  hoisted.listSharesForTicketMock.mockResolvedValue([share()])
+  hoisted.toResourceScopeMock.mockReturnValue(SCOPE)
+  hoisted.canViewTicketMock.mockReturnValue(true)
+  hoisted.canManageParticipantsMock.mockReturnValue(true)
+  hoisted.canShareCrossTeamMock.mockReturnValue(true)
+  hoisted.listParticipantsMock.mockResolvedValue([participant()])
+  hoisted.addParticipantMock.mockResolvedValue(participant())
+  hoisted.removeParticipantMock.mockResolvedValue(undefined)
+  hoisted.shareTicketWithTeamMock.mockResolvedValue(share())
+  hoisted.revokeShareMock.mockResolvedValue(undefined)
+})
+
+describe('GET /api/v1/tickets/:ticketId/participants', () => {
+  it('lists participants after auth, ticket lookup, scope build, and view check', async () => {
+    const response = await participantHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(200)
+    expect(await responseData(response)).toEqual(JSON.parse(JSON.stringify([participant()])))
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.loadPermissionSetMock).toHaveBeenCalledWith(PRINCIPAL)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TICKET, 'ticket', 'ticket ID')
+    expect(hoisted.getTicketMock).toHaveBeenCalledWith(TICKET)
+    expect(hoisted.listSharesForTicketMock).toHaveBeenCalledWith(TICKET)
+    // The route builds the resource scope from the ticket and its shares.
+    expect(hoisted.toResourceScopeMock).toHaveBeenCalledWith({
+      primaryTeamId: 'team_primary',
+      assigneePrincipalId: null,
+      assigneeTeamId: null,
+      shares: [{ teamId: 'team_shared', revokedAt: null }],
+    })
+    expect(hoisted.canViewTicketMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+    expect(hoisted.listParticipantsMock).toHaveBeenCalledWith(TICKET)
+  })
+
+  it('returns 404 when the ticket does not exist', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+
+    const response = await participantHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(404)
+    expect(hoisted.listSharesForTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.listParticipantsMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot view the ticket', async () => {
+    hoisted.canViewTicketMock.mockReturnValue(false)
+
+    const response = await participantHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.listParticipantsMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.getTicketMock.mockRejectedValueOnce({ code: 'CONFLICT', message: 'boom' })
+
+    const response = await participantHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('POST /api/v1/tickets/:ticketId/participants', () => {
+  it('adds a participant, coalescing omitted principalId and contactId to null', async () => {
+    const response = await participantHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { role: 'watcher' }))
+    )
+
+    expect(response.status).toBe(201)
+    expect(hoisted.canManageParticipantsMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+    expect(hoisted.addParticipantMock).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      role: 'watcher',
+      principalId: null,
+      contactId: null,
+      addedByPrincipalId: PRINCIPAL,
+    })
+  })
+
+  it('passes through provided principalId and contactId values', async () => {
+    const response = await participantHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/x', 'POST', {
+          role: 'collaborator',
+          principalId: 'principal_other',
+          contactId: 'contact_99',
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(hoisted.addParticipantMock).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      role: 'collaborator',
+      principalId: 'principal_other',
+      contactId: 'contact_99',
+      addedByPrincipalId: PRINCIPAL,
+    })
+  })
+
+  it('returns 400 for an invalid request body without calling the service', async () => {
+    const response = await participantHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { role: 'invalid' }))
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.addParticipantMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the body is not valid JSON', async () => {
+    // request.json() rejects, so the route coalesces to null which fails parsing.
+    const malformed = new Request('http://test/x', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+
+    const response = await participantHandlers.POST(args({ ticketId: TICKET }, malformed))
+
+    expect(response.status).toBe(400)
+    expect(hoisted.addParticipantMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+
+    const response = await participantHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { role: 'watcher' }))
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.addParticipantMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot manage participants', async () => {
+    hoisted.canManageParticipantsMock.mockReturnValue(false)
+
+    const response = await participantHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { role: 'watcher' }))
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.addParticipantMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.addParticipantMock.mockRejectedValueOnce({ code: 'CONFLICT', message: 'dupe' })
+
+    const response = await participantHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { role: 'watcher' }))
+    )
+
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('DELETE /api/v1/tickets/:ticketId/participants/:participantId', () => {
+  it('removes a participant after parsing both ids and the manage check', async () => {
+    const response = await participantDetailHandlers.DELETE(
+      args({ ticketId: TICKET, participantId: PARTICIPANT })
+    )
+
+    expect(response.status).toBe(204)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TICKET, 'ticket', 'ticket ID')
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(
+      PARTICIPANT,
+      'ticket_part',
+      'participant ID'
+    )
+    expect(hoisted.canManageParticipantsMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+    expect(hoisted.removeParticipantMock).toHaveBeenCalledWith(PARTICIPANT, PRINCIPAL)
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+
+    const response = await participantDetailHandlers.DELETE(
+      args({ ticketId: TICKET, participantId: PARTICIPANT })
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.removeParticipantMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot manage participants', async () => {
+    hoisted.canManageParticipantsMock.mockReturnValue(false)
+
+    const response = await participantDetailHandlers.DELETE(
+      args({ ticketId: TICKET, participantId: PARTICIPANT })
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.removeParticipantMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.removeParticipantMock.mockRejectedValueOnce({ code: 'CONFLICT', message: 'nope' })
+
+    const response = await participantDetailHandlers.DELETE(
+      args({ ticketId: TICKET, participantId: PARTICIPANT })
+    )
+
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('GET /api/v1/tickets/:ticketId/shares', () => {
+  it('lists active shares after the view check', async () => {
+    const response = await shareHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(200)
+    expect(await responseData(response)).toEqual(JSON.parse(JSON.stringify([share()])))
+    expect(hoisted.getTicketMock).toHaveBeenCalledWith(TICKET)
+    expect(hoisted.canViewTicketMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+
+    const response = await shareHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(404)
+  })
+
+  it('returns 403 when the caller cannot view the ticket', async () => {
+    hoisted.canViewTicketMock.mockReturnValue(false)
+
+    const response = await shareHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(403)
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.listSharesForTicketMock.mockRejectedValueOnce({ code: 'CONFLICT', message: 'boom' })
+
+    const response = await shareHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('POST /api/v1/tickets/:ticketId/shares', () => {
+  it('shares the ticket with a team, forwarding an explicit accessLevel', async () => {
+    const response = await shareHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/x', 'POST', { teamId: 'team_b', accessLevel: 'full' })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(hoisted.canShareCrossTeamMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+    expect(hoisted.shareTicketWithTeamMock).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      teamId: 'team_b',
+      accessLevel: 'full',
+      grantedByPrincipalId: PRINCIPAL,
+    })
+  })
+
+  it('omits accessLevel when the caller does not supply one', async () => {
+    const response = await shareHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { teamId: 'team_b' }))
+    )
+
+    expect(response.status).toBe(201)
+    expect(hoisted.shareTicketWithTeamMock).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      teamId: 'team_b',
+      accessLevel: undefined,
+      grantedByPrincipalId: PRINCIPAL,
+    })
+  })
+
+  it('returns 400 for an invalid request body without calling the service', async () => {
+    const response = await shareHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { teamId: '' }))
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.shareTicketWithTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when the body is not valid JSON', async () => {
+    // request.json() rejects, so the route's .catch coalesces to null which fails parsing.
+    const malformed = new Request('http://test/x', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+
+    const response = await shareHandlers.POST(args({ ticketId: TICKET }, malformed))
+
+    expect(response.status).toBe(400)
+    expect(hoisted.shareTicketWithTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+
+    const response = await shareHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { teamId: 'team_b' }))
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.shareTicketWithTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot share cross-team', async () => {
+    hoisted.canShareCrossTeamMock.mockReturnValue(false)
+
+    const response = await shareHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { teamId: 'team_b' }))
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.shareTicketWithTeamMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.shareTicketWithTeamMock.mockRejectedValueOnce({ code: 'CONFLICT', message: 'dupe' })
+
+    const response = await shareHandlers.POST(
+      args({ ticketId: TICKET }, jsonRequest('http://test/x', 'POST', { teamId: 'team_b' }))
+    )
+
+    expect(response.status).toBe(409)
+  })
+})
+
+describe('DELETE /api/v1/tickets/:ticketId/shares/:shareId', () => {
+  it('revokes a share after parsing both ids and the cross-team check', async () => {
+    const response = await shareDetailHandlers.DELETE(args({ ticketId: TICKET, shareId: SHARE }))
+
+    expect(response.status).toBe(204)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TICKET, 'ticket', 'ticket ID')
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(SHARE, 'ticket_share', 'share ID')
+    expect(hoisted.canShareCrossTeamMock).toHaveBeenCalledWith(expect.any(Set), SCOPE)
+    expect(hoisted.revokeShareMock).toHaveBeenCalledWith(SHARE, PRINCIPAL)
+  })
+
+  it('returns 404 when the ticket is missing', async () => {
+    hoisted.getTicketMock.mockResolvedValueOnce(null)
+
+    const response = await shareDetailHandlers.DELETE(args({ ticketId: TICKET, shareId: SHARE }))
+
+    expect(response.status).toBe(404)
+    expect(hoisted.revokeShareMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot share cross-team', async () => {
+    hoisted.canShareCrossTeamMock.mockReturnValue(false)
+
+    const response = await shareDetailHandlers.DELETE(args({ ticketId: TICKET, shareId: SHARE }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.revokeShareMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.revokeShareMock.mockRejectedValueOnce({ code: 'CONFLICT', message: 'nope' })
+
+    const response = await shareDetailHandlers.DELETE(args({ ticketId: TICKET, shareId: SHARE }))
+
+    expect(response.status).toBe(409)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/tickets/__tests__/tickets-threads.coverage.test.ts b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-threads.coverage.test.ts
new file mode 100644
index 000000000..c7bed513f
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/__tests__/tickets-threads.coverage.test.ts
@@ -0,0 +1,653 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+/**
+ * Request-level behaviour coverage for the ticket thread REST routes:
+ *   - $ticketId.threads.ts            (GET, POST)
+ *   - $ticketId.threads.$threadId.ts  (PATCH, DELETE)
+ *
+ * These routes do not use the scope/`assertScopeAllowed` mechanism. Instead they
+ * authorise via the tickets domain `can*` helpers driven by `loadPermissionSet`.
+ * We mock every collaborator each route imports and exercise every branch so the
+ * suite drives both files to full line and branch coverage. British spelling is
+ * used throughout (authorise, behaviour) per repo convention.
+ */
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  loadPermissionSetMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  addThreadMock: vi.fn(),
+  listThreadsMock: vi.fn(),
+  getTicketMock: vi.fn(),
+  getThreadMock: vi.fn(),
+  editThreadMock: vi.fn(),
+  softDeleteThreadMock: vi.fn(),
+  listSharesForTicketMock: vi.fn(),
+  toResourceScopeMock: vi.fn(),
+  canViewTicketMock: vi.fn(),
+  canReplyPublicMock: vi.fn(),
+  canCommentInternalMock: vi.fn(),
+  canShareCrossTeamMock: vi.fn(),
+  canEditFieldsMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/authz/authz.service', () => ({
+  loadPermissionSet: (...args: unknown[]) => hoisted.loadPermissionSetMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/tickets', () => ({
+  addThread: (...args: unknown[]) => hoisted.addThreadMock(...args),
+  listThreads: (...args: unknown[]) => hoisted.listThreadsMock(...args),
+  getTicket: (...args: unknown[]) => hoisted.getTicketMock(...args),
+  getThread: (...args: unknown[]) => hoisted.getThreadMock(...args),
+  editThread: (...args: unknown[]) => hoisted.editThreadMock(...args),
+  softDeleteThread: (...args: unknown[]) => hoisted.softDeleteThreadMock(...args),
+  listSharesForTicket: (...args: unknown[]) => hoisted.listSharesForTicketMock(...args),
+  toResourceScope: (...args: unknown[]) => hoisted.toResourceScopeMock(...args),
+  canViewTicket: (...args: unknown[]) => hoisted.canViewTicketMock(...args),
+  canReplyPublic: (...args: unknown[]) => hoisted.canReplyPublicMock(...args),
+  canCommentInternal: (...args: unknown[]) => hoisted.canCommentInternalMock(...args),
+  canShareCrossTeam: (...args: unknown[]) => hoisted.canShareCrossTeamMock(...args),
+  canEditFields: (...args: unknown[]) => hoisted.canEditFieldsMock(...args),
+}))
+
+vi.mock('@/lib/server/db', () => ({
+  TICKET_THREAD_AUDIENCES: ['public', 'internal', 'shared_team'],
+}))
+
+import { Route as ThreadsRoute } from '../$ticketId.threads'
+import { Route as ThreadDetailRoute } from '../$ticketId.threads.$threadId'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const threadsHandlers = (ThreadsRoute as unknown as RouteWithHandlers).options.server.handlers
+const threadDetailHandlers = (ThreadDetailRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+
+const PRINCIPAL = 'principal_admin'
+const TICKET = 'ticket_123'
+const THREAD = 'ticket_thread_123'
+const TEAM = 'team_456'
+
+function jsonRequest(url: string, method: string, body?: unknown) {
+  return new Request(url, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/tickets/ticket_123/threads')
+) {
+  return { request, params: handlerParams }
+}
+
+function ticket(overrides: Record<string, unknown> = {}) {
+  return {
+    id: TICKET,
+    primaryTeamId: TEAM,
+    assigneePrincipalId: null,
+    assigneeTeamId: null,
+    requesterPrincipalId: 'principal_requester',
+    ...overrides,
+  }
+}
+
+function thread(overrides: Record<string, unknown> = {}) {
+  return {
+    id: THREAD,
+    ticketId: TICKET,
+    principalId: PRINCIPAL,
+    audience: 'internal',
+    bodyText: 'hello',
+    bodyJson: null,
+    deletedAt: null,
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+const SCOPE = { kind: 'scope' }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'team',
+    key: { scopes: [] },
+  })
+  hoisted.loadPermissionSetMock.mockResolvedValue({ teamIds: ['team_self'] })
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+  hoisted.getTicketMock.mockResolvedValue(ticket())
+  hoisted.listSharesForTicketMock.mockResolvedValue([])
+  hoisted.toResourceScopeMock.mockReturnValue(SCOPE)
+  hoisted.canViewTicketMock.mockReturnValue(true)
+  hoisted.canReplyPublicMock.mockReturnValue(true)
+  hoisted.canCommentInternalMock.mockReturnValue(true)
+  hoisted.canShareCrossTeamMock.mockReturnValue(true)
+  hoisted.canEditFieldsMock.mockReturnValue(true)
+})
+
+describe('GET /api/v1/tickets/:ticketId/threads', () => {
+  it('lists threads and threads the viewer context through when the caller is the requester', async () => {
+    const rows = [thread()]
+    hoisted.listThreadsMock.mockResolvedValue(rows)
+    hoisted.getTicketMock.mockResolvedValue(ticket({ requesterPrincipalId: PRINCIPAL }))
+    hoisted.canCommentInternalMock.mockReturnValue(true)
+    // Exercise the shares.map() callback inside loadScope with a non-empty share list.
+    hoisted.listSharesForTicketMock.mockResolvedValue([
+      { teamId: TEAM, revokedAt: null },
+      { teamId: 'team_other', revokedAt: new Date('2026-02-01') },
+    ])
+
+    const response = await threadsHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(rows)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'team' })
+    expect(hoisted.loadPermissionSetMock).toHaveBeenCalledWith(PRINCIPAL)
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TICKET, 'ticket', 'ticket ID')
+    // The mapped shares are forwarded to toResourceScope.
+    expect(hoisted.toResourceScopeMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        shares: [
+          { teamId: TEAM, revokedAt: null },
+          { teamId: 'team_other', revokedAt: new Date('2026-02-01') },
+        ],
+      })
+    )
+    expect(hoisted.listThreadsMock).toHaveBeenCalledWith(TICKET, {
+      viewerTeamIds: ['team_self'],
+      canSeeInternal: true,
+      isRequester: true,
+    })
+  })
+
+  it('marks isRequester false and canSeeInternal off for a non-requester without internal access', async () => {
+    hoisted.listThreadsMock.mockResolvedValue([])
+    // Default ticket requesterPrincipalId differs from the caller.
+    hoisted.canCommentInternalMock.mockReturnValue(false)
+
+    const response = await threadsHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(200)
+    expect(hoisted.listThreadsMock).toHaveBeenCalledWith(TICKET, {
+      viewerTeamIds: ['team_self'],
+      canSeeInternal: false,
+      isRequester: false,
+    })
+  })
+
+  it('returns 404 when the ticket cannot be loaded', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+
+    const response = await threadsHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(404)
+    expect(hoisted.listThreadsMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot view the ticket', async () => {
+    hoisted.canViewTicketMock.mockReturnValue(false)
+
+    const response = await threadsHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.listThreadsMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.listThreadsMock.mockRejectedValue(new Error('boom'))
+
+    const response = await threadsHandlers.GET(args({ ticketId: TICKET }))
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('POST /api/v1/tickets/:ticketId/threads', () => {
+  it('creates a thread, defaulting optional fields to null', async () => {
+    const created = thread({ audience: 'public' })
+    hoisted.addThreadMock.mockResolvedValue(created)
+
+    const response = await threadsHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/threads', 'POST', {
+          audience: 'public',
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(await expectJsonData(response)).toEqual(JSON.parse(JSON.stringify(created)))
+    expect(hoisted.addThreadMock).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      principalId: PRINCIPAL,
+      audience: 'public',
+      bodyJson: null,
+      bodyText: null,
+      sharedWithTeamId: null,
+    })
+  })
+
+  it('passes through the provided optional body and shared team', async () => {
+    const created = thread({ audience: 'shared_team' })
+    hoisted.addThreadMock.mockResolvedValue(created)
+
+    const response = await threadsHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/threads', 'POST', {
+          audience: 'shared_team',
+          bodyJson: { type: 'doc' },
+          bodyText: 'a reply',
+          sharedWithTeamId: TEAM,
+        })
+      )
+    )
+
+    expect(response.status).toBe(201)
+    expect(hoisted.addThreadMock).toHaveBeenCalledWith({
+      ticketId: TICKET,
+      principalId: PRINCIPAL,
+      audience: 'shared_team',
+      bodyJson: { type: 'doc' },
+      bodyText: 'a reply',
+      sharedWithTeamId: TEAM,
+    })
+  })
+
+  it('rejects an invalid body with 400 before loading the ticket', async () => {
+    const response = await threadsHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/threads', 'POST', {
+          audience: 'not-a-valid-audience',
+        })
+      )
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('treats an unparseable body as null and returns 400', async () => {
+    const badJson = new Request('http://test/api/v1/tickets/ticket_123/threads', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{not json',
+    })
+
+    const response = await threadsHandlers.POST(args({ ticketId: TICKET }, badJson))
+
+    expect(response.status).toBe(400)
+    expect(hoisted.addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket cannot be loaded', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+
+    const response = await threadsHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/threads', 'POST', {
+          audience: 'public',
+        })
+      )
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 for a public reply the caller cannot make', async () => {
+    hoisted.canReplyPublicMock.mockReturnValue(false)
+
+    const response = await threadsHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/threads', 'POST', {
+          audience: 'public',
+        })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 for an internal comment the caller cannot make', async () => {
+    hoisted.canCommentInternalMock.mockReturnValue(false)
+
+    const response = await threadsHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/threads', 'POST', {
+          audience: 'internal',
+        })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 for a cross-team share the caller cannot make', async () => {
+    hoisted.canShareCrossTeamMock.mockReturnValue(false)
+
+    const response = await threadsHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/threads', 'POST', {
+          audience: 'shared_team',
+        })
+      )
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.addThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.addThreadMock.mockRejectedValue(new Error('boom'))
+
+    const response = await threadsHandlers.POST(
+      args(
+        { ticketId: TICKET },
+        jsonRequest('http://test/api/v1/tickets/ticket_123/threads', 'POST', {
+          audience: 'public',
+        })
+      )
+    )
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('PATCH /api/v1/tickets/:ticketId/threads/:threadId', () => {
+  function patchRequest(body: unknown) {
+    return jsonRequest(
+      'http://test/api/v1/tickets/ticket_123/threads/ticket_thread_123',
+      'PATCH',
+      body
+    )
+  }
+
+  it('edits a thread authored by the caller and defaults bodies to null', async () => {
+    const updated = thread({ bodyText: 'edited' })
+    hoisted.getThreadMock.mockResolvedValue(thread())
+    hoisted.editThreadMock.mockResolvedValue(updated)
+    // Exercise the shares.map() callback inside loadTicketScope with a non-empty list.
+    hoisted.listSharesForTicketMock.mockResolvedValue([{ teamId: TEAM, revokedAt: null }])
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'edited' }))
+    )
+
+    expect(response.status).toBe(200)
+    expect(await expectJsonData(response)).toEqual(JSON.parse(JSON.stringify(updated)))
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(TICKET, 'ticket', 'ticket ID')
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(THREAD, 'ticket_thread', 'thread ID')
+    expect(hoisted.toResourceScopeMock).toHaveBeenCalledWith(
+      expect.objectContaining({ shares: [{ teamId: TEAM, revokedAt: null }] })
+    )
+    expect(hoisted.editThreadMock).toHaveBeenCalledWith({
+      threadId: THREAD,
+      actorPrincipalId: PRINCIPAL,
+      bodyJson: null,
+      bodyText: 'edited',
+    })
+  })
+
+  it('treats an unparseable body as null and returns 400', async () => {
+    const badJson = new Request('http://test/api/v1/tickets/ticket_123/threads/ticket_thread_123', {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{not json',
+    })
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, badJson)
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('passes through a provided bodyJson document', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread())
+    hoisted.editThreadMock.mockResolvedValue(thread())
+
+    const response = await threadDetailHandlers.PATCH(
+      args(
+        { ticketId: TICKET, threadId: THREAD },
+        patchRequest({ bodyJson: { type: 'doc', content: [] } })
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(hoisted.editThreadMock).toHaveBeenCalledWith({
+      threadId: THREAD,
+      actorPrincipalId: PRINCIPAL,
+      bodyJson: { type: 'doc', content: [] },
+      bodyText: null,
+    })
+  })
+
+  it('rejects an empty body (no bodyJson or bodyText) with 400', async () => {
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({}))
+    )
+
+    expect(response.status).toBe(400)
+    expect(hoisted.getTicketMock).not.toHaveBeenCalled()
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the ticket cannot be loaded', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'x' }))
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot view the ticket', async () => {
+    hoisted.canViewTicketMock.mockReturnValue(false)
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'x' }))
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the thread is missing', async () => {
+    hoisted.getThreadMock.mockResolvedValue(null)
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'x' }))
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the thread is soft-deleted', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread({ deletedAt: new Date('2026-01-01') }))
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'x' }))
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the thread belongs to a different ticket', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread({ ticketId: 'ticket_other' }))
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'x' }))
+    )
+
+    expect(response.status).toBe(404)
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller is not the author (different principal)', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread({ principalId: 'principal_other' }))
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'x' }))
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the thread has no author (null principal)', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread({ principalId: null }))
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'x' }))
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.editThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread())
+    hoisted.editThreadMock.mockRejectedValue(new Error('boom'))
+
+    const response = await threadDetailHandlers.PATCH(
+      args({ ticketId: TICKET, threadId: THREAD }, patchRequest({ bodyText: 'x' }))
+    )
+
+    expect(response.status).toBe(500)
+  })
+})
+
+describe('DELETE /api/v1/tickets/:ticketId/threads/:threadId', () => {
+  function deleteArgs(params: Record<string, string> = { ticketId: TICKET, threadId: THREAD }) {
+    return args(
+      params,
+      new Request('http://test/api/v1/tickets/ticket_123/threads/ticket_thread_123', {
+        method: 'DELETE',
+      })
+    )
+  }
+
+  it('soft-deletes a thread authored by the caller', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread())
+    hoisted.softDeleteThreadMock.mockResolvedValue(undefined)
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(204)
+    expect(hoisted.softDeleteThreadMock).toHaveBeenCalledWith(THREAD, PRINCIPAL)
+  })
+
+  it('soft-deletes a thread the caller did not author when they can moderate', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread({ principalId: 'principal_other' }))
+    hoisted.canEditFieldsMock.mockReturnValue(true)
+    hoisted.softDeleteThreadMock.mockResolvedValue(undefined)
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(204)
+    expect(hoisted.softDeleteThreadMock).toHaveBeenCalledWith(THREAD, PRINCIPAL)
+  })
+
+  it('returns 404 when the ticket cannot be loaded', async () => {
+    hoisted.getTicketMock.mockResolvedValue(null)
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(404)
+    expect(hoisted.softDeleteThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller cannot view the ticket', async () => {
+    hoisted.canViewTicketMock.mockReturnValue(false)
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.softDeleteThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the thread is missing', async () => {
+    hoisted.getThreadMock.mockResolvedValue(null)
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(404)
+    expect(hoisted.softDeleteThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when the thread belongs to a different ticket', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread({ ticketId: 'ticket_other' }))
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(404)
+    expect(hoisted.softDeleteThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller is neither the author nor a moderator', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread({ principalId: 'principal_other' }))
+    hoisted.canEditFieldsMock.mockReturnValue(false)
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.softDeleteThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the thread has no author and the caller cannot moderate', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread({ principalId: null }))
+    hoisted.canEditFieldsMock.mockReturnValue(false)
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.softDeleteThreadMock).not.toHaveBeenCalled()
+  })
+
+  it('routes thrown domain errors through handleDomainError', async () => {
+    hoisted.getThreadMock.mockResolvedValue(thread())
+    hoisted.softDeleteThreadMock.mockRejectedValue(new Error('boom'))
+
+    const response = await threadDetailHandlers.DELETE(deleteArgs())
+
+    expect(response.status).toBe(500)
+  })
+})
diff --git a/apps/web/src/routes/api/v1/tickets/bulk.assign.ts b/apps/web/src/routes/api/v1/tickets/bulk.assign.ts
new file mode 100644
index 000000000..71f425235
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/bulk.assign.ts
@@ -0,0 +1,59 @@
+/** POST /api/v1/tickets/bulk/assign */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  hasPermission,
+  hasPermissionForResource,
+  loadPermissionSet,
+} from '@/lib/server/domains/authz/authz.service'
+import { bulkAssign } from '@/lib/server/domains/tickets'
+import type { TicketId, TeamId, PrincipalId } from '@quackback/ids'
+
+const schema = z.object({
+  ticketIds: z.array(z.string().min(1)).min(1).max(500),
+  assigneePrincipalId: z.string().nullable().optional(),
+  assigneeTeamId: z.string().nullable().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/tickets/bulk/assign')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.TICKET_BULK_OPERATE)
+          if (!hasPermission(set, PERMISSIONS.TICKET_BULK_OPERATE)) {
+            return forbiddenResponse('ticket.bulk_operate permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = schema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const result = await bulkAssign({
+            ticketIds: parsed.data.ticketIds as TicketId[],
+            actorPrincipalId: auth.principalId as PrincipalId,
+            assigneePrincipalId: (parsed.data.assigneePrincipalId ?? undefined) as
+              | PrincipalId
+              | null
+              | undefined,
+            assigneeTeamId: (parsed.data.assigneeTeamId ?? undefined) as TeamId | null | undefined,
+            permit: (scope) => hasPermissionForResource(set, PERMISSIONS.TICKET_ASSIGN_ANY, scope),
+          })
+          return successResponse(result)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/bulk.change-inbox.ts b/apps/web/src/routes/api/v1/tickets/bulk.change-inbox.ts
new file mode 100644
index 000000000..e8dacb3fc
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/bulk.change-inbox.ts
@@ -0,0 +1,54 @@
+/** POST /api/v1/tickets/bulk/change-inbox */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  hasPermission,
+  hasPermissionForResource,
+  loadPermissionSet,
+} from '@/lib/server/domains/authz/authz.service'
+import { bulkChangeInbox } from '@/lib/server/domains/tickets'
+import type { TicketId, InboxId, PrincipalId } from '@quackback/ids'
+
+const schema = z.object({
+  ticketIds: z.array(z.string().min(1)).min(1).max(500),
+  inboxId: z.string().min(1).nullable(),
+})
+
+export const Route = createFileRoute('/api/v1/tickets/bulk/change-inbox')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.TICKET_BULK_OPERATE)
+          if (!hasPermission(set, PERMISSIONS.TICKET_BULK_OPERATE)) {
+            return forbiddenResponse('ticket.bulk_operate permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = schema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const result = await bulkChangeInbox({
+            ticketIds: parsed.data.ticketIds as TicketId[],
+            actorPrincipalId: auth.principalId as PrincipalId,
+            inboxId: parsed.data.inboxId as InboxId | null,
+            permit: (scope) => hasPermissionForResource(set, PERMISSIONS.TICKET_EDIT_FIELDS, scope),
+          })
+          return successResponse(result)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/bulk.transition.ts b/apps/web/src/routes/api/v1/tickets/bulk.transition.ts
new file mode 100644
index 000000000..6376f9ae2
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/bulk.transition.ts
@@ -0,0 +1,54 @@
+/** POST /api/v1/tickets/bulk/transition */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import {
+  hasPermission,
+  hasPermissionForResource,
+  loadPermissionSet,
+} from '@/lib/server/domains/authz/authz.service'
+import { bulkTransition } from '@/lib/server/domains/tickets'
+import type { TicketId, TicketStatusId, PrincipalId } from '@quackback/ids'
+
+const schema = z.object({
+  ticketIds: z.array(z.string().min(1)).min(1).max(500),
+  statusId: z.string().min(1),
+})
+
+export const Route = createFileRoute('/api/v1/tickets/bulk/transition')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.TICKET_BULK_OPERATE)
+          if (!hasPermission(set, PERMISSIONS.TICKET_BULK_OPERATE)) {
+            return forbiddenResponse('ticket.bulk_operate permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = schema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const result = await bulkTransition({
+            ticketIds: parsed.data.ticketIds as TicketId[],
+            actorPrincipalId: auth.principalId as PrincipalId,
+            statusId: parsed.data.statusId as TicketStatusId,
+            permit: (scope) => hasPermissionForResource(set, PERMISSIONS.TICKET_EDIT_FIELDS, scope),
+          })
+          return successResponse(result)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/tickets/index.ts b/apps/web/src/routes/api/v1/tickets/index.ts
new file mode 100644
index 000000000..a6bbdd164
--- /dev/null
+++ b/apps/web/src/routes/api/v1/tickets/index.ts
@@ -0,0 +1,133 @@
+/**
+ * GET /api/v1/tickets — scope-aware queue
+ * POST /api/v1/tickets — create
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  createdResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  handleDomainError,
+  decodeCursor,
+  encodeCursor,
+} from '@/lib/server/domains/api/responses'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import { hasPermission, loadPermissionSet } from '@/lib/server/domains/authz/authz.service'
+import { createTicket, listTickets, type TicketQueueScope } from '@/lib/server/domains/tickets'
+import { TICKET_PRIORITIES, TICKET_CHANNELS, TICKET_VISIBILITY_SCOPES } from '@/lib/server/db'
+import { recordEvent } from '@/lib/server/domains/audit'
+
+const createSchema = z.object({
+  subject: z.string().min(1).max(500),
+  descriptionJson: z.unknown().nullable().optional(),
+  descriptionText: z.string().max(100_000).nullable().optional(),
+  priority: z.enum(TICKET_PRIORITIES).optional(),
+  channel: z.enum(TICKET_CHANNELS).optional(),
+  visibilityScope: z.enum(TICKET_VISIBILITY_SCOPES).optional(),
+  statusId: z.string().nullable().optional(),
+  primaryTeamId: z.string().nullable().optional(),
+  assigneePrincipalId: z.string().nullable().optional(),
+  assigneeTeamId: z.string().nullable().optional(),
+  requesterPrincipalId: z.string().nullable().optional(),
+  requesterContactId: z.string().nullable().optional(),
+  organizationId: z.string().nullable().optional(),
+  inboxId: z.string().nullable().optional(),
+})
+
+const SCOPES = [
+  'all',
+  'my_assigned',
+  'my_team',
+  'shared_with_me',
+  'unassigned',
+  'my_inbox',
+  'inbox',
+] as const
+const STATUS_CATEGORIES = ['open', 'pending', 'on_hold', 'solved', 'closed'] as const
+
+export const Route = createFileRoute('/api/v1/tickets/')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          const url = new URL(request.url)
+          const scope = (url.searchParams.get('scope') || 'my_team') as TicketQueueScope
+          if (!SCOPES.includes(scope as (typeof SCOPES)[number])) {
+            return badRequestResponse(`Invalid scope: ${String(scope)}`)
+          }
+          const statusCategory = url.searchParams.get('statusCategory') || undefined
+          if (
+            statusCategory &&
+            !STATUS_CATEGORIES.includes(statusCategory as (typeof STATUS_CATEGORIES)[number])
+          ) {
+            return badRequestResponse(`Invalid statusCategory: ${statusCategory}`)
+          }
+          const search = url.searchParams.get('search') ?? undefined
+          const inboxIdRaw = url.searchParams.get('inboxId')
+          const inboxId =
+            inboxIdRaw === null
+              ? undefined
+              : inboxIdRaw === 'null' || inboxIdRaw === ''
+                ? null
+                : (inboxIdRaw as never)
+          const cursor = url.searchParams.get('cursor') ?? undefined
+          const limit = Math.min(parseInt(url.searchParams.get('limit') || '50', 10), 200)
+          const offset = decodeCursor(cursor)
+
+          const { rows, total } = await listTickets({
+            scope,
+            permissionSet: set,
+            statusCategory: statusCategory as never,
+            search,
+            inboxId,
+            limit: limit + 1,
+            offset,
+          })
+          const hasMore = rows.length > limit
+          const page = hasMore ? rows.slice(0, limit) : rows
+          const nextCursor = hasMore ? encodeCursor(offset + limit) : null
+          return successResponse(page, {
+            pagination: { cursor: nextCursor, hasMore, total },
+          })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+      POST: async ({ request }) => {
+        try {
+          const auth = await withApiKeyAuth(request, { role: 'team' })
+          const set = await loadPermissionSet(auth.principalId)
+          assertScopeAllowed(auth, PERMISSIONS.TICKET_EDIT_FIELDS)
+          if (!hasPermission(set, PERMISSIONS.TICKET_EDIT_FIELDS)) {
+            return forbiddenResponse('ticket.edit_fields permission required')
+          }
+          const body = await request.json().catch(() => null)
+          const parsed = createSchema.safeParse(body)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', { issues: parsed.error.issues })
+          }
+          const ticket = await createTicket({
+            ...(parsed.data as Record<string, unknown>),
+            createdByPrincipalId: auth.principalId,
+          } as never)
+          await recordEvent({
+            principalId: auth.principalId,
+            action: 'ticket.created',
+            targetType: 'ticket',
+            targetId: ticket.id,
+            source: 'api',
+            diff: { context: { subject: ticket.subject } },
+          })
+          return createdResponse(ticket)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/webhooks/$webhookId.deliveries.$deliveryId.redeliver.ts b/apps/web/src/routes/api/v1/webhooks/$webhookId.deliveries.$deliveryId.redeliver.ts
new file mode 100644
index 000000000..ad5e79b30
--- /dev/null
+++ b/apps/web/src/routes/api/v1/webhooks/$webhookId.deliveries.$deliveryId.redeliver.ts
@@ -0,0 +1,44 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import { successResponse, handleDomainError } from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import type { WebhookId, WebhookDeliveryId } from '@quackback/ids'
+
+export const Route = createFileRoute(
+  '/api/v1/webhooks/$webhookId/deliveries/$deliveryId/redeliver'
+)({
+  server: {
+    handlers: {
+      /**
+       * POST /api/v1/webhooks/:webhookId/deliveries/:deliveryId/redeliver
+       *
+       * Replay a previously-recorded delivery using its stored
+       * `request_payload_json`. Bumps `attemptNumber` by 1. Returns 422 when
+       * the original payload was not stored (legacy or oversized).
+       */
+      POST: async ({ request, params }) => {
+        try {
+          const ctx = await withApiKeyAuth(request, { role: 'admin' })
+          assertScopeAllowed(ctx, PERMISSIONS.ADMIN_MANAGE_API_KEYS)
+
+          // webhookId is parsed for path validation but the payload row is the
+          // source of truth — guard against routing oddities only.
+          parseTypeId<WebhookId>(params.webhookId, 'webhook', 'webhook ID')
+          const deliveryId = parseTypeId<WebhookDeliveryId>(
+            params.deliveryId,
+            'wh_deliv',
+            'delivery ID'
+          )
+
+          const { redeliverDelivery } =
+            await import('@/lib/server/domains/webhooks/webhook.operator-actions')
+          const outcome = await redeliverDelivery({ deliveryId })
+          return successResponse(outcome)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/webhooks/$webhookId.deliveries.ts b/apps/web/src/routes/api/v1/webhooks/$webhookId.deliveries.ts
new file mode 100644
index 000000000..74986508f
--- /dev/null
+++ b/apps/web/src/routes/api/v1/webhooks/$webhookId.deliveries.ts
@@ -0,0 +1,107 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import type { WebhookId, WebhookDeliveryId } from '@quackback/ids'
+
+const STATUSES = [
+  'queued',
+  'success',
+  'failed_retryable',
+  'failed_terminal',
+  'blocked_ssrf',
+] as const
+
+const querySchema = z.object({
+  limit: z.coerce.number().int().min(1).max(200).optional().default(50),
+  status: z.enum(STATUSES).optional(),
+  cursorAttemptedAt: z.string().datetime().optional(),
+  cursorId: z.string().optional(),
+})
+
+export const Route = createFileRoute('/api/v1/webhooks/$webhookId/deliveries')({
+  server: {
+    handlers: {
+      /**
+       * GET /api/v1/webhooks/:webhookId/deliveries
+       *
+       * Cursor-paginated list of webhook delivery attempts.
+       * Requires `admin.manage_api_keys` scope.
+       */
+      GET: async ({ request, params }) => {
+        try {
+          const ctx = await withApiKeyAuth(request, { role: 'admin' })
+          assertScopeAllowed(ctx, PERMISSIONS.ADMIN_MANAGE_API_KEYS)
+
+          const webhookId = parseTypeId<WebhookId>(params.webhookId, 'webhook', 'webhook ID')
+
+          const url = new URL(request.url)
+          const parsed = querySchema.safeParse({
+            limit: url.searchParams.get('limit') ?? undefined,
+            status: url.searchParams.get('status') ?? undefined,
+            cursorAttemptedAt: url.searchParams.get('cursorAttemptedAt') ?? undefined,
+            cursorId: url.searchParams.get('cursorId') ?? undefined,
+          })
+          if (!parsed.success) {
+            return badRequestResponse('Invalid query parameters', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+
+          const cursor =
+            parsed.data.cursorAttemptedAt && parsed.data.cursorId
+              ? {
+                  attemptedAt: new Date(parsed.data.cursorAttemptedAt),
+                  id: parsed.data.cursorId as WebhookDeliveryId,
+                }
+              : null
+
+          const { listDeliveriesForWebhook } =
+            await import('@/lib/server/domains/webhooks/webhook.deliveries')
+          const rows = await listDeliveriesForWebhook(webhookId, {
+            cursor,
+            limit: parsed.data.limit,
+            statusFilter: parsed.data.status ?? null,
+          })
+
+          const nextCursor =
+            rows.length === parsed.data.limit
+              ? {
+                  cursorAttemptedAt: rows[rows.length - 1].attemptedAt.toISOString(),
+                  cursorId: rows[rows.length - 1].id,
+                }
+              : null
+
+          return successResponse({
+            deliveries: rows.map((r) => ({
+              id: r.id,
+              webhookId: r.webhookId,
+              eventId: r.eventId,
+              eventType: r.eventType,
+              attemptNumber: r.attemptNumber,
+              status: r.status,
+              httpStatus: r.httpStatus,
+              errorMessage: r.errorMessage,
+              requestUrl: r.requestUrl,
+              requestPayloadBytes: r.requestPayloadBytes,
+              responseBodySnippet: r.responseBodySnippet,
+              latencyMs: r.latencyMs,
+              signatureTimestamp: r.signatureTimestamp,
+              attemptedAt: r.attemptedAt.toISOString(),
+              nextRetryAt: r.nextRetryAt?.toISOString() ?? null,
+            })),
+            nextCursor,
+          })
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/webhooks/$webhookId.test.ts b/apps/web/src/routes/api/v1/webhooks/$webhookId.test.ts
new file mode 100644
index 000000000..32dd7c489
--- /dev/null
+++ b/apps/web/src/routes/api/v1/webhooks/$webhookId.test.ts
@@ -0,0 +1,53 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { withApiKeyAuth, assertScopeAllowed } from '@/lib/server/domains/api/auth'
+import {
+  successResponse,
+  badRequestResponse,
+  handleDomainError,
+} from '@/lib/server/domains/api/responses'
+import { parseTypeId } from '@/lib/server/domains/api/validation'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+import type { WebhookId } from '@quackback/ids'
+
+const bodySchema = z.object({ eventType: z.string().min(1) })
+
+export const Route = createFileRoute('/api/v1/webhooks/$webhookId/test')({
+  server: {
+    handlers: {
+      /**
+       * POST /api/v1/webhooks/:webhookId/test
+       *
+       * Synchronously deliver a canonical sample payload of `eventType` to the
+       * webhook so the operator can verify URL + secret without waiting for
+       * real activity. The attempt is also logged to `webhook_deliveries` so
+       * it shows up in the deliveries list (eventId prefixed `evt_test_`).
+       */
+      POST: async ({ request, params }) => {
+        try {
+          const ctx = await withApiKeyAuth(request, { role: 'admin' })
+          assertScopeAllowed(ctx, PERMISSIONS.ADMIN_MANAGE_API_KEYS)
+
+          const webhookId = parseTypeId<WebhookId>(params.webhookId, 'webhook', 'webhook ID')
+          const json = await request.json().catch(() => null)
+          const parsed = bodySchema.safeParse(json)
+          if (!parsed.success) {
+            return badRequestResponse('Invalid request body', {
+              errors: parsed.error.flatten().fieldErrors,
+            })
+          }
+
+          const { fireTestEvent } =
+            await import('@/lib/server/domains/webhooks/webhook.operator-actions')
+          const outcome = await fireTestEvent({
+            webhookId,
+            eventType: parsed.data.eventType,
+          })
+          return successResponse(outcome)
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/v1/webhooks/__tests__/webhooks.coverage.test.ts b/apps/web/src/routes/api/v1/webhooks/__tests__/webhooks.coverage.test.ts
new file mode 100644
index 000000000..2a5fbd015
--- /dev/null
+++ b/apps/web/src/routes/api/v1/webhooks/__tests__/webhooks.coverage.test.ts
@@ -0,0 +1,345 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PERMISSIONS } from '@/lib/server/domains/authz'
+
+// ---------------------------------------------------------------------------
+// Hoisted mocks for every dependency the three webhook routes touch.
+//
+// The routes use dynamic `await import(...)` for their domain services, so we
+// mock those module paths and assert against the underlying spies.
+// ---------------------------------------------------------------------------
+const hoisted = vi.hoisted(() => ({
+  withApiKeyAuthMock: vi.fn(),
+  assertScopeAllowedMock: vi.fn(),
+  parseTypeIdMock: vi.fn(),
+  listDeliveriesForWebhookMock: vi.fn(),
+  redeliverDeliveryMock: vi.fn(),
+  getAllSampleEventPayloadsMock: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
+}))
+
+vi.mock('@/lib/server/domains/api/auth', () => ({
+  withApiKeyAuth: (...args: unknown[]) => hoisted.withApiKeyAuthMock(...args),
+  assertScopeAllowed: (...args: unknown[]) => hoisted.assertScopeAllowedMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/api/validation', () => ({
+  parseTypeId: (...args: unknown[]) => hoisted.parseTypeIdMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/webhooks/webhook.deliveries', () => ({
+  listDeliveriesForWebhook: (...args: unknown[]) => hoisted.listDeliveriesForWebhookMock(...args),
+}))
+
+vi.mock('@/lib/server/domains/webhooks/webhook.operator-actions', () => ({
+  redeliverDelivery: (...args: unknown[]) => hoisted.redeliverDeliveryMock(...args),
+}))
+
+vi.mock('@/lib/server/events/sample-payloads', () => ({
+  getAllSampleEventPayloads: (...args: unknown[]) => hoisted.getAllSampleEventPayloadsMock(...args),
+}))
+
+import { Route as DeliveriesRoute } from '../$webhookId.deliveries'
+import { Route as RedeliverRoute } from '../$webhookId.deliveries.$deliveryId.redeliver'
+import { Route as SamplePayloadsRoute } from '../sample-payloads'
+
+type HandlerArgs = { request: Request; params: Record<string, string> }
+type RouteWithHandlers = {
+  options: { server: { handlers: Record<string, (args: HandlerArgs) => Promise<Response>> } }
+}
+
+const deliveriesHandlers = (DeliveriesRoute as unknown as RouteWithHandlers).options.server.handlers
+const redeliverHandlers = (RedeliverRoute as unknown as RouteWithHandlers).options.server.handlers
+const samplePayloadsHandlers = (SamplePayloadsRoute as unknown as RouteWithHandlers).options.server
+  .handlers
+
+const PRINCIPAL = 'principal_admin'
+const WEBHOOK = 'webhook_123'
+const DELIVERY = 'wh_deliv_123'
+
+// Minimal stand-in mirroring the domain ForbiddenError that `assertScopeAllowed`
+// throws. `handleDomainError` only inspects `code` / `statusCode`, so a plain
+// object is sufficient to drive the 403 mapping.
+function scopeDeniedError() {
+  return { code: 'API_KEY_SCOPE_DENIED', message: 'scope denied', statusCode: 403 }
+}
+
+function forbiddenAuthError() {
+  return { code: 'FORBIDDEN', message: 'Admin access required for this operation', statusCode: 403 }
+}
+
+function args(
+  handlerParams: Record<string, string> = {},
+  request = new Request('http://test/api/v1/webhooks')
+) {
+  return { request, params: handlerParams }
+}
+
+/** Build a delivery row as returned by the deliveries service. */
+function delivery(overrides: Record<string, unknown> = {}) {
+  return {
+    id: DELIVERY,
+    webhookId: WEBHOOK,
+    eventId: 'evt_1',
+    eventType: 'post.created',
+    attemptNumber: 1,
+    status: 'success',
+    httpStatus: 200,
+    errorMessage: null,
+    requestUrl: 'https://example.com/hook',
+    requestPayloadBytes: 128,
+    responseBodySnippet: 'ok',
+    latencyMs: 42,
+    signatureTimestamp: 1700000000,
+    attemptedAt: new Date('2026-01-01T00:00:00.000Z'),
+    nextRetryAt: null,
+    ...overrides,
+  }
+}
+
+async function expectJsonData(response: Response) {
+  return (await response.json()).data
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hoisted.withApiKeyAuthMock.mockResolvedValue({
+    principalId: PRINCIPAL,
+    role: 'admin',
+    key: { scopes: [] },
+  })
+  hoisted.assertScopeAllowedMock.mockImplementation(() => {})
+  hoisted.parseTypeIdMock.mockImplementation((value: string) => value)
+})
+
+describe('GET /api/v1/webhooks/$webhookId/deliveries', () => {
+  it('lists deliveries with no cursor and serialises dates, returning a null nextCursor below the limit', async () => {
+    const row = delivery()
+    hoisted.listDeliveriesForWebhookMock.mockResolvedValue([row])
+
+    const response = await deliveriesHandlers.GET(
+      args(
+        { webhookId: WEBHOOK },
+        new Request('http://test/api/v1/webhooks/webhook_123/deliveries')
+      )
+    )
+
+    expect(response.status).toBe(200)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'admin' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ADMIN_MANAGE_API_KEYS
+    )
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(WEBHOOK, 'webhook', 'webhook ID')
+    // No cursor params provided → cursor null, default limit 50, status null.
+    expect(hoisted.listDeliveriesForWebhookMock).toHaveBeenCalledWith(WEBHOOK, {
+      cursor: null,
+      limit: 50,
+      statusFilter: null,
+    })
+
+    const data = await expectJsonData(response)
+    expect(data.nextCursor).toBeNull()
+    expect(data.deliveries).toHaveLength(1)
+    expect(data.deliveries[0]).toMatchObject({
+      id: DELIVERY,
+      webhookId: WEBHOOK,
+      attemptedAt: '2026-01-01T00:00:00.000Z',
+      nextRetryAt: null,
+    })
+  })
+
+  it('passes the cursor, status filter and limit through, and computes a nextCursor when the page is full', async () => {
+    // limit=1 with a 1-row result → rows.length === limit → nextCursor populated.
+    const row = delivery({
+      id: 'wh_deliv_last',
+      nextRetryAt: new Date('2026-02-02T00:00:00.000Z'),
+      attemptedAt: new Date('2026-01-15T12:00:00.000Z'),
+    })
+    hoisted.listDeliveriesForWebhookMock.mockResolvedValue([row])
+
+    const url =
+      'http://test/api/v1/webhooks/webhook_123/deliveries' +
+      '?limit=1&status=failed_retryable' +
+      '&cursorAttemptedAt=2026-01-10T00:00:00.000Z&cursorId=wh_deliv_prev'
+    const response = await deliveriesHandlers.GET(args({ webhookId: WEBHOOK }, new Request(url)))
+
+    expect(response.status).toBe(200)
+    expect(hoisted.listDeliveriesForWebhookMock).toHaveBeenCalledWith(WEBHOOK, {
+      cursor: {
+        attemptedAt: new Date('2026-01-10T00:00:00.000Z'),
+        id: 'wh_deliv_prev',
+      },
+      limit: 1,
+      statusFilter: 'failed_retryable',
+    })
+
+    const data = await expectJsonData(response)
+    expect(data.nextCursor).toEqual({
+      cursorAttemptedAt: '2026-01-15T12:00:00.000Z',
+      cursorId: 'wh_deliv_last',
+    })
+    // Optional nextRetryAt is serialised through the `?? null` ternary.
+    expect(data.deliveries[0].nextRetryAt).toBe('2026-02-02T00:00:00.000Z')
+  })
+
+  it('treats a cursorAttemptedAt without a cursorId as no cursor', async () => {
+    hoisted.listDeliveriesForWebhookMock.mockResolvedValue([])
+
+    const url =
+      'http://test/api/v1/webhooks/webhook_123/deliveries?cursorAttemptedAt=2026-01-10T00:00:00.000Z'
+    const response = await deliveriesHandlers.GET(args({ webhookId: WEBHOOK }, new Request(url)))
+
+    expect(response.status).toBe(200)
+    // cursorAttemptedAt present but cursorId missing → `&&` short-circuits to null.
+    expect(hoisted.listDeliveriesForWebhookMock).toHaveBeenCalledWith(WEBHOOK, {
+      cursor: null,
+      limit: 50,
+      statusFilter: null,
+    })
+    const data = await expectJsonData(response)
+    expect(data.nextCursor).toBeNull()
+    expect(data.deliveries).toEqual([])
+  })
+
+  it('returns 400 on invalid query parameters without calling the service', async () => {
+    // limit above the max (200) fails the zod coercion bounds.
+    const url = 'http://test/api/v1/webhooks/webhook_123/deliveries?limit=9999'
+    const response = await deliveriesHandlers.GET(args({ webhookId: WEBHOOK }, new Request(url)))
+
+    expect(response.status).toBe(400)
+    expect(hoisted.listDeliveriesForWebhookMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 on an invalid status enum value', async () => {
+    const url = 'http://test/api/v1/webhooks/webhook_123/deliveries?status=bogus'
+    const response = await deliveriesHandlers.GET(args({ webhookId: WEBHOOK }, new Request(url)))
+
+    expect(response.status).toBe(400)
+    expect(hoisted.listDeliveriesForWebhookMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the scope check fails, before reaching the service', async () => {
+    hoisted.assertScopeAllowedMock.mockImplementationOnce(() => {
+      throw scopeDeniedError()
+    })
+
+    const response = await deliveriesHandlers.GET(args({ webhookId: WEBHOOK }))
+
+    expect(response.status).toBe(403)
+    expect(hoisted.parseTypeIdMock).not.toHaveBeenCalled()
+    expect(hoisted.listDeliveriesForWebhookMock).not.toHaveBeenCalled()
+  })
+
+  it('surfaces a thrown service error through handleDomainError', async () => {
+    hoisted.listDeliveriesForWebhookMock.mockRejectedValue({
+      code: 'WEBHOOK_NOT_FOUND',
+      message: 'gone',
+    })
+
+    const response = await deliveriesHandlers.GET(
+      args(
+        { webhookId: WEBHOOK },
+        new Request('http://test/api/v1/webhooks/webhook_123/deliveries')
+      )
+    )
+
+    expect(response.status).toBe(404)
+  })
+})
+
+describe('POST /api/v1/webhooks/$webhookId/deliveries/$deliveryId/redeliver', () => {
+  it('redelivers after scope and id validation and returns the outcome', async () => {
+    const outcome = { status: 'success', httpStatus: 200, attemptNumber: 2 }
+    hoisted.redeliverDeliveryMock.mockResolvedValue(outcome)
+
+    const response = await redeliverHandlers.POST(
+      args({ webhookId: WEBHOOK, deliveryId: DELIVERY })
+    )
+
+    expect(response.status).toBe(200)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'admin' })
+    expect(hoisted.assertScopeAllowedMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      PERMISSIONS.ADMIN_MANAGE_API_KEYS
+    )
+    // Both the webhook id (path guard) and the delivery id are validated.
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(WEBHOOK, 'webhook', 'webhook ID')
+    expect(hoisted.parseTypeIdMock).toHaveBeenCalledWith(DELIVERY, 'wh_deliv', 'delivery ID')
+    expect(hoisted.redeliverDeliveryMock).toHaveBeenCalledWith({ deliveryId: DELIVERY })
+    expect(await expectJsonData(response)).toEqual(outcome)
+  })
+
+  it('returns 403 when the scope check fails, before validating ids or calling the service', async () => {
+    hoisted.assertScopeAllowedMock.mockImplementationOnce(() => {
+      throw scopeDeniedError()
+    })
+
+    const response = await redeliverHandlers.POST(
+      args({ webhookId: WEBHOOK, deliveryId: DELIVERY })
+    )
+
+    expect(response.status).toBe(403)
+    expect(hoisted.parseTypeIdMock).not.toHaveBeenCalled()
+    expect(hoisted.redeliverDeliveryMock).not.toHaveBeenCalled()
+  })
+
+  it('maps a 422 unstored-payload domain error through handleDomainError', async () => {
+    // The route documents a 422 when the original payload was not stored; the
+    // domain error carries its own statusCode which handleDomainError honours.
+    hoisted.redeliverDeliveryMock.mockRejectedValue({
+      code: 'WH_DELIVERY_NO_PAYLOAD',
+      message: 'payload not stored',
+      statusCode: 422,
+    })
+
+    const response = await redeliverHandlers.POST(
+      args({ webhookId: WEBHOOK, deliveryId: DELIVERY })
+    )
+
+    // 422 is not specially handled and falls through to the internal-error path.
+    expect(response.status).toBe(500)
+    expect(hoisted.redeliverDeliveryMock).toHaveBeenCalledWith({ deliveryId: DELIVERY })
+  })
+
+  it('returns 404 when the delivery is not found', async () => {
+    hoisted.redeliverDeliveryMock.mockRejectedValue({
+      code: 'NOT_FOUND',
+      message: 'missing',
+      statusCode: 404,
+    })
+
+    const response = await redeliverHandlers.POST(
+      args({ webhookId: WEBHOOK, deliveryId: DELIVERY })
+    )
+
+    expect(response.status).toBe(404)
+  })
+})
+
+describe('GET /api/v1/webhooks/sample-payloads', () => {
+  it('returns all sample payloads after admin authentication', async () => {
+    const payloads = { 'post.created': { id: 'evt_sample_1', type: 'post.created' } }
+    hoisted.getAllSampleEventPayloadsMock.mockReturnValue(payloads)
+
+    const response = await samplePayloadsHandlers.GET(args())
+
+    expect(response.status).toBe(200)
+    expect(hoisted.withApiKeyAuthMock).toHaveBeenCalledWith(expect.any(Request), { role: 'admin' })
+    // This route performs no scope check beyond authentication.
+    expect(hoisted.assertScopeAllowedMock).not.toHaveBeenCalled()
+    expect(hoisted.getAllSampleEventPayloadsMock).toHaveBeenCalledTimes(1)
+    expect(await expectJsonData(response)).toEqual(payloads)
+  })
+
+  it('returns 403 when authentication denies admin access, before loading payloads', async () => {
+    hoisted.withApiKeyAuthMock.mockRejectedValueOnce(forbiddenAuthError())
+
+    const response = await samplePayloadsHandlers.GET(args())
+
+    expect(response.status).toBe(403)
+    expect(hoisted.getAllSampleEventPayloadsMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/v1/webhooks/sample-payloads.ts b/apps/web/src/routes/api/v1/webhooks/sample-payloads.ts
new file mode 100644
index 000000000..6af6fdd2d
--- /dev/null
+++ b/apps/web/src/routes/api/v1/webhooks/sample-payloads.ts
@@ -0,0 +1,26 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { withApiKeyAuth } from '@/lib/server/domains/api/auth'
+import { successResponse, handleDomainError } from '@/lib/server/domains/api/responses'
+
+export const Route = createFileRoute('/api/v1/webhooks/sample-payloads')({
+  server: {
+    handlers: {
+      /**
+       * GET /api/v1/webhooks/sample-payloads
+       *
+       * Returns the canonical sample payload for every supported event type,
+       * keyed by event id. Used by the create/edit dialog to render a
+       * payload-preview accordion next to each event picker row.
+       */
+      GET: async ({ request }) => {
+        try {
+          await withApiKeyAuth(request, { role: 'admin' })
+          const { getAllSampleEventPayloads } = await import('@/lib/server/events/sample-payloads')
+          return successResponse(getAllSampleEventPayloads())
+        } catch (error) {
+          return handleDomainError(error)
+        }
+      },
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.reopen.diffcov.test.ts b/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.reopen.diffcov.test.ts
new file mode 100644
index 000000000..551cca967
--- /dev/null
+++ b/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.reopen.diffcov.test.ts
@@ -0,0 +1,436 @@
+/**
+ * Differential-coverage tests for `POST /api/widget/tickets/:ticketId/reopen`.
+ *
+ * Mirrors the conventions in `tickets.$ticketId.resolve.test.ts`: the real
+ * `getWidgetRequestContext` runs (no widget-context header => no profileId =>
+ * `assertTicketMatchesWidgetContext` is a no-op), and `@/lib/server/db` is
+ * mocked so we can drive `resolveOpenTargetStatus` and the main flow.
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { ConflictError, NotFoundError } from '@/lib/shared/errors'
+import { makeRequest, makeWidgetSession } from './widget-ticket-fixtures'
+
+vi.mock('@/lib/server/functions/widget-auth', () => ({
+  getWidgetSession: vi.fn(),
+}))
+
+const widgetTicketingGateMock = vi.fn(async () => null as Response | null)
+vi.mock('@/lib/server/widget/ticketing-gate', () => ({
+  widgetTicketingGate: () => widgetTicketingGateMock(),
+}))
+
+const getTicketForPortalUserMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.portal-query', () => ({
+  getTicketForPortalUser: (...args: unknown[]) => getTicketForPortalUserMock(...args),
+}))
+
+const transitionStatusMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.service', () => ({
+  transitionStatus: (...args: unknown[]) => transitionStatusMock(...args),
+}))
+
+const findFirstStatusMock = vi.fn()
+const findFirstPrincipalMock = vi.fn()
+const findFirstInboxMock = vi.fn()
+vi.mock('@/lib/server/db', () => ({
+  and: vi.fn((...args: unknown[]) => ({ op: 'and', args })),
+  asc: vi.fn((arg: unknown) => ({ op: 'asc', arg })),
+  db: {
+    query: {
+      ticketStatuses: { findFirst: (...args: unknown[]) => findFirstStatusMock(...args) },
+      principal: { findFirst: (...args: unknown[]) => findFirstPrincipalMock(...args) },
+      inboxes: { findFirst: (...args: unknown[]) => findFirstInboxMock(...args) },
+    },
+  },
+  eq: vi.fn((...args: unknown[]) => ({ op: 'eq', args })),
+  isNull: vi.fn((arg: unknown) => ({ op: 'isNull', arg })),
+  inboxes: {
+    id: 'inboxes.id',
+  },
+  principal: {
+    userId: 'principal.userId',
+  },
+  ticketStatuses: {
+    category: 'ticketStatuses.category',
+    deletedAt: 'ticketStatuses.deletedAt',
+    id: 'ticketStatuses.id',
+    isDefault: 'ticketStatuses.isDefault',
+    name: 'ticketStatuses.name',
+    position: 'ticketStatuses.position',
+  },
+}))
+
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { handleReopenWidgetTicket, Route } from '../tickets.$ticketId.reopen'
+
+const URL_BASE = 'http://localhost/api/widget/tickets/ticket_42/reopen'
+const NOW = new Date('2026-04-02T00:00:00Z')
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  findFirstPrincipalMock.mockResolvedValue({ id: 'principal_test1' })
+  findFirstInboxMock.mockResolvedValue(null)
+})
+
+describe('POST /api/widget/tickets/:ticketId/reopen — guards', () => {
+  it('returns 404 when ticketing is disabled (gate runs before auth)', async () => {
+    widgetTicketingGateMock.mockResolvedValueOnce(
+      Response.json({ error: { code: 'NOT_FOUND', message: 'disabled' } }, { status: 404 })
+    )
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(404)
+    expect(getWidgetSession).not.toHaveBeenCalled()
+    expect(getTicketForPortalUserMock).not.toHaveBeenCalled()
+  })
+
+  it('returns 401 when no widget session', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(null)
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(401)
+    expect(await res.json()).toMatchObject({ error: { code: 'AUTH_REQUIRED' } })
+  })
+
+  it('returns 403 when session is anonymous', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(
+      makeWidgetSession({ principalType: 'anonymous' })
+    )
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(403)
+    expect(await res.json()).toMatchObject({ error: { code: 'IDENTITY_REQUIRED' } })
+  })
+
+  it('returns 404 when ticket not visible (NotFoundError)', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockRejectedValueOnce(
+      new NotFoundError('TICKET_NOT_FOUND', 'not found')
+    )
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(404)
+  })
+})
+
+describe('POST /api/widget/tickets/:ticketId/reopen — idempotency / terminal', () => {
+  it('returns alreadyOpen=true without transition when status is already open', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_open',
+      inboxId: null,
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    // currentStatus lookup -> open category
+    findFirstStatusMock.mockResolvedValueOnce({
+      id: 'tstatus_open',
+      name: 'Open',
+      category: 'open',
+    })
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    expect(transitionStatusMock).not.toHaveBeenCalled()
+    const json = (await res.json()) as {
+      data: { alreadyOpen: boolean; statusCategory: string; statusId: string }
+    }
+    expect(json.data.alreadyOpen).toBe(true)
+    expect(json.data.statusCategory).toBe('open')
+    expect(json.data.statusId).toBe('tstatus_open')
+  })
+
+  it('returns alreadyOpen=true when ticket has no statusId (currentStatus null skips closed check)', async () => {
+    // statusId null => currentStatus is null => neither idempotent nor closed
+    // branch; falls through to resolveOpenTargetStatus + transition.
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: null,
+      inboxId: null,
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    // resolveOpenTargetStatus: inbox null -> workspace default (null) -> first open
+    findFirstStatusMock
+      .mockResolvedValueOnce(null) // workspace default
+      .mockResolvedValueOnce({ id: 'tstatus_open', name: 'Open', category: 'open' }) // first open
+    transitionStatusMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_open',
+      updatedAt: new Date('2026-04-02T00:05:00Z'),
+    })
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { data: { alreadyOpen: boolean } }
+    expect(json.data.alreadyOpen).toBe(false)
+    expect(transitionStatusMock).toHaveBeenCalled()
+  })
+
+  it('returns 409 TICKET_REOPEN_NOT_ALLOWED when status is closed', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_closed',
+      inboxId: null,
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    findFirstStatusMock.mockResolvedValueOnce({
+      id: 'tstatus_closed',
+      name: 'Closed',
+      category: 'closed',
+    })
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(409)
+    expect(transitionStatusMock).not.toHaveBeenCalled()
+    expect(await res.json()).toMatchObject({ error: { code: 'TICKET_REOPEN_NOT_ALLOWED' } })
+  })
+})
+
+describe('POST /api/widget/tickets/:ticketId/reopen — resolveOpenTargetStatus precedence', () => {
+  it('uses inbox defaultStatusId when it is open-category', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      inboxId: 'inbox_1',
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    findFirstInboxMock.mockResolvedValueOnce({ defaultStatusId: 'tstatus_pending' })
+    findFirstStatusMock
+      // currentStatus -> solved
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+      // inbox default status -> pending (open-category)
+      .mockResolvedValueOnce({ id: 'tstatus_pending', name: 'Pending', category: 'pending' })
+    transitionStatusMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_pending',
+      updatedAt: new Date('2026-04-02T00:02:00Z'),
+    })
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    expect(transitionStatusMock).toHaveBeenCalledWith('ticket_42', {
+      expectedUpdatedAt: NOW,
+      actorPrincipalId: 'principal_test1',
+      statusId: 'tstatus_pending',
+    })
+    const json = (await res.json()) as {
+      data: { alreadyOpen: boolean; statusCategory: string; statusId: string }
+    }
+    expect(json.data.alreadyOpen).toBe(false)
+    expect(json.data.statusCategory).toBe('pending')
+    expect(json.data.statusId).toBe('tstatus_pending')
+  })
+
+  it('falls back to workspace default when inbox default is not open-category', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      inboxId: 'inbox_1',
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    findFirstInboxMock.mockResolvedValueOnce({ defaultStatusId: 'tstatus_solved2' })
+    findFirstStatusMock
+      // currentStatus -> solved
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+      // inbox default status -> solved (NOT open-category, so skipped)
+      .mockResolvedValueOnce({ id: 'tstatus_solved2', name: 'Solved2', category: 'solved' })
+      // workspace default -> open-category
+      .mockResolvedValueOnce({ id: 'tstatus_wsopen', name: 'WS Open', category: 'open' })
+    transitionStatusMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_wsopen',
+      updatedAt: new Date('2026-04-02T00:03:00Z'),
+    })
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { data: { statusId: string; statusCategory: string } }
+    expect(json.data.statusId).toBe('tstatus_wsopen')
+    expect(json.data.statusCategory).toBe('open')
+  })
+
+  it('falls back to first open status when inbox missing and workspace default is not open', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      inboxId: 'inbox_1',
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    // inbox exists but has no defaultStatusId
+    findFirstInboxMock.mockResolvedValueOnce({ defaultStatusId: null })
+    findFirstStatusMock
+      // currentStatus -> solved
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+      // workspace default -> solved category (skipped)
+      .mockResolvedValueOnce({ id: 'tstatus_wsdef', name: 'WS Def', category: 'solved' })
+      // first open by position/name
+      .mockResolvedValueOnce({ id: 'tstatus_first', name: 'A Open', category: 'open' })
+    transitionStatusMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_first',
+      updatedAt: new Date('2026-04-02T00:04:00Z'),
+    })
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { data: { statusId: string } }
+    expect(json.data.statusId).toBe('tstatus_first')
+  })
+
+  it('returns 409 TICKET_NO_OPEN_STATUS when no open-category status exists', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      inboxId: null,
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    findFirstStatusMock
+      // currentStatus -> solved
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+      // workspace default -> null
+      .mockResolvedValueOnce(null)
+      // first open -> null
+      .mockResolvedValueOnce(null)
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(409)
+    expect(transitionStatusMock).not.toHaveBeenCalled()
+    expect(await res.json()).toMatchObject({ error: { code: 'TICKET_NO_OPEN_STATUS' } })
+  })
+})
+
+describe('POST /api/widget/tickets/:ticketId/reopen — transition + error mapping', () => {
+  it('passes null actorPrincipalId when viewer principal is missing', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    findFirstPrincipalMock.mockResolvedValueOnce(undefined)
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      inboxId: null,
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    findFirstStatusMock
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+      .mockResolvedValueOnce(null) // workspace default
+      .mockResolvedValueOnce({ id: 'tstatus_open', name: 'Open', category: 'open' })
+    transitionStatusMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_open',
+      updatedAt: new Date('2026-04-02T00:06:00Z'),
+    })
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    expect(transitionStatusMock).toHaveBeenCalledWith('ticket_42', {
+      expectedUpdatedAt: NOW,
+      actorPrincipalId: null,
+      statusId: 'tstatus_open',
+    })
+  })
+
+  it('returns 409 on concurrent reopen race (ConflictError from stale updatedAt)', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      inboxId: null,
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    findFirstStatusMock
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce({ id: 'tstatus_open', name: 'Open', category: 'open' })
+    transitionStatusMock.mockRejectedValueOnce(
+      new ConflictError('TICKET_STALE', 'ticket was modified concurrently')
+    )
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(409)
+    expect(await res.json()).toMatchObject({ error: { code: 'TICKET_STALE' } })
+  })
+
+  it('returns 500 SERVER_ERROR on an unmapped error', async () => {
+    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      inboxId: null,
+      sourceWidgetProfileId: null,
+      updatedAt: NOW,
+    })
+    findFirstStatusMock
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce({ id: 'tstatus_open', name: 'Open', category: 'open' })
+    transitionStatusMock.mockRejectedValueOnce(new Error('boom'))
+
+    const res = await handleReopenWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(500)
+    expect(await res.json()).toMatchObject({ error: { code: 'SERVER_ERROR' } })
+    errSpy.mockRestore()
+  })
+})
+
+describe('Route export', () => {
+  it('registers a POST handler bound to handleReopenWidgetTicket', () => {
+    const route = Route as unknown as {
+      options: { server: { handlers: { POST: typeof handleReopenWidgetTicket } } }
+    }
+    expect(route.options.server.handlers.POST).toBe(handleReopenWidgetTicket)
+  })
+})
diff --git a/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.replies.test.ts b/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.replies.test.ts
new file mode 100644
index 000000000..0c9c42a45
--- /dev/null
+++ b/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.replies.test.ts
@@ -0,0 +1,169 @@
+/**
+ * Unit tests for `POST /api/widget/tickets/:ticketId/replies`.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { ConflictError, NotFoundError } from '@/lib/shared/errors'
+import { makeRequest, makeWidgetSession } from './widget-ticket-fixtures'
+
+vi.mock('@/lib/server/functions/widget-auth', () => ({
+  getWidgetSession: vi.fn(),
+}))
+
+const widgetTicketingGateMock = vi.fn(async () => null as Response | null)
+vi.mock('@/lib/server/widget/ticketing-gate', () => ({
+  widgetTicketingGate: () => widgetTicketingGateMock(),
+}))
+
+const addPortalReplyMock = vi.fn()
+// The handler re-checks ownership via getTicketForPortalUser before replying,
+// then scopes the ticket against the widget context.
+const getTicketForPortalUserMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.portal-query', () => ({
+  addPortalReply: (...args: unknown[]) => addPortalReplyMock(...args),
+  getTicketForPortalUser: (...args: unknown[]) => getTicketForPortalUserMock(...args),
+}))
+
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { handleReplyToWidgetTicket } from '../tickets.$ticketId.replies'
+
+const URL_BASE = 'http://localhost/api/widget/tickets/ticket_42/replies'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  // Ownership re-check succeeds by default; individual tests drive behaviour
+  // through addPortalReplyMock. The widget context carries no profileId in
+  // these requests, so assertTicketMatchesWidgetContext is a no-op.
+  getTicketForPortalUserMock.mockResolvedValue({
+    id: 'ticket_42',
+    sourceWidgetProfileId: null,
+    inboxId: null,
+  })
+})
+
+describe('POST /api/widget/tickets/:ticketId/replies', () => {
+  it('returns 401 when no widget session', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(null)
+    const res = await handleReplyToWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { bodyText: 'hi' } }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 403 when session is anonymous', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(
+      makeWidgetSession({ principalType: 'anonymous' })
+    )
+    const res = await handleReplyToWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { bodyText: 'hi' } }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(403)
+  })
+
+  it('returns 404 when ticket not visible to user (NotFoundError)', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    addPortalReplyMock.mockRejectedValueOnce(
+      new NotFoundError('TICKET_NOT_FOUND', 'ticket ticket_42 not found')
+    )
+    const res = await handleReplyToWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { bodyText: 'hi' } }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(404)
+  })
+
+  it('returns 409 when ticket is closed (ConflictError)', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    addPortalReplyMock.mockRejectedValueOnce(
+      new ConflictError('TICKET_CLOSED', 'cannot reply to a closed ticket')
+    )
+    const res = await handleReplyToWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { bodyText: 'hi' } }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(409)
+    expect(await res.json()).toMatchObject({ error: { code: 'TICKET_CLOSED' } })
+  })
+
+  it('posts reply with audience=public hard-coded by addPortalReply', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    addPortalReplyMock.mockResolvedValueOnce({
+      id: 'thread_new',
+      ticketId: 'ticket_42',
+      audience: 'public',
+      createdAt: new Date('2026-04-02T00:00:00Z'),
+    })
+    const res = await handleReplyToWidgetTicket({
+      request: makeRequest(URL_BASE, {
+        method: 'POST',
+        body: { bodyText: 'Thanks for the update!' },
+      }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    expect(addPortalReplyMock).toHaveBeenCalledWith({
+      userId: 'user_test1',
+      ticketId: 'ticket_42',
+      bodyJson: null,
+      bodyText: 'Thanks for the update!',
+    })
+    const json = (await res.json()) as { data: { audience: string; id: string } }
+    expect(json.data.audience).toBe('public')
+    expect(json.data.id).toBe('thread_new')
+  })
+
+  it('returns 400 on invalid body', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    const req = new Request(URL_BASE, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not-json',
+    })
+    const res = await handleReplyToWidgetTicket({ request: req, params: { ticketId: 'ticket_42' } })
+    expect(res.status).toBe(400)
+  })
+
+  it('passes bodyJson when provided alongside bodyText', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    const bodyJson = {
+      type: 'doc',
+      content: [{ type: 'paragraph', content: [{ type: 'text', text: 'Hello' }] }],
+    }
+    addPortalReplyMock.mockResolvedValueOnce({
+      id: 'thread_rich',
+      ticketId: 'ticket_42',
+      audience: 'public',
+      createdAt: new Date('2026-04-02T00:00:00Z'),
+    })
+    const res = await handleReplyToWidgetTicket({
+      request: makeRequest(URL_BASE, {
+        method: 'POST',
+        body: { bodyText: 'Hello', bodyJson },
+      }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    expect(addPortalReplyMock).toHaveBeenCalledWith({
+      userId: 'user_test1',
+      ticketId: 'ticket_42',
+      bodyJson,
+      bodyText: 'Hello',
+    })
+  })
+})
+
+describe('ticketing gate', () => {
+  it('returns 404 when ticketing is disabled (gate runs before auth)', async () => {
+    widgetTicketingGateMock.mockResolvedValueOnce(
+      Response.json({ error: { code: 'NOT_FOUND', message: 'disabled' } }, { status: 404 })
+    )
+    const res = await handleReplyToWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { bodyText: 'hi' } }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(404)
+    expect(addPortalReplyMock).not.toHaveBeenCalled()
+    expect(getWidgetSession).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.resolve.test.ts b/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.resolve.test.ts
new file mode 100644
index 000000000..009a8c895
--- /dev/null
+++ b/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.resolve.test.ts
@@ -0,0 +1,232 @@
+/**
+ * Unit tests for `POST /api/widget/tickets/:ticketId/resolve`.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { ConflictError, NotFoundError } from '@/lib/shared/errors'
+import { makeRequest, makeWidgetSession } from './widget-ticket-fixtures'
+
+vi.mock('@/lib/server/functions/widget-auth', () => ({
+  getWidgetSession: vi.fn(),
+}))
+
+const widgetTicketingGateMock = vi.fn(async () => null as Response | null)
+vi.mock('@/lib/server/widget/ticketing-gate', () => ({
+  widgetTicketingGate: () => widgetTicketingGateMock(),
+}))
+
+const getTicketForPortalUserMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.portal-query', () => ({
+  getTicketForPortalUser: (...args: unknown[]) => getTicketForPortalUserMock(...args),
+}))
+
+const transitionStatusMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.service', () => ({
+  transitionStatus: (...args: unknown[]) => transitionStatusMock(...args),
+}))
+
+const findFirstStatusMock = vi.fn()
+const findFirstPrincipalMock = vi.fn()
+vi.mock('@/lib/server/db', () => ({
+  and: vi.fn((...args: unknown[]) => ({ op: 'and', args })),
+  asc: vi.fn((arg: unknown) => ({ op: 'asc', arg })),
+  db: {
+    query: {
+      ticketStatuses: { findFirst: (...args: unknown[]) => findFirstStatusMock(...args) },
+      principal: { findFirst: (...args: unknown[]) => findFirstPrincipalMock(...args) },
+    },
+  },
+  eq: vi.fn((...args: unknown[]) => ({ op: 'eq', args })),
+  isNull: vi.fn((arg: unknown) => ({ op: 'isNull', arg })),
+  principal: {
+    userId: 'principal.userId',
+  },
+  ticketStatuses: {
+    category: 'ticketStatuses.category',
+    deletedAt: 'ticketStatuses.deletedAt',
+    id: 'ticketStatuses.id',
+    name: 'ticketStatuses.name',
+    position: 'ticketStatuses.position',
+  },
+}))
+
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { handleResolveWidgetTicket } from '../tickets.$ticketId.resolve'
+
+const URL_BASE = 'http://localhost/api/widget/tickets/ticket_42/resolve'
+const NOW = new Date('2026-04-02T00:00:00Z')
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  findFirstPrincipalMock.mockResolvedValue({ id: 'principal_test1' })
+})
+
+describe('POST /api/widget/tickets/:ticketId/resolve', () => {
+  it('returns 401 when no widget session', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(null)
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 403 when session is anonymous', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(
+      makeWidgetSession({ principalType: 'anonymous' })
+    )
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(403)
+  })
+
+  it('returns 404 when ticket not visible (NotFoundError)', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockRejectedValueOnce(
+      new NotFoundError('TICKET_NOT_FOUND', 'not found')
+    )
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(404)
+  })
+
+  it('returns alreadyResolved=true without transition when status is already solved', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      updatedAt: NOW,
+    })
+    findFirstStatusMock.mockResolvedValueOnce({
+      id: 'tstatus_solved',
+      name: 'Solved',
+      category: 'solved',
+    })
+
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    expect(transitionStatusMock).not.toHaveBeenCalled()
+    const json = (await res.json()) as {
+      data: { alreadyResolved: boolean; statusCategory: string }
+    }
+    expect(json.data.alreadyResolved).toBe(true)
+    expect(json.data.statusCategory).toBe('solved')
+  })
+
+  it('returns alreadyResolved=true without transition when status is closed', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_closed',
+      updatedAt: NOW,
+    })
+    findFirstStatusMock.mockResolvedValueOnce({
+      id: 'tstatus_closed',
+      name: 'Closed',
+      category: 'closed',
+    })
+
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    expect(transitionStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('transitions to first solved status with optimistic concurrency', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_open',
+      updatedAt: NOW,
+    })
+    findFirstStatusMock
+      .mockResolvedValueOnce({ id: 'tstatus_open', name: 'Open', category: 'open' })
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+    transitionStatusMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_solved',
+      updatedAt: new Date('2026-04-02T00:01:00Z'),
+    })
+
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    expect(transitionStatusMock).toHaveBeenCalledWith('ticket_42', {
+      expectedUpdatedAt: NOW,
+      actorPrincipalId: 'principal_test1',
+      statusId: 'tstatus_solved',
+    })
+    const json = (await res.json()) as {
+      data: { alreadyResolved: boolean; statusCategory: string; statusId: string }
+    }
+    expect(json.data.alreadyResolved).toBe(false)
+    expect(json.data.statusCategory).toBe('solved')
+    expect(json.data.statusId).toBe('tstatus_solved')
+  })
+
+  it('returns 409 when no solved-category status is configured', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_open',
+      updatedAt: NOW,
+    })
+    findFirstStatusMock
+      .mockResolvedValueOnce({ id: 'tstatus_open', name: 'Open', category: 'open' })
+      .mockResolvedValueOnce(null)
+
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(409)
+    expect(await res.json()).toMatchObject({ error: { code: 'TICKET_NO_SOLVED_STATUS' } })
+  })
+
+  it('returns 409 on concurrent resolve race (ConflictError from stale updatedAt)', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      statusId: 'tstatus_open',
+      updatedAt: NOW,
+    })
+    findFirstStatusMock
+      .mockResolvedValueOnce({ id: 'tstatus_open', name: 'Open', category: 'open' })
+      .mockResolvedValueOnce({ id: 'tstatus_solved', name: 'Solved', category: 'solved' })
+    transitionStatusMock.mockRejectedValueOnce(
+      new ConflictError('TICKET_STALE', 'ticket was modified concurrently')
+    )
+
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(409)
+    expect(await res.json()).toMatchObject({ error: { code: 'TICKET_STALE' } })
+  })
+})
+
+describe('ticketing gate', () => {
+  it('returns 404 when ticketing is disabled (gate runs before auth)', async () => {
+    widgetTicketingGateMock.mockResolvedValueOnce(
+      Response.json({ error: { code: 'NOT_FOUND', message: 'disabled' } }, { status: 404 })
+    )
+    const res = await handleResolveWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST' }),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(404)
+    expect(getTicketForPortalUserMock).not.toHaveBeenCalled()
+    expect(getWidgetSession).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.test.ts b/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.test.ts
new file mode 100644
index 000000000..c05bef5bf
--- /dev/null
+++ b/apps/web/src/routes/api/widget/__tests__/tickets.$ticketId.test.ts
@@ -0,0 +1,233 @@
+/**
+ * Unit tests for `GET /api/widget/tickets/:ticketId`.
+ *
+ * Critical assertion: the response NEVER includes `requesterPrincipalId`
+ * (one less identifier exposed across the host page CORS boundary), and
+ * threads are public-only (delegated to `listPublicThreadsForTicket`).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NotFoundError } from '@/lib/shared/errors'
+import { makeRequest, makeWidgetSession } from './widget-ticket-fixtures'
+
+vi.mock('@/lib/server/functions/widget-auth', () => ({
+  getWidgetSession: vi.fn(),
+}))
+
+const widgetTicketingGateMock = vi.fn(async () => null as Response | null)
+vi.mock('@/lib/server/widget/ticketing-gate', () => ({
+  widgetTicketingGate: () => widgetTicketingGateMock(),
+}))
+
+const getTicketForPortalUserMock = vi.fn()
+const updatePortalTicketDescriptionMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.portal-query', () => ({
+  getTicketForPortalUser: (...args: unknown[]) => getTicketForPortalUserMock(...args),
+  updatePortalTicketDescription: (...args: unknown[]) => updatePortalTicketDescriptionMock(...args),
+}))
+
+const listPublicThreadsForTicketMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.threads', () => ({
+  listPublicThreadsForTicket: (...args: unknown[]) => listPublicThreadsForTicketMock(...args),
+}))
+
+const findFirstStatusMock = vi.fn()
+const findFirstPrincipalMock = vi.fn()
+const selectMock = vi.fn()
+vi.mock('@/lib/server/db', () => ({
+  eq: (...args: unknown[]) => ({ op: 'eq', args }),
+  inArray: (...args: unknown[]) => ({ op: 'inArray', args }),
+  principal: { id: 'principal.id', userId: 'principal.userId' },
+  ticketStatuses: { id: 'ticketStatuses.id' },
+  user: { name: 'user.name' },
+  db: {
+    query: {
+      ticketStatuses: { findFirst: (...args: unknown[]) => findFirstStatusMock(...args) },
+      principal: { findFirst: (...args: unknown[]) => findFirstPrincipalMock(...args) },
+    },
+    select: (...args: unknown[]) => selectMock(...args),
+  },
+}))
+
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { handleGetWidgetTicket, handlePatchWidgetTicket } from '../tickets.$ticketId'
+
+const URL_BASE = 'http://localhost/api/widget/tickets/ticket_42'
+const getWidgetSessionMock = getWidgetSession as unknown as ReturnType<typeof vi.fn>
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  findFirstStatusMock.mockResolvedValue({
+    id: 'tstatus_open',
+    name: 'Open',
+    color: '#3b82f6',
+    category: 'open',
+  })
+  findFirstPrincipalMock.mockResolvedValue({ id: 'principal_test1' })
+  // Default: empty thread author list -> no select() call needed.
+  selectMock.mockReturnValue({
+    from: () => ({
+      leftJoin: () => ({ where: () => Promise.resolve([]) }),
+    }),
+  })
+})
+
+describe('GET /api/widget/tickets/:ticketId', () => {
+  it('returns 401 when no widget session', async () => {
+    getWidgetSessionMock.mockResolvedValueOnce(null)
+    const res = await handleGetWidgetTicket({
+      request: makeRequest(URL_BASE),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 403 when session is anonymous', async () => {
+    getWidgetSessionMock.mockResolvedValueOnce(makeWidgetSession({ principalType: 'anonymous' }))
+    const res = await handleGetWidgetTicket({
+      request: makeRequest(URL_BASE),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(403)
+  })
+
+  it('returns 404 when ownership predicate yields no row (NotFoundError)', async () => {
+    getWidgetSessionMock.mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockRejectedValueOnce(
+      new NotFoundError('TICKET_NOT_FOUND', 'ticket ticket_42 not found')
+    )
+    const res = await handleGetWidgetTicket({
+      request: makeRequest(URL_BASE),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(404)
+    expect(await res.json()).toMatchObject({ error: { code: 'TICKET_NOT_FOUND' } })
+  })
+
+  it('returns ticket + public threads, strips requesterPrincipalId from response', async () => {
+    getWidgetSessionMock.mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      subject: 'Help',
+      descriptionJson: null,
+      descriptionText: 'My order is broken',
+      statusId: 'tstatus_open',
+      requesterPrincipalId: 'principal_test1',
+      createdAt: new Date('2026-04-01T00:00:00Z'),
+      lastActivityAt: new Date('2026-04-02T00:00:00Z'),
+      updatedAt: new Date('2026-04-02T00:00:00Z'),
+    })
+    listPublicThreadsForTicketMock.mockResolvedValueOnce([
+      {
+        id: 'thread_1',
+        principalId: 'principal_test1',
+        audience: 'public',
+        bodyJson: null,
+        bodyText: 'Reply text',
+        createdAt: new Date('2026-04-02T00:00:00Z'),
+        editedAt: null,
+      },
+    ])
+    selectMock.mockReturnValueOnce({
+      from: () => ({
+        leftJoin: () => ({
+          where: () => Promise.resolve([{ id: 'principal_test1', userName: 'Jane' }]),
+        }),
+      }),
+    })
+
+    const res = await handleGetWidgetTicket({
+      request: makeRequest(URL_BASE),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as {
+      data: {
+        ticket: Record<string, unknown>
+        threads: Array<{ audience: string }>
+        principalNames: Record<string, string>
+      }
+    }
+    // Critical: requesterPrincipalId must NOT leak across the widget boundary.
+    expect(json.data.ticket).not.toHaveProperty('requesterPrincipalId')
+    expect(json.data.ticket.statusName).toBe('Open')
+    expect(json.data.threads).toHaveLength(1)
+    expect(json.data.threads[0].audience).toBe('public')
+    expect(json.data.principalNames['principal_test1']).toBe('Jane')
+  })
+
+  it('sets CORS header on success', async () => {
+    getWidgetSessionMock.mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      subject: 'Help',
+      descriptionJson: null,
+      descriptionText: null,
+      statusId: 'tstatus_open',
+      requesterPrincipalId: 'principal_test1',
+      createdAt: new Date(),
+      lastActivityAt: new Date(),
+      updatedAt: new Date(),
+    })
+    listPublicThreadsForTicketMock.mockResolvedValueOnce([])
+
+    const res = await handleGetWidgetTicket({
+      request: makeRequest(URL_BASE),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.headers.get('access-control-allow-origin')).toBe('*')
+  })
+})
+
+describe('PATCH /api/widget/tickets/:ticketId', () => {
+  it('updates the description through the portal access-managed helper', async () => {
+    getWidgetSessionMock.mockResolvedValueOnce(makeWidgetSession())
+    getTicketForPortalUserMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      sourceWidgetProfileId: null,
+      inboxId: 'inbox_1',
+    })
+    updatePortalTicketDescriptionMock.mockResolvedValueOnce({
+      id: 'ticket_42',
+      updatedAt: new Date('2026-04-02T00:00:01Z'),
+    })
+
+    const res = await handlePatchWidgetTicket({
+      request: makeRequest(URL_BASE, {
+        method: 'PATCH',
+        body: {
+          expectedUpdatedAt: '2026-04-02T00:00:00.000Z',
+          descriptionJson: { type: 'doc', content: [] },
+          descriptionText: 'Updated description',
+        },
+      }),
+      params: { ticketId: 'ticket_42' },
+    })
+
+    expect(res.status).toBe(200)
+    expect(updatePortalTicketDescriptionMock).toHaveBeenCalledWith({
+      userId: 'user_test1',
+      ticketId: 'ticket_42',
+      expectedUpdatedAt: new Date('2026-04-02T00:00:00.000Z'),
+      descriptionJson: { type: 'doc', content: [] },
+      descriptionText: 'Updated description',
+    })
+    await expect(res.json()).resolves.toMatchObject({
+      data: { id: 'ticket_42', updatedAt: '2026-04-02T00:00:01.000Z' },
+    })
+  })
+})
+
+describe('ticketing gate', () => {
+  it('returns 404 when ticketing is disabled (gate runs before auth)', async () => {
+    widgetTicketingGateMock.mockResolvedValueOnce(
+      Response.json({ error: { code: 'NOT_FOUND', message: 'disabled' } }, { status: 404 })
+    )
+    const res = await handleGetWidgetTicket({
+      request: makeRequest(URL_BASE),
+      params: { ticketId: 'ticket_42' },
+    })
+    expect(res.status).toBe(404)
+    expect(getTicketForPortalUserMock).not.toHaveBeenCalled()
+    expect(getWidgetSession).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/web/src/routes/api/widget/__tests__/tickets.test.ts b/apps/web/src/routes/api/widget/__tests__/tickets.test.ts
new file mode 100644
index 000000000..54c8b3520
--- /dev/null
+++ b/apps/web/src/routes/api/widget/__tests__/tickets.test.ts
@@ -0,0 +1,320 @@
+/**
+ * Unit tests for `POST /api/widget/tickets` and `GET /api/widget/tickets`.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NotFoundError, ValidationError } from '@/lib/shared/errors'
+import { makeRequest, makeWidgetSession } from './widget-ticket-fixtures'
+
+vi.mock('zod', async () => {
+  const actual = await vi.importActual<typeof import('zod')>('zod')
+  return { ...actual, z: actual.z ?? actual.default }
+})
+
+vi.mock('@/lib/server/functions/widget-auth', () => ({
+  getWidgetSession: vi.fn(),
+}))
+
+const widgetTicketingGateMock = vi.fn(async () => null as Response | null)
+vi.mock('@/lib/server/widget/ticketing-gate', () => ({
+  widgetTicketingGate: () => widgetTicketingGateMock(),
+}))
+
+const createTicketMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.service', () => ({
+  createTicket: (...args: unknown[]) => createTicketMock(...args),
+}))
+
+// The create handler opens an initial public thread (attachment storage flow)
+// via the tickets barrel. Mock addThread so the handler doesn't hit the real
+// DB-backed implementation.
+const addThreadMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets', () => ({
+  addThread: (...args: unknown[]) => addThreadMock(...args),
+}))
+
+const listTicketsForPortalUserMock = vi.fn()
+vi.mock('@/lib/server/domains/tickets/ticket.portal-query', () => ({
+  listTicketsForPortalUser: (...args: unknown[]) => listTicketsForPortalUserMock(...args),
+}))
+
+const findFirstStatusMock = vi.fn()
+const findManyStatusesMock = vi.fn()
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: {
+      ticketStatuses: {
+        findFirst: (...args: unknown[]) => findFirstStatusMock(...args),
+        findMany: (...args: unknown[]) => findManyStatusesMock(...args),
+      },
+    },
+  },
+  eq: vi.fn((...args: unknown[]) => ({ op: 'eq', args })),
+  inArray: vi.fn((...args: unknown[]) => ({ op: 'inArray', args })),
+  ticketStatuses: {
+    id: 'ticketStatuses.id',
+  },
+}))
+
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { handleCreateWidgetTicket, handleListWidgetTickets } from '../tickets'
+
+const URL_BASE = 'http://localhost/api/widget/tickets'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  findFirstStatusMock.mockResolvedValue({
+    id: 'tstatus_open',
+    name: 'Open',
+    color: '#3b82f6',
+    category: 'open',
+  })
+  findManyStatusesMock.mockResolvedValue([])
+  addThreadMock.mockResolvedValue({ id: 'thread_initial', audience: 'public' })
+})
+
+describe('POST /api/widget/tickets', () => {
+  it('returns 401 when no widget session', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(null)
+    const res = await handleCreateWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { subject: 'Help' } }),
+    })
+    expect(res.status).toBe(401)
+    expect(await res.json()).toMatchObject({ error: { code: 'AUTH_REQUIRED' } })
+  })
+
+  it('returns 403 when widget session is anonymous', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(
+      makeWidgetSession({ principalType: 'anonymous' })
+    )
+    const res = await handleCreateWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { subject: 'Help' } }),
+    })
+    expect(res.status).toBe(403)
+    expect(await res.json()).toMatchObject({ error: { code: 'IDENTITY_REQUIRED' } })
+  })
+
+  it('returns 400 on invalid body (empty subject)', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    const res = await handleCreateWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { subject: '' } }),
+    })
+    expect(res.status).toBe(400)
+  })
+
+  it('rejects `urgent` priority (widget cannot escalate)', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    const res = await handleCreateWidgetTicket({
+      request: makeRequest(URL_BASE, {
+        method: 'POST',
+        body: { subject: 'Help', priority: 'urgent' },
+      }),
+    })
+    expect(res.status).toBe(400)
+  })
+
+  it('creates ticket with channel=widget and requesterPrincipalId from session', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    createTicketMock.mockResolvedValueOnce({
+      id: 'ticket_new',
+      subject: 'Help',
+      statusId: 'tstatus_open',
+      createdAt: new Date('2026-04-01T00:00:00Z'),
+      lastActivityAt: new Date('2026-04-01T00:00:00Z'),
+    })
+    const res = await handleCreateWidgetTicket({
+      request: makeRequest(URL_BASE, {
+        method: 'POST',
+        body: { subject: 'Help', bodyText: 'My order is broken', priority: 'high' },
+      }),
+    })
+    expect(res.status).toBe(200)
+    expect(createTicketMock).toHaveBeenCalledTimes(1)
+    expect(createTicketMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        subject: 'Help',
+        descriptionText: 'My order is broken',
+        priority: 'high',
+        channel: 'widget',
+        requesterPrincipalId: 'principal_test1',
+        createdByPrincipalId: 'principal_test1',
+      })
+    )
+    const json = (await res.json()) as { data: { id: string; statusCategory: string } }
+    expect(json.data.id).toBe('ticket_new')
+    expect(json.data.statusCategory).toBe('open')
+  })
+
+  it('maps domain ValidationError to 400', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    createTicketMock.mockRejectedValueOnce(
+      new ValidationError('TICKET_SUBJECT_TOO_LONG', 'too long')
+    )
+    const res = await handleCreateWidgetTicket({
+      request: makeRequest(URL_BASE, {
+        method: 'POST',
+        body: { subject: 'Help' },
+      }),
+    })
+    expect(res.status).toBe(400)
+    expect(await res.json()).toMatchObject({ error: { code: 'TICKET_SUBJECT_TOO_LONG' } })
+  })
+
+  it('sets CORS header on success', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    createTicketMock.mockResolvedValueOnce({
+      id: 'ticket_new',
+      subject: 'Help',
+      statusId: 'tstatus_open',
+      createdAt: new Date(),
+      lastActivityAt: new Date(),
+    })
+    const res = await handleCreateWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { subject: 'Help' } }),
+    })
+    expect(res.headers.get('access-control-allow-origin')).toBe('*')
+  })
+})
+
+describe('GET /api/widget/tickets', () => {
+  it('returns 401 when no session', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(null)
+    const res = await handleListWidgetTickets({ request: makeRequest(URL_BASE) })
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 403 when session is anonymous', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(
+      makeWidgetSession({ principalType: 'anonymous' })
+    )
+    const res = await handleListWidgetTickets({ request: makeRequest(URL_BASE) })
+    expect(res.status).toBe(403)
+  })
+
+  it('returns empty list when user has no linked tickets', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    listTicketsForPortalUserMock.mockResolvedValueOnce({ rows: [], total: 0 })
+    const res = await handleListWidgetTickets({ request: makeRequest(URL_BASE) })
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ data: { rows: [], total: 0 } })
+  })
+
+  it('passes statusCategory + limit + offset through and hydrates statuses', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    listTicketsForPortalUserMock.mockResolvedValueOnce({
+      rows: [
+        {
+          id: 'ticket_1',
+          subject: 'Hello',
+          statusId: 'tstatus_open',
+          createdAt: new Date('2026-04-01T00:00:00Z'),
+          lastActivityAt: new Date('2026-04-02T00:00:00Z'),
+        },
+      ],
+      total: 1,
+    })
+    findManyStatusesMock.mockResolvedValueOnce([
+      {
+        id: 'tstatus_open',
+        name: 'Open',
+        color: '#3b82f6',
+        category: 'open',
+      },
+    ])
+
+    const res = await handleListWidgetTickets({
+      request: makeRequest(`${URL_BASE}?statusCategory=pending&limit=5&offset=10`),
+    })
+    expect(res.status).toBe(200)
+    expect(listTicketsForPortalUserMock).toHaveBeenCalledWith({
+      userId: 'user_test1',
+      statusCategory: 'pending',
+      limit: 5,
+      offset: 10,
+    })
+    const json = (await res.json()) as {
+      data: {
+        rows: Array<{ id: string; statusName: string; statusCategory: string }>
+        total: number
+      }
+    }
+    expect(json.data.total).toBe(1)
+    expect(json.data.rows[0].statusName).toBe('Open')
+    expect(json.data.rows[0].statusCategory).toBe('open')
+  })
+
+  it('uses requester-owned scope so non-widget requester tickets are included by default', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    listTicketsForPortalUserMock.mockResolvedValueOnce({ rows: [], total: 0 })
+
+    const res = await handleListWidgetTickets({ request: makeRequest(URL_BASE) })
+
+    expect(res.status).toBe(200)
+    expect(listTicketsForPortalUserMock).toHaveBeenCalledWith({ userId: 'user_test1' })
+  })
+
+  it('returns 400 on invalid statusCategory', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    const res = await handleListWidgetTickets({
+      request: makeRequest(`${URL_BASE}?statusCategory=bogus`),
+    })
+    expect(res.status).toBe(400)
+  })
+
+  it('maps domain NotFoundError to 404', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    listTicketsForPortalUserMock.mockRejectedValueOnce(
+      new NotFoundError('TICKET_NOT_FOUND', 'not found')
+    )
+    const res = await handleListWidgetTickets({ request: makeRequest(URL_BASE) })
+    expect(res.status).toBe(404)
+  })
+})
+
+describe('ticketing gate', () => {
+  it('returns 404 NOT_FOUND on list when ticketing is disabled (gate runs before auth)', async () => {
+    widgetTicketingGateMock.mockResolvedValueOnce(
+      Response.json({ error: { code: 'NOT_FOUND', message: 'disabled' } }, { status: 404 })
+    )
+    const res = await handleListWidgetTickets({ request: makeRequest(URL_BASE) })
+    expect(res.status).toBe(404)
+    expect(await res.json()).toMatchObject({ error: { code: 'NOT_FOUND' } })
+    expect(getWidgetSession).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 on create when ticketing is disabled', async () => {
+    widgetTicketingGateMock.mockResolvedValueOnce(
+      Response.json({ error: { code: 'NOT_FOUND', message: 'disabled' } }, { status: 404 })
+    )
+    const res = await handleCreateWidgetTicket({
+      request: makeRequest(URL_BASE, { method: 'POST', body: { subject: 'Help' } }),
+    })
+    expect(res.status).toBe(404)
+    expect(createTicketMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('GET /api/widget/tickets — CORS', () => {
+  it('includes Access-Control-Allow-Origin header on successful list response', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(makeWidgetSession())
+    listTicketsForPortalUserMock.mockResolvedValueOnce({ rows: [], total: 0 })
+    const res = await handleListWidgetTickets({ request: makeRequest(URL_BASE) })
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+  })
+})
+
+describe('GET /api/widget/tickets — contact-linked visibility', () => {
+  it('passes contactId from session to listTicketsForPortalUser', async () => {
+    vi.mocked(getWidgetSession).mockResolvedValueOnce(
+      makeWidgetSession({ contactId: 'contact_linked1' as never })
+    )
+    listTicketsForPortalUserMock.mockResolvedValueOnce({ rows: [], total: 0 })
+    await handleListWidgetTickets({ request: makeRequest(URL_BASE) })
+    // The portal query uses userId (not contactId directly) — the session
+    // carries contactId to resolve linked contacts internally. Verify the
+    // function was called with the session user's identity.
+    expect(listTicketsForPortalUserMock).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'user_test1' })
+    )
+  })
+})
diff --git a/apps/web/src/routes/api/widget/__tests__/widget-ticket-fixtures.ts b/apps/web/src/routes/api/widget/__tests__/widget-ticket-fixtures.ts
new file mode 100644
index 000000000..819847a46
--- /dev/null
+++ b/apps/web/src/routes/api/widget/__tests__/widget-ticket-fixtures.ts
@@ -0,0 +1,49 @@
+/**
+ * Shared fixtures for widget ticket endpoint tests.
+ */
+import type { PrincipalId, UserId, WorkspaceId, ContactId } from '@quackback/ids'
+import type { WidgetAuthContext } from '@/lib/server/functions/widget-auth'
+
+export function makeWidgetSession(
+  overrides: Partial<{
+    principalType: 'user' | 'anonymous'
+    contactId: ContactId | null
+    userId: string
+    principalId: string
+    email: string
+  }> = {}
+): WidgetAuthContext {
+  return {
+    settings: {
+      id: 'workspace_test1' as WorkspaceId,
+      slug: 'test',
+      name: 'Test',
+    },
+    user: {
+      id: (overrides.userId ?? 'user_test1') as UserId,
+      email: overrides.email ?? '[email protected]',
+      name: 'Jane',
+      image: null,
+    },
+    principal: {
+      id: (overrides.principalId ?? 'principal_test1') as PrincipalId,
+      role: 'user',
+      type: overrides.principalType ?? 'user',
+    },
+    contactId: (overrides.contactId ?? null) as ContactId | null,
+  }
+}
+
+export function makeRequest(
+  url: string,
+  init: { method?: string; body?: unknown; bearer?: string } = {}
+): Request {
+  const headers: Record<string, string> = {}
+  if (init.bearer) headers.Authorization = `Bearer ${init.bearer}`
+  if (init.body !== undefined) headers['Content-Type'] = 'application/json'
+  return new Request(url, {
+    method: init.method ?? 'GET',
+    headers,
+    body: init.body !== undefined ? JSON.stringify(init.body) : undefined,
+  })
+}
diff --git a/apps/web/src/routes/api/widget/tickets.$ticketId.reopen.ts b/apps/web/src/routes/api/widget/tickets.$ticketId.reopen.ts
new file mode 100644
index 000000000..8fca51fe4
--- /dev/null
+++ b/apps/web/src/routes/api/widget/tickets.$ticketId.reopen.ts
@@ -0,0 +1,169 @@
+/**
+ * Widget ticket reopen — POST /api/widget/tickets/:ticketId/reopen
+ *
+ * Symmetric counterpart to `tickets.$ticketId.resolve.ts`. Lets the requester
+ * reopen one of their own previously-solved tickets directly from the widget.
+ *
+ * Allowed when the ticket's current status category is `solved`. Returns an
+ * idempotent `{ alreadyOpen: true }` envelope when the ticket is already in
+ * `open` / `pending` / `on_hold`. Rejects with 409 when the ticket is in
+ * `closed` (terminal from the requester's perspective — symmetric with
+ * `addPortalReply`'s `TICKET_CLOSED` rejection).
+ *
+ * Target status precedence (first match wins):
+ *   1. The ticket's inbox `defaultStatusId` if it points to an open-category status.
+ *   2. The workspace `is_default = true` ticket status if it's open-category.
+ *   3. First non-deleted `category = 'open'` status by position, then name.
+ *
+ * Auth: Bearer-authenticated identified widget session.
+ * Ownership: enforced by `getTicketForPortalUser` (404 on miss, never 403).
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { and, asc, db, eq, inboxes, isNull, principal, ticketStatuses } from '@/lib/server/db'
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { getTicketForPortalUser } from '@/lib/server/domains/tickets/ticket.portal-query'
+import { transitionStatus } from '@/lib/server/domains/tickets/ticket.service'
+import {
+  mapDomainErrorToResponse,
+  widgetCorsHeaders,
+  widgetJsonError,
+} from '@/lib/server/widget/cors'
+import { widgetTicketingGate } from '@/lib/server/widget/ticketing-gate'
+import { getWidgetRequestContext } from '@/lib/server/widget/context'
+import { assertTicketMatchesWidgetContext } from '@/lib/server/widget/ticket-scope'
+import type { InboxId, PrincipalId, TicketId, TicketStatusId, UserId } from '@quackback/ids'
+
+const OPEN_CATEGORIES = new Set(['open', 'pending', 'on_hold'])
+
+async function resolveOpenTargetStatus(
+  inboxId: InboxId | null
+): Promise<{ id: TicketStatusId; category: string } | null> {
+  if (inboxId) {
+    const inbox = await db.query.inboxes.findFirst({
+      where: eq(inboxes.id, inboxId),
+      columns: { defaultStatusId: true },
+    })
+    if (inbox?.defaultStatusId) {
+      const status = await db.query.ticketStatuses.findFirst({
+        where: and(eq(ticketStatuses.id, inbox.defaultStatusId), isNull(ticketStatuses.deletedAt)),
+      })
+      if (status && OPEN_CATEGORIES.has(status.category)) {
+        return { id: status.id as TicketStatusId, category: status.category }
+      }
+    }
+  }
+
+  const workspaceDefault = await db.query.ticketStatuses.findFirst({
+    where: and(eq(ticketStatuses.isDefault, true), isNull(ticketStatuses.deletedAt)),
+  })
+  if (workspaceDefault && OPEN_CATEGORIES.has(workspaceDefault.category)) {
+    return { id: workspaceDefault.id as TicketStatusId, category: workspaceDefault.category }
+  }
+
+  const firstOpen = await db.query.ticketStatuses.findFirst({
+    where: and(eq(ticketStatuses.category, 'open'), isNull(ticketStatuses.deletedAt)),
+    orderBy: [asc(ticketStatuses.position), asc(ticketStatuses.name)],
+  })
+  if (firstOpen) {
+    return { id: firstOpen.id as TicketStatusId, category: firstOpen.category }
+  }
+  return null
+}
+
+export async function handleReopenWidgetTicket({
+  request,
+  params,
+}: {
+  request: Request
+  params: { ticketId: string }
+}): Promise<Response> {
+  const disabled = await widgetTicketingGate()
+  if (disabled) return disabled
+  const session = await getWidgetSession(request)
+  if (!session) {
+    return widgetJsonError('AUTH_REQUIRED', 'Valid widget session required', 401)
+  }
+  if (session.principal.type === 'anonymous') {
+    return widgetJsonError(
+      'IDENTITY_REQUIRED',
+      'Identify the widget user before reopening tickets',
+      403
+    )
+  }
+
+  const ticketId = params.ticketId as TicketId
+
+  try {
+    const ticket = await getTicketForPortalUser({
+      userId: session.user.id as UserId,
+      ticketId,
+    })
+    assertTicketMatchesWidgetContext(ticket, await getWidgetRequestContext(request))
+
+    const currentStatus = ticket.statusId
+      ? await db.query.ticketStatuses.findFirst({
+          where: eq(ticketStatuses.id, ticket.statusId),
+        })
+      : null
+
+    if (currentStatus && OPEN_CATEGORIES.has(currentStatus.category)) {
+      return Response.json(
+        {
+          data: {
+            id: ticket.id as TicketId,
+            statusId: ticket.statusId as TicketStatusId,
+            statusCategory: currentStatus.category,
+            alreadyOpen: true,
+            updatedAt: ticket.updatedAt.toISOString(),
+          },
+        },
+        { headers: widgetCorsHeaders() }
+      )
+    }
+
+    if (currentStatus?.category === 'closed') {
+      return widgetJsonError('TICKET_REOPEN_NOT_ALLOWED', 'cannot reopen a closed ticket', 409)
+    }
+
+    const target = await resolveOpenTargetStatus(ticket.inboxId as InboxId | null)
+    if (!target) {
+      return widgetJsonError('TICKET_NO_OPEN_STATUS', 'No open-category status configured', 409)
+    }
+
+    const viewerPrincipal = await db.query.principal.findFirst({
+      where: eq(principal.userId, session.user.id as UserId),
+    })
+
+    const updated = await transitionStatus(ticketId, {
+      expectedUpdatedAt: ticket.updatedAt,
+      actorPrincipalId: (viewerPrincipal?.id as PrincipalId | undefined) ?? null,
+      statusId: target.id,
+    })
+
+    return Response.json(
+      {
+        data: {
+          id: updated.id as TicketId,
+          statusId: updated.statusId as TicketStatusId,
+          statusCategory: target.category,
+          alreadyOpen: false,
+          updatedAt: updated.updatedAt.toISOString(),
+        },
+      },
+      { headers: widgetCorsHeaders() }
+    )
+  } catch (err) {
+    const mapped = mapDomainErrorToResponse(err)
+    if (mapped) return mapped
+    console.error('[widget:tickets] reopen error', err)
+    return widgetJsonError('SERVER_ERROR', 'Failed to reopen ticket', 500)
+  }
+}
+
+export const Route = createFileRoute('/api/widget/tickets/$ticketId/reopen')({
+  server: {
+    handlers: {
+      POST: handleReopenWidgetTicket,
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/widget/tickets.$ticketId.replies.ts b/apps/web/src/routes/api/widget/tickets.$ticketId.replies.ts
new file mode 100644
index 000000000..8caa616c3
--- /dev/null
+++ b/apps/web/src/routes/api/widget/tickets.$ticketId.replies.ts
@@ -0,0 +1,104 @@
+/**
+ * Widget ticket reply — POST /api/widget/tickets/:ticketId/replies
+ *
+ * Auth: Bearer-authenticated identified widget session.
+ * Authorisation, audience pinning, and reopen-vs-closed semantics are all
+ * delegated to `addPortalReply`, which:
+ *   - re-checks ownership via `getTicketForPortalUser` (404 on miss)
+ *   - hard-codes `audience='public'`
+ *   - rejects replies on `closed` tickets with `ConflictError`
+ *
+ * The widget never offers an `audience` field — staff notes never traverse
+ * the widget surface.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import {
+  addPortalReply,
+  getTicketForPortalUser,
+} from '@/lib/server/domains/tickets/ticket.portal-query'
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import {
+  mapDomainErrorToResponse,
+  widgetCorsHeaders,
+  widgetJsonError,
+} from '@/lib/server/widget/cors'
+import { widgetTicketingGate } from '@/lib/server/widget/ticketing-gate'
+import { getWidgetRequestContext } from '@/lib/server/widget/context'
+import { assertTicketMatchesWidgetContext } from '@/lib/server/widget/ticket-scope'
+import type { TicketId, UserId } from '@quackback/ids'
+
+const tiptapDocSchema = z
+  .object({ type: z.literal('doc'), content: z.array(z.unknown()).optional() })
+  .passthrough()
+
+const replySchema = z.object({
+  bodyJson: tiptapDocSchema.nullable().optional(),
+  bodyText: z.string().max(100_000).nullable().optional(),
+})
+
+export async function handleReplyToWidgetTicket({
+  request,
+  params,
+}: {
+  request: Request
+  params: { ticketId: string }
+}): Promise<Response> {
+  const disabled = await widgetTicketingGate()
+  if (disabled) return disabled
+  const session = await getWidgetSession(request)
+  if (!session) {
+    return widgetJsonError('AUTH_REQUIRED', 'Valid widget session required', 401)
+  }
+  if (session.principal.type === 'anonymous') {
+    return widgetJsonError('IDENTITY_REQUIRED', 'Identify the widget user before replying', 403)
+  }
+
+  let body: z.infer<typeof replySchema>
+  try {
+    const raw = await request.json()
+    body = replySchema.parse(raw)
+  } catch {
+    return widgetJsonError('VALIDATION_ERROR', 'Invalid request body', 400)
+  }
+
+  try {
+    const ticket = await getTicketForPortalUser({
+      userId: session.user.id as UserId,
+      ticketId: params.ticketId as TicketId,
+    })
+    assertTicketMatchesWidgetContext(ticket, await getWidgetRequestContext(request))
+
+    const thread = await addPortalReply({
+      userId: session.user.id as UserId,
+      ticketId: params.ticketId as TicketId,
+      bodyJson: (body.bodyJson ?? null) as never,
+      bodyText: body.bodyText ?? null,
+    })
+    return Response.json(
+      {
+        data: {
+          id: thread.id,
+          ticketId: thread.ticketId as TicketId,
+          // Hard-coded by `addPortalReply`; we narrow the response type.
+          audience: 'public' as const,
+          createdAt: thread.createdAt.toISOString(),
+        },
+      },
+      { headers: widgetCorsHeaders() }
+    )
+  } catch (err) {
+    const mapped = mapDomainErrorToResponse(err)
+    if (mapped) return mapped
+    console.error('[widget:tickets] reply error', err)
+    return widgetJsonError('SERVER_ERROR', 'Failed to post reply', 500)
+  }
+}
+
+export const Route = createFileRoute('/api/widget/tickets/$ticketId/replies')({
+  server: {
+    handlers: {
+      POST: handleReplyToWidgetTicket,
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/widget/tickets.$ticketId.resolve.ts b/apps/web/src/routes/api/widget/tickets.$ticketId.resolve.ts
new file mode 100644
index 000000000..d7f59d057
--- /dev/null
+++ b/apps/web/src/routes/api/widget/tickets.$ticketId.resolve.ts
@@ -0,0 +1,129 @@
+/**
+ * Widget ticket resolve - POST /api/widget/tickets/:ticketId/resolve
+ *
+ * Lets the requester themselves mark a ticket as solved from the widget. The
+ * agent UI keeps its richer status workflow; this is a single-button shortcut
+ * for end-users on the host page.
+ *
+ * Auth: Bearer-authenticated identified widget session.
+ * Ownership: enforced by `getTicketForPortalUser` (404 on miss, never 403).
+ *
+ * If the ticket is already in the `solved` or `closed` category we return
+ * `{ ok: true, alreadyResolved: true }` instead of attempting an update - a
+ * pointless `transitionStatus` call would write activity rows for a no-op.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { and, asc, db, eq, isNull, principal, ticketStatuses } from '@/lib/server/db'
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { getTicketForPortalUser } from '@/lib/server/domains/tickets/ticket.portal-query'
+import { transitionStatus } from '@/lib/server/domains/tickets/ticket.service'
+import {
+  mapDomainErrorToResponse,
+  widgetCorsHeaders,
+  widgetJsonError,
+} from '@/lib/server/widget/cors'
+import { widgetTicketingGate } from '@/lib/server/widget/ticketing-gate'
+import { getWidgetRequestContext } from '@/lib/server/widget/context'
+import { assertTicketMatchesWidgetContext } from '@/lib/server/widget/ticket-scope'
+import type { PrincipalId, TicketId, TicketStatusId, UserId } from '@quackback/ids'
+
+export async function handleResolveWidgetTicket({
+  request,
+  params,
+}: {
+  request: Request
+  params: { ticketId: string }
+}): Promise<Response> {
+  const disabled = await widgetTicketingGate()
+  if (disabled) return disabled
+  const session = await getWidgetSession(request)
+  if (!session) {
+    return widgetJsonError('AUTH_REQUIRED', 'Valid widget session required', 401)
+  }
+  if (session.principal.type === 'anonymous') {
+    return widgetJsonError(
+      'IDENTITY_REQUIRED',
+      'Identify the widget user before resolving tickets',
+      403
+    )
+  }
+
+  const ticketId = params.ticketId as TicketId
+
+  try {
+    // Enforce ownership and capture the current updatedAt for the optimistic
+    // concurrency guard inside `transitionStatus`.
+    const ticket = await getTicketForPortalUser({
+      userId: session.user.id as UserId,
+      ticketId,
+    })
+    assertTicketMatchesWidgetContext(ticket, await getWidgetRequestContext(request))
+
+    const currentStatus = ticket.statusId
+      ? await db.query.ticketStatuses.findFirst({
+          where: eq(ticketStatuses.id, ticket.statusId),
+        })
+      : null
+
+    if (currentStatus?.category === 'solved' || currentStatus?.category === 'closed') {
+      return Response.json(
+        {
+          data: {
+            id: ticket.id as TicketId,
+            statusId: ticket.statusId as TicketStatusId,
+            statusCategory: currentStatus.category,
+            alreadyResolved: true,
+            updatedAt: ticket.updatedAt.toISOString(),
+          },
+        },
+        { headers: widgetCorsHeaders() }
+      )
+    }
+
+    // Pick the first non-deleted status in the `solved` category by position.
+    const solvedStatus = await db.query.ticketStatuses.findFirst({
+      where: and(eq(ticketStatuses.category, 'solved'), isNull(ticketStatuses.deletedAt)),
+      orderBy: [asc(ticketStatuses.position), asc(ticketStatuses.name)],
+    })
+    if (!solvedStatus) {
+      return widgetJsonError('TICKET_NO_SOLVED_STATUS', 'No solved-category status configured', 409)
+    }
+
+    // Look up the requester's principal to attribute the activity row.
+    const viewerPrincipal = await db.query.principal.findFirst({
+      where: eq(principal.userId, session.user.id as UserId),
+    })
+
+    const updated = await transitionStatus(ticketId, {
+      expectedUpdatedAt: ticket.updatedAt,
+      actorPrincipalId: (viewerPrincipal?.id as PrincipalId | undefined) ?? null,
+      statusId: solvedStatus.id as TicketStatusId,
+    })
+
+    return Response.json(
+      {
+        data: {
+          id: updated.id as TicketId,
+          statusId: updated.statusId as TicketStatusId,
+          statusCategory: 'solved' as const,
+          alreadyResolved: false,
+          updatedAt: updated.updatedAt.toISOString(),
+        },
+      },
+      { headers: widgetCorsHeaders() }
+    )
+  } catch (err) {
+    const mapped = mapDomainErrorToResponse(err)
+    if (mapped) return mapped
+    console.error('[widget:tickets] resolve error', err)
+    return widgetJsonError('SERVER_ERROR', 'Failed to resolve ticket', 500)
+  }
+}
+
+export const Route = createFileRoute('/api/widget/tickets/$ticketId/resolve')({
+  server: {
+    handlers: {
+      POST: handleResolveWidgetTicket,
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/widget/tickets.$ticketId.threads.$threadId.attachments.ts b/apps/web/src/routes/api/widget/tickets.$ticketId.threads.$threadId.attachments.ts
new file mode 100644
index 000000000..eb15e31ed
--- /dev/null
+++ b/apps/web/src/routes/api/widget/tickets.$ticketId.threads.$threadId.attachments.ts
@@ -0,0 +1,174 @@
+/**
+ * Widget thread attachments — POST /api/widget/tickets/:ticketId/threads/:threadId/attachments
+ *
+ * Lets the requester attach an image to one of THEIR OWN threads on a ticket
+ * they own. Two-step flow:
+ *   1. Create the thread first via POST /api/widget/tickets/:ticketId/replies
+ *      (or use the seed thread returned from POST /api/widget/tickets).
+ *   2. Upload one or more images to that thread via this endpoint.
+ *
+ * Constraints (mirror `/api/v1/.../attachments` and `/api/widget/upload`):
+ *   - Image MIME types only (`isAllowedImageType`)
+ *   - 5MB max (`MAX_FILE_SIZE`)
+ *   - Shared S3 prefix `'widget-images'`
+ *
+ * Authorization gates:
+ *   - `widgetTicketingGate` — workspace must have ticketing enabled
+ *   - identified widget session (anonymous rejected)
+ *   - `widgetConfig.imageUploadsInWidget === true`
+ *   - ownership: `getTicketForPortalUser` (404 on miss, never 403)
+ *   - thread.ticketId must equal the URL ticketId
+ *   - thread.audience must be `'public'` (requester surface only)
+ *   - thread.principalId must equal the requester's principal — requesters
+ *     cannot attach to staff replies
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { db, eq, principal as principalTable } from '@/lib/server/db'
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { getTicketForPortalUser } from '@/lib/server/domains/tickets/ticket.portal-query'
+import { getThread, attachToThread } from '@/lib/server/domains/tickets'
+import { getWidgetConfig } from '@/lib/server/domains/settings/settings.widget'
+import {
+  isS3Configured,
+  isAllowedAttachmentType,
+  MAX_ATTACHMENT_FILE_SIZE,
+  generateStorageKey,
+  uploadObject,
+} from '@/lib/server/storage/s3'
+import {
+  mapDomainErrorToResponse,
+  widgetCorsHeaders,
+  widgetJsonError,
+} from '@/lib/server/widget/cors'
+import { widgetTicketingGate } from '@/lib/server/widget/ticketing-gate'
+import type { PrincipalId, TicketId, TicketThreadId, UserId } from '@quackback/ids'
+
+const STORAGE_PREFIX = 'ticket-attachments'
+
+export async function handleWidgetThreadAttachmentUpload({
+  request,
+  params,
+}: {
+  request: Request
+  params: { ticketId: string; threadId: string }
+}): Promise<Response> {
+  const disabled = await widgetTicketingGate()
+  if (disabled) return disabled
+  const session = await getWidgetSession(request)
+  if (!session) {
+    return widgetJsonError('AUTH_REQUIRED', 'Valid widget session required', 401)
+  }
+  if (session.principal.type === 'anonymous') {
+    return widgetJsonError(
+      'IDENTITY_REQUIRED',
+      'Identify the widget user before uploading attachments',
+      403
+    )
+  }
+
+  const widgetConfig = await getWidgetConfig()
+  if (!widgetConfig.imageUploadsInWidget) {
+    return widgetJsonError('IMAGE_UPLOADS_DISABLED', 'Image uploads are disabled', 403)
+  }
+  if (!isS3Configured()) {
+    return widgetJsonError('STORAGE_NOT_CONFIGURED', 'Storage is not configured', 503)
+  }
+
+  const ticketId = params.ticketId as TicketId
+  const threadId = params.threadId as TicketThreadId
+
+  try {
+    // Ownership: throws NotFoundError on miss, never ForbiddenError.
+    await getTicketForPortalUser({
+      userId: session.user.id as UserId,
+      ticketId,
+    })
+
+    const thread = await getThread(threadId)
+    if (!thread || thread.deletedAt || thread.ticketId !== ticketId) {
+      return widgetJsonError('THREAD_NOT_FOUND', 'Thread not found', 404)
+    }
+    if (thread.audience !== 'public') {
+      return widgetJsonError('THREAD_NOT_PUBLIC', 'Cannot attach to non-public threads', 403)
+    }
+
+    // Requesters can only attach to their own threads (never staff replies).
+    const viewerPrincipal = await db.query.principal.findFirst({
+      where: eq(principalTable.userId, session.user.id as UserId),
+    })
+    const viewerPrincipalId = (viewerPrincipal?.id as PrincipalId | undefined) ?? null
+    if (!viewerPrincipalId || thread.principalId !== viewerPrincipalId) {
+      return widgetJsonError('THREAD_NOT_OWNER', "Cannot attach to another author's thread", 403)
+    }
+
+    let formData: FormData
+    try {
+      formData = await request.formData()
+    } catch {
+      return widgetJsonError('VALIDATION_ERROR', 'expected multipart/form-data', 400)
+    }
+    const file = formData.get('file')
+    if (!(file instanceof File)) {
+      return widgetJsonError('VALIDATION_ERROR', 'missing "file" field', 400)
+    }
+    if (!isAllowedAttachmentType(file.type)) {
+      return widgetJsonError('VALIDATION_ERROR', `unsupported file type: ${file.type}`, 400)
+    }
+    if (file.size === 0) {
+      return widgetJsonError('VALIDATION_ERROR', 'file is empty', 400)
+    }
+    if (file.size > MAX_ATTACHMENT_FILE_SIZE) {
+      return widgetJsonError(
+        'VALIDATION_ERROR',
+        `file exceeds ${MAX_ATTACHMENT_FILE_SIZE / 1024 / 1024}MB`,
+        400
+      )
+    }
+
+    const ext = file.name.split('.').pop() || 'bin'
+    const filename = file.name || `upload-${Date.now()}.${ext}`
+    const key = generateStorageKey(STORAGE_PREFIX, filename)
+    const buffer = Buffer.from(await file.arrayBuffer())
+    const publicUrl = await uploadObject(key, buffer, file.type)
+
+    const created = await attachToThread({
+      threadId,
+      uploadedByPrincipalId: viewerPrincipalId,
+      filename,
+      mimeType: file.type,
+      sizeBytes: file.size,
+      storageKey: key,
+      publicUrl,
+    })
+
+    return Response.json(
+      {
+        data: {
+          id: created.id,
+          threadId: created.threadId,
+          filename: created.filename,
+          mimeType: created.mimeType,
+          sizeBytes: created.sizeBytes,
+          publicUrl: created.publicUrl,
+          createdAt: created.createdAt.toISOString(),
+        },
+      },
+      { status: 201, headers: widgetCorsHeaders() }
+    )
+  } catch (err) {
+    const mapped = mapDomainErrorToResponse(err)
+    if (mapped) return mapped
+    console.error('[widget:tickets] attachment upload error', err)
+    return widgetJsonError('SERVER_ERROR', 'Failed to upload attachment', 500)
+  }
+}
+
+export const Route = createFileRoute('/api/widget/tickets/$ticketId/threads/$threadId/attachments')(
+  {
+    server: {
+      handlers: {
+        POST: handleWidgetThreadAttachmentUpload,
+      },
+    },
+  }
+)
diff --git a/apps/web/src/routes/api/widget/tickets.$ticketId.ts b/apps/web/src/routes/api/widget/tickets.$ticketId.ts
new file mode 100644
index 000000000..a54c72ad5
--- /dev/null
+++ b/apps/web/src/routes/api/widget/tickets.$ticketId.ts
@@ -0,0 +1,231 @@
+/**
+ * Widget ticket detail — GET /api/widget/tickets/:ticketId
+ *                        PATCH /api/widget/tickets/:ticketId
+ *
+ * Auth: Bearer-authenticated identified widget session.
+ * Ownership: reuses `getTicketForPortalUser` which throws `NotFoundError`
+ * (never `Forbidden`) on miss to avoid existence leaks.
+ *
+ * Threads are filtered to `audience='public'` only via
+ * `listPublicThreadsForTicket`. Internal/shared_team notes never reach the
+ * widget — enforced at the data layer, not just the response shape.
+ *
+ * Compared to the portal `getMyTicketFn`, we deliberately omit
+ * `requesterPrincipalId` from the response: the widget UI doesn't need it,
+ * and one less identifier crosses an arbitrary host page's CORS boundary.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import {
+  db,
+  eq,
+  inArray,
+  principal,
+  ticketStatuses,
+  user,
+  type TiptapContent,
+} from '@/lib/server/db'
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import {
+  getTicketForPortalUser,
+  updatePortalTicketDescription,
+} from '@/lib/server/domains/tickets/ticket.portal-query'
+import { listPublicThreadsForTicket } from '@/lib/server/domains/tickets/ticket.threads'
+import {
+  mapDomainErrorToResponse,
+  widgetCorsHeaders,
+  widgetJsonError,
+} from '@/lib/server/widget/cors'
+import { widgetTicketingGate } from '@/lib/server/widget/ticketing-gate'
+import { getWidgetRequestContext } from '@/lib/server/widget/context'
+import { assertTicketMatchesWidgetContext } from '@/lib/server/widget/ticket-scope'
+import type { PrincipalId, TicketId, TicketStatusId, UserId } from '@quackback/ids'
+
+const tiptapDocSchema = z
+  .object({ type: z.literal('doc'), content: z.array(z.unknown()).optional() })
+  .passthrough()
+
+const patchSchema = z.object({
+  expectedUpdatedAt: z.string().datetime(),
+  descriptionJson: tiptapDocSchema.nullable().optional(),
+  descriptionText: z.string().max(100_000).nullable().optional(),
+})
+
+interface SerializedThread {
+  id: string
+  principalId: PrincipalId | null
+  audience: 'public'
+  bodyJson: TiptapContent | null
+  bodyText: string
+  createdAt: string
+  editedAt: string | null
+}
+
+export async function handleGetWidgetTicket({
+  request,
+  params,
+}: {
+  request: Request
+  params: { ticketId: string }
+}): Promise<Response> {
+  const disabled = await widgetTicketingGate()
+  if (disabled) return disabled
+  const session = await getWidgetSession(request)
+  if (!session) {
+    return widgetJsonError('AUTH_REQUIRED', 'Valid widget session required', 401)
+  }
+  if (session.principal.type === 'anonymous') {
+    return widgetJsonError(
+      'IDENTITY_REQUIRED',
+      'Identify the widget user before viewing tickets',
+      403
+    )
+  }
+
+  const ticketId = params.ticketId as TicketId
+
+  try {
+    const ticket = await getTicketForPortalUser({
+      userId: session.user.id as UserId,
+      ticketId,
+    })
+    assertTicketMatchesWidgetContext(ticket, await getWidgetRequestContext(request))
+
+    const [threads, status, viewerPrincipal] = await Promise.all([
+      listPublicThreadsForTicket(ticket.id as TicketId),
+      ticket.statusId
+        ? db.query.ticketStatuses.findFirst({ where: eq(ticketStatuses.id, ticket.statusId) })
+        : Promise.resolve(undefined),
+      db.query.principal.findFirst({ where: eq(principal.userId, session.user.id as UserId) }),
+    ])
+
+    const principalIds = Array.from(
+      new Set(threads.map((t) => t.principalId).filter((p): p is PrincipalId => p != null))
+    )
+    const principalRows = principalIds.length
+      ? await db
+          .select({ id: principal.id, userName: user.name })
+          .from(principal)
+          .leftJoin(user, eq(principal.userId, user.id))
+          .where(inArray(principal.id, principalIds))
+      : []
+    const principalNames: Record<string, string> = {}
+    for (const row of principalRows) {
+      principalNames[row.id] = row.userName ?? 'User'
+    }
+
+    return Response.json(
+      {
+        data: {
+          ticket: {
+            id: ticket.id as TicketId,
+            subject: ticket.subject,
+            descriptionJson: (ticket.descriptionJson as TiptapContent | null) ?? null,
+            descriptionText: ticket.descriptionText ?? null,
+            statusId: ticket.statusId as TicketStatusId,
+            statusCategory: (status?.category ?? 'open') as
+              | 'open'
+              | 'pending'
+              | 'on_hold'
+              | 'solved'
+              | 'closed',
+            statusName: status?.name ?? 'Unknown',
+            statusColor: status?.color ?? null,
+            createdAt: ticket.createdAt.toISOString(),
+            lastActivityAt: ticket.lastActivityAt.toISOString(),
+            updatedAt: ticket.updatedAt.toISOString(),
+          },
+          threads: threads.map(
+            (t): SerializedThread => ({
+              id: t.id,
+              principalId: (t.principalId as PrincipalId | null) ?? null,
+              // The data-layer helper guarantees this; we narrow the response type.
+              audience: 'public',
+              bodyJson: (t.bodyJson as TiptapContent | null) ?? null,
+              bodyText: t.bodyText,
+              createdAt: t.createdAt.toISOString(),
+              editedAt: t.editedAt ? t.editedAt.toISOString() : null,
+            })
+          ),
+          principalNames,
+          viewerPrincipalId: (viewerPrincipal?.id as PrincipalId | undefined) ?? null,
+        },
+      },
+      { headers: widgetCorsHeaders() }
+    )
+  } catch (err) {
+    const mapped = mapDomainErrorToResponse(err)
+    if (mapped) return mapped
+    console.error('[widget:tickets] detail error', err)
+    return widgetJsonError('SERVER_ERROR', 'Failed to load ticket', 500)
+  }
+}
+
+export async function handlePatchWidgetTicket({
+  request,
+  params,
+}: {
+  request: Request
+  params: { ticketId: string }
+}): Promise<Response> {
+  const disabled = await widgetTicketingGate()
+  if (disabled) return disabled
+  const session = await getWidgetSession(request)
+  if (!session) {
+    return widgetJsonError('AUTH_REQUIRED', 'Valid widget session required', 401)
+  }
+  if (session.principal.type === 'anonymous') {
+    return widgetJsonError(
+      'IDENTITY_REQUIRED',
+      'Identify the widget user before editing tickets',
+      403
+    )
+  }
+
+  let body: z.infer<typeof patchSchema>
+  try {
+    const raw = await request.json()
+    body = patchSchema.parse(raw)
+  } catch {
+    return widgetJsonError('VALIDATION_ERROR', 'Invalid request body', 400)
+  }
+
+  try {
+    const ticket = await getTicketForPortalUser({
+      userId: session.user.id as UserId,
+      ticketId: params.ticketId as TicketId,
+    })
+    assertTicketMatchesWidgetContext(ticket, await getWidgetRequestContext(request))
+
+    const updated = await updatePortalTicketDescription({
+      userId: session.user.id as UserId,
+      ticketId: params.ticketId as TicketId,
+      expectedUpdatedAt: new Date(body.expectedUpdatedAt),
+      descriptionJson: (body.descriptionJson ?? null) as never,
+      descriptionText: body.descriptionText ?? null,
+    })
+    return Response.json(
+      {
+        data: {
+          id: updated.id as TicketId,
+          updatedAt: updated.updatedAt.toISOString(),
+        },
+      },
+      { headers: widgetCorsHeaders() }
+    )
+  } catch (err) {
+    const mapped = mapDomainErrorToResponse(err)
+    if (mapped) return mapped
+    console.error('[widget:tickets] patch error', err)
+    return widgetJsonError('SERVER_ERROR', 'Failed to update ticket', 500)
+  }
+}
+
+export const Route = createFileRoute('/api/widget/tickets/$ticketId')({
+  server: {
+    handlers: {
+      GET: handleGetWidgetTicket,
+      PATCH: handlePatchWidgetTicket,
+    },
+  },
+})
diff --git a/apps/web/src/routes/api/widget/tickets.ts b/apps/web/src/routes/api/widget/tickets.ts
new file mode 100644
index 000000000..6b9bfc212
--- /dev/null
+++ b/apps/web/src/routes/api/widget/tickets.ts
@@ -0,0 +1,303 @@
+/**
+ * Widget tickets - list (GET) and create (POST).
+ *
+ * Auth: requires a Bearer-authenticated widget session (`getWidgetSession`).
+ * Anonymous principals are rejected here; the iframe UI must call
+ * `Quackback.identify(...)` first so a real `user`/`principal` exists.
+ *
+ * GET ownership model: reuses the portal-side `listTicketsForPortalUser`
+ * helper, which builds the identity-set
+ *   `principalId(userId) + linkedContactIds(userId)`
+ * from `contact_user_links`. Phase 1 populates that link on verified
+ * `identify`; Phase 2 also populates it lazily inside `createTicket` via
+ * `resolveRequesterContactId`.
+ *
+ * POST stamps `channel='widget'` so analytics and routing can distinguish
+ * widget-originated tickets. Requester defaults to the session principal -
+ * the widget never accepts an inbound `requesterContactId` field.
+ */
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import {
+  db,
+  eq,
+  inArray,
+  inboxes,
+  ticketStatuses,
+  type TicketPriority,
+  type TiptapContent,
+} from '@/lib/server/db'
+import { getWidgetSession } from '@/lib/server/functions/widget-auth'
+import { createTicket } from '@/lib/server/domains/tickets/ticket.service'
+import { listTicketsForPortalUser } from '@/lib/server/domains/tickets/ticket.portal-query'
+import {
+  mapDomainErrorToResponse,
+  widgetCorsHeaders,
+  widgetJsonError,
+} from '@/lib/server/widget/cors'
+import { widgetTicketingGate } from '@/lib/server/widget/ticketing-gate'
+import { getWidgetRequestContext } from '@/lib/server/widget/context'
+import {
+  visibleWidgetSupportCategories,
+  widgetTicketListFilters,
+} from '@/lib/server/widget/ticket-scope'
+import type { TicketId, TicketStatusId, UserId } from '@quackback/ids'
+
+const tiptapDocSchema = z
+  .object({ type: z.literal('doc'), content: z.array(z.unknown()).optional() })
+  .passthrough()
+
+const statusCategorySchema = z.enum(['open', 'pending', 'on_hold', 'solved', 'closed'])
+
+const widgetPrioritySchema = z.enum(['low', 'normal', 'high', 'urgent'])
+
+const createSchema = z.object({
+  subject: z.string().min(1).max(500),
+  bodyJson: tiptapDocSchema.nullable().optional(),
+  bodyText: z.string().max(100_000).nullable().optional(),
+  priority: widgetPrioritySchema.optional(),
+  categoryKey: z.string().min(1).max(120).optional(),
+})
+
+interface SerializedTicketRow {
+  id: TicketId
+  subject: string
+  statusId: TicketStatusId
+  statusCategory: 'open' | 'pending' | 'on_hold' | 'solved' | 'closed'
+  statusName: string
+  statusColor: string | null
+  lastActivityAt: string
+  createdAt: string
+}
+
+async function hydrateStatuses(
+  rows: { statusId: TicketStatusId | null }[]
+): Promise<Map<TicketStatusId, { name: string; color: string | null; category: string }>> {
+  const ids = Array.from(
+    new Set(rows.map((r) => r.statusId).filter((id): id is TicketStatusId => !!id))
+  )
+  if (ids.length === 0) return new Map()
+  const statusRows = await db.query.ticketStatuses.findMany({
+    where: inArray(ticketStatuses.id, ids),
+  })
+  return new Map(
+    statusRows.map((s) => [
+      s.id as TicketStatusId,
+      { name: s.name, color: s.color ?? null, category: s.category as string },
+    ])
+  )
+}
+
+export async function handleListWidgetTickets({
+  request,
+}: {
+  request: Request
+}): Promise<Response> {
+  const disabled = await widgetTicketingGate()
+  if (disabled) return disabled
+  const session = await getWidgetSession(request)
+  if (!session) {
+    return widgetJsonError('AUTH_REQUIRED', 'Valid widget session required', 401)
+  }
+  if (session.principal.type === 'anonymous') {
+    return widgetJsonError(
+      'IDENTITY_REQUIRED',
+      'Identify the widget user before listing tickets',
+      403
+    )
+  }
+
+  const url = new URL(request.url)
+  const statusCategoryRaw = url.searchParams.get('statusCategory') ?? undefined
+  const limitRaw = url.searchParams.get('limit')
+  const offsetRaw = url.searchParams.get('offset')
+
+  const parsed = z
+    .object({
+      statusCategory: statusCategorySchema.optional(),
+      limit: z.coerce.number().int().min(1).max(50).optional(),
+      offset: z.coerce.number().int().min(0).optional(),
+    })
+    .safeParse({
+      statusCategory: statusCategoryRaw,
+      limit: limitRaw ?? undefined,
+      offset: offsetRaw ?? undefined,
+    })
+  if (!parsed.success) {
+    return widgetJsonError('VALIDATION_ERROR', 'Invalid query params', 400)
+  }
+
+  try {
+    const widgetContext = await getWidgetRequestContext(request)
+    const scopeFilters = widgetTicketListFilters(widgetContext)
+
+    const { rows, total } = await listTicketsForPortalUser({
+      userId: session.user.id as UserId,
+      statusCategory: parsed.data.statusCategory,
+      limit: parsed.data.limit,
+      offset: parsed.data.offset,
+      ...scopeFilters,
+    })
+
+    const statusById = await hydrateStatuses(
+      rows.map((r) => ({ statusId: r.statusId as TicketStatusId | null }))
+    )
+
+    const serialized: SerializedTicketRow[] = rows.map((r) => {
+      const s = r.statusId ? statusById.get(r.statusId as TicketStatusId) : undefined
+      return {
+        id: r.id as TicketId,
+        subject: r.subject,
+        statusId: r.statusId as TicketStatusId,
+        statusCategory: (s?.category ?? 'open') as SerializedTicketRow['statusCategory'],
+        statusName: s?.name ?? 'Unknown',
+        statusColor: s?.color ?? null,
+        lastActivityAt: r.lastActivityAt.toISOString(),
+        createdAt: r.createdAt.toISOString(),
+      }
+    })
+
+    return Response.json({ data: { rows: serialized, total } }, { headers: widgetCorsHeaders() })
+  } catch (err) {
+    const mapped = mapDomainErrorToResponse(err)
+    if (mapped) return mapped
+    console.error('[widget:tickets] list error', err)
+    return widgetJsonError('SERVER_ERROR', 'Failed to list tickets', 500)
+  }
+}
+
+export async function handleCreateWidgetTicket({
+  request,
+}: {
+  request: Request
+}): Promise<Response> {
+  const disabled = await widgetTicketingGate()
+  if (disabled) return disabled
+  const session = await getWidgetSession(request)
+  if (!session) {
+    return widgetJsonError('AUTH_REQUIRED', 'Valid widget session required', 401)
+  }
+  if (session.principal.type === 'anonymous') {
+    return widgetJsonError(
+      'IDENTITY_REQUIRED',
+      'Identify the widget user before creating a ticket',
+      403
+    )
+  }
+
+  let body: z.infer<typeof createSchema>
+  try {
+    const raw = await request.json()
+    body = createSchema.parse(raw)
+  } catch {
+    return widgetJsonError('VALIDATION_ERROR', 'Invalid request body', 400)
+  }
+
+  try {
+    const widgetContext = await getWidgetRequestContext(request)
+    const visibleCategories = visibleWidgetSupportCategories(widgetContext)
+    const selectedCategory =
+      visibleCategories.length === 1
+        ? visibleCategories[0]
+        : visibleCategories.find((category) => category.categoryKey === body.categoryKey)
+
+    if (visibleCategories.length > 1 && !body.categoryKey) {
+      return widgetJsonError('SUPPORT_CATEGORY_REQUIRED', 'Select a support category', 400)
+    }
+    if (body.categoryKey && !selectedCategory) {
+      return widgetJsonError(
+        'SUPPORT_CATEGORY_NOT_ALLOWED',
+        'Support category is not available',
+        400
+      )
+    }
+
+    const inbox = selectedCategory
+      ? await db.query.inboxes.findFirst({
+          where: eq(inboxes.id, selectedCategory.inboxId),
+        })
+      : null
+    if (selectedCategory && !inbox) {
+      return widgetJsonError('SUPPORT_INBOX_NOT_FOUND', 'Support inbox is not available', 400)
+    }
+
+    const allowedPriorities = selectedCategory?.allowedPriorities?.length
+      ? selectedCategory.allowedPriorities
+      : selectedCategory
+        ? (['low', 'normal', 'high', 'urgent'] as TicketPriority[])
+        : (['low', 'normal', 'high'] as TicketPriority[])
+    const priorityAllowed = new Set<TicketPriority>(allowedPriorities as TicketPriority[])
+    if (body.priority && !priorityAllowed.has(body.priority)) {
+      return widgetJsonError('TICKET_PRIORITY_NOT_ALLOWED', 'Priority is not available', 400)
+    }
+    const priority =
+      body.priority ??
+      (selectedCategory?.defaultPriority && priorityAllowed.has(selectedCategory.defaultPriority)
+        ? selectedCategory.defaultPriority
+        : inbox?.defaultPriority && priorityAllowed.has(inbox.defaultPriority)
+          ? inbox.defaultPriority
+          : (allowedPriorities[0] as TicketPriority | undefined)) ??
+      'normal'
+
+    const ticket = await createTicket({
+      subject: body.subject,
+      descriptionJson: (body.bodyJson ?? null) as TiptapContent | null,
+      descriptionText: body.bodyText ?? null,
+      priority,
+      channel: 'widget',
+      inboxId: selectedCategory?.inboxId ?? null,
+      statusId: (inbox?.defaultStatusId as TicketStatusId | null | undefined) ?? undefined,
+      primaryTeamId: inbox?.primaryTeamId ?? undefined,
+      visibilityScope: inbox?.defaultVisibilityScope ?? undefined,
+      sourceWidgetProfileId: widgetContext.profileId ?? null,
+      requesterPrincipalId: session.principal.id,
+      createdByPrincipalId: session.principal.id,
+    })
+
+    // Create an initial public thread for attachment storage during creation flow
+    const { addThread } = await import('@/lib/server/domains/tickets')
+    const initialThread = await addThread({
+      ticketId: ticket.id,
+      principalId: session.principal.id,
+      audience: 'public',
+      bodyText: '[Attachments added at ticket creation]',
+    })
+
+    const status = ticket.statusId
+      ? await db.query.ticketStatuses.findFirst({
+          where: eq(ticketStatuses.id, ticket.statusId),
+        })
+      : undefined
+
+    return Response.json(
+      {
+        data: {
+          id: ticket.id as TicketId,
+          subject: ticket.subject,
+          statusId: ticket.statusId as TicketStatusId,
+          statusCategory: (status?.category ?? 'open') as SerializedTicketRow['statusCategory'],
+          statusName: status?.name ?? 'Unknown',
+          statusColor: status?.color ?? null,
+          createdAt: ticket.createdAt.toISOString(),
+          lastActivityAt: ticket.lastActivityAt.toISOString(),
+          initialThreadId: initialThread.id,
+        },
+      },
+      { headers: widgetCorsHeaders() }
+    )
+  } catch (err) {
+    const mapped = mapDomainErrorToResponse(err)
+    if (mapped) return mapped
+    console.error('[widget:tickets] create error', err)
+    return widgetJsonError('SERVER_ERROR', 'Failed to create ticket', 500)
+  }
+}
+
+export const Route = createFileRoute('/api/widget/tickets')({
+  server: {
+    handlers: {
+      GET: handleListWidgetTickets,
+      POST: handleCreateWidgetTicket,
+    },
+  },
+})
diff --git a/apps/web/src/routes/oauth/__tests__/consent.gap.test.tsx b/apps/web/src/routes/oauth/__tests__/consent.gap.test.tsx
new file mode 100644
index 000000000..73601ba5e
--- /dev/null
+++ b/apps/web/src/routes/oauth/__tests__/consent.gap.test.tsx
@@ -0,0 +1,58 @@
+// @vitest-environment happy-dom
+/**
+ * Differential-coverage test for the OAuth consent page — groupScopes (scope →
+ * read/write/manage group mapping) and the loaded-state permission rows.
+ */
+import type { ReactNode } from 'react'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { render, screen, waitFor } from '@testing-library/react'
+
+const routeData = vi.hoisted(() => ({ useSearch: vi.fn() }))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (cfg: unknown) => ({ options: cfg, useSearch: routeData.useSearch }),
+}))
+vi.mock('@/components/ui/button', () => ({
+  Button: ({ children }: { children: ReactNode }) => <button type="button">{children}</button>,
+}))
+vi.mock('lucide-react', () => ({
+  ExternalLink: () => null,
+  Globe: () => null,
+  ShieldCheck: () => null,
+}))
+
+const { Route } = await import('../consent')
+const ConsentPage = (Route as unknown as { options: { component: () => ReactNode } }).options
+  .component
+
+beforeEach(() => {
+  vi.restoreAllMocks()
+  routeData.useSearch.mockReturnValue({
+    client_id: 'client_1',
+    scope: 'read:feedback write:feedback openid offline_access',
+  })
+})
+afterEach(() => vi.restoreAllMocks())
+
+describe('ConsentPage', () => {
+  it('maps scopes into permission groups and renders them once the client loads', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({ client_name: 'My App', client_uri: 'https://app.example.com' }),
+        { status: 200 }
+      )
+    )
+    render(<ConsentPage />)
+    // groupScopes ran during render — Feedback group (read+write) is shown after load
+    await waitFor(() => expect(screen.getByText('My App')).toBeInTheDocument())
+    expect(screen.getByText('Feedback')).toBeInTheDocument()
+    expect(screen.getByText('Read')).toBeInTheDocument()
+    expect(screen.getByText('Write')).toBeInTheDocument()
+  })
+
+  it('handles a client fetch failure by rendering the fallback name', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(new Response('nope', { status: 500 }))
+    render(<ConsentPage />)
+    await waitFor(() => expect(screen.getByText('An application')).toBeInTheDocument())
+  })
+})
diff --git a/apps/web/src/routes/oauth/consent.tsx b/apps/web/src/routes/oauth/consent.tsx
index fc1c37159..6dd7a3cf5 100644
--- a/apps/web/src/routes/oauth/consent.tsx
+++ b/apps/web/src/routes/oauth/consent.tsx
@@ -49,12 +49,19 @@ interface ScopeGroup {
   description: string
   read: boolean
   write: boolean
+  manage: boolean
 }
 
 function groupScopes(scopes: string[]): ScopeGroup[] {
   const scopeSet = new Set(scopes)
 
-  const groups: { read?: string; write?: string; label: string; description: string }[] = [
+  const groups: {
+    read?: string
+    write?: string
+    manage?: string
+    label: string
+    description: string
+  }[] = [
     {
       read: 'read:feedback',
       write: 'write:feedback',
@@ -72,6 +79,19 @@ function groupScopes(scopes: string[]): ScopeGroup[] {
       label: 'Help Center',
       description: 'Categories and articles',
     },
+    {
+      read: 'read:tickets',
+      write: 'write:tickets',
+      manage: 'manage:tickets',
+      label: 'Tickets',
+      description: 'Tickets, threads, participants, and shares',
+    },
+    {
+      read: 'read:contacts',
+      write: 'write:contacts',
+      label: 'Contacts',
+      description: 'Contacts and customer organizations',
+    },
     {
       read: 'read:chat',
       write: 'write:chat',
@@ -86,8 +106,9 @@ function groupScopes(scopes: string[]): ScopeGroup[] {
       description: g.description,
       read: g.read ? scopeSet.has(g.read) : false,
       write: g.write ? scopeSet.has(g.write) : false,
+      manage: g.manage ? scopeSet.has(g.manage) : false,
     }))
-    .filter((g) => g.read || g.write)
+    .filter((g) => g.read || g.write || g.manage)
 }
 
 const HIDDEN_SCOPES = new Set(['openid', 'profile', 'email', 'offline_access'])
@@ -245,6 +266,11 @@ function ConsentPage() {
                       Write
                     </span>
                   )}
+                  {group.manage && (
+                    <span className="text-[11px] font-medium text-muted-foreground/80 border border-border/50 rounded-md px-1.5 py-0.5">
+                      Manage
+                    </span>
+                  )}
                 </div>
               </div>
             ))}
diff --git a/apps/web/src/routes/onboarding/__tests__/onboarding-step.test.ts b/apps/web/src/routes/onboarding/__tests__/onboarding-step.test.ts
index 6e86bd8ee..8c6d4da47 100644
--- a/apps/web/src/routes/onboarding/__tests__/onboarding-step.test.ts
+++ b/apps/web/src/routes/onboarding/__tests__/onboarding-step.test.ts
@@ -22,6 +22,7 @@ describe('pickOnboardingStep', () => {
         state: {
           setupState: {
             version: 1,
+            source: 'self-hosted',
             useCase: 'saas',
             steps: { core: false, workspace: true, boards: false },
           },
@@ -38,6 +39,7 @@ describe('pickOnboardingStep', () => {
         state: {
           setupState: {
             version: 1,
+            source: 'self-hosted',
             useCase: 'saas',
             steps: { core: false, workspace: false, boards: false },
           },
@@ -60,6 +62,7 @@ describe('pickOnboardingStep', () => {
         state: {
           setupState: {
             version: 1,
+            source: 'self-hosted',
             steps: { core: true, workspace: true, boards: false },
           },
           principalRecord: { id: 'p1', role: 'admin' },
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index aefee4526..91d144263 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -65,6 +65,7 @@ export default defineConfig(({ mode }) => {
       __BUILD_TIME__: JSON.stringify(buildInfo.buildTime),
     },
     server: {
+      host: process.env.NITRO_HOST || undefined,
       port: Number(process.env.PORT || 3000),
       cors: mode === 'development',
       allowedHosts: true,
diff --git a/bun.lock b/bun.lock
index 1fd008b3f..1fe8ef3c4 100644
--- a/bun.lock
+++ b/bun.lock
@@ -9,15 +9,15 @@
         "@codemirror/language": "^6.12.3",
         "@codemirror/view": "^6.41.0",
         "@lezer/highlight": "^1.2.3",
-        "@tiptap/extension-image": "^3.22.3",
-        "@tiptap/extension-mention": "^3.22.3",
-        "@tiptap/extension-table": "^3.22.3",
-        "@tiptap/extension-table-cell": "^3.22.3",
-        "@tiptap/extension-table-header": "^3.22.3",
-        "@tiptap/extension-table-row": "^3.22.3",
-        "@tiptap/extension-task-item": "^3.22.3",
-        "@tiptap/extension-task-list": "^3.22.3",
-        "@tiptap/extension-underline": "^3.22.3",
+        "@tiptap/extension-image": "3.23.4",
+        "@tiptap/extension-mention": "3.23.4",
+        "@tiptap/extension-table": "3.23.4",
+        "@tiptap/extension-table-cell": "3.23.4",
+        "@tiptap/extension-table-header": "3.23.4",
+        "@tiptap/extension-table-row": "3.23.4",
+        "@tiptap/extension-task-item": "3.23.4",
+        "@tiptap/extension-task-list": "3.23.4",
+        "@tiptap/extension-underline": "3.23.4",
         "@uiw/codemirror-extensions-color": "^4.25.9",
         "@uiw/react-codemirror": "^4.25.9",
         "cmdk": "^1.1.1",
@@ -27,6 +27,7 @@
         "@eslint/js": "^10.0.1",
         "@testing-library/jest-dom": "^6.9.1",
         "@types/node": "^25.6.0",
+        "@vitest/coverage-v8": "4.1.9",
         "dotenv-cli": "^11.0.0",
         "eslint": "^10.2.1",
         "eslint-config-prettier": "^10.1.8",
@@ -44,7 +45,7 @@
     },
     "apps/web": {
       "name": "@quackback/web",
-      "version": "0.12.2",
+      "version": "0.12.3",
       "dependencies": {
         "@aws-sdk/client-s3": "^3.1032.0",
         "@aws-sdk/s3-request-presigner": "^3.1032.0",
@@ -89,27 +90,28 @@
         "@tanstack/react-start": "^1.168.25",
         "@tanstack/react-table": "^8.21.3",
         "@tanstack/react-virtual": "^3.13.26",
-        "@tiptap/core": "^3.22.3",
-        "@tiptap/extension-bubble-menu": "^3.22.3",
-        "@tiptap/extension-code-block-lowlight": "^3.22.3",
-        "@tiptap/extension-emoji": "3.22.3",
-        "@tiptap/extension-image": "^3.22.3",
-        "@tiptap/extension-link": "^3.22.3",
-        "@tiptap/extension-mention": "3.22.3",
-        "@tiptap/extension-placeholder": "^3.22.3",
-        "@tiptap/extension-table": "^3.22.3",
-        "@tiptap/extension-table-cell": "^3.22.3",
-        "@tiptap/extension-table-header": "^3.22.3",
-        "@tiptap/extension-table-row": "^3.22.3",
-        "@tiptap/extension-task-item": "^3.22.3",
-        "@tiptap/extension-task-list": "^3.22.3",
-        "@tiptap/extension-underline": "^3.22.3",
-        "@tiptap/extension-youtube": "^3.22.3",
-        "@tiptap/markdown": "^3.22.3",
-        "@tiptap/pm": "^3.22.3",
-        "@tiptap/react": "^3.22.3",
-        "@tiptap/starter-kit": "^3.22.3",
-        "@tiptap/suggestion": "^3.22.3",
+        "@tanstack/start": "^1.120.20",
+        "@tiptap/core": "3.23.4",
+        "@tiptap/extension-bubble-menu": "3.23.4",
+        "@tiptap/extension-code-block-lowlight": "3.23.4",
+        "@tiptap/extension-emoji": "3.23.4",
+        "@tiptap/extension-image": "3.23.4",
+        "@tiptap/extension-link": "3.23.4",
+        "@tiptap/extension-mention": "3.23.4",
+        "@tiptap/extension-placeholder": "3.23.4",
+        "@tiptap/extension-table": "3.23.4",
+        "@tiptap/extension-table-cell": "3.23.4",
+        "@tiptap/extension-table-header": "3.23.4",
+        "@tiptap/extension-table-row": "3.23.4",
+        "@tiptap/extension-task-item": "3.23.4",
+        "@tiptap/extension-task-list": "3.23.4",
+        "@tiptap/extension-underline": "3.23.4",
+        "@tiptap/extension-youtube": "3.23.4",
+        "@tiptap/markdown": "3.23.4",
+        "@tiptap/pm": "3.23.4",
+        "@tiptap/react": "3.23.4",
+        "@tiptap/starter-kit": "3.23.4",
+        "@tiptap/suggestion": "3.23.4",
         "bcryptjs": "^3.0.3",
         "better-auth": "^1.6.16",
         "bullmq": "^5.74.1",
@@ -229,7 +231,7 @@
     },
     "packages/widget": {
       "name": "@quackback/widget",
-      "version": "0.1.5",
+      "version": "0.2.1",
       "devDependencies": {
         "@testing-library/dom": "^10.4.1",
         "@testing-library/react": "^16.3.2",
@@ -264,11 +266,32 @@
     "@codemirror/state": "6.6.0",
     "@noble/ciphers": "2.0.0",
     "@tiptap/core": "3.23.4",
+    "@tiptap/extension-blockquote": "3.23.4",
+    "@tiptap/extension-bold": "3.23.4",
+    "@tiptap/extension-bullet-list": "3.23.4",
+    "@tiptap/extension-code": "3.23.4",
+    "@tiptap/extension-code-block": "3.23.4",
+    "@tiptap/extension-document": "3.23.4",
+    "@tiptap/extension-dropcursor": "3.23.4",
+    "@tiptap/extension-floating-menu": "3.23.4",
+    "@tiptap/extension-gapcursor": "3.23.4",
+    "@tiptap/extension-hard-break": "3.23.4",
+    "@tiptap/extension-heading": "3.23.4",
+    "@tiptap/extension-horizontal-rule": "3.23.4",
+    "@tiptap/extension-italic": "3.23.4",
+    "@tiptap/extension-list": "3.23.4",
+    "@tiptap/extension-list-item": "3.23.4",
+    "@tiptap/extension-list-keymap": "3.23.4",
+    "@tiptap/extension-ordered-list": "3.23.4",
+    "@tiptap/extension-paragraph": "3.23.4",
+    "@tiptap/extension-strike": "3.23.4",
+    "@tiptap/extension-text": "3.23.4",
+    "@tiptap/extensions": "3.23.4",
     "@tiptap/pm": "3.23.4",
     "@tiptap/suggestion": "3.23.4",
   },
   "packages": {
-    "@adobe/css-tools": ["@adobe/css-tools@4.4.4", "", {}, "sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg=="],
+    "@adobe/css-tools": ["@adobe/css-tools@4.5.0", "", {}, "sha512-6OzddxPio9UiWTCemp4N8cYLV2ZN1ncRnV1cVGtve7dhPOtRkleRyx32GQCYSwDYgaHU3USMm84tNsvKzRCa1Q=="],
 
     "@aws-crypto/crc32": ["@aws-crypto/crc32@5.2.0", "", { "dependencies": { "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "tslib": "^2.6.2" } }, "sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg=="],
 
@@ -284,131 +307,135 @@
 
     "@aws-crypto/util": ["@aws-crypto/util@5.2.0", "", { "dependencies": { "@aws-sdk/types": "^3.222.0", "@smithy/util-utf8": "^2.0.0", "tslib": "^2.6.2" } }, "sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ=="],
 
-    "@aws-sdk/client-s3": ["@aws-sdk/client-s3@3.1032.0", "", { "dependencies": { "@aws-crypto/sha1-browser": "5.2.0", "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.974.1", "@aws-sdk/credential-provider-node": "^3.972.32", "@aws-sdk/middleware-bucket-endpoint": "^3.972.10", "@aws-sdk/middleware-expect-continue": "^3.972.10", "@aws-sdk/middleware-flexible-checksums": "^3.974.9", "@aws-sdk/middleware-host-header": "^3.972.10", "@aws-sdk/middleware-location-constraint": "^3.972.10", "@aws-sdk/middleware-logger": "^3.972.10", "@aws-sdk/middleware-recursion-detection": "^3.972.11", "@aws-sdk/middleware-sdk-s3": "^3.972.30", "@aws-sdk/middleware-ssec": "^3.972.10", "@aws-sdk/middleware-user-agent": "^3.972.31", "@aws-sdk/region-config-resolver": "^3.972.12", "@aws-sdk/signature-v4-multi-region": "^3.996.18", "@aws-sdk/types": "^3.973.8", "@aws-sdk/util-endpoints": "^3.996.7", "@aws-sdk/util-user-agent-browser": "^3.972.10", "@aws-sdk/util-user-agent-node": "^3.973.17", "@smithy/config-resolver": "^4.4.16", "@smithy/core": "^3.23.15", "@smithy/eventstream-serde-browser": "^4.2.14", "@smithy/eventstream-serde-config-resolver": "^4.3.14", "@smithy/eventstream-serde-node": "^4.2.14", "@smithy/fetch-http-handler": "^5.3.17", "@smithy/hash-blob-browser": "^4.2.15", "@smithy/hash-node": "^4.2.14", "@smithy/hash-stream-node": "^4.2.14", "@smithy/invalid-dependency": "^4.2.14", "@smithy/md5-js": "^4.2.14", "@smithy/middleware-content-length": "^4.2.14", "@smithy/middleware-endpoint": "^4.4.30", "@smithy/middleware-retry": "^4.5.3", "@smithy/middleware-serde": "^4.2.18", "@smithy/middleware-stack": "^4.2.14", "@smithy/node-config-provider": "^4.3.14", "@smithy/node-http-handler": "^4.5.3", "@smithy/protocol-http": "^5.3.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "@smithy/url-parser": "^4.2.14", "@smithy/util-base64": "^4.3.2", "@smithy/util-body-length-browser": "^4.2.2", "@smithy/util-body-length-node": "^4.2.3", "@smithy/util-defaults-mode-browser": "^4.3.47", "@smithy/util-defaults-mode-node": "^4.2.52", "@smithy/util-endpoints": "^3.4.1", "@smithy/util-middleware": "^4.2.14", "@smithy/util-retry": "^4.3.2", "@smithy/util-stream": "^4.5.23", "@smithy/util-utf8": "^4.2.2", "@smithy/util-waiter": "^4.2.16", "tslib": "^2.6.2" } }, "sha512-A1wjVhV3IgsZ5td2l4AWgK03EjZ+ldwbiorxuO1hPf7RHJtSdr6oq/gKzyUwP7Tm7ma/M2xS/tplg5C8XB8RWg=="],
+    "@aws-sdk/checksums": ["@aws-sdk/checksums@3.1000.6", "", { "dependencies": { "@aws-crypto/crc32": "5.2.0", "@aws-crypto/crc32c": "5.2.0", "@aws-crypto/util": "5.2.0", "@aws-sdk/core": "^3.974.21", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-RMCrCteiUwYTEv2G9zfP/BEuKHv57665vVieJyp9cf8VgilWxP/KrWVtMdfdDlIH8nFhvu3rIMc29z3ebGEZ1w=="],
 
-    "@aws-sdk/core": ["@aws-sdk/core@3.974.1", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@aws-sdk/xml-builder": "^3.972.18", "@smithy/core": "^3.23.15", "@smithy/node-config-provider": "^4.3.14", "@smithy/property-provider": "^4.2.14", "@smithy/protocol-http": "^5.3.14", "@smithy/signature-v4": "^5.3.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "@smithy/util-base64": "^4.3.2", "@smithy/util-middleware": "^4.2.14", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-gy/gffKz0zaHDaqRiLCdIvgHmaAL/HXuAtMcBP7euYSFx4BsbsdlfmUBJag+Gqe62z6/XuloKyQyaiH+kS3Vrg=="],
+    "@aws-sdk/client-s3": ["@aws-sdk/client-s3@3.1069.0", "", { "dependencies": { "@aws-crypto/sha1-browser": "5.2.0", "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.974.21", "@aws-sdk/credential-provider-node": "^3.972.56", "@aws-sdk/middleware-flexible-checksums": "^3.974.31", "@aws-sdk/middleware-sdk-s3": "^3.972.52", "@aws-sdk/signature-v4-multi-region": "^3.996.35", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/fetch-http-handler": "^5.4.6", "@smithy/node-http-handler": "^4.7.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-zkwCW4D88foQ0YHyjVyFhDOIWG+IWiTGXYg8+kUgH6M19son3OsZLvioZGyZdNtlRgLNYfQGBjfArSJOYYt2QQ=="],
 
-    "@aws-sdk/crc64-nvme": ["@aws-sdk/crc64-nvme@3.972.7", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-QUagVVBbC8gODCF6e1aV0mE2TXWB9Opz4k8EJFdNrujUVQm5R4AjJa1mpOqzwOuROBzqJU9zawzig7M96L8Ejg=="],
+    "@aws-sdk/core": ["@aws-sdk/core@3.974.21", "", { "dependencies": { "@aws-sdk/types": "^3.973.13", "@aws-sdk/xml-builder": "^3.972.30", "@aws/lambda-invoke-store": "^0.2.2", "@smithy/core": "^3.24.6", "@smithy/signature-v4": "^5.4.6", "@smithy/types": "^4.14.3", "bowser": "^2.11.0", "tslib": "^2.6.2" } }, "sha512-P5JAHvn4dTi96UsAGS67LVOqqpUNNRhnfFXqzCYtdBIGZtqBue4CXvRr9YenOO7PALj/Pn8uuyw53FBCiCYw8w=="],
 
-    "@aws-sdk/credential-provider-env": ["@aws-sdk/credential-provider-env@3.972.27", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/types": "^3.973.8", "@smithy/property-provider": "^4.2.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-xfUt2CUZDC+Tf16A6roD1b4pk/nrXdkoLY3TEhv198AXDtBo5xUJP1zd0e8SmuKLN4PpIBX96OizZbmMlcI6oQ=="],
+    "@aws-sdk/credential-provider-env": ["@aws-sdk/credential-provider-env@3.972.47", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-3YoPwJczcc+MtX2xxXaYaOOWO6xKUJr1ZIIDIFuninr51BYONVVcF/CP8K2xfVRC/PztJjqKWxNGFH7BWQAw1Q=="],
 
-    "@aws-sdk/credential-provider-http": ["@aws-sdk/credential-provider-http@3.972.29", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/types": "^3.973.8", "@smithy/fetch-http-handler": "^5.3.17", "@smithy/node-http-handler": "^4.5.3", "@smithy/property-provider": "^4.2.14", "@smithy/protocol-http": "^5.3.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "@smithy/util-stream": "^4.5.23", "tslib": "^2.6.2" } }, "sha512-hjNeYb6oLyHgMihra83ie0J/T2y9om3cy1qC90h9DRgvYXEoN4BCFf8bHguZjKhXunnv7YkmZRuYL5Mkk77eCA=="],
+    "@aws-sdk/credential-provider-http": ["@aws-sdk/credential-provider-http@3.972.49", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/fetch-http-handler": "^5.4.6", "@smithy/node-http-handler": "^4.7.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-2UtGUPy+x3lqyceHrtC1uEuVxBZbDalPF6KAFqBwYgm4edWdBrZKNnCqzDs7KynWUvEC6mrR+ojRk+ZgQz9C2w=="],
 
-    "@aws-sdk/credential-provider-ini": ["@aws-sdk/credential-provider-ini@3.972.31", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/credential-provider-env": "^3.972.27", "@aws-sdk/credential-provider-http": "^3.972.29", "@aws-sdk/credential-provider-login": "^3.972.31", "@aws-sdk/credential-provider-process": "^3.972.27", "@aws-sdk/credential-provider-sso": "^3.972.31", "@aws-sdk/credential-provider-web-identity": "^3.972.31", "@aws-sdk/nested-clients": "^3.996.21", "@aws-sdk/types": "^3.973.8", "@smithy/credential-provider-imds": "^4.2.14", "@smithy/property-provider": "^4.2.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-PuQ7e8WYzAPpzvFcajxf8c0LqSzakVHVlKw8M0oubk8Kf347YOCCqT1seQrHs5AdZuIh2RD9LX4O+Xa5ImEBfQ=="],
+    "@aws-sdk/credential-provider-ini": ["@aws-sdk/credential-provider-ini@3.972.54", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/credential-provider-env": "^3.972.47", "@aws-sdk/credential-provider-http": "^3.972.49", "@aws-sdk/credential-provider-login": "^3.972.53", "@aws-sdk/credential-provider-process": "^3.972.47", "@aws-sdk/credential-provider-sso": "^3.972.53", "@aws-sdk/credential-provider-web-identity": "^3.972.53", "@aws-sdk/nested-clients": "^3.997.21", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/credential-provider-imds": "^4.3.7", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-Hx4gO4YRjFwitf3MVl3cDwYe1aryJthC4txVl9b+JAURovA50M2ywf9r8j1E/Q6SCTPT4qQpjOAbKYIC9CG+Vw=="],
 
-    "@aws-sdk/credential-provider-login": ["@aws-sdk/credential-provider-login@3.972.31", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/nested-clients": "^3.996.21", "@aws-sdk/types": "^3.973.8", "@smithy/property-provider": "^4.2.14", "@smithy/protocol-http": "^5.3.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-bBmWDmtSpmLOZR6a0kmowBcVL1hiL8Vlap/RXeMpFd7JbWl87YcwqL6T9LH/0oBVEZXu1dUZAtojgSuZgMO5xw=="],
+    "@aws-sdk/credential-provider-login": ["@aws-sdk/credential-provider-login@3.972.53", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/nested-clients": "^3.997.21", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-+71sluhkgPqdhbbD3UDwUpj24GCkng9HQx6z7qoBFb8dwkF4ktpOcVKDeHpgg8PvBgLYwAnUYLTEGRC/PniCiQ=="],
 
-    "@aws-sdk/credential-provider-node": ["@aws-sdk/credential-provider-node@3.972.32", "", { "dependencies": { "@aws-sdk/credential-provider-env": "^3.972.27", "@aws-sdk/credential-provider-http": "^3.972.29", "@aws-sdk/credential-provider-ini": "^3.972.31", "@aws-sdk/credential-provider-process": "^3.972.27", "@aws-sdk/credential-provider-sso": "^3.972.31", "@aws-sdk/credential-provider-web-identity": "^3.972.31", "@aws-sdk/types": "^3.973.8", "@smithy/credential-provider-imds": "^4.2.14", "@smithy/property-provider": "^4.2.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-9aj0x9hGYUondBZSD0XkksAdHhOKttFw4BWpLCeggeg40qSJxGrAP++g0GCm0VqWc1WtC/NRFiAVzPCy56vmog=="],
+    "@aws-sdk/credential-provider-node": ["@aws-sdk/credential-provider-node@3.972.56", "", { "dependencies": { "@aws-sdk/credential-provider-env": "^3.972.47", "@aws-sdk/credential-provider-http": "^3.972.49", "@aws-sdk/credential-provider-ini": "^3.972.54", "@aws-sdk/credential-provider-process": "^3.972.47", "@aws-sdk/credential-provider-sso": "^3.972.53", "@aws-sdk/credential-provider-web-identity": "^3.972.53", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/credential-provider-imds": "^4.3.7", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-iI+4o0dvQQ4NHel4FMDiFy5q2gaU/ryLK3niOsoPccAt9WLFRkV4XTYPWRr9XvmBUqEzXG73S4p/8gm0Lu/W3A=="],
 
-    "@aws-sdk/credential-provider-process": ["@aws-sdk/credential-provider-process@3.972.27", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/types": "^3.973.8", "@smithy/property-provider": "^4.2.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-1CZvfb1WzudWWIFAVQkd1OI/T1RxPcSvNWzNsb2BMBVsBJzBtB8dV5f2nymHVU4UqwxipdVt/DAbgdDRf33JDg=="],
+    "@aws-sdk/credential-provider-process": ["@aws-sdk/credential-provider-process@3.972.47", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-tAizPm9IFo/PHn06c+LQJlzfY2AGOlyF0CUljFejrU6LcZBjnk8pmbZK3/xoIDdnIzjEdbClfvY3mXfr818ZEg=="],
 
-    "@aws-sdk/credential-provider-sso": ["@aws-sdk/credential-provider-sso@3.972.31", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/nested-clients": "^3.996.21", "@aws-sdk/token-providers": "3.1032.0", "@aws-sdk/types": "^3.973.8", "@smithy/property-provider": "^4.2.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-x8Mx18S48XMl9bEEpYwmXDTvjWGPIfDadReN37Lc099/DUrlL4Zs9T9rwwggo6DkKS1aev6v+MTUx7JTa87TZQ=="],
+    "@aws-sdk/credential-provider-sso": ["@aws-sdk/credential-provider-sso@3.972.53", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/nested-clients": "^3.997.21", "@aws-sdk/token-providers": "3.1069.0", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-pUXE3fu4tfEDV8BksIgf4dXvuIH10FhwHMl/wu8rBD5T1sMpryQWFVitH3kdPS90wlgrGYJQ/meQTSPacyZfeg=="],
 
-    "@aws-sdk/credential-provider-web-identity": ["@aws-sdk/credential-provider-web-identity@3.972.31", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/nested-clients": "^3.996.21", "@aws-sdk/types": "^3.973.8", "@smithy/property-provider": "^4.2.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-zfuNMIkGfjYsHis9qytYf74Bcmq6Ji9Xwf4w53baRCI/b2otTwZv3SW1uRiJ5Di7999QzRGhHZ96+eUeo3gSOA=="],
+    "@aws-sdk/credential-provider-web-identity": ["@aws-sdk/credential-provider-web-identity@3.972.53", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/nested-clients": "^3.997.21", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-JmMGlhVvSj8uSG9CpeDkJAXT35H89tc6v84iMgEIE75q4yp1MKVVKvopv6Gg28HJIR7hMNkojRF8H2m5W44wyg=="],
 
-    "@aws-sdk/middleware-bucket-endpoint": ["@aws-sdk/middleware-bucket-endpoint@3.972.10", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@aws-sdk/util-arn-parser": "^3.972.3", "@smithy/node-config-provider": "^4.3.14", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "@smithy/util-config-provider": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-Vbc2frZH7wXlMNd+ZZSXUEs/l1Sv8Jj4zUnIfwrYF5lwaLdXHZ9xx4U3rjUcaye3HRhFVc+E5DbBxpRAbB16BA=="],
+    "@aws-sdk/middleware-flexible-checksums": ["@aws-sdk/middleware-flexible-checksums@3.974.31", "", { "dependencies": { "@aws-sdk/checksums": "^3.1000.6", "tslib": "^2.6.2" } }, "sha512-Yzj6NRYVZdBaCp7o1BwHGyeDBfixdeToLIAMprshIITEdl9wKVSiidVOfeaiH8FyeC1hBmBfDZFvs/aH1Y3xpw=="],
 
-    "@aws-sdk/middleware-expect-continue": ["@aws-sdk/middleware-expect-continue@3.972.10", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-2Yn0f1Qiq/DjxYR3wfI3LokXnjOhFM7Ssn4LTdFDIxRMCE6I32MAsVnhPX1cUZsuVA9tiZtwwhlSLAtFGxAZlQ=="],
+    "@aws-sdk/middleware-sdk-s3": ["@aws-sdk/middleware-sdk-s3@3.972.52", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/signature-v4-multi-region": "^3.996.35", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-rerjP08onRqkBh0AcCqip6GkKvESapmLoTgi1xysZ4C6a1xMrIMtTBcEbUb6EY71oeajnigeUD4KwZjtIO+aWQ=="],
 
-    "@aws-sdk/middleware-flexible-checksums": ["@aws-sdk/middleware-flexible-checksums@3.974.9", "", { "dependencies": { "@aws-crypto/crc32": "5.2.0", "@aws-crypto/crc32c": "5.2.0", "@aws-crypto/util": "5.2.0", "@aws-sdk/core": "^3.974.1", "@aws-sdk/crc64-nvme": "^3.972.7", "@aws-sdk/types": "^3.973.8", "@smithy/is-array-buffer": "^4.2.2", "@smithy/node-config-provider": "^4.3.14", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "@smithy/util-middleware": "^4.2.14", "@smithy/util-stream": "^4.5.23", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-ye6xVuMEQ5NCT+yQOryGYsuCXnOwu7iGFGzV+qpXZOWtqXIAAaFostapxj6RCubw36rekVwmdB2lcspFuyNfYQ=="],
+    "@aws-sdk/nested-clients": ["@aws-sdk/nested-clients@3.997.21", "", { "dependencies": { "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.974.21", "@aws-sdk/signature-v4-multi-region": "^3.996.35", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/fetch-http-handler": "^5.4.6", "@smithy/node-http-handler": "^4.7.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-eC7Vl7Qom/BGhZjG9GEqPwdQ/fk45hg1t5LP4EUxG5d1fdshLbaxCiwh/tszUzDX/4mW40mu2QsbeJJRPBbqUw=="],
 
-    "@aws-sdk/middleware-host-header": ["@aws-sdk/middleware-host-header@3.972.10", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-IJSsIMeVQ8MMCPbuh1AbltkFhLBLXn7aejzfX5YKT/VLDHn++Dcz8886tXckE+wQssyPUhaXrJhdakO2VilRhg=="],
+    "@aws-sdk/s3-request-presigner": ["@aws-sdk/s3-request-presigner@3.1069.0", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/signature-v4-multi-region": "^3.996.35", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-/s8zMe/C4bLLilx8Jlh3neN2sbaGmQTdi5dxu/GG1D9wlg+3MDemqyzYy9Gi1W2m/iD2+qf6kEpNk97qEEBcZA=="],
 
-    "@aws-sdk/middleware-location-constraint": ["@aws-sdk/middleware-location-constraint@3.972.10", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-rI3NZvJcEvjoD0+0PI0iUAwlPw2IlSlhyvgBK/3WkKJQE/YiKFedd9dMN2lVacdNxPNhxL/jzQaKQdrGtQagjQ=="],
+    "@aws-sdk/signature-v4-multi-region": ["@aws-sdk/signature-v4-multi-region@3.996.35", "", { "dependencies": { "@aws-sdk/types": "^3.973.13", "@smithy/signature-v4": "^5.4.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-6L/VWs+Wch2stHemCGTmUNqKLMzURxQDK5boNG3Jn3kAOp71meDUuS5sbObpEvFxHDq0uWeSLFDNSYsjNt+Dlg=="],
 
-    "@aws-sdk/middleware-logger": ["@aws-sdk/middleware-logger@3.972.10", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-OOuGvvz1Dm20SjZo5oEBePFqxt5nf8AwkNDSyUHvD9/bfNASmstcYxFAHUowy4n6Io7mWUZ04JURZwSBvyQanQ=="],
+    "@aws-sdk/token-providers": ["@aws-sdk/token-providers@3.1069.0", "", { "dependencies": { "@aws-sdk/core": "^3.974.21", "@aws-sdk/nested-clients": "^3.997.21", "@aws-sdk/types": "^3.973.13", "@smithy/core": "^3.24.6", "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-ks4X+kngC3PA5howV7Qu1TgG4bfC4jPykKdvw3nmBSXR9yZxRJouBholFSNQ5kY3L+Fgwyw+LCjzQmNi+KR91g=="],
 
-    "@aws-sdk/middleware-recursion-detection": ["@aws-sdk/middleware-recursion-detection@3.972.11", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@aws/lambda-invoke-store": "^0.2.2", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-+zz6f79Kj9V5qFK2P+D8Ehjnw4AhphAlCAsPjUqEcInA9umtSSKMrHbSagEeOIsDNuvVrH98bjRHcyQukTrhaQ=="],
+    "@aws-sdk/types": ["@aws-sdk/types@3.973.13", "", { "dependencies": { "@smithy/types": "^4.14.3", "tslib": "^2.6.2" } }, "sha512-pEHZqRkAlHfnfAU9tK+WpKv/gBNjGJrHMgA3A0iYRGyswBS2t0pfez+lWlwktb3Bqa0ovh7w/QJTFwp3fDxLNg=="],
 
-    "@aws-sdk/middleware-sdk-s3": ["@aws-sdk/middleware-sdk-s3@3.972.30", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/types": "^3.973.8", "@aws-sdk/util-arn-parser": "^3.972.3", "@smithy/core": "^3.23.15", "@smithy/node-config-provider": "^4.3.14", "@smithy/protocol-http": "^5.3.14", "@smithy/signature-v4": "^5.3.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "@smithy/util-config-provider": "^4.2.2", "@smithy/util-middleware": "^4.2.14", "@smithy/util-stream": "^4.5.23", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-hoQRxjJu4tt3gEOQin21rJKotClJC+x7AmCh9ylRct1DJeaNI/BRlFxMbuhJe54bG6xANPagSs0my8K30QyV9g=="],
+    "@aws-sdk/util-locate-window": ["@aws-sdk/util-locate-window@3.965.8", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-uUbMs1cBZPafD0ohUj6EwNf0fPZ534NvBxHox4hjX+0Rxq5paSYUem7+hi833pYrzrcnBATKIYpR02MDXT5M9g=="],
 
-    "@aws-sdk/middleware-ssec": ["@aws-sdk/middleware-ssec@3.972.10", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-Gli9A0u8EVVb+5bFDGS/QbSVg28w/wpEidg1ggVcSj65BDTdGR6punsOcVjqdiu1i42WHWo51MCvARPIIz9juw=="],
+    "@aws-sdk/xml-builder": ["@aws-sdk/xml-builder@3.972.30", "", { "dependencies": { "@smithy/types": "^4.14.3", "fast-xml-parser": "5.7.3", "tslib": "^2.6.2" } }, "sha512-StElZPEoBquWwNqw1AcfpzEyZqJvFxouG+mpDNYlcH6ZOrqd2CuIryv+8LV8gNHZUOyKyJF3Dq9vxaXEmDR9TQ=="],
 
-    "@aws-sdk/middleware-user-agent": ["@aws-sdk/middleware-user-agent@3.972.31", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/types": "^3.973.8", "@aws-sdk/util-endpoints": "^3.996.7", "@smithy/core": "^3.23.15", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "@smithy/util-retry": "^4.3.2", "tslib": "^2.6.2" } }, "sha512-L+hXN2HDomlIsWSHW5DVD7ppccCeRnlHXZ5uHG34ePTjF5bm0I1fmrJLbUGiW97xRXWryit5cjdP4Sx2FwiGog=="],
+    "@aws/lambda-invoke-store": ["@aws/lambda-invoke-store@0.2.4", "", {}, "sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ=="],
 
-    "@aws-sdk/nested-clients": ["@aws-sdk/nested-clients@3.996.21", "", { "dependencies": { "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.974.1", "@aws-sdk/middleware-host-header": "^3.972.10", "@aws-sdk/middleware-logger": "^3.972.10", "@aws-sdk/middleware-recursion-detection": "^3.972.11", "@aws-sdk/middleware-user-agent": "^3.972.31", "@aws-sdk/region-config-resolver": "^3.972.12", "@aws-sdk/types": "^3.973.8", "@aws-sdk/util-endpoints": "^3.996.7", "@aws-sdk/util-user-agent-browser": "^3.972.10", "@aws-sdk/util-user-agent-node": "^3.973.17", "@smithy/config-resolver": "^4.4.16", "@smithy/core": "^3.23.15", "@smithy/fetch-http-handler": "^5.3.17", "@smithy/hash-node": "^4.2.14", "@smithy/invalid-dependency": "^4.2.14", "@smithy/middleware-content-length": "^4.2.14", "@smithy/middleware-endpoint": "^4.4.30", "@smithy/middleware-retry": "^4.5.3", "@smithy/middleware-serde": "^4.2.18", "@smithy/middleware-stack": "^4.2.14", "@smithy/node-config-provider": "^4.3.14", "@smithy/node-http-handler": "^4.5.3", "@smithy/protocol-http": "^5.3.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "@smithy/url-parser": "^4.2.14", "@smithy/util-base64": "^4.3.2", "@smithy/util-body-length-browser": "^4.2.2", "@smithy/util-body-length-node": "^4.2.3", "@smithy/util-defaults-mode-browser": "^4.3.47", "@smithy/util-defaults-mode-node": "^4.2.52", "@smithy/util-endpoints": "^3.4.1", "@smithy/util-middleware": "^4.2.14", "@smithy/util-retry": "^4.3.2", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-Me3d/ua2lb2G0bQfFmvCeQQp3+nN6GSPqMxDmi/IQlQ8CrlpQ5C0JJHpz2AnOUkEFI0lBNrAL3Vnt29l44ndkA=="],
+    "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
 
-    "@aws-sdk/region-config-resolver": ["@aws-sdk/region-config-resolver@3.972.12", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/config-resolver": "^4.4.16", "@smithy/node-config-provider": "^4.3.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-QQI43Mxd53nBij0pm8HXC+t4IOC6gnhhZfzxE0OATQyO6QfPV4e+aTIRRuAJKA6Nig/cR8eLwPryqYTX9ZrjAQ=="],
+    "@babel/compat-data": ["@babel/compat-data@7.29.7", "", {}, "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg=="],
 
-    "@aws-sdk/s3-request-presigner": ["@aws-sdk/s3-request-presigner@3.1032.0", "", { "dependencies": { "@aws-sdk/signature-v4-multi-region": "^3.996.18", "@aws-sdk/types": "^3.973.8", "@aws-sdk/util-format-url": "^3.972.10", "@smithy/middleware-endpoint": "^4.4.30", "@smithy/protocol-http": "^5.3.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-LFaI5JQhiOmJDjKK02ir9oERU9AmxdyEvzv332oPDzAzWeNH06sZ1WsF3xRBBE5tbEH2jIc79N8EqDCY0s5kKQ=="],
+    "@babel/core": ["@babel/core@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-module-transforms": "^7.29.7", "@babel/helpers": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA=="],
 
-    "@aws-sdk/signature-v4-multi-region": ["@aws-sdk/signature-v4-multi-region@3.996.18", "", { "dependencies": { "@aws-sdk/middleware-sdk-s3": "^3.972.30", "@aws-sdk/types": "^3.973.8", "@smithy/protocol-http": "^5.3.14", "@smithy/signature-v4": "^5.3.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-4KT8UXRmvNAP5zKq9UI1MIwbnmSChZncBt89RKu/skMqZSSWGkBZTAJsZ+no+txfmF3kVaUFv31CTBZkQ5BJpQ=="],
+    "@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
 
-    "@aws-sdk/token-providers": ["@aws-sdk/token-providers@3.1032.0", "", { "dependencies": { "@aws-sdk/core": "^3.974.1", "@aws-sdk/nested-clients": "^3.996.21", "@aws-sdk/types": "^3.973.8", "@smithy/property-provider": "^4.2.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-n+PU8Z+gll7p3wDrH+Wo6fkt8sPrVnq30YYM6Ryga95oJlEneNMEbDHj0iqjMX3V7gaGdJo/hJWyPo4lscP+mA=="],
+    "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw=="],
 
-    "@aws-sdk/types": ["@aws-sdk/types@3.973.8", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-gjlAdtHMbtR9X5iIhVUvbVcy55KnznpC6bkDUWW9z915bi0ckdUr5cjf16Kp6xq0bP5HBD2xzgbL9F9Quv5vUw=="],
+    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.29.7", "", { "dependencies": { "@babel/compat-data": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g=="],
 
-    "@aws-sdk/util-arn-parser": ["@aws-sdk/util-arn-parser@3.972.3", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-HzSD8PMFrvgi2Kserxuff5VitNq2sgf3w9qxmskKDiDTThWfVteJxuCS9JXiPIPtmCrp+7N9asfIaVhBFORllA=="],
+    "@babel/helper-create-class-features-plugin": ["@babel/helper-create-class-features-plugin@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/helper-replace-supers": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/traverse": "^7.29.7", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg=="],
 
-    "@aws-sdk/util-endpoints": ["@aws-sdk/util-endpoints@3.996.7", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/types": "^4.14.1", "@smithy/url-parser": "^4.2.14", "@smithy/util-endpoints": "^3.4.1", "tslib": "^2.6.2" } }, "sha512-ty4LQxN1QC+YhUP28NfEgZDEGXkyqOQy+BDriBozqHsrYO4JMgiPhfizqOGF7P+euBTZ5Ez6SKlLAMCLo8tzmw=="],
+    "@babel/helper-globals": ["@babel/helper-globals@7.29.7", "", {}, "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA=="],
 
-    "@aws-sdk/util-format-url": ["@aws-sdk/util-format-url@3.972.10", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/querystring-builder": "^4.2.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-DEKiHNJVtNxdyTeQspzY+15Po/kHm6sF0Cs4HV9Q2+lplB63+DrvdeiSoOSdWEWAoO2RcY1veoXVDz2tWxWCgQ=="],
+    "@babel/helper-member-expression-to-functions": ["@babel/helper-member-expression-to-functions@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg=="],
 
-    "@aws-sdk/util-locate-window": ["@aws-sdk/util-locate-window@3.965.5", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-WhlJNNINQB+9qtLtZJcpQdgZw3SCDCpXdUJP7cToGwHbCWCnRckGlc6Bx/OhWwIYFNAn+FIydY8SZ0QmVu3xTQ=="],
+    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g=="],
 
-    "@aws-sdk/util-user-agent-browser": ["@aws-sdk/util-user-agent-browser@3.972.10", "", { "dependencies": { "@aws-sdk/types": "^3.973.8", "@smithy/types": "^4.14.1", "bowser": "^2.11.0", "tslib": "^2.6.2" } }, "sha512-FAzqXvfEssGdSIz8ejatan0bOdx1qefBWKF/gWmVBXIP1HkS7v/wjjaqrAGGKvyihrXTXW00/2/1nTJtxpXz7g=="],
+    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.29.7", "", { "dependencies": { "@babel/helper-module-imports": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg=="],
 
-    "@aws-sdk/util-user-agent-node": ["@aws-sdk/util-user-agent-node@3.973.17", "", { "dependencies": { "@aws-sdk/middleware-user-agent": "^3.972.31", "@aws-sdk/types": "^3.973.8", "@smithy/node-config-provider": "^4.3.14", "@smithy/types": "^4.14.1", "@smithy/util-config-provider": "^4.2.2", "tslib": "^2.6.2" }, "peerDependencies": { "aws-crt": ">=1.0.0" }, "optionalPeers": ["aws-crt"] }, "sha512-utF5qjjbuJQuU9VdCkWl7L87sr93cApsrD+uxGfUnlafX8iyEzJrb7EZnufjThURZVTOtelRMXrblWxpefElUg=="],
+    "@babel/helper-optimise-call-expression": ["@babel/helper-optimise-call-expression@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong=="],
 
-    "@aws-sdk/xml-builder": ["@aws-sdk/xml-builder@3.972.18", "", { "dependencies": { "@smithy/types": "^4.14.1", "fast-xml-parser": "5.5.8", "tslib": "^2.6.2" } }, "sha512-BMDNVG1ETXRhl1tnisQiYBef3RShJ1kfZA7x7afivTFMLirfHNTb6U71K569HNXhSXbQZsweHvSDZ6euBw8hPA=="],
+    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.29.7", "", {}, "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw=="],
 
-    "@aws/lambda-invoke-store": ["@aws/lambda-invoke-store@0.2.4", "", {}, "sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ=="],
+    "@babel/helper-replace-supers": ["@babel/helper-replace-supers@7.29.7", "", { "dependencies": { "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ=="],
+
+    "@babel/helper-skip-transparent-expression-wrappers": ["@babel/helper-skip-transparent-expression-wrappers@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ=="],
+
+    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
 
-    "@babel/code-frame": ["@babel/code-frame@7.29.0", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.28.5", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw=="],
+    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
 
-    "@babel/compat-data": ["@babel/compat-data@7.29.0", "", {}, "sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg=="],
+    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.29.7", "", {}, "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw=="],
 
-    "@babel/core": ["@babel/core@7.29.0", "", { "dependencies": { "@babel/code-frame": "^7.29.0", "@babel/generator": "^7.29.0", "@babel/helper-compilation-targets": "^7.28.6", "@babel/helper-module-transforms": "^7.28.6", "@babel/helpers": "^7.28.6", "@babel/parser": "^7.29.0", "@babel/template": "^7.28.6", "@babel/traverse": "^7.29.0", "@babel/types": "^7.29.0", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA=="],
+    "@babel/helpers": ["@babel/helpers@7.29.7", "", { "dependencies": { "@babel/template": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg=="],
 
-    "@babel/generator": ["@babel/generator@7.29.1", "", { "dependencies": { "@babel/parser": "^7.29.0", "@babel/types": "^7.29.0", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw=="],
+    "@babel/parser": ["@babel/parser@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" }, "bin": "./bin/babel-parser.js" }, "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg=="],
 
-    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.28.6", "", { "dependencies": { "@babel/compat-data": "^7.28.6", "@babel/helper-validator-option": "^7.27.1", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA=="],
+    "@babel/plugin-syntax-jsx": ["@babel/plugin-syntax-jsx@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A=="],
 
-    "@babel/helper-globals": ["@babel/helper-globals@7.28.0", "", {}, "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw=="],
+    "@babel/plugin-syntax-typescript": ["@babel/plugin-syntax-typescript@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA=="],
 
-    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.28.6", "", { "dependencies": { "@babel/traverse": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw=="],
+    "@babel/plugin-transform-modules-commonjs": ["@babel/plugin-transform-modules-commonjs@7.29.7", "", { "dependencies": { "@babel/helper-module-transforms": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-j0vCldybPC5b5dwCQOJ21uKtHzt7hxLygJTg9eF1ScfaikEDNfzn94XoW5Fi+seBR0nCyL23xaBFFkq7dTM8XQ=="],
 
-    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.28.6", "", { "dependencies": { "@babel/helper-module-imports": "^7.28.6", "@babel/helper-validator-identifier": "^7.28.5", "@babel/traverse": "^7.28.6" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA=="],
+    "@babel/plugin-transform-react-jsx-self": ["@babel/plugin-transform-react-jsx-self@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw=="],
 
-    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.27.1", "", {}, "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA=="],
+    "@babel/plugin-transform-react-jsx-source": ["@babel/plugin-transform-react-jsx-source@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q=="],
 
-    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.28.5", "", {}, "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q=="],
+    "@babel/plugin-transform-typescript": ["@babel/plugin-transform-typescript@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-create-class-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/plugin-syntax-typescript": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-jK52h8LaLc7JarhQV2ofeFMts4H7vnOXnqZNA6fYglBTZewRBE51KWt3BUltW1P+KoPsYkHoJeXePuz4zo2LMw=="],
 
-    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.27.1", "", {}, "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg=="],
+    "@babel/preset-typescript": ["@babel/preset-typescript@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "@babel/plugin-syntax-jsx": "^7.29.7", "@babel/plugin-transform-modules-commonjs": "^7.29.7", "@babel/plugin-transform-typescript": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-/Foi8vKY2EVbed/1eZx0gJEEwHAIxogrySI7rULcRIvhZzbvoE/b5qG5Ghc0WKAFKOHA9SD1x7RsFlOYdutIiQ=="],
 
-    "@babel/helpers": ["@babel/helpers@7.29.2", "", { "dependencies": { "@babel/template": "^7.28.6", "@babel/types": "^7.29.0" } }, "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw=="],
+    "@babel/runtime": ["@babel/runtime@7.29.7", "", {}, "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw=="],
 
-    "@babel/parser": ["@babel/parser@7.29.2", "", { "dependencies": { "@babel/types": "^7.29.0" }, "bin": "./bin/babel-parser.js" }, "sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA=="],
+    "@babel/template": ["@babel/template@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg=="],
 
-    "@babel/runtime": ["@babel/runtime@7.29.2", "", {}, "sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g=="],
+    "@babel/traverse": ["@babel/traverse@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-globals": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/types": "^7.29.7", "debug": "^4.3.1" } }, "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw=="],
 
-    "@babel/template": ["@babel/template@7.28.6", "", { "dependencies": { "@babel/code-frame": "^7.28.6", "@babel/parser": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ=="],
+    "@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
 
-    "@babel/traverse": ["@babel/traverse@7.29.0", "", { "dependencies": { "@babel/code-frame": "^7.29.0", "@babel/generator": "^7.29.0", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.29.0", "@babel/template": "^7.28.6", "@babel/types": "^7.29.0", "debug": "^4.3.1" } }, "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA=="],
+    "@bcoe/v8-coverage": ["@bcoe/v8-coverage@1.0.2", "", {}, "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA=="],
 
-    "@babel/types": ["@babel/types@7.29.0", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A=="],
+    "@better-auth/core": ["@better-auth/core@1.6.19", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.6", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-ddE3Y9MoQ8t32QSO5Y8mV7pmnDAv5LdJjX1SPWUH6JUUmuOc7YEy3B5JfXZIJbRaXFdnAitN7pHPVa5u/dYAZA=="],
 
-    "@better-auth/core": ["@better-auth/core@1.6.16", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.2.2", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.6", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-a0+ZNaaYYxOdFXFXmOE36TgtYN8QDzSYDozaAH0zsiWB0oyljsENyCxHJSekysISftb0rFpVXNdw525aEAOa6w=="],
+    "@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.6.19", "", { "peerDependencies": { "@better-auth/core": "^1.6.19", "@better-auth/utils": "0.4.2", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["drizzle-orm"] }, "sha512-57C9ePorPmIEez6dHuQMz3hCTkYim0lfVRIoRtX7PiVfiRFB2bjXseQwrCJfQmkgMFlkp1s/c9nKgAjc2EvAIg=="],
 
-    "@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.6.16", "", { "peerDependencies": { "@better-auth/core": "^1.6.16", "@better-auth/utils": "0.4.1", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["drizzle-orm"] }, "sha512-AZjswadpR7zlQduj3fRSsu1R5ldQRR9AeFqoxXRI4colrQhevOVY+tJr8RTJv9Nh18e9FMYDXUju2GX+QWHDzg=="],
+    "@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.6.19", "", { "peerDependencies": { "@better-auth/core": "^1.6.19", "@better-auth/utils": "0.4.2", "kysely": "^0.28.17 || ^0.29.0" }, "optionalPeers": ["kysely"] }, "sha512-DlmvllEd0nv8JL+plX3JB3WTmqDFnGFOmjmIiUDHo8R3PTAvC0ZaJq3Jk+LQLN5PyVQSUzXZKtvTQYaqRHzBaw=="],
 
-    "@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.6.16", "", { "peerDependencies": { "@better-auth/core": "^1.6.16", "@better-auth/utils": "0.4.1", "kysely": "^0.28.17 || ^0.29.0" }, "optionalPeers": ["kysely"] }, "sha512-ys/feL1p6By3/rQlMZ8QTgf9K2tZAIp1p+fGqT2krIoG5r+UsH3gMkUdbHlYxLt790Bo+Njkiqt59P0BMNsi+g=="],
+    "@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.6.19", "", { "peerDependencies": { "@better-auth/core": "^1.6.19", "@better-auth/utils": "0.4.2" } }, "sha512-cZ8iLRG/T8Oi/CqE9FTHj3z8pIOqRsINi50trWxPNwyY/Eyb7YCljrBi0PuqgIdyVs7BWfrrtEYTpO4ddfuwEw=="],
 
-    "@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.6.16", "", { "peerDependencies": { "@better-auth/core": "^1.6.16", "@better-auth/utils": "0.4.1" } }, "sha512-8mDqe+2PMF9hUxjGNP1NOcqU1AqjUgmE8YC1HTtxa+LjnO7zsAPSxGSyo1L+7buFNLtiNyGFxccHpwOkO4/Msw=="],
+    "@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.6.19", "", { "peerDependencies": { "@better-auth/core": "^1.6.19", "@better-auth/utils": "0.4.2", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-8AReXqhMGiGQIPEpGbmAhh+R4g70TsAVvzwdd6Aj4q+LTSwd3tqC89TFJ4eX8KSplxm9PFBZ6g6gsRmDd7urQg=="],
 
-    "@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.6.16", "", { "peerDependencies": { "@better-auth/core": "^1.6.16", "@better-auth/utils": "0.4.1", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-JbUg/v3m9WUX94ivVdUOF8t/w2mWNBWvqYMqyWybfHQEPR8cvcqsqpfYvwg9HLBrYwhKXBS3KcJ1Rtk6gZ19Yw=="],
+    "@better-auth/oauth-provider": ["@better-auth/oauth-provider@1.6.19", "", { "dependencies": { "jose": "^6.1.3", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/core": "^1.6.19", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "better-auth": "^1.6.19", "better-call": "1.3.6" } }, "sha512-tGY9zvoActfrwlHBIOBN3Y6Sh/UtyzP4s2tBI3pjW0h7HptTbPvB8wyNMBMK7YT7ztsEPYY1OoY3WnMnxaqzxw=="],
 
-    "@better-auth/oauth-provider": ["@better-auth/oauth-provider@1.6.16", "", { "dependencies": { "jose": "^6.1.3", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/core": "^1.6.16", "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.2.2", "better-auth": "^1.6.16", "better-call": "1.3.6" } }, "sha512-UdGhs3ZhmfhKKYZwpzTZseiAhv1ChVP8qXCo48MkvMviFJemQY0waAKi+iYCWBV/poC6pNwRzOwpGLTp8mzOCA=="],
+    "@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.6.19", "", { "peerDependencies": { "@better-auth/core": "^1.6.19", "@better-auth/utils": "0.4.2", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-pXZBhR7/bzJb48IUHlGMyz9SM9h1OCO5GIIuHEllJYt8MKgrjtsnXfUkwZh6pAUEIp3WxBEYMMK96bfkqHiWEg=="],
 
-    "@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.6.16", "", { "peerDependencies": { "@better-auth/core": "^1.6.16", "@better-auth/utils": "0.4.1", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-2bIlA7wjBx+4N2QcM32xL/YojRuJpDvskXqT/dGYKToDIEl/7yr12cLYlqeaFLL0O0s5qNZ8jbDtlCz20eogeQ=="],
+    "@better-auth/telemetry": ["@better-auth/telemetry@1.6.19", "", { "peerDependencies": { "@better-auth/core": "^1.6.19", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1" } }, "sha512-bBaB6SMIsrD3WutDdm5YQ1bQyinANTimHD8RtpLWhNh/jIXvzgwVVCrDFqA256vcGC/ZRCydmtW8ZrUqNMW9Og=="],
 
-    "@better-auth/telemetry": ["@better-auth/telemetry@1.6.16", "", { "peerDependencies": { "@better-auth/core": "^1.6.16", "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.2.2" } }, "sha512-A782UQvlqZBddw0j2Q6tdroHulIpMlqQh/pbw2up30drLi66jz1ttgShRmryfOLAqN4DHqteuRrSsqDDrsp/pA=="],
+    "@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
 
-    "@better-auth/utils": ["@better-auth/utils@0.4.1", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-SZBPRPF3z0nBvE5ygOkxae35wnnXPRShmqFo78S+qslLeFoPu/pMgnXAuNKFMMybac3tiLaVg1e3MQW5MC+1iA=="],
+    "@better-fetch/fetch": ["@better-fetch/fetch@1.3.1", "", {}, "sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g=="],
 
-    "@better-fetch/fetch": ["@better-fetch/fetch@1.2.2", "", {}, "sha512-xlgQcYROGFgKg5FY7ZLppFmG7rR5Hkmz7tgDuQeR79i5KhKRjr2QC9xsBG2qEGPJJjf9bxzg/NMW2hEUWs5OnA=="],
+    "@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.4.2", "", {}, "sha512-SIOD2DxrRRwQ+jgzlXCqoEFiKOFqaPjhnNTGKXSRLvp1HiOvapLaFG2kEr9dYQTYe8rKrd9uvDUzmAITeNyaHQ=="],
 
-    "@codemirror/autocomplete": ["@codemirror/autocomplete@6.20.1", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0" } }, "sha512-1cvg3Vz1dSSToCNlJfRA2WSI4ht3K+WplO0UMOgmUYPivCyy2oueZY6Lx7M9wThm7SDUBViRmuT+OG/i8+ON9A=="],
+    "@codemirror/autocomplete": ["@codemirror/autocomplete@6.20.3", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0" } }, "sha512-tlosUqb+3BbxCxZdu4tKeRghPFC+QM7q4X5YhKV2eCmPG+1r2F3f4AaSz5sCrFqUtX4Jh20VFTKecl16MgiV9g=="],
 
     "@codemirror/commands": ["@codemirror/commands@6.10.3", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.6.0", "@codemirror/view": "^6.27.0", "@lezer/common": "^1.1.0" } }, "sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q=="],
 
@@ -416,17 +443,21 @@
 
     "@codemirror/language": ["@codemirror/language@6.12.3", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.23.0", "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.0.0", "style-mod": "^4.0.0" } }, "sha512-QwCZW6Tt1siP37Jet9Tb02Zs81TQt6qQrZR2H+eGMcFsL1zMrk2/b9CLC7/9ieP1fjIUMgviLWMmgiHoJrj+ZA=="],
 
-    "@codemirror/lint": ["@codemirror/lint@6.9.5", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.35.0", "crelt": "^1.0.5" } }, "sha512-GElsbU9G7QT9xXhpUg1zWGmftA/7jamh+7+ydKRuT0ORpWS3wOSP0yT1FOlIZa7mIJjpVPipErsyvVqB9cfTFA=="],
+    "@codemirror/lint": ["@codemirror/lint@6.9.7", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.42.0", "crelt": "^1.0.5" } }, "sha512-28/+iWLYxKxsvGYhSYL7zaCZqLz5+FFFDq9tVsvGv9kv8RY4fFAchJ5WX9M3YrrRlTIsECjsXPqeNgnSmNP2dg=="],
 
-    "@codemirror/search": ["@codemirror/search@6.6.0", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.37.0", "crelt": "^1.0.5" } }, "sha512-koFuNXcDvyyotWcgOnZGmY7LZqEOXZaaxD/j6n18TCLx2/9HieZJ5H6hs1g8FiRxBD0DNfs0nXn17g872RmYdw=="],
+    "@codemirror/search": ["@codemirror/search@6.7.0", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.37.0", "crelt": "^1.0.5" } }, "sha512-ZvGm99wc/s2cITtMT15LFdn8aH/aS+V+DqyGq/N5ZlV5vWtH+nILvC2nw0zX7ByNoHHDZ2IxxdW38O0tc5nVHg=="],
 
     "@codemirror/state": ["@codemirror/state@6.6.0", "", { "dependencies": { "@marijn/find-cluster-break": "^1.0.0" } }, "sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ=="],
 
     "@codemirror/theme-one-dark": ["@codemirror/theme-one-dark@6.1.3", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0", "@lezer/highlight": "^1.0.0" } }, "sha512-NzBdIvEJmx6fjeremiGp3t/okrLPYT0d9orIc7AFun8oZcRk58aejkqhv6spnz4MLAevrKNPMQYXEWMg4s+sKA=="],
 
-    "@codemirror/view": ["@codemirror/view@6.41.0", "", { "dependencies": { "@codemirror/state": "^6.6.0", "crelt": "^1.0.6", "style-mod": "^4.1.0", "w3c-keyname": "^2.2.4" } }, "sha512-6H/qadXsVuDY219Yljhohglve8xf4B8xJkVOEWfA5uiYKiTFppjqsvsfR5iPA0RbvRBoOyTZpbLIxe9+0UR8xA=="],
+    "@codemirror/view": ["@codemirror/view@6.43.1", "", { "dependencies": { "@codemirror/state": "^6.6.0", "crelt": "^1.0.6", "style-mod": "^4.1.0", "w3c-keyname": "^2.2.4" } }, "sha512-+BIjw/AG3tDQ4pJgTLPYdAW25eDE66YsvM4LKyVPgGzVgZ4a9Wj1SRX8kPVKgBDdPt8oHtZ15F0qx7p0oOHdHw=="],
 
-    "@date-fns/tz": ["@date-fns/tz@1.4.1", "", {}, "sha512-P5LUNhtbj6YfI3iJjw5EL9eUAG6OitD0W3fWQcpQjDRc/QIsL0tRNuO1PcDvPccWL1fSTXXdE1ds+l95DV/OFA=="],
+    "@date-fns/tz": ["@date-fns/tz@1.5.0", "", {}, "sha512-lwYN/vDPeNRULcepoE/LO2Pgx+7/RV+S9ARfbc9lr2DtGkOD7pAiruHvbR1RX3Qyf6ja47EWJDMsNK5vK08DJg=="],
+
+    "@deno/shim-deno": ["@deno/shim-deno@0.19.2", "", { "dependencies": { "@deno/shim-deno-test": "^0.5.0", "which": "^4.0.0" } }, "sha512-q3VTHl44ad8T2Tw2SpeAvghdGOjlnLPDNO2cpOxwMrBE/PVas6geWpbpIgrM+czOCH0yejp0yi8OaTuB+NU40Q=="],
+
+    "@deno/shim-deno-test": ["@deno/shim-deno-test@0.5.0", "", {}, "sha512-4nMhecpGlPi0cSzT67L+Tm+GOJqvuk8gqHBziqcUQOarnuIax1z96/gJHCSIz2Z0zhxE6Rzwb3IZXPtFh51j+w=="],
 
     "@dnd-kit/accessibility": ["@dnd-kit/accessibility@3.1.1", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0" } }, "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw=="],
 
@@ -438,9 +469,9 @@
 
     "@drizzle-team/brocli": ["@drizzle-team/brocli@0.10.2", "", {}, "sha512-z33Il7l5dKjUgGULTqBsQBQwckHh5AbIuxhdsIxDDiZAzBOrZO6q9ogcWC65kU382AfynTfgNumVcNIjuIua6w=="],
 
-    "@emnapi/core": ["@emnapi/core@1.9.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA=="],
+    "@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
 
-    "@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+    "@emnapi/runtime": ["@emnapi/runtime@1.11.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw=="],
 
     "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
 
@@ -506,7 +537,7 @@
 
     "@eslint/config-array": ["@eslint/config-array@0.23.5", "", { "dependencies": { "@eslint/object-schema": "^3.0.5", "debug": "^4.3.1", "minimatch": "^10.2.4" } }, "sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA=="],
 
-    "@eslint/config-helpers": ["@eslint/config-helpers@0.5.5", "", { "dependencies": { "@eslint/core": "^1.2.1" } }, "sha512-eIJYKTCECbP/nsKaaruF6LW967mtbQbsw4JTtSVkUQc9MneSkbrgPJAbKl9nWr0ZeowV8BfsarBmPpBzGelA2w=="],
+    "@eslint/config-helpers": ["@eslint/config-helpers@0.6.0", "", { "dependencies": { "@eslint/core": "^1.2.1" } }, "sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA=="],
 
     "@eslint/core": ["@eslint/core@1.2.1", "", { "dependencies": { "@types/json-schema": "^7.0.15" } }, "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ=="],
 
@@ -514,7 +545,7 @@
 
     "@eslint/object-schema": ["@eslint/object-schema@3.0.5", "", {}, "sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw=="],
 
-    "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.1", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-rZAP3aVgB9ds9KOeUSL+zZ21hPmo8dh6fnIFwRQj5EAZl9gzR7wxYbYXYysAM8CTqGmUGyp2S4kUdV17MnGuWQ=="],
+    "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.2", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A=="],
 
     "@faker-js/faker": ["@faker-js/faker@10.4.0", "", {}, "sha512-sDBWI3yLy8EcDzgobvJTWq1MJYzAkQdpjXuPukga9wXonhpMRvd1Izuo2Qgwey2OiEoRIBr35RMU9HJRoOHzpw=="],
 
@@ -528,21 +559,33 @@
 
     "@fontsource-variable/inter": ["@fontsource-variable/inter@5.2.8", "", {}, "sha512-kOfP2D+ykbcX/P3IFnokOhVRNoTozo5/JxhAIVYLpea/UBmCQ/YWPBfWIDuBImXX/15KH+eKh4xpEUyS2sQQGQ=="],
 
-    "@formatjs/cli": ["@formatjs/cli@6.14.2", "", { "peerDependencies": { "@glimmer/syntax": "^0.84.3 || ^0.95.0", "@vue/compiler-core": "^3.5.0", "content-tag": "^4.1.0", "vue": "^3.5.0" }, "optionalPeers": ["@glimmer/syntax", "@vue/compiler-core", "content-tag", "vue"], "bin": { "formatjs": "bin/formatjs" } }, "sha512-0aZLIRcrxIf6QU2u04bIorYIVA1Sm8hHlHzlK9ROGB2BLN0WbiBCwK3jAPV9um+pPS6O4ZFT6K9c2j/3iMkmSw=="],
+    "@formatjs/cli": ["@formatjs/cli@6.16.11", "", { "optionalDependencies": { "@formatjs/cli-native-darwin-arm64": "1.1.5", "@formatjs/cli-native-linux-arm64": "1.2.5", "@formatjs/cli-native-linux-arm64-musl": "1.0.3", "@formatjs/cli-native-linux-x64": "1.1.5", "@formatjs/cli-native-linux-x64-musl": "1.0.3", "@formatjs/cli-native-win32-x64": "1.1.6" }, "peerDependencies": { "@glimmer/syntax": "^0.84.3 || ^0.95.0", "@vue/compiler-core": "^3.5.0", "content-tag": "^4.1.0", "vue": "^3.5.0" }, "optionalPeers": ["@glimmer/syntax", "@vue/compiler-core", "content-tag", "vue"], "bin": { "formatjs": "bin/formatjs" } }, "sha512-O3tTFavGK3zOhW4i2/ONWfMUgbU7fapxNbIsdFuF9eTMtQZFnKFdoBDdiBHj7d2W4ULVyeWd4b3qw2XHYpmuBg=="],
+
+    "@formatjs/cli-native-darwin-arm64": ["@formatjs/cli-native-darwin-arm64@1.1.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-zGt7OenQakyh8a+eAgCx/zUInbQXYT0UNzeOaYlnaKmU9yr78wsVAGGhPc85gchnQ7gIXSWOKhwIzvfSMFGU7w=="],
+
+    "@formatjs/cli-native-linux-arm64": ["@formatjs/cli-native-linux-arm64@1.2.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-G1Ou5CFDM2hfqmD2jfXJJpHL7DL7f7OxlMXf6VPWvUYu+jcvpEj0KdEtmz5poh8rWzfHbOf4MfqC6WNhExJD5A=="],
 
-    "@formatjs/fast-memoize": ["@formatjs/fast-memoize@3.1.2", "", {}, "sha512-vPnriihkfK0lzoQGaXq+qXH23VsYyansRTkTgo2aTG0k1NjLFyZimFVdfj4C9JkSE5dm7CEngcQ5TTc1yAyBfQ=="],
+    "@formatjs/cli-native-linux-arm64-musl": ["@formatjs/cli-native-linux-arm64-musl@1.0.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-1qq9EZIY87cnptTd2PywI41s/DlkJBzNID6AofHCYm8sunXfj+vYAIQOSZnctNm7/u1ZlSJ/VjxHSS1NIC4tTw=="],
 
-    "@formatjs/icu-messageformat-parser": ["@formatjs/icu-messageformat-parser@3.5.4", "", { "dependencies": { "@formatjs/icu-skeleton-parser": "2.1.4" } }, "sha512-JVY39ROgLt+pIYngo6piyj4OVfZmXs/2FkC4wLS+ql1Eig/sGJKB7YwDO/5bkJFkfwaFAeIpgEiJc8hiYxNalw=="],
+    "@formatjs/cli-native-linux-x64": ["@formatjs/cli-native-linux-x64@1.1.5", "", { "os": "linux", "cpu": "x64" }, "sha512-v/EtDIMC7C3cOpYpRJDvUImQFHBveFP+PTggZJbi88zXCeMMEL6eMwbMlJezUIwvYjgH1FWQargCgwOnI3lVdg=="],
 
-    "@formatjs/icu-skeleton-parser": ["@formatjs/icu-skeleton-parser@2.1.4", "", {}, "sha512-8bSFZbrlvGX11ywMZxtgkPBt5Q8/etyts7j7j+GWpOVK1g43zwMIH3LZxk43HAtEP7L/jtZ+OZaMiFTOiBj9CA=="],
+    "@formatjs/cli-native-linux-x64-musl": ["@formatjs/cli-native-linux-x64-musl@1.0.3", "", { "os": "linux", "cpu": "x64" }, "sha512-wb90O1S7cad8QKmHQ2I5glN9O9m+y+V29mrvvxFbKAVmVbKB7oyjhoau/jtuHQ/Yv2tfah3CYCj+1iaDNlJmYg=="],
 
-    "@formatjs/intl": ["@formatjs/intl@4.1.6", "", { "dependencies": { "@formatjs/fast-memoize": "3.1.2", "@formatjs/icu-messageformat-parser": "3.5.4", "intl-messageformat": "11.2.1" } }, "sha512-eQuZCkG7kVBIjMhLhvsRZmYnVbTHBiiM+fNxIbDg7LZ9WXcpWUISuv58baq2dov7vz3qXYtDEgJ9AODZK6idaQ=="],
+    "@formatjs/cli-native-win32-x64": ["@formatjs/cli-native-win32-x64@1.1.6", "", { "os": "win32", "cpu": "x64" }, "sha512-fsPOUB4JePy6VJfQV+oorLfozbb9IfYRAncGZ54VZg77Uj2aOP2h/KLhQmgippNlgi0Q77EB8QDMzNQfaKpVAA=="],
+
+    "@formatjs/fast-memoize": ["@formatjs/fast-memoize@3.1.6", "", {}, "sha512-H5aexk1Le7T9TPmscacZ+1pR6CTa2n1wq+HDVGXhH8TzUlQQpeXzZs91dRtmFHrbeNbjPFPfQujUqm7MHgVoXQ=="],
+
+    "@formatjs/icu-messageformat-parser": ["@formatjs/icu-messageformat-parser@3.5.11", "", { "dependencies": { "@formatjs/icu-skeleton-parser": "2.1.10" } }, "sha512-NVsuNsc2dUVG9+4HBJ/srScxtA/18LqGgwtop/tuN/OIBjVl6QA+0KhfZQddDD9sEh2LeVjLFPGVU3ixa3blcA=="],
+
+    "@formatjs/icu-skeleton-parser": ["@formatjs/icu-skeleton-parser@2.1.10", "", {}, "sha512-XuSva+8ZGawk8VnD5VD6UeH8KarQ/Z022zgjHDoHmlNiAewstXuuzXc0Hk5pGFSdG+nNw5bfJKXqj1ZXHn9yUA=="],
+
+    "@formatjs/intl": ["@formatjs/intl@4.1.13", "", { "dependencies": { "@formatjs/fast-memoize": "3.1.6", "@formatjs/icu-messageformat-parser": "3.5.11", "intl-messageformat": "11.2.8" } }, "sha512-dufOl09iREq8V+laVdlGuyoqNmuzqDvyeA3O3k+0XQfvKJgK8bBWFKqYYWejFMKeOij/4LuPKJA+LsshpXQ4sw=="],
 
     "@heroicons/react": ["@heroicons/react@2.2.0", "", { "peerDependencies": { "react": ">= 16 || ^19.0.0-rc" } }, "sha512-LMcepvRaS9LYHJGsF0zzmgKCUim/X3N/DQKc4jepAXJ7l8QxJ1PmxJzqplF2Z3FE4PqBAIGyJAQ/w4B5dsqbtQ=="],
 
     "@hono/node-server": ["@hono/node-server@1.19.14", "", { "peerDependencies": { "hono": "^4" } }, "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw=="],
 
-    "@hookform/resolvers": ["@hookform/resolvers@5.2.2", "", { "dependencies": { "@standard-schema/utils": "^0.3.0" }, "peerDependencies": { "react-hook-form": "^7.55.0" } }, "sha512-A/IxlMLShx3KjV/HeTcTfaMxdwy690+L/ZADoeaTltLx+CVuzkeVIPuybK3jrRfw7YZnmdKsVVHAlEPIAEUNlA=="],
+    "@hookform/resolvers": ["@hookform/resolvers@5.4.0", "", { "dependencies": { "@standard-schema/utils": "^0.3.0" }, "peerDependencies": { "react-hook-form": "^7.55.0" } }, "sha512-EIsqr/t/qbinPIhGjMdtvutIN1Kk4uwbROE9/UQ93CAVGR7GkA7Y92+fX80OzXi/OB67jVFYwKGO1WzkxmkFZw=="],
 
     "@humanfs/core": ["@humanfs/core@0.19.2", "", { "dependencies": { "@humanfs/types": "^0.15.0" } }, "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA=="],
 
@@ -604,7 +647,11 @@
 
     "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.34.5", "", { "os": "win32", "cpu": "x64" }, "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw=="],
 
-    "@ioredis/commands": ["@ioredis/commands@1.5.1", "", {}, "sha512-JH8ZL/ywcJyR9MmJ5BNqZllXNZQqQbnVZOqpPQqE1vHiFgAw4NHbvE0FOduNU8IX9babitBT46571OnPTT0Zcw=="],
+    "@ioredis/commands": ["@ioredis/commands@1.10.0", "", {}, "sha512-UmeW7z4LfctwoQ5wkhVzgq8tXkreED2xZGpX+Bg+zA+WJFZCT6c062AfCK/Dfk81xZnnwdhJCUMkitihRaoC2Q=="],
+
+    "@isaacs/cliui": ["@isaacs/cliui@8.0.2", "", { "dependencies": { "string-width": "^5.1.2", "string-width-cjs": "npm:string-width@^4.2.0", "strip-ansi": "^7.0.1", "strip-ansi-cjs": "npm:strip-ansi@^6.0.1", "wrap-ansi": "^8.1.0", "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0" } }, "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA=="],
+
+    "@isaacs/fs-minipass": ["@isaacs/fs-minipass@4.0.1", "", { "dependencies": { "minipass": "^7.0.4" } }, "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w=="],
 
     "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],
 
@@ -624,30 +671,40 @@
 
     "@lezer/highlight": ["@lezer/highlight@1.2.3", "", { "dependencies": { "@lezer/common": "^1.3.0" } }, "sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g=="],
 
-    "@lezer/lr": ["@lezer/lr@1.4.9", "", { "dependencies": { "@lezer/common": "^1.0.0" } }, "sha512-mF6irshW4nRJEhdR0HOAxxTDGss+rQFqA0nLRlZsPh14q+DB9Fqp0YbOvyRSOeKPLfUL/w5wPQAcETvkQ1VApg=="],
+    "@lezer/lr": ["@lezer/lr@1.4.10", "", { "dependencies": { "@lezer/common": "^1.0.0" } }, "sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A=="],
+
+    "@mapbox/node-pre-gyp": ["@mapbox/node-pre-gyp@2.0.3", "", { "dependencies": { "consola": "^3.2.3", "detect-libc": "^2.0.0", "https-proxy-agent": "^7.0.5", "node-fetch": "^2.6.7", "nopt": "^8.0.0", "semver": "^7.5.3", "tar": "^7.4.0" }, "bin": { "node-pre-gyp": "bin/node-pre-gyp" } }, "sha512-uwPAhccfFJlsfCxMYTwOdVfOz3xqyj8xYL3zJj8f0pb30tLohnnFPhLuqp4/qoEz8sNxe4SESZedcBojRefIzg=="],
 
     "@marijn/find-cluster-break": ["@marijn/find-cluster-break@1.0.2", "", {}, "sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g=="],
 
     "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.29.0", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ=="],
 
-    "@msgpackr-extract/msgpackr-extract-darwin-arm64": ["@msgpackr-extract/msgpackr-extract-darwin-arm64@3.0.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-QZHtlVgbAdy2zAqNA9Gu1UpIuI8Xvsd1v8ic6B2pZmeFnFcMWiPLfWXh7TVw4eGEZ/C9TH281KwhVoeQUKbyjw=="],
+    "@msgpackr-extract/msgpackr-extract-darwin-arm64": ["@msgpackr-extract/msgpackr-extract-darwin-arm64@3.0.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ=="],
 
-    "@msgpackr-extract/msgpackr-extract-darwin-x64": ["@msgpackr-extract/msgpackr-extract-darwin-x64@3.0.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-mdzd3AVzYKuUmiWOQ8GNhl64/IoFGol569zNRdkLReh6LRLHOXxU4U8eq0JwaD8iFHdVGqSy4IjFL4reoWCDFw=="],
+    "@msgpackr-extract/msgpackr-extract-darwin-x64": ["@msgpackr-extract/msgpackr-extract-darwin-x64@3.0.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w=="],
 
-    "@msgpackr-extract/msgpackr-extract-linux-arm": ["@msgpackr-extract/msgpackr-extract-linux-arm@3.0.3", "", { "os": "linux", "cpu": "arm" }, "sha512-fg0uy/dG/nZEXfYilKoRe7yALaNmHoYeIoJuJ7KJ+YyU2bvY8vPv27f7UKhGRpY6euFYqEVhxCFZgAUNQBM3nw=="],
+    "@msgpackr-extract/msgpackr-extract-linux-arm": ["@msgpackr-extract/msgpackr-extract-linux-arm@3.0.4", "", { "os": "linux", "cpu": "arm" }, "sha512-Tg3yX65f5GbtXLkrYEHE5oibZG9epyYWas7FogTTEJeDEF9JlXJzKgXaNhT3UXlTOeA+AfZpYZYZ0uPj7Cfquw=="],
 
-    "@msgpackr-extract/msgpackr-extract-linux-arm64": ["@msgpackr-extract/msgpackr-extract-linux-arm64@3.0.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-YxQL+ax0XqBJDZiKimS2XQaf+2wDGVa1enVRGzEvLLVFeqa5kx2bWbtcSXgsxjQB7nRqqIGFIcLteF/sHeVtQg=="],
+    "@msgpackr-extract/msgpackr-extract-linux-arm64": ["@msgpackr-extract/msgpackr-extract-linux-arm64@3.0.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-dgX0P/9wGPJeHFBG+ZmhgE6bmtMt7NP5CRBGyyktpopdk/mW4POnrpQsSLtKI1dwpc+pPLuXHDh6vvskyQE/sw=="],
 
-    "@msgpackr-extract/msgpackr-extract-linux-x64": ["@msgpackr-extract/msgpackr-extract-linux-x64@3.0.3", "", { "os": "linux", "cpu": "x64" }, "sha512-cvwNfbP07pKUfq1uH+S6KJ7dT9K8WOE4ZiAcsrSes+UY55E/0jLYc+vq+DO7jlmqRb5zAggExKm0H7O/CBaesg=="],
+    "@msgpackr-extract/msgpackr-extract-linux-x64": ["@msgpackr-extract/msgpackr-extract-linux-x64@3.0.4", "", { "os": "linux", "cpu": "x64" }, "sha512-8TNXMEjJc3QEy7R/x1INhgiU+XakDAFUzBhaz7+Rbrs8NH5UQeHQxxmzsSBJGyV6I1jW79undiQm8tOI+D+8FQ=="],
 
-    "@msgpackr-extract/msgpackr-extract-win32-x64": ["@msgpackr-extract/msgpackr-extract-win32-x64@3.0.3", "", { "os": "win32", "cpu": "x64" }, "sha512-x0fWaQtYp4E6sktbsdAqnehxDgEc/VwM7uLsRCYWaiGu0ykYdZPiS8zCWdnjHwyiumousxfBm4SO31eXqwEZhQ=="],
+    "@msgpackr-extract/msgpackr-extract-win32-x64": ["@msgpackr-extract/msgpackr-extract-win32-x64@3.0.4", "", { "os": "win32", "cpu": "x64" }, "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ=="],
 
-    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.5", "", { "dependencies": { "@tybys/wasm-util": "^0.10.2" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q=="],
 
     "@noble/ciphers": ["@noble/ciphers@2.0.0", "", {}, "sha512-j/l6jpnpaIBM87cAYPJzi/6TgqmBv9spkqPyCXvRYsu5uxqh6tPJZDnD85yo8VWqzTuTQPgfv7NgT63u7kbwAQ=="],
 
     "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
 
+    "@nodable/entities": ["@nodable/entities@2.2.0", "", {}, "sha512-9uGyhaQavEUMC8AIddIjau4NsnsXhou+j5sBAGojCM1oxmQpVKTWR/9JxABD6UAv12vpIms55fPZKFQEhG6uBg=="],
+
+    "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="],
+
+    "@nodelib/fs.stat": ["@nodelib/fs.stat@2.0.5", "", {}, "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A=="],
+
+    "@nodelib/fs.walk": ["@nodelib/fs.walk@1.2.8", "", { "dependencies": { "@nodelib/fs.scandir": "2.1.5", "fastq": "^1.6.0" } }, "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg=="],
+
     "@oozcitak/dom": ["@oozcitak/dom@2.0.2", "", { "dependencies": { "@oozcitak/infra": "^2.0.2", "@oozcitak/url": "^3.0.0", "@oozcitak/util": "^10.0.0" } }, "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w=="],
 
     "@oozcitak/infra": ["@oozcitak/infra@2.0.2", "", { "dependencies": { "@oozcitak/util": "^10.0.0" } }, "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA=="],
@@ -658,16 +715,54 @@
 
     "@opentelemetry/api": ["@opentelemetry/api@1.9.1", "", {}, "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q=="],
 
-    "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.40.0", "", {}, "sha512-cifvXDhcqMwwTlTK04GBNeIe7yyo28Mfby85QXFe1Yk8nmi36Ab/5UQwptOx84SsoGNRg+EVSjwzfSZMy6pmlw=="],
+    "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.41.1", "", {}, "sha512-/UhIkaZgPutTFmQ7RnIJGgDXZmtEJ7Dvi86xNTFWcnRxVRNk/aotsqDJYeEvDP+FSMB2SdW+pQzNMcWP0rwuNA=="],
+
+    "@oxc-project/types": ["@oxc-project/types@0.133.0", "", {}, "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA=="],
+
+    "@parcel/watcher": ["@parcel/watcher@2.5.6", "", { "dependencies": { "detect-libc": "^2.0.3", "is-glob": "^4.0.3", "node-addon-api": "^7.0.0", "picomatch": "^4.0.3" }, "optionalDependencies": { "@parcel/watcher-android-arm64": "2.5.6", "@parcel/watcher-darwin-arm64": "2.5.6", "@parcel/watcher-darwin-x64": "2.5.6", "@parcel/watcher-freebsd-x64": "2.5.6", "@parcel/watcher-linux-arm-glibc": "2.5.6", "@parcel/watcher-linux-arm-musl": "2.5.6", "@parcel/watcher-linux-arm64-glibc": "2.5.6", "@parcel/watcher-linux-arm64-musl": "2.5.6", "@parcel/watcher-linux-x64-glibc": "2.5.6", "@parcel/watcher-linux-x64-musl": "2.5.6", "@parcel/watcher-win32-arm64": "2.5.6", "@parcel/watcher-win32-ia32": "2.5.6", "@parcel/watcher-win32-x64": "2.5.6" } }, "sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ=="],
+
+    "@parcel/watcher-android-arm64": ["@parcel/watcher-android-arm64@2.5.6", "", { "os": "android", "cpu": "arm64" }, "sha512-YQxSS34tPF/6ZG7r/Ih9xy+kP/WwediEUsqmtf0cuCV5TPPKw/PQHRhueUo6JdeFJaqV3pyjm0GdYjZotbRt/A=="],
+
+    "@parcel/watcher-darwin-arm64": ["@parcel/watcher-darwin-arm64@2.5.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Z2ZdrnwyXvvvdtRHLmM4knydIdU9adO3D4n/0cVipF3rRiwP+3/sfzpAwA/qKFL6i1ModaabkU7IbpeMBgiVEA=="],
+
+    "@parcel/watcher-darwin-x64": ["@parcel/watcher-darwin-x64@2.5.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-HgvOf3W9dhithcwOWX9uDZyn1lW9R+7tPZ4sug+NGrGIo4Rk1hAXLEbcH1TQSqxts0NYXXlOWqVpvS1SFS4fRg=="],
+
+    "@parcel/watcher-freebsd-x64": ["@parcel/watcher-freebsd-x64@2.5.6", "", { "os": "freebsd", "cpu": "x64" }, "sha512-vJVi8yd/qzJxEKHkeemh7w3YAn6RJCtYlE4HPMoVnCpIXEzSrxErBW5SJBgKLbXU3WdIpkjBTeUNtyBVn8TRng=="],
+
+    "@parcel/watcher-linux-arm-glibc": ["@parcel/watcher-linux-arm-glibc@2.5.6", "", { "os": "linux", "cpu": "arm" }, "sha512-9JiYfB6h6BgV50CCfasfLf/uvOcJskMSwcdH1PHH9rvS1IrNy8zad6IUVPVUfmXr+u+Km9IxcfMLzgdOudz9EQ=="],
+
+    "@parcel/watcher-linux-arm-musl": ["@parcel/watcher-linux-arm-musl@2.5.6", "", { "os": "linux", "cpu": "arm" }, "sha512-Ve3gUCG57nuUUSyjBq/MAM0CzArtuIOxsBdQ+ftz6ho8n7s1i9E1Nmk/xmP323r2YL0SONs1EuwqBp2u1k5fxg=="],
+
+    "@parcel/watcher-linux-arm64-glibc": ["@parcel/watcher-linux-arm64-glibc@2.5.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-f2g/DT3NhGPdBmMWYoxixqYr3v/UXcmLOYy16Bx0TM20Tchduwr4EaCbmxh1321TABqPGDpS8D/ggOTaljijOA=="],
+
+    "@parcel/watcher-linux-arm64-musl": ["@parcel/watcher-linux-arm64-musl@2.5.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-qb6naMDGlbCwdhLj6hgoVKJl2odL34z2sqkC7Z6kzir8b5W65WYDpLB6R06KabvZdgoHI/zxke4b3zR0wAbDTA=="],
+
+    "@parcel/watcher-linux-x64-glibc": ["@parcel/watcher-linux-x64-glibc@2.5.6", "", { "os": "linux", "cpu": "x64" }, "sha512-kbT5wvNQlx7NaGjzPFu8nVIW1rWqV780O7ZtkjuWaPUgpv2NMFpjYERVi0UYj1msZNyCzGlaCWEtzc+exjMGbQ=="],
+
+    "@parcel/watcher-linux-x64-musl": ["@parcel/watcher-linux-x64-musl@2.5.6", "", { "os": "linux", "cpu": "x64" }, "sha512-1JRFeC+h7RdXwldHzTsmdtYR/Ku8SylLgTU/reMuqdVD7CtLwf0VR1FqeprZ0eHQkO0vqsbvFLXUmYm/uNKJBg=="],
+
+    "@parcel/watcher-wasm": ["@parcel/watcher-wasm@2.3.0", "", { "dependencies": { "is-glob": "^4.0.3", "micromatch": "^4.0.5", "napi-wasm": "^1.1.0" } }, "sha512-ejBAX8H0ZGsD8lSICDNyMbSEtPMWgDL0WFCt/0z7hyf5v8Imz4rAM8xY379mBsECkq/Wdqa5WEDLqtjZ+6NxfA=="],
 
-    "@oxc-project/types": ["@oxc-project/types@0.126.0", "", {}, "sha512-oGfVtjAgwQVVpfBrbtk4e1XDyWHRFta6BS3GWVzrF8xYBT2VGQAk39yJS/wFSMrZqoiCU4oghT3Ch0HaHGIHcQ=="],
+    "@parcel/watcher-win32-arm64": ["@parcel/watcher-win32-arm64@2.5.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-3ukyebjc6eGlw9yRt678DxVF7rjXatWiHvTXqphZLvo7aC5NdEgFufVwjFfY51ijYEWpXbqF5jtrK275z52D4Q=="],
+
+    "@parcel/watcher-win32-ia32": ["@parcel/watcher-win32-ia32@2.5.6", "", { "os": "win32", "cpu": "ia32" }, "sha512-k35yLp1ZMwwee3Ez/pxBi5cf4AoBKYXj00CZ80jUz5h8prpiaQsiRPKQMxoLstNuqe2vR4RNPEAEcjEFzhEz/g=="],
+
+    "@parcel/watcher-win32-x64": ["@parcel/watcher-win32-x64@2.5.6", "", { "os": "win32", "cpu": "x64" }, "sha512-hbQlYcCq5dlAX9Qx+kFb0FHue6vbjlf0FrNzSKdYK2APUf7tGfGxQCk2ihEREmbR6ZMc0MVAD5RIX/41gpUzTw=="],
 
     "@pinojs/redact": ["@pinojs/redact@0.4.0", "", {}, "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg=="],
 
-    "@playwright/test": ["@playwright/test@1.59.1", "", { "dependencies": { "playwright": "1.59.1" }, "bin": { "playwright": "cli.js" } }, "sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg=="],
+    "@pkgjs/parseargs": ["@pkgjs/parseargs@0.11.0", "", {}, "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg=="],
+
+    "@playwright/test": ["@playwright/test@1.61.0", "", { "dependencies": { "playwright": "1.61.0" }, "bin": { "playwright": "cli.js" } }, "sha512-cKA5B6lpFEMyMGjxF54QihfYpB4FkEGH+qZhtArDEG+wezQAJY8Pq6C7T1SjWz+FFzt3TbyoXBQYk/0292TdJA=="],
 
     "@popperjs/core": ["@popperjs/core@2.11.8", "", {}, "sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A=="],
 
+    "@poppinss/colors": ["@poppinss/colors@4.1.6", "", { "dependencies": { "kleur": "^4.1.5" } }, "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg=="],
+
+    "@poppinss/dumper": ["@poppinss/dumper@0.7.0", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@sindresorhus/is": "^7.0.2", "supports-color": "^10.0.0" } }, "sha512-0UTYalzk2t6S4rA2uHOz5bSSW2CHdv4vggJI6Alg90yvl0UgXs6XSXpH96OH+bRkX4J/06djv29pqXJ0lq5Kag=="],
+
+    "@poppinss/exception": ["@poppinss/exception@1.2.3", "", {}, "sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw=="],
+
     "@quackback/db": ["@quackback/db@workspace:packages/db"],
 
     "@quackback/email": ["@quackback/email@workspace:packages/email"],
@@ -682,125 +777,125 @@
 
     "@quackback/widget": ["@quackback/widget@workspace:packages/widget"],
 
-    "@radix-ui/number": ["@radix-ui/number@1.1.1", "", {}, "sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g=="],
+    "@radix-ui/number": ["@radix-ui/number@1.1.2", "", {}, "sha512-ceTwaxc4I5IOi97DgCotl3pqiyRGvffcc0oOsE2dQYaJOFIDsDt4VWG6xEbg1QePv9QWausCEIppud/tJ1wNig=="],
 
-    "@radix-ui/primitive": ["@radix-ui/primitive@1.1.3", "", {}, "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg=="],
+    "@radix-ui/primitive": ["@radix-ui/primitive@1.1.4", "", {}, "sha512-7AdCK9PQyiljKoBDbN8OuctCbd/esdwZPQ8RtOE3SsyQtUpiPb+ND75q0jEhC1m1ecBI0MFNeLJvwIh9iKHRcQ=="],
 
-    "@radix-ui/react-accessible-icon": ["@radix-ui/react-accessible-icon@1.1.7", "", { "dependencies": { "@radix-ui/react-visually-hidden": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-XM+E4WXl0OqUJFovy6GjmxxFyx9opfCAIUku4dlKRd5YEPqt4kALOkQOp0Of6reHuUkJuiPBEc5k0o4z4lTC8A=="],
+    "@radix-ui/react-accessible-icon": ["@radix-ui/react-accessible-icon@1.1.10", "", { "dependencies": { "@radix-ui/react-visually-hidden": "1.2.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-TraSwZUqTcVbiDV2/RXzAXC7aeVVXchq0daPFZE7zAxYFaMzjOUggLOfQH9KFLgRizuwVKZO/crveV1eeO3/ZQ=="],
 
-    "@radix-ui/react-accordion": ["@radix-ui/react-accordion@1.2.12", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collapsible": "1.1.12", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-T4nygeh9YE9dLRPhAHSeOZi7HBXo+0kYIPJXayZfvWOWA0+n3dESrZbjfDPUABkUNym6Hd+f2IR113To8D2GPA=="],
+    "@radix-ui/react-accordion": ["@radix-ui/react-accordion@1.2.14", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collapsible": "1.1.14", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-iE8YB9nmTBH8zd73ofBISZ8JCzgMoMkATJr7qDwa6u5F1+7mTM81V6fa71jgZ65rpjVpecDf1vSnwIFP9Ly1zw=="],
 
-    "@radix-ui/react-alert-dialog": ["@radix-ui/react-alert-dialog@1.1.15", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-dialog": "1.1.15", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-oTVLkEw5GpdRe29BqJ0LSDFWI3qu0vR1M0mUkOQWDIUnY/QIkLpgDMWuKxP94c2NAC2LGcgVhG1ImF3jkZ5wXw=="],
+    "@radix-ui/react-alert-dialog": ["@radix-ui/react-alert-dialog@1.1.17", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-dialog": "1.1.17", "@radix-ui/react-primitive": "2.1.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-563ygGeyWPrxyVCNp7OV4rE2aIXhFPknpFyo4wbDlcyMMPZ6ySh+zC5WTvY0ZFLgPTg/QB6tA8PyDQyJ2b4cPg=="],
 
-    "@radix-ui/react-arrow": ["@radix-ui/react-arrow@1.1.7", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-F+M1tLhO+mlQaOWspE8Wstg+z6PwxwRd8oQ8IXceWz92kfAmalTRf0EjrouQeo7QssEPfCn05B4Ihs1K9WQ/7w=="],
+    "@radix-ui/react-arrow": ["@radix-ui/react-arrow@1.1.10", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-j2VTDz1vgCsmuG0k5lBfOcM8n5JPFqZBcMryasFjHYMhwxYL5SRUV5lMSUpRdNtw3D/Sv8pzJtrlAgkssYSsQQ=="],
 
-    "@radix-ui/react-aspect-ratio": ["@radix-ui/react-aspect-ratio@1.1.7", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Yq6lvO9HQyPwev1onK1daHCHqXVLzPhSVjmsNjCa2Zcxy2f7uJD2itDtxknv6FzAKCwD1qQkeVDmX/cev13n/g=="],
+    "@radix-ui/react-aspect-ratio": ["@radix-ui/react-aspect-ratio@1.1.10", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-kbI7NrqhDeuytYrq7JjAsoXczvL8wgj2tc1MyaYWm+50bMKHCHQtVWCryslx4cCpmCTTkBcwQckE4CmmGV2haQ=="],
 
-    "@radix-ui/react-avatar": ["@radix-ui/react-avatar@1.1.11", "", { "dependencies": { "@radix-ui/react-context": "1.1.3", "@radix-ui/react-primitive": "2.1.4", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-is-hydrated": "0.1.0", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-0Qk603AHGV28BOBO34p7IgD5m+V5Sg/YovfayABkoDDBM5d3NCx0Mp4gGrjzLGes1jV5eNOE1r3itqOR33VC6Q=="],
+    "@radix-ui/react-avatar": ["@radix-ui/react-avatar@1.2.0", "", { "dependencies": { "@radix-ui/react-context": "1.1.4", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-is-hydrated": "0.1.1", "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-am/CwltXtmtdtP+5FbYblYDnMa/zuKcMJP1i3/SJMDXXfj2mG+BTqLH2wucqeyyiQMursUtg/5cK+Nh2pCaSOA=="],
 
-    "@radix-ui/react-checkbox": ["@radix-ui/react-checkbox@1.3.3", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-previous": "1.1.1", "@radix-ui/react-use-size": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wBbpv+NQftHDdG86Qc0pIyXk5IR3tM8Vd0nWLKDcX8nNn4nXFOFwsKuqw2okA/1D/mpaAkmuyndrPJTYDNZtFw=="],
+    "@radix-ui/react-checkbox": ["@radix-ui/react-checkbox@1.3.5", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-previous": "1.1.2", "@radix-ui/react-use-size": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-pREzrmNnVwGvYaBoM64huTRK7B3lrTRuwj8A9nwhPiEtMb+yudiWh6zWAqEtP0Dzd5+iBa1Ki7V1pCxV8ExMdA=="],
 
-    "@radix-ui/react-collapsible": ["@radix-ui/react-collapsible@1.1.12", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Uu+mSh4agx2ib1uIGPP4/CKNULyajb3p92LsVXmH2EHVMTfZWpll88XJ0j4W0z3f8NK1eYl1+Mf/szHPmcHzyA=="],
+    "@radix-ui/react-collapsible": ["@radix-ui/react-collapsible@1.1.14", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-9bT+FvifX1FK2Mj6UEsTdyu0cN3JaA3KdfhaBao+ONrYFy/pyOy3TU1TNw7iOk1o+0hOEq67RojlUUmoFGwxyA=="],
 
-    "@radix-ui/react-collection": ["@radix-ui/react-collection@1.1.7", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Fh9rGN0MoI4ZFUNyfFVNU4y9LUz93u9/0K+yLgA2bwRojxM8JU1DyvvMBabnZPBgMWREAJvU2jjVzq+LrFUglw=="],
+    "@radix-ui/react-collection": ["@radix-ui/react-collection@1.1.10", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-IVVz4EvBcKjrzKgof714qDnz/SzQAkLA2Emh5edlHbgcE6fNd3Un6CJLlaYcnm8N4JmAtzQgse4dOKxcD2yc9g=="],
 
     "@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg=="],
 
-    "@radix-ui/react-context": ["@radix-ui/react-context@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA=="],
+    "@radix-ui/react-context": ["@radix-ui/react-context@1.1.4", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-QwH4PO5urrbO+FaGd5Aglg+YJgWTyyuZ3g/6mKvsqraLkglDdckw9JafgL5McL5VEJ6EPNduPaT3ZE9BttDAqg=="],
 
-    "@radix-ui/react-context-menu": ["@radix-ui/react-context-menu@2.2.16", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-menu": "2.1.16", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-O8morBEW+HsVG28gYDZPTrT9UUovQUlJue5YO836tiTJhuIWBm/zQHc7j388sHWtdH/xUZurK9olD2+pcqx5ww=="],
+    "@radix-ui/react-context-menu": ["@radix-ui/react-context-menu@2.3.1", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-menu": "2.1.18", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-XbrxS68W5dyiE4fAb96yvJwSVU5x66B20A99sD5Mk3xSWK/LqeOnx6TZnim1KieMjXS/CTFq8reOAjWxas2G8Q=="],
 
-    "@radix-ui/react-dialog": ["@radix-ui/react-dialog@1.1.15", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-focus-guards": "1.1.3", "@radix-ui/react-focus-scope": "1.1.7", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-slot": "1.2.3", "@radix-ui/react-use-controllable-state": "1.2.2", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.6.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-TCglVRtzlffRNxRMEyR36DGBLJpeusFcgMVD9PZEzAKnUs1lKCgX5u9BmC2Yg+LL9MgZDugFFs1Vl+Jp4t/PGw=="],
+    "@radix-ui/react-dialog": ["@radix-ui/react-dialog@1.1.17", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-focus-guards": "1.1.4", "@radix-ui/react-focus-scope": "1.1.10", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-portal": "1.1.12", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-slot": "1.3.0", "@radix-ui/react-use-controllable-state": "1.2.3", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.7.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-TDTYmpdq8dI2+Xgvgj9AJ8Ghqq+Eph/TRVEdaFQPDItIY+6QSkU7MJMeevw1568Yw/2Ijz8BTphPSP2XejKphw=="],
 
-    "@radix-ui/react-direction": ["@radix-ui/react-direction@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-1UEWRX6jnOA2y4H5WczZ44gOOjTEmlqv1uNW4GAJEO5+bauCBhv8snY65Iw5/VOS/ghKN9gr2KjnLKxrsvoMVw=="],
+    "@radix-ui/react-direction": ["@radix-ui/react-direction@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-C3vFhbyi4SW3PmbAi6Awpu4OzJtd0MxGurvSsYtr7p7nM8RNB3VAF3CUmnp2j50knpkrRcB7+ycVXzgLgF6yNA=="],
 
-    "@radix-ui/react-dismissable-layer": ["@radix-ui/react-dismissable-layer@1.1.11", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-escape-keydown": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Nqcp+t5cTB8BinFkZgXiMJniQH0PsUt2k51FUhbdfeKvc4ACcG2uQniY/8+h1Yv6Kza4Q7lD7PQV0z0oicE0Mg=="],
+    "@radix-ui/react-dismissable-layer": ["@radix-ui/react-dismissable-layer@1.1.13", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-escape-keydown": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-2v+zNAWWe0ySxgC0D0yeXMPQ23xZVgXZTerTz+JKlmdRj6gfTqmCcR29jb6d290DezXPGgruHWDX/vYUebtErg=="],
 
-    "@radix-ui/react-dropdown-menu": ["@radix-ui/react-dropdown-menu@2.1.16", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-menu": "2.1.16", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-1PLGQEynI/3OX/ftV54COn+3Sud/Mn8vALg2rWnBLnRaGtJDduNW/22XjlGgPdpcIbiQxjKtb7BkcjP00nqfJw=="],
+    "@radix-ui/react-dropdown-menu": ["@radix-ui/react-dropdown-menu@2.1.18", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-menu": "2.1.18", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-PZGV82gFk0WltDRI//SsG28ZIjlo9ANTmoNYg0jLNzXXiDsAy5PkOOYQaVD1pPxY6t7gxffb1QMD6qaUvsBZdw=="],
 
-    "@radix-ui/react-focus-guards": ["@radix-ui/react-focus-guards@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-0rFg/Rj2Q62NCm62jZw0QX7a3sz6QCQU0LpZdNrJX8byRGaGVTqbrW9jAoIAHyMQqsNpeZ81YgSizOt5WXq0Pw=="],
+    "@radix-ui/react-focus-guards": ["@radix-ui/react-focus-guards@1.1.4", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-cot/aB/mOm0IYVYTTmQcEEK1M48lZWi8FlYe5nDPQQ8NYZUlXEFgncJ9p2Kzer3RKSrY7cTTpEMLZKNo9QoP5Q=="],
 
-    "@radix-ui/react-focus-scope": ["@radix-ui/react-focus-scope@1.1.7", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-t2ODlkXBQyn7jkl6TNaw/MtVEVvIGelJDCG41Okq/KwUsJBwQ4XVZsHAVUkK4mBv3ewiAS3PGuUWuY2BoK4ZUw=="],
+    "@radix-ui/react-focus-scope": ["@radix-ui/react-focus-scope@1.1.10", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-callback-ref": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Fas/lXQqhVvqwAb64s5RFeHiHYElZ6SUQbZaNd6EkfhP/Al7wTIQ9WIR4QVX475tlu5yFCEdDcJH6/UwsZjMWw=="],
 
-    "@radix-ui/react-form": ["@radix-ui/react-form@0.1.8", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-label": "2.1.7", "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-QM70k4Zwjttifr5a4sZFts9fn8FzHYvQ5PiB19O2HsYibaHSVt9fH9rzB0XZo/YcM+b7t/p7lYCT/F5eOeF5yQ=="],
+    "@radix-ui/react-form": ["@radix-ui/react-form@0.1.10", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-label": "2.1.10", "@radix-ui/react-primitive": "2.1.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-1NfuvctVtX4sU3Mmq/IdrR8UunxiCMiVg3A5UENKhFzxUBeOyaQQ+lmaQaV7Tc8cqvBKsJL3/KGBsixK0D8WFg=="],
 
-    "@radix-ui/react-hover-card": ["@radix-ui/react-hover-card@1.1.15", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-popper": "1.2.8", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-qgTkjNT1CfKMoP0rcasmlH2r1DAiYicWsDsufxl940sT2wHNEWWv6FMWIQXWhVdmC1d/HYfbhQx60KYyAtKxjg=="],
+    "@radix-ui/react-hover-card": ["@radix-ui/react-hover-card@1.1.17", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-popper": "1.3.1", "@radix-ui/react-portal": "1.1.12", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-GjZQIEANVkuuWeztlKz6QEHe31ZX2iDfHzcTMCQVZXC0JyQrgfKWSC+LOOEw6aVV64zyjzobIzSA4AU4eKWrHA=="],
 
     "@radix-ui/react-id": ["@radix-ui/react-id@1.1.1", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-kGkGegYIdQsOb4XjsfM97rXsiHaBwco+hFI66oO4s9LU+PLAC5oJ7khdOVFxkhsmlbpUqDAvXw11CluXP+jkHg=="],
 
-    "@radix-ui/react-label": ["@radix-ui/react-label@2.1.8", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.4" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-FmXs37I6hSBVDlO4y764TNz1rLgKwjJMQ0EGte6F3Cb3f4bIuHB/iLa/8I9VKkmOy+gNHq8rql3j686ACVV21A=="],
+    "@radix-ui/react-label": ["@radix-ui/react-label@2.1.10", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-ib0zvq2ZsAqKm5tRnqGJn3vOxSgIts5ToxsXT0q1S/GfLD1Zj7UOEnkw8u2w6sRmn47djpQWuSU1DCL1R29/yw=="],
 
-    "@radix-ui/react-menu": ["@radix-ui/react-menu@2.1.16", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-focus-guards": "1.1.3", "@radix-ui/react-focus-scope": "1.1.7", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-popper": "1.2.8", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-roving-focus": "1.1.11", "@radix-ui/react-slot": "1.2.3", "@radix-ui/react-use-callback-ref": "1.1.1", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.6.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-72F2T+PLlphrqLcAotYPp0uJMr5SjP5SL01wfEspJbru5Zs5vQaSHb4VB3ZMJPimgHHCHG7gMOeOB9H3Hdmtxg=="],
+    "@radix-ui/react-menu": ["@radix-ui/react-menu@2.1.18", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-focus-guards": "1.1.4", "@radix-ui/react-focus-scope": "1.1.10", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-popper": "1.3.1", "@radix-ui/react-portal": "1.1.12", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-roving-focus": "1.1.13", "@radix-ui/react-slot": "1.3.0", "@radix-ui/react-use-callback-ref": "1.1.2", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.7.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-lj8Rxjtn6zJq1oSbE/uDtAwCbB9BnxgHD+8MwJMuTh6u1dPamYhW9iuELr/Z8d0D/UysFblYYHeBPwi7T4k0YQ=="],
 
-    "@radix-ui/react-menubar": ["@radix-ui/react-menubar@1.1.16", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-menu": "2.1.16", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-roving-focus": "1.1.11", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-EB1FktTz5xRRi2Er974AUQZWg2yVBb1yjip38/lgwtCVRd3a+maUoGHN/xs9Yv8SY8QwbSEb+YrxGadVWbEutA=="],
+    "@radix-ui/react-menubar": ["@radix-ui/react-menubar@1.1.18", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-menu": "2.1.18", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-roving-focus": "1.1.13", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-hX7EGx/oFq6DPY27GQuP/2wP48GHf5LG6r06VgNJlG+znmDS8OfopZcRcGly3L4lsB9FqpmLx6JQSE9P3BUpyw=="],
 
-    "@radix-ui/react-navigation-menu": ["@radix-ui/react-navigation-menu@1.2.14", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-layout-effect": "1.1.1", "@radix-ui/react-use-previous": "1.1.1", "@radix-ui/react-visually-hidden": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-YB9mTFQvCOAQMHU+C/jVl96WmuWeltyUEpRJJky51huhds5W2FQr1J8D/16sQlf0ozxkPK8uF3niQMdUwZPv5w=="],
+    "@radix-ui/react-navigation-menu": ["@radix-ui/react-navigation-menu@1.2.16", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-layout-effect": "1.1.2", "@radix-ui/react-use-previous": "1.1.2", "@radix-ui/react-visually-hidden": "1.2.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-nJ0SkrSQgudyYhMiYeHA1ayLVuduEJCFLan1RZZN7c9kqzzCFLaU9kuy81uNtqzweM9YaQPgWzxi9MwQ9jZ04g=="],
 
-    "@radix-ui/react-one-time-password-field": ["@radix-ui/react-one-time-password-field@0.1.8", "", { "dependencies": { "@radix-ui/number": "1.1.1", "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-roving-focus": "1.1.11", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-effect-event": "0.0.2", "@radix-ui/react-use-is-hydrated": "0.1.0", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-ycS4rbwURavDPVjCb5iS3aG4lURFDILi6sKI/WITUMZ13gMmn/xGjpLoqBAalhJaDk8I3UbCM5GzKHrnzwHbvg=="],
+    "@radix-ui/react-one-time-password-field": ["@radix-ui/react-one-time-password-field@0.1.10", "", { "dependencies": { "@radix-ui/number": "1.1.2", "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-roving-focus": "1.1.13", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-effect-event": "0.0.3", "@radix-ui/react-use-is-hydrated": "0.1.1", "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-GHkcJ+WVj91At+OvUVTD4R3W0/wxw9t/sG5xFUBYXaCbtWiooZX5Md376QjJqgH4VsVyXrbVNHO2O4NYcmjfVg=="],
 
-    "@radix-ui/react-password-toggle-field": ["@radix-ui/react-password-toggle-field@0.1.3", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-effect-event": "0.0.2", "@radix-ui/react-use-is-hydrated": "0.1.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-/UuCrDBWravcaMix4TdT+qlNdVwOM1Nck9kWx/vafXsdfj1ChfhOdfi3cy9SGBpWgTXwYCuboT/oYpJy3clqfw=="],
+    "@radix-ui/react-password-toggle-field": ["@radix-ui/react-password-toggle-field@0.1.5", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-effect-event": "0.0.3", "@radix-ui/react-use-is-hydrated": "0.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-fVuA82u0b/fClpbEJv8yp1nU9eSvoSEOERsU/hhf3FXGPIvkmE7oEaHEu8poowoXO39/Va7zq2E0TUcYr1dBRg=="],
 
-    "@radix-ui/react-popover": ["@radix-ui/react-popover@1.1.15", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-focus-guards": "1.1.3", "@radix-ui/react-focus-scope": "1.1.7", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-popper": "1.2.8", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-slot": "1.2.3", "@radix-ui/react-use-controllable-state": "1.2.2", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.6.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-kr0X2+6Yy/vJzLYJUPCZEc8SfQcf+1COFoAqauJm74umQhta9M7lNJHP7QQS3vkvcGLQUbWpMzwrXYwrYztHKA=="],
+    "@radix-ui/react-popover": ["@radix-ui/react-popover@1.1.17", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-focus-guards": "1.1.4", "@radix-ui/react-focus-scope": "1.1.10", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-popper": "1.3.1", "@radix-ui/react-portal": "1.1.12", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-slot": "1.3.0", "@radix-ui/react-use-controllable-state": "1.2.3", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.7.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-/YSAOdJ7YJvdn7bn5sdSx2egW+SKY+u7O5RyAVs94Ymrg2fg5QTSFPMRkzvhGyFuE4/qsmPBdrwYoZMZh/4f+g=="],
 
-    "@radix-ui/react-popper": ["@radix-ui/react-popper@1.2.8", "", { "dependencies": { "@floating-ui/react-dom": "^2.0.0", "@radix-ui/react-arrow": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-layout-effect": "1.1.1", "@radix-ui/react-use-rect": "1.1.1", "@radix-ui/react-use-size": "1.1.1", "@radix-ui/rect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-0NJQ4LFFUuWkE7Oxf0htBKS6zLkkjBH+hM1uk7Ng705ReR8m/uelduy1DBo0PyBXPKVnBA6YBlU94MBGXrSBCw=="],
+    "@radix-ui/react-popper": ["@radix-ui/react-popper@1.3.1", "", { "dependencies": { "@floating-ui/react-dom": "^2.0.0", "@radix-ui/react-arrow": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-layout-effect": "1.1.2", "@radix-ui/react-use-rect": "1.1.2", "@radix-ui/react-use-size": "1.1.2", "@radix-ui/rect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-bhnq/0DEPTi2lsOD3J5rTL65qUKHbKbhqHsmN9TMiclSXpipi651ooUKPPp6G5lF/WiHBdn1s0Wuqsn+myVAvw=="],
 
-    "@radix-ui/react-portal": ["@radix-ui/react-portal@1.1.9", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-bpIxvq03if6UNwXZ+HTK71JLh4APvnXntDc6XOX8UVq4XQOVl7lwok0AvIl+b8zgCw3fSaVTZMpAPPagXbKmHQ=="],
+    "@radix-ui/react-portal": ["@radix-ui/react-portal@1.1.12", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m309havGzsjLHHaIX50G5PlvRs3xkgPCsGk/5PTvYm8D5q33yG0J7w/712PTOhid7NTaFETtnSXjngHQavvhVw=="],
 
-    "@radix-ui/react-presence": ["@radix-ui/react-presence@1.1.5", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-/jfEwNDdQVBCNvjkGit4h6pMOzq8bHkopq458dPt2lMjx+eBQUohZNG9A7DtO/O5ukSbxuaNGXMjHicgwy6rQQ=="],
+    "@radix-ui/react-presence": ["@radix-ui/react-presence@1.1.6", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-zdTk4PlUO0E18HnZ3wYbW0KkJJxWCdiNYp6g6X1PtONFhxVkg01vliTJAmwIszU6mHiyBOoW9P0rAugl5/hULQ=="],
 
-    "@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.4", "", { "dependencies": { "@radix-ui/react-slot": "1.2.4" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-9hQc4+GNVtJAIEPEqlYqW5RiYdrr8ea5XQ0ZOnD6fgru+83kqT15mq2OCcbe8KnjRZl5vF3ks69AKz3kh1jrhg=="],
+    "@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
 
-    "@radix-ui/react-progress": ["@radix-ui/react-progress@1.1.7", "", { "dependencies": { "@radix-ui/react-context": "1.1.2", "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-vPdg/tF6YC/ynuBIJlk1mm7Le0VgW6ub6J2UWnTQ7/D23KXcPI1qy+0vBkgKgd38RCMJavBXpB83HPNFMTb0Fg=="],
+    "@radix-ui/react-progress": ["@radix-ui/react-progress@1.1.10", "", { "dependencies": { "@radix-ui/react-context": "1.1.4", "@radix-ui/react-primitive": "2.1.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-JYzEg60lk79PwKM27WZyKd7PW8O4OM5jOaFfRPfOyeXmMw7tLJh5kSj+CEjVTehszuwml/AdCzPGMXBTGf4BBw=="],
 
-    "@radix-ui/react-radio-group": ["@radix-ui/react-radio-group@1.3.8", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-roving-focus": "1.1.11", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-previous": "1.1.1", "@radix-ui/react-use-size": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-VBKYIYImA5zsxACdisNQ3BjCBfmbGH3kQlnFVqlWU4tXwjy7cGX8ta80BcrO+WJXIn5iBylEH3K6ZTlee//lgQ=="],
+    "@radix-ui/react-radio-group": ["@radix-ui/react-radio-group@1.4.1", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-roving-focus": "1.1.13", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-previous": "1.1.2", "@radix-ui/react-use-size": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-/SSxZdKEo2Eo29FFRKd06EfFDYp8HryKg0WYg7QLXaydPzl52YfSvCH2a3QDBRdtcuwACroJT8UVjQVgOJ7P9A=="],
 
-    "@radix-ui/react-roving-focus": ["@radix-ui/react-roving-focus@1.1.11", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-7A6S9jSgm/S+7MdtNDSb+IU859vQqJ/QAtcYQcfFC6W8RS4IxIZDldLR0xqCFZ6DCyrQLjLPsxtTNch5jVA4lA=="],
+    "@radix-ui/react-roving-focus": ["@radix-ui/react-roving-focus@1.1.13", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-9gkwneI0guf8JDmrFxPjJF6Ozzgioyw+/lonYNCwefS9ZHA05er0BVHiXr+LbWGHxUfczvMY6G1oiZZi1VzjRw=="],
 
-    "@radix-ui/react-scroll-area": ["@radix-ui/react-scroll-area@1.2.10", "", { "dependencies": { "@radix-ui/number": "1.1.1", "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-tAXIa1g3sM5CGpVT0uIbUx/U3Gs5N8T52IICuCtObaos1S8fzsrPXG5WObkQN3S6NVl6wKgPhAIiBGbWnvc97A=="],
+    "@radix-ui/react-scroll-area": ["@radix-ui/react-scroll-area@1.2.12", "", { "dependencies": { "@radix-ui/number": "1.1.2", "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-xuafVzQiTCLsyEjakowTdG3OgTXsmO7IdCiO77otIa+z44xoLNs9Do5eg7POFumIOCjtG6djfm6RKUKpUa/csA=="],
 
-    "@radix-ui/react-select": ["@radix-ui/react-select@2.2.6", "", { "dependencies": { "@radix-ui/number": "1.1.1", "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-focus-guards": "1.1.3", "@radix-ui/react-focus-scope": "1.1.7", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-popper": "1.2.8", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-slot": "1.2.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-layout-effect": "1.1.1", "@radix-ui/react-use-previous": "1.1.1", "@radix-ui/react-visually-hidden": "1.2.3", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.6.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-I30RydO+bnn2PQztvo25tswPH+wFBjehVGtmagkU78yMdwTwVf12wnAOF+AeP8S2N8xD+5UPbGhkUfPyvT+mwQ=="],
+    "@radix-ui/react-select": ["@radix-ui/react-select@2.3.1", "", { "dependencies": { "@radix-ui/number": "1.1.2", "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-focus-guards": "1.1.4", "@radix-ui/react-focus-scope": "1.1.10", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-popper": "1.3.1", "@radix-ui/react-portal": "1.1.12", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-slot": "1.3.0", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-layout-effect": "1.1.2", "@radix-ui/react-use-previous": "1.1.2", "@radix-ui/react-visually-hidden": "1.2.6", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.7.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-w6eDvY78LE9ZUiNnXCA1QVK8RYN7k9galFv09kjVydJqBAgHd7Y9A6h0UJ/6DCZNGZMZrB2ohcSW1Bo9d8+wWA=="],
 
-    "@radix-ui/react-separator": ["@radix-ui/react-separator@1.1.7", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-0HEb8R9E8A+jZjvmFCy/J4xhbXy3TV+9XSnGJ3KvTtjlIUy/YQ/p6UYZvi7YbeoeXdyU9+Y3scizK6hkY37baA=="],
+    "@radix-ui/react-separator": ["@radix-ui/react-separator@1.1.10", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Y6K6jLQCVfCnTL2MEtGxDLffkhNfEfHsEg3Wa8JU+IWdn3EWbLXd3OuOfQRN7p/W/cUce1WyTk3QeuAoDBzN9g=="],
 
-    "@radix-ui/react-slider": ["@radix-ui/react-slider@1.3.6", "", { "dependencies": { "@radix-ui/number": "1.1.1", "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-layout-effect": "1.1.1", "@radix-ui/react-use-previous": "1.1.1", "@radix-ui/react-use-size": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-JPYb1GuM1bxfjMRlNLE+BcmBC8onfCi60Blk7OBqi2MLTFdS+8401U4uFjnwkOr49BLmXxLC6JHkvAsx5OJvHw=="],
+    "@radix-ui/react-slider": ["@radix-ui/react-slider@1.4.1", "", { "dependencies": { "@radix-ui/number": "1.1.2", "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-layout-effect": "1.1.2", "@radix-ui/react-use-previous": "1.1.2", "@radix-ui/react-use-size": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-r91WSpQucNGFKAIxT8FT0H0zyjd5tJlqObLp7LOMV4z49KoDCwjy01w3vDOU4e1wxhF9IgjYco7SB6byOW7Buw=="],
 
-    "@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.4", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Jl+bCv8HxKnlTLVrcDE8zTMJ09R9/ukw4qBs/oZClOfoQk/cOTbDn+NceXfV7j09YPVQUryJPHurafcSg6EVKA=="],
+    "@radix-ui/react-slot": ["@radix-ui/react-slot@1.3.0", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.3" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-MojKku4U/miO8Av4Dkb+ctMAQx7JmY96LmtDQlAarCRtd7rN52QCSzBF+XAvr5S6coSVj9HEPBgHAHKEJVk/WA=="],
 
-    "@radix-ui/react-switch": ["@radix-ui/react-switch@1.2.6", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-previous": "1.1.1", "@radix-ui/react-use-size": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-bByzr1+ep1zk4VubeEVViV592vu2lHE2BZY5OnzehZqOOgogN80+mNtCqPkhn2gklJqOpxWgPoYTSnhBCqpOXQ=="],
+    "@radix-ui/react-switch": ["@radix-ui/react-switch@1.3.1", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-previous": "1.1.2", "@radix-ui/react-use-size": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-55bQtCnOB0BohomSHi6qvQXpJEEqUGDm6hRrM0Bph5OXwhSegqkd8IqgBAQkM1IlgUlWZIxpxRcpOEfRIgimyw=="],
 
-    "@radix-ui/react-tabs": ["@radix-ui/react-tabs@1.1.13", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-roving-focus": "1.1.11", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-7xdcatg7/U+7+Udyoj2zodtI9H/IIopqo+YOIcZOq1nJwXWBZ9p8xiu5llXlekDbZkca79a/fozEYQXIA4sW6A=="],
+    "@radix-ui/react-tabs": ["@radix-ui/react-tabs@1.1.15", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-roving-focus": "1.1.13", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-kxc9gI6/HfcU4nfMMVS3AmQK414kbU1IE6UCJmMmxjhO3cRPXOyYnmvyKD+ODt7q56nRq9l7Wovi6uaGwKgMlg=="],
 
-    "@radix-ui/react-toast": ["@radix-ui/react-toast@1.2.15", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-layout-effect": "1.1.1", "@radix-ui/react-visually-hidden": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-3OSz3TacUWy4WtOXV38DggwxoqJK4+eDkNMl5Z/MJZaoUPaP4/9lf81xXMe1I2ReTAptverZUpbPY4wWwWyL5g=="],
+    "@radix-ui/react-toast": ["@radix-ui/react-toast@1.2.17", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-portal": "1.1.12", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-layout-effect": "1.1.2", "@radix-ui/react-visually-hidden": "1.2.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-uL4kyyWy000pPL43fGGCV5qT6ZchCWEQZOSlkYiPwPt8Hy1iW38RjeptIvz1/SZesrW6Vn58Ct3sV7tfEfiAbw=="],
 
-    "@radix-ui/react-toggle": ["@radix-ui/react-toggle@1.1.10", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-lS1odchhFTeZv3xwHH31YPObmJn8gOg7Lq12inrr0+BH/l3Tsq32VfjqH1oh80ARM3mlkfMic15n0kg4sD1poQ=="],
+    "@radix-ui/react-toggle": ["@radix-ui/react-toggle@1.1.12", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-AsAVsYNZIlRBsci7BhE+QyQeKd1h6TffJYt+lF0QQkd5OpQ3klfIByPsCb4G0h/Fq6PJwh1FYNluzBFYzhk4+w=="],
 
-    "@radix-ui/react-toggle-group": ["@radix-ui/react-toggle-group@1.1.11", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-roving-focus": "1.1.11", "@radix-ui/react-toggle": "1.1.10", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-5umnS0T8JQzQT6HbPyO7Hh9dgd82NmS36DQr+X/YJ9ctFNCiiQd6IJAYYZ33LUwm8M+taCz5t2ui29fHZc4Y6Q=="],
+    "@radix-ui/react-toggle-group": ["@radix-ui/react-toggle-group@1.1.13", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-roving-focus": "1.1.13", "@radix-ui/react-toggle": "1.1.12", "@radix-ui/react-use-controllable-state": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Xb9PLtlvU66F36LiKba6dFswu6V2mDkgidO4fNSbQHQwmZ9ObxMIO17MN/LJ4aWJecVuSVLAHPZjyeMzJrgeiA=="],
 
-    "@radix-ui/react-toolbar": ["@radix-ui/react-toolbar@1.1.11", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-roving-focus": "1.1.11", "@radix-ui/react-separator": "1.1.7", "@radix-ui/react-toggle-group": "1.1.11" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-4ol06/1bLoFu1nwUqzdD4Y5RZ9oDdKeiHIsntug54Hcr1pgaHiPqHFEaXI1IFP/EsOfROQZ8Mig9VTIRza6Tjg=="],
+    "@radix-ui/react-toolbar": ["@radix-ui/react-toolbar@1.1.13", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-roving-focus": "1.1.13", "@radix-ui/react-separator": "1.1.10", "@radix-ui/react-toggle-group": "1.1.13" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Za1l4f6fzTkGgz/iynAMN8iaqiKff2wm2/QwiLmHPtDQreWEBrvSimgQFIekxMUdRPhILM7xdIXxuS/o/DGZag=="],
 
     "@radix-ui/react-tooltip": ["@radix-ui/react-tooltip@1.2.8", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-popper": "1.2.8", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-slot": "1.2.3", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-visually-hidden": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-tY7sVt1yL9ozIxvmbtN5qtmH2krXcBCfjEiCgKGLqunJHvgvZG2Pcl2oQ3kbcZARb1BGEHdkLzcYGO8ynVlieg=="],
 
-    "@radix-ui/react-use-callback-ref": ["@radix-ui/react-use-callback-ref@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg=="],
+    "@radix-ui/react-use-callback-ref": ["@radix-ui/react-use-callback-ref@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-xCso9j1/u8sEgP1RNHjFrXJLApL8LiqOkI1R4ywuN00rxWdYg4oQXuwKLS3i0j5NWLromUD27/4nlxj2UFVvIw=="],
 
-    "@radix-ui/react-use-controllable-state": ["@radix-ui/react-use-controllable-state@1.2.2", "", { "dependencies": { "@radix-ui/react-use-effect-event": "0.0.2", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg=="],
+    "@radix-ui/react-use-controllable-state": ["@radix-ui/react-use-controllable-state@1.2.3", "", { "dependencies": { "@radix-ui/react-use-effect-event": "0.0.3", "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-PLzC90MS+ReootmjC597dvopoelpZ8Q61HJkDXZSExitIq7PL55vHNnesAHwguHK0aPfBnpdNzQtv1uliaqQrA=="],
 
-    "@radix-ui/react-use-effect-event": ["@radix-ui/react-use-effect-event@0.0.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA=="],
+    "@radix-ui/react-use-effect-event": ["@radix-ui/react-use-effect-event@0.0.3", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-6c8ZqvPTWILEKnyVkP53EGRCcpnJiKTC21sS/6R1GF5xKyHJJWQEPfkqlcgUkdRQivd6tb23abUwe4ngWmY0JA=="],
 
-    "@radix-ui/react-use-escape-keydown": ["@radix-ui/react-use-escape-keydown@1.1.1", "", { "dependencies": { "@radix-ui/react-use-callback-ref": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g=="],
+    "@radix-ui/react-use-escape-keydown": ["@radix-ui/react-use-escape-keydown@1.1.2", "", { "dependencies": { "@radix-ui/react-use-callback-ref": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-2uVLvLjgO7NZCWw01/FdqRwmA42J0BcjPMUCA+koFEOAb+zjqIP7SiFz/7zWPrKnVmSqr76Omq2ALyCuX4dhLw=="],
 
-    "@radix-ui/react-use-is-hydrated": ["@radix-ui/react-use-is-hydrated@0.1.0", "", { "dependencies": { "use-sync-external-store": "^1.5.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-U+UORVEq+cTnRIaostJv9AGdV3G6Y+zbVd+12e18jQ5A3c0xL03IhnHuiU4UV69wolOQp5GfR58NW/EgdQhwOA=="],
+    "@radix-ui/react-use-is-hydrated": ["@radix-ui/react-use-is-hydrated@0.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-qwOiz4Tjo8CNnrOLAYUMXeZwDzXgXpvK4TKQPmWLECM9XoWvA6+0Z2/7Ag3A4ivjS4ovbLJPbskkxioFyBhr8A=="],
 
-    "@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ=="],
+    "@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA=="],
 
-    "@radix-ui/react-use-previous": ["@radix-ui/react-use-previous@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-2dHfToCj/pzca2Ck724OZ5L0EVrr3eHRNsG/b3xQJLA2hZpVCS99bLAX+hm1IHXDEnzU6by5z/5MIY794/a8NQ=="],
+    "@radix-ui/react-use-previous": ["@radix-ui/react-use-previous@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-IGBQPtRFdhN6MQ8dbegVmBq1LVZluya3F1jWY+puIcQC3MHctRwTDSBWCkL/3ZcnMJLTMJ++Z+ktmvg0F89iCw=="],
 
-    "@radix-ui/react-use-rect": ["@radix-ui/react-use-rect@1.1.1", "", { "dependencies": { "@radix-ui/rect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-QTYuDesS0VtuHNNvMh+CjlKJ4LJickCMUAqjlE3+j8w+RlRpwyX3apEQKGFzbZGdo7XNG1tXa+bQqIE7HIXT2w=="],
+    "@radix-ui/react-use-rect": ["@radix-ui/react-use-rect@1.1.2", "", { "dependencies": { "@radix-ui/rect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-d8a+bBY/FxikNPlgJJoaBHZX+zKVbWHYJGTLnLvveQgFSTntkGdEKv3JDtHrMS0DNYpllz2nRsTLGLKYttbpmw=="],
 
-    "@radix-ui/react-use-size": ["@radix-ui/react-use-size@1.1.1", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-ewrXRDTAqAXlkl6t/fkXWNAhFX9I+CkKlw6zjEwk86RSPKwZr3xpBRso655aqYafwtnbpHLj6toFzmd6xdVptQ=="],
+    "@radix-ui/react-use-size": ["@radix-ui/react-use-size@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-giWQp+4mxjBPt4KZ0MmyuykFNWfbDxKt4x+fPkRYmgRFJSbCZFzUglvMb/Kjn38tm10YP4ufiQZDx3zna4LU6w=="],
 
-    "@radix-ui/react-visually-hidden": ["@radix-ui/react-visually-hidden@1.2.3", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-pzJq12tEaaIhqjbzpCuv/OypJY/BPavOofm+dbab+MHLajy277+1lLm6JFcGgF5eskJ6mquGirhXY2GD/8u8Ug=="],
+    "@radix-ui/react-visually-hidden": ["@radix-ui/react-visually-hidden@1.2.6", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-jCE0WljWifTI4niIMCll06kGpsJTAPiZVU9H4WR1N6qW7At9ystHbN7dDB+we2xH535roFHj7qKS+RGj0FMDWQ=="],
 
-    "@radix-ui/rect": ["@radix-ui/rect@1.1.1", "", {}, "sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw=="],
+    "@radix-ui/rect": ["@radix-ui/rect@1.1.2", "", {}, "sha512-xnXE7wG13PI+cxieVssYXlQJuYVRhH9NBoxt3KNwzghDIA69GMm7d4wXRouHIYjE+KvS6U/MsMO73NdS2MH9ZA=="],
 
     "@react-email/body": ["@react-email/body@0.3.0", "", { "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-uGo0BOOzjbMUo3lu+BIDWayvn5o6Xyfmnlla5VGf05n8gHMvO1ll7U4FtzWe3hxMLwt53pmc4iE0M+B5slG+Ug=="],
 
@@ -844,197 +939,137 @@
 
     "@react-email/text": ["@react-email/text@0.1.6", "", { "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-TYqkioRS45wTR5il3dYk/SbUjjEdhSwh9BtRNB99qNH1pXAwA45H7rAuxehiu8iJQJH0IyIr+6n62gBz9ezmsw=="],
 
-    "@reduxjs/toolkit": ["@reduxjs/toolkit@2.11.2", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "@standard-schema/utils": "^0.3.0", "immer": "^11.0.0", "redux": "^5.0.1", "redux-thunk": "^3.1.0", "reselect": "^5.1.0" }, "peerDependencies": { "react": "^16.9.0 || ^17.0.0 || ^18 || ^19", "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0" }, "optionalPeers": ["react", "react-redux"] }, "sha512-Kd6kAHTA6/nUpp8mySPqj3en3dm0tdMIgbttnQ1xFMVpufoj+ADi8pXLBsd4xzTRHQa7t/Jv8W5UnCuW4kuWMQ=="],
-
-    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-rc.16", "", { "os": "android", "cpu": "arm64" }, "sha512-rhY3k7Bsae9qQfOtph2Pm2jZEA+s8Gmjoz4hhmx70K9iMQ/ddeae+xhRQcM5IuVx5ry1+bGfkvMn7D6MJggVSA=="],
-
-    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-rc.16", "", { "os": "darwin", "cpu": "arm64" }, "sha512-rNz0yK078yrNn3DrdgN+PKiMOW8HfQ92jQiXxwX8yW899ayV00MLVdaCNeVBhG/TbH3ouYVObo8/yrkiectkcQ=="],
-
-    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.0-rc.16", "", { "os": "darwin", "cpu": "x64" }, "sha512-r/OmdR00HmD4i79Z//xO06uEPOq5hRXdhw7nzkxQxwSavs3PSHa1ijntdpOiZ2mzOQ3fVVu8C1M19FoNM+dMUQ=="],
-
-    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.0-rc.16", "", { "os": "freebsd", "cpu": "x64" }, "sha512-KcRE5w8h0OnjUatG8pldyD14/CQ5Phs1oxfR+3pKDjboHRo9+MkqQaiIZlZRpsxC15paeXme/I127tUa9TXJ6g=="],
-
-    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.16", "", { "os": "linux", "cpu": "arm" }, "sha512-bT0guA1bpxEJ/ZhTRniQf7rNF8ybvXOuWbNIeLABaV5NGjx4EtOWBTSRGWFU9ZWVkPOZ+HNFP8RMcBokBiZ0Kg=="],
-
-    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.0-rc.16", "", { "os": "linux", "cpu": "arm64" }, "sha512-+tHktCHWV8BDQSjemUqm/Jl/TPk3QObCTIjmdDy/nlupcujZghmKK2962LYrqFpWu+ai01AN/REOH3NEpqvYQg=="],
-
-    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.0-rc.16", "", { "os": "linux", "cpu": "arm64" }, "sha512-3fPzdREH806oRLxpTWW1Gt4tQHs0TitZFOECB2xzCFLPKnSOy90gwA7P29cksYilFO6XVRY1kzga0cL2nRjKPg=="],
-
-    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.16", "", { "os": "linux", "cpu": "ppc64" }, "sha512-EKwI1tSrLs7YVw+JPJT/G2dJQ1jl9qlTTTEG0V2Ok/RdOenRfBw2PQdLPyjhIu58ocdBfP7vIRN/pvMsPxs/AQ=="],
-
-    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.0-rc.16", "", { "os": "linux", "cpu": "s390x" }, "sha512-Uknladnb3Sxqu6SEcqBldQyJUpk8NleooZEc0MbRBJ4inEhRYWZX0NJu12vNf2mqAq7gsofAxHrGghiUYjhaLQ=="],
-
-    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.0-rc.16", "", { "os": "linux", "cpu": "x64" }, "sha512-FIb8+uG49sZBtLTn+zt1AJ20TqVcqWeSIyoVt0or7uAWesgKaHbiBh6OpA/k9v0LTt+PTrb1Lao133kP4uVxkg=="],
-
-    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.0-rc.16", "", { "os": "linux", "cpu": "x64" }, "sha512-RuERhF9/EgWxZEXYWCOaViUWHIboceK4/ivdtQ3R0T44NjLkIIlGIAVAuCddFxsZ7vnRHtNQUrt2vR2n2slB2w=="],
-
-    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.0-rc.16", "", { "os": "none", "cpu": "arm64" }, "sha512-mXcXnvd9GpazCxeUCCnZ2+YF7nut+ZOEbE4GtaiPtyY6AkhZWbK70y1KK3j+RDhjVq5+U8FySkKRb/+w0EeUwA=="],
-
-    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.0-rc.16", "", { "dependencies": { "@emnapi/core": "1.9.2", "@emnapi/runtime": "1.9.2", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-3Q2KQxnC8IJOLqXmUMoYwyIPZU9hzRbnHaoV3Euz+VVnjZKcY8ktnNP8T9R4/GGQtb27C/UYKABxesKWb8lsvQ=="],
-
-    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.0-rc.16", "", { "os": "win32", "cpu": "arm64" }, "sha512-tj7XRemQcOcFwv7qhpUxMTBbI5mWMlE4c1Omhg5+h8GuLXzyj8HviYgR+bB2DMDgRqUE+jiDleqSCRjx4aYk/Q=="],
-
-    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.0-rc.16", "", { "os": "win32", "cpu": "x64" }, "sha512-PH5DRZT+F4f2PTXRXR8uJxnBq2po/xFtddyabTJVJs/ZYVHqXPEgNIr35IHTEa6bpa0Q8Awg+ymkTaGnKITw4g=="],
-
-    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.7", "", {}, "sha512-qujRfC8sFVInYSPPMLQByRh7zhwkGFS4+tyMQ83srV1qrxL4g8E2tyxVVyxd0+8QeBM1mIk9KbWxkegRr76XzA=="],
-
-    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.60.1", "", { "os": "android", "cpu": "arm" }, "sha512-d6FinEBLdIiK+1uACUttJKfgZREXrF0Qc2SmLII7W2AD8FfiZ9Wjd+rD/iRuf5s5dWrr1GgwXCvPqOuDquOowA=="],
-
-    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.60.1", "", { "os": "android", "cpu": "arm64" }, "sha512-YjG/EwIDvvYI1YvYbHvDz/BYHtkY4ygUIXHnTdLhG+hKIQFBiosfWiACWortsKPKU/+dUwQQCKQM3qrDe8c9BA=="],
-
-    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.60.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-mjCpF7GmkRtSJwon+Rq1N8+pI+8l7w5g9Z3vWj4T7abguC4Czwi3Yu/pFaLvA3TTeMVjnu3ctigusqWUfjZzvw=="],
-
-    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.60.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-haZ7hJ1JT4e9hqkoT9R/19XW2QKqjfJVv+i5AGg57S+nLk9lQnJ1F/eZloRO3o9Scy9CM3wQ9l+dkXtcBgN5Ew=="],
-
-    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.60.1", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-czw90wpQq3ZsAVBlinZjAYTKduOjTywlG7fEeWKUA7oCmpA8xdTkxZZlwNJKWqILlq0wehoZcJYfBvOyhPTQ6w=="],
-
-    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.60.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-KVB2rqsxTHuBtfOeySEyzEOB7ltlB/ux38iu2rBQzkjbwRVlkhAGIEDiiYnO2kFOkJp+Z7pUXKyrRRFuFUKt+g=="],
-
-    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.60.1", "", { "os": "linux", "cpu": "arm" }, "sha512-L+34Qqil+v5uC0zEubW7uByo78WOCIrBvci69E7sFASRl0X7b/MB6Cqd1lky/CtcSVTydWa2WZwFuWexjS5o6g=="],
-
-    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.60.1", "", { "os": "linux", "cpu": "arm" }, "sha512-n83O8rt4v34hgFzlkb1ycniJh7IR5RCIqt6mz1VRJD6pmhRi0CXdmfnLu9dIUS6buzh60IvACM842Ffb3xd6Gg=="],
-
-    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.60.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-Nql7sTeAzhTAja3QXeAI48+/+GjBJ+QmAH13snn0AJSNL50JsDqotyudHyMbO2RbJkskbMbFJfIJKWA6R1LCJQ=="],
-
-    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.60.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-+pUymDhd0ys9GcKZPPWlFiZ67sTWV5UU6zOJat02M1+PiuSGDziyRuI/pPue3hoUwm2uGfxdL+trT6Z9rxnlMA=="],
+    "@reduxjs/toolkit": ["@reduxjs/toolkit@2.12.0", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "@standard-schema/utils": "^0.3.0", "immer": "^11.0.0", "redux": "^5.0.1", "redux-thunk": "^3.1.0", "reselect": "^5.1.0" }, "peerDependencies": { "react": "^16.9.0 || ^17.0.0 || ^18 || ^19", "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0" }, "optionalPeers": ["react", "react-redux"] }, "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw=="],
 
-    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.60.1", "", { "os": "linux", "cpu": "none" }, "sha512-VSvgvQeIcsEvY4bKDHEDWcpW4Yw7BtlKG1GUT4FzBUlEKQK0rWHYBqQt6Fm2taXS+1bXvJT6kICu5ZwqKCnvlQ=="],
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.3", "", { "os": "android", "cpu": "arm64" }, "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw=="],
 
-    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.60.1", "", { "os": "linux", "cpu": "none" }, "sha512-4LqhUomJqwe641gsPp6xLfhqWMbQV04KtPp7/dIp0nzPxAkNY1AbwL5W0MQpcalLYk07vaW9Kp1PBhdpZYYcEw=="],
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA=="],
 
-    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.60.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-tLQQ9aPvkBxOc/EUT6j3pyeMD6Hb8QF2BTBnCQWP/uu1lhc9AIrIjKnLYMEroIz/JvtGYgI9dF3AxHZNaEH0rw=="],
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg=="],
 
-    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.60.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-RMxFhJwc9fSXP6PqmAz4cbv3kAyvD1etJFjTx4ONqFP9DkTkXsAMU4v3Vyc5BgzC+anz7nS/9tp4obsKfqkDHg=="],
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g=="],
 
-    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.60.1", "", { "os": "linux", "cpu": "none" }, "sha512-QKgFl+Yc1eEk6MmOBfRHYF6lTxiiiV3/z/BRrbSiW2I7AFTXoBFvdMEyglohPj//2mZS4hDOqeB0H1ACh3sBbg=="],
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.3", "", { "os": "linux", "cpu": "arm" }, "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw=="],
 
-    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.60.1", "", { "os": "linux", "cpu": "none" }, "sha512-RAjXjP/8c6ZtzatZcA1RaQr6O1TRhzC+adn8YZDnChliZHviqIjmvFwHcxi4JKPSDAt6Uhf/7vqcBzQJy0PDJg=="],
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw=="],
 
-    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.60.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-wcuocpaOlaL1COBYiA89O6yfjlp3RwKDeTIA0hM7OpmhR1Bjo9j31G1uQVpDlTvwxGn2nQs65fBFL5UFd76FcQ=="],
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q=="],
 
-    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.60.1", "", { "os": "linux", "cpu": "x64" }, "sha512-77PpsFQUCOiZR9+LQEFg9GClyfkNXj1MP6wRnzYs0EeWbPcHs02AXu4xuUbM1zhwn3wqaizle3AEYg5aeoohhg=="],
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg=="],
 
-    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.60.1", "", { "os": "linux", "cpu": "x64" }, "sha512-5cIATbk5vynAjqqmyBjlciMJl1+R/CwX9oLk/EyiFXDWd95KpHdrOJT//rnUl4cUcskrd0jCCw3wpZnhIHdD9w=="],
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg=="],
 
-    "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.60.1", "", { "os": "openbsd", "cpu": "x64" }, "sha512-cl0w09WsCi17mcmWqqglez9Gk8isgeWvoUZ3WiJFYSR3zjBQc2J5/ihSjpl+VLjPqjQ/1hJRcqBfLjssREQILw=="],
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.3", "", { "os": "linux", "cpu": "x64" }, "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg=="],
 
-    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.60.1", "", { "os": "none", "cpu": "arm64" }, "sha512-4Cv23ZrONRbNtbZa37mLSueXUCtN7MXccChtKpUnQNgF010rjrjfHx3QxkS2PI7LqGT5xXyYs1a7LbzAwT0iCA=="],
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.3", "", { "os": "linux", "cpu": "x64" }, "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow=="],
 
-    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.60.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-i1okWYkA4FJICtr7KpYzFpRTHgy5jdDbZiWfvny21iIKky5YExiDXP+zbXzm3dUcFpkEeYNHgQ5fuG236JPq0g=="],
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.3", "", { "os": "none", "cpu": "arm64" }, "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg=="],
 
-    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.60.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-u09m3CuwLzShA0EYKMNiFgcjjzwqtUMLmuCJLeZWjjOYA3IT2Di09KaxGBTP9xVztWyIWjVdsB2E9goMjZvTQg=="],
+    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.3", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg=="],
 
-    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.60.1", "", { "os": "win32", "cpu": "x64" }, "sha512-k+600V9Zl1CM7eZxJgMyTUzmrmhB/0XZnF4pRypKAlAgxmedUA+1v9R+XOFv56W4SlHEzfeMtzujLJD22Uz5zg=="],
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g=="],
 
-    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.60.1", "", { "os": "win32", "cpu": "x64" }, "sha512-lWMnixq/QzxyhTV6NjQJ4SFo1J6PvOX8vUx5Wb4bBPsEb+8xZ89Bz6kOXpfXj9ak9AHTQVQzlgzBEc1SyM27xQ=="],
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.3", "", { "os": "win32", "cpu": "x64" }, "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA=="],
 
-    "@selderee/plugin-htmlparser2": ["@selderee/plugin-htmlparser2@0.11.0", "", { "dependencies": { "domhandler": "^5.0.3", "selderee": "^0.11.0" } }, "sha512-P33hHGdldxGabLFjPPpaTxVolMrzrcegejx+0GxjrIb9Zv48D8yAIA/QTDR2dFl7Uz7urX8aX6+5bCZslr+gWQ=="],
-
-    "@slack/logger": ["@slack/logger@4.0.1", "", { "dependencies": { "@types/node": ">=18" } }, "sha512-6cmdPrV/RYfd2U0mDGiMK8S7OJqpCTm7enMLRR3edccsPX8j7zXTLnaEF4fhxxJJTAIOil6+qZrnUPTuaLvwrQ=="],
-
-    "@slack/types": ["@slack/types@2.20.1", "", {}, "sha512-eWX2mdt1ktpn8+40iiMc404uGrih+2fxiky3zBcPjtXKj6HLRdYlmhrPkJi7JTJm8dpXR6BWVWEDBXtaWMKD6A=="],
+    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
 
-    "@slack/web-api": ["@slack/web-api@7.15.1", "", { "dependencies": { "@slack/logger": "^4.0.1", "@slack/types": "^2.20.1", "@types/node": ">=18", "@types/retry": "0.12.0", "axios": "^1.15.0", "eventemitter3": "^5.0.1", "form-data": "^4.0.4", "is-electron": "2.2.2", "is-stream": "^2", "p-queue": "^6", "p-retry": "^4", "retry": "^0.13.1" } }, "sha512-y+TAF7TszcmFzbVtBkFqAdBwKSoD+8shkNxhp4WIfFwXmCKdFje9WD6evROApPa2FTy1v1uc9yBaJs3609PPgg=="],
+    "@rollup/plugin-alias": ["@rollup/plugin-alias@6.0.0", "", { "peerDependencies": { "rollup": ">=4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-tPCzJOtS7uuVZd+xPhoy5W4vThe6KWXNmsFCNktaAh5RTqcLiSfT4huPQIXkgJ6YCOjJHvecOAzQxLFhPxKr+g=="],
 
-    "@smithy/chunked-blob-reader": ["@smithy/chunked-blob-reader@5.2.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-St+kVicSyayWQca+I1rGitaOEH6uKgE8IUWoYnnEX26SWdWQcL6LvMSD19Lg+vYHKdT9B2Zuu7rd3i6Wnyb/iw=="],
+    "@rollup/plugin-commonjs": ["@rollup/plugin-commonjs@29.0.3", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "commondir": "^1.0.1", "estree-walker": "^2.0.2", "fdir": "^6.2.0", "is-reference": "1.2.1", "magic-string": "^0.30.3", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^2.68.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-ZaOxZceP7SOUW7Lqw5IRVweSQYWaeIPnXIGLiB690EBA3FGJTO40EEr2L5yZplJWsgTCogILRSpcAe7+U0Otdg=="],
 
-    "@smithy/chunked-blob-reader-native": ["@smithy/chunked-blob-reader-native@4.2.3", "", { "dependencies": { "@smithy/util-base64": "^4.3.2", "tslib": "^2.6.2" } }, "sha512-jA5k5Udn7Y5717L86h4EIv06wIr3xn8GM1qHRi/Nf31annXcXHJjBKvgztnbn2TxH3xWrPBfgwHsOwZf0UmQWw=="],
+    "@rollup/plugin-inject": ["@rollup/plugin-inject@5.0.5", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "estree-walker": "^2.0.2", "magic-string": "^0.30.3" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-2+DEJbNBoPROPkgTDNe8/1YXWcqxbN5DTjASVIOx8HS+pITXushyNiBV56RB08zuptzz8gT3YfkqriTBVycepg=="],
 
-    "@smithy/config-resolver": ["@smithy/config-resolver@4.4.16", "", { "dependencies": { "@smithy/node-config-provider": "^4.3.14", "@smithy/types": "^4.14.1", "@smithy/util-config-provider": "^4.2.2", "@smithy/util-endpoints": "^3.4.1", "@smithy/util-middleware": "^4.2.14", "tslib": "^2.6.2" } }, "sha512-GFlGPNLZKrGfqWpqVb31z7hvYCA9ZscfX1buYnvvMGcRYsQQnhH+4uN6mWWflcD5jB4OXP/LBrdpukEdjl41tg=="],
+    "@rollup/plugin-json": ["@rollup/plugin-json@6.1.0", "", { "dependencies": { "@rollup/pluginutils": "^5.1.0" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA=="],
 
-    "@smithy/core": ["@smithy/core@3.23.15", "", { "dependencies": { "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "@smithy/url-parser": "^4.2.14", "@smithy/util-base64": "^4.3.2", "@smithy/util-body-length-browser": "^4.2.2", "@smithy/util-middleware": "^4.2.14", "@smithy/util-stream": "^4.5.23", "@smithy/util-utf8": "^4.2.2", "@smithy/uuid": "^1.1.2", "tslib": "^2.6.2" } }, "sha512-E7GVCgsQttzfujEZb6Qep005wWf4xiL4x06apFEtzQMWYBPggZh/0cnOxPficw5cuK/YjjkehKoIN4YUaSh0UQ=="],
+    "@rollup/plugin-node-resolve": ["@rollup/plugin-node-resolve@16.0.3", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "@types/resolve": "1.20.2", "deepmerge": "^4.2.2", "is-module": "^1.0.0", "resolve": "^1.22.1" }, "peerDependencies": { "rollup": "^2.78.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg=="],
 
-    "@smithy/credential-provider-imds": ["@smithy/credential-provider-imds@4.2.14", "", { "dependencies": { "@smithy/node-config-provider": "^4.3.14", "@smithy/property-provider": "^4.2.14", "@smithy/types": "^4.14.1", "@smithy/url-parser": "^4.2.14", "tslib": "^2.6.2" } }, "sha512-Au28zBN48ZAoXdooGUHemuVBrkE+Ie6RPmGNIAJsFqj33Vhb6xAgRifUydZ2aY+M+KaMAETAlKk5NC5h1G7wpg=="],
+    "@rollup/plugin-replace": ["@rollup/plugin-replace@6.0.3", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "magic-string": "^0.30.3" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-J4RZarRvQAm5IF0/LwUUg+obsm+xZhYnbMXmXROyoSE1ATJe3oXSb9L5MMppdxP2ylNSjv6zFBwKYjcKMucVfA=="],
 
-    "@smithy/eventstream-codec": ["@smithy/eventstream-codec@4.2.14", "", { "dependencies": { "@aws-crypto/crc32": "5.2.0", "@smithy/types": "^4.14.1", "@smithy/util-hex-encoding": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-erZq0nOIpzfeZdCyzZjdJb4nVSKLUmSkaQUVkRGQTXs30gyUGeKnrYEg+Xe1W5gE3aReS7IgsvANwVPxSzY6Pw=="],
+    "@rollup/plugin-terser": ["@rollup/plugin-terser@1.0.0", "", { "dependencies": { "serialize-javascript": "^7.0.3", "smob": "^1.0.0", "terser": "^5.17.4" }, "peerDependencies": { "rollup": "^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-FnCxhTBx6bMOYQrar6C8h3scPt8/JwIzw3+AJ2K++6guogH5fYaIFia+zZuhqv0eo1RN7W1Pz630SyvLbDjhtQ=="],
 
-    "@smithy/eventstream-serde-browser": ["@smithy/eventstream-serde-browser@4.2.14", "", { "dependencies": { "@smithy/eventstream-serde-universal": "^4.2.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-8IelTCtTctWRbb+0Dcy+C0aICh1qa0qWXqgjcXDmMuCvPJRnv26hiDZoAau2ILOniki65mCPKqOQs/BaWvO4CQ=="],
+    "@rollup/pluginutils": ["@rollup/pluginutils@5.4.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-walker": "^2.0.2", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg=="],
 
-    "@smithy/eventstream-serde-config-resolver": ["@smithy/eventstream-serde-config-resolver@4.3.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-sqHiHpYRYo3FJlaIxD1J8PhbcmJAm7IuM16mVnwSkCToD7g00IBZzKuiLNMGmftULmEUX6/UAz8/NN5uMP8bVA=="],
+    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.62.0", "", { "os": "android", "cpu": "arm" }, "sha512-IPIQ55ythEHkfEd9jMEi32OQ7SxURsGA43JI22lj01OLZNt2NUbJX8YUHxkVWyQ6daHPNn0truF5nSj3DQp6YQ=="],
 
-    "@smithy/eventstream-serde-node": ["@smithy/eventstream-serde-node@4.2.14", "", { "dependencies": { "@smithy/eventstream-serde-universal": "^4.2.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-Ht/8BuGlKfFTy0H3+8eEu0vdpwGztCnaLLXtpXNdQqiR7Hj4vFScU3T436vRAjATglOIPjJXronY+1WxxNLSiw=="],
+    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.62.0", "", { "os": "android", "cpu": "arm64" }, "sha512-M6s9cr10MibETyo8JsOkq+Lo1+lU6hcvb1MApnUql5qte/5hMEgzlN8/ReIKNfRV8rrqX50W1BX9zoUhC192RA=="],
 
-    "@smithy/eventstream-serde-universal": ["@smithy/eventstream-serde-universal@4.2.14", "", { "dependencies": { "@smithy/eventstream-codec": "^4.2.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-lWyt4T2XQZUZgK3tQ3Wn0w3XBvZsK/vjTuJl6bXbnGZBHH0ZUSONTYiK9TgjTTzU54xQr3DRFwpjmhp0oLm3gg=="],
+    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.62.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-BqCoMoIbn0keKys+dEAdBa70EtOwV1bEsQCUgU9FdiZmmMge/Zk7LlkYGqbrdHR+Frnt0E1FOanly+rlwvvQzw=="],
 
-    "@smithy/fetch-http-handler": ["@smithy/fetch-http-handler@5.3.17", "", { "dependencies": { "@smithy/protocol-http": "^5.3.14", "@smithy/querystring-builder": "^4.2.14", "@smithy/types": "^4.14.1", "@smithy/util-base64": "^4.3.2", "tslib": "^2.6.2" } }, "sha512-bXOvQzaSm6MnmLaWA1elgfQcAtN4UP3vXqV97bHuoOrHQOJiLT3ds6o9eo5bqd0TJfRFpzdGnDQdW3FACiAVdw=="],
+    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.62.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-SIMzST3VFNXDAbeIWDWiFCNM5qncUBDWaEV7NfE7oZbDt2mgfW4MvbKdbYiGOLoM32gbTv608UMd0XktEYSD7w=="],
 
-    "@smithy/hash-blob-browser": ["@smithy/hash-blob-browser@4.2.15", "", { "dependencies": { "@smithy/chunked-blob-reader": "^5.2.2", "@smithy/chunked-blob-reader-native": "^4.2.3", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-0PJ4Al3fg2nM4qKrAIxyNcApgqHAXcBkN8FeizOz69z0rb26uZ6lMESYtxegaTlXB5Hj84JfwMPavMrwDMjucA=="],
+    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.62.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-ezjfSQMP7ArdUsbBwbQIfwAlhE84I2iVnzQNCFSveqV42q+BmKlzVpf7mxv5EchLcoWU4y6/heFzVg1F+hodUQ=="],
 
-    "@smithy/hash-node": ["@smithy/hash-node@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "@smithy/util-buffer-from": "^4.2.2", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-8ZBDY2DD4wr+GGjTpPtiglEsqr0lUP+KHqgZcWczFf6qeZ/YRjMIOoQWVQlmwu7EtxKTd8YXD8lblmYcpBIA1g=="],
+    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.62.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-9+qTWGW9AZRhnUgwtTwzNwcPlL87ngkeN0LA+q1bADvmY9aNvWaF2TFW8BZgnQPYxpDI7+rMVLivcd4V737TAQ=="],
 
-    "@smithy/hash-stream-node": ["@smithy/hash-stream-node@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-tw4GANWkZPb6+BdD4Fgucqzey2+r73Z/GRo9zklsCdwrnxxumUV83ZIaBDdudV4Ylazw3EPTiJZhpX42105ruQ=="],
+    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.62.0", "", { "os": "linux", "cpu": "arm" }, "sha512-T1dMEQhXA/jkJ/jyMIw9IovK8bSUq7A8kLIlvZTb/6YIVsp2zLavr4F3oyllHWo7eIVJRyE5n3tUjQJEbE1IuQ=="],
 
-    "@smithy/invalid-dependency": ["@smithy/invalid-dependency@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-c21qJiTSb25xvvOp+H2TNZzPCngrvl5vIPqPB8zQ/DmJF4QWXO19x1dWfMJZ6wZuuWUPPm0gV8C0cU3+ifcWuw=="],
+    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.62.0", "", { "os": "linux", "cpu": "arm" }, "sha512-2as0LgT7qQpyceQq6VUJYnumUMUrgGQCWIiDIN9DE0/tglsk6o66uCB4f3djRawAltvfCNLyZZrsqbPA6inCsA=="],
 
-    "@smithy/is-array-buffer": ["@smithy/is-array-buffer@4.2.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow=="],
+    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.62.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-bVURMg+6eNN9C/yc0aVjooZcwTTtYF4YW3xta5pP0//r3o1V8gXEHXWCndj47w/HhwsFroZrFhR+6uQP5T0n0g=="],
 
-    "@smithy/md5-js": ["@smithy/md5-js@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-V2v0vx+h0iUSNG1Alt+GNBMSLGCrl9iVsdd+Ap67HPM9PN479x12V8LkuMoKImNZxn3MXeuyUjls+/7ZACZghA=="],
+    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.62.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Ful8pM/2yYI83PViWdFdpZhdI8HJ5qsXANe5atypbHDf+KIBBDsZsbyy8hbXnULVvW9NsTh5DHwbcBftyLTfiw=="],
 
-    "@smithy/middleware-content-length": ["@smithy/middleware-content-length@4.2.14", "", { "dependencies": { "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-xhHq7fX4/3lv5NHxLUk3OeEvl0xZ+Ek3qIbWaCL4f9JwgDZEclPBElljaZCAItdGPQl/kSM4LPMOpy1MYgprpw=="],
+    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.62.0", "", { "os": "linux", "cpu": "none" }, "sha512-9Gp/DgrkzfUBmNPVTyPTvay+4xEP7M/clXpj3efXBcm6uTIVIgDg4rqUpqKXvLEuFRVuEpSAOkhgNeecvaZ4Cg=="],
 
-    "@smithy/middleware-endpoint": ["@smithy/middleware-endpoint@4.4.30", "", { "dependencies": { "@smithy/core": "^3.23.15", "@smithy/middleware-serde": "^4.2.18", "@smithy/node-config-provider": "^4.3.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "@smithy/url-parser": "^4.2.14", "@smithy/util-middleware": "^4.2.14", "tslib": "^2.6.2" } }, "sha512-qS2XqhKeXmdZ4nEQ4cOxIczSP/Y91wPAHYuRwmWDCh975B7/57uxsm5d6sisnUThn2u2FwzMdJNM7AbO1YPsPg=="],
+    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.62.0", "", { "os": "linux", "cpu": "none" }, "sha512-m9tsJz54LUXkSYM8+8PG81B9IKK5r+2T0clMq4QrS16xFosufU7firBDAZEsDheDs7wTlP7h3++S7lMsU955HA=="],
 
-    "@smithy/middleware-retry": ["@smithy/middleware-retry@4.5.3", "", { "dependencies": { "@smithy/core": "^3.23.15", "@smithy/node-config-provider": "^4.3.14", "@smithy/protocol-http": "^5.3.14", "@smithy/service-error-classification": "^4.2.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "@smithy/util-middleware": "^4.2.14", "@smithy/util-retry": "^4.3.2", "@smithy/uuid": "^1.1.2", "tslib": "^2.6.2" } }, "sha512-TE8dJNi6JuxzGSxMCVd3i9IEWDndCl3bmluLsBNDWok8olgj65OfkndMhl9SZ7m14c+C5SQn/PcUmrDl57rSFw=="],
+    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.62.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-3UvJ5PNVU16aJf6M3tFI24pWzAl2/ynfbyRN3ICyQajK1lSkrnVYNnLz3v04J32qKa0FczJc22zeToc0lr2A3w=="],
 
-    "@smithy/middleware-serde": ["@smithy/middleware-serde@4.2.18", "", { "dependencies": { "@smithy/core": "^3.23.15", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-M6CSgnp3v4tYz9ynj2JHbA60woBZcGqEwNjTKjBsNHPV26R1ZX52+0wW8WsZU18q45jD0tw2wL22S17Ze9LpEw=="],
+    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.62.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-vRWUAbYLGHBZS6Q8Msb2sfnf1fvJf+47t8l/TwOerM2qArzy+IeNMTHrYLHXh95h8MoatPHI5hhSZNs+mGXKPg=="],
 
-    "@smithy/middleware-stack": ["@smithy/middleware-stack@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-2dvkUKLuFdKsCRmOE4Mn63co0Djtsm+JMh0bYZQupN1pJwMeE8FmQmRLLzzEMN0dnNi7CDCYYH8F0EVwWiPBeA=="],
+    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.62.0", "", { "os": "linux", "cpu": "none" }, "sha512-c00T5SYENHAt86cfW47URaP3Us5vLC/4QO7GYud1G5VNRffCwwCuBspwqYrriuJB+5m0WFzClCn9wed0FBjKvg=="],
 
-    "@smithy/node-config-provider": ["@smithy/node-config-provider@4.3.14", "", { "dependencies": { "@smithy/property-provider": "^4.2.14", "@smithy/shared-ini-file-loader": "^4.4.9", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-S+gFjyo/weSVL0P1b9Ts8C/CwIfNCgUPikk3sl6QVsfE/uUuO+QsF+NsE/JkpvWqqyz1wg7HFdiaZuj5CoBMRg=="],
+    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.62.0", "", { "os": "linux", "cpu": "none" }, "sha512-krrCDilhXOwFkSkO3Wm9I/f9H0L92XHHwy2fwxjukxIbh0dem8gZqOW5Y8BsHrpJv5qwlRBV+Wl4ZFyRWhUpwg=="],
 
-    "@smithy/node-http-handler": ["@smithy/node-http-handler@4.5.3", "", { "dependencies": { "@smithy/protocol-http": "^5.3.14", "@smithy/querystring-builder": "^4.2.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-lc5jFL++x17sPhIwMWJ3YOnqmSjw/2Po6VLDlUIXvxVWRuJwRXnJ4jOBBLB0cfI5BB5ehIl02Fxr1PDvk/kxDw=="],
+    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.62.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-7pfYFSTc4/rUC/FtAI0Qp6QthDBCIi6/AuP1xYqFk5vanI6KnL5dWKP60OM/05LOsbwTmIcvr6eXC4CJuJ75IA=="],
 
-    "@smithy/property-provider": ["@smithy/property-provider@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-WuM31CgfsnQ/10i7NYr0PyxqknD72Y5uMfUMVSniPjbEPceiTErb4eIqJQ+pdxNEAUEWrewrGjIRjVbVHsxZiQ=="],
+    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.62.0", "", { "os": "linux", "cpu": "x64" }, "sha512-7SDIalKeIpG0Ifogbbdn58HmSotYMlf23K3dCJEmiVd9Fg36Vmni82iPQec27N3wY4Bvbxftkxz6vSx9OcouTg=="],
 
-    "@smithy/protocol-http": ["@smithy/protocol-http@5.3.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-dN5F8kHx8RNU0r+pCwNmFZyz6ChjMkzShy/zup6MtkRmmix4vZzJdW+di7x//b1LiynIev88FM18ie+wwPcQtQ=="],
+    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.62.0", "", { "os": "linux", "cpu": "x64" }, "sha512-eRZevouTH2i1HeAVLqJuLnt256krQkGY0TN6WsTmsIhuzbh457HuWDMakKwmi0Cjadux983CoSr8Lim2QhUIFw=="],
 
-    "@smithy/querystring-builder": ["@smithy/querystring-builder@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "@smithy/util-uri-escape": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-XYA5Z0IqTeF+5XDdh4BBmSA0HvbgVZIyv4cmOoUheDNR57K1HgBp9ukUMx3Cr3XpDHHpLBnexPE3LAtDsZkj2A=="],
+    "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.62.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-3oVS7FLGa4U1qcvao9ylGxrjXZyUQqR8UwxEcnUEyPX53O/C/mKDZegNXTdHCP+h3e6ta/f1EN38Yif1mmZHYg=="],
 
-    "@smithy/querystring-parser": ["@smithy/querystring-parser@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-hr+YyqBD23GVvRxGGrcc/oOeNlK3PzT5Fu4dzrDXxzS1LpFiuL2PQQqKPs87M79aW7ziMs+nvB3qdw77SqE7Lw=="],
+    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.62.0", "", { "os": "none", "cpu": "arm64" }, "sha512-yTB9TgfWj5wHe5QgktAgXTLLot1gvEjl1NiPPAUiCs4oPrIWFl5V4nC3GrkNdj9LaAU4s94nVrGbGOCqUpyWsg=="],
 
-    "@smithy/service-error-classification": ["@smithy/service-error-classification@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1" } }, "sha512-vVimoUnGxlx4eLLQbZImdOZFOe+Zh+5ACntv8VxZuGP72LdWu5GV3oEmCahSEReBgRJoWjypFkrehSj7BWx1HQ=="],
+    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.62.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-5LOhoaesY3doG1c+ac/2JtgREpKoJr5bUHH8tKY0V8di7+uSV6BwLs2PlR0/yzefGOkR+wE7ZolZphHCsyG5Rw=="],
 
-    "@smithy/shared-ini-file-loader": ["@smithy/shared-ini-file-loader@4.4.9", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-495/V2I15SHgedSJoDPD23JuSfKAp726ZI1V0wtjB07Wh7q/0tri/0e0DLefZCHgxZonrGKt/OCTpAtP1wE1kQ=="],
+    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.62.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-yYkWHhmbhRTWTnWos5HC4GcPQfjlzzCNbM9e/+GXrLuaBXYA3qSDR9f0Vgufd5S8yX81U8jPKp7ZnAjZFMtRnw=="],
 
-    "@smithy/signature-v4": ["@smithy/signature-v4@5.3.14", "", { "dependencies": { "@smithy/is-array-buffer": "^4.2.2", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "@smithy/util-hex-encoding": "^4.2.2", "@smithy/util-middleware": "^4.2.14", "@smithy/util-uri-escape": "^4.2.2", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-1D9Y/nmlVjCeSivCbhZ7hgEpmHyY1h0GvpSZt3l0xcD9JjmjVC1CHOozS6+Gh+/ldMH8JuJ6cujObQqfayAVFA=="],
+    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.62.0", "", { "os": "win32", "cpu": "x64" }, "sha512-SoTb6lPg25xZlA2ibwQ++ahCCnH+FP0qmEuafMJ4gznZKOlXioKEAeJLgCrqjM98ACziXM9V1amFjICVL4IFoA=="],
 
-    "@smithy/smithy-client": ["@smithy/smithy-client@4.12.11", "", { "dependencies": { "@smithy/core": "^3.23.15", "@smithy/middleware-endpoint": "^4.4.30", "@smithy/middleware-stack": "^4.2.14", "@smithy/protocol-http": "^5.3.14", "@smithy/types": "^4.14.1", "@smithy/util-stream": "^4.5.23", "tslib": "^2.6.2" } }, "sha512-wzz/Wa1CH/Tlhxh0s4DQPEcXSxSVfJ59AZcUh9Gu0c6JTlKuwGf4o/3P2TExv0VbtPFt8odIBG+eQGK2+vTECg=="],
+    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.62.0", "", { "os": "win32", "cpu": "x64" }, "sha512-5L+T1fMX4RIEBoZzT0+sQ0PhTS36NULFmMXtl1TZo44TMAROIMHbZufSOjVWt/Y622BtxgxtaNOokbTDvfsrZA=="],
 
-    "@smithy/types": ["@smithy/types@4.14.1", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-59b5HtSVrVR/eYNei3BUj3DCPKD/G7EtDDe7OEJE7i7FtQFugYo6MxbotS8mVJkLNVf8gYaAlEBwwtJ9HzhWSg=="],
-
-    "@smithy/url-parser": ["@smithy/url-parser@4.2.14", "", { "dependencies": { "@smithy/querystring-parser": "^4.2.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-p06BiBigJ8bTA3MgnOfCtDUWnAMY0YfedO/GRpmc7p+wg3KW8vbXy1xwSu5ASy0wV7rRYtlfZOIKH4XqfhjSQQ=="],
-
-    "@smithy/util-base64": ["@smithy/util-base64@4.3.2", "", { "dependencies": { "@smithy/util-buffer-from": "^4.2.2", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-XRH6b0H/5A3SgblmMa5ErXQ2XKhfbQB+Fm/oyLZ2O2kCUrwgg55bU0RekmzAhuwOjA9qdN5VU2BprOvGGUkOOQ=="],
+    "@selderee/plugin-htmlparser2": ["@selderee/plugin-htmlparser2@0.11.0", "", { "dependencies": { "domhandler": "^5.0.3", "selderee": "^0.11.0" } }, "sha512-P33hHGdldxGabLFjPPpaTxVolMrzrcegejx+0GxjrIb9Zv48D8yAIA/QTDR2dFl7Uz7urX8aX6+5bCZslr+gWQ=="],
 
-    "@smithy/util-body-length-browser": ["@smithy/util-body-length-browser@4.2.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-JKCrLNOup3OOgmzeaKQwi4ZCTWlYR5H4Gm1r2uTMVBXoemo1UEghk5vtMi1xSu2ymgKVGW631e2fp9/R610ZjQ=="],
+    "@sindresorhus/is": ["@sindresorhus/is@7.2.0", "", {}, "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw=="],
 
-    "@smithy/util-body-length-node": ["@smithy/util-body-length-node@4.2.3", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-ZkJGvqBzMHVHE7r/hcuCxlTY8pQr1kMtdsVPs7ex4mMU+EAbcXppfo5NmyxMYi2XU49eqaz56j2gsk4dHHPG/g=="],
+    "@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@4.0.0", "", {}, "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ=="],
 
-    "@smithy/util-buffer-from": ["@smithy/util-buffer-from@4.2.2", "", { "dependencies": { "@smithy/is-array-buffer": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q=="],
+    "@slack/logger": ["@slack/logger@4.0.1", "", { "dependencies": { "@types/node": ">=18" } }, "sha512-6cmdPrV/RYfd2U0mDGiMK8S7OJqpCTm7enMLRR3edccsPX8j7zXTLnaEF4fhxxJJTAIOil6+qZrnUPTuaLvwrQ=="],
 
-    "@smithy/util-config-provider": ["@smithy/util-config-provider@4.2.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-dWU03V3XUprJwaUIFVv4iOnS1FC9HnMHDfUrlNDSh4315v0cWyaIErP8KiqGVbf5z+JupoVpNM7ZB3jFiTejvQ=="],
+    "@slack/types": ["@slack/types@2.21.1", "", {}, "sha512-I8vmSjNYWsaxuWPx6dz4yeh0h7vRBWbgAMK14LEmblbZ404BtrPbXs6jDPx4cYgGf8msDGF4A9opLZBu21FViQ=="],
 
-    "@smithy/util-defaults-mode-browser": ["@smithy/util-defaults-mode-browser@4.3.47", "", { "dependencies": { "@smithy/property-provider": "^4.2.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-zlIuXai3/SHjQUQ8y3g/woLvrH573SK2wNjcDaHu5e9VOcC0JwM1MI0Sq0GZJyN3BwSUneIhpjZ18nsiz5AtQw=="],
+    "@slack/web-api": ["@slack/web-api@7.17.0", "", { "dependencies": { "@slack/logger": "^4.0.1", "@slack/types": "^2.21.0", "@types/node": ">=18", "@types/retry": "0.12.0", "axios": "^1.16.0", "eventemitter3": "^5.0.1", "form-data": "^4.0.4", "is-electron": "2.2.2", "is-stream": "^2", "p-queue": "^6", "p-retry": "^4", "retry": "^0.13.1" } }, "sha512-jejr34a8B4L5AS713wOAx1LAqNkW16HVMDEa6sYBvFDc/llUBl8hXaiI4BwF+Al+Sug19Vn2O7iokTVIhVvZ1Q=="],
 
-    "@smithy/util-defaults-mode-node": ["@smithy/util-defaults-mode-node@4.2.52", "", { "dependencies": { "@smithy/config-resolver": "^4.4.16", "@smithy/credential-provider-imds": "^4.2.14", "@smithy/node-config-provider": "^4.3.14", "@smithy/property-provider": "^4.2.14", "@smithy/smithy-client": "^4.12.11", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-cQBz8g68Vnw1W2meXlkb3D/hXJU+Taiyj9P8qLJtjREEV9/Td65xi4A/H1sRQ8EIgX5qbZbvdYPKygKLholZ3w=="],
+    "@smithy/core": ["@smithy/core@3.25.0", "", { "dependencies": { "@aws-crypto/crc32": "5.2.0", "@smithy/types": "^4.15.0", "tslib": "^2.6.2" } }, "sha512-TTD6el7tvKyafkXBf7XO3jLOE+qVxOTrLjp/fEGiV3BMfUHK/LfdYlQO9YgZvzxC7kqA3H/IhJXNqQgnbgjb7A=="],
 
-    "@smithy/util-endpoints": ["@smithy/util-endpoints@3.4.1", "", { "dependencies": { "@smithy/node-config-provider": "^4.3.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-wMxNDZJrgS5mQV9oxCs4TWl5767VMgOfqfZ3JHyCkMtGC2ykW9iPqMvFur695Otcc5yxLG8OKO/80tsQBxrhXg=="],
+    "@smithy/credential-provider-imds": ["@smithy/credential-provider-imds@4.4.0", "", { "dependencies": { "@smithy/core": "^3.25.0", "@smithy/types": "^4.15.0", "tslib": "^2.6.2" } }, "sha512-pPQmNdEvMJttv9z2kdYxoui83p/nr32zjMf0aMfmzmGmFEgKXUfy0vXiNg0fx4R5XLQzmJBLM9Wg0guEq2/q8A=="],
 
-    "@smithy/util-hex-encoding": ["@smithy/util-hex-encoding@4.2.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-Qcz3W5vuHK4sLQdyT93k/rfrUwdJ8/HZ+nMUOyGdpeGA1Wxt65zYwi3oEl9kOM+RswvYq90fzkNDahPS8K0OIg=="],
+    "@smithy/fetch-http-handler": ["@smithy/fetch-http-handler@5.5.0", "", { "dependencies": { "@smithy/core": "^3.25.0", "@smithy/types": "^4.15.0", "tslib": "^2.6.2" } }, "sha512-OG8kBYAgX7lf32+xLzgirvuLffn1KNoszaSiButt45i2cRa5irk8LQXLYQ5Smij1SBTN4KMNcBsRwRrLPfIGyA=="],
 
-    "@smithy/util-middleware": ["@smithy/util-middleware@4.2.14", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-1Su2vj9RYNDEv/V+2E+jXkkwGsgR7dc4sfHn9Z7ruzQHJIEni9zzw5CauvRXlFJfmgcqYP8fWa0dkh2Q2YaQyw=="],
+    "@smithy/is-array-buffer": ["@smithy/is-array-buffer@2.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA=="],
 
-    "@smithy/util-retry": ["@smithy/util-retry@4.3.2", "", { "dependencies": { "@smithy/service-error-classification": "^4.2.14", "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-2+KTsJEwTi63NUv4uR9IQ+IFT1yu6Rf6JuoBK2WKaaJ/TRvOiOVGcXAsEqX/TQN2thR9yII21kPUJq1UV/WI2A=="],
+    "@smithy/node-http-handler": ["@smithy/node-http-handler@4.8.0", "", { "dependencies": { "@smithy/core": "^3.25.0", "@smithy/types": "^4.15.0", "tslib": "^2.6.2" } }, "sha512-Mq7TNt/VhlEWiYRLQGpzUWeUxh899UGpjKh7Ru0WVIDIjnE+cTRAn0NYlFQ6bWfsQnKnpCbWJj86HzmcG0qEdg=="],
 
-    "@smithy/util-stream": ["@smithy/util-stream@4.5.23", "", { "dependencies": { "@smithy/fetch-http-handler": "^5.3.17", "@smithy/node-http-handler": "^4.5.3", "@smithy/types": "^4.14.1", "@smithy/util-base64": "^4.3.2", "@smithy/util-buffer-from": "^4.2.2", "@smithy/util-hex-encoding": "^4.2.2", "@smithy/util-utf8": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-N6on1+ngJ3RznZOnDWNveIwnTSlqxNnXuNAh7ez889ZZaRdXoNRTXKgmYOLe6dB0gCmAVtuRScE1hymQFl4hpg=="],
+    "@smithy/signature-v4": ["@smithy/signature-v4@5.5.0", "", { "dependencies": { "@smithy/core": "^3.25.0", "@smithy/types": "^4.15.0", "tslib": "^2.6.2" } }, "sha512-vW6UdK7e7gV2wU/tXRsPq4pMQMusb8VymdVOyIFNA1FtyRmEClRFkYDtYI8UcO/HM0wK3qqjvvQs3HOlbgMbdg=="],
 
-    "@smithy/util-uri-escape": ["@smithy/util-uri-escape@4.2.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-2kAStBlvq+lTXHyAZYfJRb/DfS3rsinLiwb+69SstC9Vb0s9vNWkRwpnj918Pfi85mzi42sOqdV72OLxWAISnw=="],
+    "@smithy/types": ["@smithy/types@4.15.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-Z5TAOxygoFvybJV3igo5SloFflSokHx2hu1eFA+DxDTcn+FtKxUSui+rbTRG1pAafMA888Z3MVvCWUuvCrTXjg=="],
 
-    "@smithy/util-utf8": ["@smithy/util-utf8@4.2.2", "", { "dependencies": { "@smithy/util-buffer-from": "^4.2.2", "tslib": "^2.6.2" } }, "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw=="],
+    "@smithy/util-buffer-from": ["@smithy/util-buffer-from@2.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA=="],
 
-    "@smithy/util-waiter": ["@smithy/util-waiter@4.2.16", "", { "dependencies": { "@smithy/types": "^4.14.1", "tslib": "^2.6.2" } }, "sha512-GtclrKoZ3Lt7jPQ7aTIYKfjY92OgceScftVnkTsG8e1KV8rkvZgN+ny6YSRhd9hxB8rZtwVbmln7NTvE5O3GmQ=="],
+    "@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
 
-    "@smithy/uuid": ["@smithy/uuid@1.1.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-O/IEdcCUKkubz60tFbGA7ceITTAJsty+lBjNoorP4Z6XRqaFb/OjQjZODophEcuq68nKm6/0r+6/lLQ+XVpk8g=="],
+    "@speed-highlight/core": ["@speed-highlight/core@1.2.17", "", {}, "sha512-Z92FwKpCtfaW1V0jTU/fh3QzYEZN8wDwrzRIBoADCJfn4mJCNcJN/XegifX7BDrQ8/h9Xh/JnbyMchL0FqXrkg=="],
 
     "@stablelib/base64": ["@stablelib/base64@1.0.1", "", {}, "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ=="],
 
@@ -1044,51 +1079,53 @@
 
     "@tabby_ai/hijri-converter": ["@tabby_ai/hijri-converter@1.0.5", "", {}, "sha512-r5bClKrcIusDoo049dSL8CawnHR6mRdDwhlQuIgZRNty68q0x8k3Lf1BtPAMxRf/GgnHBnIO4ujd3+GQdLWzxQ=="],
 
-    "@tabler/icons": ["@tabler/icons@3.41.1", "", {}, "sha512-OaRnVbRmH2nHtFeg+RmMJ/7m2oBIF9XCJAUD5gQnMrpK9f05ydj8MZrAf3NZQqOXyxGN1UBL0D5IKLLEUfr74Q=="],
+    "@tabler/icons": ["@tabler/icons@3.44.0", "", {}, "sha512-Wn0AOZG9sg0L+bjfMqq4eNhC6pQjIrk94LvvWYNYkY8KH8wC3YILRzQlrnVJc4FUeMxH/AK97QsYCX35H3LndA=="],
 
-    "@tabler/icons-react": ["@tabler/icons-react@3.41.1", "", { "dependencies": { "@tabler/icons": "3.41.1" }, "peerDependencies": { "react": ">= 16" } }, "sha512-kUgweE+DJtAlMZVIns1FTDdcbpRVnkK7ZpUOXmoxy3JAF0rSHj0TcP4VHF14+gMJGnF+psH2Zt26BLT6owetBA=="],
+    "@tabler/icons-react": ["@tabler/icons-react@3.44.0", "", { "dependencies": { "@tabler/icons": "3.44.0" }, "peerDependencies": { "react": ">= 16" } }, "sha512-8+rvzBbVm/1Z3sG3x7GUNAaxIKxwgz8xaMhRs23nrCnMTKRFAhEC+82zAIFeAA0seXdrAGX5HFCkaLpGK2rVHg=="],
 
-    "@tailwindcss/node": ["@tailwindcss/node@4.2.2", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.19.0", "jiti": "^2.6.1", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.2.2" } }, "sha512-pXS+wJ2gZpVXqFaUEjojq7jzMpTGf8rU6ipJz5ovJV6PUGmlJ+jvIwGrzdHdQ80Sg+wmQxUFuoW1UAAwHNEdFA=="],
+    "@tailwindcss/node": ["@tailwindcss/node@4.3.1", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "5.21.6", "jiti": "^2.7.0", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.3.1" } }, "sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A=="],
 
-    "@tailwindcss/oxide": ["@tailwindcss/oxide@4.2.2", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.2.2", "@tailwindcss/oxide-darwin-arm64": "4.2.2", "@tailwindcss/oxide-darwin-x64": "4.2.2", "@tailwindcss/oxide-freebsd-x64": "4.2.2", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.2.2", "@tailwindcss/oxide-linux-arm64-gnu": "4.2.2", "@tailwindcss/oxide-linux-arm64-musl": "4.2.2", "@tailwindcss/oxide-linux-x64-gnu": "4.2.2", "@tailwindcss/oxide-linux-x64-musl": "4.2.2", "@tailwindcss/oxide-wasm32-wasi": "4.2.2", "@tailwindcss/oxide-win32-arm64-msvc": "4.2.2", "@tailwindcss/oxide-win32-x64-msvc": "4.2.2" } }, "sha512-qEUA07+E5kehxYp9BVMpq9E8vnJuBHfJEC0vPC5e7iL/hw7HR61aDKoVoKzrG+QKp56vhNZe4qwkRmMC0zDLvg=="],
+    "@tailwindcss/oxide": ["@tailwindcss/oxide@4.3.1", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.3.1", "@tailwindcss/oxide-darwin-arm64": "4.3.1", "@tailwindcss/oxide-darwin-x64": "4.3.1", "@tailwindcss/oxide-freebsd-x64": "4.3.1", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.1", "@tailwindcss/oxide-linux-arm64-gnu": "4.3.1", "@tailwindcss/oxide-linux-arm64-musl": "4.3.1", "@tailwindcss/oxide-linux-x64-gnu": "4.3.1", "@tailwindcss/oxide-linux-x64-musl": "4.3.1", "@tailwindcss/oxide-wasm32-wasi": "4.3.1", "@tailwindcss/oxide-win32-arm64-msvc": "4.3.1", "@tailwindcss/oxide-win32-x64-msvc": "4.3.1" } }, "sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA=="],
 
-    "@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.2.2", "", { "os": "android", "cpu": "arm64" }, "sha512-dXGR1n+P3B6748jZO/SvHZq7qBOqqzQ+yFrXpoOWWALWndF9MoSKAT3Q0fYgAzYzGhxNYOoysRvYlpixRBBoDg=="],
+    "@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.3.1", "", { "os": "android", "cpu": "arm64" }, "sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ=="],
 
-    "@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.2.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-iq9Qjr6knfMpZHj55/37ouZeykwbDqF21gPFtfnhCCKGDcPI/21FKC9XdMO/XyBM7qKORx6UIhGgg6jLl7BZlg=="],
+    "@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.3.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA=="],
 
-    "@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.2.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-BlR+2c3nzc8f2G639LpL89YY4bdcIdUmiOOkv2GQv4/4M0vJlpXEa0JXNHhCHU7VWOKWT/CjqHdTP8aUuDJkuw=="],
+    "@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.3.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg=="],
 
-    "@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.2.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-YUqUgrGMSu2CDO82hzlQ5qSb5xmx3RUrke/QgnoEx7KvmRJHQuZHZmZTLSuuHwFf0DJPybFMXMYf+WJdxHy/nQ=="],
+    "@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.3.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g=="],
 
-    "@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.2.2", "", { "os": "linux", "cpu": "arm" }, "sha512-FPdhvsW6g06T9BWT0qTwiVZYE2WIFo2dY5aCSpjG/S/u1tby+wXoslXS0kl3/KXnULlLr1E3NPRRw0g7t2kgaQ=="],
+    "@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.3.1", "", { "os": "linux", "cpu": "arm" }, "sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg=="],
 
-    "@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.2.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-4og1V+ftEPXGttOO7eCmW7VICmzzJWgMx+QXAJRAhjrSjumCwWqMfkDrNu1LXEQzNAwz28NCUpucgQPrR4S2yw=="],
+    "@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.3.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ=="],
 
-    "@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.2.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-oCfG/mS+/+XRlwNjnsNLVwnMWYH7tn/kYPsNPh+JSOMlnt93mYNCKHYzylRhI51X+TbR+ufNhhKKzm6QkqX8ag=="],
+    "@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.3.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA=="],
 
-    "@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.2.2", "", { "os": "linux", "cpu": "x64" }, "sha512-rTAGAkDgqbXHNp/xW0iugLVmX62wOp2PoE39BTCGKjv3Iocf6AFbRP/wZT/kuCxC9QBh9Pu8XPkv/zCZB2mcMg=="],
+    "@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.3.1", "", { "os": "linux", "cpu": "x64" }, "sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg=="],
 
-    "@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.2.2", "", { "os": "linux", "cpu": "x64" }, "sha512-XW3t3qwbIwiSyRCggeO2zxe3KWaEbM0/kW9e8+0XpBgyKU4ATYzcVSMKteZJ1iukJ3HgHBjbg9P5YPRCVUxlnQ=="],
+    "@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.3.1", "", { "os": "linux", "cpu": "x64" }, "sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ=="],
 
-    "@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.2.2", "", { "dependencies": { "@emnapi/core": "^1.8.1", "@emnapi/runtime": "^1.8.1", "@emnapi/wasi-threads": "^1.1.0", "@napi-rs/wasm-runtime": "^1.1.1", "@tybys/wasm-util": "^0.10.1", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-eKSztKsmEsn1O5lJ4ZAfyn41NfG7vzCg496YiGtMDV86jz1q/irhms5O0VrY6ZwTUkFy/EKG3RfWgxSI3VbZ8Q=="],
+    "@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.3.1", "", { "dependencies": { "@emnapi/core": "^1.10.0", "@emnapi/runtime": "^1.10.0", "@emnapi/wasi-threads": "^1.2.1", "@napi-rs/wasm-runtime": "^1.1.4", "@tybys/wasm-util": "^0.10.2", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA=="],
 
-    "@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.2.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-qPmaQM4iKu5mxpsrWZMOZRgZv1tOZpUm+zdhhQP0VhJfyGGO3aUKdbh3gDZc/dPLQwW4eSqWGrrcWNBZWUWaXQ=="],
+    "@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.3.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg=="],
 
-    "@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.2.2", "", { "os": "win32", "cpu": "x64" }, "sha512-1T/37VvI7WyH66b+vqHj/cLwnCxt7Qt3WFu5Q8hk65aOvlwAhs7rAp1VkulBJw/N4tMirXjVnylTR72uI0HGcA=="],
+    "@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.3.1", "", { "os": "win32", "cpu": "x64" }, "sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA=="],
 
-    "@tailwindcss/typography": ["@tailwindcss/typography@0.5.19", "", { "dependencies": { "postcss-selector-parser": "6.0.10" }, "peerDependencies": { "tailwindcss": ">=3.0.0 || insiders || >=4.0.0-alpha.20 || >=4.0.0-beta.1" } }, "sha512-w31dd8HOx3k9vPtcQh5QHP9GwKcgbMp87j58qi6xgiBnFFtKEAgCWnDw4qUT8aHwkCp8bKvb/KGKWWHedP0AAg=="],
+    "@tailwindcss/typography": ["@tailwindcss/typography@0.5.20", "", { "dependencies": { "postcss-selector-parser": "6.0.10" }, "peerDependencies": { "tailwindcss": ">=3.0.0 || >=4.0.0 || insiders" } }, "sha512-hwbzQuNUfcPvbegQFatVPl/MY/tcM9KLl963hQ5laJKPh81TEZ1+dNG9PirGvcaDBkp+BCshExAyKVPW91dozw=="],
 
-    "@tailwindcss/vite": ["@tailwindcss/vite@4.2.2", "", { "dependencies": { "@tailwindcss/node": "4.2.2", "@tailwindcss/oxide": "4.2.2", "tailwindcss": "4.2.2" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7 || ^8" } }, "sha512-mEiF5HO1QqCLXoNEfXVA1Tzo+cYsrqV7w9Juj2wdUFyW07JRenqMG225MvPwr3ZD9N1bFQj46X7r33iHxLUW0w=="],
+    "@tailwindcss/vite": ["@tailwindcss/vite@4.3.1", "", { "dependencies": { "@tailwindcss/node": "4.3.1", "@tailwindcss/oxide": "4.3.1", "tailwindcss": "4.3.1" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7 || ^8" } }, "sha512-hItDHuIIlEV61R+faXu66s1K36aTurO/Qw0e45Vskz57gXl9pWOT6eg3zmcEui6CZXddbN7zd41bwmvag4JGwQ=="],
+
+    "@tanstack/directive-functions-plugin": ["@tanstack/directive-functions-plugin@1.142.1", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/router-utils": "1.141.0", "babel-dead-code-elimination": "^1.0.10", "pathe": "^2.0.3", "tiny-invariant": "^1.3.3" }, "peerDependencies": { "vite": ">=6.0.0 || >=7.0.0" } }, "sha512-k4HhAaitobp+z2pXBkmoWgE8Ollhx7fQXpVL+PQ7HeHZc2PilrQtC3ysxvoPunufrztIxweSE9HAWkZ2AFNaLw=="],
 
     "@tanstack/history": ["@tanstack/history@1.162.0", "", {}, "sha512-79pf/RkhteYZTRgcR4F9kbk84P2N8rugQJswxfIqovlbRiT3yI7eBE+5QorIrZaOKktsgzRlXh1l/du/xpl4iA=="],
 
-    "@tanstack/query-core": ["@tanstack/query-core@5.99.0", "", {}, "sha512-3Jv3WQG0BCcH7G+7lf/bP8QyBfJOXeY+T08Rin3GZ1bshvwlbPt7NrDHMEzGdKIOmOzvIQmxjk28YEQX60k7pQ=="],
+    "@tanstack/query-core": ["@tanstack/query-core@5.101.0", "", {}, "sha512-cQetA74EB+seWySv1TTKr828TnP0u39m6LykwDXIo84SNortpDkp30TMEjkqtYCNP9c40uT/iwl6MLiufEt0Ow=="],
 
-    "@tanstack/query-devtools": ["@tanstack/query-devtools@5.99.0", "", {}, "sha512-m4ufXaJ8FjWXw7xDtyzE/6fkZAyQFg9WrbMrUpt8ZecRJx58jiFOZ2lxZMphZdIpAnIeto/S8stbwLKLusyckQ=="],
+    "@tanstack/query-devtools": ["@tanstack/query-devtools@5.101.0", "", {}, "sha512-MVqw17k08RQtGGLEL654+dX/btbX9p/8WjkznO//zusLTMaObxi3Q+MoFwGVkC9K3tqjn8qrrNhJevXx4fJTeQ=="],
 
-    "@tanstack/react-query": ["@tanstack/react-query@5.99.0", "", { "dependencies": { "@tanstack/query-core": "5.99.0" }, "peerDependencies": { "react": "^18 || ^19" } }, "sha512-OY2bCqPemT1LlqJ8Y2CUau4KELnIhhG9Ol3ZndPbdnB095pRbPo1cHuXTndg8iIwtoHTgwZjyaDnQ0xD0mYwAw=="],
+    "@tanstack/react-query": ["@tanstack/react-query@5.101.0", "", { "dependencies": { "@tanstack/query-core": "5.101.0" }, "peerDependencies": { "react": "^18 || ^19" } }, "sha512-rLlJXSpkqfizLWgkR5+eLeIk0MvTx/meEIR7LRjxic+qxiQP8zVjq7BqQkiCMNLQBlLfuOLqqr6KO5GtrDlmSg=="],
 
-    "@tanstack/react-query-devtools": ["@tanstack/react-query-devtools@5.99.0", "", { "dependencies": { "@tanstack/query-devtools": "5.99.0" }, "peerDependencies": { "@tanstack/react-query": "^5.99.0", "react": "^18 || ^19" } }, "sha512-CqqX7LCU9yOfCY/vBURSx2YSD83ryfX+QkfkaKionTfg1s2Hdm572Ro99gW3QPoJjzvsj1HM4pnN4nbDy3MXKA=="],
+    "@tanstack/react-query-devtools": ["@tanstack/react-query-devtools@5.101.0", "", { "dependencies": { "@tanstack/query-devtools": "5.101.0" }, "peerDependencies": { "@tanstack/react-query": "^5.101.0", "react": "^18 || ^19" } }, "sha512-cpZA0+WqKXwrwMfiWZEGGF6QrIWVQFbhBtxqDF5sQsAfrFf47HIE6fiPbQU3wyAUEN2+7UNqLCQe7oG6m3f93w=="],
 
     "@tanstack/react-router": ["@tanstack/react-router@1.170.15", "", { "dependencies": { "@tanstack/history": "1.162.0", "@tanstack/react-store": "^0.9.3", "@tanstack/router-core": "1.171.13", "isbot": "^5.1.22" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-GawYz7HEjj8rTUUDoT/SemDEVm63pZUO+2mOcXHY9Jl3EwMS5gFBnPu/2UvcrwRm1jN1k79fokc0d4aFmrLatg=="],
 
@@ -1100,6 +1137,10 @@
 
     "@tanstack/react-start-client": ["@tanstack/react-start-client@1.168.13", "", { "dependencies": { "@tanstack/react-router": "1.170.15", "@tanstack/router-core": "1.171.13", "@tanstack/start-client-core": "1.170.12" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-enr4hL0Fifqz7jO8Zy4CuEpunEfH1LbvMw/mRjG49j699Bo3CaR7mPDcgN/9tSSjjUT5ZDj9M6TiTp9cSgehww=="],
 
+    "@tanstack/react-start-plugin": ["@tanstack/react-start-plugin@1.131.50", "", { "dependencies": { "@tanstack/start-plugin-core": "1.131.50", "pathe": "^2.0.3", "zod": "^3.24.2" }, "peerDependencies": { "@vitejs/plugin-react": ">=4.3.4", "vite": ">=6.0.0" } }, "sha512-ys+sGvnnE8BUNjGsngg+MGn3F5lV4okL5CWEKFzjBSjQsrTN7apGfmqvBP3O6PkRPHpXZ8X3Z5QsFvSc0CaDRQ=="],
+
+    "@tanstack/react-start-router-manifest": ["@tanstack/react-start-router-manifest@1.120.19", "", { "dependencies": { "@tanstack/router-core": "^1.120.19", "tiny-invariant": "^1.3.3", "vinxi": "0.5.3" } }, "sha512-z+4YL6shTtsHjk32yaIemQwgkx6FcqwPBYfeNt7Co2eOpWrvsoo/Fe9869/oIY2sPyhiWDs1rDb3e0qnAy8Cag=="],
+
     "@tanstack/react-start-rsc": ["@tanstack/react-start-rsc@0.1.24", "", { "dependencies": { "@tanstack/react-router": "1.170.15", "@tanstack/router-core": "1.171.13", "@tanstack/router-utils": "1.162.2", "@tanstack/start-client-core": "1.170.12", "@tanstack/start-fn-stubs": "1.162.0", "@tanstack/start-plugin-core": "1.171.17", "@tanstack/start-server-core": "1.169.14", "@tanstack/start-storage-context": "1.167.15", "pathe": "^2.0.3" }, "peerDependencies": { "@rspack/core": ">=2.0.0-0", "@vitejs/plugin-rsc": ">=0.5.20", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0", "react-server-dom-rspack": ">=0.0.2" }, "optionalPeers": ["@rspack/core", "@vitejs/plugin-rsc", "react-server-dom-rspack"] }, "sha512-8zBLV68t6byrbtIyKYNTCpcc7qFbb0kQiu0yFtFIvsi70fpBeG3VP8bmkN95/Cqpvz1lLio+E4JApRyV52MpxQ=="],
 
     "@tanstack/react-start-server": ["@tanstack/react-start-server@1.167.19", "", { "dependencies": { "@tanstack/react-router": "1.170.15", "@tanstack/router-core": "1.171.13", "@tanstack/start-server-core": "1.169.14" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-+eMpAwDreQvCwgX45MdUHTUCF/Wad36+PwQafe6W5wa3qVkGyN3P131ShGyRwT/0WwKa5EVGdW1zFgwby8UNqA=="],
@@ -1108,7 +1149,7 @@
 
     "@tanstack/react-table": ["@tanstack/react-table@8.21.3", "", { "dependencies": { "@tanstack/table-core": "8.21.3" }, "peerDependencies": { "react": ">=16.8", "react-dom": ">=16.8" } }, "sha512-5nNMTSETP4ykGegmVkhjcS8tTLW6Vl4axfEGQN3v0zdHYbK4UfoqfPChclTrJ4EoK9QynqAu9oUf8VEmrpZ5Ww=="],
 
-    "@tanstack/react-virtual": ["@tanstack/react-virtual@3.13.26", "", { "dependencies": { "@tanstack/virtual-core": "3.16.0" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-DosdgjOxCLahkn0o+ilmZYwEjo1glfMGuRT/j3PQ18yr5XqA8N/BCaL9IJ3B5TRl+nnzyK2IOFgAILwzN3a9xQ=="],
+    "@tanstack/react-virtual": ["@tanstack/react-virtual@3.14.3", "", { "dependencies": { "@tanstack/virtual-core": "3.17.1" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-k/cnHPVaOfn46hSbiY6n4Dzf4QjCGWSF40zR5QIIYUqPAjpA6TN7InfYmcMiDVQGP2iUn9xsRbAl8u1v3UmeVQ=="],
 
     "@tanstack/router-core": ["@tanstack/router-core@1.171.13", "", { "dependencies": { "@tanstack/history": "1.162.0", "cookie-es": "^3.0.0", "seroval": "^1.5.4", "seroval-plugins": "^1.5.4" } }, "sha512-+NOwEj1kO/6IGmpHRIZHasYxYWpyBQGNIZAST9aNrk9Q3YlU9SgqVnl1pbLa9qAKfeNdXQIRve0RQb/0kyDeDA=="],
 
@@ -1122,21 +1163,39 @@
 
     "@tanstack/router-utils": ["@tanstack/router-utils@1.162.2", "", { "dependencies": { "@babel/generator": "^7.28.5", "@babel/parser": "^7.28.5", "@babel/types": "^7.28.5", "ansis": "^4.1.0", "babel-dead-code-elimination": "^1.0.12", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-hTWqJtqIFFdvuCl8WXNyrodp2L9zo2G37xKRrcVmVRWpAB2h+U1LuRAfS4tsFTiWOIoE/B+WDVFB8JpoEdw6jQ=="],
 
+    "@tanstack/server-functions-plugin": ["@tanstack/server-functions-plugin@1.142.1", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/directive-functions-plugin": "1.142.1", "babel-dead-code-elimination": "^1.0.9", "tiny-invariant": "^1.3.3" } }, "sha512-ltTOj6dIDlRV3M8+PzontDYFMnIQ+icUnD+OKzIRfKo6bbvC0qvy8ttuWmVJxmqHy9xsWgkNt4gZrKVjtWXIhQ=="],
+
+    "@tanstack/start": ["@tanstack/start@1.120.20", "", { "dependencies": { "@tanstack/react-start-client": "^1.120.20", "@tanstack/react-start-router-manifest": "^1.120.19", "@tanstack/react-start-server": "^1.120.20", "@tanstack/start-api-routes": "^1.120.19", "@tanstack/start-config": "^1.120.20", "@tanstack/start-server-functions-client": "^1.120.19", "@tanstack/start-server-functions-handler": "^1.120.19", "@tanstack/start-server-functions-server": "^1.120.17", "@tanstack/start-server-functions-ssr": "^1.120.19" } }, "sha512-fQO+O/5xJpli5KlV6pwDz6DtpbqO/0atdVSyVnkemzk0Mej9azm4HXtw+cKkIPtsSplWs4B1EbMtgGMb9ADhSA=="],
+
+    "@tanstack/start-api-routes": ["@tanstack/start-api-routes@1.120.19", "", { "dependencies": { "@tanstack/router-core": "^1.120.19", "@tanstack/start-server-core": "^1.120.19", "vinxi": "0.5.3" } }, "sha512-zvMI9Rfwsm3CCLTLqdvUfteDRMdPKTOO05O3L8vp49BrYYsLrT0OplhounzdRMgGMnKd4qCXUC9Pj4UOUOodTw=="],
+
     "@tanstack/start-client-core": ["@tanstack/start-client-core@1.170.12", "", { "dependencies": { "@tanstack/router-core": "1.171.13", "@tanstack/start-fn-stubs": "1.162.0", "@tanstack/start-storage-context": "1.167.15", "seroval": "^1.5.4" } }, "sha512-gwtZRMPUIAxmDV2AIQUhC0kSW262SV7BkHXEgy5B1woHQdrdsELuGOdJwdweLxrjyefORxk+9MYGqDY0Cxn0bw=="],
 
+    "@tanstack/start-config": ["@tanstack/start-config@1.120.20", "", { "dependencies": { "@tanstack/react-router": "^1.120.20", "@tanstack/react-start-plugin": "^1.120.17", "@tanstack/router-generator": "^1.120.20", "@tanstack/router-plugin": "^1.120.20", "@tanstack/server-functions-plugin": "^1.120.17", "@tanstack/start-server-functions-handler": "^1.120.19", "@vitejs/plugin-react": "^4.3.4", "import-meta-resolve": "^4.1.0", "nitropack": "^2.10.4", "ofetch": "^1.4.1", "vinxi": "0.5.3", "vite": "^6.1.0", "zod": "^3.24.2" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-oH/mfTSHV8Qbil74tWicPLW6+kKmT3esXCnDzvrkhi3+N8ZuVUDr01Qpil0Wxf9lLPfM5L6VX03nF4hSU8vljg=="],
+
     "@tanstack/start-fn-stubs": ["@tanstack/start-fn-stubs@1.162.0", "", {}, "sha512-QWfUZ3Yo923tdQn38LyKMU8rcTw69zc+T4dAvgTWV4O56SqFRsGfS0lSWIMhJRwXIx/bvdi7nTUBDdZtTHtpTQ=="],
 
     "@tanstack/start-plugin-core": ["@tanstack/start-plugin-core@1.171.17", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.28.5", "@babel/types": "^7.28.5", "@tanstack/router-core": "1.171.13", "@tanstack/router-generator": "1.167.17", "@tanstack/router-plugin": "1.168.18", "@tanstack/router-utils": "1.162.2", "@tanstack/start-server-core": "1.169.14", "exsolve": "^1.0.7", "lightningcss": "^1.32.0", "pathe": "^2.0.3", "picomatch": "^4.0.3", "seroval": "^1.5.4", "source-map": "^0.7.6", "srvx": "^0.11.9", "tinyglobby": "^0.2.15", "ufo": "^1.5.4", "vitefu": "^1.1.1", "xmlbuilder2": "^4.0.3", "zod": "^4.4.3" }, "peerDependencies": { "@rsbuild/core": "^2.0.0", "vite": ">=7.0.0" }, "optionalPeers": ["@rsbuild/core", "vite"] }, "sha512-ngKkp3wn/U3nyeqZl7KcMzjbgTbcypC5ES7O92JpA5/tz4PufFOf5l+eX3pY+4Z6jE6Jb6ekQgnryG7XMjpK7Q=="],
 
     "@tanstack/start-server-core": ["@tanstack/start-server-core@1.169.14", "", { "dependencies": { "@tanstack/history": "1.162.0", "@tanstack/router-core": "1.171.13", "@tanstack/start-client-core": "1.170.12", "@tanstack/start-storage-context": "1.167.15", "fetchdts": "^0.1.6", "h3-v2": "npm:h3@2.0.1-rc.20", "seroval": "^1.5.4" } }, "sha512-cSCTNbKARrkddPOfavF/soRFDxH+b+v3m4TeW6AvEy419R3E0ZsoZAm5UI6uNR1y4UU9WTOmaxLQ4nzIZPKmXg=="],
 
+    "@tanstack/start-server-functions-client": ["@tanstack/start-server-functions-client@1.131.50", "", { "dependencies": { "@tanstack/server-functions-plugin": "1.131.2", "@tanstack/start-server-functions-fetcher": "1.131.50" } }, "sha512-4aM17fFdVAFH6uLPswKJxzrhhIjcCwKqzfTcgY3OnhUKnaZBTQwJA+nUHQCI6IWvEvrcrNVtFTtv13TkDk3YMw=="],
+
+    "@tanstack/start-server-functions-fetcher": ["@tanstack/start-server-functions-fetcher@1.131.50", "", { "dependencies": { "@tanstack/router-core": "1.131.50", "@tanstack/start-client-core": "1.131.50" } }, "sha512-yeZekr84BkyLaNaZ4llKbDBb+CJPVESP881iJijP++SuRmvetivUs75KiV9VFIf7MhdefICmRcCdff/KbK5QnQ=="],
+
+    "@tanstack/start-server-functions-handler": ["@tanstack/start-server-functions-handler@1.120.19", "", { "dependencies": { "@tanstack/router-core": "^1.120.19", "@tanstack/start-client-core": "^1.120.19", "@tanstack/start-server-core": "^1.120.19", "tiny-invariant": "^1.3.3" } }, "sha512-Ow8HkNieoqHumD3QK4YUDIhzBtFX9mMEDrxFYtbVBgxP1C9Rm/YDuwnUNP49q1tTOZ22Bs4wSDjBXvu+OgSSfA=="],
+
+    "@tanstack/start-server-functions-server": ["@tanstack/start-server-functions-server@1.131.2", "", { "dependencies": { "@tanstack/server-functions-plugin": "1.131.2", "tiny-invariant": "^1.3.3" } }, "sha512-u67d6XspczlC/dYki/Id28oWsTjkZMJhDqO4E23U3rHs8eYgxvMBHKqdeqWgOyC+QWT9k6ze1pJmbv+rmc3wOQ=="],
+
+    "@tanstack/start-server-functions-ssr": ["@tanstack/start-server-functions-ssr@1.120.19", "", { "dependencies": { "@tanstack/server-functions-plugin": "^1.120.17", "@tanstack/start-client-core": "^1.120.19", "@tanstack/start-server-core": "^1.120.19", "@tanstack/start-server-functions-fetcher": "^1.120.19", "tiny-invariant": "^1.3.3" } }, "sha512-D4HGvJXWvVUssgkLDtdSJTFfWuT+nVv9GauPfVQTtMUUy+NbExNkFWKvF+XvCS81lBqnCKL7VrWqZMXiod0gTA=="],
+
     "@tanstack/start-storage-context": ["@tanstack/start-storage-context@1.167.15", "", { "dependencies": { "@tanstack/router-core": "1.171.13" } }, "sha512-Jy0q4vdG6pv76N92+X+ag3fuOV2zINQagYyMN1/es7tPI1vzpKECIU8AqHqzI6ahkwaph7XDvmfUkiLJ3i4LOA=="],
 
     "@tanstack/store": ["@tanstack/store@0.9.3", "", {}, "sha512-8reSzl/qGWGGVKhBoxXPMWzATSbZLZFWhwBAFO9NAyp0TxzfBP0mIrGb8CP8KrQTmvzXlR/vFPPUrHTLBGyFyw=="],
 
     "@tanstack/table-core": ["@tanstack/table-core@8.21.3", "", {}, "sha512-ldZXEhOBb8Is7xLs01fR3YEc3DERiz5silj8tnGkFZytt1abEvl/GhUmCE0PMLaMPTa3Jk4HbKmRlHmu+gCftg=="],
 
-    "@tanstack/virtual-core": ["@tanstack/virtual-core@3.16.0", "", {}, "sha512-Er2N7q3WOiH6y2JLxsxNX+u2/sLqSsL0bxFgDjuiPiA7vKhZRm+IzcS17vRee3GNXr64UsesA5CAp9yTiIYw9A=="],
+    "@tanstack/virtual-core": ["@tanstack/virtual-core@3.17.1", "", {}, "sha512-VZyW2Uiml5tmBZwPGrSD3Sz73OxzljQMCmzYHsUTPEuTsERf5xwa+uWb01xEzkz3ZSYTjj8NEb/mKHvgKxyZdA=="],
 
     "@tanstack/virtual-file-routes": ["@tanstack/virtual-file-routes@1.162.0", "", {}, "sha512-uhOeFyxLcU41HzvrxsGpiWdcMbScY1EDgbZ5K7DVRMYInbLYWAC0EA/kx9wXAoSM8q82bUG2hRl8+EAjE6XAbA=="],
 
@@ -1148,95 +1207,107 @@
 
     "@tiptap/core": ["@tiptap/core@3.23.4", "", { "peerDependencies": { "@tiptap/pm": "3.23.4" } }, "sha512-ni2LWE52bVeSt3L2HVBSmbBw+elc32ATej9C68EyKzN/8vR5ILxFn6RCdDTKm4asmwZyq2jys12dKmBdWMr9QA=="],
 
-    "@tiptap/extension-blockquote": ["@tiptap/extension-blockquote@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-IaUx3zh7yLHXzIXKL+fw/jzFhsIImdhJyw0lMhe8FfYrefFqXJFYW/sey6+L/e8B3AWvTksPA6VBwefzbH77JA=="],
+    "@tiptap/extension-blockquote": ["@tiptap/extension-blockquote@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-7YjSibNlPcy9eGK+tHt5G/Njr7nPxl+rZ3rCC6TwtLIRLSHPnoGDsfFOgTPkXxaQcE1a/VQwemnYfWc3kdIjDQ=="],
 
-    "@tiptap/extension-bold": ["@tiptap/extension-bold@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-tysipHla2zCWr8XNIWRaW9O+7i7/SoEqnRqSRUUi2ailcJjlia+RBy3RykhkgyThrQDStu5KGBS/UvrXwA+O1A=="],
+    "@tiptap/extension-bold": ["@tiptap/extension-bold@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-3L9tnZ12i+98u5df2nV2zGu/sc3rhI87E3ocn1YYAO8PJUAgZnMwdet8JawCrS1uut5sRKlxo3SXEmdNfRVm/w=="],
 
-    "@tiptap/extension-bubble-menu": ["@tiptap/extension-bubble-menu@3.22.3", "", { "dependencies": { "@floating-ui/dom": "^1.0.0" }, "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-Y6zQjh0ypDg32HWgICEvmPSKjGLr39k3aDxxt/H0uQEZSfw4smT0hxUyyyjVjx68C6t6MTnwdfz0hPI5lL68vQ=="],
+    "@tiptap/extension-bubble-menu": ["@tiptap/extension-bubble-menu@3.23.4", "", { "dependencies": { "@floating-ui/dom": "^1.0.0" }, "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-EPTpL/IFp/aTGZErBq/Mc3dKznj6G/qNEkVYWjueOn1oKApyT0P6WVHGvu/vpMdErhzmoGDuFPPGVS6T8Upx2Q=="],
 
-    "@tiptap/extension-bullet-list": ["@tiptap/extension-bullet-list@3.22.3", "", { "peerDependencies": { "@tiptap/extension-list": "^3.22.3" } }, "sha512-xOmW/b1hgECIE6r3IeZvKn4VVlG3+dfTjCWE6lnnyLaqdNkNhKS1CwUmDZdYNLUS2ryIUtgz5ID1W/8A3PhbiA=="],
+    "@tiptap/extension-bullet-list": ["@tiptap/extension-bullet-list@3.23.4", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.4" } }, "sha512-mXB2KZOz1R+E6VNTZ3vzdAk7ZDGKjPmsJEZIQg1B5qRycTKg49/rCCkLA2QnqAwX6BzS3mLLH1RWE2W0oXD7vg=="],
 
-    "@tiptap/extension-code": ["@tiptap/extension-code@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-wafWTDQOuMKtXpZEuk1PFQmzopabBciNLryL90MB9S03MNLaQQZYLnmYkDBlzAaLAbgF5QiC+2XZQEBQuTVjFQ=="],
+    "@tiptap/extension-code": ["@tiptap/extension-code@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-C0TeRipMycUEBnV+Mzx6eLp/yZb6Vi/waP3Tkb0lO5/ikg7LWLB7AlmMunjIXEUcR/pJHID/aEh5PfJFpysUDg=="],
 
-    "@tiptap/extension-code-block": ["@tiptap/extension-code-block@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-RiQtEjDAPrHpdo6sw6b7fOw/PijqgFIsozKKkGcSeBgWHQuFg7q9OxJTj+l0e60rVwSu/5gmKEEobzM9bX+t2Q=="],
+    "@tiptap/extension-code-block": ["@tiptap/extension-code-block@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-UEU1w/85CSNKktbhESnIRmtjKcH7DeschReZA8err1wAnYLTKzid5ucnJSJ25iRg2V5Fnuws5gnPT5CVgdfXCQ=="],
 
-    "@tiptap/extension-code-block-lowlight": ["@tiptap/extension-code-block-lowlight@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/extension-code-block": "^3.22.3", "@tiptap/pm": "^3.22.3", "highlight.js": "^11", "lowlight": "^2 || ^3" } }, "sha512-NGFuD9zb1QfnCgD2zW4XaUEdQvd/ydm9FmXXh8eawx/+C8xt3p21DIKRERvxWrCvvVNzIUEpZRRYehPOJiD1eg=="],
+    "@tiptap/extension-code-block-lowlight": ["@tiptap/extension-code-block-lowlight@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/extension-code-block": "3.23.4", "@tiptap/pm": "3.23.4", "highlight.js": "^11", "lowlight": "^2 || ^3" } }, "sha512-fnqUBS9zTXntCzdXMKtH18vLunZ+vyLONmco3rChWKII8lBV7Dycdrj9jGvJKJ4BsvK7NLwZp3NLokSyVSGtiQ=="],
 
-    "@tiptap/extension-document": ["@tiptap/extension-document@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-MCSr1PFPtTd++lA3H1RNgqAczAE59XXJ5wUFIQf2F+/0DPY5q2SU4g5QsNJVxPPft5mrNT4C6ty8xBPrALFEdA=="],
+    "@tiptap/extension-document": ["@tiptap/extension-document@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-YC4G6VkxT629rlqUTwD6XvOpxjvghn7fxrK4RbyKVJY2C6E1vgmX0won1Ast6v+qTE6iONOMS6f6VyPxSGjg4w=="],
 
-    "@tiptap/extension-dropcursor": ["@tiptap/extension-dropcursor@3.22.3", "", { "peerDependencies": { "@tiptap/extensions": "^3.22.3" } }, "sha512-taXq9Tl5aybdFbptJtFRHX9LFJzbXphAbPp4/vutFyTrBu5meXDxuS+B9pEmE+Or0XcolTlW2nDZB0Tqnr18JQ=="],
+    "@tiptap/extension-dropcursor": ["@tiptap/extension-dropcursor@3.23.4", "", { "peerDependencies": { "@tiptap/extensions": "3.23.4" } }, "sha512-ujJQUIENk0RwVFCh5g/TOSEv1a7Pnam/cjHmSUqHWUNZkYS9aOqjm+JfURJPCinRS2oHvo3AARul5mkKgDJYcA=="],
 
-    "@tiptap/extension-emoji": ["@tiptap/extension-emoji@3.22.3", "", { "dependencies": { "emoji-regex": "^10.6.0", "emojibase-data": "^17", "is-emoji-supported": "^0.0.5" }, "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3", "@tiptap/suggestion": "^3.22.3" } }, "sha512-eKPLtdrUZ8ZgDCl8TW7RbfkYgGmVwMoWt10U/7gFYxGOlH+GD+hIKMrzyQrz5kOru/5LI+AoXgFe7eTuc1iplg=="],
+    "@tiptap/extension-emoji": ["@tiptap/extension-emoji@3.23.4", "", { "dependencies": { "emoji-regex": "^10.6.0", "emojibase-data": "^17", "is-emoji-supported": "^0.0.5" }, "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4", "@tiptap/suggestion": "3.23.4" } }, "sha512-yXnq2NF154tlEt6S0v6CRr438J2EUHIFTb+YvK/OzzUBBdHHS4KYorfwa8kjwdgk4KL7JK8/S5h76HSBYMuq/w=="],
 
-    "@tiptap/extension-floating-menu": ["@tiptap/extension-floating-menu@3.22.3", "", { "peerDependencies": { "@floating-ui/dom": "^1.0.0", "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-0f8b4KZ3XKai8GXWseIYJGdOfQr3evtFbBo3U08zy2aYzMMXWG0zEF7qe5/oiYp2aZ95edjjITnEceviTsZkIg=="],
+    "@tiptap/extension-floating-menu": ["@tiptap/extension-floating-menu@3.23.4", "", { "peerDependencies": { "@floating-ui/dom": "^1.0.0", "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-eAc72bKM26yIPx0jsU8qdjE71vFNVu5R9jGbdItBMFc0SPLS4qY8g+8RJ+iWoLwbcSEpgooLS9D9sLfdAU+Tvw=="],
 
-    "@tiptap/extension-gapcursor": ["@tiptap/extension-gapcursor@3.22.3", "", { "peerDependencies": { "@tiptap/extensions": "^3.22.3" } }, "sha512-L/Px4UeQEVG/D9WIlcAOIej+4wyIBCMUSYicSR+hW68UsObe4rxVbUas1QgidQKm6DOhoT7U7D4KQHA/Gdg/7A=="],
+    "@tiptap/extension-gapcursor": ["@tiptap/extension-gapcursor@3.23.4", "", { "peerDependencies": { "@tiptap/extensions": "3.23.4" } }, "sha512-RuyvOlIGP6UpVOc0Lw0L63jKLtYM49CNhPV2OMSfwwwbBZ3pJGos2/SqpYg71d3sn+qpsAopS4Pfr8iPZog73A=="],
 
-    "@tiptap/extension-hard-break": ["@tiptap/extension-hard-break@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-J0v8I99y9tbvVmgKYKzKP/JYNsWaZYS7avn4rzLft2OhnyTfwt3OoY8DtpHmmi6apSUaCtoWHWta/TmoEfK1nQ=="],
+    "@tiptap/extension-hard-break": ["@tiptap/extension-hard-break@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-ODlpZCi7n136BH9luM09EFL8Pg+bbRCd0tzCQM5BKMXRkLitYZA8Gl/f5DLmGJ50wzFsDPXK2Br2g9UvZK7COg=="],
 
-    "@tiptap/extension-heading": ["@tiptap/extension-heading@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-XBHuhiEV2EEhZHpOLcplLqAmBIhJciU3I6AtwmqeEqDC0P114uMEfAO7JGlbBZdCYotNer26PKnu44TBTeNtkw=="],
+    "@tiptap/extension-heading": ["@tiptap/extension-heading@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-8W9Hqi0J69Xbqg08nPf4xRMJXMccaKFAgUE1tvy5PAWJSQxOMwkKQXgZXxwe+80sOMUnV8qveBqUy/ODMPgAxQ=="],
 
-    "@tiptap/extension-horizontal-rule": ["@tiptap/extension-horizontal-rule@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-wI2bFzScs+KgWeBH/BtypcVKeYelCyqV0RG8nxsZMWtPrBhqixzNd0Oi3gEKtjSjKUqMQ/kjJAIRuESr5UzlHA=="],
+    "@tiptap/extension-horizontal-rule": ["@tiptap/extension-horizontal-rule@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-EA4kK8ywZ4dQNOdxeZbplmDDs5T5LjMgHpqxRwukj9wwKiILOK5E3fcKm1fCKh9Q02w96jax6YVccHwmgJP3sQ=="],
 
-    "@tiptap/extension-image": ["@tiptap/extension-image@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-Qpp8c5LOQaNpHrzjqZtoxtIR+8sSqJ7k8v+8anmYw3nxjvt2kpfT28Vd7aWMX55ZS43LaxMx+MkZqbmgUmMP0w=="],
+    "@tiptap/extension-image": ["@tiptap/extension-image@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-qandp5HLRl+n8D61+LCT67qtb1uSKffyEGD0fVTkg/RfbyFsJvCDFbjVEoiIG8JOx8O5DehgrDCvS35QOWgr2A=="],
 
-    "@tiptap/extension-italic": ["@tiptap/extension-italic@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-LteA4cb4EGCiUtrK2JHvDF/Zg0/YqV4DUyHhAAho+oGEQDupZlsS6m0ia5wQcclkiTLzsoPrwcSNu6RDGQ16wQ=="],
+    "@tiptap/extension-italic": ["@tiptap/extension-italic@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-jUAHi+HZlg47BzgVIy6y/UH5vev7vPQ95jddhB5K3hC122kvWFMXlken7UOnqzbxNcHs2+4Oi/ZJirYMpT4P5w=="],
 
-    "@tiptap/extension-link": ["@tiptap/extension-link@3.22.3", "", { "dependencies": { "linkifyjs": "^4.3.2" }, "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-S8/P2o9pv6B3kqLjH2TRWwSAximGbciNc6R8/QcN6HWLYxp0N0JoqN3rZHl9VWIBAGRWc4zkt80dhqrl2xmgfQ=="],
+    "@tiptap/extension-link": ["@tiptap/extension-link@3.23.4", "", { "dependencies": { "linkifyjs": "^4.3.3" }, "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-XjxltY7MomwfTs6jmN6Bw5bb/upb34lpyqv2RiXppFTK25Br7ipksRjUpWpB4/csZeg30qwrLGVKxCol38ffrw=="],
 
-    "@tiptap/extension-list": ["@tiptap/extension-list@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-rqvv/dtqwbX+8KnPv0eMYp6PnBcuhPMol5cv1GlS8Nq/Cxt68EWGUHBuTFesw+hdnRQLmKwzoO1DlRn7PhxYRQ=="],
+    "@tiptap/extension-list": ["@tiptap/extension-list@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-yuauDm6qW/7q+ZO0YJBKQEGdnUm6DDTJM8AMp9bMZrT4jRf/zyUtNcZ91QEfFvBcyVuI+10PIOXtNPevhQ741Q=="],
 
-    "@tiptap/extension-list-item": ["@tiptap/extension-list-item@3.22.3", "", { "peerDependencies": { "@tiptap/extension-list": "^3.22.3" } }, "sha512-80CNf4oO5y8+LdckT4CyMe1t01EyhpRrQC9H45JW20P7559Nrchp5my3vvMtIAJbpTPPZtcB7LwdzWGKsG5drg=="],
+    "@tiptap/extension-list-item": ["@tiptap/extension-list-item@3.23.4", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.4" } }, "sha512-Q/JXosShD5oyDwukE6igdrZD2lb0ZgyoQTHYchk0pzU4frClFbn3RI1wKP+XeqKLhdO6KH2WZ9rERGH7PtDi7Q=="],
 
-    "@tiptap/extension-list-keymap": ["@tiptap/extension-list-keymap@3.22.3", "", { "peerDependencies": { "@tiptap/extension-list": "^3.22.3" } }, "sha512-pKuyj5llu35zd/s2u/H9aydKZjmPRAIK5P1q/YXULhhCNln2RnmuRfQ5NklAqTD3yGciQ2lxDwwf7J6iw3ergA=="],
+    "@tiptap/extension-list-keymap": ["@tiptap/extension-list-keymap@3.23.4", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.4" } }, "sha512-9FezifCfuoc0o+5K6l4QNOOfelqxnDGg/f9oL1D/LFZPC54bPxpWWft9QCWOqyqZgyLCLjbCjciAlbgkrFUmmw=="],
 
     "@tiptap/extension-mention": ["@tiptap/extension-mention@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4", "@tiptap/suggestion": "3.23.4" } }, "sha512-4Fq4shW/XQ8h4wyaudOP4HWze9NWN4MTCQAQb8BSHWaMOosVRzve+WnTQL53axWj0pbYqM+d9iYpMgvdMmMm9g=="],
 
-    "@tiptap/extension-ordered-list": ["@tiptap/extension-ordered-list@3.22.3", "", { "peerDependencies": { "@tiptap/extension-list": "^3.22.3" } }, "sha512-orAghtmd+K4Euu4BgI1hG+iZDXBYOyl5YTwiLBc2mQn+pqtZ9LqaH2us4ETwEwNP3/IWXGSAimUZ19nuL+eM2w=="],
+    "@tiptap/extension-ordered-list": ["@tiptap/extension-ordered-list@3.23.4", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.4" } }, "sha512-+3ofyssYnOTa1+nFWEmCAY1ngn8nAV1xo25JnNNC87NMU9WkSgr93jB7/uUJP0uui1C2dBLlaup3XXm108yarw=="],
 
-    "@tiptap/extension-paragraph": ["@tiptap/extension-paragraph@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-oO7rhfyhEuwm+50s9K3GZPjYyEEEvFAvm1wXopvZnhbkBLydIWImBfrZoC5IQh4/sRDlTIjosV2C+ji5y0tUSg=="],
+    "@tiptap/extension-paragraph": ["@tiptap/extension-paragraph@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-KbhXjCFzWphvFn5VU7E4dtmYDm+bssI1i0+CnXPWCXkjdaaX88ck68Xp1fKz8/bbI/CqlgiNDO/3TvqgtZ6woQ=="],
 
-    "@tiptap/extension-placeholder": ["@tiptap/extension-placeholder@3.22.3", "", { "peerDependencies": { "@tiptap/extensions": "^3.22.3" } }, "sha512-7vbtlDVO00odqCnsMSmA4b6wjL5PFdfExFsdsDO0K0VemqHZ/doIRx/tosNUD1VYSOyKQd8U7efUjkFyVoIPlg=="],
+    "@tiptap/extension-placeholder": ["@tiptap/extension-placeholder@3.23.4", "", { "peerDependencies": { "@tiptap/extensions": "3.23.4" } }, "sha512-yHtAZkFR9M2AQmCi555w4ns1BBCqwRyYDYMtd10DBvqPX7T3TmGerPdUfI6sLr74GxnZ5zHOnOYdwAbeG5JzNw=="],
 
-    "@tiptap/extension-strike": ["@tiptap/extension-strike@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-jY2InoUlKkuk5KHoIDGdML1OCA2n6PRHAtxwHNkAmiYh0Khf0zaVPGFpx4dgQrN7W5Q1WE6oBZnjrvy6qb7w0g=="],
+    "@tiptap/extension-strike": ["@tiptap/extension-strike@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-Vnq5vW801zPbu1LtKeA5k4R241jY+hRjXeijYwIPxy15KzIiipY12518HiCf6/8kkRbMxgOfdYg9X4BRV3HV3g=="],
 
-    "@tiptap/extension-table": ["@tiptap/extension-table@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-inbQSusJad7H0T++L1APg/anfL5d15cNGp2YG3vwo6TQr71nn2c9pepvmz3xuAIt8eygZDRba+4GT/COP1f9QA=="],
+    "@tiptap/extension-table": ["@tiptap/extension-table@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-TRh6JMTRYXCWpwavGt3aAHH2f51ZzkhurfW3XvrURG3It8MvfuuY1xB1xba1ss5c0QLWlrKx6GVaSXrUCdFLlg=="],
 
-    "@tiptap/extension-table-cell": ["@tiptap/extension-table-cell@3.22.3", "", { "peerDependencies": { "@tiptap/extension-table": "^3.22.3" } }, "sha512-LgaUgNwjHe6J7dq66N7iflC9efjgygsYWkHJtfLzaSU82tXzk8HSwBrMRCaj0PU+AR967/jGixEZIxH9xfXswQ=="],
+    "@tiptap/extension-table-cell": ["@tiptap/extension-table-cell@3.23.4", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.4" } }, "sha512-GmLLF9w7ExXhieshDnwC2U4kE8EM3TliDnHYX7uXOnSptWqASku6hOFw0f1AT5MDJog9NPzRo+adGVRHS9kjTQ=="],
 
-    "@tiptap/extension-table-header": ["@tiptap/extension-table-header@3.22.3", "", { "peerDependencies": { "@tiptap/extension-table": "^3.22.3" } }, "sha512-5wQ5rne9ccdbzeqC1AEDaUzlWjnpQNgBctgSPKEv+Da88lRRcGX21H+b/8jhL7fr4/sznr45toKGUg8NmRhboQ=="],
+    "@tiptap/extension-table-header": ["@tiptap/extension-table-header@3.23.4", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.4" } }, "sha512-5IXIHjpCpuZ06SmOoVsnK4VoOhd/G6yLiDtP3Azcf+KUI5539ryWE9I9EAqgalV2HcJMMYX9MQpl5WReHRGETw=="],
 
-    "@tiptap/extension-table-row": ["@tiptap/extension-table-row@3.22.3", "", { "peerDependencies": { "@tiptap/extension-table": "^3.22.3" } }, "sha512-dkoHnbOZgb2iQLXsp2FUu0KejAh3LOqDLMixYYU/0lnUwhqGG8kgu6+0YkCiUhedbfMFqVvemdKnRddpTQ4sqg=="],
+    "@tiptap/extension-table-row": ["@tiptap/extension-table-row@3.23.4", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.4" } }, "sha512-kqQt0I4cm2E+NNLpZ5rtox53Vgzyy19ZczvJ66Ao6BZkXXKqYXSRJc4q0jGNPX8hHhvHBpHmffcz5hdT/1XtNQ=="],
 
-    "@tiptap/extension-task-item": ["@tiptap/extension-task-item@3.22.3", "", { "peerDependencies": { "@tiptap/extension-list": "^3.22.3" } }, "sha512-bUxP6fmlrF4sbpHnkm0nTKNVmtQXNnhrbWsUt0MCnvAd9y5Nq3ohpOzMOCL71AEHfmeV1kEkPbpdwKb1R7XDbg=="],
+    "@tiptap/extension-task-item": ["@tiptap/extension-task-item@3.23.4", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.4" } }, "sha512-b6lmmwCcF5/9WetpgnSa5gxq/dRpJNJNvl4om/XKVRsvC9MQ3GwJMnhjPmcIneop4M5n++644+PJRu/N03uM7w=="],
 
-    "@tiptap/extension-task-list": ["@tiptap/extension-task-list@3.22.3", "", { "peerDependencies": { "@tiptap/extension-list": "^3.22.3" } }, "sha512-ze/DNj7Uq/Xjo+t8UuumnvJcmGVrVvLar11nFxobgpij21ja6XiUNMZ+BywvFurWbh5NrHeSYV07vFOWWf5Cpg=="],
+    "@tiptap/extension-task-list": ["@tiptap/extension-task-list@3.23.4", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.4" } }, "sha512-WIz4MHvPZssS5pNTTn2BuriCNrHA6jeS1XiRIqJFrvRXj7Kc9scXtGpne3GmisXDDeDKcP1IjREwQO9nlD8mVw=="],
 
-    "@tiptap/extension-text": ["@tiptap/extension-text@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-Q9R7JsTdomP5uUjtPjNKxHT1xoh/i9OJZnmgJLe7FcgZEaPOQ3bWxmKZoLZQfDfZjyB8BtH+Hc7nUvhCMOePxw=="],
+    "@tiptap/extension-text": ["@tiptap/extension-text@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-q9kxver/MR18p66aWZHSPycnr9hcBFyVGeGj8gf+BQCzn5hpvtSYTfLvk1nq8GFhygdQ9/e3f7B5ovrm/jnpvw=="],
 
-    "@tiptap/extension-underline": ["@tiptap/extension-underline@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-Ch6CBWRa5w90yYSPUW6x9Py9JdrXMqk3pZ9OIlMYD8A7BqyZGfiHerX7XDMYDS09KjyK3U9XH60/zxYOzXdDLA=="],
+    "@tiptap/extension-underline": ["@tiptap/extension-underline@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-F1ocPT10LV+seky25R1TMCRdc/Iof99jLcDSYDGr6mNEDY4ct2RvOeSM8aDdYq6CkH+vXt3i3JDeRwV23KzswQ=="],
 
-    "@tiptap/extension-youtube": ["@tiptap/extension-youtube@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3" } }, "sha512-Qk9u1E5vSAGuRbSjCp3spLVZ4JMRzx0XGtz4wCIv4Fr6RZE6zGnja5vnbGA72KzhOEZJ0bS2S5mcKyYPUUIXeg=="],
+    "@tiptap/extension-youtube": ["@tiptap/extension-youtube@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4" } }, "sha512-zIRbyZqIc2IUOl0aPveOxFHiKQiECRslaPtmy1tGkxQce0QbBBXutrucBgnKrkkmBHFQuwVqJ5dGpy20Z35eoA=="],
 
-    "@tiptap/extensions": ["@tiptap/extensions@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-s5eiMq0m5N6N+W7dU6rd60KgZyyCD7FvtPNNswISfPr12EQwJBfbjWwTqd0UKNzA4fNrhQEERXnzORkykttPeA=="],
+    "@tiptap/extensions": ["@tiptap/extensions@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-SlGPXauW8iKWG7wwuwC/0y/smLImp0h6GBIGgNnTBgIP/ThXQnjLMSZH0mW/REO87dQxkku01V3ARRywi+juhg=="],
 
-    "@tiptap/markdown": ["@tiptap/markdown@3.22.3", "", { "dependencies": { "marked": "^17.0.1" }, "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-Ajw8AkAae7IET1sxZqNv+dhZQSuLY0AHWocowTny1azyiBtmRRKygkGK0ysVA+k6UxmBD6K+tvnbpjQ0/ACl4A=="],
+    "@tiptap/markdown": ["@tiptap/markdown@3.23.4", "", { "dependencies": { "marked": "^17.0.1" }, "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-jRh/oa7WyhnXo+vaiaiZ42a5h/m1vvsrEWJHy12vD1qMivRKfNmRJN+lZmYpBV+6h+5vhQpg7EMMIH82xvVWRQ=="],
 
     "@tiptap/pm": ["@tiptap/pm@3.23.4", "", { "dependencies": { "prosemirror-changeset": "^2.3.0", "prosemirror-commands": "^1.6.2", "prosemirror-dropcursor": "^1.8.1", "prosemirror-gapcursor": "^1.3.2", "prosemirror-history": "^1.4.1", "prosemirror-keymap": "^1.2.2", "prosemirror-model": "^1.24.1", "prosemirror-schema-list": "^1.5.0", "prosemirror-state": "^1.4.3", "prosemirror-tables": "^1.6.4", "prosemirror-transform": "^1.10.2", "prosemirror-view": "^1.38.1" } }, "sha512-+C5ngcoza47n3MjtjVBqBEBICPC0McdbwzJ+X6SSCviCLoqnSYanv5mIX9HWG0Q4fJ4BkdNM3VibZUxQaTbKyQ=="],
 
-    "@tiptap/react": ["@tiptap/react@3.22.3", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "fast-equals": "^5.3.3", "use-sync-external-store": "^1.4.0" }, "optionalDependencies": { "@tiptap/extension-bubble-menu": "^3.22.3", "@tiptap/extension-floating-menu": "^3.22.3" }, "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3", "@types/react": "^17.0.0 || ^18.0.0 || ^19.0.0", "@types/react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-6MNr6z0PxwfJFs+BKhHcvPNvY+UV1PXgqzTiTM4Z9guml84iVZxv7ZOCSj1dFYTr3Bf1MiOs4hT1yvBFlTfIaQ=="],
+    "@tiptap/react": ["@tiptap/react@3.23.4", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "fast-equals": "^5.3.3", "use-sync-external-store": "^1.4.0" }, "optionalDependencies": { "@tiptap/extension-bubble-menu": "^3.23.4", "@tiptap/extension-floating-menu": "^3.23.4" }, "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4", "@types/react": "^17.0.0 || ^18.0.0 || ^19.0.0", "@types/react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-mb5aIY9PuLreOVLExqs+8BAI20I/8+jCUBfEIqheuFY2GRRuBiwczejSlYuADfVDBbPVN5uPw4UMADCaH5wueQ=="],
 
-    "@tiptap/starter-kit": ["@tiptap/starter-kit@3.22.3", "", { "dependencies": { "@tiptap/core": "^3.22.3", "@tiptap/extension-blockquote": "^3.22.3", "@tiptap/extension-bold": "^3.22.3", "@tiptap/extension-bullet-list": "^3.22.3", "@tiptap/extension-code": "^3.22.3", "@tiptap/extension-code-block": "^3.22.3", "@tiptap/extension-document": "^3.22.3", "@tiptap/extension-dropcursor": "^3.22.3", "@tiptap/extension-gapcursor": "^3.22.3", "@tiptap/extension-hard-break": "^3.22.3", "@tiptap/extension-heading": "^3.22.3", "@tiptap/extension-horizontal-rule": "^3.22.3", "@tiptap/extension-italic": "^3.22.3", "@tiptap/extension-link": "^3.22.3", "@tiptap/extension-list": "^3.22.3", "@tiptap/extension-list-item": "^3.22.3", "@tiptap/extension-list-keymap": "^3.22.3", "@tiptap/extension-ordered-list": "^3.22.3", "@tiptap/extension-paragraph": "^3.22.3", "@tiptap/extension-strike": "^3.22.3", "@tiptap/extension-text": "^3.22.3", "@tiptap/extension-underline": "^3.22.3", "@tiptap/extensions": "^3.22.3", "@tiptap/pm": "^3.22.3" } }, "sha512-vdW/Oo1fdwTL1VOQ5YYbTov00ANeHLquBVEZyL/EkV7Xv5io9rXQsCysJfTSHhiQlyr2MtWFB4+CPGuwXjQWOQ=="],
+    "@tiptap/starter-kit": ["@tiptap/starter-kit@3.23.4", "", { "dependencies": { "@tiptap/core": "^3.23.4", "@tiptap/extension-blockquote": "^3.23.4", "@tiptap/extension-bold": "^3.23.4", "@tiptap/extension-bullet-list": "^3.23.4", "@tiptap/extension-code": "^3.23.4", "@tiptap/extension-code-block": "^3.23.4", "@tiptap/extension-document": "^3.23.4", "@tiptap/extension-dropcursor": "^3.23.4", "@tiptap/extension-gapcursor": "^3.23.4", "@tiptap/extension-hard-break": "^3.23.4", "@tiptap/extension-heading": "^3.23.4", "@tiptap/extension-horizontal-rule": "^3.23.4", "@tiptap/extension-italic": "^3.23.4", "@tiptap/extension-link": "^3.23.4", "@tiptap/extension-list": "^3.23.4", "@tiptap/extension-list-item": "^3.23.4", "@tiptap/extension-list-keymap": "^3.23.4", "@tiptap/extension-ordered-list": "^3.23.4", "@tiptap/extension-paragraph": "^3.23.4", "@tiptap/extension-strike": "^3.23.4", "@tiptap/extension-text": "^3.23.4", "@tiptap/extension-underline": "^3.23.4", "@tiptap/extensions": "^3.23.4", "@tiptap/pm": "^3.23.4" } }, "sha512-3VhU+NO6/ec9DMj/5Ej0nzARSq42cXnqW+QHCmTL3FNXkXQz+tw1KlfruT5GGJ3M0RssjWjRC0a39N/4S3qxeA=="],
 
     "@tiptap/suggestion": ["@tiptap/suggestion@3.23.4", "", { "peerDependencies": { "@tiptap/core": "3.23.4", "@tiptap/pm": "3.23.4" } }, "sha512-KvrHKQcGpEKPPuetH2N4K21kA7hc31n5WDzw3FM+fNpMKdJOToYoNZzS9rmuBBHmNZ9wyK2sWmzi09enmv6wbg=="],
 
-    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg=="],
+    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="],
 
     "@types/aria-query": ["@types/aria-query@5.0.4", "", {}, "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw=="],
 
+    "@types/babel__code-frame": ["@types/babel__code-frame@7.27.0", "", {}, "sha512-Dwlo+LrxDx/0SpfmJ/BKveHf7QXWvLBLc+x03l5sbzykj3oB9nHygCpSECF1a+s+QIxbghe+KHqC90vGtxLRAA=="],
+
+    "@types/babel__core": ["@types/babel__core@7.20.5", "", { "dependencies": { "@babel/parser": "^7.20.7", "@babel/types": "^7.20.7", "@types/babel__generator": "*", "@types/babel__template": "*", "@types/babel__traverse": "*" } }, "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA=="],
+
+    "@types/babel__generator": ["@types/babel__generator@7.27.0", "", { "dependencies": { "@babel/types": "^7.0.0" } }, "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg=="],
+
+    "@types/babel__template": ["@types/babel__template@7.4.4", "", { "dependencies": { "@babel/parser": "^7.1.0", "@babel/types": "^7.0.0" } }, "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A=="],
+
+    "@types/babel__traverse": ["@types/babel__traverse@7.28.0", "", { "dependencies": { "@babel/types": "^7.28.2" } }, "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q=="],
+
     "@types/bcryptjs": ["@types/bcryptjs@3.0.0", "", { "dependencies": { "bcryptjs": "*" } }, "sha512-WRZOuCuaz8UcZZE4R5HXTco2goQSI2XxjGY3hbM/xDvwmqFWd4ivooImsMx65OKM6CtNKbnZ5YL+YwAwK7c1dg=="],
 
-    "@types/bun": ["@types/bun@1.3.12", "", { "dependencies": { "bun-types": "1.3.12" } }, "sha512-DBv81elK+/VSwXHDlnH3Qduw+KxkTIWi7TXkAeh24zpi5l0B2kUg9Ga3tb4nJaPcOFswflgi/yAvMVBPrxMB+A=="],
+    "@types/braces": ["@types/braces@3.0.5", "", {}, "sha512-SQFof9H+LXeWNz8wDe7oN5zu7ket0qwMu5vZubW4GCJ8Kkeh6nBWUz87+KTz/G3Kqsrp0j/W253XJb3KMEeg3w=="],
+
+    "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
 
     "@types/chai": ["@types/chai@5.2.3", "", { "dependencies": { "@types/deep-eql": "*", "assertion-error": "^2.0.1" } }, "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA=="],
 
@@ -1264,24 +1335,28 @@
 
     "@types/esrecurse": ["@types/esrecurse@4.3.1", "", {}, "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw=="],
 
-    "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
+    "@types/estree": ["@types/estree@1.0.9", "", {}, "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg=="],
 
     "@types/hast": ["@types/hast@3.0.4", "", { "dependencies": { "@types/unist": "*" } }, "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ=="],
 
     "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
 
-    "@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
+    "@types/micromatch": ["@types/micromatch@4.0.10", "", { "dependencies": { "@types/braces": "*" } }, "sha512-5jOhFDElqr4DKTrTEbnW8DZ4Hz5LRUEmyrGpCMrD/NphYv3nUnaF08xmSLx1rGGnyEs/kFnhiw6dCgcDqMr5PQ=="],
 
-    "@types/nodemailer": ["@types/nodemailer@7.0.11", "", { "dependencies": { "@types/node": "*" } }, "sha512-E+U4RzR2dKrx+u3N4DlsmLaDC6mMZOM/TPROxA0UAPiTgI0y4CEFBmZE+coGWTjakDriRsXG368lNk1u9Q0a2g=="],
+    "@types/node": ["@types/node@25.9.3", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg=="],
+
+    "@types/nodemailer": ["@types/nodemailer@7.0.12", "", { "dependencies": { "@types/node": "*" } }, "sha512-80vKwiIsVSyFA1rRovH59jNPLBOuc6dRZIHEu40gXTkBkZnQv8vog1xSGEb9j5q/tdMAs5ivvDR2pLTU0hGHXA=="],
 
     "@types/papaparse": ["@types/papaparse@5.5.2", "", { "dependencies": { "@types/node": "*" } }, "sha512-gFnFp/JMzLHCwRf7tQHrNnfhN4eYBVYYI897CGX4MY1tzY9l2aLkVyx2IlKZ/SAqDbB3I1AOZW5gTMGGsqWliA=="],
 
     "@types/qrcode": ["@types/qrcode@1.5.6", "", { "dependencies": { "@types/node": "*" } }, "sha512-te7NQcV2BOvdj2b1hCAHzAoMNuj65kNBMz0KBaxM6c3VGBOhU0dURQKOtH8CFNI/dsKkwlv32p26qYQTWoB5bw=="],
 
-    "@types/react": ["@types/react@19.2.14", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w=="],
+    "@types/react": ["@types/react@19.2.17", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw=="],
 
     "@types/react-dom": ["@types/react-dom@19.2.3", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ=="],
 
+    "@types/resolve": ["@types/resolve@1.20.2", "", {}, "sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q=="],
+
     "@types/retry": ["@types/retry@0.12.0", "", {}, "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA=="],
 
     "@types/trusted-types": ["@types/trusted-types@2.0.7", "", {}, "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw=="],
@@ -1294,68 +1369,92 @@
 
     "@types/ws": ["@types/ws@8.18.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg=="],
 
-    "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.58.2", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.58.2", "@typescript-eslint/type-utils": "8.58.2", "@typescript-eslint/utils": "8.58.2", "@typescript-eslint/visitor-keys": "8.58.2", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.58.2", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-aC2qc5thQahutKjP+cl8cgN9DWe3ZUqVko30CMSZHnFEHyhOYoZSzkGtAI2mcwZ38xeImDucI4dnqsHiOYuuCw=="],
+    "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.61.1", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.61.1", "@typescript-eslint/type-utils": "8.61.1", "@typescript-eslint/utils": "8.61.1", "@typescript-eslint/visitor-keys": "8.61.1", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.61.1", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ=="],
+
+    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.61.1", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.61.1", "@typescript-eslint/types": "8.61.1", "@typescript-eslint/typescript-estree": "8.61.1", "@typescript-eslint/visitor-keys": "8.61.1", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg=="],
+
+    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.61.1", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.61.1", "@typescript-eslint/types": "^8.61.1", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA=="],
+
+    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.61.1", "", { "dependencies": { "@typescript-eslint/types": "8.61.1", "@typescript-eslint/visitor-keys": "8.61.1" } }, "sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w=="],
+
+    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.61.1", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg=="],
 
-    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.58.2", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.58.2", "@typescript-eslint/types": "8.58.2", "@typescript-eslint/typescript-estree": "8.58.2", "@typescript-eslint/visitor-keys": "8.58.2", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-/Zb/xaIDfxeJnvishjGdcR4jmr7S+bda8PKNhRGdljDM+elXhlvN0FyPSsMnLmJUrVG9aPO6dof80wjMawsASg=="],
+    "@typescript-eslint/type-utils": ["@typescript-eslint/type-utils@8.61.1", "", { "dependencies": { "@typescript-eslint/types": "8.61.1", "@typescript-eslint/typescript-estree": "8.61.1", "@typescript-eslint/utils": "8.61.1", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw=="],
 
-    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.58.2", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.58.2", "@typescript-eslint/types": "^8.58.2", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-Cq6UfpZZk15+r87BkIh5rDpi38W4b+Sjnb8wQCPPDDweS/LRCFjCyViEbzHk5Ck3f2QDfgmlxqSa7S7clDtlfg=="],
+    "@typescript-eslint/types": ["@typescript-eslint/types@8.61.1", "", {}, "sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA=="],
 
-    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.58.2", "", { "dependencies": { "@typescript-eslint/types": "8.58.2", "@typescript-eslint/visitor-keys": "8.58.2" } }, "sha512-SgmyvDPexWETQek+qzZnrG6844IaO02UVyOLhI4wpo82dpZJY9+6YZCKAMFzXb7qhx37mFK1QcPQ18tud+vo6Q=="],
+    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.61.1", "", { "dependencies": { "@typescript-eslint/project-service": "8.61.1", "@typescript-eslint/tsconfig-utils": "8.61.1", "@typescript-eslint/types": "8.61.1", "@typescript-eslint/visitor-keys": "8.61.1", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg=="],
 
-    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.58.2", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-3SR+RukipDvkkKp/d0jP0dyzuls3DbGmwDpVEc5wqk5f38KFThakqAAO0XMirWAE+kT00oTauTbzMFGPoAzB0A=="],
+    "@typescript-eslint/utils": ["@typescript-eslint/utils@8.61.1", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.61.1", "@typescript-eslint/types": "8.61.1", "@typescript-eslint/typescript-estree": "8.61.1" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA=="],
 
-    "@typescript-eslint/type-utils": ["@typescript-eslint/type-utils@8.58.2", "", { "dependencies": { "@typescript-eslint/types": "8.58.2", "@typescript-eslint/typescript-estree": "8.58.2", "@typescript-eslint/utils": "8.58.2", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-Z7EloNR/B389FvabdGeTo2XMs4W9TjtPiO9DAsmT0yom0bwlPyRjkJ1uCdW1DvrrrYP50AJZ9Xc3sByZA9+dcg=="],
+    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.61.1", "", { "dependencies": { "@typescript-eslint/types": "8.61.1", "eslint-visitor-keys": "^5.0.0" } }, "sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w=="],
 
-    "@typescript-eslint/types": ["@typescript-eslint/types@8.58.2", "", {}, "sha512-9TukXyATBQf/Jq9AMQXfvurk+G5R2MwfqQGDR2GzGz28HvY/lXNKGhkY+6IOubwcquikWk5cjlgPvD2uAA7htQ=="],
+    "@uiw/codemirror-extensions-basic-setup": ["@uiw/codemirror-extensions-basic-setup@4.25.10", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/commands": "^6.0.0", "@codemirror/language": "^6.0.0", "@codemirror/lint": "^6.0.0", "@codemirror/search": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0" } }, "sha512-P3vytLlpE62KYSWrMUnwDCv2lvaQDuDZzyj03mHntuHo5bSl34fRZpjTY3kQTPGuXHxkGSYpoPFFj+hMTqaaMQ=="],
 
-    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.58.2", "", { "dependencies": { "@typescript-eslint/project-service": "8.58.2", "@typescript-eslint/tsconfig-utils": "8.58.2", "@typescript-eslint/types": "8.58.2", "@typescript-eslint/visitor-keys": "8.58.2", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-ELGuoofuhhoCvNbQjFFiobFcGgcDCEm0ThWdmO4Z0UzLqPXS3KFvnEZ+SHewwOYHjM09tkzOWXNTv9u6Gqtyuw=="],
+    "@uiw/codemirror-extensions-color": ["@uiw/codemirror-extensions-color@4.25.10", "", { "dependencies": { "colors-named": "^1.0.0", "colors-named-hex": "^1.0.0", "hsl-matcher": "^1.2.3" }, "peerDependencies": { "@codemirror/language": ">=6.0.0", "@codemirror/state": ">=6.0.0", "@codemirror/view": ">=6.0.0" } }, "sha512-C+a7xORBbHF2WzJASQwOmwIskGH8iCAu4E45dL88maNPDFa1JEzo6oZ64QTJtGTP9QKNEru+fjIknOIHFfow6Q=="],
 
-    "@typescript-eslint/utils": ["@typescript-eslint/utils@8.58.2", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.58.2", "@typescript-eslint/types": "8.58.2", "@typescript-eslint/typescript-estree": "8.58.2" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-QZfjHNEzPY8+l0+fIXMvuQ2sJlplB4zgDZvA+NmvZsZv3EQwOcc1DuIU1VJUTWZ/RKouBMhDyNaBMx4sWvrzRA=="],
+    "@uiw/react-codemirror": ["@uiw/react-codemirror@4.25.10", "", { "dependencies": { "@babel/runtime": "^7.18.6", "@codemirror/commands": "^6.1.0", "@codemirror/state": "^6.1.1", "@codemirror/theme-one-dark": "^6.0.0", "@uiw/codemirror-extensions-basic-setup": "4.25.10", "codemirror": "^6.0.0" }, "peerDependencies": { "@codemirror/view": ">=6.0.0", "react": ">=17.0.0", "react-dom": ">=17.0.0" } }, "sha512-DzgSMwM5qzB7v1FIb4gEeriYt67iiay756/HIOM9mAbeOVK0MO7rqefHf0O5c0269pJKMW7AH9FjclExD23V9w=="],
 
-    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.58.2", "", { "dependencies": { "@typescript-eslint/types": "8.58.2", "eslint-visitor-keys": "^5.0.0" } }, "sha512-f1WO2Lx8a9t8DARmcWAUPJbu0G20bJlj8L4z72K00TMeJAoyLr/tHhI/pzYBLrR4dXWkcxO1cWYZEOX8DKHTqA=="],
+    "@vercel/nft": ["@vercel/nft@1.10.2", "", { "dependencies": { "@mapbox/node-pre-gyp": "^2.0.0", "@rollup/pluginutils": "^5.1.3", "acorn": "^8.6.0", "acorn-import-attributes": "^1.9.5", "async-sema": "^3.1.1", "bindings": "^1.4.0", "estree-walker": "2.0.2", "glob": "^13.0.0", "graceful-fs": "^4.2.9", "node-gyp-build": "^4.2.2", "picomatch": "^4.0.2", "resolve-from": "^5.0.0" }, "bin": { "nft": "out/cli.js" } }, "sha512-w+WyX5Ulmj4dtTZrxaulqrjaLZHSbnPzx75SJsTNYmotKsqn1JlLnDJa+lz5hn90HJofhl/2MAtw0mCrgM3qYw=="],
 
-    "@uiw/codemirror-extensions-basic-setup": ["@uiw/codemirror-extensions-basic-setup@4.25.9", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/commands": "^6.0.0", "@codemirror/language": "^6.0.0", "@codemirror/lint": "^6.0.0", "@codemirror/search": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0" } }, "sha512-QFAqr+pu6lDmNpAlecODcF49TlsrZ0bj15zPzfhiqSDl+Um3EsDLFLppixC7kFLn+rdDM2LTvVjn5CPvefpRgw=="],
+    "@vinxi/listhen": ["@vinxi/listhen@1.5.6", "", { "dependencies": { "@parcel/watcher": "^2.3.0", "@parcel/watcher-wasm": "2.3.0", "citty": "^0.1.5", "clipboardy": "^4.0.0", "consola": "^3.2.3", "defu": "^6.1.4", "get-port-please": "^3.1.2", "h3": "^1.10.0", "http-shutdown": "^1.2.2", "jiti": "^1.21.0", "mlly": "^1.5.0", "node-forge": "^1.3.1", "pathe": "^1.1.2", "std-env": "^3.7.0", "ufo": "^1.3.2", "untun": "^0.1.3", "uqr": "^0.1.2" }, "bin": { "listen": "bin/listhen.mjs", "listhen": "bin/listhen.mjs" } }, "sha512-WSN1z931BtasZJlgPp704zJFnQFRg7yzSjkm3MzAWQYe4uXFXlFr1hc5Ac2zae5/HDOz5x1/zDM5Cb54vTCnWw=="],
 
-    "@uiw/codemirror-extensions-color": ["@uiw/codemirror-extensions-color@4.25.9", "", { "dependencies": { "colors-named": "^1.0.0", "colors-named-hex": "^1.0.0", "hsl-matcher": "^1.2.3" }, "peerDependencies": { "@codemirror/language": ">=6.0.0", "@codemirror/state": ">=6.0.0", "@codemirror/view": ">=6.0.0" } }, "sha512-Knwede3T6XDhb+o50EHYhqYTzgwdBQpyxPVy8VGlufS5d9qs64DlrK3BqE7nZvwwn8K3iT4K5o1EyE+Y+UxzOw=="],
+    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.2", "", { "dependencies": { "@rolldown/pluginutils": "^1.0.0" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-DlSMqo4WhThw4vB8Mpn0Woe9J+Jfq1geJ61AKW0QEgLzGMNwtIMdxbDUzLxcun8W7NbJO0e2Jg/Nxm3cCSVzzg=="],
 
-    "@uiw/react-codemirror": ["@uiw/react-codemirror@4.25.9", "", { "dependencies": { "@babel/runtime": "^7.18.6", "@codemirror/commands": "^6.1.0", "@codemirror/state": "^6.1.1", "@codemirror/theme-one-dark": "^6.0.0", "@uiw/codemirror-extensions-basic-setup": "4.25.9", "codemirror": "^6.0.0" }, "peerDependencies": { "@codemirror/view": ">=6.0.0", "react": ">=17.0.0", "react-dom": ">=17.0.0" } }, "sha512-HftqCBUYShAOH0pGi1CHP8vfm5L8fQ3+0j0VI6lQD6QpK+UBu3J7nxfEN5O/BXMilMNf9ZyFJRvRcuMMOLHMng=="],
+    "@vitest/coverage-v8": ["@vitest/coverage-v8@4.1.9", "", { "dependencies": { "@bcoe/v8-coverage": "^1.0.2", "@vitest/utils": "4.1.9", "ast-v8-to-istanbul": "^1.0.0", "istanbul-lib-coverage": "^3.2.2", "istanbul-lib-report": "^3.0.1", "istanbul-reports": "^3.2.0", "magicast": "^0.5.2", "obug": "^2.1.1", "std-env": "^4.0.0-rc.1", "tinyrainbow": "^3.1.0" }, "peerDependencies": { "@vitest/browser": "4.1.9", "vitest": "4.1.9" }, "optionalPeers": ["@vitest/browser"] }, "sha512-G9/lgqibheLVBDRuya45EbsEXTYcWoSG+TLg7i2axuzx0Eq62eXn+aWXyaVdV5vKvFSWd6ywcX8hA7la9Pvu8g=="],
 
-    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.1", "", { "dependencies": { "@rolldown/pluginutils": "1.0.0-rc.7" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-l9X/E3cDb+xY3SWzlG1MOGt2usfEHGMNIaegaUGFsLkb3RCn/k8/TOXBcab+OndDI4TBtktT8/9BwwW8Vi9KUQ=="],
+    "@vitest/expect": ["@vitest/expect@4.1.9", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.9", "@vitest/utils": "4.1.9", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA=="],
 
-    "@vitest/expect": ["@vitest/expect@4.1.4", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.4", "@vitest/utils": "4.1.4", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-iPBpra+VDuXmBFI3FMKHSFXp3Gx5HfmSCE8X67Dn+bwephCnQCaB7qWK2ldHa+8ncN8hJU8VTMcxjPpyMkUjww=="],
+    "@vitest/mocker": ["@vitest/mocker@4.1.9", "", { "dependencies": { "@vitest/spy": "4.1.9", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw=="],
 
-    "@vitest/mocker": ["@vitest/mocker@4.1.4", "", { "dependencies": { "@vitest/spy": "4.1.4", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-R9HTZBhW6yCSGbGQnDnH3QHfJxokKN4KB+Yvk9Q1le7eQNYwiCyKxmLmurSpFy6BzJanSLuEUDrD+j97Q+ZLPg=="],
+    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.9", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A=="],
 
-    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.4", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-ddmDHU0gjEUyEVLxtZa7xamrpIefdEETu3nZjWtHeZX4QxqJ7tRxSteHVXJOcr8jhiLoGAhkK4WJ3WqBpjx42A=="],
+    "@vitest/runner": ["@vitest/runner@4.1.9", "", { "dependencies": { "@vitest/utils": "4.1.9", "pathe": "^2.0.3" } }, "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg=="],
 
-    "@vitest/runner": ["@vitest/runner@4.1.4", "", { "dependencies": { "@vitest/utils": "4.1.4", "pathe": "^2.0.3" } }, "sha512-xTp7VZ5aXP5ZJrn15UtJUWlx6qXLnGtF6jNxHepdPHpMfz/aVPx+htHtgcAL2mDXJgKhpoo2e9/hVJsIeFbytQ=="],
+    "@vitest/snapshot": ["@vitest/snapshot@4.1.9", "", { "dependencies": { "@vitest/pretty-format": "4.1.9", "@vitest/utils": "4.1.9", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA=="],
 
-    "@vitest/snapshot": ["@vitest/snapshot@4.1.4", "", { "dependencies": { "@vitest/pretty-format": "4.1.4", "@vitest/utils": "4.1.4", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-MCjCFgaS8aZz+m5nTcEcgk/xhWv0rEH4Yl53PPlMXOZ1/Ka2VcZU6CJ+MgYCZbcJvzGhQRjVrGQNZqkGPttIKw=="],
+    "@vitest/spy": ["@vitest/spy@4.1.9", "", {}, "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA=="],
 
-    "@vitest/spy": ["@vitest/spy@4.1.4", "", {}, "sha512-XxNdAsKW7C+FLydqFJLb5KhJtl3PGCMmYwFRfhvIgxJvLSXhhVI1zM8f1qD3Zg7RCjTSzDVyct6sghs9UEgBEQ=="],
+    "@vitest/utils": ["@vitest/utils@4.1.9", "", { "dependencies": { "@vitest/pretty-format": "4.1.9", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA=="],
 
-    "@vitest/utils": ["@vitest/utils@4.1.4", "", { "dependencies": { "@vitest/pretty-format": "4.1.4", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-13QMT+eysM5uVGa1rG4kegGYNp6cnQcsTc67ELFbhNLQO+vgsygtYJx2khvdt4gVQqSSpC/KT5FZZxUpP3Oatw=="],
+    "abbrev": ["abbrev@3.0.1", "", {}, "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg=="],
+
+    "abort-controller": ["abort-controller@3.0.0", "", { "dependencies": { "event-target-shim": "^5.0.0" } }, "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg=="],
 
     "accepts": ["accepts@2.0.0", "", { "dependencies": { "mime-types": "^3.0.0", "negotiator": "^1.0.0" } }, "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng=="],
 
-    "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
+    "acorn": ["acorn@8.17.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg=="],
+
+    "acorn-import-attributes": ["acorn-import-attributes@1.9.5", "", { "peerDependencies": { "acorn": "^8" } }, "sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ=="],
 
     "acorn-jsx": ["acorn-jsx@5.3.2", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
 
-    "ajv": ["ajv@6.14.0", "", { "dependencies": { "fast-deep-equal": "^3.1.1", "fast-json-stable-stringify": "^2.0.0", "json-schema-traverse": "^0.4.1", "uri-js": "^4.2.2" } }, "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw=="],
+    "agent-base": ["agent-base@6.0.2", "", { "dependencies": { "debug": "4" } }, "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ=="],
+
+    "ajv": ["ajv@6.15.0", "", { "dependencies": { "fast-deep-equal": "^3.1.1", "fast-json-stable-stringify": "^2.0.0", "json-schema-traverse": "^0.4.1", "uri-js": "^4.2.2" } }, "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw=="],
 
     "ajv-formats": ["ajv-formats@3.0.1", "", { "dependencies": { "ajv": "^8.0.0" } }, "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ=="],
 
+    "ansi-align": ["ansi-align@3.0.1", "", { "dependencies": { "string-width": "^4.1.0" } }, "sha512-IOfwwBF5iczOjp/WeY4YxyjqAFMQoZufdQWDd19SEExbVLNXqvpzSJ/M7Za4/sCPmQ0+GRquoA7bGcINcxew6w=="],
+
     "ansi-escapes": ["ansi-escapes@7.3.0", "", { "dependencies": { "environment": "^1.0.0" } }, "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg=="],
 
     "ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
 
     "ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
 
-    "ansis": ["ansis@4.2.0", "", {}, "sha512-HqZ5rWlFjGiV0tDm3UxxgNRqsOTniqoKZu0pIAfh7TZQMGuZK+hH0drySty0si0QXj1ieop4+SkSfPZBPPkHig=="],
+    "ansis": ["ansis@4.3.1", "", {}, "sha512-BJ8/l4R5LRE7hW9WdSuGYrLSHi2ynxeFpDFbH0K/CgNeY/tyhk+vO6TYxXC5r5CpUhNVX310xzPsN/H9lCdfOA=="],
 
     "any-promise": ["any-promise@1.3.0", "", {}, "sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A=="],
 
+    "anymatch": ["anymatch@3.1.3", "", { "dependencies": { "normalize-path": "^3.0.0", "picomatch": "^2.0.4" } }, "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw=="],
+
+    "anynum": ["anynum@1.0.0", "", {}, "sha512-xjR9/zBVnUOP6ztMIIgShjsxui80nQUQH+5xJnvrYLs+90bF25/KJqaAi8mk+B4RDtX1Nspi6fmp4YTEts8SfA=="],
+
+    "archiver": ["archiver@7.0.1", "", { "dependencies": { "archiver-utils": "^5.0.2", "async": "^3.2.4", "buffer-crc32": "^1.0.0", "readable-stream": "^4.0.0", "readdir-glob": "^1.1.2", "tar-stream": "^3.0.0", "zip-stream": "^6.0.1" } }, "sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ=="],
+
+    "archiver-utils": ["archiver-utils@5.0.2", "", { "dependencies": { "glob": "^10.0.0", "graceful-fs": "^4.2.0", "is-stream": "^2.0.1", "lazystream": "^1.0.0", "lodash": "^4.17.15", "normalize-path": "^3.0.0", "readable-stream": "^4.0.0" } }, "sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA=="],
+
     "argparse": ["argparse@2.0.1", "", {}, "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="],
 
     "aria-hidden": ["aria-hidden@1.2.6", "", { "dependencies": { "tslib": "^2.0.0" } }, "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA=="],
@@ -1378,46 +1477,90 @@
 
     "assertion-error": ["assertion-error@2.0.1", "", {}, "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA=="],
 
+    "ast-types": ["ast-types@0.16.1", "", { "dependencies": { "tslib": "^2.0.1" } }, "sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg=="],
+
+    "ast-v8-to-istanbul": ["ast-v8-to-istanbul@1.0.4", "", { "dependencies": { "@jridgewell/trace-mapping": "^0.3.31", "estree-walker": "^3.0.3", "js-tokens": "^10.0.0" } }, "sha512-0bC0/4bTSrnwdhU3IsZDwEdojvuPrSg59OYZfKsLRtJZ0u8VBx9DebfqqG8bRdCC0I7vjgxmPi41P0lpkhJHtA=="],
+
+    "async": ["async@3.2.6", "", {}, "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA=="],
+
     "async-function": ["async-function@1.0.0", "", {}, "sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA=="],
 
+    "async-sema": ["async-sema@3.1.1", "", {}, "sha512-tLRNUXati5MFePdAk8dw7Qt7DpxPB60ofAgn8WRhW6a2rcimZnYBP9oxHiv0OHy+Wz7kPMG+t4LGdt31+4EmGg=="],
+
     "asynckit": ["asynckit@0.4.0", "", {}, "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="],
 
     "atomic-sleep": ["atomic-sleep@1.0.0", "", {}, "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ=="],
 
     "available-typed-arrays": ["available-typed-arrays@1.0.7", "", { "dependencies": { "possible-typed-array-names": "^1.0.0" } }, "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ=="],
 
-    "axios": ["axios@1.15.0", "", { "dependencies": { "follow-redirects": "^1.15.11", "form-data": "^4.0.5", "proxy-from-env": "^2.1.0" } }, "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q=="],
+    "axios": ["axios@1.18.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw=="],
+
+    "b4a": ["b4a@1.8.1", "", { "peerDependencies": { "react-native-b4a": "*" }, "optionalPeers": ["react-native-b4a"] }, "sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw=="],
 
     "babel-dead-code-elimination": ["babel-dead-code-elimination@1.0.12", "", { "dependencies": { "@babel/core": "^7.23.7", "@babel/parser": "^7.23.6", "@babel/traverse": "^7.23.7", "@babel/types": "^7.23.6" } }, "sha512-GERT7L2TiYcYDtYk1IpD+ASAYXjKbLTDPhBtYj7X1NuRMDTMtAx9kyBenub1Ev41lo91OHCKdmP+egTDmfQ7Ig=="],
 
     "balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
-    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.19", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-qCkNLi2sfBOn8XhZQ0FXsT1Ki/Yo5P90hrkRamVFRS7/KV9hpfA4HkoWNU152+8w0zPjnxo5psx5NL3PSGgv5g=="],
+    "bare-events": ["bare-events@2.9.1", "", { "peerDependencies": { "bare-abort-controller": "*" }, "optionalPeers": ["bare-abort-controller"] }, "sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg=="],
+
+    "bare-fs": ["bare-fs@4.7.2", "", { "dependencies": { "bare-events": "^2.5.4", "bare-path": "^3.0.0", "bare-stream": "^2.6.4", "bare-url": "^2.2.2", "fast-fifo": "^1.3.2" }, "peerDependencies": { "bare-buffer": "*" }, "optionalPeers": ["bare-buffer"] }, "sha512-aTvMFUWkBmjzKtEQMDGGDNF8bkfpD5N1b/FCwt7A3wrU4t1o/e/85Wzkluh6JlODCjqVESYCkQCdTXqZ9G7VFg=="],
+
+    "bare-os": ["bare-os@3.9.1", "", {}, "sha512-6M5XjcnsygQNPMCMPXSK379xrJFiZ/AEMNBmFEmQW8d/789VQATvriyi5r0HYTL9TkQ26rn3kgdTG3aisbrXkQ=="],
+
+    "bare-path": ["bare-path@3.0.1", "", { "dependencies": { "bare-os": "^3.0.1" } }, "sha512-ghj2DSK/2e99a1anTVPCV4m4YIYtrbXhfM7V3D7XZLOTsybnYyaJloymGqssQc8l/or0UoDyRtNQkmkEF/ysgQ=="],
+
+    "bare-stream": ["bare-stream@2.13.3", "", { "dependencies": { "b4a": "^1.8.1", "streamx": "^2.25.0", "teex": "^1.0.1" }, "peerDependencies": { "bare-abort-controller": "*", "bare-buffer": "*", "bare-events": "*" }, "optionalPeers": ["bare-abort-controller", "bare-buffer", "bare-events"] }, "sha512-Kc+brLqvEqGkjyfiwJmImAOqLZL7OsoLKuavx+hJjgVV3nLTOjloJyPMFxjUPerGGHrNH0fLU06jjykMLWrERQ=="],
+
+    "bare-url": ["bare-url@2.4.5", "", { "dependencies": { "bare-path": "^3.0.0" } }, "sha512-K+y9xF1tN+CdPu4qWwr0QiK1Al07eFPGYK5M2pDXcmHdMdgC/tT/bpmMe1hrmRHaidKLkXrC+cRNYf3XVDUhSQ=="],
+
+    "base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
+
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.37", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-girxaJ7WZssDOFhzCGZTDKoTa1gk6A1TbflaYTpykLJ4UU9Fz9kx1aREM8JCuoVHbL8X8T/mJg7w2oYSq72Oig=="],
 
     "bcryptjs": ["bcryptjs@3.0.3", "", { "bin": { "bcrypt": "bin/bcrypt" } }, "sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g=="],
 
-    "better-auth": ["better-auth@1.6.16", "", { "dependencies": { "@better-auth/core": "1.6.16", "@better-auth/drizzle-adapter": "1.6.16", "@better-auth/kysely-adapter": "1.6.16", "@better-auth/memory-adapter": "1.6.16", "@better-auth/mongo-adapter": "1.6.16", "@better-auth/prisma-adapter": "1.6.16", "@better-auth/telemetry": "1.6.16", "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.2.2", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.6", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.17 || ^0.29.0", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": "^0.45.2", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-YlBITnH3LIBRD+JpR1XRIToJAVVpoQvZzRc4sm5W0/bnPZKLbsmtXbVWJF3ypo9TVnF6geczJKprG/CsWT07Wg=="],
+    "better-auth": ["better-auth@1.6.19", "", { "dependencies": { "@better-auth/core": "1.6.19", "@better-auth/drizzle-adapter": "1.6.19", "@better-auth/kysely-adapter": "1.6.19", "@better-auth/memory-adapter": "1.6.19", "@better-auth/mongo-adapter": "1.6.19", "@better-auth/prisma-adapter": "1.6.19", "@better-auth/telemetry": "1.6.19", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.6", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.17 || ^0.29.0", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": "^0.45.2", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-68eXWKj0sxa0xW4+n4tENd6Co94UCynPKe1fncmO6kIB3XhSXWgwDEpiUouJV2dmLBrHM1FPkoI6Q5597zCGpQ=="],
 
     "better-call": ["better-call@1.3.6", "", { "dependencies": { "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-no1jI+h6Bkxs1NVBo4rONbVIzsPjZ8IUu7IHaJBiFwVX1XEQGN8KpHots5fSWmXe9nNyLuLIcgx6WEUcE6EDaA=="],
 
-    "body-parser": ["body-parser@2.2.2", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^1.0.5", "debug": "^4.4.3", "http-errors": "^2.0.0", "iconv-lite": "^0.7.0", "on-finished": "^2.4.1", "qs": "^6.14.1", "raw-body": "^3.0.1", "type-is": "^2.0.1" } }, "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA=="],
+    "binary-extensions": ["binary-extensions@2.3.0", "", {}, "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw=="],
+
+    "bindings": ["bindings@1.5.0", "", { "dependencies": { "file-uri-to-path": "1.0.0" } }, "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ=="],
+
+    "body-parser": ["body-parser@2.3.0", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^2.0.0", "debug": "^4.4.3", "http-errors": "^2.0.1", "iconv-lite": "^0.7.2", "on-finished": "^2.4.1", "qs": "^6.15.2", "raw-body": "^3.0.2", "type-is": "^2.1.0" } }, "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw=="],
+
+    "boolbase": ["boolbase@1.0.0", "", {}, "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="],
 
     "bowser": ["bowser@2.14.1", "", {}, "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg=="],
 
-    "brace-expansion": ["brace-expansion@5.0.5", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ=="],
+    "boxen": ["boxen@7.1.1", "", { "dependencies": { "ansi-align": "^3.0.1", "camelcase": "^7.0.1", "chalk": "^5.2.0", "cli-boxes": "^3.0.0", "string-width": "^5.1.2", "type-fest": "^2.13.0", "widest-line": "^4.0.1", "wrap-ansi": "^8.1.0" } }, "sha512-2hCgjEmP8YLWQ130n2FerGv7rYpfBmnmp9Uy2Le1vge6X3gZIfSmEzP5QTDElFxcvVcXlEn8Aq6MU/PZygIOog=="],
+
+    "brace-expansion": ["brace-expansion@5.0.6", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g=="],
+
+    "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
     "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
 
+    "buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],
+
+    "buffer-crc32": ["buffer-crc32@1.0.0", "", {}, "sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w=="],
+
     "buffer-from": ["buffer-from@1.1.2", "", {}, "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="],
 
-    "bullmq": ["bullmq@5.74.1", "", { "dependencies": { "cron-parser": "4.9.0", "ioredis": "5.10.1", "msgpackr": "1.11.5", "node-abort-controller": "3.1.1", "semver": "7.7.4", "tslib": "2.8.1", "uuid": "11.1.0" } }, "sha512-GfJEos2zoOGM9xqkB7VZouwwFuejKFqm667cBcmbBekJXKqqXWk4QYP3Uy2pzgUwCbg1cR7GgGmGczM7fnhWSA=="],
+    "buffer-image-size": ["buffer-image-size@0.6.4", "", { "dependencies": { "@types/node": "*" } }, "sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ=="],
+
+    "bullmq": ["bullmq@5.78.1", "", { "dependencies": { "cron-parser": "4.9.0", "ioredis": "5.10.1", "msgpackr": "2.0.2", "node-abort-controller": "3.1.1", "semver": "7.8.1", "tslib": "2.8.1" }, "peerDependencies": { "redis": ">=5.0.0" }, "optionalPeers": ["redis"] }, "sha512-zD5IT+qMqbMgPFPdL9FwnZka1bz6nckM+5lXj4N0vsXqdzoVO6wizmXpwsg/4GnHmXJsL7XOKeWA64tYUdPrOA=="],
 
-    "bun-types": ["bun-types@1.3.12", "", { "dependencies": { "@types/node": "*" } }, "sha512-HqOLj5PoFajAQciOMRiIZGNoKxDJSr6qigAttOX40vJuSp6DN/CxWp9s3C1Xwm4oH7ybueITwiaOcWXoYVoRkA=="],
+    "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
+
+    "bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
 
     "bundle-require": ["bundle-require@5.1.0", "", { "dependencies": { "load-tsconfig": "^0.2.3" }, "peerDependencies": { "esbuild": ">=0.18" } }, "sha512-3WrrOuZiyaaZPWiEt4G3+IffISVC9HYlWueJEBWED4ZH4aIAC2PnkdnuRrR94M+w6yGWn4AglWtJtBI8YqvgoA=="],
 
     "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
 
+    "c12": ["c12@3.3.4", "", { "dependencies": { "chokidar": "^5.0.0", "confbox": "^0.2.4", "defu": "^6.1.6", "dotenv": "^17.3.1", "exsolve": "^1.0.8", "giget": "^3.2.0", "jiti": "^2.6.1", "ohash": "^2.0.11", "pathe": "^2.0.3", "perfect-debounce": "^2.1.0", "pkg-types": "^2.3.0", "rc9": "^3.0.1" }, "peerDependencies": { "magicast": "*" }, "optionalPeers": ["magicast"] }, "sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA=="],
+
     "cac": ["cac@6.7.14", "", {}, "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ=="],
 
     "call-bind": ["call-bind@1.0.9", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "get-intrinsic": "^1.3.0", "set-function-length": "^1.2.2" } }, "sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ=="],
@@ -1428,23 +1571,37 @@
 
     "camelcase": ["camelcase@5.3.1", "", {}, "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg=="],
 
-    "caniuse-lite": ["caniuse-lite@1.0.30001788", "", {}, "sha512-6q8HFp+lOQtcf7wBK+uEenxymVWkGKkjFpCvw5W25cmMwEDU45p1xQFBQv8JDlMMry7eNxyBaR+qxgmTUZkIRQ=="],
+    "caniuse-lite": ["caniuse-lite@1.0.30001799", "", {}, "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw=="],
 
     "chai": ["chai@6.2.2", "", {}, "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg=="],
 
+    "chalk": ["chalk@5.6.2", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="],
+
+    "cheerio": ["cheerio@1.2.0", "", { "dependencies": { "cheerio-select": "^2.1.0", "dom-serializer": "^2.0.0", "domhandler": "^5.0.3", "domutils": "^3.2.2", "encoding-sniffer": "^0.2.1", "htmlparser2": "^10.1.0", "parse5": "^7.3.0", "parse5-htmlparser2-tree-adapter": "^7.1.0", "parse5-parser-stream": "^7.1.2", "undici": "^7.19.0", "whatwg-mimetype": "^4.0.0" } }, "sha512-WDrybc/gKFpTYQutKIK6UvfcuxijIZfMfXaYm8NMsPQxSYvf+13fXUJ4rztGGbJcBQ/GF55gvrZ0Bc0bj/mqvg=="],
+
+    "cheerio-select": ["cheerio-select@2.1.0", "", { "dependencies": { "boolbase": "^1.0.0", "css-select": "^5.1.0", "css-what": "^6.1.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3", "domutils": "^3.0.1" } }, "sha512-9v9kG0LvzrlcungtnJtpGNxY+fzECQKhK4EGJX2vByejiMX84MFNQw4UxPJl3bFbTMw+Dfs37XaIkCwTZfLh4g=="],
+
     "chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="],
 
+    "chownr": ["chownr@3.0.0", "", {}, "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g=="],
+
+    "citty": ["citty@0.1.6", "", { "dependencies": { "consola": "^3.2.3" } }, "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ=="],
+
     "class-variance-authority": ["class-variance-authority@0.7.1", "", { "dependencies": { "clsx": "^2.1.1" } }, "sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg=="],
 
+    "cli-boxes": ["cli-boxes@3.0.0", "", {}, "sha512-/lzGpEWL/8PfI0BmBOPRwp0c/wFNX1RdUML3jK/RcSBA9T8mZDdQpqYBKtCFTOfQbwPqWEOpjqW+Fnayc0969g=="],
+
     "cli-cursor": ["cli-cursor@5.0.0", "", { "dependencies": { "restore-cursor": "^5.0.0" } }, "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw=="],
 
     "cli-truncate": ["cli-truncate@5.2.0", "", { "dependencies": { "slice-ansi": "^8.0.0", "string-width": "^8.2.0" } }, "sha512-xRwvIOMGrfOAnM1JYtqQImuaNtDEv9v6oIYAs4LIHwTiKee8uwvIi363igssOC0O5U04i4AlENs79LQLu9tEMw=="],
 
+    "clipboardy": ["clipboardy@4.0.0", "", { "dependencies": { "execa": "^8.0.1", "is-wsl": "^3.1.0", "is64bit": "^2.0.0" } }, "sha512-5mOlNS0mhX0707P2I0aZ2V/cmHUEO/fL7VFLqszkhUsxt7RwnmrInf/eEQKlf5GzvYeHIjT+Ov1HRfNmymlG0w=="],
+
     "cliui": ["cliui@6.0.0", "", { "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.0", "wrap-ansi": "^6.2.0" } }, "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ=="],
 
     "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
 
-    "cluster-key-slot": ["cluster-key-slot@1.1.2", "", {}, "sha512-RMr0FhtfXemyinomL4hrWcYJxmX6deFdCxpJzhDttxgO1+bcCnkk+9drydLVDmAMG7NE6aN/fl4F7ucU/90gAA=="],
+    "cluster-key-slot": ["cluster-key-slot@1.1.1", "", {}, "sha512-rwHwUfXL40Chm1r08yrhU3qpUvdVlgkKNeyeGPOxnW8/SyVDvgRaed/Uz54AqWNaTCAThlj6QAs3TZcKI0xDEw=="],
 
     "cmdk": ["cmdk@1.1.1", "", { "dependencies": { "@radix-ui/react-compose-refs": "^1.1.1", "@radix-ui/react-dialog": "^1.1.6", "@radix-ui/react-id": "^1.1.0", "@radix-ui/react-primitive": "^2.0.2" }, "peerDependencies": { "react": "^18 || ^19 || ^19.0.0-rc", "react-dom": "^18 || ^19 || ^19.0.0-rc" } }, "sha512-Vsv7kFaXm+ptHDMZ7izaRsP70GgrW9NBNGswt9OZaVBLlE0SNpDq8eu/VGXyF9r7M0azK3Wy7OlYXsuyYLFzHg=="],
 
@@ -1464,9 +1621,15 @@
 
     "commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
 
+    "commondir": ["commondir@1.0.1", "", {}, "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg=="],
+
+    "compatx": ["compatx@0.2.0", "", {}, "sha512-6gLRNt4ygsi5NyMVhceOCFv14CIdDFN7fQjX1U4+47qVE/+kjPoXMK65KWK+dWxmFzMTuKazoQ9sch6pM0p5oA=="],
+
+    "compress-commons": ["compress-commons@6.0.2", "", { "dependencies": { "crc-32": "^1.2.0", "crc32-stream": "^6.0.0", "is-stream": "^2.0.1", "normalize-path": "^3.0.0", "readable-stream": "^4.0.0" } }, "sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg=="],
+
     "concat-map": ["concat-map@0.0.1", "", {}, "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="],
 
-    "confbox": ["confbox@0.1.8", "", {}, "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w=="],
+    "confbox": ["confbox@0.2.4", "", {}, "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ=="],
 
     "consola": ["consola@3.4.2", "", {}, "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA=="],
 
@@ -1482,15 +1645,27 @@
 
     "cookie-signature": ["cookie-signature@1.2.2", "", {}, "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg=="],
 
+    "core-util-is": ["core-util-is@1.0.3", "", {}, "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ=="],
+
     "cors": ["cors@2.8.6", "", { "dependencies": { "object-assign": "^4", "vary": "^1" } }, "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw=="],
 
+    "crc-32": ["crc-32@1.2.2", "", { "bin": { "crc32": "bin/crc32.njs" } }, "sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ=="],
+
+    "crc32-stream": ["crc32-stream@6.0.0", "", { "dependencies": { "crc-32": "^1.2.0", "readable-stream": "^4.0.0" } }, "sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g=="],
+
     "crelt": ["crelt@1.0.6", "", {}, "sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g=="],
 
     "cron-parser": ["cron-parser@4.9.0", "", { "dependencies": { "luxon": "^3.2.1" } }, "sha512-p0SaNjrHOnQeR8/VnfGbmg9te2kfyYSQ7Sc/j/6DtPL3JQvKxmjO9TSjNFpujqV3vEYYBvNNvXSxzyksBWAx1Q=="],
 
+    "croner": ["croner@10.0.1", "", {}, "sha512-ixNtAJndqh173VQ4KodSdJEI6nuioBWI0V1ITNKhZZsO0pEMoDxz539T4FTTbSZ/xIOSuDnzxLVRqBVSvPNE2g=="],
+
     "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
 
-    "crossws": ["crossws@0.4.5", "", { "peerDependencies": { "srvx": ">=0.11.5" }, "optionalPeers": ["srvx"] }, "sha512-wUR89x/Rw7/8t+vn0CmGDYM9TD6VtARGb0LD5jq2wjtMy1vCP4M+sm6N6TigWeTYvnA8MoW29NqqXD0ep0rfBA=="],
+    "crossws": ["crossws@0.4.6", "", { "peerDependencies": { "srvx": ">=0.11.5" }, "optionalPeers": ["srvx"] }, "sha512-/Wxe9Z007EbJ496j88nToZEvyPZ8PY/wjZJ18Agh/GCA9cYHyLbxtrpdFlFzAw3TV20F0SUYGl0g6PzChbwUrg=="],
+
+    "css-select": ["css-select@5.2.2", "", { "dependencies": { "boolbase": "^1.0.0", "css-what": "^6.1.0", "domhandler": "^5.0.2", "domutils": "^3.0.1", "nth-check": "^2.0.1" } }, "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw=="],
+
+    "css-what": ["css-what@6.2.2", "", {}, "sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA=="],
 
     "css.escape": ["css.escape@1.5.1", "", {}, "sha512-YUifsXXuknHlUsmlgyY0PKzgPOr7/FjCePfHNt0jxm83wHZi44VDMQ7/fGNkjY3/jV1MC+1CmZbaHzugyeRtpg=="],
 
@@ -1526,10 +1701,12 @@
 
     "data-view-byte-offset": ["data-view-byte-offset@1.0.1", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "is-data-view": "^1.0.1" } }, "sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ=="],
 
-    "date-fns": ["date-fns@4.1.0", "", {}, "sha512-Ukq0owbQXxa/U3EGtsdVBkR1w7KOQ5gIBqdH2hkvknzZPYvBxb/aa6E8L7tmjFtkwZBu3UXBbjIgPo/Ez4xaNg=="],
+    "date-fns": ["date-fns@4.4.0", "", {}, "sha512-+1UMbeh68lH1SegH83CGWwpb6OHHbpSgr3+s5Eww5M4CAgswBpoWS0AjTOfEJ33HiYKz1hdj/KTFprzXHmq/6w=="],
 
     "date-fns-jalali": ["date-fns-jalali@4.1.0-0", "", {}, "sha512-hTIP/z+t+qKwBDcmmsnmjWTduxCg+5KfdqWQvb2X/8C9+knYY6epN/pfxdDuyVlSVeFz0sM5eEfwIUQ70U4ckg=="],
 
+    "dax-sh": ["dax-sh@0.39.2", "", { "dependencies": { "@deno/shim-deno": "~0.19.0", "undici-types": "^5.26" } }, "sha512-gpuGEkBQM+5y6p4cWaw9+ePy5TNon+fdwFVtTI8leU3UhwhsBfPewRxMXGuQNC+M2b/MDGMlfgpqynkcd0C3FQ=="],
+
     "db0": ["db0@0.3.4", "", { "peerDependencies": { "@electric-sql/pglite": "*", "@libsql/client": "*", "better-sqlite3": "*", "drizzle-orm": "*", "mysql2": "*", "sqlite3": "*" }, "optionalPeers": ["@electric-sql/pglite", "@libsql/client", "better-sqlite3", "drizzle-orm", "mysql2", "sqlite3"] }, "sha512-RiXXi4WaNzPTHEOu8UPQKMooIbqOEyqA1t7Z6MsdxSCeb8iUC9ko3LcmsLmeUt2SM5bctfArZKkRQggKZz7JNw=="],
 
     "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
@@ -1542,8 +1719,14 @@
 
     "deepmerge": ["deepmerge@4.3.1", "", {}, "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A=="],
 
+    "default-browser": ["default-browser@5.5.0", "", { "dependencies": { "bundle-name": "^4.1.0", "default-browser-id": "^5.0.0" } }, "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw=="],
+
+    "default-browser-id": ["default-browser-id@5.0.1", "", {}, "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q=="],
+
     "define-data-property": ["define-data-property@1.1.4", "", { "dependencies": { "es-define-property": "^1.0.0", "es-errors": "^1.3.0", "gopd": "^1.0.1" } }, "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A=="],
 
+    "define-lazy-prop": ["define-lazy-prop@3.0.0", "", {}, "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg=="],
+
     "define-properties": ["define-properties@1.2.1", "", { "dependencies": { "define-data-property": "^1.0.1", "has-property-descriptors": "^1.0.0", "object-keys": "^1.1.1" } }, "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg=="],
 
     "defu": ["defu@6.1.7", "", {}, "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ=="],
@@ -1556,6 +1739,10 @@
 
     "dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="],
 
+    "destr": ["destr@2.0.5", "", {}, "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA=="],
+
+    "destroy": ["destroy@1.2.0", "", {}, "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg=="],
+
     "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
 
     "detect-node-es": ["detect-node-es@1.1.0", "", {}, "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ=="],
@@ -1576,10 +1763,12 @@
 
     "domhandler": ["domhandler@5.0.3", "", { "dependencies": { "domelementtype": "^2.3.0" } }, "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w=="],
 
-    "dompurify": ["dompurify@3.4.0", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-nolgK9JcaUXMSmW+j1yaSvaEaoXYHwWyGJlkoCTghc97KgGDDSnpoU/PlEnw63Ah+TGKFOyY+X5LnxaWbCSfXg=="],
+    "dompurify": ["dompurify@3.4.10", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-0xzNv0e7oYC6yyuOGZIABPM4qtg3QxLFniDNPP4ZP90wR8Yq3zgwpRbrNiT4N3IKqDbbYFEJLV+JWEs19aZ//w=="],
 
     "domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="],
 
+    "dot-prop": ["dot-prop@10.1.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-MVUtAugQMOff5RnBy2d9N31iG0lNwg1qAoAOn7pOK5wf94WIaE3My2p3uwTQuvS2AcqchkcR3bHByjaM0mmi7Q=="],
+
     "dotenv": ["dotenv@17.4.2", "", {}, "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw=="],
 
     "dotenv-cli": ["dotenv-cli@11.0.0", "", { "dependencies": { "cross-spawn": "^7.0.6", "dotenv": "^17.1.0", "dotenv-expand": "^12.0.0", "minimist": "^1.2.6" }, "bin": { "dotenv": "cli.js" } }, "sha512-r5pA8idbk7GFWuHEU7trSTflWcdBpQEK+Aw17UrSHjS6CReuhrrPcyC3zcQBPQvhArRHnBo/h6eLH1fkCvNlww=="],
@@ -1592,9 +1781,13 @@
 
     "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
 
+    "duplexer": ["duplexer@0.1.2", "", {}, "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg=="],
+
+    "eastasianwidth": ["eastasianwidth@0.2.0", "", {}, "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA=="],
+
     "ee-first": ["ee-first@1.1.1", "", {}, "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="],
 
-    "electron-to-chromium": ["electron-to-chromium@1.5.340", "", {}, "sha512-908qahOGocRMinT2nM3ajCEM99H4iPdv84eagPP3FfZy/1ZGeOy2CZYzjhms81ckOPCXPlW7LkY4XpxD8r1DrA=="],
+    "electron-to-chromium": ["electron-to-chromium@1.5.372", "", {}, "sha512-M3yhbAlilnwqC8D21t28UCDGHyitShTmmLRU/H+b74P6Ski16Nb9HONYEaVpMj/pwC7BEo5B95FpjODLCWbtfA=="],
 
     "emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
 
@@ -1604,25 +1797,29 @@
 
     "encodeurl": ["encodeurl@2.0.0", "", {}, "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg=="],
 
-    "enhanced-resolve": ["enhanced-resolve@5.20.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA=="],
+    "encoding-sniffer": ["encoding-sniffer@0.2.1", "", { "dependencies": { "iconv-lite": "^0.6.3", "whatwg-encoding": "^3.1.1" } }, "sha512-5gvq20T6vfpekVtqrYQsSCFZ1wEg5+wW0/QaZMWkFr6BqD3NfKs0rLCx4rrVlSWJeZb5NBJgVLswK/w2MWU+Gw=="],
+
+    "enhanced-resolve": ["enhanced-resolve@5.21.6", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-aNnGCvbJ/RIyWo1IuhNdVjnNF+EjH9wpzpNHt+ci/m9He9LJvUN8wrCcXjp9cWsGNAuvSpVFTx/vraAFQ8qGjQ=="],
 
     "entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
 
-    "env-runner": ["env-runner@0.1.7", "", { "dependencies": { "crossws": "^0.4.4", "exsolve": "^1.0.8", "httpxy": "^0.5.0", "srvx": "^0.11.13" }, "peerDependencies": { "@netlify/runtime": "^4", "miniflare": "^4.20260317.3" }, "optionalPeers": ["@netlify/runtime", "miniflare"], "bin": { "env-runner": "dist/cli.mjs" } }, "sha512-i7h96jxETJYhXy5grgHNJ9xNzCzWIn9Ck/VkkYgOlE4gOqknsLX3CmlVb5LmwNex8sOoLFVZLz+TIw/+b5rktA=="],
+    "env-runner": ["env-runner@0.1.14", "", { "dependencies": { "crossws": "^0.4.5", "exsolve": "^1.0.8", "httpxy": "^0.5.3", "srvx": "^0.11.16" }, "peerDependencies": { "@netlify/runtime": "^4.1.23", "@vercel/queue": "^0.2.0", "miniflare": "^4.20260515.0", "wrangler": "^4.0.0" }, "optionalPeers": ["@netlify/runtime", "@vercel/queue", "miniflare", "wrangler"], "bin": { "env-runner": "dist/cli.mjs" } }, "sha512-qdk5mmgFsd+zPg3r1bkZ+IbvpfUfypyDvNhMGypSMRpz7kOa/kI6SpW8fgyukuEM4Lo24M65r+1Ne0DtT7vFBA=="],
 
     "environment": ["environment@1.1.0", "", {}, "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q=="],
 
+    "error-stack-parser-es": ["error-stack-parser-es@1.0.5", "", {}, "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA=="],
+
     "es-abstract": ["es-abstract@1.24.2", "", { "dependencies": { "array-buffer-byte-length": "^1.0.2", "arraybuffer.prototype.slice": "^1.0.4", "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.8", "call-bound": "^1.0.4", "data-view-buffer": "^1.0.2", "data-view-byte-length": "^1.0.2", "data-view-byte-offset": "^1.0.1", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "es-set-tostringtag": "^2.1.0", "es-to-primitive": "^1.3.0", "function.prototype.name": "^1.1.8", "get-intrinsic": "^1.3.0", "get-proto": "^1.0.1", "get-symbol-description": "^1.1.0", "globalthis": "^1.0.4", "gopd": "^1.2.0", "has-property-descriptors": "^1.0.2", "has-proto": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "internal-slot": "^1.1.0", "is-array-buffer": "^3.0.5", "is-callable": "^1.2.7", "is-data-view": "^1.0.2", "is-negative-zero": "^2.0.3", "is-regex": "^1.2.1", "is-set": "^2.0.3", "is-shared-array-buffer": "^1.0.4", "is-string": "^1.1.1", "is-typed-array": "^1.1.15", "is-weakref": "^1.1.1", "math-intrinsics": "^1.1.0", "object-inspect": "^1.13.4", "object-keys": "^1.1.1", "object.assign": "^4.1.7", "own-keys": "^1.0.1", "regexp.prototype.flags": "^1.5.4", "safe-array-concat": "^1.1.3", "safe-push-apply": "^1.0.0", "safe-regex-test": "^1.1.0", "set-proto": "^1.0.0", "stop-iteration-iterator": "^1.1.0", "string.prototype.trim": "^1.2.10", "string.prototype.trimend": "^1.0.9", "string.prototype.trimstart": "^1.0.8", "typed-array-buffer": "^1.0.3", "typed-array-byte-length": "^1.0.3", "typed-array-byte-offset": "^1.0.4", "typed-array-length": "^1.0.7", "unbox-primitive": "^1.1.0", "which-typed-array": "^1.1.19" } }, "sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg=="],
 
     "es-define-property": ["es-define-property@1.0.1", "", {}, "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g=="],
 
     "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
 
-    "es-iterator-helpers": ["es-iterator-helpers@1.3.2", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "define-properties": "^1.2.1", "es-abstract": "^1.24.2", "es-errors": "^1.3.0", "es-set-tostringtag": "^2.1.0", "function-bind": "^1.1.2", "get-intrinsic": "^1.3.0", "globalthis": "^1.0.4", "gopd": "^1.2.0", "has-property-descriptors": "^1.0.2", "has-proto": "^1.2.0", "has-symbols": "^1.1.0", "internal-slot": "^1.1.0", "iterator.prototype": "^1.1.5", "math-intrinsics": "^1.1.0" } }, "sha512-HVLACW1TppGYjJ8H6/jqH/pqOtKRw6wMlrB23xfExmFWxFquAIWCmwoLsOyN96K4a5KbmOf5At9ZUO3GZbetAw=="],
+    "es-iterator-helpers": ["es-iterator-helpers@1.3.3", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "define-properties": "^1.2.1", "es-abstract": "^1.24.2", "es-errors": "^1.3.0", "es-set-tostringtag": "^2.1.0", "function-bind": "^1.1.2", "get-intrinsic": "^1.3.0", "globalthis": "^1.0.4", "gopd": "^1.2.0", "has-property-descriptors": "^1.0.2", "has-proto": "^1.2.0", "has-symbols": "^1.1.0", "internal-slot": "^1.1.0", "iterator.prototype": "^1.1.5", "math-intrinsics": "^1.1.0" } }, "sha512-0PuBxFi+4uPanB97iDxCLWuHeYud2FALrw5HFZGtAF38UpJDbDC8frwp2cnDyae692CQ0dou60UwWfhgsa4U/g=="],
 
-    "es-module-lexer": ["es-module-lexer@2.0.0", "", {}, "sha512-5POEcUuZybH7IdmGsD8wlf0AI55wMecM9rVBTI/qEAy2c1kTOm3DjFYjrBdI2K3BaJjJYfYFeRtM0t9ssnRuxw=="],
+    "es-module-lexer": ["es-module-lexer@2.1.0", "", {}, "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ=="],
 
-    "es-object-atoms": ["es-object-atoms@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA=="],
+    "es-object-atoms": ["es-object-atoms@1.1.2", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw=="],
 
     "es-set-tostringtag": ["es-set-tostringtag@2.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6", "has-tostringtag": "^1.0.2", "hasown": "^2.0.2" } }, "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA=="],
 
@@ -1630,7 +1827,7 @@
 
     "es-to-primitive": ["es-to-primitive@1.3.0", "", { "dependencies": { "is-callable": "^1.2.7", "is-date-object": "^1.0.5", "is-symbol": "^1.0.4" } }, "sha512-w+5mJ3GuFL+NjVtJlvydShqE1eN3h3PbI7/5LAsYJP/2qtuMXjfL2LpHSRqo4b4eSF5K/DH1JXKUAHSB2UW50g=="],
 
-    "es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
+    "es-toolkit": ["es-toolkit@1.47.1", "", {}, "sha512-5RAqEwf4P4E17p+W75KLOWw/nOvKZzSQpxM32IpI2KZLaVonjTrZ0Ai5ghMaVI9eKC2p8eoQgcBdkEDgzFk6+Q=="],
 
     "esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
 
@@ -1640,7 +1837,7 @@
 
     "escape-string-regexp": ["escape-string-regexp@4.0.0", "", {}, "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="],
 
-    "eslint": ["eslint@10.2.1", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", "@eslint/config-helpers": "^0.5.5", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.1", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", "@types/estree": "^1.0.6", "ajv": "^6.14.0", "cross-spawn": "^7.0.6", "debug": "^4.3.2", "escape-string-regexp": "^4.0.0", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "espree": "^11.2.0", "esquery": "^1.7.0", "esutils": "^2.0.2", "fast-deep-equal": "^3.1.3", "file-entry-cache": "^8.0.0", "find-up": "^5.0.0", "glob-parent": "^6.0.2", "ignore": "^5.2.0", "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", "minimatch": "^10.2.4", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, "peerDependencies": { "jiti": "*" }, "optionalPeers": ["jiti"], "bin": { "eslint": "bin/eslint.js" } }, "sha512-wiyGaKsDgqXvF40P8mDwiUp/KQjE1FdrIEJsM8PZ3XCiniTMXS3OHWWUe5FI5agoCnr8x4xPrTDZuxsBlNHl+Q=="],
+    "eslint": ["eslint@10.5.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", "@eslint/config-helpers": "^0.6.0", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.2", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", "@types/estree": "^1.0.6", "ajv": "^6.14.0", "cross-spawn": "^7.0.6", "debug": "^4.3.2", "escape-string-regexp": "^4.0.0", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "espree": "^11.2.0", "esquery": "^1.7.0", "esutils": "^2.0.2", "fast-deep-equal": "^3.1.3", "file-entry-cache": "^8.0.0", "find-up": "^5.0.0", "glob-parent": "^6.0.2", "ignore": "^5.2.0", "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", "minimatch": "^10.2.4", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, "peerDependencies": { "jiti": "*" }, "optionalPeers": ["jiti"], "bin": { "eslint": "bin/eslint.js" } }, "sha512-1y+7C+vi12bUK1IpZeaV3gsH9fHLBmPvYmPx42pvT/E9yG0IC8g3PUZZgp0+JLJl7ZDK0flc2gc+Aw9dpCvIsQ=="],
 
     "eslint-config-prettier": ["eslint-config-prettier@10.1.8", "", { "peerDependencies": { "eslint": ">=7.0.0" }, "bin": { "eslint-config-prettier": "bin/cli.js" } }, "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w=="],
 
@@ -1654,6 +1851,8 @@
 
     "espree": ["espree@11.2.0", "", { "dependencies": { "acorn": "^8.16.0", "acorn-jsx": "^5.3.2", "eslint-visitor-keys": "^5.0.1" } }, "sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw=="],
 
+    "esprima": ["esprima@4.0.1", "", { "bin": { "esparse": "./bin/esparse.js", "esvalidate": "./bin/esvalidate.js" } }, "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="],
+
     "esquery": ["esquery@1.7.0", "", { "dependencies": { "estraverse": "^5.1.0" } }, "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g=="],
 
     "esrecurse": ["esrecurse@4.3.0", "", { "dependencies": { "estraverse": "^5.2.0" } }, "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag=="],
@@ -1666,17 +1865,25 @@
 
     "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="],
 
+    "event-target-shim": ["event-target-shim@5.0.1", "", {}, "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ=="],
+
     "eventemitter3": ["eventemitter3@5.0.4", "", {}, "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw=="],
 
+    "events": ["events@3.3.0", "", {}, "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q=="],
+
+    "events-universal": ["events-universal@1.0.1", "", { "dependencies": { "bare-events": "^2.7.0" } }, "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw=="],
+
     "eventsource": ["eventsource@3.0.7", "", { "dependencies": { "eventsource-parser": "^3.0.1" } }, "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA=="],
 
-    "eventsource-parser": ["eventsource-parser@3.0.7", "", {}, "sha512-zwxwiQqexizSXFZV13zMiEtW1E3lv7RlUv+1f5FBiR4x7wFhEjm3aFTyYkZQWzyN08WnPdox015GoRH5D/E5YA=="],
+    "eventsource-parser": ["eventsource-parser@3.1.0", "", {}, "sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg=="],
+
+    "execa": ["execa@8.0.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^8.0.1", "human-signals": "^5.0.0", "is-stream": "^3.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^5.1.0", "onetime": "^6.0.0", "signal-exit": "^4.1.0", "strip-final-newline": "^3.0.0" } }, "sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg=="],
 
     "expect-type": ["expect-type@1.3.0", "", {}, "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA=="],
 
     "express": ["express@5.2.1", "", { "dependencies": { "accepts": "^2.0.0", "body-parser": "^2.2.1", "content-disposition": "^1.0.0", "content-type": "^1.0.5", "cookie": "^0.7.1", "cookie-signature": "^1.2.1", "debug": "^4.4.0", "depd": "^2.0.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "finalhandler": "^2.1.0", "fresh": "^2.0.0", "http-errors": "^2.0.0", "merge-descriptors": "^2.0.0", "mime-types": "^3.0.0", "on-finished": "^2.4.1", "once": "^1.4.0", "parseurl": "^1.3.3", "proxy-addr": "^2.0.7", "qs": "^6.14.0", "range-parser": "^1.2.1", "router": "^2.2.0", "send": "^1.1.0", "serve-static": "^2.2.0", "statuses": "^2.0.1", "type-is": "^2.0.1", "vary": "^1.1.2" } }, "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw=="],
 
-    "express-rate-limit": ["express-rate-limit@8.3.2", "", { "dependencies": { "ip-address": "10.1.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-77VmFeJkO0/rvimEDuUC5H30oqUC4EyOhyGccfqoLebB0oiEYfM7nwPrsDsBL1gsTpwfzX8SFy2MT3TDyRq+bg=="],
+    "express-rate-limit": ["express-rate-limit@8.5.2", "", { "dependencies": { "ip-address": "^10.2.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A=="],
 
     "exsolve": ["exsolve@1.0.8", "", {}, "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA=="],
 
@@ -1684,17 +1891,23 @@
 
     "fast-equals": ["fast-equals@5.4.0", "", {}, "sha512-jt2DW/aNFNwke7AUd+Z+e6pz39KO5rzdbbFCg2sGafS4mk13MI7Z8O5z9cADNn5lhGODIgLwug6TZO2ctf7kcw=="],
 
+    "fast-fifo": ["fast-fifo@1.3.2", "", {}, "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ=="],
+
+    "fast-glob": ["fast-glob@3.3.3", "", { "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.2", "merge2": "^1.3.0", "micromatch": "^4.0.8" } }, "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg=="],
+
     "fast-json-stable-stringify": ["fast-json-stable-stringify@2.1.0", "", {}, "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="],
 
     "fast-levenshtein": ["fast-levenshtein@2.0.6", "", {}, "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw=="],
 
     "fast-sha256": ["fast-sha256@1.3.0", "", {}, "sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ=="],
 
-    "fast-uri": ["fast-uri@3.1.0", "", {}, "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA=="],
+    "fast-uri": ["fast-uri@3.1.2", "", {}, "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ=="],
 
-    "fast-xml-builder": ["fast-xml-builder@1.1.5", "", { "dependencies": { "path-expression-matcher": "^1.1.3" } }, "sha512-4TJn/8FKLeslLAH3dnohXqE3QSoxkhvaMzepOIZytwJXZO69Bfz0HBdDHzOTOon6G59Zrk6VQ2bEiv1t61rfkA=="],
+    "fast-xml-builder": ["fast-xml-builder@1.2.0", "", { "dependencies": { "path-expression-matcher": "^1.5.0", "xml-naming": "^0.1.0" } }, "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q=="],
 
-    "fast-xml-parser": ["fast-xml-parser@5.5.8", "", { "dependencies": { "fast-xml-builder": "^1.1.4", "path-expression-matcher": "^1.2.0", "strnum": "^2.2.0" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-Z7Fh2nVQSb2d+poDViM063ix2ZGt9jmY1nWhPfHBOK2Hgnb/OW3P4Et3P/81SEej0J7QbWtJqxO05h8QYfK7LQ=="],
+    "fast-xml-parser": ["fast-xml-parser@5.7.3", "", { "dependencies": { "@nodable/entities": "^2.1.0", "fast-xml-builder": "^1.1.7", "path-expression-matcher": "^1.5.0", "strnum": "^2.2.3" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg=="],
+
+    "fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="],
 
     "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
 
@@ -1702,6 +1915,10 @@
 
     "file-entry-cache": ["file-entry-cache@8.0.0", "", { "dependencies": { "flat-cache": "^4.0.0" } }, "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ=="],
 
+    "file-uri-to-path": ["file-uri-to-path@1.0.0", "", {}, "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="],
+
+    "fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
+
     "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="],
 
     "find-up": ["find-up@5.0.0", "", { "dependencies": { "locate-path": "^6.0.0", "path-exists": "^4.0.0" } }, "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng=="],
@@ -1716,11 +1933,13 @@
 
     "for-each": ["for-each@0.3.5", "", { "dependencies": { "is-callable": "^1.2.7" } }, "sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg=="],
 
-    "form-data": ["form-data@4.0.5", "", { "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", "hasown": "^2.0.2", "mime-types": "^2.1.12" } }, "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w=="],
+    "foreground-child": ["foreground-child@3.3.1", "", { "dependencies": { "cross-spawn": "^7.0.6", "signal-exit": "^4.0.1" } }, "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw=="],
+
+    "form-data": ["form-data@4.0.6", "", { "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", "hasown": "^2.0.4", "mime-types": "^2.1.35" } }, "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ=="],
 
     "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="],
 
-    "framer-motion": ["framer-motion@12.38.0", "", { "dependencies": { "motion-dom": "^12.38.0", "motion-utils": "^12.36.0", "tslib": "^2.4.0" }, "peerDependencies": { "@emotion/is-prop-valid": "*", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@emotion/is-prop-valid", "react", "react-dom"] }, "sha512-rFYkY/pigbcswl1XQSb7q424kSTQ8q6eAC+YUsSKooHQYuLdzdHjrt6uxUC+PRAO++q5IS7+TamgIw1AphxR+g=="],
+    "framer-motion": ["framer-motion@12.40.0", "", { "dependencies": { "motion-dom": "^12.40.0", "motion-utils": "^12.39.0", "tslib": "^2.4.0" }, "peerDependencies": { "@emotion/is-prop-valid": "*", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@emotion/is-prop-valid", "react", "react-dom"] }, "sha512-uaBd3qC1v3KQqBEjwTUd183K6PbS+j0yR9w9VmEOLWA/tnUcSn8Xa3uck7t4dgpDoUss8xQTcj8W2L07lrnLFg=="],
 
     "fresh": ["fresh@2.0.0", "", {}, "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="],
 
@@ -1728,7 +1947,7 @@
 
     "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
 
-    "function.prototype.name": ["function.prototype.name@1.1.8", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "define-properties": "^1.2.1", "functions-have-names": "^1.2.3", "hasown": "^2.0.2", "is-callable": "^1.2.7" } }, "sha512-e5iwyodOHhbMr/yNrc7fDYG4qlbIvI5gajyzPnb5TCwyhjApznQh1BMFou9b30SevY43gCJKXycoCBjMbsuW0Q=="],
+    "function.prototype.name": ["function.prototype.name@1.2.0", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "functions-have-names": "^1.2.3", "has-property-descriptors": "^1.0.2", "hasown": "^2.0.4", "is-callable": "^1.2.7", "is-document.all": "^1.0.0" } }, "sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew=="],
 
     "functions-have-names": ["functions-have-names@1.2.3", "", {}, "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ=="],
 
@@ -1738,40 +1957,52 @@
 
     "get-caller-file": ["get-caller-file@2.0.5", "", {}, "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg=="],
 
-    "get-east-asian-width": ["get-east-asian-width@1.5.0", "", {}, "sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA=="],
+    "get-east-asian-width": ["get-east-asian-width@1.6.0", "", {}, "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA=="],
 
     "get-intrinsic": ["get-intrinsic@1.3.0", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "function-bind": "^1.1.2", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "math-intrinsics": "^1.1.0" } }, "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ=="],
 
     "get-nonce": ["get-nonce@1.0.1", "", {}, "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q=="],
 
+    "get-port-please": ["get-port-please@3.2.0", "", {}, "sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A=="],
+
     "get-proto": ["get-proto@1.0.1", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-object-atoms": "^1.0.0" } }, "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g=="],
 
+    "get-stream": ["get-stream@8.0.1", "", {}, "sha512-VaUJspBffn/LMCJVoMvSAdmscJyS1auj5Zulnn5UoYcY531UWmdwhRWkcGKnGU93m5HSXP9LP2usOryrBtQowA=="],
+
     "get-symbol-description": ["get-symbol-description@1.1.0", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6" } }, "sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg=="],
 
     "get-tsconfig": ["get-tsconfig@4.14.0", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA=="],
 
-    "giget": ["giget@3.2.0", "", { "bin": { "giget": "dist/cli.mjs" } }, "sha512-GvHTWcykIR/fP8cj8dMpuMMkvaeJfPvYnhq0oW+chSeIr+ldX21ifU2Ms6KBoyKZQZmVaUAAhQ2EZ68KJF8a7A=="],
+    "giget": ["giget@3.3.0", "", { "bin": { "giget": "dist/cli.mjs" } }, "sha512-gzi2D96p+AMfDcmJHGDj3KJ9NRiwvlFAU5yfa3ROwWZmFUjX4P43x3BcyRaOMMLto1vUo7C+86+MFhYTl6Ryiw=="],
+
+    "glob": ["glob@13.0.6", "", { "dependencies": { "minimatch": "^10.2.2", "minipass": "^7.1.3", "path-scurry": "^2.0.2" } }, "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw=="],
 
     "glob-parent": ["glob-parent@6.0.2", "", { "dependencies": { "is-glob": "^4.0.3" } }, "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A=="],
 
     "globalthis": ["globalthis@1.0.4", "", { "dependencies": { "define-properties": "^1.2.1", "gopd": "^1.0.1" } }, "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ=="],
 
+    "globby": ["globby@16.2.0", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "fast-glob": "^3.3.3", "ignore": "^7.0.5", "is-path-inside": "^4.0.0", "slash": "^5.1.0", "unicorn-magic": "^0.4.0" } }, "sha512-QrJia2qDf5BB/V6HYlDTs0I0lBahyjLzpGQg3KT7FnCdTonAyPy2RtY802m2k4ALx6Dp752f82WsOczEVr3l6Q=="],
+
     "globrex": ["globrex@0.1.2", "", {}, "sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg=="],
 
-    "goober": ["goober@2.1.18", "", { "peerDependencies": { "csstype": "^3.0.10" } }, "sha512-2vFqsaDVIT9Gz7N6kAL++pLpp41l3PfDuusHcjnGLfR6+huZkl6ziX+zgVC3ZxpqWhzH6pyDdGrCeDhMIvwaxw=="],
+    "goober": ["goober@2.1.19", "", { "peerDependencies": { "csstype": "^3.0.10" } }, "sha512-U7veizMqxyKlM58+Z5j2ngJBH/r9siDmxpvNxSw0PylF6WQvrASJEZrxh1hidRBJc2jqoBVSyOban5u8m+6Rxg=="],
 
     "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="],
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
-    "h3": ["h3@2.0.1-rc.20", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.13" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-28ljodXuUp0fZovdiSRq4G9OgrxCztrJe5VdYzXAB7ueRvI7pIUqLU14Xi3XqdYJ/khXjfpUOOD2EQa6CmBgsg=="],
+    "gzip-size": ["gzip-size@7.0.0", "", { "dependencies": { "duplexer": "^0.1.2" } }, "sha512-O1Ld7Dr+nqPnmGpdhzLmMTQ4vAsD+rHwMm1NLUmoUFFymBOMKxCCrtDxqdBRYXdeEPEi3SyoR4TizJLQrnKBNA=="],
+
+    "h3": ["h3@2.0.1-rc.22", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.15" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-Esv0DMIuPkCTSWCA0vO73vcTqwzH1wjSrAO1TXNu/K3up1sZHa9EKMapbmxCDYBeymC3fVTk4qxp7ogQWQ+KgA=="],
 
     "h3-v2": ["h3@2.0.1-rc.20", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.13" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-28ljodXuUp0fZovdiSRq4G9OgrxCztrJe5VdYzXAB7ueRvI7pIUqLU14Xi3XqdYJ/khXjfpUOOD2EQa6CmBgsg=="],
 
-    "happy-dom": ["happy-dom@20.9.0", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.18.3" } }, "sha512-GZZ9mKe8r646NUAf/zemnGbjYh4Bt8/MqASJY+pSm5ZDtc3YQox+4gsLI7yi1hba6o+eCsGxpHn5+iEVn31/FQ=="],
+    "happy-dom": ["happy-dom@20.10.4", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-bKrsQnFNpcjZG0UPsH7UMN7Oyp3AB42LXk2GuiQmu7l4QFxH7lsw5T1eWEtE2+vbIFrTC45sbNSB2pkB8MTfKA=="],
 
     "has-bigints": ["has-bigints@1.1.0", "", {}, "sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg=="],
 
+    "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
+
     "has-property-descriptors": ["has-property-descriptors@1.0.2", "", { "dependencies": { "es-define-property": "^1.0.0" } }, "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg=="],
 
     "has-proto": ["has-proto@1.2.0", "", { "dependencies": { "dunder-proto": "^1.0.0" } }, "sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ=="],
@@ -1780,7 +2011,7 @@
 
     "has-tostringtag": ["has-tostringtag@1.0.2", "", { "dependencies": { "has-symbols": "^1.0.3" } }, "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw=="],
 
-    "hasown": ["hasown@2.0.3", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg=="],
+    "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="],
 
     "hermes-estree": ["hermes-estree@0.25.1", "", {}, "sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw=="],
 
@@ -1788,28 +2019,42 @@
 
     "highlight.js": ["highlight.js@11.11.1", "", {}, "sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w=="],
 
-    "hono": ["hono@4.12.14", "", {}, "sha512-am5zfg3yu6sqn5yjKBNqhnTX7Cv+m00ox+7jbaKkrLMRJ4rAdldd1xPd/JzbBWspqaQv6RSTrgFN95EsfhC+7w=="],
+    "hono": ["hono@4.12.25", "", {}, "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ=="],
 
     "hookable": ["hookable@6.1.1", "", {}, "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ=="],
 
     "hsl-matcher": ["hsl-matcher@1.2.4", "", {}, "sha512-tS7XnJS33Egirm+6cI+Z/kH/aVZt94uxGlJxOZlGql2/yqbAzPg3zHHnTnVN4cVpoJnEYEGq+LE3iXbuUIe8BA=="],
 
+    "html-escaper": ["html-escaper@2.0.2", "", {}, "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg=="],
+
     "html-to-text": ["html-to-text@9.0.5", "", { "dependencies": { "@selderee/plugin-htmlparser2": "^0.11.0", "deepmerge": "^4.3.1", "dom-serializer": "^2.0.0", "htmlparser2": "^8.0.2", "selderee": "^0.11.0" } }, "sha512-qY60FjREgVZL03vJU6IfMV4GDjGBIoOyvuFdpBDIX9yTlDw0TjxVBQp+P8NvpdIXNJvfWBTNul7fsAQJq2FNpg=="],
 
     "htmlparser2": ["htmlparser2@8.0.2", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.3", "domutils": "^3.0.1", "entities": "^4.4.0" } }, "sha512-GYdjWKDkbRLkZ5geuHs5NY1puJ+PXwP7+fHPRz06Eirsb9ugf6d8kkXav6ADhcODhFFPMIXyxkxSuMf3D6NCFA=="],
 
     "http-errors": ["http-errors@2.0.1", "", { "dependencies": { "depd": "~2.0.0", "inherits": "~2.0.4", "setprototypeof": "~1.2.0", "statuses": "~2.0.2", "toidentifier": "~1.0.1" } }, "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ=="],
 
-    "httpxy": ["httpxy@0.5.0", "", {}, "sha512-qwX7QX/rK2visT10/b7bSeZWQOMlSm3svTD0pZpU+vJjNUP0YHtNv4c3z+MO+MSnGuRFWJFdCZiV+7F7dXIOzg=="],
+    "http-proxy": ["http-proxy@1.18.1", "", { "dependencies": { "eventemitter3": "^4.0.0", "follow-redirects": "^1.0.0", "requires-port": "^1.0.0" } }, "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ=="],
+
+    "http-shutdown": ["http-shutdown@1.2.2", "", {}, "sha512-S9wWkJ/VSY9/k4qcjG318bqJNruzE4HySUhFYknwmu6LBP97KLLfwNf+n4V1BHurvFNkSKLFnK/RsuUnRTf9Vw=="],
+
+    "https-proxy-agent": ["https-proxy-agent@5.0.1", "", { "dependencies": { "agent-base": "6", "debug": "4" } }, "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA=="],
+
+    "httpxy": ["httpxy@0.5.3", "", {}, "sha512-SMS9V6Sn7VWaS11lYhoAr0ceoaiolTWf4jYdJn0NJhCdKMu9R2H9Fh0LBDWBHQF6HRLI1PmaePYsjanSpE5PEw=="],
+
+    "human-signals": ["human-signals@5.0.0", "", {}, "sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ=="],
 
     "husky": ["husky@9.1.7", "", { "bin": { "husky": "bin.js" } }, "sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA=="],
 
     "iconv-lite": ["iconv-lite@0.7.2", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw=="],
 
+    "ieee754": ["ieee754@1.2.1", "", {}, "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA=="],
+
     "ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
 
     "immer": ["immer@10.2.0", "", {}, "sha512-d/+XTN3zfODyjr89gM3mPq1WNX2B8pYsu7eORitdwyA2sBubnTl3laYlBk4sXY5FUa5qTZGBDPJICVbvqzjlbw=="],
 
+    "import-meta-resolve": ["import-meta-resolve@4.2.0", "", {}, "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg=="],
+
     "imurmurhash": ["imurmurhash@0.1.4", "", {}, "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA=="],
 
     "indent-string": ["indent-string@4.0.0", "", {}, "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg=="],
@@ -1822,30 +2067,38 @@
 
     "internmap": ["internmap@2.0.3", "", {}, "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg=="],
 
-    "intl-messageformat": ["intl-messageformat@11.2.1", "", { "dependencies": { "@formatjs/fast-memoize": "3.1.2", "@formatjs/icu-messageformat-parser": "3.5.4" } }, "sha512-1gAVEUt3wEPvTqML4Fsw9klZV5j0vszQxayP/fi6gUroAc8AUHiNaisBKLWxybL1AdWq1mP07YV1q8v4N92ilQ=="],
+    "intl-messageformat": ["intl-messageformat@11.2.8", "", { "dependencies": { "@formatjs/fast-memoize": "3.1.6", "@formatjs/icu-messageformat-parser": "3.5.11" } }, "sha512-l323RCl3qJDVQ8U9j74ut/hVMdg3VPsOHpVMDvFfz9qiq4dPO5ooVYFNVUzzrpgG39a+RLzcXyJb8VFgIU+tUA=="],
 
-    "ioredis": ["ioredis@5.10.1", "", { "dependencies": { "@ioredis/commands": "1.5.1", "cluster-key-slot": "^1.1.0", "debug": "^4.3.4", "denque": "^2.1.0", "lodash.defaults": "^4.2.0", "lodash.isarguments": "^3.1.0", "redis-errors": "^1.2.0", "redis-parser": "^3.0.0", "standard-as-callback": "^2.1.0" } }, "sha512-HuEDBTI70aYdx1v6U97SbNx9F1+svQKBDo30o0b9fw055LMepzpOOd0Ccg9Q6tbqmBSJaMuY0fB7yw9/vjBYCA=="],
+    "ioredis": ["ioredis@5.11.1", "", { "dependencies": { "@ioredis/commands": "1.10.0", "cluster-key-slot": "1.1.1", "debug": "4.4.3", "denque": "2.1.0", "redis-errors": "1.2.0", "redis-parser": "3.0.0", "standard-as-callback": "2.1.0" } }, "sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A=="],
 
-    "ip-address": ["ip-address@10.1.0", "", {}, "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q=="],
+    "ip-address": ["ip-address@10.2.0", "", {}, "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="],
 
     "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
 
+    "iron-webcrypto": ["iron-webcrypto@1.2.1", "", {}, "sha512-feOM6FaSr6rEABp/eDfVseKyTMDt+KGpeB35SkVn9Tyn0CqvVsY3EwI0v5i8nMHyJnzCIQf7nsy3p41TPkJZhg=="],
+
     "is-array-buffer": ["is-array-buffer@3.0.5", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "get-intrinsic": "^1.2.6" } }, "sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A=="],
 
     "is-async-function": ["is-async-function@2.1.1", "", { "dependencies": { "async-function": "^1.0.0", "call-bound": "^1.0.3", "get-proto": "^1.0.1", "has-tostringtag": "^1.0.2", "safe-regex-test": "^1.1.0" } }, "sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ=="],
 
     "is-bigint": ["is-bigint@1.1.0", "", { "dependencies": { "has-bigints": "^1.0.2" } }, "sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ=="],
 
+    "is-binary-path": ["is-binary-path@2.1.0", "", { "dependencies": { "binary-extensions": "^2.0.0" } }, "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw=="],
+
     "is-boolean-object": ["is-boolean-object@1.2.2", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A=="],
 
     "is-callable": ["is-callable@1.2.7", "", {}, "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA=="],
 
-    "is-core-module": ["is-core-module@2.16.1", "", { "dependencies": { "hasown": "^2.0.2" } }, "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w=="],
+    "is-core-module": ["is-core-module@2.16.2", "", { "dependencies": { "hasown": "^2.0.3" } }, "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA=="],
 
     "is-data-view": ["is-data-view@1.0.2", "", { "dependencies": { "call-bound": "^1.0.2", "get-intrinsic": "^1.2.6", "is-typed-array": "^1.1.13" } }, "sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw=="],
 
     "is-date-object": ["is-date-object@1.1.0", "", { "dependencies": { "call-bound": "^1.0.2", "has-tostringtag": "^1.0.2" } }, "sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg=="],
 
+    "is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
+
+    "is-document.all": ["is-document.all@1.0.0", "", { "dependencies": { "call-bound": "^1.0.4" } }, "sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g=="],
+
     "is-electron": ["is-electron@2.2.2", "", {}, "sha512-FO/Rhvz5tuw4MCWkpMzHFKWD2LsfHzIb7i6MdPYZ/KW7AlxawyLkqdy+jPZP1WubqEADE3O4FUENlJHDfQASRg=="],
 
     "is-emoji-supported": ["is-emoji-supported@0.0.5", "", {}, "sha512-WOlXUhDDHxYqcSmFZis+xWhhqXiK2SU0iYiqmth5Ip0FHLZQAt9rKL5ahnilE8/86WH8tZ3bmNNNC+bTzamqlw=="],
@@ -1860,14 +2113,26 @@
 
     "is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="],
 
+    "is-in-ssh": ["is-in-ssh@1.0.0", "", {}, "sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw=="],
+
+    "is-inside-container": ["is-inside-container@1.0.0", "", { "dependencies": { "is-docker": "^3.0.0" }, "bin": { "is-inside-container": "cli.js" } }, "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA=="],
+
     "is-map": ["is-map@2.0.3", "", {}, "sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw=="],
 
+    "is-module": ["is-module@1.0.0", "", {}, "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g=="],
+
     "is-negative-zero": ["is-negative-zero@2.0.3", "", {}, "sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw=="],
 
+    "is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
+
     "is-number-object": ["is-number-object@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw=="],
 
+    "is-path-inside": ["is-path-inside@4.0.0", "", {}, "sha512-lJJV/5dYS+RcL8uQdBDW9c9uWFLLBNRyFhnAKXw5tVqLlKZ4RMGZKv+YQ/IA3OhD+RpbJa1LLFM1FQPGyIXvOA=="],
+
     "is-promise": ["is-promise@4.0.0", "", {}, "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="],
 
+    "is-reference": ["is-reference@1.2.1", "", { "dependencies": { "@types/estree": "*" } }, "sha512-U82MsXXiFIrjCK4otLT+o2NA2Cd2g5MLoOVXUZjIOhLurrRxpEXzI8O0KZHr3IjLvlAH1kTPYSuqer5T9ZVBKQ=="],
+
     "is-regex": ["is-regex@1.2.1", "", { "dependencies": { "call-bound": "^1.0.2", "gopd": "^1.2.0", "has-tostringtag": "^1.0.2", "hasown": "^2.0.2" } }, "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g=="],
 
     "is-set": ["is-set@2.0.3", "", {}, "sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg=="],
@@ -1888,23 +2153,35 @@
 
     "is-weakset": ["is-weakset@2.0.4", "", { "dependencies": { "call-bound": "^1.0.3", "get-intrinsic": "^1.2.6" } }, "sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ=="],
 
+    "is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
+
+    "is64bit": ["is64bit@2.0.0", "", { "dependencies": { "system-architecture": "^0.1.0" } }, "sha512-jv+8jaWCl0g2lSBkNSVXdzfBA0npK1HGC2KtWM9FumFRoGS94g3NbCCLVnCYHLjp4GrW2KZeeSTMo5ddtznmGw=="],
+
     "isarray": ["isarray@2.0.5", "", {}, "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw=="],
 
-    "isbot": ["isbot@5.1.39", "", {}, "sha512-obH0yYahGXdzNxo+djmHhBYThUKDkz565cxkIlt2L9hXfv1NlaLKoDBHo6KxXsYrIXx2RK3x5vY36CfZcobxEw=="],
+    "isbot": ["isbot@5.1.43", "", {}, "sha512-drJhFmibra4LO6Wd7D3Oi6UICRK9244vSZkmxzhlZP0TTdwCA2ueK4PEkUkzPYeuqug9+cqqdWPgihjk5+83Cg=="],
 
     "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
 
+    "istanbul-lib-coverage": ["istanbul-lib-coverage@3.2.2", "", {}, "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg=="],
+
+    "istanbul-lib-report": ["istanbul-lib-report@3.0.1", "", { "dependencies": { "istanbul-lib-coverage": "^3.0.0", "make-dir": "^4.0.0", "supports-color": "^7.1.0" } }, "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw=="],
+
+    "istanbul-reports": ["istanbul-reports@3.2.0", "", { "dependencies": { "html-escaper": "^2.0.0", "istanbul-lib-report": "^3.0.0" } }, "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA=="],
+
     "iterator.prototype": ["iterator.prototype@1.1.5", "", { "dependencies": { "define-data-property": "^1.1.4", "es-object-atoms": "^1.0.0", "get-intrinsic": "^1.2.6", "get-proto": "^1.0.0", "has-symbols": "^1.1.0", "set-function-name": "^2.0.2" } }, "sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g=="],
 
-    "jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
+    "jackspeak": ["jackspeak@3.4.3", "", { "dependencies": { "@isaacs/cliui": "^8.0.2" }, "optionalDependencies": { "@pkgjs/parseargs": "^0.11.0" } }, "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw=="],
 
-    "jose": ["jose@6.2.2", "", {}, "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ=="],
+    "jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
+
+    "jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
 
     "joycon": ["joycon@3.1.1", "", {}, "sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw=="],
 
-    "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+    "js-tokens": ["js-tokens@10.0.0", "", {}, "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q=="],
 
-    "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
+    "js-yaml": ["js-yaml@4.2.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw=="],
 
     "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="],
 
@@ -1922,7 +2199,15 @@
 
     "keyv": ["keyv@4.5.4", "", { "dependencies": { "json-buffer": "3.0.1" } }, "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw=="],
 
-    "kysely": ["kysely@0.28.16", "", {}, "sha512-3i5pmOiZvMDj00qhrIVbH0AnioVTx22DMP7Vn5At4yJO46iy+FM8Y/g61ltenLVSo3fiO8h8Q3QOFgf/gQ72ww=="],
+    "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
+
+    "klona": ["klona@2.0.6", "", {}, "sha512-dhG34DXATL5hSxJbIexCft8FChFXtmskoZYnoPWjXQuebWYCNkVeV3KkGegCK9CP1oswI/vQibS2GY7Em/sJJA=="],
+
+    "knitwork": ["knitwork@1.3.0", "", {}, "sha512-4LqMNoONzR43B1W0ek0fhXMsDNW/zxa1NdFAVMY+k28pgZLovR4G3PB5MrpTxCy1QaZCqNoiaKPr5w5qZHfSNw=="],
+
+    "kysely": ["kysely@0.29.2", "", {}, "sha512-s6WVJyEZrbm6jhBpiKHsGHyePMrVQKJ85wZCFCr9W4QHv6WTjWIrdvTmO9hDEA3bNK0xkrE2DqrHsXMLWuZpQg=="],
+
+    "lazystream": ["lazystream@1.0.1", "", { "dependencies": { "readable-stream": "^2.0.5" } }, "sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw=="],
 
     "leac": ["leac@0.6.0", "", {}, "sha512-y+SqErxb8h7nE/fiEX07jsbuhrpO9lL8eca7/Y1nuWV2moNlXhyd59iDGcRf6moVyDMbmTNzL40SUyrFU/yDpg=="],
 
@@ -1956,16 +2241,22 @@
 
     "lines-and-columns": ["lines-and-columns@1.2.4", "", {}, "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg=="],
 
-    "linkifyjs": ["linkifyjs@4.3.2", "", {}, "sha512-NT1CJtq3hHIreOianA8aSXn6Cw0JzYOuDQbOrSPe7gqFnCpKP++MQe3ODgO3oh2GJFORkAAdqredOa60z63GbA=="],
+    "linkifyjs": ["linkifyjs@4.3.3", "", {}, "sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg=="],
 
     "lint-staged": ["lint-staged@16.4.0", "", { "dependencies": { "commander": "^14.0.3", "listr2": "^9.0.5", "picomatch": "^4.0.3", "string-argv": "^0.3.2", "tinyexec": "^1.0.4", "yaml": "^2.8.2" }, "bin": { "lint-staged": "bin/lint-staged.js" } }, "sha512-lBWt8hujh/Cjysw5GYVmZpFHXDCgZzhrOm8vbcUdobADZNOK/bRshr2kM3DfgrrtR1DQhfupW9gnIXOfiFi+bw=="],
 
+    "listhen": ["listhen@1.10.0", "", { "dependencies": { "@parcel/watcher": "^2.5.6", "@parcel/watcher-wasm": "^2.5.6", "citty": "^0.2.2", "consola": "^3.4.2", "crossws": ">=0.2.0 <0.5.0", "defu": "^6.1.7", "get-port-please": "^3.2.0", "h3": "^1.15.11", "http-shutdown": "^1.2.2", "jiti": "^2.6.1", "mlly": "^1.8.2", "node-forge": "^1.4.0", "pathe": "^2.0.3", "std-env": "^4.1.0", "tinyclip": "^0.1.12", "ufo": "^1.6.4", "untun": "^0.1.3", "uqr": "^0.1.3" }, "bin": { "listen": "bin/listhen.mjs", "listhen": "bin/listhen.mjs" } }, "sha512-kfz4C0OrC6IpaVMtYDJtf6PFjurxe9NBBoDAh/o2p587INryFOO4DQ9OetbCdDrWFt1m1CJKvYrzkGsuPHw8nQ=="],
+
     "listr2": ["listr2@9.0.5", "", { "dependencies": { "cli-truncate": "^5.0.0", "colorette": "^2.0.20", "eventemitter3": "^5.0.1", "log-update": "^6.1.0", "rfdc": "^1.4.1", "wrap-ansi": "^9.0.0" } }, "sha512-ME4Fb83LgEgwNw96RKNvKV4VTLuXfoKudAmm2lP8Kk87KaMK0/Xrx/aAkMWmT8mDb+3MlFDspfbCs7adjRxA2g=="],
 
     "load-tsconfig": ["load-tsconfig@0.2.5", "", {}, "sha512-IXO6OCs9yg8tMKzfPZ1YmheJbZCiEsnBdcB03l0OcfK9prKnJb96siuHCr5Fl37/yo9DnKU+TLpxzTUspw9shg=="],
 
+    "local-pkg": ["local-pkg@1.2.1", "", { "dependencies": { "mlly": "^1.7.4", "pkg-types": "^2.3.0", "quansync": "^0.2.11" } }, "sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q=="],
+
     "locate-path": ["locate-path@6.0.0", "", { "dependencies": { "p-locate": "^5.0.0" } }, "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw=="],
 
+    "lodash": ["lodash@4.18.1", "", {}, "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q=="],
+
     "lodash.defaults": ["lodash.defaults@4.2.0", "", {}, "sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ=="],
 
     "lodash.isarguments": ["lodash.isarguments@3.1.0", "", {}, "sha512-chi4NHZlZqZD18a0imDHnZPrDeBbTtVN7GXMwuGdRH9qotxAjYs3aVLKc7zNOG9eddR5Ksd8rvFEBc9SsggPpg=="],
@@ -1978,7 +2269,7 @@
 
     "lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
 
-    "lucide-react": ["lucide-react@1.8.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-WuvlsjngSk7TnTBJ1hsCy3ql9V9VOdcPkd3PKcSmM34vJD8KG6molxz7m7zbYFgICwsanQWmJ13JlYs4Zp7Arw=="],
+    "lucide-react": ["lucide-react@1.18.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-LZDb7H/0YfM+RJncD0hDQRCAu+vSGODqpe35TuVI8EuXaRjkczbsx7p8dY4J87F/MUSj6bpYqeI8nw8qXaAdmA=="],
 
     "luxon": ["luxon@3.7.2", "", {}, "sha512-vtEhXh/gNjI9Yg1u4jX/0YVPMvxzHuGgCm6tC5kZyb08yjGWGnqAjGJvcXbqQR2P3MyMEFnRbpcdFS6PBcLqew=="],
 
@@ -1986,6 +2277,10 @@
 
     "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
 
+    "magicast": ["magicast@0.5.3", "", { "dependencies": { "@babel/parser": "^7.29.3", "@babel/types": "^7.29.0", "source-map-js": "^1.2.1" } }, "sha512-pVKE4UdSQ7DvHzivsCIFx2BJn1mHG6KsyrFcaxFx6tONdneEuThrDx0Cj3AMg58KyN4pzYT+LHOotxDQDjNvkw=="],
+
+    "make-dir": ["make-dir@4.0.0", "", { "dependencies": { "semver": "^7.5.3" } }, "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw=="],
+
     "marked": ["marked@17.0.6", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-gB0gkNafnonOw0obSTEGZTT86IuhILt2Wfx0mWH/1Au83kybTayroZ/V6nS25mN7u8ASy+5fMhgB3XPNrOZdmA=="],
 
     "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="],
@@ -1994,10 +2289,20 @@
 
     "merge-descriptors": ["merge-descriptors@2.0.0", "", {}, "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g=="],
 
+    "merge-stream": ["merge-stream@2.0.0", "", {}, "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="],
+
+    "merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="],
+
+    "micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
+
+    "mime": ["mime@4.1.0", "", { "bin": { "mime": "bin/cli.js" } }, "sha512-X5ju04+cAzsojXKes0B/S4tcYtFAJ6tTMuSPBEn9CPGlrWr8Fiw7qYeLT0XyH80HSoAoqWCaz+MWKh22P7G1cw=="],
+
     "mime-db": ["mime-db@1.54.0", "", {}, "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ=="],
 
     "mime-types": ["mime-types@3.0.2", "", { "dependencies": { "mime-db": "^1.54.0" } }, "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A=="],
 
+    "mimic-fn": ["mimic-fn@4.0.0", "", {}, "sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw=="],
+
     "mimic-function": ["mimic-function@5.0.1", "", {}, "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA=="],
 
     "min-indent": ["min-indent@1.0.1", "", {}, "sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg=="],
@@ -2006,21 +2311,25 @@
 
     "minimist": ["minimist@1.2.8", "", {}, "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA=="],
 
+    "minipass": ["minipass@7.1.3", "", {}, "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A=="],
+
+    "minizlib": ["minizlib@3.1.0", "", { "dependencies": { "minipass": "^7.1.2" } }, "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw=="],
+
     "mlly": ["mlly@1.8.2", "", { "dependencies": { "acorn": "^8.16.0", "pathe": "^2.0.3", "pkg-types": "^1.3.1", "ufo": "^1.6.3" } }, "sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA=="],
 
-    "motion-dom": ["motion-dom@12.38.0", "", { "dependencies": { "motion-utils": "^12.36.0" } }, "sha512-pdkHLD8QYRp8VfiNLb8xIBJis1byQ9gPT3Jnh2jqfFtAsWUA3dEepDlsWe/xMpO8McV+VdpKVcp+E+TGJEtOoA=="],
+    "motion-dom": ["motion-dom@12.40.0", "", { "dependencies": { "motion-utils": "^12.39.0" } }, "sha512-HxU3ZaBwNPVQUBQf1xxgq+7JrPNZvjLVxgbpEZL7RrWJnsxOf0/OM+yrHG9ogLQ31Do/r57Oz2gQWPK+6q62mg=="],
 
-    "motion-utils": ["motion-utils@12.36.0", "", {}, "sha512-eHWisygbiwVvf6PZ1vhaHCLamvkSbPIeAYxWUuL3a2PD/TROgE7FvfHWTIH4vMl798QLfMw15nRqIaRDXTlYRg=="],
+    "motion-utils": ["motion-utils@12.39.0", "", {}, "sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ=="],
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
-    "msgpackr": ["msgpackr@1.11.5", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.2" } }, "sha512-UjkUHN0yqp9RWKy0Lplhh+wlpdt9oQBYgULZOiFhV3VclSF1JnSQWZ5r9gORQlNYaUKQoR8itv7g7z1xDDuACA=="],
+    "msgpackr": ["msgpackr@2.0.2", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.4" } }, "sha512-c5hYOXFbP79Slh6Dzd2wzk+jnV7mX1UxfMYtilnY1NmalXPqG8DGb5cYCMBrW4AsH3zekBBZd4QrKz9NhtvYLQ=="],
 
-    "msgpackr-extract": ["msgpackr-extract@3.0.3", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.3", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.3", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.3" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-P0efT1C9jIdVRefqjzOQ9Xml57zpOXnIuS+csaB4MdZbTdmGDLo8XhzBG1N7aO11gKDDkJvBLULeFTo46wwreA=="],
+    "msgpackr-extract": ["msgpackr-extract@3.0.4", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw=="],
 
     "mz": ["mz@2.7.0", "", { "dependencies": { "any-promise": "^1.0.0", "object-assign": "^4.0.1", "thenify-all": "^1.0.0" } }, "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q=="],
 
-    "nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+    "nanoid": ["nanoid@3.3.12", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="],
 
     "nanostores": ["nanostores@1.3.0", "", {}, "sha512-XPUa/jz+P1oJvN9VBxw4L9MtdFfaH3DAryqPssqhb2kXjmb9npz0dly6rCsgFWOPr4Yg9mTfM3MDZgZZ+7A3lA=="],
 
@@ -2030,22 +2339,44 @@
 
     "next-themes": ["next-themes@0.4.6", "", { "peerDependencies": { "react": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc", "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc" } }, "sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA=="],
 
-    "nf3": ["nf3@0.3.16", "", {}, "sha512-Gs0xRPpUm2nDkqbi40NJ9g7qDIcjcJzgExiydnq6LAyqhI2jfno8wG3NKTL+IiJsx799UHOb1CnSd4Wg4SG4Pw=="],
+    "nf3": ["nf3@0.3.17", "", {}, "sha512-N9zEWySuJFw+gR0lhS5863YsvNeudOdqRyFvNb+jMXbeTJOdrjDqkCpDginIZfUm0LzT1t1nCRiDeqQm/8kirQ=="],
 
     "nitro": ["nitro@3.0.260415-beta", "", { "dependencies": { "consola": "^3.4.2", "crossws": "^0.4.5", "db0": "^0.3.4", "env-runner": "^0.1.7", "h3": "^2.0.1-rc.20", "hookable": "^6.1.1", "nf3": "^0.3.16", "ocache": "^0.1.4", "ofetch": "^2.0.0-alpha.3", "ohash": "^2.0.11", "rolldown": "^1.0.0-rc.15", "srvx": "^0.11.15", "unenv": "^2.0.0-rc.24", "unstorage": "^2.0.0-alpha.7" }, "peerDependencies": { "@vercel/queue": "^0.1.4", "dotenv": "*", "giget": "*", "jiti": "^2.6.1", "rollup": "^4.60.1", "vite": "^7 || ^8", "xml2js": "^0.6.2", "zephyr-agent": "^0.2.0" }, "optionalPeers": ["@vercel/queue", "dotenv", "giget", "jiti", "rollup", "vite", "xml2js", "zephyr-agent"], "bin": { "nitro": "dist/cli/index.mjs" } }, "sha512-J0ntJERWtIdvweZdmkCiF8eOFvP9fIAJR2gpeIDrHbAlYavK41WQfADo/YoZ/LF7RMTZBiPaH/pt2s/nPru9Iw=="],
 
+    "nitropack": ["nitropack@2.13.4", "", { "dependencies": { "@cloudflare/kv-asset-handler": "^0.4.2", "@rollup/plugin-alias": "^6.0.0", "@rollup/plugin-commonjs": "^29.0.2", "@rollup/plugin-inject": "^5.0.5", "@rollup/plugin-json": "^6.1.0", "@rollup/plugin-node-resolve": "^16.0.3", "@rollup/plugin-replace": "^6.0.3", "@rollup/plugin-terser": "^1.0.0", "@vercel/nft": "^1.5.0", "archiver": "^7.0.1", "c12": "^3.3.4", "chokidar": "^5.0.0", "citty": "^0.2.2", "compatx": "^0.2.0", "confbox": "^0.2.4", "consola": "^3.4.2", "cookie-es": "^2.0.1", "croner": "^10.0.1", "crossws": "^0.3.5", "db0": "^0.3.4", "defu": "^6.1.7", "destr": "^2.0.5", "dot-prop": "^10.1.0", "esbuild": "^0.28.0", "escape-string-regexp": "^5.0.0", "etag": "^1.8.1", "exsolve": "^1.0.8", "globby": "^16.2.0", "gzip-size": "^7.0.0", "h3": "^1.15.11", "hookable": "^5.5.3", "httpxy": "^0.5.1", "ioredis": "^5.10.1", "jiti": "^2.6.1", "klona": "^2.0.6", "knitwork": "^1.3.0", "listhen": "^1.9.1", "magic-string": "^0.30.21", "magicast": "^0.5.2", "mime": "^4.1.0", "mlly": "^1.8.2", "node-fetch-native": "^1.6.7", "node-mock-http": "^1.0.4", "ofetch": "^1.5.1", "ohash": "^2.0.11", "pathe": "^2.0.3", "perfect-debounce": "^2.1.0", "pkg-types": "^2.3.1", "pretty-bytes": "^7.1.0", "radix3": "^1.1.2", "rollup": "^4.60.2", "rollup-plugin-visualizer": "^7.0.1", "scule": "^1.3.0", "semver": "^7.7.4", "serve-placeholder": "^2.0.2", "serve-static": "^2.2.1", "source-map": "^0.7.6", "std-env": "^4.1.0", "ufo": "^1.6.4", "ultrahtml": "^1.6.0", "uncrypto": "^0.1.3", "unctx": "^2.5.0", "unenv": "2.0.0-rc.24", "unimport": "^6.2.0", "unplugin-utils": "^0.3.1", "unstorage": "^1.17.5", "untyped": "^2.0.0", "unwasm": "^0.5.3", "youch": "^4.1.1", "youch-core": "^0.3.3" }, "peerDependencies": { "xml2js": "^0.6.2" }, "optionalPeers": ["xml2js"], "bin": { "nitro": "dist/cli/index.mjs", "nitropack": "dist/cli/index.mjs" } }, "sha512-tX7bT6zxNeMwkc6hxHiZeUoTOjVrcjoh1Z3cmxOlodIqjl4HISgqfGOmkWSayky3Nv9Z5+KQH52F8nmXJY5AAA=="],
+
     "node-abort-controller": ["node-abort-controller@3.1.1", "", {}, "sha512-AGK2yQKIjRuqnc6VkX2Xj5d+QW8xZ87pa1UK6yA6ouUyuxfHuMP6umE5QK7UmTeOAymo+Zx1Fxiuw9rVx8taHQ=="],
 
+    "node-addon-api": ["node-addon-api@7.1.1", "", {}, "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ=="],
+
     "node-exports-info": ["node-exports-info@1.6.0", "", { "dependencies": { "array.prototype.flatmap": "^1.3.3", "es-errors": "^1.3.0", "object.entries": "^1.1.9", "semver": "^6.3.1" } }, "sha512-pyFS63ptit/P5WqUkt+UUfe+4oevH+bFeIiPPdfb0pFeYEu/1ELnJu5l+5EcTKYL5M7zaAa7S8ddywgXypqKCw=="],
 
+    "node-fetch": ["node-fetch@2.7.0", "", { "dependencies": { "whatwg-url": "^5.0.0" }, "peerDependencies": { "encoding": "^0.1.0" }, "optionalPeers": ["encoding"] }, "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A=="],
+
+    "node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],
+
+    "node-forge": ["node-forge@1.4.0", "", {}, "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ=="],
+
+    "node-gyp-build": ["node-gyp-build@4.8.4", "", { "bin": { "node-gyp-build": "bin.js", "node-gyp-build-optional": "optional.js", "node-gyp-build-test": "build-test.js" } }, "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ=="],
+
     "node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.2.2", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-optional": "optional.js", "node-gyp-build-optional-packages-test": "build-test.js" } }, "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw=="],
 
-    "node-releases": ["node-releases@2.0.37", "", {}, "sha512-1h5gKZCF+pO/o3Iqt5Jp7wc9rH3eJJ0+nh/CIoiRwjRxde/hAHyLPXYN4V3CqKAbiZPSeJFSWHmJsbkicta0Eg=="],
+    "node-mock-http": ["node-mock-http@1.0.4", "", {}, "sha512-8DY+kFsDkNXy1sJglUfuODx1/opAGJGyrTuFqEoN90oRc2Vk0ZbD4K2qmKXBBEhZQzdKHIVfEJpDU8Ak2NJEvQ=="],
+
+    "node-releases": ["node-releases@2.0.47", "", {}, "sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og=="],
 
-    "nodemailer": ["nodemailer@8.0.5", "", {}, "sha512-0PF8Yb1yZuQfQbq+5/pZJrtF6WQcjTd5/S4JOHs9PGFxuTqoB/icwuB44pOdURHJbRKX1PPoJZtY7R4VUoCC8w=="],
+    "nodemailer": ["nodemailer@8.0.11", "", {}, "sha512-nrO/pDAUKl+wXX+lx16tDLbnm0fW6sK/x8mgohaCpg+CdCEl482bD4tCuAZk2DyliruiNTIZxRCoWkDqJEnAiA=="],
+
+    "nopt": ["nopt@8.1.0", "", { "dependencies": { "abbrev": "^3.0.0" }, "bin": { "nopt": "bin/nopt.js" } }, "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A=="],
+
+    "normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],
 
     "normalize-wheel": ["normalize-wheel@1.0.1", "", {}, "sha512-1OnlAPZ3zgrk8B91HyRj+eVv+kS5u+Z0SCsak6Xil/kmgEia50ga7zfkumayonZrImffAxPU/5WcyGhzetHNPA=="],
 
+    "npm-run-path": ["npm-run-path@5.3.0", "", { "dependencies": { "path-key": "^4.0.0" } }, "sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ=="],
+
+    "nth-check": ["nth-check@2.1.1", "", { "dependencies": { "boolbase": "^1.0.0" } }, "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w=="],
+
     "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="],
 
     "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="],
@@ -2060,9 +2391,9 @@
 
     "object.values": ["object.values@1.2.1", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "define-properties": "^1.2.1", "es-object-atoms": "^1.0.0" } }, "sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA=="],
 
-    "obug": ["obug@2.1.1", "", {}, "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ=="],
+    "obug": ["obug@2.1.3", "", {}, "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg=="],
 
-    "ocache": ["ocache@0.1.4", "", { "dependencies": { "ohash": "^2.0.11" } }, "sha512-e7geNdWjxSnvsSgvLuPvgKgu7ubM10ZmTPOgpr7mz2BXYtvjMKTiLhjFi/gWU8chkuP6hNkZBsa9LzOusyaqkQ=="],
+    "ocache": ["ocache@0.1.5", "", { "dependencies": { "ohash": "^2.0.11" } }, "sha512-kNNnkkVQup/QDvmTz8Q84wc2ntiyoVHDxa6eHWKt5qdGAmFRBIxy83rxgCYEjW0x06UJ9E3P6VgM2yY4rOBH4w=="],
 
     "ofetch": ["ofetch@2.0.0-alpha.3", "", {}, "sha512-zpYTCs2byOuft65vI3z43Dd6iSdFbOZZLb9/d21aCpx2rGastVU9dOCv0lu4ykc1Ur1anAYjDi3SUvR0vq50JA=="],
 
@@ -2076,7 +2407,9 @@
 
     "onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
 
-    "openai": ["openai@6.34.0", "", { "peerDependencies": { "ws": "^8.18.0", "zod": "^3.25 || ^4.0" }, "optionalPeers": ["ws", "zod"], "bin": { "openai": "bin/cli" } }, "sha512-yEr2jdGf4tVFYG6ohmr3pF6VJuveP0EA/sS8TBx+4Eq5NT10alu5zg2dmxMXMgqpihRDQlFGpRt2XwsGj+Fyxw=="],
+    "open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],
+
+    "openai": ["openai@6.42.0", "", { "peerDependencies": { "ws": "^8.18.0", "zod": "^3.25 || ^4.0" }, "optionalPeers": ["ws", "zod"] }, "sha512-1WFEt/uXMXOLhYRNkgJWo08Y2YNvNwpVU72K7ibrWgWpNOXd4VojXLbe6SQ4bLiUQ3Y8jz4IiyVkylJCL1DtZg=="],
 
     "optionator": ["optionator@0.9.4", "", { "dependencies": { "deep-is": "^0.1.3", "fast-levenshtein": "^2.0.6", "levn": "^0.4.1", "prelude-ls": "^1.2.1", "type-check": "^0.4.0", "word-wrap": "^1.2.5" } }, "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g=="],
 
@@ -2098,8 +2431,16 @@
 
     "p-try": ["p-try@2.2.0", "", {}, "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ=="],
 
+    "package-json-from-dist": ["package-json-from-dist@1.0.1", "", {}, "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw=="],
+
     "papaparse": ["papaparse@5.5.3", "", {}, "sha512-5QvjGxYVjxO59MGU2lHVYpRWBBtKHnlIAcSe1uNFCkkptUh63NFRj0FJQm7nR67puEruUci/ZkjmEFrjCAyP4A=="],
 
+    "parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
+
+    "parse5-htmlparser2-tree-adapter": ["parse5-htmlparser2-tree-adapter@7.1.0", "", { "dependencies": { "domhandler": "^5.0.3", "parse5": "^7.0.0" } }, "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g=="],
+
+    "parse5-parser-stream": ["parse5-parser-stream@7.1.2", "", { "dependencies": { "parse5": "^7.0.0" } }, "sha512-JyeQc9iwFLn5TbvvqACIF/VXG6abODeB3Fwmv/TGdLk2LfbWkaySGY72at4+Ty7EkPZj854u4CrICqNk2qIbow=="],
+
     "parseley": ["parseley@0.12.1", "", { "dependencies": { "leac": "^0.6.0", "peberminta": "^0.9.0" } }, "sha512-e6qHKe3a9HWr0oMRVDTRhKce+bRO8VGQR3NyVwcjwrbhMmFCX9KszEV35+rn4AdilFAq9VPxP/Fe1wC9Qjd2lw=="],
 
     "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
@@ -2112,12 +2453,16 @@
 
     "path-parse": ["path-parse@1.0.7", "", {}, "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="],
 
+    "path-scurry": ["path-scurry@2.0.2", "", { "dependencies": { "lru-cache": "^11.0.0", "minipass": "^7.1.2" } }, "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg=="],
+
     "path-to-regexp": ["path-to-regexp@8.4.2", "", {}, "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA=="],
 
     "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
 
     "peberminta": ["peberminta@0.9.0", "", {}, "sha512-XIxfHpEuSJbITd1H3EeQwpcZbTLHc+VVr8ANI9t5sit565tsI4/xK3KWTUFE2e6QiangUkh3B0jihzmGnNrRsQ=="],
 
+    "perfect-debounce": ["perfect-debounce@2.1.0", "", {}, "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g=="],
+
     "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
 
     "picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
@@ -2132,11 +2477,11 @@
 
     "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="],
 
-    "pkg-types": ["pkg-types@1.3.1", "", { "dependencies": { "confbox": "^0.1.8", "mlly": "^1.7.4", "pathe": "^2.0.1" } }, "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ=="],
+    "pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
 
-    "playwright": ["playwright@1.59.1", "", { "dependencies": { "playwright-core": "1.59.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw=="],
+    "playwright": ["playwright@1.61.0", "", { "dependencies": { "playwright-core": "1.61.0" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-Z+7BeeqQPRRzklHsVFP4KTGIyMxKUmfeRA4WisM6G3/XW6nwGeX6fX9qYaDa+CiUqpOkb2f6X3nar05R3kSuJQ=="],
 
-    "playwright-core": ["playwright-core@1.59.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg=="],
+    "playwright-core": ["playwright-core@1.61.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-caX7TrY3Ml6egyDX0WUcTHDxodl/b51y5wJOdCEA36QviK/s2g081hvmGs8eaE3DWb6NYZQ6BjO/QkNRPenoPA=="],
 
     "pngjs": ["pngjs@5.0.0", "", {}, "sha512-40QW5YalBNfQo5yRYmiw7Yz6TKKVr3h6970B2YE+3fQpsWcrbj1PzJgxeJ19DRQjhMbKPIuMY8rFaXc8moolVw=="],
 
@@ -2144,7 +2489,7 @@
 
     "postal-mime": ["postal-mime@2.7.4", "", {}, "sha512-0WdnFQYUrPGGTFu1uOqD2s7omwua8xaeYGdO6rb88oD5yJ/4pPHDA4sdWqfD8wQVfCny563n/HQS7zTFft+f/g=="],
 
-    "postcss": ["postcss@8.5.10", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ=="],
+    "postcss": ["postcss@8.5.15", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A=="],
 
     "postcss-load-config": ["postcss-load-config@6.0.1", "", { "dependencies": { "lilconfig": "^3.1.1" }, "peerDependencies": { "jiti": ">=1.21.0", "postcss": ">=8.0.9", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["jiti", "postcss", "tsx", "yaml"] }, "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g=="],
 
@@ -2152,14 +2497,22 @@
 
     "postgres": ["postgres@3.4.9", "", {}, "sha512-GD3qdB0x1z9xgFI6cdRD6xu2Sp2WCOEoe3mtnyB5Ee0XrrL5Pe+e4CCnJrRMnL1zYtRDZmQQVbvOttLnKDLnaw=="],
 
+    "powershell-utils": ["powershell-utils@0.1.0", "", {}, "sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A=="],
+
     "prelude-ls": ["prelude-ls@1.2.1", "", {}, "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g=="],
 
     "prettier": ["prettier@3.8.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw=="],
 
+    "pretty-bytes": ["pretty-bytes@7.1.0", "", {}, "sha512-nODzvTiYVRGRqAOvE84Vk5JDPyyxsVk0/fbA/bq7RqlnhksGpset09XTxbpvLTIjoaF7K8Z8DG8yHtKGTPSYRw=="],
+
     "pretty-format": ["pretty-format@27.5.1", "", { "dependencies": { "ansi-regex": "^5.0.1", "ansi-styles": "^5.0.0", "react-is": "^17.0.1" } }, "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ=="],
 
     "prismjs": ["prismjs@1.30.0", "", {}, "sha512-DEvV2ZF2r2/63V+tK8hQvrR2ZGn10srHbXviTlcv7Kpzw8jWiNTqbVgjO3IY8RxrrOUF8VPMQQFysYYYv0YZxw=="],
 
+    "process": ["process@0.11.10", "", {}, "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A=="],
+
+    "process-nextick-args": ["process-nextick-args@2.0.1", "", {}, "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag=="],
+
     "process-warning": ["process-warning@5.0.0", "", {}, "sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA=="],
 
     "prop-types": ["prop-types@15.8.1", "", { "dependencies": { "loose-envify": "^1.4.0", "object-assign": "^4.1.1", "react-is": "^16.13.1" } }, "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg=="],
@@ -2176,7 +2529,7 @@
 
     "prosemirror-keymap": ["prosemirror-keymap@1.2.3", "", { "dependencies": { "prosemirror-state": "^1.0.0", "w3c-keyname": "^2.2.0" } }, "sha512-4HucRlpiLd1IPQQXNqeo81BGtkY8Ai5smHhKW9jjPKRc2wQIxksg7Hl1tTI2IfT2B/LgX6bfYvXxEpJl7aKYKw=="],
 
-    "prosemirror-model": ["prosemirror-model@1.25.4", "", { "dependencies": { "orderedmap": "^2.0.0" } }, "sha512-PIM7E43PBxKce8OQeezAs9j4TP+5yDpZVbuurd1h5phUxEKIu+G2a+EUZzIC5nS1mJktDJWzbqS23n1tsAf5QA=="],
+    "prosemirror-model": ["prosemirror-model@1.25.9", "", { "dependencies": { "orderedmap": "^2.0.0" } }, "sha512-pRTklkDDMMRopyoAcrr9wV/8g/RYgrLHBuJAb5hlEuYZRdm5yqmPjWId83fpBwPpSFqEdja0H7Dfd7z1X/npcA=="],
 
     "prosemirror-schema-list": ["prosemirror-schema-list@1.5.1", "", { "dependencies": { "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.7.3" } }, "sha512-927lFx/uwyQaGwJxLWCZRkjXG0p48KpMj6ueoYiu4JX05GGuGcgzAy62dfiV8eFZftgyBUvLx76RsMe20fJl+Q=="],
 
@@ -2186,7 +2539,7 @@
 
     "prosemirror-transform": ["prosemirror-transform@1.12.0", "", { "dependencies": { "prosemirror-model": "^1.21.0" } }, "sha512-GxboyN4AMIsoHNtz5uf2r2Ru551i5hWeCMD6E2Ib4Eogqoub0NflniaBPVQ4MrGE5yZ8JV9tUHg9qcZTTrcN4w=="],
 
-    "prosemirror-view": ["prosemirror-view@1.41.8", "", { "dependencies": { "prosemirror-model": "^1.20.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0" } }, "sha512-TnKDdohEatgyZNGCDWIdccOHXhYloJwbwU+phw/a23KBvJIR9lWQWW7WHHK3vBdOLDNuF7TaX98GObUZOWkOnA=="],
+    "prosemirror-view": ["prosemirror-view@1.41.9", "", { "dependencies": { "prosemirror-model": "^1.25.8", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0" } }, "sha512-clTunTX+eaLbr87L1V1QPheRlEQJyTlL3gXe9x3jQIk3rL0RVWxviDGz8tFaydwIVm+hKhYCyr+R/zBtWr9s6A=="],
 
     "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="],
 
@@ -2196,31 +2549,41 @@
 
     "qrcode": ["qrcode@1.5.4", "", { "dependencies": { "dijkstrajs": "^1.0.1", "pngjs": "^5.0.0", "yargs": "^15.3.1" }, "bin": { "qrcode": "bin/qrcode" } }, "sha512-1ca71Zgiu6ORjHqFBDpnSMTR2ReToX4l1Au1VFLyVeBTFavzQnv5JxMFr3ukHVKpSrSA2MCk0lNJSykjUfz7Zg=="],
 
-    "qs": ["qs@6.15.1", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg=="],
+    "qs": ["qs@6.15.2", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw=="],
+
+    "quansync": ["quansync@0.2.11", "", {}, "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA=="],
+
+    "queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
 
     "quick-format-unescaped": ["quick-format-unescaped@4.0.4", "", {}, "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg=="],
 
-    "radix-ui": ["radix-ui@1.4.3", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-accessible-icon": "1.1.7", "@radix-ui/react-accordion": "1.2.12", "@radix-ui/react-alert-dialog": "1.1.15", "@radix-ui/react-arrow": "1.1.7", "@radix-ui/react-aspect-ratio": "1.1.7", "@radix-ui/react-avatar": "1.1.10", "@radix-ui/react-checkbox": "1.3.3", "@radix-ui/react-collapsible": "1.1.12", "@radix-ui/react-collection": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-context-menu": "2.2.16", "@radix-ui/react-dialog": "1.1.15", "@radix-ui/react-direction": "1.1.1", "@radix-ui/react-dismissable-layer": "1.1.11", "@radix-ui/react-dropdown-menu": "2.1.16", "@radix-ui/react-focus-guards": "1.1.3", "@radix-ui/react-focus-scope": "1.1.7", "@radix-ui/react-form": "0.1.8", "@radix-ui/react-hover-card": "1.1.15", "@radix-ui/react-label": "2.1.7", "@radix-ui/react-menu": "2.1.16", "@radix-ui/react-menubar": "1.1.16", "@radix-ui/react-navigation-menu": "1.2.14", "@radix-ui/react-one-time-password-field": "0.1.8", "@radix-ui/react-password-toggle-field": "0.1.3", "@radix-ui/react-popover": "1.1.15", "@radix-ui/react-popper": "1.2.8", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.5", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-progress": "1.1.7", "@radix-ui/react-radio-group": "1.3.8", "@radix-ui/react-roving-focus": "1.1.11", "@radix-ui/react-scroll-area": "1.2.10", "@radix-ui/react-select": "2.2.6", "@radix-ui/react-separator": "1.1.7", "@radix-ui/react-slider": "1.3.6", "@radix-ui/react-slot": "1.2.3", "@radix-ui/react-switch": "1.2.6", "@radix-ui/react-tabs": "1.1.13", "@radix-ui/react-toast": "1.2.15", "@radix-ui/react-toggle": "1.1.10", "@radix-ui/react-toggle-group": "1.1.11", "@radix-ui/react-toolbar": "1.1.11", "@radix-ui/react-tooltip": "1.2.8", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-controllable-state": "1.2.2", "@radix-ui/react-use-effect-event": "0.0.2", "@radix-ui/react-use-escape-keydown": "1.1.1", "@radix-ui/react-use-is-hydrated": "0.1.0", "@radix-ui/react-use-layout-effect": "1.1.1", "@radix-ui/react-use-size": "1.1.1", "@radix-ui/react-visually-hidden": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-aWizCQiyeAenIdUbqEpXgRA1ya65P13NKn/W8rWkcN0OPkRDxdBVLWnIEDsS2RpwCK2nobI7oMUSmexzTDyAmA=="],
+    "radix-ui": ["radix-ui@1.6.0", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-accessible-icon": "1.1.10", "@radix-ui/react-accordion": "1.2.14", "@radix-ui/react-alert-dialog": "1.1.17", "@radix-ui/react-arrow": "1.1.10", "@radix-ui/react-aspect-ratio": "1.1.10", "@radix-ui/react-avatar": "1.2.0", "@radix-ui/react-checkbox": "1.3.5", "@radix-ui/react-collapsible": "1.1.14", "@radix-ui/react-collection": "1.1.10", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-context-menu": "2.3.1", "@radix-ui/react-dialog": "1.1.17", "@radix-ui/react-direction": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-dropdown-menu": "2.1.18", "@radix-ui/react-focus-guards": "1.1.4", "@radix-ui/react-focus-scope": "1.1.10", "@radix-ui/react-form": "0.1.10", "@radix-ui/react-hover-card": "1.1.17", "@radix-ui/react-label": "2.1.10", "@radix-ui/react-menu": "2.1.18", "@radix-ui/react-menubar": "1.1.18", "@radix-ui/react-navigation-menu": "1.2.16", "@radix-ui/react-one-time-password-field": "0.1.10", "@radix-ui/react-password-toggle-field": "0.1.5", "@radix-ui/react-popover": "1.1.17", "@radix-ui/react-popper": "1.3.1", "@radix-ui/react-portal": "1.1.12", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-progress": "1.1.10", "@radix-ui/react-radio-group": "1.4.1", "@radix-ui/react-roving-focus": "1.1.13", "@radix-ui/react-scroll-area": "1.2.12", "@radix-ui/react-select": "2.3.1", "@radix-ui/react-separator": "1.1.10", "@radix-ui/react-slider": "1.4.1", "@radix-ui/react-slot": "1.3.0", "@radix-ui/react-switch": "1.3.1", "@radix-ui/react-tabs": "1.1.15", "@radix-ui/react-toast": "1.2.17", "@radix-ui/react-toggle": "1.1.12", "@radix-ui/react-toggle-group": "1.1.13", "@radix-ui/react-toolbar": "1.1.13", "@radix-ui/react-tooltip": "1.2.10", "@radix-ui/react-use-callback-ref": "1.1.2", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-use-effect-event": "0.0.3", "@radix-ui/react-use-escape-keydown": "1.1.2", "@radix-ui/react-use-is-hydrated": "0.1.1", "@radix-ui/react-use-layout-effect": "1.1.2", "@radix-ui/react-use-size": "1.1.2", "@radix-ui/react-visually-hidden": "1.2.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-EUEC70O03EgxWMP5aoqfBZ6iLC5bczFagGy7zhSYRt8o5DP7IWNiP3ywetse3L9b8843ExB0OGWZvgbYVJuNeg=="],
+
+    "radix3": ["radix3@1.1.2", "", {}, "sha512-b484I/7b8rDEdSDKckSSBA8knMpcdsXudlE/LNL639wFoHKwLbEkQFZHWEYwDC0wa0FKUcCY+GAF73Z7wxNVFA=="],
 
     "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="],
 
     "raw-body": ["raw-body@3.0.2", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.7.0", "unpipe": "~1.0.0" } }, "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA=="],
 
-    "react": ["react@19.2.5", "", {}, "sha512-llUJLzz1zTUBrskt2pwZgLq59AemifIftw4aB7JxOqf1HY2FDaGDxgwpAPVzHU1kdWabH7FauP4i1oEeer2WCA=="],
+    "rc9": ["rc9@3.0.1", "", { "dependencies": { "defu": "^6.1.6", "destr": "^2.0.5" } }, "sha512-gMDyleLWVE+i6Sgtc0QbbY6pEKqYs97NGi6isHQPqYlLemPoO8dxQ3uGi0f4NiP98c+jMW6cG1Kx9dDwfvqARQ=="],
+
+    "react": ["react@19.2.7", "", {}, "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ=="],
 
     "react-day-picker": ["react-day-picker@9.14.0", "", { "dependencies": { "@date-fns/tz": "^1.4.1", "@tabby_ai/hijri-converter": "1.0.5", "date-fns": "^4.1.0", "date-fns-jalali": "4.1.0-0" }, "peerDependencies": { "react": ">=16.8.0" } }, "sha512-tBaoDWjPwe0M5pGrum4H0SR6Lyk+BO9oHnp9JbKpGKW2mlraNPgP9BMfsg5pWpwrssARmeqk7YBl2oXutZTaHA=="],
 
-    "react-dom": ["react-dom@19.2.5", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.5" } }, "sha512-J5bAZz+DXMMwW/wV3xzKke59Af6CHY7G4uYLN1OvBcKEsWOs4pQExj86BBKamxl/Ik5bx9whOrvBlSDfWzgSag=="],
+    "react-dom": ["react-dom@19.2.7", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.7" } }, "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ=="],
 
     "react-easy-crop": ["react-easy-crop@5.5.7", "", { "dependencies": { "normalize-wheel": "^1.0.1", "tslib": "^2.0.1" }, "peerDependencies": { "react": ">=16.4.0", "react-dom": ">=16.4.0" } }, "sha512-kYo4NtMeXFQB7h1U+h5yhUkE46WQbQdq7if54uDlbMdZHdRgNehfvaFrXnFw5NR1PNoUOJIfTwLnWmEx/MaZnA=="],
 
-    "react-hook-form": ["react-hook-form@7.72.1", "", { "peerDependencies": { "react": "^16.8.0 || ^17 || ^18 || ^19" } }, "sha512-RhwBoy2ygeVZje+C+bwJ8g0NjTdBmDlJvAUHTxRjTmSUKPYsKfMphkS2sgEMotsY03bP358yEYlnUeZy//D9Ig=="],
+    "react-hook-form": ["react-hook-form@7.79.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17 || ^18 || ^19" } }, "sha512-mhYp/MTmXvzYX6AJcJVko0rktoIhhmRnEouObj4wF5i/tCttgJvnp1+9wRkpITZjDTqpo4IOSJqu0dBlPlV/Lw=="],
 
-    "react-intl": ["react-intl@10.1.2", "", { "dependencies": { "@formatjs/icu-messageformat-parser": "3.5.4", "@formatjs/intl": "4.1.6", "intl-messageformat": "11.2.1" }, "peerDependencies": { "@types/react": "19", "react": "19" } }, "sha512-53iYLo+Sl6Qw1+/7VJ2v7mB2A8XHYeVFRujmoo8qVvvym4/WL9COKCcXKUyCYBwKgZNghKrgyQILx7qbrsdZ/w=="],
+    "react-intl": ["react-intl@10.1.13", "", { "dependencies": { "@formatjs/icu-messageformat-parser": "3.5.11", "@formatjs/intl": "4.1.13", "intl-messageformat": "11.2.8" }, "peerDependencies": { "@types/react": "19", "react": "19" } }, "sha512-3aKnIOIPN6CWsu3jqPpYMlJZ2U0Qnxhd42xGWQNdGIknK/gBudWOHSIx9vN4XKkITokJLr7YTgs4yLUGtbvP9g=="],
 
     "react-is": ["react-is@17.0.2", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="],
 
-    "react-redux": ["react-redux@9.2.0", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "use-sync-external-store": "^1.4.0" }, "peerDependencies": { "@types/react": "^18.2.25 || ^19", "react": "^18.0 || ^19", "redux": "^5.0.0" }, "optionalPeers": ["@types/react", "redux"] }, "sha512-ROY9fvHhwOD9ySfrF0wmvu//bKCQ6AeZZq1nJNtbDC+kk5DuSuNX/n6YWYF/SYy7bSba4D4FSz8DJeKY/S/r+g=="],
+    "react-redux": ["react-redux@9.3.0", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "use-sync-external-store": "^1.4.0" }, "peerDependencies": { "@types/react": "^18.2.25 || ^19", "react": "^18.0 || ^19", "redux": "^5.0.0" }, "optionalPeers": ["@types/react", "redux"] }, "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g=="],
+
+    "react-refresh": ["react-refresh@0.17.0", "", {}, "sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ=="],
 
     "react-remove-scroll": ["react-remove-scroll@2.7.2", "", { "dependencies": { "react-remove-scroll-bar": "^2.3.7", "react-style-singleton": "^2.2.3", "tslib": "^2.1.0", "use-callback-ref": "^1.3.3", "use-sidecar": "^1.1.3" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q=="],
 
@@ -2228,10 +2591,16 @@
 
     "react-style-singleton": ["react-style-singleton@2.2.3", "", { "dependencies": { "get-nonce": "^1.0.0", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ=="],
 
+    "readable-stream": ["readable-stream@4.7.0", "", { "dependencies": { "abort-controller": "^3.0.0", "buffer": "^6.0.3", "events": "^3.3.0", "process": "^0.11.10", "string_decoder": "^1.3.0" } }, "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg=="],
+
+    "readdir-glob": ["readdir-glob@1.1.3", "", { "dependencies": { "minimatch": "^5.1.0" } }, "sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA=="],
+
     "readdirp": ["readdirp@4.1.2", "", {}, "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="],
 
     "real-require": ["real-require@0.2.0", "", {}, "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg=="],
 
+    "recast": ["recast@0.23.11", "", { "dependencies": { "ast-types": "^0.16.1", "esprima": "~4.0.0", "source-map": "~0.6.1", "tiny-invariant": "^1.3.3", "tslib": "^2.0.1" } }, "sha512-YTUo+Flmw4ZXiWfQKGcwwc11KnoRAYgzAE2E7mXKCjSviTKShtxBsN6YUUBB2gtaBzKzeKunxhUwNHQuRryhWA=="],
+
     "recharts": ["recharts@3.8.1", "", { "dependencies": { "@reduxjs/toolkit": "^1.9.0 || 2.x.x", "clsx": "^2.1.1", "decimal.js-light": "^2.5.1", "es-toolkit": "^1.39.3", "eventemitter3": "^5.0.1", "immer": "^10.1.1", "react-redux": "8.x.x || 9.x.x", "reselect": "5.1.1", "tiny-invariant": "^1.3.3", "use-sync-external-store": "^1.2.2", "victory-vendor": "^37.0.2" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-mwzmO1s9sFL0TduUpwndxCUNoXsBw3u3E/0+A+cLcrSfQitSG62L32N69GhqUrrT5qKcAE3pCGVINC6pqkBBQg=="],
 
     "redent": ["redent@3.0.0", "", { "dependencies": { "indent-string": "^4.0.0", "strip-indent": "^3.0.0" } }, "sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg=="],
@@ -2254,11 +2623,13 @@
 
     "require-main-filename": ["require-main-filename@2.0.0", "", {}, "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg=="],
 
+    "requires-port": ["requires-port@1.0.0", "", {}, "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ=="],
+
     "reselect": ["reselect@5.1.1", "", {}, "sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w=="],
 
-    "resend": ["resend@6.12.0", "", { "dependencies": { "postal-mime": "2.7.4", "svix": "1.90.0" }, "peerDependencies": { "@react-email/render": "*" }, "optionalPeers": ["@react-email/render"] }, "sha512-CaxEvX1z+/MGbgnhsM/bvmkbnZd1v1sEXELAjBNSDBQNMaB7MgqOyrBgI27CYikEgdaDnBrXghAXYWTBs/h5Bw=="],
+    "resend": ["resend@6.12.4", "", { "dependencies": { "postal-mime": "2.7.4", "standardwebhooks": "1.0.0" }, "peerDependencies": { "@react-email/render": "*" }, "optionalPeers": ["@react-email/render"] }, "sha512-lRpJ2Hxd+ht+JPDm97juRcUp9HOMuZyxaRFRFmc9Tx8iNWiei94Dx9v6SWufgKk2667C/uCeKKspMotOHSpCSg=="],
 
-    "resolve": ["resolve@2.0.0-next.6", "", { "dependencies": { "es-errors": "^1.3.0", "is-core-module": "^2.16.1", "node-exports-info": "^1.6.0", "object-keys": "^1.1.1", "path-parse": "^1.0.7", "supports-preserve-symlinks-flag": "^1.0.0" }, "bin": { "resolve": "bin/resolve" } }, "sha512-3JmVl5hMGtJ3kMmB3zi3DL25KfkCEyy3Tw7Gmw7z5w8M9WlwoPFnIvwChzu1+cF3iaK3sp18hhPz8ANeimdJfA=="],
+    "resolve": ["resolve@2.0.0-next.7", "", { "dependencies": { "es-errors": "^1.3.0", "is-core-module": "^2.16.2", "node-exports-info": "^1.6.0", "object-keys": "^1.1.1", "path-parse": "^1.0.7", "supports-preserve-symlinks-flag": "^1.0.0" }, "bin": { "resolve": "bin/resolve" } }, "sha512-tqt+NBWwyaMgw3zDsnygx4CByWjQEJHOPMdslYhppaQSJUtL/D4JO9CcBBlhPoI8lz9oJIDXkwXfhF4aWqP8xQ=="],
 
     "resolve-from": ["resolve-from@5.0.0", "", {}, "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw=="],
 
@@ -2268,11 +2639,15 @@
 
     "retry": ["retry@0.13.1", "", {}, "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg=="],
 
+    "reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="],
+
     "rfdc": ["rfdc@1.4.1", "", {}, "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA=="],
 
-    "rolldown": ["rolldown@1.0.0-rc.16", "", { "dependencies": { "@oxc-project/types": "=0.126.0", "@rolldown/pluginutils": "1.0.0-rc.16" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.0-rc.16", "@rolldown/binding-darwin-arm64": "1.0.0-rc.16", "@rolldown/binding-darwin-x64": "1.0.0-rc.16", "@rolldown/binding-freebsd-x64": "1.0.0-rc.16", "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.16", "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.16", "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.16", "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.16", "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.16", "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.16", "@rolldown/binding-linux-x64-musl": "1.0.0-rc.16", "@rolldown/binding-openharmony-arm64": "1.0.0-rc.16", "@rolldown/binding-wasm32-wasi": "1.0.0-rc.16", "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.16", "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.16" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-rzi5WqKzEZw3SooTt7cgm4eqIoujPIyGcJNGFL7iPEuajQw7vxMHUkXylu4/vhCkJGXsgRmxqMKXUpT6FEgl0g=="],
+    "rolldown": ["rolldown@1.0.3", "", { "dependencies": { "@oxc-project/types": "=0.133.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.3", "@rolldown/binding-darwin-arm64": "1.0.3", "@rolldown/binding-darwin-x64": "1.0.3", "@rolldown/binding-freebsd-x64": "1.0.3", "@rolldown/binding-linux-arm-gnueabihf": "1.0.3", "@rolldown/binding-linux-arm64-gnu": "1.0.3", "@rolldown/binding-linux-arm64-musl": "1.0.3", "@rolldown/binding-linux-ppc64-gnu": "1.0.3", "@rolldown/binding-linux-s390x-gnu": "1.0.3", "@rolldown/binding-linux-x64-gnu": "1.0.3", "@rolldown/binding-linux-x64-musl": "1.0.3", "@rolldown/binding-openharmony-arm64": "1.0.3", "@rolldown/binding-wasm32-wasi": "1.0.3", "@rolldown/binding-win32-arm64-msvc": "1.0.3", "@rolldown/binding-win32-x64-msvc": "1.0.3" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g=="],
+
+    "rollup": ["rollup@4.62.0", "", { "dependencies": { "@types/estree": "1.0.9" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.62.0", "@rollup/rollup-android-arm64": "4.62.0", "@rollup/rollup-darwin-arm64": "4.62.0", "@rollup/rollup-darwin-x64": "4.62.0", "@rollup/rollup-freebsd-arm64": "4.62.0", "@rollup/rollup-freebsd-x64": "4.62.0", "@rollup/rollup-linux-arm-gnueabihf": "4.62.0", "@rollup/rollup-linux-arm-musleabihf": "4.62.0", "@rollup/rollup-linux-arm64-gnu": "4.62.0", "@rollup/rollup-linux-arm64-musl": "4.62.0", "@rollup/rollup-linux-loong64-gnu": "4.62.0", "@rollup/rollup-linux-loong64-musl": "4.62.0", "@rollup/rollup-linux-ppc64-gnu": "4.62.0", "@rollup/rollup-linux-ppc64-musl": "4.62.0", "@rollup/rollup-linux-riscv64-gnu": "4.62.0", "@rollup/rollup-linux-riscv64-musl": "4.62.0", "@rollup/rollup-linux-s390x-gnu": "4.62.0", "@rollup/rollup-linux-x64-gnu": "4.62.0", "@rollup/rollup-linux-x64-musl": "4.62.0", "@rollup/rollup-openbsd-x64": "4.62.0", "@rollup/rollup-openharmony-arm64": "4.62.0", "@rollup/rollup-win32-arm64-msvc": "4.62.0", "@rollup/rollup-win32-ia32-msvc": "4.62.0", "@rollup/rollup-win32-x64-gnu": "4.62.0", "@rollup/rollup-win32-x64-msvc": "4.62.0", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-nc72Wgq62I7rtDV4izT5/aaS0zxy3kttkinf9586ApknY3jZO9NYsmtc24fUckA0X7Q2v+ML4a15pdUlV5V/jA=="],
 
-    "rollup": ["rollup@4.60.1", "", { "dependencies": { "@types/estree": "1.0.8" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.60.1", "@rollup/rollup-android-arm64": "4.60.1", "@rollup/rollup-darwin-arm64": "4.60.1", "@rollup/rollup-darwin-x64": "4.60.1", "@rollup/rollup-freebsd-arm64": "4.60.1", "@rollup/rollup-freebsd-x64": "4.60.1", "@rollup/rollup-linux-arm-gnueabihf": "4.60.1", "@rollup/rollup-linux-arm-musleabihf": "4.60.1", "@rollup/rollup-linux-arm64-gnu": "4.60.1", "@rollup/rollup-linux-arm64-musl": "4.60.1", "@rollup/rollup-linux-loong64-gnu": "4.60.1", "@rollup/rollup-linux-loong64-musl": "4.60.1", "@rollup/rollup-linux-ppc64-gnu": "4.60.1", "@rollup/rollup-linux-ppc64-musl": "4.60.1", "@rollup/rollup-linux-riscv64-gnu": "4.60.1", "@rollup/rollup-linux-riscv64-musl": "4.60.1", "@rollup/rollup-linux-s390x-gnu": "4.60.1", "@rollup/rollup-linux-x64-gnu": "4.60.1", "@rollup/rollup-linux-x64-musl": "4.60.1", "@rollup/rollup-openbsd-x64": "4.60.1", "@rollup/rollup-openharmony-arm64": "4.60.1", "@rollup/rollup-win32-arm64-msvc": "4.60.1", "@rollup/rollup-win32-ia32-msvc": "4.60.1", "@rollup/rollup-win32-x64-gnu": "4.60.1", "@rollup/rollup-win32-x64-msvc": "4.60.1", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w=="],
+    "rollup-plugin-visualizer": ["rollup-plugin-visualizer@7.0.1", "", { "dependencies": { "open": "^11.0.0", "picomatch": "^4.0.2", "source-map": "^0.7.4", "yargs": "^18.0.0" }, "peerDependencies": { "rolldown": "1.x || ^1.0.0-beta || ^1.0.0-rc", "rollup": "2.x || 3.x || 4.x" }, "optionalPeers": ["rolldown", "rollup"], "bin": { "rollup-plugin-visualizer": "dist/bin/cli.js" } }, "sha512-UJUT4+1Ho4OcWmPYU3sYXgUqI8B8Ayfe06MX7y0qCJ1K8aGoKtR/NDd/2nZqM7ADkrzny+I99Ul7GgyoiVNAgg=="],
 
     "rope-sequence": ["rope-sequence@1.3.4", "", {}, "sha512-UT5EDe2cu2E/6O4igUr5PSFs23nvvukicWHx6GnOPlHAiiYbzNuCRQCuiUdHJQcqKalLKlrYJnjY0ySGsXNQXQ=="],
 
@@ -2280,7 +2655,13 @@
 
     "router": ["router@2.2.0", "", { "dependencies": { "debug": "^4.4.0", "depd": "^2.0.0", "is-promise": "^4.0.0", "parseurl": "^1.3.3", "path-to-regexp": "^8.0.0" } }, "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ=="],
 
-    "safe-array-concat": ["safe-array-concat@1.1.3", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.2", "get-intrinsic": "^1.2.6", "has-symbols": "^1.1.0", "isarray": "^2.0.5" } }, "sha512-AURm5f0jYEOydBj7VQlVvDrjeFgthDdEF5H1dP+6mNpoXOMo1quQqJ4wvJDyRZ9+pO3kGWoOdmV08cSv2aJV6Q=="],
+    "run-applescript": ["run-applescript@7.1.0", "", {}, "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q=="],
+
+    "run-parallel": ["run-parallel@1.2.0", "", { "dependencies": { "queue-microtask": "^1.2.2" } }, "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA=="],
+
+    "safe-array-concat": ["safe-array-concat@1.1.4", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "get-intrinsic": "^1.3.0", "has-symbols": "^1.1.0", "isarray": "^2.0.5" } }, "sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg=="],
+
+    "safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
 
     "safe-push-apply": ["safe-push-apply@1.0.0", "", { "dependencies": { "es-errors": "^1.3.0", "isarray": "^2.0.5" } }, "sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA=="],
 
@@ -2292,16 +2673,22 @@
 
     "scheduler": ["scheduler@0.27.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
 
+    "scule": ["scule@1.3.0", "", {}, "sha512-6FtHJEvt+pVMIB9IBY+IcCJ6Z5f1iQnytgyfKMhDKgmzYG+TeH/wx1y3l27rshSbLiSanrR9ffZDrEsmjlQF2g=="],
+
     "selderee": ["selderee@0.11.0", "", { "dependencies": { "parseley": "^0.12.0" } }, "sha512-5TF+l7p4+OsnP8BCCvSyZiSPc4x4//p5uPwK8TCnVPJYRmU2aYKMpOXvw8zM5a5JvuuCGN1jmsMwuU2W02ukfA=="],
 
     "semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
     "send": ["send@1.2.1", "", { "dependencies": { "debug": "^4.4.3", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "fresh": "^2.0.0", "http-errors": "^2.0.1", "mime-types": "^3.0.2", "ms": "^2.1.3", "on-finished": "^2.4.1", "range-parser": "^1.2.1", "statuses": "^2.0.2" } }, "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ=="],
 
+    "serialize-javascript": ["serialize-javascript@7.0.5", "", {}, "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw=="],
+
     "seroval": ["seroval@1.5.4", "", {}, "sha512-46uFvgrXTVxZcUorgSSRZ4y+ieqLLQRMlG4bnCZKW3qI6BZm7Rg4ntMW4p1mILEEBZWrFlcpp0AyIIlM6jD9iw=="],
 
     "seroval-plugins": ["seroval-plugins@1.5.4", "", { "peerDependencies": { "seroval": "^1.0" } }, "sha512-S0xQPhUTefAhNvNWFg0c1J8qJArHt5KdtJ/cFAofo06KD1MVSeFWyl4iiu+ApDIuw0WhjpOfCdgConOfAnLgkw=="],
 
+    "serve-placeholder": ["serve-placeholder@2.0.2", "", { "dependencies": { "defu": "^6.1.4" } }, "sha512-/TMG8SboeiQbZJWRlfTCqMs2DD3SZgWp0kDQePz9yUuCnDfDh/92gf7/PxGhzXTKBIPASIHxFcZndoNbp6QOLQ=="],
+
     "serve-static": ["serve-static@2.2.1", "", { "dependencies": { "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "parseurl": "^1.3.3", "send": "^1.2.0" } }, "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw=="],
 
     "set-blocking": ["set-blocking@2.0.0", "", {}, "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw=="],
@@ -2322,7 +2709,7 @@
 
     "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
 
-    "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="],
+    "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="],
 
     "side-channel-list": ["side-channel-list@1.0.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4" } }, "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w=="],
 
@@ -2334,10 +2721,14 @@
 
     "signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
 
+    "slash": ["slash@5.1.0", "", {}, "sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg=="],
+
     "slice-ansi": ["slice-ansi@8.0.0", "", { "dependencies": { "ansi-styles": "^6.2.3", "is-fullwidth-code-point": "^5.1.0" } }, "sha512-stxByr12oeeOyY2BlviTNQlYV5xOj47GirPr4yA1hE9JCtxfQN0+tVbkxwCtYDQWhEKWFHsEK48ORg5jrouCAg=="],
 
     "slugify": ["slugify@1.6.9", "", {}, "sha512-vZ7rfeehZui7wQs438JXBckYLkIIdfHOXsaVEUMyS5fHo1483l1bMdo0EDSWYclY0yZKFOipDy4KHuKs6ssvdg=="],
 
+    "smob": ["smob@1.6.2", "", {}, "sha512-RQsvleCbF8cVHEv+xuDGaA4pOizFqJ0GgjtMSRo6oP8pnN7WsigHgVGey6aILRBKv4W2YOMHLqbKdnB6hpB9fw=="],
+
     "sonic-boom": ["sonic-boom@4.2.1", "", { "dependencies": { "atomic-sleep": "^1.0.0" } }, "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q=="],
 
     "sonner": ["sonner@2.0.7", "", { "peerDependencies": { "react": "^18.0.0 || ^19.0.0 || ^19.0.0-rc", "react-dom": "^18.0.0 || ^19.0.0 || ^19.0.0-rc" } }, "sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w=="],
@@ -2350,7 +2741,9 @@
 
     "split2": ["split2@4.2.0", "", {}, "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg=="],
 
-    "srvx": ["srvx@0.11.15", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-iXsux0UcOjdvs0LCMa2Ws3WwcDUozA3JN3BquNXkaFPP7TpRqgunKdEgoZ/uwb1J6xaYHfxtz9Twlh6yzwM6Tg=="],
+    "sprintf-js": ["sprintf-js@1.0.3", "", {}, "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g=="],
+
+    "srvx": ["srvx@0.11.16", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-bp07zRuycfTY43IjAvvTFnmnJi8ikW0VFiHwOhhYcVW/L4xQ1XY4PAd4Nuum1rsA17C39zL7x+CDhrn5AL32Rw=="],
 
     "stackback": ["stackback@0.0.2", "", {}, "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw=="],
 
@@ -2364,41 +2757,65 @@
 
     "stop-iteration-iterator": ["stop-iteration-iterator@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "internal-slot": "^1.1.0" } }, "sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ=="],
 
+    "streamx": ["streamx@2.28.0", "", { "dependencies": { "events-universal": "^1.0.0", "fast-fifo": "^1.3.2", "text-decoder": "^1.1.0" } }, "sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw=="],
+
     "string-argv": ["string-argv@0.3.2", "", {}, "sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q=="],
 
     "string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
 
+    "string-width-cjs": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
     "string.prototype.matchall": ["string.prototype.matchall@4.0.12", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "define-properties": "^1.2.1", "es-abstract": "^1.23.6", "es-errors": "^1.3.0", "es-object-atoms": "^1.0.0", "get-intrinsic": "^1.2.6", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "internal-slot": "^1.1.0", "regexp.prototype.flags": "^1.5.3", "set-function-name": "^2.0.2", "side-channel": "^1.1.0" } }, "sha512-6CC9uyBL+/48dYizRf7H7VAYCMCNTBeM78x/VTUe9bFEaxBepPJDa1Ow99LqI/1yF7kuy7Q3cQsYMrcjGUcskA=="],
 
     "string.prototype.repeat": ["string.prototype.repeat@1.0.0", "", { "dependencies": { "define-properties": "^1.1.3", "es-abstract": "^1.17.5" } }, "sha512-0u/TldDbKD8bFCQ/4f5+mNRrXwZ8hg2w7ZR8wa16e8z9XpePWl3eGEcUD0OXpEH/VJH/2G3gjUtR3ZOiBe2S/w=="],
 
-    "string.prototype.trim": ["string.prototype.trim@1.2.10", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.2", "define-data-property": "^1.1.4", "define-properties": "^1.2.1", "es-abstract": "^1.23.5", "es-object-atoms": "^1.0.0", "has-property-descriptors": "^1.0.2" } }, "sha512-Rs66F0P/1kedk5lyYyH9uBzuiI/kNRmwJAR9quK6VOtIpZ2G+hMZd+HQbbv25MgCA6gEffoMZYxlTod4WcdrKA=="],
+    "string.prototype.trim": ["string.prototype.trim@1.2.11", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "define-data-property": "^1.1.4", "define-properties": "^1.2.1", "es-abstract": "^1.24.2", "es-object-atoms": "^1.1.2", "has-property-descriptors": "^1.0.2", "safe-regex-test": "^1.1.0" } }, "sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w=="],
 
-    "string.prototype.trimend": ["string.prototype.trimend@1.0.9", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.2", "define-properties": "^1.2.1", "es-object-atoms": "^1.0.0" } }, "sha512-G7Ok5C6E/j4SGfyLCloXTrngQIQU3PWtXGst3yM7Bea9FRURf1S42ZHlZZtsNque2FN2PoUhfZXYLNWwEr4dLQ=="],
+    "string.prototype.trimend": ["string.prototype.trimend@1.0.10", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "define-properties": "^1.2.1", "es-object-atoms": "^1.1.2" } }, "sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw=="],
 
     "string.prototype.trimstart": ["string.prototype.trimstart@1.0.8", "", { "dependencies": { "call-bind": "^1.0.7", "define-properties": "^1.2.1", "es-object-atoms": "^1.0.0" } }, "sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg=="],
 
+    "string_decoder": ["string_decoder@1.3.0", "", { "dependencies": { "safe-buffer": "~5.2.0" } }, "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA=="],
+
     "strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
 
+    "strip-ansi-cjs": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "strip-final-newline": ["strip-final-newline@3.0.0", "", {}, "sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw=="],
+
     "strip-indent": ["strip-indent@3.0.0", "", { "dependencies": { "min-indent": "^1.0.0" } }, "sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ=="],
 
-    "strnum": ["strnum@2.2.3", "", {}, "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg=="],
+    "strip-literal": ["strip-literal@3.1.0", "", { "dependencies": { "js-tokens": "^9.0.1" } }, "sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg=="],
+
+    "strnum": ["strnum@2.4.0", "", { "dependencies": { "anynum": "^1.0.0" } }, "sha512-sHrVyWWdq28RbhjuJdZsA1SnGRJV6NiXbk6AXBxDOsgAcA+lmpUZCYjOdLBxkXMwis6RRe7dlZt4VlIWFVzkmg=="],
 
     "style-mod": ["style-mod@4.1.3", "", {}, "sha512-i/n8VsZydrugj3Iuzll8+x/00GH2vnYsk1eomD8QiRrSAeW6ItbCQDtfXCeJHd0iwiNagqjQkvpvREEPtW3IoQ=="],
 
     "sucrase": ["sucrase@3.35.1", "", { "dependencies": { "@jridgewell/gen-mapping": "^0.3.2", "commander": "^4.0.0", "lines-and-columns": "^1.1.6", "mz": "^2.7.0", "pirates": "^4.0.1", "tinyglobby": "^0.2.11", "ts-interface-checker": "^0.1.9" }, "bin": { "sucrase": "bin/sucrase", "sucrase-node": "bin/sucrase-node" } }, "sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw=="],
 
+    "supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
+
     "supports-preserve-symlinks-flag": ["supports-preserve-symlinks-flag@1.0.0", "", {}, "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w=="],
 
-    "svix": ["svix@1.90.0", "", { "dependencies": { "standardwebhooks": "1.0.0", "uuid": "^10.0.0" } }, "sha512-ljkZuyy2+IBEoESkIpn8sLM+sxJHQcPxlZFxU+nVDhltNfUMisMBzWX/UR8SjEnzoI28ZjCzMbmYAPwSTucoMw=="],
+    "system-architecture": ["system-architecture@0.1.0", "", {}, "sha512-ulAk51I9UVUyJgxlv9M6lFot2WP3e7t8Kz9+IS6D4rVba1tR9kON+Ey69f+1R4Q8cd45Lod6a4IcJIxnzGc/zA=="],
+
+    "tagged-tag": ["tagged-tag@1.0.0", "", {}, "sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng=="],
+
+    "tailwind-merge": ["tailwind-merge@3.6.0", "", {}, "sha512-uxL7qAVQriqRQPAyK3pj66VqskWqoZ37PW94jwOTwNfq/z9oyu1V+eqrZqtR2+fCiXdYOZe/Modt8GtvqNzu+w=="],
+
+    "tailwindcss": ["tailwindcss@4.3.1", "", {}, "sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q=="],
 
-    "tailwind-merge": ["tailwind-merge@3.5.0", "", {}, "sha512-I8K9wewnVDkL1NTGoqWmVEIlUcB9gFriAEkXkfCjX5ib8ezGxtR3xD7iZIxrfArjEsH7F1CHD4RFUtxefdqV/A=="],
+    "tapable": ["tapable@2.3.3", "", {}, "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A=="],
 
-    "tailwindcss": ["tailwindcss@4.2.2", "", {}, "sha512-KWBIxs1Xb6NoLdMVqhbhgwZf2PGBpPEiwOqgI4pFIYbNTfBXiKYyWoTsXgBQ9WFg/OlhnvHaY+AEpW7wSmFo2Q=="],
+    "tar": ["tar@7.5.16", "", { "dependencies": { "@isaacs/fs-minipass": "^4.0.0", "chownr": "^3.0.0", "minipass": "^7.1.2", "minizlib": "^3.1.0", "yallist": "^5.0.0" } }, "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w=="],
 
-    "tapable": ["tapable@2.3.2", "", {}, "sha512-1MOpMXuhGzGL5TTCZFItxCc0AARf1EZFQkGqMm7ERKj8+Hgr5oLvJOVFcC+lRmR8hCe2S3jC4T5D7Vg/d7/fhA=="],
+    "tar-stream": ["tar-stream@3.2.0", "", { "dependencies": { "b4a": "^1.6.4", "bare-fs": "^4.5.5", "fast-fifo": "^1.2.0", "streamx": "^2.15.0" } }, "sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg=="],
 
-    "terser": ["terser@5.46.1", "", { "dependencies": { "@jridgewell/source-map": "^0.3.3", "acorn": "^8.15.0", "commander": "^2.20.0", "source-map-support": "~0.5.20" }, "bin": { "terser": "bin/terser" } }, "sha512-vzCjQO/rgUuK9sf8VJZvjqiqiHFaZLnOiimmUuOKODxWL8mm/xua7viT7aqX7dgPY60otQjUotzFMmCB4VdmqQ=="],
+    "teex": ["teex@1.0.1", "", { "dependencies": { "streamx": "^2.12.5" } }, "sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg=="],
+
+    "terser": ["terser@5.48.0", "", { "dependencies": { "@jridgewell/source-map": "^0.3.3", "acorn": "^8.15.0", "commander": "^2.20.0", "source-map-support": "~0.5.20" }, "bin": { "terser": "bin/terser" } }, "sha512-J/9An6vs9Us6wKRriSFXBWdRZapREHqFzdNUKk0pmu804EMR6dr6winwo7e5JDxN4xahxQsuysyYFwlwj4XN/Q=="],
+
+    "text-decoder": ["text-decoder@1.2.7", "", { "dependencies": { "b4a": "^1.6.4" } }, "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ=="],
 
     "thenify": ["thenify@3.3.1", "", { "dependencies": { "any-promise": "^1.0.0" } }, "sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw=="],
 
@@ -2408,11 +2825,15 @@
 
     "tiny-invariant": ["tiny-invariant@1.3.3", "", {}, "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg=="],
 
+    "tiny-warning": ["tiny-warning@1.0.3", "", {}, "sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA=="],
+
     "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="],
 
-    "tinyexec": ["tinyexec@1.1.1", "", {}, "sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg=="],
+    "tinyclip": ["tinyclip@0.1.14", "", {}, "sha512-F1oWdz8tjT17qe1d5JgDK6z03WGOhYYAN0lK3/D/fzNiy93xswLLEw7pk+3g05onhAy6Bsc6PLNUGhdgVjemMQ=="],
+
+    "tinyexec": ["tinyexec@1.2.4", "", {}, "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg=="],
 
-    "tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+    "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
 
     "tinyrainbow": ["tinyrainbow@3.1.0", "", {}, "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw=="],
 
@@ -2420,8 +2841,12 @@
 
     "tiptap-extension-resizable-image": ["tiptap-extension-resizable-image@2.1.0", "", { "peerDependencies": { "@tiptap/core": ">=2", "@tiptap/pm": ">=2", "@tiptap/react": ">=2", "react": ">=18" } }, "sha512-uvdY/mTHMZ3EF3Z+b61y1htOUg8oF4TiepNFF1pYRg/KITYoYSteF5/L2/qtlZF9SMrzzwnrtRFQFzn/qBj7qQ=="],
 
+    "to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
+
     "toidentifier": ["toidentifier@1.0.1", "", {}, "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="],
 
+    "tr46": ["tr46@0.0.3", "", {}, "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="],
+
     "tree-kill": ["tree-kill@1.2.2", "", { "bin": { "tree-kill": "cli.js" } }, "sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A=="],
 
     "ts-api-utils": ["ts-api-utils@2.5.0", "", { "peerDependencies": { "typescript": ">=4.8.4" } }, "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA=="],
@@ -2434,13 +2859,15 @@
 
     "tsup": ["tsup@8.5.1", "", { "dependencies": { "bundle-require": "^5.1.0", "cac": "^6.7.14", "chokidar": "^4.0.3", "consola": "^3.4.0", "debug": "^4.4.0", "esbuild": "^0.27.0", "fix-dts-default-cjs-exports": "^1.0.0", "joycon": "^3.1.1", "picocolors": "^1.1.1", "postcss-load-config": "^6.0.1", "resolve-from": "^5.0.0", "rollup": "^4.34.8", "source-map": "^0.7.6", "sucrase": "^3.35.0", "tinyexec": "^0.3.2", "tinyglobby": "^0.2.11", "tree-kill": "^1.2.2" }, "peerDependencies": { "@microsoft/api-extractor": "^7.36.0", "@swc/core": "^1", "postcss": "^8.4.12", "typescript": ">=4.5.0" }, "optionalPeers": ["@microsoft/api-extractor", "@swc/core", "postcss", "typescript"], "bin": { "tsup": "dist/cli-default.js", "tsup-node": "dist/cli-node.js" } }, "sha512-xtgkqwdhpKWr3tKPmCkvYmS9xnQK3m3XgxZHwSUjvfTjp7YfXe5tT3GgWi0F2N+ZSMsOeWeZFh7ZZFg5iPhing=="],
 
-    "tsx": ["tsx@4.21.0", "", { "dependencies": { "esbuild": "~0.27.0", "get-tsconfig": "^4.7.5" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw=="],
+    "tsx": ["tsx@4.22.4", "", { "dependencies": { "esbuild": "~0.28.0" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg=="],
 
     "tw-animate-css": ["tw-animate-css@1.4.0", "", {}, "sha512-7bziOlRqH0hJx80h/3mbicLW7o8qLsH5+RaLR2t+OHM3D0JlWGODQKQ4cxbK7WlvmUxpcj6Kgu6EKqjrGFe3QQ=="],
 
     "type-check": ["type-check@0.4.0", "", { "dependencies": { "prelude-ls": "^1.2.1" } }, "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew=="],
 
-    "type-is": ["type-is@2.0.1", "", { "dependencies": { "content-type": "^1.0.5", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw=="],
+    "type-fest": ["type-fest@2.19.0", "", {}, "sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA=="],
+
+    "type-is": ["type-is@2.1.0", "", { "dependencies": { "content-type": "^2.0.0", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA=="],
 
     "typed-array-buffer": ["typed-array-buffer@1.0.3", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "is-typed-array": "^1.1.14" } }, "sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw=="],
 
@@ -2448,30 +2875,52 @@
 
     "typed-array-byte-offset": ["typed-array-byte-offset@1.0.4", "", { "dependencies": { "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.8", "for-each": "^0.3.3", "gopd": "^1.2.0", "has-proto": "^1.2.0", "is-typed-array": "^1.1.15", "reflect.getprototypeof": "^1.0.9" } }, "sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ=="],
 
-    "typed-array-length": ["typed-array-length@1.0.7", "", { "dependencies": { "call-bind": "^1.0.7", "for-each": "^0.3.3", "gopd": "^1.0.1", "is-typed-array": "^1.1.13", "possible-typed-array-names": "^1.0.0", "reflect.getprototypeof": "^1.0.6" } }, "sha512-3KS2b+kL7fsuk/eJZ7EQdnEmQoaho/r6KUef7hxvltNA5DR8NAUM+8wJMbJyZ4G9/7i3v5zPBIMN5aybAh2/Jg=="],
+    "typed-array-length": ["typed-array-length@1.0.8", "", { "dependencies": { "call-bind": "^1.0.9", "for-each": "^0.3.5", "gopd": "^1.2.0", "is-typed-array": "^1.1.15", "possible-typed-array-names": "^1.1.0", "reflect.getprototypeof": "^1.0.10" } }, "sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g=="],
 
     "typeid-js": ["typeid-js@1.2.0", "", { "dependencies": { "uuid": "^10.0.0" } }, "sha512-t76ZucAnvGC60ea/HjVsB0TSoB0cw9yjnfurUgtInXQWUI/VcrlZGpO23KN3iSe8yOGUgb1zr7W7uEzJ3hSljA=="],
 
     "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
 
-    "typescript-eslint": ["typescript-eslint@8.58.2", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.58.2", "@typescript-eslint/parser": "8.58.2", "@typescript-eslint/typescript-estree": "8.58.2", "@typescript-eslint/utils": "8.58.2" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-V8iSng9mRbdZjl54VJ9NKr6ZB+dW0J3TzRXRGcSbLIej9jV86ZRtlYeTKDR/QLxXykocJ5icNzbsl2+5TzIvcQ=="],
+    "typescript-eslint": ["typescript-eslint@8.61.1", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.61.1", "@typescript-eslint/parser": "8.61.1", "@typescript-eslint/typescript-estree": "8.61.1", "@typescript-eslint/utils": "8.61.1" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw=="],
 
-    "ufo": ["ufo@1.6.3", "", {}, "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q=="],
+    "ufo": ["ufo@1.6.4", "", {}, "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA=="],
+
+    "ultrahtml": ["ultrahtml@1.6.0", "", {}, "sha512-R9fBn90VTJrqqLDwyMph+HGne8eqY1iPfYhPzZrvKpIfwkWZbcYlfpsb8B9dTvBfpy1/hqAD7Wi8EKfP9e8zdw=="],
 
     "unbox-primitive": ["unbox-primitive@1.1.0", "", { "dependencies": { "call-bound": "^1.0.3", "has-bigints": "^1.0.2", "has-symbols": "^1.1.0", "which-boxed-primitive": "^1.1.1" } }, "sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw=="],
 
-    "undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
+    "uncrypto": ["uncrypto@0.1.3", "", {}, "sha512-Ql87qFHB3s/De2ClA9e0gsnS6zXG27SkTiSJwjCc9MebbfapQfuPzumMIUMi38ezPZVNFcHI9sUIepeQfw8J8Q=="],
+
+    "unctx": ["unctx@2.5.0", "", { "dependencies": { "acorn": "^8.15.0", "estree-walker": "^3.0.3", "magic-string": "^0.30.21", "unplugin": "^2.3.11" } }, "sha512-p+Rz9x0R7X+CYDkT+Xg8/GhpcShTlU8n+cf9OtOEf7zEQsNcCZO1dPKNRDqvUTaq+P32PMMkxWHwfrxkqfqAYg=="],
+
+    "undici": ["undici@7.28.0", "", {}, "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA=="],
+
+    "undici-types": ["undici-types@7.24.6", "", {}, "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg=="],
 
     "unenv": ["unenv@2.0.0-rc.24", "", { "dependencies": { "pathe": "^2.0.3" } }, "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw=="],
 
+    "unicorn-magic": ["unicorn-magic@0.4.0", "", {}, "sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw=="],
+
+    "unimport": ["unimport@6.3.0", "", { "dependencies": { "acorn": "^8.16.0", "escape-string-regexp": "^5.0.0", "estree-walker": "^3.0.3", "local-pkg": "^1.1.2", "magic-string": "^0.30.21", "mlly": "^1.8.2", "pathe": "^2.0.3", "picomatch": "^4.0.4", "pkg-types": "^2.3.1", "scule": "^1.3.0", "strip-literal": "^3.1.0", "tinyglobby": "^0.2.16", "unplugin": "^3.0.0", "unplugin-utils": "^0.3.1" }, "peerDependencies": { "oxc-parser": "*", "rolldown": "^1.0.0" }, "optionalPeers": ["oxc-parser", "rolldown"] }, "sha512-M+Dxk5W9WRd+8j56W9tp8lGW/dmMc7g5zj7BWQnEjKQhryBstqsi1V0izb0zHwSkEN8cSYV7K75/bykairV2tA=="],
+
     "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="],
 
     "unplugin": ["unplugin@3.0.0", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "picomatch": "^4.0.3", "webpack-virtual-modules": "^0.6.2" } }, "sha512-0Mqk3AT2TZCXWKdcoaufeXNukv2mTrEZExeXlHIOZXdqYoHHr4n51pymnwV8x2BOVxwXbK2HLlI7usrqMpycdg=="],
 
+    "unplugin-utils": ["unplugin-utils@0.3.1", "", { "dependencies": { "pathe": "^2.0.3", "picomatch": "^4.0.3" } }, "sha512-5lWVjgi6vuHhJ526bI4nlCOmkCIF3nnfXkCMDeMJrtdvxTs6ZFCM8oNufGTsDbKv/tJ/xj8RpvXjRuPBZJuJog=="],
+
     "unstorage": ["unstorage@2.0.0-alpha.7", "", { "peerDependencies": { "@azure/app-configuration": "^1.11.0", "@azure/cosmos": "^4.9.1", "@azure/data-tables": "^13.3.2", "@azure/identity": "^4.13.0", "@azure/keyvault-secrets": "^4.10.0", "@azure/storage-blob": "^12.31.0", "@capacitor/preferences": "^6 || ^7 || ^8", "@deno/kv": ">=0.13.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.36.2", "@vercel/blob": ">=0.27.3", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1.0.1", "aws4fetch": "^1.0.20", "chokidar": "^4 || ^5", "db0": ">=0.3.4", "idb-keyval": "^6.2.2", "ioredis": "^5.9.3", "lru-cache": "^11.2.6", "mongodb": "^6 || ^7", "ofetch": "*", "uploadthing": "^7.7.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "chokidar", "db0", "idb-keyval", "ioredis", "lru-cache", "mongodb", "ofetch", "uploadthing"] }, "sha512-ELPztchk2zgFJnakyodVY3vJWGW9jy//keJ32IOJVGUMyaPydwcA1FtVvWqT0TNRch9H+cMNEGllfVFfScImog=="],
 
+    "untun": ["untun@0.1.3", "", { "dependencies": { "citty": "^0.1.5", "consola": "^3.2.3", "pathe": "^1.1.1" }, "bin": { "untun": "bin/untun.mjs" } }, "sha512-4luGP9LMYszMRZwsvyUd9MrxgEGZdZuZgpVQHEEX0lCYFESasVRvZd0EYpCkOIbJKHMuv0LskpXc/8Un+MJzEQ=="],
+
+    "untyped": ["untyped@2.0.0", "", { "dependencies": { "citty": "^0.1.6", "defu": "^6.1.4", "jiti": "^2.4.2", "knitwork": "^1.2.0", "scule": "^1.3.0" }, "bin": { "untyped": "dist/cli.mjs" } }, "sha512-nwNCjxJTjNuLCgFr42fEak5OcLuB3ecca+9ksPFNvtfYSLpjf+iJqSIaSnIile6ZPbKYxI5k2AfXqeopGudK/g=="],
+
+    "unwasm": ["unwasm@0.5.3", "", { "dependencies": { "exsolve": "^1.0.8", "knitwork": "^1.3.0", "magic-string": "^0.30.21", "mlly": "^1.8.0", "pathe": "^2.0.3", "pkg-types": "^2.3.0" } }, "sha512-keBgTSfp3r6+s9ZcSma+0chwxQdmLbB5+dAD9vjtB21UTMYuKAxHXCU1K2CbCtnP09EaWeRvACnXk0EJtUx+hw=="],
+
     "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
 
+    "uqr": ["uqr@0.1.3", "", {}, "sha512-0rjE8iEJe4YmT9TOhwsZtqCMRLc5DXZUI2UEYUUg63ikBkqqE5EYWaI0etFe/5KUcmcYwLih2RND1kq+hrUJXA=="],
+
     "uri-js": ["uri-js@4.4.1", "", { "dependencies": { "punycode": "^2.1.0" } }, "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg=="],
 
     "use-callback-ref": ["use-callback-ref@1.3.3", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg=="],
@@ -2488,20 +2937,28 @@
 
     "victory-vendor": ["victory-vendor@37.3.6", "", { "dependencies": { "@types/d3-array": "^3.0.3", "@types/d3-ease": "^3.0.0", "@types/d3-interpolate": "^3.0.1", "@types/d3-scale": "^4.0.2", "@types/d3-shape": "^3.1.0", "@types/d3-time": "^3.0.0", "@types/d3-timer": "^3.0.0", "d3-array": "^3.1.6", "d3-ease": "^3.0.1", "d3-interpolate": "^3.0.1", "d3-scale": "^4.0.2", "d3-shape": "^3.1.0", "d3-time": "^3.0.0", "d3-timer": "^3.0.1" } }, "sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ=="],
 
-    "vite": ["vite@8.0.8", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.8", "rolldown": "1.0.0-rc.15", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-dbU7/iLVa8KZALJyLOBOQ88nOXtNG8vxKuOT4I2mD+Ya70KPceF4IAmDsmU0h1Qsn5bPrvsY9HJstCRh3hG6Uw=="],
+    "vinxi": ["vinxi@0.5.3", "", { "dependencies": { "@babel/core": "^7.22.11", "@babel/plugin-syntax-jsx": "^7.22.5", "@babel/plugin-syntax-typescript": "^7.22.5", "@types/micromatch": "^4.0.2", "@vinxi/listhen": "^1.5.6", "boxen": "^7.1.1", "chokidar": "^3.5.3", "citty": "^0.1.4", "consola": "^3.2.3", "crossws": "^0.3.1", "dax-sh": "^0.39.1", "defu": "^6.1.2", "es-module-lexer": "^1.3.0", "esbuild": "^0.20.2", "fast-glob": "^3.3.1", "get-port-please": "^3.1.1", "h3": "1.13.0", "hookable": "^5.5.3", "http-proxy": "^1.18.1", "micromatch": "^4.0.5", "nitropack": "^2.10.4", "node-fetch-native": "^1.4.0", "path-to-regexp": "^6.2.1", "pathe": "^1.1.1", "radix3": "^1.1.0", "resolve": "^1.22.6", "serve-placeholder": "^2.0.1", "serve-static": "^1.15.0", "ufo": "^1.3.0", "unctx": "^2.3.1", "unenv": "^1.9.0", "unstorage": "^1.13.1", "vite": "^6.0.0", "zod": "^3.22.2" }, "bin": { "vinxi": "bin/cli.mjs" } }, "sha512-4sL2SMrRzdzClapP44oXdGjCE1oq7/DagsbjY5A09EibmoIO4LP8ScRVdh03lfXxKRk7nCWK7n7dqKvm+fp/9w=="],
+
+    "vite": ["vite@8.0.16", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.15", "rolldown": "1.0.3", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.18", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw=="],
 
     "vite-tsconfig-paths": ["vite-tsconfig-paths@6.1.1", "", { "dependencies": { "debug": "^4.1.1", "globrex": "^0.1.2", "tsconfck": "^3.0.3" }, "peerDependencies": { "vite": "*" } }, "sha512-2cihq7zliibCCZ8P9cKJrQBkfgdvcFkOOc3Y02o3GWUDLgqjWsZudaoiuOwO/gzTzy17cS5F7ZPo4bsnS4DGkg=="],
 
     "vitefu": ["vitefu@1.1.3", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["vite"] }, "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg=="],
 
-    "vitest": ["vitest@4.1.4", "", { "dependencies": { "@vitest/expect": "4.1.4", "@vitest/mocker": "4.1.4", "@vitest/pretty-format": "4.1.4", "@vitest/runner": "4.1.4", "@vitest/snapshot": "4.1.4", "@vitest/spy": "4.1.4", "@vitest/utils": "4.1.4", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.4", "@vitest/browser-preview": "4.1.4", "@vitest/browser-webdriverio": "4.1.4", "@vitest/coverage-istanbul": "4.1.4", "@vitest/coverage-v8": "4.1.4", "@vitest/ui": "4.1.4", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-tFuJqTxKb8AvfyqMfnavXdzfy3h3sWZRWwfluGbkeR7n0HUev+FmNgZ8SDrRBTVrVCjgH5cA21qGbCffMNtWvg=="],
+    "vitest": ["vitest@4.1.9", "", { "dependencies": { "@vitest/expect": "4.1.9", "@vitest/mocker": "4.1.9", "@vitest/pretty-format": "4.1.9", "@vitest/runner": "4.1.9", "@vitest/snapshot": "4.1.9", "@vitest/spy": "4.1.9", "@vitest/utils": "4.1.9", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.9", "@vitest/browser-preview": "4.1.9", "@vitest/browser-webdriverio": "4.1.9", "@vitest/coverage-istanbul": "4.1.9", "@vitest/coverage-v8": "4.1.9", "@vitest/ui": "4.1.9", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "./vitest.mjs" } }, "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ=="],
 
     "w3c-keyname": ["w3c-keyname@2.2.8", "", {}, "sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ=="],
 
+    "webidl-conversions": ["webidl-conversions@3.0.1", "", {}, "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="],
+
     "webpack-virtual-modules": ["webpack-virtual-modules@0.6.2", "", {}, "sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ=="],
 
+    "whatwg-encoding": ["whatwg-encoding@3.1.1", "", { "dependencies": { "iconv-lite": "0.6.3" } }, "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ=="],
+
     "whatwg-mimetype": ["whatwg-mimetype@3.0.0", "", {}, "sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q=="],
 
+    "whatwg-url": ["whatwg-url@5.0.0", "", { "dependencies": { "tr46": "~0.0.3", "webidl-conversions": "^3.0.0" } }, "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw=="],
+
     "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
 
     "which-boxed-primitive": ["which-boxed-primitive@1.1.1", "", { "dependencies": { "is-bigint": "^1.1.0", "is-boolean-object": "^1.2.1", "is-number-object": "^1.1.1", "is-string": "^1.1.1", "is-symbol": "^1.1.1" } }, "sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA=="],
@@ -2512,17 +2969,25 @@
 
     "which-module": ["which-module@2.0.1", "", {}, "sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ=="],
 
-    "which-typed-array": ["which-typed-array@1.1.20", "", { "dependencies": { "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.8", "call-bound": "^1.0.4", "for-each": "^0.3.5", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-tostringtag": "^1.0.2" } }, "sha512-LYfpUkmqwl0h9A2HL09Mms427Q1RZWuOHsukfVcKRq9q95iQxdw0ix1JQrqbcDR9PH1QDwf5Qo8OZb5lksZ8Xg=="],
+    "which-typed-array": ["which-typed-array@1.1.22", "", { "dependencies": { "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.9", "call-bound": "^1.0.4", "for-each": "^0.3.5", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-tostringtag": "^1.0.2" } }, "sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw=="],
 
     "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="],
 
+    "widest-line": ["widest-line@4.0.1", "", { "dependencies": { "string-width": "^5.0.1" } }, "sha512-o0cyEG0e8GPzT4iGHphIOh0cJOV8fivsXxddQasHPHfoZf1ZexrfeA21w2NaEN1RHE+fXlfISmOE8R9N3u3Qig=="],
+
     "word-wrap": ["word-wrap@1.2.5", "", {}, "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA=="],
 
     "wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="],
 
+    "wrap-ansi-cjs": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
+
     "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
 
-    "ws": ["ws@8.20.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="],
+    "ws": ["ws@8.21.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g=="],
+
+    "wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],
+
+    "xml-naming": ["xml-naming@0.1.0", "", {}, "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw=="],
 
     "xmlbuilder2": ["xmlbuilder2@4.0.3", "", { "dependencies": { "@oozcitak/dom": "^2.0.2", "@oozcitak/infra": "^2.0.2", "@oozcitak/util": "^10.0.0", "js-yaml": "^4.1.1" } }, "sha512-bx8Q1STctnNaaDymWnkfQLKofs0mGNN7rLLapJlGuV3VlvegD7Ls4ggMjE3aUSWItCCzU0PEv45lI87iSigiCA=="],
 
@@ -2530,7 +2995,7 @@
 
     "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
 
-    "yaml": ["yaml@2.8.4", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog=="],
+    "yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
 
     "yargs": ["yargs@15.4.1", "", { "dependencies": { "cliui": "^6.0.0", "decamelize": "^1.2.0", "find-up": "^4.1.0", "get-caller-file": "^2.0.1", "require-directory": "^2.1.1", "require-main-filename": "^2.0.0", "set-blocking": "^2.0.0", "string-width": "^4.2.0", "which-module": "^2.0.0", "y18n": "^4.0.0", "yargs-parser": "^18.1.2" } }, "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A=="],
 
@@ -2538,7 +3003,13 @@
 
     "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
 
-    "zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+    "youch": ["youch@4.1.1", "", { "dependencies": { "@poppinss/colors": "^4.1.6", "@poppinss/dumper": "^0.7.0", "@speed-highlight/core": "^1.2.14", "cookie-es": "^3.0.1", "youch-core": "^0.3.3" } }, "sha512-mxW3qiSnl+GRxXsaUMzv2Mbada1Y8CDltET9UxejDQe6DBYlSekghl5U5K0ReAikcHDi0G1vKZEmmo/NWAGKLA=="],
+
+    "youch-core": ["youch-core@0.3.3", "", { "dependencies": { "@poppinss/exception": "^1.2.2", "error-stack-parser-es": "^1.0.5" } }, "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA=="],
+
+    "zip-stream": ["zip-stream@6.0.1", "", { "dependencies": { "archiver-utils": "^5.0.0", "compress-commons": "^6.0.2", "readable-stream": "^4.0.0" } }, "sha512-zK7YHHz4ZXpW89AHXUPbQVGKI7uvkd3hzusTdotCg1UxyaVtg0zFJSTfW/Dq5f7OBBVnq6cZIaC8Ti4hb6dtCA=="],
+
+    "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
 
     "zod-openapi": ["zod-openapi@5.4.6", "", { "peerDependencies": { "zod": "^3.25.74 || ^4.0.0" } }, "sha512-P2jsOOBAq/6hCwUsMCjUATZ8szkMsV5VAwZENfyxp2Hc/XPJQpVwAgevWZc65xZauCwWB9LAn7zYeiCJFAEL+A=="],
 
@@ -2546,203 +3017,405 @@
 
     "zod-validation-error": ["zod-validation-error@4.0.2", "", { "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" } }, "sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ=="],
 
-    "zustand": ["zustand@5.0.12", "", { "peerDependencies": { "@types/react": ">=18.0.0", "immer": ">=9.0.6", "react": ">=18.0.0", "use-sync-external-store": ">=1.2.0" }, "optionalPeers": ["@types/react", "immer", "react", "use-sync-external-store"] }, "sha512-i77ae3aZq4dhMlRhJVCYgMLKuSiZAaUPAct2AksxQ+gOtimhGMdXljRT21P5BNpeT4kXlLIckvkPM029OljD7g=="],
+    "zustand": ["zustand@5.0.14", "", { "peerDependencies": { "@types/react": ">=18.0.0", "immer": ">=9.0.6", "react": ">=18.0.0", "use-sync-external-store": ">=1.2.0" }, "optionalPeers": ["@types/react", "immer", "react", "use-sync-external-store"] }, "sha512-/8tAspM5LMPr28b3fwLYrtdj77ECpfZviaP75CMTnwO8ISyaE4GDIG/9rDDYq/cH9D2Xw2A2RXglLInmVBQB/g=="],
 
-    "@aws-crypto/sha1-browser/@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
+    "@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
-    "@aws-crypto/sha256-browser/@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
-
-    "@aws-crypto/util/@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
+    "@deno/shim-deno/which": ["which@4.0.0", "", { "dependencies": { "isexe": "^3.1.1" }, "bin": { "node-which": "bin/which.js" } }, "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg=="],
 
     "@esbuild-kit/core-utils/esbuild": ["esbuild@0.18.20", "", { "optionalDependencies": { "@esbuild/android-arm": "0.18.20", "@esbuild/android-arm64": "0.18.20", "@esbuild/android-x64": "0.18.20", "@esbuild/darwin-arm64": "0.18.20", "@esbuild/darwin-x64": "0.18.20", "@esbuild/freebsd-arm64": "0.18.20", "@esbuild/freebsd-x64": "0.18.20", "@esbuild/linux-arm": "0.18.20", "@esbuild/linux-arm64": "0.18.20", "@esbuild/linux-ia32": "0.18.20", "@esbuild/linux-loong64": "0.18.20", "@esbuild/linux-mips64el": "0.18.20", "@esbuild/linux-ppc64": "0.18.20", "@esbuild/linux-riscv64": "0.18.20", "@esbuild/linux-s390x": "0.18.20", "@esbuild/linux-x64": "0.18.20", "@esbuild/netbsd-x64": "0.18.20", "@esbuild/openbsd-x64": "0.18.20", "@esbuild/sunos-x64": "0.18.20", "@esbuild/win32-arm64": "0.18.20", "@esbuild/win32-ia32": "0.18.20", "@esbuild/win32-x64": "0.18.20" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA=="],
 
     "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
 
-    "@modelcontextprotocol/sdk/ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
+    "@isaacs/cliui/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
+
+    "@isaacs/cliui/wrap-ansi": ["wrap-ansi@8.1.0", "", { "dependencies": { "ansi-styles": "^6.1.0", "string-width": "^5.0.1", "strip-ansi": "^7.0.1" } }, "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ=="],
+
+    "@mapbox/node-pre-gyp/https-proxy-agent": ["https-proxy-agent@7.0.6", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "4" } }, "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw=="],
+
+    "@mapbox/node-pre-gyp/semver": ["semver@7.8.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA=="],
+
+    "@modelcontextprotocol/sdk/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
+
+    "@parcel/watcher-wasm/napi-wasm": ["napi-wasm@1.1.3", "", { "bundled": true }, "sha512-h/4nMGsHjZDCYmQVNODIrYACVJ+I9KItbG+0si6W/jSjdA9JbWDoU4LLeMXVcEQGHjttI2tuXqDrbGF7qkUHHg=="],
+
+    "@poppinss/dumper/supports-color": ["supports-color@10.2.2", "", {}, "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g=="],
 
     "@quackback/import/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
     "@quackback/import/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
-    "@quackback/web/@tiptap/extension-mention": ["@tiptap/extension-mention@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3", "@tiptap/suggestion": "^3.22.3" } }, "sha512-wJmpjU6WqZgbMJUwGQKhwnzCdN/DtsFGRsExCvncuQxFKgsMzhW+NWwmzgrGJDyS8BMKzqwyKlSc1dcMOYzgJQ=="],
+    "@radix-ui/react-accordion/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-accordion/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
+
+    "@radix-ui/react-accordion/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-alert-dialog/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-alert-dialog/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-arrow/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-aspect-ratio/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-avatar/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-checkbox/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-checkbox/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-collapsible/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-collapsible/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
+
+    "@radix-ui/react-collapsible/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-collection/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-collection/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-context-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-dialog/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-dialog/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
+
+    "@radix-ui/react-dialog/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-dismissable-layer/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-dismissable-layer/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-dropdown-menu/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-dropdown-menu/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
+
+    "@radix-ui/react-dropdown-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-focus-scope/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-focus-scope/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-form/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-form/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
+
+    "@radix-ui/react-form/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-hover-card/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "@radix-ui/react-hover-card/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-accordion/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-id/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ=="],
 
-    "@radix-ui/react-alert-dialog/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-label/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-alert-dialog/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-menu/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-arrow/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-menu/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
 
-    "@radix-ui/react-aspect-ratio/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-avatar/@radix-ui/react-context": ["@radix-ui/react-context@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-ieIFACdMpYfMEjF0rEf5KLvfVyIkOz6PDGyNnP+u+4xQ6jny3VCgA4OgXOwNx2aUkxn8zx9fiVcM8CfFYv9Lxw=="],
+    "@radix-ui/react-menubar/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-checkbox/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-menubar/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
 
-    "@radix-ui/react-collapsible/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-menubar/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-collection/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-navigation-menu/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-collection/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-navigation-menu/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
 
-    "@radix-ui/react-context-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-navigation-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-dialog/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-one-time-password-field/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-dialog/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-one-time-password-field/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-dismissable-layer/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-password-toggle-field/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-dropdown-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-password-toggle-field/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
 
-    "@radix-ui/react-focus-scope/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-password-toggle-field/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-form/@radix-ui/react-label": ["@radix-ui/react-label@2.1.7", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-YT1GqPSL8kJn20djelMX7/cTRp/Y9w5IZHvfxQTVHrOqa2yMl7i/UfMqKRU5V7mEyKTrUVgJXhNQPVCG8PBLoQ=="],
+    "@radix-ui/react-popover/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-form/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-popover/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
 
-    "@radix-ui/react-hover-card/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-popover/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-popper/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-menu/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-popper/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-menubar/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-portal/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-navigation-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
 
-    "@radix-ui/react-one-time-password-field/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-progress/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-password-toggle-field/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-radio-group/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-popover/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-radio-group/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-popover/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-roving-focus/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-popper/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-roving-focus/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
 
-    "@radix-ui/react-portal/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-roving-focus/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-progress/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-scroll-area/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-radio-group/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-scroll-area/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-roving-focus/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-select/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-scroll-area/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-select/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
 
-    "@radix-ui/react-select/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-select/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-select/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-separator/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-separator/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-slider/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-slider/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-slider/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-switch/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-slot/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-tabs/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-switch/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-toast/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-switch/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-toggle/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-tabs/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
 
-    "@radix-ui/react-toggle-group/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-tabs/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "@radix-ui/react-toolbar/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-toast/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
 
-    "@radix-ui/react-tooltip/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-toast/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-toggle/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-toggle-group/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-toolbar/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
+
+    "@radix-ui/react-tooltip/@radix-ui/primitive": ["@radix-ui/primitive@1.1.3", "", {}, "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg=="],
+
+    "@radix-ui/react-tooltip/@radix-ui/react-context": ["@radix-ui/react-context@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA=="],
+
+    "@radix-ui/react-tooltip/@radix-ui/react-dismissable-layer": ["@radix-ui/react-dismissable-layer@1.1.11", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-escape-keydown": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Nqcp+t5cTB8BinFkZgXiMJniQH0PsUt2k51FUhbdfeKvc4ACcG2uQniY/8+h1Yv6Kza4Q7lD7PQV0z0oicE0Mg=="],
+
+    "@radix-ui/react-tooltip/@radix-ui/react-popper": ["@radix-ui/react-popper@1.2.8", "", { "dependencies": { "@floating-ui/react-dom": "^2.0.0", "@radix-ui/react-arrow": "1.1.7", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-layout-effect": "1.1.1", "@radix-ui/react-use-rect": "1.1.1", "@radix-ui/react-use-size": "1.1.1", "@radix-ui/rect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-0NJQ4LFFUuWkE7Oxf0htBKS6zLkkjBH+hM1uk7Ng705ReR8m/uelduy1DBo0PyBXPKVnBA6YBlU94MBGXrSBCw=="],
+
+    "@radix-ui/react-tooltip/@radix-ui/react-portal": ["@radix-ui/react-portal@1.1.9", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-bpIxvq03if6UNwXZ+HTK71JLh4APvnXntDc6XOX8UVq4XQOVl7lwok0AvIl+b8zgCw3fSaVTZMpAPPagXbKmHQ=="],
+
+    "@radix-ui/react-tooltip/@radix-ui/react-presence": ["@radix-ui/react-presence@1.1.5", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-/jfEwNDdQVBCNvjkGit4h6pMOzq8bHkopq458dPt2lMjx+eBQUohZNG9A7DtO/O5ukSbxuaNGXMjHicgwy6rQQ=="],
 
     "@radix-ui/react-tooltip/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
 
-    "@radix-ui/react-visually-hidden/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-use-controllable-state": ["@radix-ui/react-use-controllable-state@1.2.2", "", { "dependencies": { "@radix-ui/react-use-effect-event": "0.0.2", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg=="],
+
+    "@radix-ui/react-tooltip/@radix-ui/react-visually-hidden": ["@radix-ui/react-visually-hidden@1.2.3", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-pzJq12tEaaIhqjbzpCuv/OypJY/BPavOofm+dbab+MHLajy277+1lLm6JFcGgF5eskJ6mquGirhXY2GD/8u8Ug=="],
+
+    "@radix-ui/react-visually-hidden/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
     "@react-email/markdown/marked": ["marked@15.0.12", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA=="],
 
-    "@react-email/render/prettier": ["prettier@3.8.1", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg=="],
+    "@reduxjs/toolkit/immer": ["immer@11.1.8", "", {}, "sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA=="],
+
+    "@rolldown/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+
+    "@rollup/plugin-commonjs/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@rollup/plugin-inject/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
 
-    "@reduxjs/toolkit/immer": ["immer@11.1.4", "", {}, "sha512-XREFCPo6ksxVzP4E0ekD5aMdf8WMwmdNaz6vuvxgI40UaEiu6q3p8X52aU6GdyvLY3XXX/8R7JOTXStz/nBbRw=="],
+    "@rollup/plugin-node-resolve/resolve": ["resolve@1.22.12", "", { "dependencies": { "es-errors": "^1.3.0", "is-core-module": "^2.16.1", "path-parse": "^1.0.7", "supports-preserve-symlinks-flag": "^1.0.0" }, "bin": { "resolve": "bin/resolve" } }, "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA=="],
 
-    "@rolldown/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.9.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw=="],
+    "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" }, "bundled": true }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" }, "bundled": true }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
+    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.5", "", { "dependencies": { "@tybys/wasm-util": "^0.10.2" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" }, "bundled": true }, "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/wasm-util@0.10.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg=="],
+    "@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="],
 
     "@tailwindcss/oxide-wasm32-wasi/tslib": ["tslib@2.8.1", "", { "bundled": true }, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
-    "@tanstack/router-generator/jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
+    "@tanstack/directive-functions-plugin/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
 
-    "@tanstack/router-generator/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+    "@tanstack/directive-functions-plugin/@tanstack/router-utils": ["@tanstack/router-utils@1.141.0", "", { "dependencies": { "@babel/core": "^7.27.4", "@babel/generator": "^7.27.5", "@babel/parser": "^7.27.5", "@babel/preset-typescript": "^7.27.1", "ansis": "^4.1.0", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-/eFGKCiix1SvjxwgzrmH4pHjMiMxc+GA4nIbgEkG2RdAJqyxLcRhd7RPLG0/LZaJ7d0ad3jrtRqsHLv2152Vbw=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core": ["@tanstack/start-plugin-core@1.131.50", "", { "dependencies": { "@babel/code-frame": "7.26.2", "@babel/core": "^7.26.8", "@babel/types": "^7.26.8", "@tanstack/router-core": "1.131.50", "@tanstack/router-generator": "1.131.50", "@tanstack/router-plugin": "1.131.50", "@tanstack/router-utils": "1.131.2", "@tanstack/server-functions-plugin": "1.131.2", "@tanstack/start-server-core": "1.131.50", "@types/babel__code-frame": "^7.0.6", "@types/babel__core": "^7.20.5", "babel-dead-code-elimination": "^1.0.9", "cheerio": "^1.0.0", "h3": "1.13.0", "nitropack": "^2.11.12", "pathe": "^2.0.3", "ufo": "^1.5.4", "vitefu": "^1.1.1", "xmlbuilder2": "^3.1.1", "zod": "^3.24.2" }, "peerDependencies": { "vite": ">=6.0.0" } }, "sha512-eFvMA0chqLtHbq+8ojp1fXN7AQjhmeoOpQaZaU1d51wb7ugetrn0k3OuHblxtE/O0L4HEC9s4X5zmFJt0vLh0w=="],
+
+    "@tanstack/react-start-plugin/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
     "@tanstack/router-plugin/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
 
-    "@tanstack/router-plugin/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+    "@tanstack/server-functions-plugin/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
+
+    "@tanstack/start-config/@vitejs/plugin-react": ["@vitejs/plugin-react@4.7.0", "", { "dependencies": { "@babel/core": "^7.28.0", "@babel/plugin-transform-react-jsx-self": "^7.27.1", "@babel/plugin-transform-react-jsx-source": "^7.27.1", "@rolldown/pluginutils": "1.0.0-beta.27", "@types/babel__core": "^7.20.5", "react-refresh": "^0.17.0" }, "peerDependencies": { "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" } }, "sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA=="],
+
+    "@tanstack/start-config/ofetch": ["ofetch@1.5.1", "", { "dependencies": { "destr": "^2.0.5", "node-fetch-native": "^1.6.7", "ufo": "^1.6.1" } }, "sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA=="],
+
+    "@tanstack/start-config/vite": ["vite@6.4.3", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A=="],
+
+    "@tanstack/start-config/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
     "@tanstack/start-plugin-core/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
 
-    "@tanstack/start-plugin-core/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+    "@tanstack/start-server-functions-client/@tanstack/server-functions-plugin": ["@tanstack/server-functions-plugin@1.131.2", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/directive-functions-plugin": "1.131.2", "babel-dead-code-elimination": "^1.0.9", "tiny-invariant": "^1.3.3" } }, "sha512-hWsaSgEZAVyzHg8+IcJWCEtfI9ZSlNELErfLiGHG9XCHEXMegFWsrESsKHlASzJqef9RsuOLDl+1IMPIskwdDw=="],
+
+    "@tanstack/start-server-functions-fetcher/@tanstack/router-core": ["@tanstack/router-core@1.131.50", "", { "dependencies": { "@tanstack/history": "1.131.2", "@tanstack/store": "^0.7.0", "cookie-es": "^1.2.2", "seroval": "^1.3.2", "seroval-plugins": "^1.3.2", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" } }, "sha512-eojd4JZ5ziUhGEmXZ4CaVX5mQdiTMiz56Sp8ZQ6r7deb55Q+5G4JQDkeuXpI7HMAvzr+4qlsFeLaDRXXjXyOqQ=="],
+
+    "@tanstack/start-server-functions-fetcher/@tanstack/start-client-core": ["@tanstack/start-client-core@1.131.50", "", { "dependencies": { "@tanstack/router-core": "1.131.50", "@tanstack/start-storage-context": "1.131.50", "cookie-es": "^1.2.2", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" } }, "sha512-8fbwYca1NAu/5WyGvO3e341/FPpsiqdPrrzkoc0cXQimMN1DligoRjvHgP13q3n5w1tFMSqChGzXfOVJP9ndSw=="],
+
+    "@tanstack/start-server-functions-server/@tanstack/server-functions-plugin": ["@tanstack/server-functions-plugin@1.131.2", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/directive-functions-plugin": "1.131.2", "babel-dead-code-elimination": "^1.0.9", "tiny-invariant": "^1.3.3" } }, "sha512-hWsaSgEZAVyzHg8+IcJWCEtfI9ZSlNELErfLiGHG9XCHEXMegFWsrESsKHlASzJqef9RsuOLDl+1IMPIskwdDw=="],
 
     "@testing-library/dom/dom-accessibility-api": ["dom-accessibility-api@0.5.16", "", {}, "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="],
 
     "@typescript-eslint/eslint-plugin/ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
 
-    "@typescript-eslint/typescript-estree/semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
+    "@typescript-eslint/typescript-estree/semver": ["semver@7.8.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA=="],
+
+    "@vercel/nft/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@vinxi/listhen/h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
+
+    "@vinxi/listhen/jiti": ["jiti@1.21.7", "", { "bin": { "jiti": "bin/jiti.js" } }, "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A=="],
+
+    "@vinxi/listhen/pathe": ["pathe@1.1.2", "", {}, "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="],
 
-    "ajv-formats/ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
+    "@vinxi/listhen/std-env": ["std-env@3.10.0", "", {}, "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg=="],
 
-    "better-auth/kysely": ["kysely@0.29.2", "", {}, "sha512-s6WVJyEZrbm6jhBpiKHsGHyePMrVQKJ85wZCFCr9W4QHv6WTjWIrdvTmO9hDEA3bNK0xkrE2DqrHsXMLWuZpQg=="],
+    "ajv-formats/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
+
+    "anymatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
+    "archiver-utils/glob": ["glob@10.5.0", "", { "dependencies": { "foreground-child": "^3.1.0", "jackspeak": "^3.1.2", "minimatch": "^9.0.4", "minipass": "^7.1.2", "package-json-from-dist": "^1.0.0", "path-scurry": "^1.11.1" }, "bin": { "glob": "dist/esm/bin.mjs" } }, "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg=="],
 
     "better-call/rou3": ["rou3@0.7.12", "", {}, "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg=="],
 
-    "bullmq/semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
+    "body-parser/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
+
+    "boxen/camelcase": ["camelcase@7.0.1", "", {}, "sha512-xlx1yCK2Oc1APsPXDL2LdlNP6+uu8OCDdhOBSVT279M/S+y75O30C2VuD8T2ogdePBBl7PfPF4504tnLgX3zfw=="],
+
+    "boxen/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
+
+    "boxen/wrap-ansi": ["wrap-ansi@8.1.0", "", { "dependencies": { "ansi-styles": "^6.1.0", "string-width": "^5.0.1", "strip-ansi": "^7.0.1" } }, "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ=="],
+
+    "bullmq/ioredis": ["ioredis@5.10.1", "", { "dependencies": { "@ioredis/commands": "1.5.1", "cluster-key-slot": "^1.1.0", "debug": "^4.3.4", "denque": "^2.1.0", "lodash.defaults": "^4.2.0", "lodash.isarguments": "^3.1.0", "redis-errors": "^1.2.0", "redis-parser": "^3.0.0", "standard-as-callback": "^2.1.0" } }, "sha512-HuEDBTI70aYdx1v6U97SbNx9F1+svQKBDo30o0b9fw055LMepzpOOd0Ccg9Q6tbqmBSJaMuY0fB7yw9/vjBYCA=="],
+
+    "bullmq/semver": ["semver@7.8.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg=="],
+
+    "c12/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
 
-    "bullmq/uuid": ["uuid@11.1.0", "", { "bin": { "uuid": "dist/esm/bin/uuid" } }, "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A=="],
+    "cheerio/htmlparser2": ["htmlparser2@10.1.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.3", "domutils": "^3.2.2", "entities": "^7.0.1" } }, "sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ=="],
 
-    "cli-truncate/string-width": ["string-width@8.2.0", "", { "dependencies": { "get-east-asian-width": "^1.5.0", "strip-ansi": "^7.1.2" } }, "sha512-6hJPQ8N0V0P3SNmP6h2J99RLuzrWz2gvT7VnK5tKvrNqJoyS9W4/Fb8mo31UiPvy00z7DQXkP2hnKBVav76thw=="],
+    "cheerio/whatwg-mimetype": ["whatwg-mimetype@4.0.0", "", {}, "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg=="],
+
+    "cli-truncate/string-width": ["string-width@8.2.1", "", { "dependencies": { "get-east-asian-width": "^1.5.0", "strip-ansi": "^7.1.2" } }, "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA=="],
 
     "cliui/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
     "cliui/wrap-ansi": ["wrap-ansi@6.2.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA=="],
 
+    "dax-sh/undici-types": ["undici-types@5.28.4", "", {}, "sha512-3OeMF5Lyowe8VW0skf5qaIE7Or3yS9LS7fvMUI0gg4YxpIBVg0L8BxCmROw2CcYhSkpR68Epz7CGc8MPj94Uww=="],
+
     "dom-serializer/entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
 
+    "dot-prop/type-fest": ["type-fest@5.7.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg=="],
+
     "dotenv-expand/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
+    "encoding-sniffer/iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
+
     "eslint-plugin-react/minimatch": ["minimatch@3.1.5", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w=="],
 
+    "execa/is-stream": ["is-stream@3.0.0", "", {}, "sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA=="],
+
+    "execa/onetime": ["onetime@6.0.0", "", { "dependencies": { "mimic-fn": "^4.0.0" } }, "sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ=="],
+
+    "fast-glob/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
+
     "form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
+    "globby/ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
+
     "htmlparser2/entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
 
-    "lint-staged/yaml": ["yaml@2.8.3", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg=="],
+    "http-proxy/eventemitter3": ["eventemitter3@4.0.7", "", {}, "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw=="],
+
+    "lazystream/readable-stream": ["readable-stream@2.3.8", "", { "dependencies": { "core-util-is": "~1.0.0", "inherits": "~2.0.3", "isarray": "~1.0.0", "process-nextick-args": "~2.0.0", "safe-buffer": "~5.1.1", "string_decoder": "~1.1.1", "util-deprecate": "~1.0.1" } }, "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA=="],
+
+    "listhen/@parcel/watcher-wasm": ["@parcel/watcher-wasm@2.5.6", "", { "dependencies": { "is-glob": "^4.0.3", "napi-wasm": "^1.1.0", "picomatch": "^4.0.3" } }, "sha512-byAiBZ1t3tXQvc8dMD/eoyE7lTXYorhn+6uVW5AC+JGI1KtJC/LvDche5cfUE+qiefH+Ybq0bUCJU0aB1cSHUA=="],
+
+    "listhen/citty": ["citty@0.2.2", "", {}, "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w=="],
+
+    "listhen/h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
 
     "log-update/slice-ansi": ["slice-ansi@7.1.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^5.0.0" } }, "sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w=="],
 
+    "loose-envify/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "make-dir/semver": ["semver@7.8.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA=="],
+
+    "micromatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
+    "mlly/pkg-types": ["pkg-types@1.3.1", "", { "dependencies": { "confbox": "^0.1.8", "mlly": "^1.7.4", "pathe": "^2.0.1" } }, "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ=="],
+
+    "nitropack/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "nitropack/citty": ["citty@0.2.2", "", {}, "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w=="],
+
+    "nitropack/cookie-es": ["cookie-es@2.0.1", "", {}, "sha512-aVf4A4hI2w70LnF7GG+7xDQUkliwiXWXFvTjkip4+b64ygDQ2sJPRSKFDHbxn8o0xu9QzPkMuuiWIXyFSE2slA=="],
+
+    "nitropack/crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
+
+    "nitropack/esbuild": ["esbuild@0.28.1", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.1", "@esbuild/android-arm": "0.28.1", "@esbuild/android-arm64": "0.28.1", "@esbuild/android-x64": "0.28.1", "@esbuild/darwin-arm64": "0.28.1", "@esbuild/darwin-x64": "0.28.1", "@esbuild/freebsd-arm64": "0.28.1", "@esbuild/freebsd-x64": "0.28.1", "@esbuild/linux-arm": "0.28.1", "@esbuild/linux-arm64": "0.28.1", "@esbuild/linux-ia32": "0.28.1", "@esbuild/linux-loong64": "0.28.1", "@esbuild/linux-mips64el": "0.28.1", "@esbuild/linux-ppc64": "0.28.1", "@esbuild/linux-riscv64": "0.28.1", "@esbuild/linux-s390x": "0.28.1", "@esbuild/linux-x64": "0.28.1", "@esbuild/netbsd-arm64": "0.28.1", "@esbuild/netbsd-x64": "0.28.1", "@esbuild/openbsd-arm64": "0.28.1", "@esbuild/openbsd-x64": "0.28.1", "@esbuild/openharmony-arm64": "0.28.1", "@esbuild/sunos-x64": "0.28.1", "@esbuild/win32-arm64": "0.28.1", "@esbuild/win32-ia32": "0.28.1", "@esbuild/win32-x64": "0.28.1" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw=="],
+
+    "nitropack/escape-string-regexp": ["escape-string-regexp@5.0.0", "", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
+
+    "nitropack/h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
+
+    "nitropack/hookable": ["hookable@5.5.3", "", {}, "sha512-Yc+BQe8SvoXH1643Qez1zqLRmbA5rCL+sSmk6TVos0LWVfNIB7PGncdlId77WzLGSIB5KaWgTaNTs2lNVEI6VQ=="],
+
+    "nitropack/ofetch": ["ofetch@1.5.1", "", { "dependencies": { "destr": "^2.0.5", "node-fetch-native": "^1.6.7", "ufo": "^1.6.1" } }, "sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA=="],
+
+    "nitropack/semver": ["semver@7.8.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA=="],
+
+    "nitropack/unstorage": ["unstorage@1.17.5", "", { "dependencies": { "anymatch": "^3.1.3", "chokidar": "^5.0.0", "destr": "^2.0.5", "h3": "^1.15.10", "lru-cache": "^11.2.7", "node-fetch-native": "^1.6.7", "ofetch": "^1.5.1", "ufo": "^1.6.3" }, "peerDependencies": { "@azure/app-configuration": "^1.8.0", "@azure/cosmos": "^4.2.0", "@azure/data-tables": "^13.3.0", "@azure/identity": "^4.6.0", "@azure/keyvault-secrets": "^4.9.0", "@azure/storage-blob": "^12.26.0", "@capacitor/preferences": "^6 || ^7 || ^8", "@deno/kv": ">=0.9.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.34.3", "@vercel/blob": ">=0.27.1", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1 || ^2 || ^3", "aws4fetch": "^1.0.20", "db0": ">=0.2.1", "idb-keyval": "^6.2.1", "ioredis": "^5.4.2", "uploadthing": "^7.4.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "db0", "idb-keyval", "ioredis", "uploadthing"] }, "sha512-0i3iqvRfx29hkNntHyQvJTpf5W9dQ9ZadSoRU8+xVlhVtT7jAX57fazYO9EHvcRCfBCyi5YRya7XCDOsbTgkPg=="],
+
+    "npm-run-path/path-key": ["path-key@4.0.0", "", {}, "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ=="],
+
     "p-queue/eventemitter3": ["eventemitter3@4.0.7", "", {}, "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw=="],
 
+    "parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
+    "path-scurry/lru-cache": ["lru-cache@11.5.1", "", {}, "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A=="],
+
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
     "prop-types/react-is": ["react-is@16.13.1", "", {}, "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="],
 
-    "radix-ui/@radix-ui/react-avatar": ["@radix-ui/react-avatar@1.1.10", "", { "dependencies": { "@radix-ui/react-context": "1.1.2", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-callback-ref": "1.1.1", "@radix-ui/react-use-is-hydrated": "0.1.0", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-V8piFfWapM5OmNCXTzVQY+E1rDa53zY+MQ4Y7356v4fFz6vqCyUtIz2rUD44ZEdwg78/jKmMJHj07+C/Z/rcog=="],
+    "radix-ui/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA=="],
+
+    "radix-ui/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.6", "", { "dependencies": { "@radix-ui/react-slot": "1.3.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g=="],
 
-    "radix-ui/@radix-ui/react-label": ["@radix-ui/react-label@2.1.7", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-YT1GqPSL8kJn20djelMX7/cTRp/Y9w5IZHvfxQTVHrOqa2yMl7i/UfMqKRU5V7mEyKTrUVgJXhNQPVCG8PBLoQ=="],
+    "radix-ui/@radix-ui/react-tooltip": ["@radix-ui/react-tooltip@1.2.10", "", { "dependencies": { "@radix-ui/primitive": "1.1.4", "@radix-ui/react-compose-refs": "1.1.3", "@radix-ui/react-context": "1.1.4", "@radix-ui/react-dismissable-layer": "1.1.13", "@radix-ui/react-id": "1.1.2", "@radix-ui/react-popper": "1.3.1", "@radix-ui/react-portal": "1.1.12", "@radix-ui/react-presence": "1.1.6", "@radix-ui/react-primitive": "2.1.6", "@radix-ui/react-slot": "1.3.0", "@radix-ui/react-use-controllable-state": "1.2.3", "@radix-ui/react-visually-hidden": "1.2.6" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-NlNe8D0dWEpVfXFli90IO6X07Josx/b1iu98tDnx9Xv0HT4wLIL+m2VOheMHhK7qbp2HoTBqALEFzGyZs/levw=="],
 
-    "radix-ui/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "readdir-glob/minimatch": ["minimatch@5.1.9", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw=="],
 
-    "radix-ui/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "recast/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
-    "rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.16", "", {}, "sha512-45+YtqxLYKDWQouLKCrpIZhke+nXxhsw+qAHVzHDVwttyBlHNBVs2K25rDXrZzhpTp9w1FlAlvweV1H++fdZoA=="],
+    "rollup-plugin-visualizer/yargs": ["yargs@18.0.0", "", { "dependencies": { "cliui": "^9.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "string-width": "^7.2.0", "y18n": "^5.0.5", "yargs-parser": "^22.0.0" } }, "sha512-4UEqdc2RYGHZc7Doyqkrqiln3p9X2DZVxaGbwhn2pi7MrRagKaOcIKe8L3OxYcbhXLgLFUS3zAYuQjKBQgmuNg=="],
 
-    "sharp/semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
+    "sharp/semver": ["semver@7.8.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA=="],
 
     "slice-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
 
@@ -2754,31 +3427,77 @@
 
     "string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
+    "string-width-cjs/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "string-width-cjs/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
     "strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
 
+    "strip-literal/js-tokens": ["js-tokens@9.0.1", "", {}, "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ=="],
+
     "sucrase/commander": ["commander@4.1.1", "", {}, "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA=="],
 
+    "tar/yallist": ["yallist@5.0.0", "", {}, "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw=="],
+
     "terser/commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
 
     "tsup/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
 
     "tsup/tinyexec": ["tinyexec@0.3.2", "", {}, "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA=="],
 
-    "tsx/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
+    "tsx/esbuild": ["esbuild@0.28.1", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.1", "@esbuild/android-arm": "0.28.1", "@esbuild/android-arm64": "0.28.1", "@esbuild/android-x64": "0.28.1", "@esbuild/darwin-arm64": "0.28.1", "@esbuild/darwin-x64": "0.28.1", "@esbuild/freebsd-arm64": "0.28.1", "@esbuild/freebsd-x64": "0.28.1", "@esbuild/linux-arm": "0.28.1", "@esbuild/linux-arm64": "0.28.1", "@esbuild/linux-ia32": "0.28.1", "@esbuild/linux-loong64": "0.28.1", "@esbuild/linux-mips64el": "0.28.1", "@esbuild/linux-ppc64": "0.28.1", "@esbuild/linux-riscv64": "0.28.1", "@esbuild/linux-s390x": "0.28.1", "@esbuild/linux-x64": "0.28.1", "@esbuild/netbsd-arm64": "0.28.1", "@esbuild/netbsd-x64": "0.28.1", "@esbuild/openbsd-arm64": "0.28.1", "@esbuild/openbsd-x64": "0.28.1", "@esbuild/openharmony-arm64": "0.28.1", "@esbuild/sunos-x64": "0.28.1", "@esbuild/win32-arm64": "0.28.1", "@esbuild/win32-ia32": "0.28.1", "@esbuild/win32-x64": "0.28.1" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw=="],
 
-    "vite/rolldown": ["rolldown@1.0.0-rc.15", "", { "dependencies": { "@oxc-project/types": "=0.124.0", "@rolldown/pluginutils": "1.0.0-rc.15" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.0-rc.15", "@rolldown/binding-darwin-arm64": "1.0.0-rc.15", "@rolldown/binding-darwin-x64": "1.0.0-rc.15", "@rolldown/binding-freebsd-x64": "1.0.0-rc.15", "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.15", "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.15", "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.15", "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.15", "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.15", "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.15", "@rolldown/binding-linux-x64-musl": "1.0.0-rc.15", "@rolldown/binding-openharmony-arm64": "1.0.0-rc.15", "@rolldown/binding-wasm32-wasi": "1.0.0-rc.15", "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.15", "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.15" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-Ff31guA5zT6WjnGp0SXw76X6hzGRk/OQq2hE+1lcDe+lJdHSgnSX6nK3erbONHyCbpSj9a9E+uX/OvytZoWp2g=="],
+    "type-is/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
+
+    "unctx/unplugin": ["unplugin@2.3.11", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "acorn": "^8.15.0", "picomatch": "^4.0.3", "webpack-virtual-modules": "^0.6.2" } }, "sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww=="],
+
+    "unimport/escape-string-regexp": ["escape-string-regexp@5.0.0", "", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
+
+    "untun/pathe": ["pathe@1.1.2", "", {}, "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="],
+
+    "vinxi/chokidar": ["chokidar@3.6.0", "", { "dependencies": { "anymatch": "~3.1.2", "braces": "~3.0.2", "glob-parent": "~5.1.2", "is-binary-path": "~2.1.0", "is-glob": "~4.0.1", "normalize-path": "~3.0.0", "readdirp": "~3.6.0" }, "optionalDependencies": { "fsevents": "~2.3.2" } }, "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw=="],
+
+    "vinxi/crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
+
+    "vinxi/es-module-lexer": ["es-module-lexer@1.7.0", "", {}, "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA=="],
+
+    "vinxi/esbuild": ["esbuild@0.20.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.20.2", "@esbuild/android-arm": "0.20.2", "@esbuild/android-arm64": "0.20.2", "@esbuild/android-x64": "0.20.2", "@esbuild/darwin-arm64": "0.20.2", "@esbuild/darwin-x64": "0.20.2", "@esbuild/freebsd-arm64": "0.20.2", "@esbuild/freebsd-x64": "0.20.2", "@esbuild/linux-arm": "0.20.2", "@esbuild/linux-arm64": "0.20.2", "@esbuild/linux-ia32": "0.20.2", "@esbuild/linux-loong64": "0.20.2", "@esbuild/linux-mips64el": "0.20.2", "@esbuild/linux-ppc64": "0.20.2", "@esbuild/linux-riscv64": "0.20.2", "@esbuild/linux-s390x": "0.20.2", "@esbuild/linux-x64": "0.20.2", "@esbuild/netbsd-x64": "0.20.2", "@esbuild/openbsd-x64": "0.20.2", "@esbuild/sunos-x64": "0.20.2", "@esbuild/win32-arm64": "0.20.2", "@esbuild/win32-ia32": "0.20.2", "@esbuild/win32-x64": "0.20.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-WdOOppmUNU+IbZ0PaDiTst80zjnrOkyJNHoKupIcVyU8Lvla3Ugx94VzkQ32Ijqd7UhHJy75gNWDMUekcrSJ6g=="],
+
+    "vinxi/h3": ["h3@1.13.0", "", { "dependencies": { "cookie-es": "^1.2.2", "crossws": ">=0.2.0 <0.4.0", "defu": "^6.1.4", "destr": "^2.0.3", "iron-webcrypto": "^1.2.1", "ohash": "^1.1.4", "radix3": "^1.1.2", "ufo": "^1.5.4", "uncrypto": "^0.1.3", "unenv": "^1.10.0" } }, "sha512-vFEAu/yf8UMUcB4s43OaDaigcqpQd14yanmOsn+NcRX3/guSKncyE2rOYhq8RIchgJrPSs/QiIddnTTR1ddiAg=="],
+
+    "vinxi/hookable": ["hookable@5.5.3", "", {}, "sha512-Yc+BQe8SvoXH1643Qez1zqLRmbA5rCL+sSmk6TVos0LWVfNIB7PGncdlId77WzLGSIB5KaWgTaNTs2lNVEI6VQ=="],
+
+    "vinxi/path-to-regexp": ["path-to-regexp@6.3.0", "", {}, "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="],
+
+    "vinxi/pathe": ["pathe@1.1.2", "", {}, "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="],
+
+    "vinxi/resolve": ["resolve@1.22.12", "", { "dependencies": { "es-errors": "^1.3.0", "is-core-module": "^2.16.1", "path-parse": "^1.0.7", "supports-preserve-symlinks-flag": "^1.0.0" }, "bin": { "resolve": "bin/resolve" } }, "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA=="],
+
+    "vinxi/serve-static": ["serve-static@1.16.3", "", { "dependencies": { "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "parseurl": "~1.3.3", "send": "~0.19.1" } }, "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA=="],
+
+    "vinxi/unenv": ["unenv@1.10.0", "", { "dependencies": { "consola": "^3.2.3", "defu": "^6.1.4", "mime": "^3.0.0", "node-fetch-native": "^1.6.4", "pathe": "^1.1.2" } }, "sha512-wY5bskBQFL9n3Eca5XnhH6KbUo/tfvkwm9OpcdCvLaeA7piBNbavbOKJySEwQ1V0RH6HvNlSAFRTpvTqgKRQXQ=="],
+
+    "vinxi/unstorage": ["unstorage@1.17.5", "", { "dependencies": { "anymatch": "^3.1.3", "chokidar": "^5.0.0", "destr": "^2.0.5", "h3": "^1.15.10", "lru-cache": "^11.2.7", "node-fetch-native": "^1.6.7", "ofetch": "^1.5.1", "ufo": "^1.6.3" }, "peerDependencies": { "@azure/app-configuration": "^1.8.0", "@azure/cosmos": "^4.2.0", "@azure/data-tables": "^13.3.0", "@azure/identity": "^4.6.0", "@azure/keyvault-secrets": "^4.9.0", "@azure/storage-blob": "^12.26.0", "@capacitor/preferences": "^6 || ^7 || ^8", "@deno/kv": ">=0.9.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.34.3", "@vercel/blob": ">=0.27.1", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1 || ^2 || ^3", "aws4fetch": "^1.0.20", "db0": ">=0.2.1", "idb-keyval": "^6.2.1", "ioredis": "^5.4.2", "uploadthing": "^7.4.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "db0", "idb-keyval", "ioredis", "uploadthing"] }, "sha512-0i3iqvRfx29hkNntHyQvJTpf5W9dQ9ZadSoRU8+xVlhVtT7jAX57fazYO9EHvcRCfBCyi5YRya7XCDOsbTgkPg=="],
+
+    "vinxi/vite": ["vite@6.4.3", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A=="],
+
+    "vinxi/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "whatwg-encoding/iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
+
+    "widest-line/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
 
     "wrap-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
 
     "wrap-ansi/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
 
-    "yargs/find-up": ["find-up@4.1.0", "", { "dependencies": { "locate-path": "^5.0.0", "path-exists": "^4.0.0" } }, "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw=="],
+    "wrap-ansi-cjs/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
-    "@aws-crypto/sha1-browser/@smithy/util-utf8/@smithy/util-buffer-from": ["@smithy/util-buffer-from@2.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA=="],
+    "wrap-ansi-cjs/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
-    "@aws-crypto/sha256-browser/@smithy/util-utf8/@smithy/util-buffer-from": ["@smithy/util-buffer-from@2.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA=="],
+    "yargs/find-up": ["find-up@4.1.0", "", { "dependencies": { "locate-path": "^5.0.0", "path-exists": "^4.0.0" } }, "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw=="],
 
-    "@aws-crypto/util/@smithy/util-utf8/@smithy/util-buffer-from": ["@smithy/util-buffer-from@2.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA=="],
+    "@deno/shim-deno/which/isexe": ["isexe@3.1.5", "", {}, "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w=="],
 
     "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.18.20", "", { "os": "android", "cpu": "arm" }, "sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw=="],
 
@@ -2824,82 +3543,198 @@
 
     "@esbuild-kit/core-utils/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.18.20", "", { "os": "win32", "cpu": "x64" }, "sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ=="],
 
+    "@isaacs/cliui/string-width/emoji-regex": ["emoji-regex@9.2.2", "", {}, "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="],
+
+    "@isaacs/cliui/wrap-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
+
+    "@mapbox/node-pre-gyp/https-proxy-agent/agent-base": ["agent-base@7.1.4", "", {}, "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ=="],
+
     "@modelcontextprotocol/sdk/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
-    "@radix-ui/react-accordion/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-dismissable-layer/@radix-ui/react-use-callback-ref": ["@radix-ui/react-use-callback-ref@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg=="],
+
+    "@radix-ui/react-tooltip/@radix-ui/react-dismissable-layer/@radix-ui/react-use-escape-keydown": ["@radix-ui/react-use-escape-keydown@1.1.1", "", { "dependencies": { "@radix-ui/react-use-callback-ref": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g=="],
 
-    "@radix-ui/react-arrow/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-popper/@radix-ui/react-arrow": ["@radix-ui/react-arrow@1.1.7", "", { "dependencies": { "@radix-ui/react-primitive": "2.1.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-F+M1tLhO+mlQaOWspE8Wstg+z6PwxwRd8oQ8IXceWz92kfAmalTRf0EjrouQeo7QssEPfCn05B4Ihs1K9WQ/7w=="],
 
-    "@radix-ui/react-aspect-ratio/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-popper/@radix-ui/react-use-callback-ref": ["@radix-ui/react-use-callback-ref@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg=="],
 
-    "@radix-ui/react-checkbox/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-popper/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ=="],
 
-    "@radix-ui/react-collapsible/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-popper/@radix-ui/react-use-rect": ["@radix-ui/react-use-rect@1.1.1", "", { "dependencies": { "@radix-ui/rect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-QTYuDesS0VtuHNNvMh+CjlKJ4LJickCMUAqjlE3+j8w+RlRpwyX3apEQKGFzbZGdo7XNG1tXa+bQqIE7HIXT2w=="],
 
-    "@radix-ui/react-context-menu/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-popper/@radix-ui/react-use-size": ["@radix-ui/react-use-size@1.1.1", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-ewrXRDTAqAXlkl6t/fkXWNAhFX9I+CkKlw6zjEwk86RSPKwZr3xpBRso655aqYafwtnbpHLj6toFzmd6xdVptQ=="],
 
-    "@radix-ui/react-dismissable-layer/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-popper/@radix-ui/rect": ["@radix-ui/rect@1.1.1", "", {}, "sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw=="],
 
-    "@radix-ui/react-dropdown-menu/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-portal/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ=="],
 
-    "@radix-ui/react-focus-scope/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-presence/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ=="],
 
-    "@radix-ui/react-form/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-use-controllable-state/@radix-ui/react-use-effect-event": ["@radix-ui/react-use-effect-event@0.0.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA=="],
 
-    "@radix-ui/react-hover-card/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@radix-ui/react-tooltip/@radix-ui/react-use-controllable-state/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ=="],
 
-    "@radix-ui/react-menubar/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
 
-    "@radix-ui/react-navigation-menu/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/directive-functions-plugin/@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
-    "@radix-ui/react-one-time-password-field/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@babel/code-frame": ["@babel/code-frame@7.26.2", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.25.9", "js-tokens": "^4.0.0", "picocolors": "^1.0.0" } }, "sha512-RJlIHRueQgwWitWgF8OdFYGZX328Ax5BCemNGlqHfplnRT9ESi8JkFlvaVYbS+UubVY6dpv87Fs2u5M29iNFVQ=="],
 
-    "@radix-ui/react-password-toggle-field/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-core": ["@tanstack/router-core@1.131.50", "", { "dependencies": { "@tanstack/history": "1.131.2", "@tanstack/store": "^0.7.0", "cookie-es": "^1.2.2", "seroval": "^1.3.2", "seroval-plugins": "^1.3.2", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" } }, "sha512-eojd4JZ5ziUhGEmXZ4CaVX5mQdiTMiz56Sp8ZQ6r7deb55Q+5G4JQDkeuXpI7HMAvzr+4qlsFeLaDRXXjXyOqQ=="],
 
-    "@radix-ui/react-popper/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-generator": ["@tanstack/router-generator@1.131.50", "", { "dependencies": { "@tanstack/router-core": "1.131.50", "@tanstack/router-utils": "1.131.2", "@tanstack/virtual-file-routes": "1.131.2", "prettier": "^3.5.0", "recast": "^0.23.11", "source-map": "^0.7.4", "tsx": "^4.19.2", "zod": "^3.24.2" } }, "sha512-zlMBw5l88GIg3v+378JsfDYq3ejEaJmD3P1R+m0yEPxh0N//Id1FjKNSS7yJbejlK2WGVm9DUG46iBdTDMQM+Q=="],
 
-    "@radix-ui/react-portal/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-plugin": ["@tanstack/router-plugin@1.131.50", "", { "dependencies": { "@babel/core": "^7.27.7", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/router-core": "1.131.50", "@tanstack/router-generator": "1.131.50", "@tanstack/router-utils": "1.131.2", "@tanstack/virtual-file-routes": "1.131.2", "babel-dead-code-elimination": "^1.0.10", "chokidar": "^3.6.0", "unplugin": "^2.1.2", "zod": "^3.24.2" }, "peerDependencies": { "@rsbuild/core": ">=1.0.2", "@tanstack/react-router": "^1.131.50", "vite": ">=5.0.0 || >=6.0.0", "vite-plugin-solid": "^2.11.2", "webpack": ">=5.92.0" }, "optionalPeers": ["@rsbuild/core", "@tanstack/react-router", "vite", "vite-plugin-solid", "webpack"] }, "sha512-gdEBPGzx7llQNRnaqfPJ1iaPS3oqB8SlvKRG5l7Fxp4q4yINgkeowFYSKEhPOc9bjoNhGrIHOlvPTPXEzAQXzQ=="],
 
-    "@radix-ui/react-progress/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-utils": ["@tanstack/router-utils@1.131.2", "", { "dependencies": { "@babel/core": "^7.27.4", "@babel/generator": "^7.27.5", "@babel/parser": "^7.27.5", "@babel/preset-typescript": "^7.27.1", "ansis": "^4.1.0", "diff": "^8.0.2" } }, "sha512-sr3x0d2sx9YIJoVth0QnfEcAcl+39sQYaNQxThtHmRpyeFYNyM2TTH+Ud3TNEnI3bbzmLYEUD+7YqB987GzhDA=="],
 
-    "@radix-ui/react-radio-group/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/server-functions-plugin": ["@tanstack/server-functions-plugin@1.131.2", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/directive-functions-plugin": "1.131.2", "babel-dead-code-elimination": "^1.0.9", "tiny-invariant": "^1.3.3" } }, "sha512-hWsaSgEZAVyzHg8+IcJWCEtfI9ZSlNELErfLiGHG9XCHEXMegFWsrESsKHlASzJqef9RsuOLDl+1IMPIskwdDw=="],
 
-    "@radix-ui/react-roving-focus/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/start-server-core": ["@tanstack/start-server-core@1.131.50", "", { "dependencies": { "@tanstack/history": "1.131.2", "@tanstack/router-core": "1.131.50", "@tanstack/start-client-core": "1.131.50", "@tanstack/start-storage-context": "1.131.50", "h3": "1.13.0", "isbot": "^5.1.22", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3", "unctx": "^2.4.1" } }, "sha512-3SWwwhW2GKMhPSaqWRal6Jj1Y9ObfdWEXKFQid1LBuk5xk/Es4bmW68o++MbVgs/GxUxyeZ3TRVqb0c7RG1sog=="],
 
-    "@radix-ui/react-scroll-area/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/h3": ["h3@1.13.0", "", { "dependencies": { "cookie-es": "^1.2.2", "crossws": ">=0.2.0 <0.4.0", "defu": "^6.1.4", "destr": "^2.0.3", "iron-webcrypto": "^1.2.1", "ohash": "^1.1.4", "radix3": "^1.1.2", "ufo": "^1.5.4", "uncrypto": "^0.1.3", "unenv": "^1.10.0" } }, "sha512-vFEAu/yf8UMUcB4s43OaDaigcqpQd14yanmOsn+NcRX3/guSKncyE2rOYhq8RIchgJrPSs/QiIddnTTR1ddiAg=="],
 
-    "@radix-ui/react-separator/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/xmlbuilder2": ["xmlbuilder2@3.1.1", "", { "dependencies": { "@oozcitak/dom": "1.15.10", "@oozcitak/infra": "1.0.8", "@oozcitak/util": "8.3.8", "js-yaml": "3.14.1" } }, "sha512-WCSfbfZnQDdLQLiMdGUQpMxxckeQ4oZNMNhLVkcekTu7xhD4tuUDyAPoY8CwXvBYE6LwBHd6QW2WZXlOWr1vCw=="],
 
-    "@radix-ui/react-slider/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/router-plugin/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
 
-    "@radix-ui/react-switch/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/server-functions-plugin/@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
-    "@radix-ui/react-tabs/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/start-config/@vitejs/plugin-react/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.27", "", {}, "sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA=="],
 
-    "@radix-ui/react-toast/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/start-plugin-core/@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
-    "@radix-ui/react-toggle-group/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/start-server-functions-client/@tanstack/server-functions-plugin/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
 
-    "@radix-ui/react-toggle/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/start-server-functions-client/@tanstack/server-functions-plugin/@tanstack/directive-functions-plugin": ["@tanstack/directive-functions-plugin@1.131.2", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/router-utils": "1.131.2", "babel-dead-code-elimination": "^1.0.10", "tiny-invariant": "^1.3.3" }, "peerDependencies": { "vite": ">=6.0.0" } }, "sha512-5Pz6aVPS0BW+0bLvMzWsoajfjI6ZeWqkbVBaQfIbSTm4DOBO05JuQ/pb7W7m3GbCb5TK1a/SKDhuTX6Ag5I7UQ=="],
 
-    "@radix-ui/react-toolbar/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/start-server-functions-fetcher/@tanstack/router-core/@tanstack/history": ["@tanstack/history@1.131.2", "", {}, "sha512-cs1WKawpXIe+vSTeiZUuSBy8JFjEuDgdMKZFRLKwQysKo8y2q6Q1HvS74Yw+m5IhOW1nTZooa6rlgdfXcgFAaw=="],
 
-    "@radix-ui/react-visually-hidden/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
+    "@tanstack/start-server-functions-fetcher/@tanstack/router-core/@tanstack/store": ["@tanstack/store@0.7.7", "", {}, "sha512-xa6pTan1bcaqYDS9BDpSiS63qa6EoDkPN9RsRaxHuDdVDNntzq3xNwR5YKTU/V3SkSyC9T4YVOPh2zRQN0nhIQ=="],
 
-    "@tanstack/router-plugin/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+    "@tanstack/start-server-functions-fetcher/@tanstack/router-core/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "@tanstack/start-server-functions-fetcher/@tanstack/start-client-core/@tanstack/start-storage-context": ["@tanstack/start-storage-context@1.131.50", "", { "dependencies": { "@tanstack/router-core": "1.131.50" } }, "sha512-qbVFdx/B5URJXzWjguaiCcQhJw2NL8qFGtSzLSGilxQnvtJdM+V9VBMizKIxhm9oiYnfqGsVfyMOBD7q9f8Y1Q=="],
+
+    "@tanstack/start-server-functions-fetcher/@tanstack/start-client-core/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "@tanstack/start-server-functions-server/@tanstack/server-functions-plugin/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
+
+    "@tanstack/start-server-functions-server/@tanstack/server-functions-plugin/@tanstack/directive-functions-plugin": ["@tanstack/directive-functions-plugin@1.131.2", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/router-utils": "1.131.2", "babel-dead-code-elimination": "^1.0.10", "tiny-invariant": "^1.3.3" }, "peerDependencies": { "vite": ">=6.0.0" } }, "sha512-5Pz6aVPS0BW+0bLvMzWsoajfjI6ZeWqkbVBaQfIbSTm4DOBO05JuQ/pb7W7m3GbCb5TK1a/SKDhuTX6Ag5I7UQ=="],
+
+    "@vinxi/listhen/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "@vinxi/listhen/h3/crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
 
     "ajv-formats/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
+    "archiver-utils/glob/minimatch": ["minimatch@9.0.9", "", { "dependencies": { "brace-expansion": "^2.0.2" } }, "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg=="],
+
+    "archiver-utils/glob/path-scurry": ["path-scurry@1.11.1", "", { "dependencies": { "lru-cache": "^10.2.0", "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" } }, "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA=="],
+
+    "boxen/string-width/emoji-regex": ["emoji-regex@9.2.2", "", {}, "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="],
+
+    "boxen/wrap-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
+
+    "bullmq/ioredis/@ioredis/commands": ["@ioredis/commands@1.5.1", "", {}, "sha512-JH8ZL/ywcJyR9MmJ5BNqZllXNZQqQbnVZOqpPQqE1vHiFgAw4NHbvE0FOduNU8IX9babitBT46571OnPTT0Zcw=="],
+
+    "c12/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
     "cliui/wrap-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
-    "eslint-plugin-react/minimatch/brace-expansion": ["brace-expansion@1.1.14", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g=="],
+    "eslint-plugin-react/minimatch/brace-expansion": ["brace-expansion@1.1.15", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg=="],
 
     "form-data/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
 
+    "lazystream/readable-stream/isarray": ["isarray@1.0.0", "", {}, "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="],
+
+    "lazystream/readable-stream/safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="],
+
+    "lazystream/readable-stream/string_decoder": ["string_decoder@1.1.1", "", { "dependencies": { "safe-buffer": "~5.1.0" } }, "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg=="],
+
+    "listhen/@parcel/watcher-wasm/napi-wasm": ["napi-wasm@1.1.3", "", { "bundled": true }, "sha512-h/4nMGsHjZDCYmQVNODIrYACVJ+I9KItbG+0si6W/jSjdA9JbWDoU4LLeMXVcEQGHjttI2tuXqDrbGF7qkUHHg=="],
+
+    "listhen/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "listhen/h3/crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
+
     "log-update/slice-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
 
     "log-update/slice-ansi/is-fullwidth-code-point": ["is-fullwidth-code-point@5.1.0", "", { "dependencies": { "get-east-asian-width": "^1.3.1" } }, "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ=="],
 
+    "mlly/pkg-types/confbox": ["confbox@0.1.8", "", {}, "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w=="],
+
+    "nitropack/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
+    "nitropack/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.1", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ=="],
+
+    "nitropack/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.28.1", "", { "os": "android", "cpu": "arm" }, "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ=="],
+
+    "nitropack/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.1", "", { "os": "android", "cpu": "arm64" }, "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg=="],
+
+    "nitropack/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.28.1", "", { "os": "android", "cpu": "x64" }, "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng=="],
+
+    "nitropack/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q=="],
+
+    "nitropack/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ=="],
+
+    "nitropack/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.1", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw=="],
+
+    "nitropack/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ=="],
+
+    "nitropack/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.1", "", { "os": "linux", "cpu": "arm" }, "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ=="],
+
+    "nitropack/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g=="],
+
+    "nitropack/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.1", "", { "os": "linux", "cpu": "ia32" }, "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w=="],
+
+    "nitropack/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg=="],
+
+    "nitropack/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ=="],
+
+    "nitropack/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ=="],
+
+    "nitropack/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ=="],
+
+    "nitropack/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag=="],
+
+    "nitropack/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.1", "", { "os": "linux", "cpu": "x64" }, "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA=="],
+
+    "nitropack/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw=="],
+
+    "nitropack/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.1", "", { "os": "none", "cpu": "x64" }, "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg=="],
+
+    "nitropack/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.1", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q=="],
+
+    "nitropack/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.1", "", { "os": "openbsd", "cpu": "x64" }, "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw=="],
+
+    "nitropack/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg=="],
+
+    "nitropack/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.1", "", { "os": "sunos", "cpu": "x64" }, "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ=="],
+
+    "nitropack/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA=="],
+
+    "nitropack/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg=="],
+
+    "nitropack/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.1", "", { "os": "win32", "cpu": "x64" }, "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A=="],
+
+    "nitropack/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "nitropack/unstorage/lru-cache": ["lru-cache@11.5.1", "", {}, "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A=="],
+
+    "radix-ui/@radix-ui/react-tooltip/@radix-ui/react-id": ["@radix-ui/react-id@1.1.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA=="],
+
+    "readdir-glob/minimatch/brace-expansion": ["brace-expansion@2.1.1", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA=="],
+
+    "rollup-plugin-visualizer/yargs/cliui": ["cliui@9.0.1", "", { "dependencies": { "string-width": "^7.2.0", "strip-ansi": "^7.1.0", "wrap-ansi": "^9.0.0" } }, "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w=="],
+
+    "rollup-plugin-visualizer/yargs/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+
+    "rollup-plugin-visualizer/yargs/y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
+
+    "rollup-plugin-visualizer/yargs/yargs-parser": ["yargs-parser@22.0.0", "", {}, "sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw=="],
+
     "tsup/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.7", "", { "os": "aix", "cpu": "ppc64" }, "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg=="],
 
     "tsup/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.7", "", { "os": "android", "cpu": "arm" }, "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ=="],
@@ -2952,106 +3787,224 @@
 
     "tsup/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.7", "", { "os": "win32", "cpu": "x64" }, "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg=="],
 
-    "tsx/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.7", "", { "os": "aix", "cpu": "ppc64" }, "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg=="],
+    "tsx/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.1", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ=="],
+
+    "tsx/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.28.1", "", { "os": "android", "cpu": "arm" }, "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ=="],
+
+    "tsx/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.1", "", { "os": "android", "cpu": "arm64" }, "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg=="],
+
+    "tsx/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.28.1", "", { "os": "android", "cpu": "x64" }, "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng=="],
+
+    "tsx/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q=="],
+
+    "tsx/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ=="],
+
+    "tsx/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.1", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw=="],
+
+    "tsx/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ=="],
 
-    "tsx/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.7", "", { "os": "android", "cpu": "arm" }, "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ=="],
+    "tsx/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.1", "", { "os": "linux", "cpu": "arm" }, "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ=="],
 
-    "tsx/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.7", "", { "os": "android", "cpu": "arm64" }, "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ=="],
+    "tsx/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g=="],
 
-    "tsx/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.7", "", { "os": "android", "cpu": "x64" }, "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg=="],
+    "tsx/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.1", "", { "os": "linux", "cpu": "ia32" }, "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w=="],
 
-    "tsx/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw=="],
+    "tsx/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg=="],
 
-    "tsx/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ=="],
+    "tsx/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ=="],
 
-    "tsx/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.7", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w=="],
+    "tsx/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ=="],
 
-    "tsx/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ=="],
+    "tsx/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ=="],
 
-    "tsx/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.7", "", { "os": "linux", "cpu": "arm" }, "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA=="],
+    "tsx/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag=="],
 
-    "tsx/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A=="],
+    "tsx/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.1", "", { "os": "linux", "cpu": "x64" }, "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA=="],
 
-    "tsx/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.7", "", { "os": "linux", "cpu": "ia32" }, "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg=="],
+    "tsx/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw=="],
 
-    "tsx/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q=="],
+    "tsx/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.1", "", { "os": "none", "cpu": "x64" }, "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg=="],
 
-    "tsx/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw=="],
+    "tsx/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.1", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q=="],
 
-    "tsx/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ=="],
+    "tsx/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.1", "", { "os": "openbsd", "cpu": "x64" }, "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw=="],
 
-    "tsx/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ=="],
+    "tsx/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg=="],
 
-    "tsx/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw=="],
+    "tsx/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.1", "", { "os": "sunos", "cpu": "x64" }, "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ=="],
 
-    "tsx/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.7", "", { "os": "linux", "cpu": "x64" }, "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA=="],
+    "tsx/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA=="],
 
-    "tsx/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w=="],
+    "tsx/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg=="],
 
-    "tsx/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.7", "", { "os": "none", "cpu": "x64" }, "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw=="],
+    "tsx/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.1", "", { "os": "win32", "cpu": "x64" }, "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A=="],
 
-    "tsx/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.7", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A=="],
+    "vinxi/chokidar/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
 
-    "tsx/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.7", "", { "os": "openbsd", "cpu": "x64" }, "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg=="],
+    "vinxi/chokidar/readdirp": ["readdirp@3.6.0", "", { "dependencies": { "picomatch": "^2.2.1" } }, "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA=="],
 
-    "tsx/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw=="],
+    "vinxi/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.20.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-D+EBOJHXdNZcLJRBkhENNG8Wji2kgc9AZ9KiPr1JuZjsNtyHzrsfLRrY0tk2H2aoFu6RANO1y1iPPUCDYWkb5g=="],
 
-    "tsx/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.7", "", { "os": "sunos", "cpu": "x64" }, "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA=="],
+    "vinxi/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.20.2", "", { "os": "android", "cpu": "arm" }, "sha512-t98Ra6pw2VaDhqNWO2Oph2LXbz/EJcnLmKLGBJwEwXX/JAN83Fym1rU8l0JUWK6HkIbWONCSSatf4sf2NBRx/w=="],
 
-    "tsx/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA=="],
+    "vinxi/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.20.2", "", { "os": "android", "cpu": "arm64" }, "sha512-mRzjLacRtl/tWU0SvD8lUEwb61yP9cqQo6noDZP/O8VkwafSYwZ4yWy24kan8jE/IMERpYncRt2dw438LP3Xmg=="],
 
-    "tsx/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.7", "", { "os": "win32", "cpu": "ia32" }, "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw=="],
+    "vinxi/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.20.2", "", { "os": "android", "cpu": "x64" }, "sha512-btzExgV+/lMGDDa194CcUQm53ncxzeBrWJcncOBxuC6ndBkKxnHdFJn86mCIgTELsooUmwUm9FkhSp5HYu00Rg=="],
 
-    "tsx/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.7", "", { "os": "win32", "cpu": "x64" }, "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg=="],
+    "vinxi/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.20.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4J6IRT+10J3aJH3l1yzEg9y3wkTDgDk7TSDFX+wKFiWjqWp/iCfLIYzGyasx9l0SAFPT1HwSCR+0w/h1ES/MjA=="],
 
-    "vite/rolldown/@oxc-project/types": ["@oxc-project/types@0.124.0", "", {}, "sha512-VBFWMTBvHxS11Z5Lvlr3IWgrwhMTXV+Md+EQF0Xf60+wAdsGFTBx7X7K/hP4pi8N7dcm1RvcHwDxZ16Qx8keUg=="],
+    "vinxi/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.20.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-tBcXp9KNphnNH0dfhv8KYkZhjc+H3XBkF5DKtswJblV7KlT9EI2+jeA8DgBjp908WEuYll6pF+UStUCfEpdysA=="],
 
-    "vite/rolldown/@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-rc.15", "", { "os": "android", "cpu": "arm64" }, "sha512-YYe6aWruPZDtHNpwu7+qAHEMbQ/yRl6atqb/AhznLTnD3UY99Q1jE7ihLSahNWkF4EqRPVC4SiR4O0UkLK02tA=="],
+    "vinxi/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.20.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-d3qI41G4SuLiCGCFGUrKsSeTXyWG6yem1KcGZVS+3FYlYhtNoNgYrWcvkOoaqMhwXSMrZRl69ArHsGJ9mYdbbw=="],
 
-    "vite/rolldown/@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-rc.15", "", { "os": "darwin", "cpu": "arm64" }, "sha512-oArR/ig8wNTPYsXL+Mzhs0oxhxfuHRfG7Ikw7jXsw8mYOtk71W0OkF2VEVh699pdmzjPQsTjlD1JIOoHkLP1Fg=="],
+    "vinxi/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.20.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-d+DipyvHRuqEeM5zDivKV1KuXn9WeRX6vqSqIDgwIfPQtwMP4jaDsQsDncjTDDsExT4lR/91OLjRo8bmC1e+Cw=="],
 
-    "vite/rolldown/@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.0-rc.15", "", { "os": "darwin", "cpu": "x64" }, "sha512-YzeVqOqjPYvUbJSWJ4EDL8ahbmsIXQpgL3JVipmN+MX0XnXMeWomLN3Fb+nwCmP/jfyqte5I3XRSm7OfQrbyxw=="],
+    "vinxi/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.20.2", "", { "os": "linux", "cpu": "arm" }, "sha512-VhLPeR8HTMPccbuWWcEUD1Az68TqaTYyj6nfE4QByZIQEQVWBB8vup8PpR7y1QHL3CpcF6xd5WVBU/+SBEvGTg=="],
 
-    "vite/rolldown/@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.0-rc.15", "", { "os": "freebsd", "cpu": "x64" }, "sha512-9Erhx956jeQ0nNTyif1+QWAXDRD38ZNjr//bSHrt6wDwB+QkAfl2q6Mn1k6OBPerznjRmbM10lgRb1Pli4xZPw=="],
+    "vinxi/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.20.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-9pb6rBjGvTFNira2FLIWqDk/uaf42sSyLE8j1rnUpuzsODBq7FvpwHYZxQ/It/8b+QOS1RYfqgGFNLRI+qlq2A=="],
 
-    "vite/rolldown/@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.15", "", { "os": "linux", "cpu": "arm" }, "sha512-cVwk0w8QbZJGTnP/AHQBs5yNwmpgGYStL88t4UIaqcvYJWBfS0s3oqVLZPwsPU6M0zlW4GqjP0Zq5MnAGwFeGA=="],
+    "vinxi/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.20.2", "", { "os": "linux", "cpu": "ia32" }, "sha512-o10utieEkNPFDZFQm9CoP7Tvb33UutoJqg3qKf1PWVeeJhJw0Q347PxMvBgVVFgouYLGIhFYG0UGdBumROyiig=="],
 
-    "vite/rolldown/@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.0-rc.15", "", { "os": "linux", "cpu": "arm64" }, "sha512-eBZ/u8iAK9SoHGanqe/jrPnY0JvBN6iXbVOsbO38mbz+ZJsaobExAm1Iu+rxa4S1l2FjG0qEZn4Rc6X8n+9M+w=="],
+    "vinxi/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.20.2", "", { "os": "linux", "cpu": "none" }, "sha512-PR7sp6R/UC4CFVomVINKJ80pMFlfDfMQMYynX7t1tNTeivQ6XdX5r2XovMmha/VjR1YN/HgHWsVcTRIMkymrgQ=="],
 
-    "vite/rolldown/@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.0-rc.15", "", { "os": "linux", "cpu": "arm64" }, "sha512-ZvRYMGrAklV9PEkgt4LQM6MjQX2P58HPAuecwYObY2DhS2t35R0I810bKi0wmaYORt6m/2Sm+Z+nFgb0WhXNcQ=="],
+    "vinxi/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.20.2", "", { "os": "linux", "cpu": "none" }, "sha512-4BlTqeutE/KnOiTG5Y6Sb/Hw6hsBOZapOVF6njAESHInhlQAghVVZL1ZpIctBOoTFbQyGW+LsVYZ8lSSB3wkjA=="],
 
-    "vite/rolldown/@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.15", "", { "os": "linux", "cpu": "ppc64" }, "sha512-VDpgGBzgfg5hLg+uBpCLoFG5kVvEyafmfxGUV0UHLcL5irxAK7PKNeC2MwClgk6ZAiNhmo9FLhRYgvMmedLtnQ=="],
+    "vinxi/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.20.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-rD3KsaDprDcfajSKdn25ooz5J5/fWBylaaXkuotBDGnMnDP1Uv5DLAN/45qfnf3JDYyJv/ytGHQaziHUdyzaAg=="],
 
-    "vite/rolldown/@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.0-rc.15", "", { "os": "linux", "cpu": "s390x" }, "sha512-y1uXY3qQWCzcPgRJATPSOUP4tCemh4uBdY7e3EZbVwCJTY3gLJWnQABgeUetvED+bt1FQ01OeZwvhLS2bpNrAQ=="],
+    "vinxi/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.20.2", "", { "os": "linux", "cpu": "none" }, "sha512-snwmBKacKmwTMmhLlz/3aH1Q9T8v45bKYGE3j26TsaOVtjIag4wLfWSiZykXzXuE1kbCE+zJRmwp+ZbIHinnVg=="],
 
-    "vite/rolldown/@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.0-rc.15", "", { "os": "linux", "cpu": "x64" }, "sha512-023bTPBod7J3Y/4fzAN6QtpkSABR0rigtrwaP+qSEabUh5zf6ELr9Nc7GujaROuPY3uwdSIXWrvhn1KxOvurWA=="],
+    "vinxi/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.20.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-wcWISOobRWNm3cezm5HOZcYz1sKoHLd8VL1dl309DiixxVFoFe/o8HnwuIwn6sXre88Nwj+VwZUvJf4AFxkyrQ=="],
 
-    "vite/rolldown/@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.0-rc.15", "", { "os": "linux", "cpu": "x64" }, "sha512-witB2O0/hU4CgfOOKUoeFgQ4GktPi1eEbAhaLAIpgD6+ZnhcPkUtPsoKKHRzmOoWPZue46IThdSgdo4XneOLYw=="],
+    "vinxi/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.20.2", "", { "os": "linux", "cpu": "x64" }, "sha512-1MdwI6OOTsfQfek8sLwgyjOXAu+wKhLEoaOLTjbijk6E2WONYpH9ZU2mNtR+lZ2B4uwr+usqGuVfFT9tMtGvGw=="],
 
-    "vite/rolldown/@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.0-rc.15", "", { "os": "none", "cpu": "arm64" }, "sha512-UCL68NJ0Ud5zRipXZE9dF5PmirzJE4E4BCIOOssEnM7wLDsxjc6Qb0sGDxTNRTP53I6MZpygyCpY8Aa8sPfKPg=="],
+    "vinxi/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.20.2", "", { "os": "none", "cpu": "x64" }, "sha512-K8/DhBxcVQkzYc43yJXDSyjlFeHQJBiowJ0uVL6Tor3jGQfSGHNNJcWxNbOI8v5k82prYqzPuwkzHt3J1T1iZQ=="],
 
-    "vite/rolldown/@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.0-rc.15", "", { "dependencies": { "@emnapi/core": "1.9.2", "@emnapi/runtime": "1.9.2", "@napi-rs/wasm-runtime": "^1.1.3" }, "cpu": "none" }, "sha512-ApLruZq/ig+nhaE7OJm4lDjayUnOHVUa77zGeqnqZ9pn0ovdVbbNPerVibLXDmWeUZXjIYIT8V3xkT58Rm9u5Q=="],
+    "vinxi/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.20.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-eMpKlV0SThJmmJgiVyN9jTPJ2VBPquf6Kt/nAoo6DgHAoN57K15ZghiHaMvqjCye/uU4X5u3YSMgVBI1h3vKrQ=="],
 
-    "vite/rolldown/@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.0-rc.15", "", { "os": "win32", "cpu": "arm64" }, "sha512-KmoUoU7HnN+Si5YWJigfTws1jz1bKBYDQKdbLspz0UaqjjFkddHsqorgiW1mxcAj88lYUE6NC/zJNwT+SloqtA=="],
+    "vinxi/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.20.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-2UyFtRC6cXLyejf/YEld4Hajo7UHILetzE1vsRcGL3earZEW77JxrFjH4Ez2qaTiEfMgAXxfAZCm1fvM/G/o8w=="],
 
-    "vite/rolldown/@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.0-rc.15", "", { "os": "win32", "cpu": "x64" }, "sha512-3P2A8L+x75qavWLe/Dll3EYBJLQmtkJN8rfh+U/eR3MqMgL/h98PhYI+JFfXuDPgPeCB7iZAKiqii5vqOvnA0g=="],
+    "vinxi/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.20.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-GRibxoawM9ZCnDxnP3usoUDO9vUkpAxIIZ6GQI+IlVmr5kP3zUq+l17xELTHMWTWzjxa2guPNyrpq1GWmPvcGQ=="],
 
-    "vite/rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.15", "", {}, "sha512-UromN0peaE53IaBRe9W7CjrZgXl90fqGpK+mIZbA3qSTeYqg3pqpROBdIPvOG3F5ereDHNwoHBI2e50n1BDr1g=="],
+    "vinxi/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.20.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-HfLOfn9YWmkSKRQqovpnITazdtquEW8/SoHW7pWpuEeguaZI4QnCRW6b+oZTztdBnZOS2hqJ6im/D5cPzBTTlQ=="],
+
+    "vinxi/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.20.2", "", { "os": "win32", "cpu": "x64" }, "sha512-N49X4lJX27+l9jbLKSqZ6bKNjzQvHaT8IIFUy+YIqmXQdjYCToGWwOItDrfby14c78aDd5NHQl29xingXfCdLQ=="],
+
+    "vinxi/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "vinxi/h3/ohash": ["ohash@1.1.6", "", {}, "sha512-TBu7PtV8YkAZn0tSxobKY2n2aAQva936lhRrj6957aDaCf9IEtqsKbgMzXE/F/sjqYOwmrukeORHNLe5glk7Cg=="],
+
+    "vinxi/serve-static/send": ["send@0.19.2", "", { "dependencies": { "debug": "2.6.9", "depd": "2.0.0", "destroy": "1.2.0", "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "etag": "~1.8.1", "fresh": "~0.5.2", "http-errors": "~2.0.1", "mime": "1.6.0", "ms": "2.1.3", "on-finished": "~2.4.1", "range-parser": "~1.2.1", "statuses": "~2.0.2" } }, "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg=="],
+
+    "vinxi/unenv/mime": ["mime@3.0.0", "", { "bin": { "mime": "cli.js" } }, "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A=="],
+
+    "vinxi/unstorage/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "vinxi/unstorage/h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
+
+    "vinxi/unstorage/lru-cache": ["lru-cache@11.5.1", "", {}, "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A=="],
+
+    "vinxi/unstorage/ofetch": ["ofetch@1.5.1", "", { "dependencies": { "destr": "^2.0.5", "node-fetch-native": "^1.6.7", "ufo": "^1.6.1" } }, "sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA=="],
+
+    "vinxi/vite/esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
+
+    "widest-line/string-width/emoji-regex": ["emoji-regex@9.2.2", "", {}, "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="],
 
     "yargs/find-up/locate-path": ["locate-path@5.0.0", "", { "dependencies": { "p-locate": "^4.1.0" } }, "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g=="],
 
-    "@aws-crypto/sha1-browser/@smithy/util-utf8/@smithy/util-buffer-from/@smithy/is-array-buffer": ["@smithy/is-array-buffer@2.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-core/@tanstack/history": ["@tanstack/history@1.131.2", "", {}, "sha512-cs1WKawpXIe+vSTeiZUuSBy8JFjEuDgdMKZFRLKwQysKo8y2q6Q1HvS74Yw+m5IhOW1nTZooa6rlgdfXcgFAaw=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-core/@tanstack/store": ["@tanstack/store@0.7.7", "", {}, "sha512-xa6pTan1bcaqYDS9BDpSiS63qa6EoDkPN9RsRaxHuDdVDNntzq3xNwR5YKTU/V3SkSyC9T4YVOPh2zRQN0nhIQ=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-core/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-generator/@tanstack/virtual-file-routes": ["@tanstack/virtual-file-routes@1.131.2", "", {}, "sha512-VEEOxc4mvyu67O+Bl0APtYjwcNRcL9it9B4HKbNgcBTIOEalhk+ufBl4kiqc8WP1sx1+NAaiS+3CcJBhrqaSRg=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-plugin/@tanstack/virtual-file-routes": ["@tanstack/virtual-file-routes@1.131.2", "", {}, "sha512-VEEOxc4mvyu67O+Bl0APtYjwcNRcL9it9B4HKbNgcBTIOEalhk+ufBl4kiqc8WP1sx1+NAaiS+3CcJBhrqaSRg=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-plugin/chokidar": ["chokidar@3.6.0", "", { "dependencies": { "anymatch": "~3.1.2", "braces": "~3.0.2", "glob-parent": "~5.1.2", "is-binary-path": "~2.1.0", "is-glob": "~4.0.1", "normalize-path": "~3.0.0", "readdirp": "~3.6.0" }, "optionalDependencies": { "fsevents": "~2.3.2" } }, "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw=="],
 
-    "@aws-crypto/sha256-browser/@smithy/util-utf8/@smithy/util-buffer-from/@smithy/is-array-buffer": ["@smithy/is-array-buffer@2.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-plugin/unplugin": ["unplugin@2.3.11", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "acorn": "^8.15.0", "picomatch": "^4.0.3", "webpack-virtual-modules": "^0.6.2" } }, "sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww=="],
 
-    "@aws-crypto/util/@smithy/util-utf8/@smithy/util-buffer-from/@smithy/is-array-buffer": ["@smithy/is-array-buffer@2.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA=="],
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/server-functions-plugin/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/server-functions-plugin/@tanstack/directive-functions-plugin": ["@tanstack/directive-functions-plugin@1.131.2", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/router-utils": "1.131.2", "babel-dead-code-elimination": "^1.0.10", "tiny-invariant": "^1.3.3" }, "peerDependencies": { "vite": ">=6.0.0" } }, "sha512-5Pz6aVPS0BW+0bLvMzWsoajfjI6ZeWqkbVBaQfIbSTm4DOBO05JuQ/pb7W7m3GbCb5TK1a/SKDhuTX6Ag5I7UQ=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/start-server-core/@tanstack/history": ["@tanstack/history@1.131.2", "", {}, "sha512-cs1WKawpXIe+vSTeiZUuSBy8JFjEuDgdMKZFRLKwQysKo8y2q6Q1HvS74Yw+m5IhOW1nTZooa6rlgdfXcgFAaw=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/start-server-core/@tanstack/start-client-core": ["@tanstack/start-client-core@1.131.50", "", { "dependencies": { "@tanstack/router-core": "1.131.50", "@tanstack/start-storage-context": "1.131.50", "cookie-es": "^1.2.2", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" } }, "sha512-8fbwYca1NAu/5WyGvO3e341/FPpsiqdPrrzkoc0cXQimMN1DligoRjvHgP13q3n5w1tFMSqChGzXfOVJP9ndSw=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/start-server-core/@tanstack/start-storage-context": ["@tanstack/start-storage-context@1.131.50", "", { "dependencies": { "@tanstack/router-core": "1.131.50" } }, "sha512-qbVFdx/B5URJXzWjguaiCcQhJw2NL8qFGtSzLSGilxQnvtJdM+V9VBMizKIxhm9oiYnfqGsVfyMOBD7q9f8Y1Q=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/h3/crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/h3/ohash": ["ohash@1.1.6", "", {}, "sha512-TBu7PtV8YkAZn0tSxobKY2n2aAQva936lhRrj6957aDaCf9IEtqsKbgMzXE/F/sjqYOwmrukeORHNLe5glk7Cg=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/h3/unenv": ["unenv@1.10.0", "", { "dependencies": { "consola": "^3.2.3", "defu": "^6.1.4", "mime": "^3.0.0", "node-fetch-native": "^1.6.4", "pathe": "^1.1.2" } }, "sha512-wY5bskBQFL9n3Eca5XnhH6KbUo/tfvkwm9OpcdCvLaeA7piBNbavbOKJySEwQ1V0RH6HvNlSAFRTpvTqgKRQXQ=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/xmlbuilder2/@oozcitak/dom": ["@oozcitak/dom@1.15.10", "", { "dependencies": { "@oozcitak/infra": "1.0.8", "@oozcitak/url": "1.0.4", "@oozcitak/util": "8.3.8" } }, "sha512-0JT29/LaxVgRcGKvHmSrUTEvZ8BXvZhGl2LASRUgHqDTC1M5g1pLmVv56IYNyt3bG2CUjDkc67wnyZC14pbQrQ=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/xmlbuilder2/@oozcitak/infra": ["@oozcitak/infra@1.0.8", "", { "dependencies": { "@oozcitak/util": "8.3.8" } }, "sha512-JRAUc9VR6IGHOL7OGF+yrvs0LO8SlqGnPAMqyzOuFZPSZSXI7Xf2O9+awQPSMXgIWGtgUf/dA6Hs6X6ySEaWTg=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/xmlbuilder2/@oozcitak/util": ["@oozcitak/util@8.3.8", "", {}, "sha512-T8TbSnGsxo6TDBJx/Sgv/BlVJL3tshxZP7Aq5R1mSnM5OcHY2dQaxLMu2+E8u3gN0MLOzdjurqN4ZRVuzQycOQ=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/xmlbuilder2/js-yaml": ["js-yaml@3.14.1", "", { "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g=="],
+
+    "@tanstack/start-server-functions-client/@tanstack/server-functions-plugin/@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "@tanstack/start-server-functions-client/@tanstack/server-functions-plugin/@tanstack/directive-functions-plugin/@tanstack/router-utils": ["@tanstack/router-utils@1.131.2", "", { "dependencies": { "@babel/core": "^7.27.4", "@babel/generator": "^7.27.5", "@babel/parser": "^7.27.5", "@babel/preset-typescript": "^7.27.1", "ansis": "^4.1.0", "diff": "^8.0.2" } }, "sha512-sr3x0d2sx9YIJoVth0QnfEcAcl+39sQYaNQxThtHmRpyeFYNyM2TTH+Ud3TNEnI3bbzmLYEUD+7YqB987GzhDA=="],
+
+    "@tanstack/start-server-functions-server/@tanstack/server-functions-plugin/@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "@tanstack/start-server-functions-server/@tanstack/server-functions-plugin/@tanstack/directive-functions-plugin/@tanstack/router-utils": ["@tanstack/router-utils@1.131.2", "", { "dependencies": { "@babel/core": "^7.27.4", "@babel/generator": "^7.27.5", "@babel/parser": "^7.27.5", "@babel/preset-typescript": "^7.27.1", "ansis": "^4.1.0", "diff": "^8.0.2" } }, "sha512-sr3x0d2sx9YIJoVth0QnfEcAcl+39sQYaNQxThtHmRpyeFYNyM2TTH+Ud3TNEnI3bbzmLYEUD+7YqB987GzhDA=="],
+
+    "archiver-utils/glob/minimatch/brace-expansion": ["brace-expansion@2.1.1", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA=="],
+
+    "archiver-utils/glob/path-scurry/lru-cache": ["lru-cache@10.4.3", "", {}, "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="],
 
     "eslint-plugin-react/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
 
-    "vite/rolldown/@rolldown/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.9.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw=="],
+    "readdir-glob/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
+
+    "vinxi/chokidar/readdirp/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
+    "vinxi/serve-static/send/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
+
+    "vinxi/serve-static/send/fresh": ["fresh@0.5.2", "", {}, "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q=="],
+
+    "vinxi/serve-static/send/mime": ["mime@1.6.0", "", { "bin": { "mime": "cli.js" } }, "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg=="],
+
+    "vinxi/unstorage/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
+    "vinxi/unstorage/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
 
     "yargs/find-up/locate-path/p-locate": ["p-locate@4.1.0", "", { "dependencies": { "p-limit": "^2.2.0" } }, "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A=="],
 
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-plugin/chokidar/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-plugin/chokidar/readdirp": ["readdirp@3.6.0", "", { "dependencies": { "picomatch": "^2.2.1" } }, "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/server-functions-plugin/@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/start-server-core/@tanstack/start-client-core/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/h3/unenv/mime": ["mime@3.0.0", "", { "bin": { "mime": "cli.js" } }, "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/h3/unenv/pathe": ["pathe@1.1.2", "", {}, "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/xmlbuilder2/@oozcitak/dom/@oozcitak/url": ["@oozcitak/url@1.0.4", "", { "dependencies": { "@oozcitak/infra": "1.0.8", "@oozcitak/util": "8.3.8" } }, "sha512-kDcD8y+y3FCSOvnBI6HJgl00viO/nGbQoCINmQ0h98OhnGITrWR3bOGfwYCthgcrV8AnTJz8MzslTQbC3SOAmw=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/xmlbuilder2/js-yaml/argparse": ["argparse@1.0.10", "", { "dependencies": { "sprintf-js": "~1.0.2" } }, "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg=="],
+
+    "archiver-utils/glob/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
+
+    "vinxi/serve-static/send/debug/ms": ["ms@2.0.0", "", {}, "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="],
+
     "yargs/find-up/locate-path/p-locate/p-limit": ["p-limit@2.3.0", "", { "dependencies": { "p-try": "^2.0.0" } }, "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w=="],
+
+    "@tanstack/react-start-plugin/@tanstack/start-plugin-core/@tanstack/router-plugin/chokidar/readdirp/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
   }
 }
diff --git a/deploy/self-hosted/README.md b/deploy/self-hosted/README.md
index 1322c070e..08a3de0bc 100644
--- a/deploy/self-hosted/README.md
+++ b/deploy/self-hosted/README.md
@@ -156,6 +156,66 @@ pg_dump -Fc quackback > quackback_backup.dump
 pg_restore -d quackback quackback_backup.dump
 ```
 
+### Scheduled Jobs (pg_cron)
+
+Quackback ships a few background jobs that need to run on a schedule. The
+provided `docker/postgres/Dockerfile` already enables the `pg_cron` and
+`http` (`pg_net`) extensions; if you bring your own Postgres, install both
+extensions and add `pg_cron` to `shared_preload_libraries`.
+
+Two jobs are recommended:
+
+1. **SLA escalation tick** — calls the internal endpoint
+   `POST /api/v1/internal/sla-tick` every minute. The endpoint is gated by
+   the `INTERNAL_TASK_SECRET` env var, which must match the
+   `x-internal-secret` header sent by the cron job.
+2. **Webhook delivery audit purge** — trims the `webhook_deliveries` audit
+   table to ~30 days so it doesn't grow unbounded.
+
+Run the following SQL once against your Quackback database (replace
+`http://web:3000` with whatever URL the Postgres container can reach the web
+app on, and `your-internal-secret` with the value of `INTERNAL_TASK_SECRET`):
+
+```sql
+-- One-time: store the shared secret as a database GUC so the job body
+-- doesn't have to hard-code it.
+ALTER DATABASE quackback SET app.internal_secret = 'your-internal-secret';
+
+-- SLA escalation tick — every minute
+SELECT cron.schedule(
+  'quackback-sla-tick',
+  '* * * * *',
+  $$
+    SELECT net.http_post(
+      url     := 'http://web:3000/api/v1/internal/sla-tick',
+      body    := '{}'::jsonb,
+      headers := jsonb_build_object(
+        'content-type',     'application/json',
+        'x-internal-secret', current_setting('app.internal_secret')
+      )
+    );
+  $$
+);
+
+-- Webhook delivery audit purge — daily at 03:00 UTC, keep 30 days
+SELECT cron.schedule(
+  'quackback-webhook-deliveries-purge',
+  '0 3 * * *',
+  $$ DELETE FROM webhook_deliveries WHERE attempted_at < now() - interval '30 days' $$
+);
+```
+
+Inspect, pause or remove jobs:
+
+```sql
+SELECT jobid, schedule, jobname, active FROM cron.job;
+SELECT cron.unschedule('quackback-sla-tick');
+```
+
+> If you don't run pg_cron, you can drive the SLA tick from any external
+> scheduler (systemd timer, Kubernetes CronJob, GitHub Actions cron, etc.)
+> by issuing the same authenticated `POST` request once per minute.
+
 ---
 
 ## Building from Source
diff --git a/docker-compose.yml b/docker-compose.yml
index a809fdb9b..56d0a9b2a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -23,7 +23,7 @@ services:
       POSTGRES_PASSWORD: password
       POSTGRES_DB: quackback
     ports:
-      - '5432:5432'
+      - '5433:5432'
     volumes:
       - postgres_data:/var/lib/postgresql
       - ./docker/postgres/init-pgcron.sql:/docker-entrypoint-initdb.d/init-pgcron.sql
diff --git a/package.json b/package.json
index a465ed023..d8190ae86 100644
--- a/package.json
+++ b/package.json
@@ -4,6 +4,7 @@
     "@eslint/js": "^10.0.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@types/node": "^25.6.0",
+    "@vitest/coverage-v8": "4.1.9",
     "dotenv-cli": "^11.0.0",
     "eslint": "^10.2.1",
     "eslint-config-prettier": "^10.1.8",
@@ -32,6 +33,27 @@
     "@noble/ciphers": "2.0.0",
     "@codemirror/state": "6.6.0",
     "@tiptap/core": "3.23.4",
+    "@tiptap/extension-blockquote": "3.23.4",
+    "@tiptap/extension-bold": "3.23.4",
+    "@tiptap/extension-bullet-list": "3.23.4",
+    "@tiptap/extension-code": "3.23.4",
+    "@tiptap/extension-code-block": "3.23.4",
+    "@tiptap/extension-document": "3.23.4",
+    "@tiptap/extension-dropcursor": "3.23.4",
+    "@tiptap/extension-floating-menu": "3.23.4",
+    "@tiptap/extension-gapcursor": "3.23.4",
+    "@tiptap/extension-hard-break": "3.23.4",
+    "@tiptap/extension-heading": "3.23.4",
+    "@tiptap/extension-horizontal-rule": "3.23.4",
+    "@tiptap/extension-italic": "3.23.4",
+    "@tiptap/extension-list": "3.23.4",
+    "@tiptap/extension-list-item": "3.23.4",
+    "@tiptap/extension-list-keymap": "3.23.4",
+    "@tiptap/extension-ordered-list": "3.23.4",
+    "@tiptap/extension-paragraph": "3.23.4",
+    "@tiptap/extension-strike": "3.23.4",
+    "@tiptap/extension-text": "3.23.4",
+    "@tiptap/extensions": "3.23.4",
     "@tiptap/pm": "3.23.4",
     "@tiptap/suggestion": "3.23.4"
   },
@@ -47,6 +69,8 @@
     "lint": "eslint . --ext .ts,.tsx",
     "test": "vitest",
     "test:api": "vitest apps/web/src/lib/api/__tests__/api-integration.test.ts",
+    "test:coverage": "vitest run --coverage",
+    "test:diff-coverage": "node scripts/diff-coverage.mjs",
     "test:e2e": "bun run --filter @quackback/web test:e2e",
     "db:generate": "bun run --cwd packages/db db:generate",
     "db:migrate": "bun run --cwd packages/db db:migrate",
@@ -74,15 +98,15 @@
     "@codemirror/language": "^6.12.3",
     "@codemirror/view": "^6.41.0",
     "@lezer/highlight": "^1.2.3",
-    "@tiptap/extension-image": "^3.22.3",
-    "@tiptap/extension-mention": "^3.22.3",
-    "@tiptap/extension-table": "^3.22.3",
-    "@tiptap/extension-table-cell": "^3.22.3",
-    "@tiptap/extension-table-header": "^3.22.3",
-    "@tiptap/extension-table-row": "^3.22.3",
-    "@tiptap/extension-task-item": "^3.22.3",
-    "@tiptap/extension-task-list": "^3.22.3",
-    "@tiptap/extension-underline": "^3.22.3",
+    "@tiptap/extension-image": "3.23.4",
+    "@tiptap/extension-mention": "3.23.4",
+    "@tiptap/extension-table": "3.23.4",
+    "@tiptap/extension-table-cell": "3.23.4",
+    "@tiptap/extension-table-header": "3.23.4",
+    "@tiptap/extension-table-row": "3.23.4",
+    "@tiptap/extension-task-item": "3.23.4",
+    "@tiptap/extension-task-list": "3.23.4",
+    "@tiptap/extension-underline": "3.23.4",
     "@uiw/codemirror-extensions-color": "^4.25.9",
     "@uiw/react-codemirror": "^4.25.9",
     "cmdk": "^1.1.1",
diff --git a/packages/db/drizzle/0113_ticketing_and_authz.sql b/packages/db/drizzle/0113_ticketing_and_authz.sql
new file mode 100644
index 000000000..04c63d432
--- /dev/null
+++ b/packages/db/drizzle/0113_ticketing_and_authz.sql
@@ -0,0 +1,1406 @@
+-- Ticketing — Phase 1: RBAC + teams + audit foundation.
+--
+-- Adds three new domains alongside the existing schema:
+--   1. teams + team_memberships (first-class grouping for principals)
+--   2. roles + permissions + role_permissions + principal_role_assignments
+--      (generic RBAC engine; the legacy principal.role column is kept as a
+--      denormalised cache)
+--   3. audit_events (append-only workspace-wide admin/security log)
+--
+-- The migration also seeds the five system roles described in
+-- apps/web/src/lib/server/domains/authz/authz.permissions.ts and backfills
+-- existing principals into the role-assignment table so requireAuth() and
+-- requirePermission() agree on day one.
+
+-- ---------------------------------------------------------------------------
+-- Tables
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "teams" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "slug" text NOT NULL,
+  "name" text NOT NULL,
+  "description" text,
+  "short_label" text,
+  "color" text,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "archived_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "teams_slug_idx" ON "teams" USING btree ("slug");
+--> statement-breakpoint
+CREATE INDEX "teams_archived_at_idx" ON "teams" USING btree ("archived_at");
+--> statement-breakpoint
+
+CREATE TABLE "team_memberships" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "team_id" uuid NOT NULL,
+  "principal_id" uuid NOT NULL,
+  "role" text DEFAULT 'member' NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "team_memberships"
+  ADD CONSTRAINT "team_memberships_team_id_teams_id_fk"
+  FOREIGN KEY ("team_id") REFERENCES "public"."teams"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "team_memberships"
+  ADD CONSTRAINT "team_memberships_principal_id_principal_id_fk"
+  FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "team_memberships_team_principal_idx"
+  ON "team_memberships" USING btree ("team_id", "principal_id");
+--> statement-breakpoint
+CREATE INDEX "team_memberships_principal_idx"
+  ON "team_memberships" USING btree ("principal_id");
+--> statement-breakpoint
+
+CREATE TABLE "roles" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "key" text NOT NULL,
+  "name" text NOT NULL,
+  "description" text,
+  "is_system" boolean DEFAULT false NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "roles_key_idx" ON "roles" USING btree ("key");
+--> statement-breakpoint
+
+CREATE TABLE "permissions" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "key" text NOT NULL,
+  "category" text NOT NULL,
+  "description" text,
+  "is_system" boolean DEFAULT true NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "permissions_key_idx" ON "permissions" USING btree ("key");
+--> statement-breakpoint
+CREATE INDEX "permissions_category_idx" ON "permissions" USING btree ("category");
+--> statement-breakpoint
+
+CREATE TABLE "role_permissions" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "role_id" uuid NOT NULL,
+  "permission_id" uuid NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "role_permissions"
+  ADD CONSTRAINT "role_permissions_role_id_roles_id_fk"
+  FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "role_permissions"
+  ADD CONSTRAINT "role_permissions_permission_id_permissions_id_fk"
+  FOREIGN KEY ("permission_id") REFERENCES "public"."permissions"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "role_permissions_role_permission_idx"
+  ON "role_permissions" USING btree ("role_id", "permission_id");
+--> statement-breakpoint
+CREATE INDEX "role_permissions_permission_idx"
+  ON "role_permissions" USING btree ("permission_id");
+--> statement-breakpoint
+
+CREATE TABLE "principal_role_assignments" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "principal_id" uuid NOT NULL,
+  "role_id" uuid NOT NULL,
+  "team_id" uuid,
+  "granted_by_principal_id" uuid,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "principal_role_assignments"
+  ADD CONSTRAINT "principal_role_assignments_principal_id_principal_id_fk"
+  FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "principal_role_assignments"
+  ADD CONSTRAINT "principal_role_assignments_role_id_roles_id_fk"
+  FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "principal_role_assignments"
+  ADD CONSTRAINT "principal_role_assignments_team_id_teams_id_fk"
+  FOREIGN KEY ("team_id") REFERENCES "public"."teams"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "principal_role_assignments"
+  ADD CONSTRAINT "principal_role_assignments_granted_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("granted_by_principal_id") REFERENCES "public"."principal"("id")
+  ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "principal_role_assignments_principal_role_team_idx"
+  ON "principal_role_assignments" USING btree ("principal_id", "role_id", "team_id")
+  WHERE team_id IS NOT NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "principal_role_assignments_principal_role_workspace_idx"
+  ON "principal_role_assignments" USING btree ("principal_id", "role_id")
+  WHERE team_id IS NULL;
+--> statement-breakpoint
+CREATE INDEX "principal_role_assignments_principal_idx"
+  ON "principal_role_assignments" USING btree ("principal_id");
+--> statement-breakpoint
+CREATE INDEX "principal_role_assignments_team_idx"
+  ON "principal_role_assignments" USING btree ("team_id");
+--> statement-breakpoint
+
+CREATE TABLE "audit_events" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "principal_id" uuid,
+  "action" text NOT NULL,
+  "target_type" text NOT NULL,
+  "target_id" text,
+  "diff" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "source" text DEFAULT 'web' NOT NULL,
+  "ip_address" text,
+  "user_agent" text,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "audit_events"
+  ADD CONSTRAINT "audit_events_principal_id_principal_id_fk"
+  FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id")
+  ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX "audit_events_created_at_idx"
+  ON "audit_events" USING btree ("created_at");
+--> statement-breakpoint
+CREATE INDEX "audit_events_principal_idx"
+  ON "audit_events" USING btree ("principal_id", "created_at");
+--> statement-breakpoint
+CREATE INDEX "audit_events_action_idx"
+  ON "audit_events" USING btree ("action", "created_at");
+--> statement-breakpoint
+CREATE INDEX "audit_events_target_idx"
+  ON "audit_events" USING btree ("target_type", "target_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Seed system permissions
+-- ---------------------------------------------------------------------------
+-- Inserts every permission listed in authz.permissions.ts. Re-runnable: ON
+-- CONFLICT (key) DO NOTHING so deploys with partial state recover cleanly.
+
+INSERT INTO "permissions" ("id", "key", "category", "description", "is_system") VALUES
+  (gen_random_uuid(), 'ticket.view_all',            'ticket', 'View every ticket in the workspace.', true),
+  (gen_random_uuid(), 'ticket.view_team',           'ticket', 'View tickets owned by, assigned to, or shared with one of the actor''s teams.', true),
+  (gen_random_uuid(), 'ticket.view_assigned',       'ticket', 'View tickets assigned to the actor.', true),
+  (gen_random_uuid(), 'ticket.view_shared',         'ticket', 'View tickets shared with one of the actor''s teams.', true),
+  (gen_random_uuid(), 'ticket.reply_public',        'ticket', 'Post a customer-visible reply.', true),
+  (gen_random_uuid(), 'ticket.comment_internal',    'ticket', 'Post an internal note.', true),
+  (gen_random_uuid(), 'ticket.edit_fields',         'ticket', 'Edit ticket fields (status, priority, assignee, etc.).', true),
+  (gen_random_uuid(), 'ticket.assign_self',         'ticket', 'Assign tickets to oneself.', true),
+  (gen_random_uuid(), 'ticket.assign_any',          'ticket', 'Assign tickets to any principal.', true),
+  (gen_random_uuid(), 'ticket.share_cross_team',    'ticket', 'Share a ticket with another team.', true),
+  (gen_random_uuid(), 'ticket.manage_participants', 'ticket', 'Add or remove ticket participants.', true),
+  (gen_random_uuid(), 'org.view',                   'org',    'View organizations and contacts.', true),
+  (gen_random_uuid(), 'org.manage',                 'org',    'Create and edit organizations and contacts.', true),
+  (gen_random_uuid(), 'sla.view',                   'sla',    'View SLA policies and clocks.', true),
+  (gen_random_uuid(), 'sla.manage',                 'sla',    'Create and edit SLA policies.', true),
+  (gen_random_uuid(), 'audit.view',                 'audit',  'Read the workspace audit log.', true),
+  (gen_random_uuid(), 'admin.manage_users',         'admin',  'Invite, remove, and update team members and teams.', true),
+  (gen_random_uuid(), 'admin.manage_roles',         'admin',  'Edit role bundles and grant/revoke roles.', true),
+  (gen_random_uuid(), 'admin.manage_api_keys',      'admin',  'Create, rotate, and revoke API keys.', true),
+  (gen_random_uuid(), 'admin.manage_settings',      'admin',  'Edit workspace-wide settings.', true)
+ON CONFLICT ("key") DO NOTHING;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Seed system roles
+-- ---------------------------------------------------------------------------
+
+INSERT INTO "roles" ("id", "key", "name", "description", "is_system") VALUES
+  (gen_random_uuid(), 'owner',        'Owner',        'Full administrative access.', true),
+  (gen_random_uuid(), 'supervisor',   'Supervisor',   'Team operations: assignment, sharing, audit visibility.', true),
+  (gen_random_uuid(), 'agent',        'Agent',        'Default support agent: handles tickets within allowed scopes.', true),
+  (gen_random_uuid(), 'collaborator', 'Collaborator', 'Internal collaborator: notes and read access on shared tickets.', true),
+  (gen_random_uuid(), 'customer',     'Customer',     'Portal user role; no internal-side permissions.', true)
+ON CONFLICT ("key") DO NOTHING;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Seed role_permissions
+-- ---------------------------------------------------------------------------
+-- Owner: every permission.
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+CROSS JOIN "permissions" p
+WHERE r.key = 'owner'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Supervisor.
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+JOIN "permissions" p ON p.key IN (
+  'ticket.view_all', 'ticket.view_team', 'ticket.view_assigned', 'ticket.view_shared',
+  'ticket.reply_public', 'ticket.comment_internal', 'ticket.edit_fields',
+  'ticket.assign_self', 'ticket.assign_any', 'ticket.share_cross_team',
+  'ticket.manage_participants',
+  'org.view', 'org.manage',
+  'sla.view',
+  'audit.view'
+)
+WHERE r.key = 'supervisor'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Agent.
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+JOIN "permissions" p ON p.key IN (
+  'ticket.view_team', 'ticket.view_assigned', 'ticket.view_shared',
+  'ticket.reply_public', 'ticket.comment_internal', 'ticket.edit_fields',
+  'ticket.assign_self',
+  'org.view',
+  'sla.view'
+)
+WHERE r.key = 'agent'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Collaborator.
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+JOIN "permissions" p ON p.key IN (
+  'ticket.view_shared', 'ticket.view_assigned', 'ticket.comment_internal',
+  'org.view'
+)
+WHERE r.key = 'collaborator'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Customer: no internal-side permissions on purpose.
+
+-- ---------------------------------------------------------------------------
+-- Backfill existing principals → role assignments
+-- ---------------------------------------------------------------------------
+-- principal.role 'admin'  → owner
+-- principal.role 'member' → agent (admins can promote to supervisor afterwards)
+-- principal.role 'user'   → customer
+--
+-- Workspace-wide grants only (team_id IS NULL).
+
+INSERT INTO "principal_role_assignments" ("id", "principal_id", "role_id", "team_id")
+SELECT gen_random_uuid(), pr.id, r.id, NULL
+FROM "principal" pr
+JOIN "roles" r ON r.key = CASE pr.role
+  WHEN 'admin'  THEN 'owner'
+  WHEN 'member' THEN 'agent'
+  WHEN 'user'   THEN 'customer'
+  ELSE 'agent'
+END
+ON CONFLICT DO NOTHING;
+-- Ticketing — Phase 2: organizations & contacts.
+--
+-- Adds three tables consumed by Phase 3 ticket intake (`findOrCreateByDomain`,
+-- `findOrCreateByEmail`) and the upcoming admin CRM views.
+--
+-- No data is seeded; tables are populated through the new REST API and the
+-- Phase 3 ticket pipeline.
+
+-- ---------------------------------------------------------------------------
+-- organizations
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "organizations" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "domain" text,
+  "external_id" text,
+  "website" text,
+  "notes" text,
+  "metadata" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "archived_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "organizations_domain_idx"
+  ON "organizations" USING btree ("domain")
+  WHERE domain IS NOT NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "organizations_external_id_idx"
+  ON "organizations" USING btree ("external_id")
+  WHERE external_id IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX "organizations_name_idx" ON "organizations" USING btree ("name");
+--> statement-breakpoint
+CREATE INDEX "organizations_archived_at_idx" ON "organizations" USING btree ("archived_at");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- contacts
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "contacts" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text,
+  "email" text,
+  "phone" text,
+  "title" text,
+  "external_id" text,
+  "organization_id" uuid,
+  "avatar_url" text,
+  "metadata" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "archived_at" timestamp with time zone
+);
+--> statement-breakpoint
+ALTER TABLE "contacts"
+  ADD CONSTRAINT "contacts_organization_id_organizations_id_fk"
+  FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id")
+  ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "contacts_email_idx"
+  ON "contacts" USING btree ("email")
+  WHERE email IS NOT NULL AND archived_at IS NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "contacts_external_id_idx"
+  ON "contacts" USING btree ("external_id")
+  WHERE external_id IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX "contacts_organization_idx" ON "contacts" USING btree ("organization_id");
+--> statement-breakpoint
+CREATE INDEX "contacts_archived_at_idx" ON "contacts" USING btree ("archived_at");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- contact_user_links (N:M between contacts and portal users)
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "contact_user_links" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "contact_id" uuid NOT NULL,
+  "user_id" uuid NOT NULL,
+  "linked_by_principal_id" uuid,
+  "linked_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "contact_user_links"
+  ADD CONSTRAINT "contact_user_links_contact_id_contacts_id_fk"
+  FOREIGN KEY ("contact_id") REFERENCES "public"."contacts"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "contact_user_links"
+  ADD CONSTRAINT "contact_user_links_user_id_user_id_fk"
+  FOREIGN KEY ("user_id") REFERENCES "public"."user"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "contact_user_links"
+  ADD CONSTRAINT "contact_user_links_linked_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("linked_by_principal_id") REFERENCES "public"."principal"("id")
+  ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "contact_user_links_contact_user_idx"
+  ON "contact_user_links" USING btree ("contact_id", "user_id");
+--> statement-breakpoint
+CREATE INDEX "contact_user_links_user_idx" ON "contact_user_links" USING btree ("user_id");
+-- Ticketing — Phase 3: ticket core.
+--
+-- Seven new tables forming the heart of the ticketing module:
+--   * ticket_statuses        configurable workflow states (5 seeded)
+--   * tickets                header / state / assignment / visibility
+--   * ticket_threads         messages (public / internal / shared_team)
+--   * ticket_attachments     metadata for files attached to a thread
+--   * ticket_participants    watchers / collaborators / cc'd contacts
+--   * ticket_shares          cross-team grants
+--   * ticket_activity        per-ticket timeline mirror
+--
+-- `tickets.inbox_id` and `tickets.sla_policy_id` are intentionally plain TEXT
+-- (no FKs) — Phases 4 and 5 will add the foreign keys without rewriting rows.
+
+-- ---------------------------------------------------------------------------
+-- ticket_statuses
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "ticket_statuses" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "slug" text NOT NULL,
+  "color" text DEFAULT '#6b7280' NOT NULL,
+  "category" text DEFAULT 'open' NOT NULL,
+  "position" integer DEFAULT 0 NOT NULL,
+  "is_default" boolean DEFAULT false NOT NULL,
+  "is_system" boolean DEFAULT false NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "deleted_at" timestamp with time zone,
+  CONSTRAINT "ticket_statuses_slug_unique" UNIQUE("slug")
+);
+--> statement-breakpoint
+CREATE INDEX "ticket_statuses_position_idx" ON "ticket_statuses" USING btree ("category", "position");
+--> statement-breakpoint
+CREATE INDEX "ticket_statuses_deleted_at_idx" ON "ticket_statuses" USING btree ("deleted_at");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- tickets
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "tickets" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "subject" text NOT NULL,
+  "description_json" jsonb,
+  "description_text" text,
+  "priority" text DEFAULT 'normal' NOT NULL,
+  "channel" text DEFAULT 'api' NOT NULL,
+  "visibility_scope" text DEFAULT 'team' NOT NULL,
+  "status_id" uuid,
+  "requester_principal_id" uuid,
+  "requester_contact_id" uuid,
+  "organization_id" uuid,
+  "assignee_principal_id" uuid,
+  "assignee_team_id" uuid,
+  "primary_team_id" uuid,
+  "inbox_id" text,
+  "sla_policy_id" text,
+  "first_response_at" timestamp with time zone,
+  "resolved_at" timestamp with time zone,
+  "reopened_at" timestamp with time zone,
+  "closed_at" timestamp with time zone,
+  "created_by_principal_id" uuid,
+  "last_activity_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "deleted_at" timestamp with time zone,
+  "deleted_by_principal_id" uuid
+);
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_status_id_ticket_statuses_id_fk"
+  FOREIGN KEY ("status_id") REFERENCES "public"."ticket_statuses"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_requester_principal_id_principal_id_fk"
+  FOREIGN KEY ("requester_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_requester_contact_id_contacts_id_fk"
+  FOREIGN KEY ("requester_contact_id") REFERENCES "public"."contacts"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_organization_id_organizations_id_fk"
+  FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_assignee_principal_id_principal_id_fk"
+  FOREIGN KEY ("assignee_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_assignee_team_id_teams_id_fk"
+  FOREIGN KEY ("assignee_team_id") REFERENCES "public"."teams"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_primary_team_id_teams_id_fk"
+  FOREIGN KEY ("primary_team_id") REFERENCES "public"."teams"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_created_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("created_by_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_deleted_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("deleted_by_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX "tickets_status_id_idx" ON "tickets" USING btree ("status_id");
+--> statement-breakpoint
+CREATE INDEX "tickets_assignee_principal_idx" ON "tickets" USING btree ("assignee_principal_id");
+--> statement-breakpoint
+CREATE INDEX "tickets_primary_team_idx" ON "tickets" USING btree ("primary_team_id");
+--> statement-breakpoint
+CREATE INDEX "tickets_organization_idx" ON "tickets" USING btree ("organization_id");
+--> statement-breakpoint
+CREATE INDEX "tickets_requester_contact_idx" ON "tickets" USING btree ("requester_contact_id");
+--> statement-breakpoint
+CREATE INDEX "tickets_created_at_idx" ON "tickets" USING btree ("created_at");
+--> statement-breakpoint
+CREATE INDEX "tickets_last_activity_at_idx" ON "tickets" USING btree ("last_activity_at");
+--> statement-breakpoint
+CREATE INDEX "tickets_deleted_at_idx" ON "tickets" USING btree ("deleted_at");
+--> statement-breakpoint
+CREATE INDEX "tickets_team_status_idx" ON "tickets" USING btree ("primary_team_id", "status_id");
+--> statement-breakpoint
+CREATE INDEX "tickets_active_last_activity_idx"
+  ON "tickets" USING btree ("last_activity_at")
+  WHERE deleted_at IS NULL;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- ticket_threads
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "ticket_threads" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "ticket_id" uuid NOT NULL,
+  "principal_id" uuid,
+  "audience" text NOT NULL,
+  "body_json" jsonb,
+  "body_text" text NOT NULL,
+  "shared_with_team_id" uuid,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "edited_at" timestamp with time zone,
+  "edited_by_principal_id" uuid,
+  "deleted_at" timestamp with time zone,
+  CONSTRAINT "ticket_threads_shared_team_required"
+    CHECK ((audience <> 'shared_team') OR (shared_with_team_id IS NOT NULL))
+);
+--> statement-breakpoint
+ALTER TABLE "ticket_threads" ADD CONSTRAINT "ticket_threads_ticket_id_tickets_id_fk"
+  FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_threads" ADD CONSTRAINT "ticket_threads_principal_id_principal_id_fk"
+  FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_threads" ADD CONSTRAINT "ticket_threads_shared_with_team_id_teams_id_fk"
+  FOREIGN KEY ("shared_with_team_id") REFERENCES "public"."teams"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_threads" ADD CONSTRAINT "ticket_threads_edited_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("edited_by_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX "ticket_threads_ticket_id_created_at_idx"
+  ON "ticket_threads" USING btree ("ticket_id", "created_at");
+--> statement-breakpoint
+CREATE INDEX "ticket_threads_audience_idx" ON "ticket_threads" USING btree ("audience");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- ticket_attachments
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "ticket_attachments" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "thread_id" uuid NOT NULL,
+  "uploaded_by_principal_id" uuid,
+  "filename" text NOT NULL,
+  "mime_type" text NOT NULL,
+  "size_bytes" integer NOT NULL,
+  "storage_key" text NOT NULL,
+  "public_url" text,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "ticket_attachments" ADD CONSTRAINT "ticket_attachments_thread_id_ticket_threads_id_fk"
+  FOREIGN KEY ("thread_id") REFERENCES "public"."ticket_threads"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_attachments" ADD CONSTRAINT "ticket_attachments_uploaded_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("uploaded_by_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX "ticket_attachments_thread_idx" ON "ticket_attachments" USING btree ("thread_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- ticket_participants
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "ticket_participants" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "ticket_id" uuid NOT NULL,
+  "principal_id" uuid,
+  "contact_id" uuid,
+  "role" text NOT NULL,
+  "added_by_principal_id" uuid,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "ticket_participants_one_subject"
+    CHECK ((principal_id IS NOT NULL)::int + (contact_id IS NOT NULL)::int = 1)
+);
+--> statement-breakpoint
+ALTER TABLE "ticket_participants" ADD CONSTRAINT "ticket_participants_ticket_id_tickets_id_fk"
+  FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_participants" ADD CONSTRAINT "ticket_participants_principal_id_principal_id_fk"
+  FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_participants" ADD CONSTRAINT "ticket_participants_contact_id_contacts_id_fk"
+  FOREIGN KEY ("contact_id") REFERENCES "public"."contacts"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_participants" ADD CONSTRAINT "ticket_participants_added_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("added_by_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "ticket_participants_ticket_principal_idx"
+  ON "ticket_participants" USING btree ("ticket_id", "principal_id")
+  WHERE principal_id IS NOT NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "ticket_participants_ticket_contact_idx"
+  ON "ticket_participants" USING btree ("ticket_id", "contact_id")
+  WHERE contact_id IS NOT NULL;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- ticket_shares
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "ticket_shares" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "ticket_id" uuid NOT NULL,
+  "team_id" uuid NOT NULL,
+  "access_level" text DEFAULT 'read' NOT NULL,
+  "granted_by_principal_id" uuid,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "revoked_at" timestamp with time zone,
+  "revoked_by_principal_id" uuid
+);
+--> statement-breakpoint
+ALTER TABLE "ticket_shares" ADD CONSTRAINT "ticket_shares_ticket_id_tickets_id_fk"
+  FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_shares" ADD CONSTRAINT "ticket_shares_team_id_teams_id_fk"
+  FOREIGN KEY ("team_id") REFERENCES "public"."teams"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_shares" ADD CONSTRAINT "ticket_shares_granted_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("granted_by_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_shares" ADD CONSTRAINT "ticket_shares_revoked_by_principal_id_principal_id_fk"
+  FOREIGN KEY ("revoked_by_principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "ticket_shares_ticket_team_active_idx"
+  ON "ticket_shares" USING btree ("ticket_id", "team_id")
+  WHERE revoked_at IS NULL;
+--> statement-breakpoint
+CREATE INDEX "ticket_shares_team_idx" ON "ticket_shares" USING btree ("team_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- ticket_activity
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE "ticket_activity" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "ticket_id" uuid NOT NULL,
+  "principal_id" uuid,
+  "type" text NOT NULL,
+  "metadata" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "ticket_activity" ADD CONSTRAINT "ticket_activity_ticket_id_tickets_id_fk"
+  FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_activity" ADD CONSTRAINT "ticket_activity_principal_id_principal_id_fk"
+  FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX "ticket_activity_ticket_id_created_idx"
+  ON "ticket_activity" USING btree ("ticket_id", "created_at");
+--> statement-breakpoint
+CREATE INDEX "ticket_activity_type_idx" ON "ticket_activity" USING btree ("type");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Seed default ticket statuses (idempotent — safe on re-run)
+-- ---------------------------------------------------------------------------
+
+INSERT INTO "ticket_statuses" ("id", "name", "slug", "color", "category", "position", "is_default", "is_system")
+VALUES
+  (gen_random_uuid(), 'Open',    'open',    '#3b82f6', 'open',    0, true,  true),
+  (gen_random_uuid(), 'Pending', 'pending', '#eab308', 'pending', 1, false, true),
+  (gen_random_uuid(), 'On hold', 'on_hold', '#a855f7', 'on_hold', 2, false, true),
+  (gen_random_uuid(), 'Solved',  'solved',  '#22c55e', 'solved',  3, false, true),
+  (gen_random_uuid(), 'Closed',  'closed',  '#6b7280', 'closed',  4, false, true)
+ON CONFLICT ("slug") DO NOTHING;
+-- Phase 4: inboxes, channels, memberships, routing rules.
+-- Adds tables: inboxes, inbox_channels, inbox_memberships, routing_rules.
+-- Backfills FK from existing tickets.inbox_id (was text → now uuid) → inboxes(id).
+-- Seeds 5 new permissions and grants them into the existing system roles.
+
+-- ---------------------------------------------------------------------------
+-- inboxes
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "inboxes" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "slug" text NOT NULL,
+  "description" text,
+  "primary_team_id" uuid,
+  "default_visibility_scope" text DEFAULT 'team' NOT NULL,
+  "default_priority" text DEFAULT 'normal' NOT NULL,
+  "default_status_id" uuid,
+  "color" text,
+  "icon" text,
+  "archived_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "inboxes" ADD CONSTRAINT "inboxes_primary_team_id_teams_id_fk"
+  FOREIGN KEY ("primary_team_id") REFERENCES "public"."teams"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "inboxes" ADD CONSTRAINT "inboxes_default_status_id_ticket_statuses_id_fk"
+  FOREIGN KEY ("default_status_id") REFERENCES "public"."ticket_statuses"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "inboxes_slug_idx" ON "inboxes" USING btree ("slug");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "inboxes_primary_team_idx" ON "inboxes" USING btree ("primary_team_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "inboxes_archived_at_idx" ON "inboxes" USING btree ("archived_at");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "inboxes_active_name_idx"
+  ON "inboxes" USING btree (lower("name"))
+  WHERE archived_at IS NULL;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- inbox_channels
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "inbox_channels" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "inbox_id" uuid NOT NULL,
+  "kind" text NOT NULL,
+  "label" text NOT NULL,
+  "config" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "external_id" text,
+  "enabled" boolean DEFAULT true NOT NULL,
+  "archived_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "inbox_channels_kind_check"
+    CHECK ("kind" IN ('portal', 'email', 'api', 'widget', 'webhook'))
+);
+--> statement-breakpoint
+ALTER TABLE "inbox_channels" ADD CONSTRAINT "inbox_channels_inbox_id_inboxes_id_fk"
+  FOREIGN KEY ("inbox_id") REFERENCES "public"."inboxes"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "inbox_channels_inbox_idx" ON "inbox_channels" USING btree ("inbox_id");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "inbox_channels_kind_external_id_idx"
+  ON "inbox_channels" USING btree ("kind", "external_id")
+  WHERE external_id IS NOT NULL AND archived_at IS NULL;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- inbox_memberships
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "inbox_memberships" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "inbox_id" uuid NOT NULL,
+  "principal_id" uuid NOT NULL,
+  "role" text DEFAULT 'agent' NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "inbox_memberships_role_check"
+    CHECK ("role" IN ('owner', 'agent', 'viewer'))
+);
+--> statement-breakpoint
+ALTER TABLE "inbox_memberships" ADD CONSTRAINT "inbox_memberships_inbox_id_inboxes_id_fk"
+  FOREIGN KEY ("inbox_id") REFERENCES "public"."inboxes"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "inbox_memberships" ADD CONSTRAINT "inbox_memberships_principal_id_principal_id_fk"
+  FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "inbox_memberships_inbox_principal_idx"
+  ON "inbox_memberships" USING btree ("inbox_id", "principal_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "inbox_memberships_principal_idx"
+  ON "inbox_memberships" USING btree ("principal_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- routing_rules
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "routing_rules" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "description" text,
+  "priority" integer DEFAULT 100 NOT NULL,
+  "enabled" boolean DEFAULT true NOT NULL,
+  "conditions" jsonb NOT NULL,
+  "actions" jsonb NOT NULL,
+  "inbox_id_scope" uuid,
+  "last_matched_at" timestamp with time zone,
+  "match_count" integer DEFAULT 0 NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "routing_rules" ADD CONSTRAINT "routing_rules_inbox_id_scope_inboxes_id_fk"
+  FOREIGN KEY ("inbox_id_scope") REFERENCES "public"."inboxes"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routing_rules_priority_idx" ON "routing_rules" USING btree ("priority");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routing_rules_inbox_scope_idx" ON "routing_rules" USING btree ("inbox_id_scope");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routing_rules_enabled_idx" ON "routing_rules" USING btree ("enabled");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Backfill tickets.inbox_id: was text (Phase 3 reservation); now uuid + FK.
+-- Safe: column has no real values yet (Phase 3 stored nothing here).
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE "tickets" ALTER COLUMN "inbox_id" TYPE uuid USING (NULLIF("inbox_id", '')::uuid);
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_inbox_id_inboxes_id_fk"
+  FOREIGN KEY ("inbox_id") REFERENCES "public"."inboxes"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "tickets_inbox_idx" ON "tickets" USING btree ("inbox_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Seed Phase 4 permissions
+-- ---------------------------------------------------------------------------
+
+INSERT INTO "permissions" ("id", "key", "category", "description", "is_system") VALUES
+  (gen_random_uuid(), 'inbox.view',           'inbox', 'View inboxes and their queues.', true),
+  (gen_random_uuid(), 'inbox.manage',         'inbox', 'Create, update, and archive inboxes and memberships.', true),
+  (gen_random_uuid(), 'inbox.channel_manage', 'inbox', 'Configure inbox channels (portal/email/api/widget/webhook).', true),
+  (gen_random_uuid(), 'routing.rule_manage',  'inbox', 'Create and edit routing rules.', true),
+  (gen_random_uuid(), 'ticket.bulk_operate',  'ticket', 'Perform bulk ticket operations (assign / transition / change inbox).', true)
+ON CONFLICT ("key") DO NOTHING;
+--> statement-breakpoint
+
+-- Re-grant owner = all permissions (covers the new keys).
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+CROSS JOIN "permissions" p
+WHERE r.key = 'owner'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Supervisor gains all Phase 4 perms.
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+JOIN "permissions" p ON p.key IN (
+  'inbox.view', 'inbox.manage', 'inbox.channel_manage',
+  'routing.rule_manage', 'ticket.bulk_operate'
+)
+WHERE r.key = 'supervisor'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Agent gains inbox.view + ticket.bulk_operate.
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+JOIN "permissions" p ON p.key IN ('inbox.view', 'ticket.bulk_operate')
+WHERE r.key = 'agent'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+-- Phase 5: SLA + escalations.
+-- Adds tables: business_hours, sla_policies, sla_targets, ticket_sla_clocks,
+-- escalation_rules, sla_escalation_log.
+-- Converts tickets.sla_policy_id from text to uuid + FK -> sla_policies(id).
+-- Seeds 2 new permissions; SLA_VIEW/SLA_MANAGE were seeded in Phase 1 already
+-- but we re-grant them here to be safe.
+
+-- ---------------------------------------------------------------------------
+-- business_hours
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "business_hours" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "timezone" text DEFAULT 'UTC' NOT NULL,
+  "schedule" jsonb NOT NULL,
+  "holidays" jsonb DEFAULT '[]'::jsonb NOT NULL,
+  "archived_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "business_hours_archived_at_idx"
+  ON "business_hours" USING btree ("archived_at");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "business_hours_active_name_idx"
+  ON "business_hours" USING btree (lower("name"))
+  WHERE archived_at IS NULL;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- sla_policies
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "sla_policies" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "description" text,
+  "priority" integer DEFAULT 100 NOT NULL,
+  "enabled" boolean DEFAULT true NOT NULL,
+  "scope" text NOT NULL,
+  "scope_team_id" uuid,
+  "scope_inbox_id" uuid,
+  "applies_to_priorities" text[] DEFAULT '{}'::text[] NOT NULL,
+  "business_hours_id" uuid,
+  "pause_on_pending" boolean DEFAULT true NOT NULL,
+  "pause_on_on_hold" boolean DEFAULT true NOT NULL,
+  "archived_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "sla_policies_scope_check"
+    CHECK ("scope" IN ('workspace', 'team', 'inbox')),
+  CONSTRAINT "sla_policies_scope_team_required"
+    CHECK ((scope <> 'team') OR (scope_team_id IS NOT NULL)),
+  CONSTRAINT "sla_policies_scope_inbox_required"
+    CHECK ((scope <> 'inbox') OR (scope_inbox_id IS NOT NULL)),
+  CONSTRAINT "sla_policies_workspace_no_scope"
+    CHECK ((scope <> 'workspace') OR (scope_team_id IS NULL AND scope_inbox_id IS NULL))
+);
+--> statement-breakpoint
+ALTER TABLE "sla_policies" ADD CONSTRAINT "sla_policies_scope_team_id_teams_id_fk"
+  FOREIGN KEY ("scope_team_id") REFERENCES "public"."teams"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "sla_policies" ADD CONSTRAINT "sla_policies_scope_inbox_id_inboxes_id_fk"
+  FOREIGN KEY ("scope_inbox_id") REFERENCES "public"."inboxes"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "sla_policies" ADD CONSTRAINT "sla_policies_business_hours_id_business_hours_id_fk"
+  FOREIGN KEY ("business_hours_id") REFERENCES "public"."business_hours"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "sla_policies_enabled_priority_idx"
+  ON "sla_policies" USING btree ("enabled", "priority");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "sla_policies_scope_team_idx"
+  ON "sla_policies" USING btree ("scope_team_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "sla_policies_scope_inbox_idx"
+  ON "sla_policies" USING btree ("scope_inbox_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "sla_policies_archived_at_idx"
+  ON "sla_policies" USING btree ("archived_at");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- sla_targets
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "sla_targets" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "policy_id" uuid NOT NULL,
+  "kind" text NOT NULL,
+  "minutes" integer NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "sla_targets_kind_check"
+    CHECK ("kind" IN ('first_response', 'next_response', 'resolution')),
+  CONSTRAINT "sla_targets_minutes_positive" CHECK (minutes > 0)
+);
+--> statement-breakpoint
+ALTER TABLE "sla_targets" ADD CONSTRAINT "sla_targets_policy_id_sla_policies_id_fk"
+  FOREIGN KEY ("policy_id") REFERENCES "public"."sla_policies"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "sla_targets_policy_kind_idx"
+  ON "sla_targets" USING btree ("policy_id", "kind");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "sla_targets_policy_idx"
+  ON "sla_targets" USING btree ("policy_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- ticket_sla_clocks
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "ticket_sla_clocks" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "ticket_id" uuid NOT NULL,
+  "policy_id" uuid,
+  "target_id" uuid,
+  "kind" text NOT NULL,
+  "state" text DEFAULT 'running' NOT NULL,
+  "target_minutes" integer NOT NULL,
+  "started_at" timestamp with time zone NOT NULL,
+  "due_at" timestamp with time zone NOT NULL,
+  "paused_at" timestamp with time zone,
+  "accumulated_paused_ms" bigint DEFAULT 0 NOT NULL,
+  "breached_at" timestamp with time zone,
+  "met_at" timestamp with time zone,
+  "last_escalated_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "ticket_sla_clocks_kind_check"
+    CHECK ("kind" IN ('first_response', 'next_response', 'resolution')),
+  CONSTRAINT "ticket_sla_clocks_state_check"
+    CHECK ("state" IN ('running', 'paused', 'met', 'breached', 'cancelled'))
+);
+--> statement-breakpoint
+ALTER TABLE "ticket_sla_clocks" ADD CONSTRAINT "ticket_sla_clocks_ticket_id_tickets_id_fk"
+  FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_sla_clocks" ADD CONSTRAINT "ticket_sla_clocks_policy_id_sla_policies_id_fk"
+  FOREIGN KEY ("policy_id") REFERENCES "public"."sla_policies"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_sla_clocks" ADD CONSTRAINT "ticket_sla_clocks_target_id_sla_targets_id_fk"
+  FOREIGN KEY ("target_id") REFERENCES "public"."sla_targets"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_sla_clocks_ticket_idx"
+  ON "ticket_sla_clocks" USING btree ("ticket_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_sla_clocks_policy_idx"
+  ON "ticket_sla_clocks" USING btree ("policy_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_sla_clocks_state_due_idx"
+  ON "ticket_sla_clocks" USING btree ("state", "due_at");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "ticket_sla_clocks_active_kind_idx"
+  ON "ticket_sla_clocks" USING btree ("ticket_id", "kind")
+  WHERE state IN ('running', 'paused');
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- escalation_rules
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "escalation_rules" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "policy_id" uuid NOT NULL,
+  "name" text NOT NULL,
+  "lead_minutes" integer NOT NULL,
+  "target_kind" text NOT NULL,
+  "recipient_type" text NOT NULL,
+  "recipient_team_id" uuid,
+  "recipient_principal_ids" text[] DEFAULT '{}'::text[] NOT NULL,
+  "channels" text[] DEFAULT '{in_app}'::text[] NOT NULL,
+  "enabled" boolean DEFAULT true NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "escalation_rules_target_kind_check"
+    CHECK ("target_kind" IN ('first_response', 'next_response', 'resolution')),
+  CONSTRAINT "escalation_rules_recipient_type_check"
+    CHECK ("recipient_type" IN ('assignee', 'team', 'principals', 'inbox_members')),
+  CONSTRAINT "escalation_rules_team_required"
+    CHECK ((recipient_type <> 'team') OR (recipient_team_id IS NOT NULL)),
+  CONSTRAINT "escalation_rules_principals_required"
+    CHECK ((recipient_type <> 'principals') OR (array_length(recipient_principal_ids, 1) >= 1))
+);
+--> statement-breakpoint
+ALTER TABLE "escalation_rules" ADD CONSTRAINT "escalation_rules_policy_id_sla_policies_id_fk"
+  FOREIGN KEY ("policy_id") REFERENCES "public"."sla_policies"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "escalation_rules" ADD CONSTRAINT "escalation_rules_recipient_team_id_teams_id_fk"
+  FOREIGN KEY ("recipient_team_id") REFERENCES "public"."teams"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "escalation_rules_policy_lead_idx"
+  ON "escalation_rules" USING btree ("policy_id", "lead_minutes");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "escalation_rules_enabled_kind_idx"
+  ON "escalation_rules" USING btree ("enabled", "target_kind");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- sla_escalation_log
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "sla_escalation_log" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "clock_id" uuid NOT NULL,
+  "rule_id" uuid,
+  "fired_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "recipient_principal_ids" text[] DEFAULT '{}'::text[] NOT NULL,
+  "channels" text[] DEFAULT '{}'::text[] NOT NULL,
+  "context" jsonb
+);
+--> statement-breakpoint
+ALTER TABLE "sla_escalation_log" ADD CONSTRAINT "sla_escalation_log_clock_id_ticket_sla_clocks_id_fk"
+  FOREIGN KEY ("clock_id") REFERENCES "public"."ticket_sla_clocks"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "sla_escalation_log" ADD CONSTRAINT "sla_escalation_log_rule_id_escalation_rules_id_fk"
+  FOREIGN KEY ("rule_id") REFERENCES "public"."escalation_rules"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "sla_escalation_log_clock_fired_idx"
+  ON "sla_escalation_log" USING btree ("clock_id", "fired_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "sla_escalation_log_rule_idx"
+  ON "sla_escalation_log" USING btree ("rule_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Backfill tickets.sla_policy_id: was text (Phase 3 reservation); now uuid + FK.
+-- Safe: column has no real values yet.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE "tickets" ALTER COLUMN "sla_policy_id" TYPE uuid
+  USING (NULLIF("sla_policy_id"::text, '')::uuid);
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_sla_policy_id_sla_policies_id_fk"
+  FOREIGN KEY ("sla_policy_id") REFERENCES "public"."sla_policies"("id") ON DELETE set null ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "tickets_sla_policy_idx" ON "tickets" USING btree ("sla_policy_id");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Seed Phase 5 permissions (SLA_VIEW/SLA_MANAGE already seeded in Phase 1).
+-- ---------------------------------------------------------------------------
+
+INSERT INTO "permissions" ("id", "key", "category", "description", "is_system") VALUES
+  (gen_random_uuid(), 'business_hours.manage', 'sla', 'Create and edit business hours calendars.', true),
+  (gen_random_uuid(), 'escalation.rule_manage', 'sla', 'Create and edit SLA escalation rules.', true)
+ON CONFLICT ("key") DO NOTHING;
+--> statement-breakpoint
+
+-- Owner = all permissions (re-grant to cover the new keys).
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+CROSS JOIN "permissions" p
+WHERE r.key = 'owner'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Supervisor gains the new SLA management perms (already had sla.view, sla.manage).
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+JOIN "permissions" p ON p.key IN ('business_hours.manage', 'escalation.rule_manage')
+WHERE r.key = 'supervisor'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+-- Phase 6: Scoped API keys + audit hardening.
+-- Adds scope columns, last IP/UA tracking, rotation/legacy compat fields
+-- to api_keys. GIN indexes enable fast lookups on array columns.
+-- Backfill: existing keys keep legacy "all permissions" behavior so they
+-- continue to work; admins can opt in to scoping per key.
+
+-- ---------------------------------------------------------------------------
+-- api_keys: upgrade scopes column from text (added by 0050) to text[]
+-- ---------------------------------------------------------------------------
+
+-- Main's migration 0050_api_keys_scopes added "scopes" as plain text.
+-- The ticketing RBAC model requires a native text[] array for GIN indexing
+-- and direct array operations. Drop the text column and re-add as text[].
+ALTER TABLE "api_keys" DROP COLUMN IF EXISTS "scopes";
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- api_keys: new columns
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE "api_keys"
+  ADD COLUMN IF NOT EXISTS "scopes" text[] DEFAULT '{}'::text[] NOT NULL,
+  ADD COLUMN IF NOT EXISTS "allowed_team_ids" text[] DEFAULT '{}'::text[] NOT NULL,
+  ADD COLUMN IF NOT EXISTS "allowed_inbox_ids" text[] DEFAULT '{}'::text[] NOT NULL,
+  ADD COLUMN IF NOT EXISTS "last_ip" text,
+  ADD COLUMN IF NOT EXISTS "last_user_agent" text,
+  ADD COLUMN IF NOT EXISTS "rotated_at" timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS "compat_legacy_full_access" boolean DEFAULT true NOT NULL,
+  ADD COLUMN IF NOT EXISTS "compat_acknowledged_at" timestamp with time zone;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- GIN indexes for array containment lookups
+-- ---------------------------------------------------------------------------
+
+CREATE INDEX IF NOT EXISTS "api_keys_scopes_idx"
+  ON "api_keys" USING gin ("scopes");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "api_keys_allowed_team_ids_idx"
+  ON "api_keys" USING gin ("allowed_team_ids");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "api_keys_allowed_inbox_ids_idx"
+  ON "api_keys" USING gin ("allowed_inbox_ids");
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Backfill: pre-existing keys retain "all permissions" semantics
+-- ---------------------------------------------------------------------------
+
+UPDATE "api_keys"
+SET "compat_legacy_full_access" = true
+WHERE "scopes" = '{}'::text[]
+  AND "allowed_team_ids" = '{}'::text[]
+  AND "allowed_inbox_ids" = '{}'::text[]
+  AND "compat_acknowledged_at" IS NULL;
+--> statement-breakpoint
+-- Phase 7: ticket subscriptions + webhook delivery audit log.
+-- Adds per-(ticket, principal) subscription rows mirroring post_subscriptions
+-- with richer flags and a `mutedUntil` window. Adds an append-only audit
+-- table for webhook delivery attempts (every dispatch outcome is logged).
+-- Adds a nullable `ticket_id` to in_app_notifications for ticket events.
+
+-- ---------------------------------------------------------------------------
+-- ticket_subscriptions
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "ticket_subscriptions" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "ticket_id" uuid NOT NULL,
+  "principal_id" uuid NOT NULL,
+  "notify_threads" boolean DEFAULT true NOT NULL,
+  "notify_status" boolean DEFAULT true NOT NULL,
+  "notify_assignment" boolean DEFAULT true NOT NULL,
+  "notify_participants" boolean DEFAULT false NOT NULL,
+  "notify_shares" boolean DEFAULT false NOT NULL,
+  "notify_sla" boolean DEFAULT true NOT NULL,
+  "muted_until" timestamp with time zone,
+  "source" text NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "ticket_subscriptions_source_check"
+    CHECK ("source" IN ('auto_assigned', 'auto_participant', 'auto_team_member', 'manual'))
+);
+--> statement-breakpoint
+
+ALTER TABLE "ticket_subscriptions"
+  ADD CONSTRAINT "ticket_subscriptions_ticket_id_fk"
+  FOREIGN KEY ("ticket_id") REFERENCES "tickets"("id") ON DELETE CASCADE;
+--> statement-breakpoint
+
+ALTER TABLE "ticket_subscriptions"
+  ADD CONSTRAINT "ticket_subscriptions_principal_id_fk"
+  FOREIGN KEY ("principal_id") REFERENCES "principal"("id") ON DELETE CASCADE;
+--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "ticket_subscriptions_unique"
+  ON "ticket_subscriptions" ("ticket_id", "principal_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_subscriptions_principal_idx"
+  ON "ticket_subscriptions" ("principal_id", "ticket_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_subscriptions_ticket_threads_idx"
+  ON "ticket_subscriptions" ("ticket_id") WHERE notify_threads = true;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_subscriptions_ticket_status_idx"
+  ON "ticket_subscriptions" ("ticket_id") WHERE notify_status = true;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_subscriptions_ticket_assignment_idx"
+  ON "ticket_subscriptions" ("ticket_id") WHERE notify_assignment = true;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_subscriptions_ticket_sla_idx"
+  ON "ticket_subscriptions" ("ticket_id") WHERE notify_sla = true;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- webhook_deliveries
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS "webhook_deliveries" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "webhook_id" uuid NOT NULL,
+  "event_id" text NOT NULL,
+  "event_type" text NOT NULL,
+  "attempt_number" integer NOT NULL,
+  "status" text NOT NULL,
+  "http_status" integer,
+  "error_message" text,
+  "request_url" text NOT NULL,
+  "request_payload_bytes" integer NOT NULL,
+  "response_body_snippet" text,
+  "latency_ms" integer,
+  "signature_timestamp" bigint NOT NULL,
+  "attempted_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "next_retry_at" timestamp with time zone,
+  CONSTRAINT "webhook_deliveries_status_check"
+    CHECK ("status" IN ('queued', 'success', 'failed_retryable', 'failed_terminal', 'blocked_ssrf'))
+);
+--> statement-breakpoint
+
+ALTER TABLE "webhook_deliveries"
+  ADD CONSTRAINT "webhook_deliveries_webhook_id_fk"
+  FOREIGN KEY ("webhook_id") REFERENCES "webhooks"("id") ON DELETE CASCADE;
+--> statement-breakpoint
+
+CREATE INDEX IF NOT EXISTS "webhook_deliveries_webhook_attempted_idx"
+  ON "webhook_deliveries" ("webhook_id", "attempted_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "webhook_deliveries_event_idx"
+  ON "webhook_deliveries" ("event_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "webhook_deliveries_failed_idx"
+  ON "webhook_deliveries" ("status", "attempted_at")
+  WHERE status IN ('failed_retryable', 'failed_terminal');
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- in_app_notifications: add nullable ticket_id for ticket-related events
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE "in_app_notifications"
+  ADD COLUMN IF NOT EXISTS "ticket_id" uuid;
+--> statement-breakpoint
+
+ALTER TABLE "in_app_notifications"
+  ADD CONSTRAINT "in_app_notifications_ticket_id_fk"
+  FOREIGN KEY ("ticket_id") REFERENCES "tickets"("id") ON DELETE SET NULL;
+--> statement-breakpoint
+
+CREATE INDEX IF NOT EXISTS "in_app_notifications_ticket_idx"
+  ON "in_app_notifications" ("ticket_id", "created_at");
+-- Phase 5 (webhook operator surface): persist the request payload alongside
+-- each webhook_deliveries row so the operator-facing redeliver action can
+-- replay the exact payload that was originally POSTed.
+--
+-- `request_payload_json` holds the full event envelope as it appears on the
+-- wire (`{id,type,createdAt,data}`). The writer caps stored payloads at
+-- ~32 KB; oversized payloads are stored as NULL with the truncated flag set
+-- and become non-redeliverable (rare for ticketing payloads).
+
+ALTER TABLE "webhook_deliveries"
+  ADD COLUMN IF NOT EXISTS "request_payload_json" jsonb;
+
+ALTER TABLE "webhook_deliveries"
+  ADD COLUMN IF NOT EXISTS "request_payload_truncated" boolean NOT NULL DEFAULT false;
+-- Phase 4 (per-inbox webhook filtering): add an optional inbox filter to
+-- the webhooks table mirroring the existing board_ids filter for posts.
+--
+-- Semantics:
+--   inbox_ids IS NULL  OR  cardinality(inbox_ids) = 0  → match all inboxes
+--   non-empty array                                    → only match ticket
+--                                                       events whose
+--                                                       data.ticket.inboxId
+--                                                       is in the array.
+--
+-- Existing webhooks transparently match-all because the column is nullable.
+
+ALTER TABLE "webhooks" ADD COLUMN IF NOT EXISTS "inbox_ids" text[];
+-- Phase 6: GitHub ↔ Ticket bidirectional sync foundation
+--
+-- 1. Allow multiple integrations per type (multi-repo GitHub support)
+-- 2. Add ticket_external_links table (mirrors post_external_links for tickets)
+-- 3. Add integration_user_mappings table (GitHub username → team principal)
+
+ALTER TABLE "integrations" DROP CONSTRAINT IF EXISTS "integration_type_unique";--> statement-breakpoint
+ALTER TABLE "integrations" ADD COLUMN IF NOT EXISTS "label" varchar(100);--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "ticket_external_links" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"ticket_id" uuid NOT NULL,
+	"integration_id" uuid,
+	"integration_type" varchar(50) NOT NULL,
+	"external_id" text NOT NULL,
+	"external_display_id" text,
+	"external_url" text,
+	"status" varchar(20) DEFAULT 'active' NOT NULL,
+	"sync_direction" varchar(20) DEFAULT 'outbound' NOT NULL,
+	"last_synced_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "integration_user_mappings" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"integration_id" uuid NOT NULL,
+	"external_username" varchar(255) NOT NULL,
+	"external_display_name" text,
+	"principal_id" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "ticket_external_links" ADD CONSTRAINT "ticket_external_links_ticket_fk" FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "ticket_external_links" ADD CONSTRAINT "ticket_external_links_integration_fk" FOREIGN KEY ("integration_id") REFERENCES "public"."integrations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "integration_user_mappings" ADD CONSTRAINT "integration_user_mappings_integration_fk" FOREIGN KEY ("integration_id") REFERENCES "public"."integrations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "integration_user_mappings" ADD CONSTRAINT "integration_user_mappings_principal_fk" FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "ticket_external_links_type_external_ticket_unique" ON "ticket_external_links" USING btree ("integration_type","external_id","ticket_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_external_links_ticket_id_idx" ON "ticket_external_links" USING btree ("ticket_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_external_links_type_external_id_idx" ON "ticket_external_links" USING btree ("integration_type","external_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_external_links_ticket_status_idx" ON "ticket_external_links" USING btree ("ticket_id","status");--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "integration_user_mappings_integration_username_unique" ON "integration_user_mappings" USING btree ("integration_id","external_username");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "integration_user_mappings_principal_idx" ON "integration_user_mappings" USING btree ("principal_id");--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "integration_sync_log" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"integration_id" uuid NOT NULL,
+	"ticket_id" uuid,
+	"external_id" text,
+	"event_type" text NOT NULL,
+	"direction" varchar(20) NOT NULL,
+	"status" varchar(20) NOT NULL,
+	"error_message" text,
+	"duration_ms" integer,
+	"metadata" jsonb,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "integration_sync_log" ADD CONSTRAINT "integration_sync_log_integration_id_fk" FOREIGN KEY ("integration_id") REFERENCES "integrations"("id") ON DELETE CASCADE;--> statement-breakpoint
+ALTER TABLE "integration_sync_log" ADD CONSTRAINT "integration_sync_log_ticket_id_fk" FOREIGN KEY ("ticket_id") REFERENCES "tickets"("id") ON DELETE SET NULL;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "integration_sync_log_integration_created_idx" ON "integration_sync_log" USING btree ("integration_id","created_at");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "integration_sync_log_ticket_created_idx" ON "integration_sync_log" USING btree ("ticket_id","created_at");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "integration_sync_log_status_idx" ON "integration_sync_log" USING btree ("status","created_at") WHERE status = 'failed';
\ No newline at end of file
diff --git a/packages/db/drizzle/0114_ticket_thread_external_links.sql b/packages/db/drizzle/0114_ticket_thread_external_links.sql
new file mode 100644
index 000000000..8cee07fee
--- /dev/null
+++ b/packages/db/drizzle/0114_ticket_thread_external_links.sql
@@ -0,0 +1,106 @@
+-- Ticket thread external comment links.
+--
+-- Durable correlation between Quackback ticket threads and external issue
+-- comments. This powers two-way comment sync, webhook idempotency, and manual
+-- backfill without overloading ticket_external_links, which represents issue
+-- links rather than per-comment links.
+
+CREATE TABLE IF NOT EXISTS "ticket_thread_external_links" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "ticket_id" uuid NOT NULL,
+  "thread_id" uuid NOT NULL,
+  "integration_id" uuid NOT NULL,
+  "integration_type" varchar(50) NOT NULL,
+  "external_issue_id" text NOT NULL,
+  "external_comment_id" text NOT NULL,
+  "external_url" text,
+  "status" varchar(20) DEFAULT 'active' NOT NULL,
+  "sync_direction" varchar(20) DEFAULT 'outbound' NOT NULL,
+  "last_synced_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "ticket_thread_external_links"
+  ADD CONSTRAINT "ticket_thread_external_links_ticket_fk"
+  FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_thread_external_links"
+  ADD CONSTRAINT "ticket_thread_external_links_thread_fk"
+  FOREIGN KEY ("thread_id") REFERENCES "public"."ticket_threads"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "ticket_thread_external_links"
+  ADD CONSTRAINT "ticket_thread_external_links_integration_fk"
+  FOREIGN KEY ("integration_id") REFERENCES "public"."integrations"("id")
+  ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "ticket_thread_external_links_integration_comment_unique"
+  ON "ticket_thread_external_links" USING btree ("integration_id", "external_comment_id");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "ticket_thread_external_links_integration_thread_unique"
+  ON "ticket_thread_external_links" USING btree ("integration_id", "thread_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_thread_external_links_ticket_idx"
+  ON "ticket_thread_external_links" USING btree ("ticket_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_thread_external_links_issue_idx"
+  ON "ticket_thread_external_links" USING btree ("integration_id", "external_issue_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ticket_thread_external_links_thread_status_idx"
+  ON "ticket_thread_external_links" USING btree ("thread_id", "status");
+--> statement-breakpoint
+
+-- Existing GitHub ticket-sync connections should start syncing public replies
+-- without requiring admins to rediscover and save the integration settings.
+-- Copy the first existing enabled ticket-event inbox filter so new comment
+-- mappings respect the same repository scoping.
+INSERT INTO "integration_event_mappings" (
+  "id",
+  "integration_id",
+  "event_type",
+  "action_type",
+  "action_config",
+  "filters",
+  "target_key",
+  "enabled",
+  "created_at",
+  "updated_at"
+)
+SELECT
+  gen_random_uuid(),
+  i."id",
+  e."event_type",
+  'send_message',
+  '{}'::jsonb,
+  existing_ticket_mapping."filters",
+  'default',
+  true,
+  now(),
+  now()
+FROM "integrations" i
+JOIN LATERAL (
+  SELECT m."filters"
+  FROM "integration_event_mappings" m
+  WHERE m."integration_id" = i."id"
+    AND m."enabled" = true
+    AND m."event_type" IN (
+      'ticket.created',
+      'ticket.status_changed',
+      'ticket.assigned',
+      'ticket.updated'
+    )
+  ORDER BY m."created_at" ASC
+  LIMIT 1
+) existing_ticket_mapping ON true
+CROSS JOIN (
+  VALUES
+    ('ticket.thread_added'),
+    ('ticket.thread_updated'),
+    ('ticket.thread_deleted')
+) AS e("event_type")
+WHERE i."integration_type" = 'github'
+  AND i."status" = 'active'
+  AND COALESCE(i."config"->>'syncDirection', 'outbound') IN ('outbound', 'bidirectional')
+ON CONFLICT ("integration_id", "event_type", "action_type", "target_key") DO NOTHING;
diff --git a/packages/db/drizzle/0115_widget_profiles.sql b/packages/db/drizzle/0115_widget_profiles.sql
new file mode 100644
index 000000000..92b84fc1c
--- /dev/null
+++ b/packages/db/drizzle/0115_widget_profiles.sql
@@ -0,0 +1,63 @@
+CREATE TABLE IF NOT EXISTS "widget_applications" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "key" text NOT NULL,
+  "name" text NOT NULL,
+  "description" text,
+  "archived_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "widget_environment_profiles" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "application_id" uuid NOT NULL,
+  "environment" text NOT NULL,
+  "display_name" text NOT NULL,
+  "enabled" boolean DEFAULT true NOT NULL,
+  "allowed_origins" jsonb DEFAULT '[]'::jsonb NOT NULL,
+  "config_overrides" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "content_filters" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "support_config" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "archived_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+DO $$ BEGIN
+  ALTER TABLE "widget_environment_profiles"
+    ADD CONSTRAINT "widget_environment_profiles_application_id_widget_applications_id_fk"
+    FOREIGN KEY ("application_id") REFERENCES "public"."widget_applications"("id")
+    ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+  WHEN duplicate_object THEN null;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "widget_applications_key_idx"
+  ON "widget_applications" USING btree ("key");
+CREATE INDEX IF NOT EXISTS "widget_applications_archived_at_idx"
+  ON "widget_applications" USING btree ("archived_at");
+CREATE INDEX IF NOT EXISTS "widget_profiles_application_idx"
+  ON "widget_environment_profiles" USING btree ("application_id");
+CREATE INDEX IF NOT EXISTS "widget_profiles_environment_idx"
+  ON "widget_environment_profiles" USING btree ("environment");
+CREATE INDEX IF NOT EXISTS "widget_profiles_enabled_idx"
+  ON "widget_environment_profiles" USING btree ("enabled");
+CREATE INDEX IF NOT EXISTS "widget_profiles_archived_at_idx"
+  ON "widget_environment_profiles" USING btree ("archived_at");
+CREATE UNIQUE INDEX IF NOT EXISTS "widget_profiles_application_environment_active_idx"
+  ON "widget_environment_profiles" USING btree ("application_id", "environment")
+  WHERE archived_at IS NULL;
+
+ALTER TABLE "tickets" ADD COLUMN IF NOT EXISTS "source_widget_profile_id" uuid;
+
+DO $$ BEGIN
+  ALTER TABLE "tickets"
+    ADD CONSTRAINT "tickets_source_widget_profile_id_widget_environment_profiles_id_fk"
+    FOREIGN KEY ("source_widget_profile_id") REFERENCES "public"."widget_environment_profiles"("id")
+    ON DELETE set null ON UPDATE no action;
+EXCEPTION
+  WHEN duplicate_object THEN null;
+END $$;
+
+CREATE INDEX IF NOT EXISTS "tickets_source_widget_profile_idx"
+  ON "tickets" USING btree ("source_widget_profile_id");
diff --git a/packages/db/drizzle/0113_integration_channelid_backfill.sql b/packages/db/drizzle/0116_integration_channelid_backfill.sql
similarity index 100%
rename from packages/db/drizzle/0113_integration_channelid_backfill.sql
rename to packages/db/drizzle/0116_integration_channelid_backfill.sql
diff --git a/packages/db/drizzle/0117_changelog_taxonomy.sql b/packages/db/drizzle/0117_changelog_taxonomy.sql
new file mode 100644
index 000000000..0bc22045b
--- /dev/null
+++ b/packages/db/drizzle/0117_changelog_taxonomy.sql
@@ -0,0 +1,49 @@
+CREATE TABLE IF NOT EXISTS "changelog_categories" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "slug" text NOT NULL,
+  "description" text,
+  "color" text,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "changelog_products" (
+  "id" uuid PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "slug" text NOT NULL,
+  "description" text,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "changelog_categories_slug_idx"
+  ON "changelog_categories" USING btree ("slug");
+CREATE UNIQUE INDEX IF NOT EXISTS "changelog_products_slug_idx"
+  ON "changelog_products" USING btree ("slug");
+
+ALTER TABLE "changelog_entries" ADD COLUMN IF NOT EXISTS "category_id" uuid;
+ALTER TABLE "changelog_entries" ADD COLUMN IF NOT EXISTS "product_id" uuid;
+
+DO $$ BEGIN
+  ALTER TABLE "changelog_entries"
+    ADD CONSTRAINT "changelog_entries_category_id_changelog_categories_id_fk"
+    FOREIGN KEY ("category_id") REFERENCES "public"."changelog_categories"("id")
+    ON DELETE set null ON UPDATE no action;
+EXCEPTION
+  WHEN duplicate_object THEN null;
+END $$;
+
+DO $$ BEGIN
+  ALTER TABLE "changelog_entries"
+    ADD CONSTRAINT "changelog_entries_product_id_changelog_products_id_fk"
+    FOREIGN KEY ("product_id") REFERENCES "public"."changelog_products"("id")
+    ON DELETE set null ON UPDATE no action;
+EXCEPTION
+  WHEN duplicate_object THEN null;
+END $$;
+
+CREATE INDEX IF NOT EXISTS "changelog_category_id_idx"
+  ON "changelog_entries" USING btree ("category_id");
+CREATE INDEX IF NOT EXISTS "changelog_product_id_idx"
+  ON "changelog_entries" USING btree ("product_id");
diff --git a/packages/db/drizzle/0118_ticket_email_prefs.sql b/packages/db/drizzle/0118_ticket_email_prefs.sql
new file mode 100644
index 000000000..cb93fac7b
--- /dev/null
+++ b/packages/db/drizzle/0118_ticket_email_prefs.sql
@@ -0,0 +1,9 @@
+ALTER TABLE "notification_preferences" ADD COLUMN "email_ticket_threads" boolean DEFAULT true NOT NULL;
+ALTER TABLE "notification_preferences" ADD COLUMN "email_ticket_properties" boolean DEFAULT true NOT NULL;
+ALTER TABLE "notification_preferences" ADD COLUMN "email_ticket_status" boolean DEFAULT true NOT NULL;
+ALTER TABLE "notification_preferences" ADD COLUMN "email_ticket_assignment" boolean DEFAULT true NOT NULL;
+ALTER TABLE "notification_preferences" ADD COLUMN "email_ticket_participants" boolean DEFAULT false NOT NULL;
+ALTER TABLE "notification_preferences" ADD COLUMN "email_ticket_shares" boolean DEFAULT false NOT NULL;
+ALTER TABLE "notification_preferences" ADD COLUMN "email_ticket_sla" boolean DEFAULT true NOT NULL;
+
+ALTER TABLE "ticket_subscriptions" ADD COLUMN "notify_properties" boolean DEFAULT true NOT NULL;
diff --git a/packages/db/drizzle/0119_github_sync_mapping_repair.sql b/packages/db/drizzle/0119_github_sync_mapping_repair.sql
new file mode 100644
index 000000000..b69f1b1e4
--- /dev/null
+++ b/packages/db/drizzle/0119_github_sync_mapping_repair.sql
@@ -0,0 +1,69 @@
+-- Ensure existing GitHub ticket sync connections have the full outbound event
+-- mapping set. Missing `ticket.updated` rows can make description and priority
+-- edits appear to save locally while never reaching the GitHub hook.
+INSERT INTO "integration_event_mappings" (
+  "id",
+  "integration_id",
+  "event_type",
+  "action_type",
+  "action_config",
+  "filters",
+  "target_key",
+  "enabled",
+  "created_at",
+  "updated_at"
+)
+SELECT
+  gen_random_uuid(),
+  i."id",
+  e."event_type",
+  'send_message',
+  '{}'::jsonb,
+  CASE
+    WHEN e."is_ticket_event" THEN COALESCE(
+      existing_ticket_mapping."filters",
+      CASE
+        WHEN NULLIF(i."config"->>'defaultInboxId', '') IS NOT NULL
+          THEN jsonb_build_object('inboxIds', jsonb_build_array(i."config"->>'defaultInboxId'))
+        ELSE NULL
+      END
+    )
+    ELSE NULL
+  END,
+  'default',
+  true,
+  now(),
+  now()
+FROM "integrations" i
+LEFT JOIN LATERAL (
+  SELECT m."filters"
+  FROM "integration_event_mappings" m
+  WHERE m."integration_id" = i."id"
+    AND m."enabled" = true
+    AND m."event_type" IN (
+      'ticket.created',
+      'ticket.status_changed',
+      'ticket.assigned',
+      'ticket.updated',
+      'ticket.thread_added',
+      'ticket.thread_updated',
+      'ticket.thread_deleted'
+    )
+  ORDER BY m."created_at" ASC
+  LIMIT 1
+) existing_ticket_mapping ON true
+CROSS JOIN (
+  VALUES
+    ('ticket.created', true),
+    ('ticket.status_changed', true),
+    ('ticket.assigned', true),
+    ('ticket.updated', true),
+    ('ticket.thread_added', true),
+    ('ticket.thread_updated', true),
+    ('ticket.thread_deleted', true),
+    ('post.created', false)
+) AS e("event_type", "is_ticket_event")
+WHERE i."integration_type" = 'github'
+  AND i."status" = 'active'
+  AND COALESCE(i."config"->>'syncDirection', 'outbound') IN ('outbound', 'bidirectional')
+ON CONFLICT ("integration_id", "event_type", "action_type", "target_key") DO NOTHING;
diff --git a/packages/db/drizzle/0120_widget_ticket_requester_owned_scope.sql b/packages/db/drizzle/0120_widget_ticket_requester_owned_scope.sql
new file mode 100644
index 000000000..c5b72c9ed
--- /dev/null
+++ b/packages/db/drizzle/0120_widget_ticket_requester_owned_scope.sql
@@ -0,0 +1,8 @@
+UPDATE widget_environment_profiles
+SET support_config = jsonb_set(
+  COALESCE(support_config, '{}'::jsonb),
+  '{ticketListScope}',
+  '"requester_owned"'::jsonb,
+  true
+)
+WHERE support_config->>'ticketListScope' = 'same_profile_allowed_inboxes';
diff --git a/packages/db/drizzle/0121_portal_tab_config.sql b/packages/db/drizzle/0121_portal_tab_config.sql
new file mode 100644
index 000000000..e31b6d5f9
--- /dev/null
+++ b/packages/db/drizzle/0121_portal_tab_config.sql
@@ -0,0 +1,15 @@
+-- Add portal tab configuration to settings table
+ALTER TABLE "settings" ADD COLUMN "portal_tab_config" text;
+
+-- Create portal_tab_segment_overrides table for segment-level tab visibility overrides
+CREATE TABLE "portal_tab_segment_overrides" (
+  "id" uuid NOT NULL PRIMARY KEY DEFAULT gen_random_uuid(),
+  "segment_id" uuid NOT NULL REFERENCES "segments"("id") ON DELETE CASCADE,
+  "overrides" text NOT NULL,
+  "created_at" timestamp NOT NULL DEFAULT now(),
+  "updated_at" timestamp NOT NULL DEFAULT now()
+);
+
+-- Create indexes for efficient lookups
+CREATE UNIQUE INDEX "portal_tab_segment_overrides_segment_id_idx" ON "portal_tab_segment_overrides"("segment_id");
+CREATE INDEX "portal_tab_segment_overrides_created_at_idx" ON "portal_tab_segment_overrides"("created_at");
diff --git a/packages/db/drizzle/0122_help_center_category_audience.sql b/packages/db/drizzle/0122_help_center_category_audience.sql
new file mode 100644
index 000000000..573ed07ce
--- /dev/null
+++ b/packages/db/drizzle/0122_help_center_category_audience.sql
@@ -0,0 +1,19 @@
+ALTER TABLE "kb_categories"
+  ADD COLUMN IF NOT EXISTS "visibility" text NOT NULL DEFAULT 'public',
+  ADD COLUMN IF NOT EXISTS "allowed_segment_ids" jsonb NOT NULL DEFAULT '[]'::jsonb,
+  ADD COLUMN IF NOT EXISTS "allowed_principal_ids" jsonb NOT NULL DEFAULT '[]'::jsonb;
+
+UPDATE "kb_categories"
+SET "visibility" = CASE WHEN "is_public" THEN 'public' ELSE 'targeted' END
+WHERE "visibility" IS NULL OR "visibility" NOT IN ('public', 'targeted');
+
+DO $$ BEGIN
+  ALTER TABLE "kb_categories"
+    ADD CONSTRAINT "kb_categories_visibility_check"
+    CHECK ("visibility" IN ('public', 'targeted'));
+EXCEPTION
+  WHEN duplicate_object THEN null;
+END $$;
+
+CREATE INDEX IF NOT EXISTS "kb_categories_visibility_idx"
+  ON "kb_categories" USING btree ("visibility");
diff --git a/packages/db/drizzle/0123_changelog_visibility.sql b/packages/db/drizzle/0123_changelog_visibility.sql
new file mode 100644
index 000000000..594cee024
--- /dev/null
+++ b/packages/db/drizzle/0123_changelog_visibility.sql
@@ -0,0 +1,37 @@
+ALTER TABLE "settings" ADD COLUMN IF NOT EXISTS "changelog_visibility_config" text;
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "changelog_segment_visibility" (
+  "id" uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+  "segment_id" uuid NOT NULL REFERENCES "segments"("id") ON DELETE CASCADE,
+  "restrict_categories" boolean DEFAULT false NOT NULL,
+  "allowed_category_ids" jsonb DEFAULT '[]'::jsonb NOT NULL,
+  "restrict_products" boolean DEFAULT false NOT NULL,
+  "allowed_product_ids" jsonb DEFAULT '[]'::jsonb NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "changelog_segment_visibility_segment_id_unique" UNIQUE("segment_id")
+);
+--> statement-breakpoint
+DO $$ BEGIN
+  -- The CREATE TABLE above already declares this UNIQUE constraint inline, so on
+  -- a fresh database the constraint (and its backing index) already exist here.
+  -- Re-running ADD CONSTRAINT unconditionally raises 42P07 duplicate_table
+  -- ("relation ... already exists") for the backing index — which is NOT a
+  -- duplicate_object, so the old EXCEPTION handler did not catch it and the
+  -- whole migration aborted on a from-scratch run. Guard on pg_constraint
+  -- instead (matching the idempotent pattern in 0124): only ADD the constraint
+  -- when the table pre-existed without it (CREATE TABLE IF NOT EXISTS skipped).
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conrelid = 'public.changelog_segment_visibility'::regclass
+      AND conname = 'changelog_segment_visibility_segment_id_unique'
+  ) THEN
+    ALTER TABLE "changelog_segment_visibility"
+      ADD CONSTRAINT "changelog_segment_visibility_segment_id_unique"
+      UNIQUE ("segment_id");
+  END IF;
+END $$;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "changelog_segment_visibility_segment_id_idx"
+  ON "changelog_segment_visibility" USING btree ("segment_id");
diff --git a/packages/db/drizzle/0124_visibility_metadata_normalization.sql b/packages/db/drizzle/0124_visibility_metadata_normalization.sql
new file mode 100644
index 000000000..c180554c0
--- /dev/null
+++ b/packages/db/drizzle/0124_visibility_metadata_normalization.sql
@@ -0,0 +1,113 @@
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = 'public'
+      AND table_name = 'portal_tab_segment_overrides'
+      AND column_name = 'overrides'
+      AND data_type <> 'jsonb'
+  ) THEN
+    ALTER TABLE "portal_tab_segment_overrides"
+      ALTER COLUMN "overrides" DROP DEFAULT;
+
+    ALTER TABLE "portal_tab_segment_overrides"
+      ALTER COLUMN "overrides" TYPE jsonb USING
+        CASE
+          WHEN "overrides" IS NULL OR btrim("overrides") = '' THEN '{}'::jsonb
+          ELSE "overrides"::jsonb
+        END;
+  END IF;
+
+  ALTER TABLE "portal_tab_segment_overrides"
+    ALTER COLUMN "overrides" SET DEFAULT '{}'::jsonb;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = 'public'
+      AND table_name = 'portal_tab_segment_overrides'
+      AND column_name = 'created_at'
+      AND data_type = 'timestamp without time zone'
+  ) THEN
+    ALTER TABLE "portal_tab_segment_overrides"
+      ALTER COLUMN "created_at" TYPE timestamp with time zone USING "created_at" AT TIME ZONE 'UTC';
+  END IF;
+
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = 'public'
+      AND table_name = 'portal_tab_segment_overrides'
+      AND column_name = 'updated_at'
+      AND data_type = 'timestamp without time zone'
+  ) THEN
+    ALTER TABLE "portal_tab_segment_overrides"
+      ALTER COLUMN "updated_at" TYPE timestamp with time zone USING "updated_at" AT TIME ZONE 'UTC';
+  END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conrelid = 'public.portal_tab_segment_overrides'::regclass
+      AND conname = 'portal_tab_segment_overrides_segment_id_unique'
+  ) THEN
+    ALTER TABLE "portal_tab_segment_overrides"
+      ADD CONSTRAINT "portal_tab_segment_overrides_segment_id_unique"
+      UNIQUE ("segment_id");
+  END IF;
+EXCEPTION
+  WHEN duplicate_object OR duplicate_table THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_class idx
+    JOIN pg_index ix ON ix.indexrelid = idx.oid
+    LEFT JOIN pg_constraint con ON con.conindid = idx.oid
+    WHERE idx.relname = 'portal_tab_segment_overrides_segment_id_idx'
+      AND ix.indisunique
+      AND con.oid IS NULL
+  ) THEN
+    DROP INDEX "portal_tab_segment_overrides_segment_id_idx";
+  END IF;
+END $$;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "portal_tab_segment_overrides_segment_id_idx"
+  ON "portal_tab_segment_overrides" USING btree ("segment_id");
+--> statement-breakpoint
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conrelid = 'public.changelog_segment_visibility'::regclass
+      AND conname = 'changelog_segment_visibility_segment_id_unique'
+  ) THEN
+    ALTER TABLE "changelog_segment_visibility"
+      ADD CONSTRAINT "changelog_segment_visibility_segment_id_unique"
+      UNIQUE ("segment_id");
+  END IF;
+EXCEPTION
+  WHEN duplicate_object OR duplicate_table THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_class idx
+    JOIN pg_index ix ON ix.indexrelid = idx.oid
+    LEFT JOIN pg_constraint con ON con.conindid = idx.oid
+    WHERE idx.relname = 'changelog_segment_visibility_segment_id_idx'
+      AND ix.indisunique
+      AND con.oid IS NULL
+  ) THEN
+    DROP INDEX "changelog_segment_visibility_segment_id_idx";
+  END IF;
+END $$;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "changelog_segment_visibility_segment_id_idx"
+  ON "changelog_segment_visibility" USING btree ("segment_id");
\ No newline at end of file
diff --git a/packages/db/drizzle/0125_external_surface_permissions.sql b/packages/db/drizzle/0125_external_surface_permissions.sql
new file mode 100644
index 000000000..67a3f7ded
--- /dev/null
+++ b/packages/db/drizzle/0125_external_surface_permissions.sql
@@ -0,0 +1,65 @@
+-- External-surface coverage: new RBAC permissions for resources newly exposed
+-- via the REST API / MCP server (teams, segments, user attributes, portal &
+-- widget config, conversations, moderation).
+--
+-- Mirrors the role grants in
+-- apps/web/src/lib/server/domains/authz/authz.permissions.ts. Re-runnable:
+-- every INSERT uses ON CONFLICT DO NOTHING so partial-state deploys recover.
+
+-- ---------------------------------------------------------------------------
+-- Seed permissions
+-- ---------------------------------------------------------------------------
+INSERT INTO "permissions" ("id", "key", "category", "description", "is_system") VALUES
+  (gen_random_uuid(), 'team.view',             'team',       'View teams and their membership.', true),
+  (gen_random_uuid(), 'team.manage',           'team',       'Create, update, and archive teams and manage team membership.', true),
+  (gen_random_uuid(), 'segment.view',          'audience',   'View audience segments and their membership.', true),
+  (gen_random_uuid(), 'segment.manage',        'audience',   'Create, update, and delete segments and manage segment membership.', true),
+  (gen_random_uuid(), 'user_attribute.view',   'audience',   'View custom user attribute definitions.', true),
+  (gen_random_uuid(), 'user_attribute.manage', 'audience',   'Create, update, and delete custom user attribute definitions.', true),
+  (gen_random_uuid(), 'portal.manage',         'portal',     'Configure portal tabs and visibility (org-wide and per-segment).', true),
+  (gen_random_uuid(), 'widget.view',           'portal',     'View widget applications and environment profiles.', true),
+  (gen_random_uuid(), 'widget.manage',         'portal',     'Create and update widget applications and environment profiles.', true),
+  (gen_random_uuid(), 'chat.view',             'chat',       'View support conversations and messages.', true),
+  (gen_random_uuid(), 'chat.manage',           'chat',       'Reply, assign, prioritise, note, tag, and resolve conversations.', true),
+  (gen_random_uuid(), 'moderation.view',       'moderation', 'View posts and comments pending moderation.', true),
+  (gen_random_uuid(), 'moderation.manage',     'moderation', 'Approve or reject posts and comments.', true)
+ON CONFLICT ("key") DO NOTHING;
+--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------
+-- Grant role_permissions
+-- ---------------------------------------------------------------------------
+-- Owner: re-grant every permission (covers the new keys).
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+CROSS JOIN "permissions" p
+WHERE r.key = 'owner'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Supervisor: all new operational + structural config (admin.* stays owner-only).
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+JOIN "permissions" p ON p.key IN (
+  'team.view', 'team.manage',
+  'segment.view', 'segment.manage',
+  'user_attribute.view', 'user_attribute.manage',
+  'portal.manage', 'widget.view', 'widget.manage',
+  'chat.view', 'chat.manage',
+  'moderation.view', 'moderation.manage'
+)
+WHERE r.key = 'supervisor'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
+--> statement-breakpoint
+
+-- Agent: front-line conversation handling + read context.
+INSERT INTO "role_permissions" ("id", "role_id", "permission_id")
+SELECT gen_random_uuid(), r.id, p.id
+FROM "roles" r
+JOIN "permissions" p ON p.key IN (
+  'chat.view', 'chat.manage', 'team.view', 'segment.view'
+)
+WHERE r.key = 'agent'
+ON CONFLICT ("role_id", "permission_id") DO NOTHING;
diff --git a/packages/db/drizzle/meta/0051_snapshot.json b/packages/db/drizzle/meta/0051_snapshot.json
index 097b1cad0..a0b530d4f 100644
--- a/packages/db/drizzle/meta/0051_snapshot.json
+++ b/packages/db/drizzle/meta/0051_snapshot.json
@@ -1,6 +1,6 @@
 {
-  "id": "2e864cf6-fe05-4b7d-a50f-1791ce9df928",
-  "prevId": "f0283e64-2c0a-4f6f-9beb-8ebb31c06b7d",
+  "id": "eb67e194-ae93-4b14-a2c3-05b686fd2f4c",
+  "prevId": "2e864cf6-fe05-4b7d-a50f-1791ce9df928",
   "version": "7",
   "dialect": "postgresql",
   "tables": {
diff --git a/packages/db/drizzle/meta/0052_snapshot.json b/packages/db/drizzle/meta/0052_snapshot.json
index 097b1cad0..dd5d82d0c 100644
--- a/packages/db/drizzle/meta/0052_snapshot.json
+++ b/packages/db/drizzle/meta/0052_snapshot.json
@@ -1,6 +1,6 @@
 {
-  "id": "2e864cf6-fe05-4b7d-a50f-1791ce9df928",
-  "prevId": "f0283e64-2c0a-4f6f-9beb-8ebb31c06b7d",
+  "id": "f7980214-908a-4bba-b0b2-af2235a2594f",
+  "prevId": "eb67e194-ae93-4b14-a2c3-05b686fd2f4c",
   "version": "7",
   "dialect": "postgresql",
   "tables": {
diff --git a/packages/db/drizzle/meta/_journal.json b/packages/db/drizzle/meta/_journal.json
index 52ddc98e0..ae41720de 100644
--- a/packages/db/drizzle/meta/_journal.json
+++ b/packages/db/drizzle/meta/_journal.json
@@ -796,8 +796,92 @@
     {
       "idx": 113,
       "version": "7",
-      "when": 1782432000000,
-      "tag": "0113_integration_channelid_backfill",
+      "when": 1782432000001,
+      "tag": "0113_ticketing_and_authz",
+      "breakpoints": true
+    },
+    {
+      "idx": 114,
+      "version": "7",
+      "when": 1782518400000,
+      "tag": "0114_ticket_thread_external_links",
+      "breakpoints": true
+    },
+    {
+      "idx": 115,
+      "version": "7",
+      "when": 1782604800000,
+      "tag": "0115_widget_profiles",
+      "breakpoints": true
+    },
+    {
+      "idx": 116,
+      "version": "7",
+      "when": 1782691200000,
+      "tag": "0116_integration_channelid_backfill",
+      "breakpoints": true
+    },
+    {
+      "idx": 117,
+      "version": "7",
+      "when": 1782777600000,
+      "tag": "0117_changelog_taxonomy",
+      "breakpoints": true
+    },
+    {
+      "idx": 118,
+      "version": "7",
+      "when": 1782864000000,
+      "tag": "0118_ticket_email_prefs",
+      "breakpoints": true
+    },
+    {
+      "idx": 119,
+      "version": "7",
+      "when": 1782950400000,
+      "tag": "0119_github_sync_mapping_repair",
+      "breakpoints": true
+    },
+    {
+      "idx": 120,
+      "version": "7",
+      "when": 1783036800000,
+      "tag": "0120_widget_ticket_requester_owned_scope",
+      "breakpoints": true
+    },
+    {
+      "idx": 121,
+      "version": "7",
+      "when": 1783123200000,
+      "tag": "0121_portal_tab_config",
+      "breakpoints": true
+    },
+    {
+      "idx": 122,
+      "version": "7",
+      "when": 1783209600000,
+      "tag": "0122_help_center_category_audience",
+      "breakpoints": true
+    },
+    {
+      "idx": 123,
+      "version": "7",
+      "when": 1783296000000,
+      "tag": "0123_changelog_visibility",
+      "breakpoints": true
+    },
+    {
+      "idx": 124,
+      "version": "7",
+      "when": 1783382400000,
+      "tag": "0124_visibility_metadata_normalization",
+      "breakpoints": true
+    },
+    {
+      "idx": 125,
+      "version": "7",
+      "when": 1783468800000,
+      "tag": "0125_external_surface_permissions",
       "breakpoints": true
     },
     {
diff --git a/packages/db/src/__tests__/schema-integration-sync-log.test.ts b/packages/db/src/__tests__/schema-integration-sync-log.test.ts
new file mode 100644
index 000000000..63dbf3670
--- /dev/null
+++ b/packages/db/src/__tests__/schema-integration-sync-log.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest'
+import { getTableColumns, getTableName } from 'drizzle-orm'
+import { integrationSyncLog } from '../schema/integration-sync-log'
+
+type DriverMappable = {
+  mapToDriverValue(value: unknown): unknown
+  mapFromDriverValue(value: unknown): unknown
+}
+
+describe('integration_sync_log schema', () => {
+  it('has the expected table and columns', () => {
+    expect(getTableName(integrationSyncLog)).toBe('integration_sync_log')
+    expect(Object.keys(getTableColumns(integrationSyncLog))).toEqual(
+      expect.arrayContaining([
+        'id',
+        'integrationId',
+        'ticketId',
+        'eventType',
+        'direction',
+        'status',
+        'errorMessage',
+        'durationMs',
+        'createdAt',
+      ])
+    )
+  })
+
+  it('maps TypeID integration and ticket ids to UUID driver values', () => {
+    const columns = getTableColumns(integrationSyncLog)
+    const integrationColumn = columns.integrationId as unknown as DriverMappable
+    const ticketColumn = columns.ticketId as unknown as DriverMappable
+    const uuid = '00000000-0000-0000-0000-000000000000'
+    const integrationId = 'integration_00000000000000000000000000'
+    const ticketId = 'ticket_00000000000000000000000000'
+
+    expect(integrationColumn.mapToDriverValue(integrationId)).toBe(uuid)
+    expect(integrationColumn.mapFromDriverValue(uuid)).toBe(integrationId)
+    expect(ticketColumn.mapToDriverValue(ticketId)).toBe(uuid)
+    expect(ticketColumn.mapFromDriverValue(uuid)).toBe(ticketId)
+    expect(ticketColumn.mapToDriverValue(null)).toBeNull()
+    expect(ticketColumn.mapFromDriverValue(null)).toBeNull()
+  })
+})
diff --git a/packages/db/src/schema/api-keys.ts b/packages/db/src/schema/api-keys.ts
index 023afa9c0..121ef74f0 100644
--- a/packages/db/src/schema/api-keys.ts
+++ b/packages/db/src/schema/api-keys.ts
@@ -4,8 +4,8 @@
  * API keys are created by admins and used by external integrations
  * to authenticate with the public REST API.
  */
-import { pgTable, timestamp, varchar, index, text } from 'drizzle-orm/pg-core'
-import { relations } from 'drizzle-orm'
+import { pgTable, timestamp, varchar, index, text, boolean } from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
 import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
 import { principal } from './auth'
 
@@ -42,13 +42,36 @@ export const apiKeys = pgTable(
     /** When the key was revoked (soft delete) */
     revokedAt: timestamp('revoked_at', { withTimezone: true }),
     /**
-     * Optional JSON-encoded array of capability scopes. Used by
-     * trusted internal endpoints — e.g. `["internal:tier-limits"]`.
-     * Null/empty means a normal API key with no special capabilities
-     * (subject to the principal's role for authorization). Never
-     * serialized to the public API.
+     * Allowed permission scopes (dotted permission keys, e.g. ['ticket.view_all']).
+     * Empty array + compatLegacyFullAccess=true means "all permissions" (legacy).
      */
-    scopes: text('scopes'),
+    scopes: text('scopes')
+      .array()
+      .notNull()
+      .default(sql`'{}'::text[]`),
+    /** Allowed team IDs; empty array means "any team allowed by scopes". */
+    allowedTeamIds: text('allowed_team_ids')
+      .array()
+      .notNull()
+      .default(sql`'{}'::text[]`),
+    /** Allowed inbox IDs; empty array means "any inbox allowed by scopes". */
+    allowedInboxIds: text('allowed_inbox_ids')
+      .array()
+      .notNull()
+      .default(sql`'{}'::text[]`),
+    /** Last client IP that authenticated with this key. */
+    lastIp: text('last_ip'),
+    /** Last user-agent (truncated to 500 chars). */
+    lastUserAgent: text('last_user_agent'),
+    /** When the key was last rotated. */
+    rotatedAt: timestamp('rotated_at', { withTimezone: true }),
+    /**
+     * If true, an empty `scopes` array grants all permissions (legacy behavior).
+     * Cleared automatically the first time `scopes` becomes non-empty.
+     */
+    compatLegacyFullAccess: boolean('compat_legacy_full_access').notNull().default(true),
+    /** When an admin acknowledged the legacy compat warning for this key. */
+    compatAcknowledgedAt: timestamp('compat_acknowledged_at', { withTimezone: true }),
   },
   (table) => [
     // Index for listing keys by creator
@@ -57,6 +80,10 @@ export const apiKeys = pgTable(
     index('api_keys_principal_id_idx').on(table.principalId),
     // Index for filtering active/revoked keys
     index('api_keys_revoked_at_idx').on(table.revokedAt),
+    // GIN indexes for array containment lookups
+    index('api_keys_scopes_idx').using('gin', table.scopes),
+    index('api_keys_allowed_team_ids_idx').using('gin', table.allowedTeamIds),
+    index('api_keys_allowed_inbox_ids_idx').using('gin', table.allowedInboxIds),
   ]
 )
 
diff --git a/packages/db/src/schema/audit-events.ts b/packages/db/src/schema/audit-events.ts
new file mode 100644
index 000000000..5f2819650
--- /dev/null
+++ b/packages/db/src/schema/audit-events.ts
@@ -0,0 +1,70 @@
+/**
+ * Workspace-wide append-only audit log.
+ *
+ * Distinct from `post_activity` (per-post timeline) and `ticket_activity`
+ * (per-ticket timeline, added in Phase 3): this table records security- and
+ * admin-relevant events across the entire workspace — role grants, permission
+ * edits, ticket shares, exports, API key actions, settings changes.
+ *
+ * The table is intentionally append-only: there is no UPDATE or DELETE path
+ * exposed by the audit domain. Schema changes that need to redact entries
+ * should add a new event rather than mutate history.
+ */
+import { pgTable, text, timestamp, jsonb, index } from 'drizzle-orm/pg-core'
+import { typeIdWithDefault, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { principal } from './auth'
+
+/**
+ * Source of the actor — UI, API key, integration, system.
+ */
+export type AuditSource = 'web' | 'api' | 'integration' | 'system' | 'mcp'
+
+/**
+ * JSON-serialisable scalar / container for audit diffs. Constrains the value
+ * type to what TanStack Start's RPC layer can serialise so audit rows can
+ * round-trip through server functions without extra encoding.
+ */
+export type AuditJsonValue =
+  | string
+  | number
+  | boolean
+  | null
+  | AuditJsonValue[]
+  | { [key: string]: AuditJsonValue }
+
+export interface AuditDiff {
+  /** Field-level before/after maps. */
+  before?: Record<string, AuditJsonValue>
+  after?: Record<string, AuditJsonValue>
+  /** Free-form additional context (e.g. share level, ticket scope). */
+  context?: Record<string, AuditJsonValue>
+}
+
+export const auditEvents = pgTable(
+  'audit_events',
+  {
+    id: typeIdWithDefault('audit')('id').primaryKey(),
+    /** Actor that performed the action; NULL = system / cron / migration. */
+    principalId: typeIdColumnNullable('principal')('principal_id').references(() => principal.id, {
+      onDelete: 'set null',
+    }),
+    /** Dotted action key, e.g. "role.granted", "ticket.shared", "api_key.rotated". */
+    action: text('action').notNull(),
+    /** Type of the target resource (e.g. "ticket", "team", "api_key"). */
+    targetType: text('target_type').notNull(),
+    /** TypeID of the target; stored as text to avoid hard-coupling to one prefix. */
+    targetId: text('target_id'),
+    /** Structured diff: before/after/context. */
+    diff: jsonb('diff').$type<AuditDiff>().notNull().default({}),
+    source: text('source').$type<AuditSource>().notNull().default('web'),
+    ipAddress: text('ip_address'),
+    userAgent: text('user_agent'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    index('audit_events_created_at_idx').on(t.createdAt),
+    index('audit_events_principal_idx').on(t.principalId, t.createdAt),
+    index('audit_events_action_idx').on(t.action, t.createdAt),
+    index('audit_events_target_idx').on(t.targetType, t.targetId),
+  ]
+)
diff --git a/packages/db/src/schema/auth.ts b/packages/db/src/schema/auth.ts
index 97691a235..b4c3e707b 100644
--- a/packages/db/src/schema/auth.ts
+++ b/packages/db/src/schema/auth.ts
@@ -325,6 +325,22 @@ export const settings = pgTable('settings', {
    * lost-update on concurrent writes.
    */
   authConfigVersion: integer('auth_config_version').notNull().default(0),
+  /**
+   * Portal tab visibility configuration (JSON)
+   * Structure: { feedback, roadmap, changelog, myTickets, helpCenter, support }
+   * Each field is a boolean indicating if the tab is visible.
+   * Null means all tabs are enabled (default).
+   */
+  portalTabConfig: text('portal_tab_config'),
+  /**
+   * Changelog category/product visibility configuration (JSON)
+   * Structure: { restrictCategories?, allowedCategoryIds?, restrictProducts?, allowedProductIds? }
+   * When restrictCategories is false (default), all categories are visible.
+   * When true, only entries whose category is in allowedCategoryIds are shown
+   * (entries with no category are always visible).
+   * Null/absent means no restrictions (all visible).
+   */
+  changelogVisibilityConfig: text('changelog_visibility_config'),
 })
 
 /**
diff --git a/packages/db/src/schema/changelog.ts b/packages/db/src/schema/changelog.ts
index d00dc5176..0dad8c678 100644
--- a/packages/db/src/schema/changelog.ts
+++ b/packages/db/src/schema/changelog.ts
@@ -1,10 +1,64 @@
-import { pgTable, text, timestamp, integer, index, uniqueIndex, jsonb } from 'drizzle-orm/pg-core'
+import {
+  pgTable,
+  text,
+  timestamp,
+  integer,
+  index,
+  uniqueIndex,
+  jsonb,
+  boolean,
+} from 'drizzle-orm/pg-core'
 import { relations } from 'drizzle-orm'
 import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
 import { principal } from './auth'
 import { posts } from './posts'
+import { segments } from './segments'
 import type { TiptapContent } from '../types'
 
+// ============================================
+// Changelog Visibility Configuration Types
+// ============================================
+
+/**
+ * Per-segment (or org-level) changelog category/product visibility config.
+ * When restrictCategories is false, all categories are visible.
+ * When true, only entries whose categoryId is in allowedCategoryIds are visible
+ * (entries with no category are always visible regardless).
+ */
+export interface ChangelogVisibilityConfig {
+  restrictCategories?: boolean
+  allowedCategoryIds?: string[]
+  restrictProducts?: boolean
+  allowedProductIds?: string[]
+}
+
+export const changelogCategories = pgTable(
+  'changelog_categories',
+  {
+    id: typeIdWithDefault('changelog_cat')('id').primaryKey(),
+    name: text('name').notNull(),
+    slug: text('slug').notNull(),
+    description: text('description'),
+    color: text('color'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (table) => [uniqueIndex('changelog_categories_slug_idx').on(table.slug)]
+)
+
+export const changelogProducts = pgTable(
+  'changelog_products',
+  {
+    id: typeIdWithDefault('changelog_prod')('id').primaryKey(),
+    name: text('name').notNull(),
+    slug: text('slug').notNull(),
+    description: text('description'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (table) => [uniqueIndex('changelog_products_slug_idx').on(table.slug)]
+)
+
 export const changelogEntries = pgTable(
   'changelog_entries',
   {
@@ -17,6 +71,14 @@ export const changelogEntries = pgTable(
     principalId: typeIdColumnNullable('principal')('principal_id').references(() => principal.id, {
       onDelete: 'set null',
     }),
+    categoryId: typeIdColumnNullable('changelog_cat')('category_id').references(
+      () => changelogCategories.id,
+      { onDelete: 'set null' }
+    ),
+    productId: typeIdColumnNullable('changelog_prod')('product_id').references(
+      () => changelogProducts.id,
+      { onDelete: 'set null' }
+    ),
     publishedAt: timestamp('published_at', { withTimezone: true }),
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
     updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
@@ -28,6 +90,8 @@ export const changelogEntries = pgTable(
   (table) => [
     index('changelog_published_at_idx').on(table.publishedAt),
     index('changelog_principal_id_idx').on(table.principalId),
+    index('changelog_category_id_idx').on(table.categoryId),
+    index('changelog_product_id_idx').on(table.productId),
     index('changelog_deleted_at_idx').on(table.deletedAt),
   ]
 )
@@ -57,9 +121,25 @@ export const changelogEntriesRelations = relations(changelogEntries, ({ one, man
     references: [principal.id],
     relationName: 'changelogAuthor',
   }),
+  category: one(changelogCategories, {
+    fields: [changelogEntries.categoryId],
+    references: [changelogCategories.id],
+  }),
+  product: one(changelogProducts, {
+    fields: [changelogEntries.productId],
+    references: [changelogProducts.id],
+  }),
   linkedPosts: many(changelogEntryPosts),
 }))
 
+export const changelogCategoriesRelations = relations(changelogCategories, ({ many }) => ({
+  entries: many(changelogEntries),
+}))
+
+export const changelogProductsRelations = relations(changelogProducts, ({ many }) => ({
+  entries: many(changelogEntries),
+}))
+
 export const changelogEntryPostsRelations = relations(changelogEntryPosts, ({ one }) => ({
   changelogEntry: one(changelogEntries, {
     fields: [changelogEntryPosts.changelogEntryId],
@@ -70,3 +150,53 @@ export const changelogEntryPostsRelations = relations(changelogEntryPosts, ({ on
     references: [posts.id],
   }),
 }))
+
+// ============================================
+// Changelog Visibility (category/product access control)
+// ============================================
+
+/**
+ * Per-segment changelog category/product visibility overrides.
+ *
+ * When restrictCategories is true, portal users in this segment only see
+ * changelog entries whose categoryId is in allowedCategoryIds (or has no
+ * category). When restrictCategories is false (default) all categories are
+ * visible for users in this segment.
+ *
+ * Effective config for a user is the UNION across their segments + org
+ * defaults: if any config is unrestricted the user sees everything.
+ */
+export const changelogSegmentVisibility = pgTable(
+  'changelog_segment_visibility',
+  {
+    id: typeIdWithDefault('clseg_vis')('id').primaryKey(),
+    segmentId: typeIdColumn('segment')('segment_id')
+      .notNull()
+      .references(() => segments.id, { onDelete: 'cascade' })
+      .unique(),
+    /** When true, limit visible entries to allowedCategoryIds (+ null category) */
+    restrictCategories: boolean('restrict_categories').notNull().default(false),
+    /** Category IDs allowed when restrictCategories=true */
+    allowedCategoryIds: jsonb('allowed_category_ids').$type<string[]>().notNull().default([]),
+    /** When true, limit visible entries to allowedProductIds (+ null product) */
+    restrictProducts: boolean('restrict_products').notNull().default(false),
+    /** Product IDs allowed when restrictProducts=true */
+    allowedProductIds: jsonb('allowed_product_ids').$type<string[]>().notNull().default([]),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (table) => [index('changelog_segment_visibility_segment_id_idx').on(table.segmentId)]
+)
+
+export const changelogSegmentVisibilityRelations = relations(
+  changelogSegmentVisibility,
+  ({ one }) => ({
+    segment: one(segments, {
+      fields: [changelogSegmentVisibility.segmentId],
+      references: [segments.id],
+    }),
+  })
+)
diff --git a/packages/db/src/schema/inboxes.ts b/packages/db/src/schema/inboxes.ts
new file mode 100644
index 000000000..c49a68dcc
--- /dev/null
+++ b/packages/db/src/schema/inboxes.ts
@@ -0,0 +1,163 @@
+/**
+ * Inboxes, channels, and memberships — Phase 4 of the ticketing rollout.
+ *
+ *   - `inboxes`             named queue owned by a team; defines defaults
+ *                           applied to incoming tickets.
+ *   - `inbox_channels`      per-inbox channel records (portal/email/api/widget/
+ *                           webhook) — config blob is opaque per kind.
+ *   - `inbox_memberships`   N:M between principals and inboxes (cross-team
+ *                           staffing); distinct from team_memberships.
+ */
+import { pgTable, text, timestamp, jsonb, boolean, index, uniqueIndex } from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { principal } from './auth'
+import { teams } from './teams'
+import { ticketStatuses } from './ticket-statuses'
+import { TICKET_PRIORITIES, TICKET_VISIBILITY_SCOPES } from './tickets'
+import type { AuditJsonValue } from './audit-events'
+
+export const INBOX_CHANNEL_KINDS = ['portal', 'email', 'api', 'widget', 'webhook'] as const
+export type InboxChannelKind = (typeof INBOX_CHANNEL_KINDS)[number]
+
+export const INBOX_MEMBERSHIP_ROLES = ['owner', 'agent', 'viewer'] as const
+export type InboxMembershipRole = (typeof INBOX_MEMBERSHIP_ROLES)[number]
+
+// ---------------------------------------------------------------------------
+// inboxes
+// ---------------------------------------------------------------------------
+
+export const inboxes = pgTable(
+  'inboxes',
+  {
+    id: typeIdWithDefault('inbox')('id').primaryKey(),
+    name: text('name').notNull(),
+    /** Stable URL/lookup identifier (lowercase, kebab). */
+    slug: text('slug').notNull(),
+    description: text('description'),
+    /** Team that owns this inbox. NULL = workspace-wide. */
+    primaryTeamId: typeIdColumnNullable('team')('primary_team_id').references(() => teams.id, {
+      onDelete: 'set null',
+    }),
+    /** Default visibility scope applied to incoming tickets. */
+    defaultVisibilityScope: text('default_visibility_scope', { enum: TICKET_VISIBILITY_SCOPES })
+      .notNull()
+      .default('team'),
+    /** Default priority applied to incoming tickets. */
+    defaultPriority: text('default_priority', { enum: TICKET_PRIORITIES })
+      .notNull()
+      .default('normal'),
+    /** Default status assigned to a fresh ticket; NULL = use the global default status. */
+    defaultStatusId: typeIdColumnNullable('ticket_status')('default_status_id').references(
+      () => ticketStatuses.id,
+      { onDelete: 'set null' }
+    ),
+    color: text('color'),
+    icon: text('icon'),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    uniqueIndex('inboxes_slug_idx').on(t.slug),
+    index('inboxes_primary_team_idx').on(t.primaryTeamId),
+    index('inboxes_archived_at_idx').on(t.archivedAt),
+    uniqueIndex('inboxes_active_name_idx')
+      .on(sql`lower(${t.name})`)
+      .where(sql`archived_at IS NULL`),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// inbox_channels
+// ---------------------------------------------------------------------------
+
+export const inboxChannels = pgTable(
+  'inbox_channels',
+  {
+    id: typeIdWithDefault('inbox_ch')('id').primaryKey(),
+    inboxId: typeIdColumn('inbox')('inbox_id')
+      .notNull()
+      .references(() => inboxes.id, { onDelete: 'cascade' }),
+    kind: text('kind', { enum: INBOX_CHANNEL_KINDS }).notNull(),
+    label: text('label').notNull(),
+    /** Per-kind opaque configuration (e.g. mailbox address, webhook secret). */
+    config: jsonb('config').$type<{ [k: string]: AuditJsonValue }>().notNull().default({}),
+    /** External provider identifier (mailbox address, webhook id, etc.). */
+    externalId: text('external_id'),
+    enabled: boolean('enabled').notNull().default(true),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    index('inbox_channels_inbox_idx').on(t.inboxId),
+    uniqueIndex('inbox_channels_kind_external_id_idx')
+      .on(t.kind, t.externalId)
+      .where(sql`external_id IS NOT NULL AND archived_at IS NULL`),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// inbox_memberships
+// ---------------------------------------------------------------------------
+
+export const inboxMemberships = pgTable(
+  'inbox_memberships',
+  {
+    id: typeIdWithDefault('inbox_mem')('id').primaryKey(),
+    inboxId: typeIdColumn('inbox')('inbox_id')
+      .notNull()
+      .references(() => inboxes.id, { onDelete: 'cascade' }),
+    principalId: typeIdColumn('principal')('principal_id')
+      .notNull()
+      .references(() => principal.id, { onDelete: 'cascade' }),
+    role: text('role', { enum: INBOX_MEMBERSHIP_ROLES }).notNull().default('agent'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    uniqueIndex('inbox_memberships_inbox_principal_idx').on(t.inboxId, t.principalId),
+    index('inbox_memberships_principal_idx').on(t.principalId),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// Relations
+// ---------------------------------------------------------------------------
+
+export const inboxesRelations = relations(inboxes, ({ one, many }) => ({
+  primaryTeam: one(teams, {
+    fields: [inboxes.primaryTeamId],
+    references: [teams.id],
+  }),
+  defaultStatus: one(ticketStatuses, {
+    fields: [inboxes.defaultStatusId],
+    references: [ticketStatuses.id],
+  }),
+  channels: many(inboxChannels),
+  memberships: many(inboxMemberships),
+}))
+
+export const inboxChannelsRelations = relations(inboxChannels, ({ one }) => ({
+  inbox: one(inboxes, {
+    fields: [inboxChannels.inboxId],
+    references: [inboxes.id],
+  }),
+}))
+
+export const inboxMembershipsRelations = relations(inboxMemberships, ({ one }) => ({
+  inbox: one(inboxes, {
+    fields: [inboxMemberships.inboxId],
+    references: [inboxes.id],
+  }),
+  principal: one(principal, {
+    fields: [inboxMemberships.principalId],
+    references: [principal.id],
+  }),
+}))
diff --git a/packages/db/src/schema/index.ts b/packages/db/src/schema/index.ts
index 389443041..f153b595d 100644
--- a/packages/db/src/schema/index.ts
+++ b/packages/db/src/schema/index.ts
@@ -28,3 +28,35 @@ export * from './hook-deliveries'
 export * from './audit-log'
 export * from './sso-recovery-code'
 export * from './push-devices'
+export * from './widget-profiles'
+
+// Ticketing — access & visibility (Phase 1 foundation)
+export * from './teams'
+export * from './roles'
+export * from './audit-events'
+
+// Ticketing — organizations & contacts (Phase 2)
+export * from './organizations'
+
+// Ticketing — ticket core (Phase 3)
+export * from './ticket-statuses'
+export * from './tickets'
+
+// Ticketing — inboxes, channels, routing (Phase 4)
+export * from './inboxes'
+export * from './routing-rules'
+
+// Ticketing — SLA + escalations (Phase 5)
+export * from './sla'
+
+// Ticketing — subscriptions + webhook delivery log (Phase 7)
+export * from './ticket-subscriptions'
+export * from './webhook-deliveries'
+
+// Ticketing — external links + user mappings (Phase 6: GitHub sync)
+export * from './ticket-external-links'
+export * from './ticket-thread-external-links'
+export * from './integration-user-mappings'
+
+// Ticketing — integration sync log (Phase 6: observability)
+export * from './integration-sync-log'
diff --git a/packages/db/src/schema/integration-sync-log.ts b/packages/db/src/schema/integration-sync-log.ts
new file mode 100644
index 000000000..2d00b27f3
--- /dev/null
+++ b/packages/db/src/schema/integration-sync-log.ts
@@ -0,0 +1,72 @@
+import {
+  pgTable,
+  text,
+  timestamp,
+  varchar,
+  integer,
+  jsonb,
+  index,
+  uuid,
+  foreignKey,
+} from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
+import { typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { integrations } from './integrations'
+import { tickets } from './tickets'
+
+/**
+ * Append-only audit log for integration sync operations (outbound & inbound).
+ * One row per sync attempt. Tracks success, failure, timing, and error details.
+ *
+ * `direction` ∈ ('outbound', 'inbound')
+ * `status` ∈ ('success', 'failed', 'skipped')
+ *
+ * 30-day retention recommended.
+ */
+export const integrationSyncLog = pgTable(
+  'integration_sync_log',
+  {
+    id: uuid('id').primaryKey().defaultRandom(),
+    integrationId: typeIdColumn('integration')('integration_id').notNull(),
+    ticketId: typeIdColumnNullable('ticket')('ticket_id'),
+    externalId: text('external_id'),
+    eventType: text('event_type').notNull(),
+    direction: varchar('direction', { length: 20 }).notNull(),
+    status: varchar('status', { length: 20 }).notNull(),
+    errorMessage: text('error_message'),
+    durationMs: integer('duration_ms'),
+    metadata: jsonb('metadata'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (table) => [
+    foreignKey({
+      name: 'integration_sync_log_integration_id_fk',
+      columns: [table.integrationId],
+      foreignColumns: [integrations.id],
+    }).onDelete('cascade'),
+    foreignKey({
+      name: 'integration_sync_log_ticket_id_fk',
+      columns: [table.ticketId],
+      foreignColumns: [tickets.id],
+    }).onDelete('set null'),
+    index('integration_sync_log_integration_created_idx').on(table.integrationId, table.createdAt),
+    index('integration_sync_log_ticket_created_idx').on(table.ticketId, table.createdAt),
+    index('integration_sync_log_status_idx')
+      .on(table.status, table.createdAt)
+      .where(sql`status = 'failed'`),
+  ]
+)
+
+export const integrationSyncLogRelations = relations(integrationSyncLog, ({ one }) => ({
+  integration: one(integrations, {
+    fields: [integrationSyncLog.integrationId],
+    references: [integrations.id],
+  }),
+  ticket: one(tickets, {
+    fields: [integrationSyncLog.ticketId],
+    references: [tickets.id],
+  }),
+}))
+
+export type SyncLogStatus = 'success' | 'failed' | 'skipped'
+export type SyncLogDirection = 'outbound' | 'inbound'
diff --git a/packages/db/src/schema/integration-user-mappings.ts b/packages/db/src/schema/integration-user-mappings.ts
new file mode 100644
index 000000000..0570d3771
--- /dev/null
+++ b/packages/db/src/schema/integration-user-mappings.ts
@@ -0,0 +1,52 @@
+import { pgTable, text, timestamp, varchar, index, unique, foreignKey } from 'drizzle-orm/pg-core'
+import { relations } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { integrations } from './integrations'
+import { principal } from './auth'
+
+/**
+ * Maps external platform usernames to workspace principals.
+ * Used for bidirectional assignee sync (e.g. GitHub username → team member).
+ * Populated via collaborator list fetch or manual mapping in settings UI.
+ */
+export const integrationUserMappings = pgTable(
+  'integration_user_mappings',
+  {
+    id: typeIdWithDefault('user_mapping')('id').primaryKey(),
+    integrationId: typeIdColumn('integration')('integration_id').notNull(),
+    externalUsername: varchar('external_username', { length: 255 }).notNull(),
+    externalDisplayName: text('external_display_name'),
+    principalId: typeIdColumnNullable('principal')('principal_id'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (table) => [
+    foreignKey({
+      name: 'integration_user_mappings_integration_fk',
+      columns: [table.integrationId],
+      foreignColumns: [integrations.id],
+    }).onDelete('cascade'),
+    foreignKey({
+      name: 'integration_user_mappings_principal_fk',
+      columns: [table.principalId],
+      foreignColumns: [principal.id],
+    }).onDelete('set null'),
+    unique('integration_user_mappings_integration_username_unique').on(
+      table.integrationId,
+      table.externalUsername
+    ),
+    index('integration_user_mappings_principal_idx').on(table.principalId),
+  ]
+)
+
+// Relations
+export const integrationUserMappingsRelations = relations(integrationUserMappings, ({ one }) => ({
+  integration: one(integrations, {
+    fields: [integrationUserMappings.integrationId],
+    references: [integrations.id],
+  }),
+  principal: one(principal, {
+    fields: [integrationUserMappings.principalId],
+    references: [principal.id],
+  }),
+}))
diff --git a/packages/db/src/schema/integrations.ts b/packages/db/src/schema/integrations.ts
index c1defc1bc..9b0c366fc 100644
--- a/packages/db/src/schema/integrations.ts
+++ b/packages/db/src/schema/integrations.ts
@@ -16,6 +16,8 @@ import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackbac
 import { principal } from './auth'
 import { boards } from './boards'
 import { postExternalLinks } from './external-links'
+import { ticketExternalLinks } from './ticket-external-links'
+import { integrationUserMappings } from './integration-user-mappings'
 import type { IntegrationConfig, EventMappingActionConfig, EventMappingFilters } from '../types'
 
 /**
@@ -50,11 +52,16 @@ export const integrations = pgTable(
     lastErrorAt: timestamp('last_error_at', { withTimezone: true }),
     errorCount: integer('error_count').notNull().default(0),
 
+    /** User-friendly label for multi-instance integrations (e.g. repo name for GitHub) */
+    label: varchar('label', { length: 100 }),
+
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
     updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
   },
   (table) => [
-    unique('integration_type_unique').on(table.integrationType),
+    // NOTE: unique('integration_type_unique') was removed in migration 0057
+    // to allow multiple integrations per type (e.g. multiple GitHub repos).
+    // Replaced by a partial expression index in SQL: integration_type_channel_unique
     index('idx_integrations_type_status').on(table.integrationType, table.status),
     // CHECK constraint to ensure error count is never negative
     check('error_count_non_negative', sql`error_count >= 0`),
@@ -169,6 +176,8 @@ export const integrationsRelations = relations(integrations, ({ one, many }) =>
   }),
   eventMappings: many(integrationEventMappings),
   externalLinks: many(postExternalLinks),
+  ticketExternalLinks: many(ticketExternalLinks),
+  userMappings: many(integrationUserMappings),
   slackChannelMonitors: many(slackChannelMonitors),
 }))
 
diff --git a/packages/db/src/schema/kb.ts b/packages/db/src/schema/kb.ts
index 37b253c22..6364fb749 100644
--- a/packages/db/src/schema/kb.ts
+++ b/packages/db/src/schema/kb.ts
@@ -44,6 +44,9 @@ export const helpCenterCategories = pgTable(
     description: text('description'),
     icon: text('icon'),
     isPublic: boolean('is_public').default(true).notNull(),
+    visibility: text('visibility').$type<'public' | 'targeted'>().default('public').notNull(),
+    allowedSegmentIds: jsonb('allowed_segment_ids').$type<string[]>().notNull().default([]),
+    allowedPrincipalIds: jsonb('allowed_principal_ids').$type<string[]>().notNull().default([]),
     position: integer('position').default(0).notNull(),
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
     updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
diff --git a/packages/db/src/schema/notifications.ts b/packages/db/src/schema/notifications.ts
index 4062bb923..3b09bb232 100644
--- a/packages/db/src/schema/notifications.ts
+++ b/packages/db/src/schema/notifications.ts
@@ -11,6 +11,7 @@ import {
 import { relations, sql } from 'drizzle-orm'
 import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
 import { posts, comments } from './posts'
+import { tickets } from './tickets'
 import { principal } from './auth'
 
 /**
@@ -72,6 +73,13 @@ export const notificationPreferences = pgTable(
     emailStatusChange: boolean('email_status_change').default(true).notNull(),
     emailNewComment: boolean('email_new_comment').default(true).notNull(),
     emailMuted: boolean('email_muted').default(false).notNull(),
+    emailTicketThreads: boolean('email_ticket_threads').default(true).notNull(),
+    emailTicketProperties: boolean('email_ticket_properties').default(true).notNull(),
+    emailTicketStatus: boolean('email_ticket_status').default(true).notNull(),
+    emailTicketAssignment: boolean('email_ticket_assignment').default(true).notNull(),
+    emailTicketParticipants: boolean('email_ticket_participants').default(false).notNull(),
+    emailTicketShares: boolean('email_ticket_shares').default(false).notNull(),
+    emailTicketSla: boolean('email_ticket_sla').default(true).notNull(),
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
     updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
   },
@@ -155,6 +163,9 @@ export const inAppNotifications = pgTable(
     commentId: typeIdColumnNullable('comment')('comment_id').references(() => comments.id, {
       onDelete: 'cascade',
     }),
+    ticketId: typeIdColumnNullable('ticket')('ticket_id').references(() => tickets.id, {
+      onDelete: 'set null',
+    }),
     metadata: jsonb('metadata').$type<Record<string, unknown>>(),
     readAt: timestamp('read_at', { withTimezone: true }),
     archivedAt: timestamp('archived_at', { withTimezone: true }),
@@ -169,6 +180,8 @@ export const inAppNotifications = pgTable(
       .where(sql`read_at IS NULL AND archived_at IS NULL`),
     // Find notifications by related post
     index('in_app_notifications_post_idx').on(table.postId),
+    // Find notifications by related ticket
+    index('in_app_notifications_ticket_idx').on(table.ticketId, table.createdAt),
   ]
 )
 
@@ -185,4 +198,8 @@ export const inAppNotificationsRelations = relations(inAppNotifications, ({ one
     fields: [inAppNotifications.commentId],
     references: [comments.id],
   }),
+  ticket: one(tickets, {
+    fields: [inAppNotifications.ticketId],
+    references: [tickets.id],
+  }),
 }))
diff --git a/packages/db/src/schema/organizations.ts b/packages/db/src/schema/organizations.ts
new file mode 100644
index 000000000..3ff2e19f5
--- /dev/null
+++ b/packages/db/src/schema/organizations.ts
@@ -0,0 +1,156 @@
+/**
+ * Organizations & contacts schema — Phase 2 of the ticketing rollout.
+ *
+ *   - `organizations` represents a customer company (B2B context).
+ *   - `contacts` represents a human at that company (or an unaffiliated
+ *     individual). One contact belongs to at most one organization (FK).
+ *   - `contact_user_links` links a contact to one or more portal `user`
+ *     accounts (N:M) so an authenticated portal user can be recognised as
+ *     "the same person" as the email-based contact on a ticket.
+ *
+ * No tickets reference these tables yet; they are populated independently
+ * via the REST API and CRM-style admin UI, then consumed by Phase 3 ticket
+ * intake helpers (`findOrCreateByEmail`, `findOrCreateByDomain`).
+ */
+import { pgTable, text, timestamp, jsonb, index, uniqueIndex } from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { principal, user } from './auth'
+
+/**
+ * JSON value used by the `metadata` jsonb columns. Constrained (rather than
+ * `Record<string, unknown>`) so server functions returning `Organization` /
+ * `Contact` rows pass TanStack Start's serialisability check.
+ */
+export type OrgJsonValue =
+  | string
+  | number
+  | boolean
+  | null
+  | OrgJsonValue[]
+  | { [key: string]: OrgJsonValue }
+export type OrgMetadata = { [key: string]: OrgJsonValue }
+
+export const organizations = pgTable(
+  'organizations',
+  {
+    id: typeIdWithDefault('org')('id').primaryKey(),
+    name: text('name').notNull(),
+    /** Lowercased apex domain (e.g. "acme.com"). Partial-unique when not null. */
+    domain: text('domain'),
+    /** External CRM identifier (HubSpot/Salesforce/etc.). Partial-unique when not null. */
+    externalId: text('external_id'),
+    website: text('website'),
+    notes: text('notes'),
+    metadata: jsonb('metadata').$type<OrgMetadata>().notNull().default({}),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+  },
+  (t) => [
+    uniqueIndex('organizations_domain_idx')
+      .on(t.domain)
+      .where(sql`domain IS NOT NULL`),
+    uniqueIndex('organizations_external_id_idx')
+      .on(t.externalId)
+      .where(sql`external_id IS NOT NULL`),
+    index('organizations_name_idx').on(t.name),
+    index('organizations_archived_at_idx').on(t.archivedAt),
+  ]
+)
+
+export const contacts = pgTable(
+  'contacts',
+  {
+    id: typeIdWithDefault('contact')('id').primaryKey(),
+    name: text('name'),
+    /** Lowercased email. Partial-unique when not null AND not archived. */
+    email: text('email'),
+    phone: text('phone'),
+    title: text('title'),
+    externalId: text('external_id'),
+    organizationId: typeIdColumnNullable('org')('organization_id').references(
+      () => organizations.id,
+      { onDelete: 'set null' }
+    ),
+    avatarUrl: text('avatar_url'),
+    metadata: jsonb('metadata').$type<OrgMetadata>().notNull().default({}),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+  },
+  (t) => [
+    uniqueIndex('contacts_email_idx')
+      .on(t.email)
+      .where(sql`email IS NOT NULL AND archived_at IS NULL`),
+    uniqueIndex('contacts_external_id_idx')
+      .on(t.externalId)
+      .where(sql`external_id IS NOT NULL`),
+    index('contacts_organization_idx').on(t.organizationId),
+    index('contacts_archived_at_idx').on(t.archivedAt),
+  ]
+)
+
+/**
+ * contact_user_links — N:M between contacts and portal users.
+ *
+ * A portal user signing in with email "[email protected]" can be linked to the
+ * contact created earlier from an inbound ticket. Multiple portal accounts
+ * may map to the same contact (e.g. SSO migration); a single portal user may
+ * be associated with multiple contacts (rare, but allowed).
+ */
+export const contactUserLinks = pgTable(
+  'contact_user_links',
+  {
+    id: typeIdWithDefault('cu_link')('id').primaryKey(),
+    contactId: typeIdColumn('contact')('contact_id')
+      .notNull()
+      .references(() => contacts.id, { onDelete: 'cascade' }),
+    userId: typeIdColumn('user')('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    /** Principal who created the link (NULL = system / migration). */
+    linkedByPrincipalId: typeIdColumnNullable('principal')('linked_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    linkedAt: timestamp('linked_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    uniqueIndex('contact_user_links_contact_user_idx').on(t.contactId, t.userId),
+    index('contact_user_links_user_idx').on(t.userId),
+  ]
+)
+
+export const organizationsRelations = relations(organizations, ({ many }) => ({
+  contacts: many(contacts),
+}))
+
+export const contactsRelations = relations(contacts, ({ one, many }) => ({
+  organization: one(organizations, {
+    fields: [contacts.organizationId],
+    references: [organizations.id],
+  }),
+  userLinks: many(contactUserLinks),
+}))
+
+export const contactUserLinksRelations = relations(contactUserLinks, ({ one }) => ({
+  contact: one(contacts, {
+    fields: [contactUserLinks.contactId],
+    references: [contacts.id],
+  }),
+  user: one(user, {
+    fields: [contactUserLinks.userId],
+    references: [user.id],
+  }),
+  linkedByPrincipal: one(principal, {
+    fields: [contactUserLinks.linkedByPrincipalId],
+    references: [principal.id],
+  }),
+}))
diff --git a/packages/db/src/schema/roles.ts b/packages/db/src/schema/roles.ts
new file mode 100644
index 000000000..8d15f634c
--- /dev/null
+++ b/packages/db/src/schema/roles.ts
@@ -0,0 +1,118 @@
+/**
+ * RBAC schema — roles, permissions, role-permission grants, role assignments.
+ *
+ * This is the source of truth for "what can a principal do?". The legacy
+ * `principal.role` column (admin | member | user) is preserved as a denormalised
+ * cache and is kept in sync via the authz service. Existing call sites that
+ * use `requireAuth({ roles: ['admin'] })` keep working through a compatibility
+ * shim in `auth-helpers.ts`.
+ *
+ * Concepts:
+ *   - role: a named bundle (e.g. "supervisor", "agent", "collaborator").
+ *   - permission: a fine-grained verb (e.g. "ticket.reply_public").
+ *   - role_permissions: which permissions belong to a role.
+ *   - principal_role_assignments: which roles a principal holds, optionally
+ *     scoped to a team (NULL team_id = workspace-wide).
+ *
+ * `is_system` rows are seeded by migrations and cannot be deleted from the UI.
+ */
+import { pgTable, text, boolean, timestamp, index, uniqueIndex } from 'drizzle-orm/pg-core'
+import { sql } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { principal } from './auth'
+import { teams } from './teams'
+
+export const roles = pgTable(
+  'roles',
+  {
+    id: typeIdWithDefault('role')('id').primaryKey(),
+    /** Stable machine name; UI labels live in i18n locale files. */
+    key: text('key').notNull(),
+    name: text('name').notNull(),
+    description: text('description'),
+    /** Seeded by migrations; not deletable from the UI. */
+    isSystem: boolean('is_system').default(false).notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [uniqueIndex('roles_key_idx').on(t.key)]
+)
+
+export const permissions = pgTable(
+  'permissions',
+  {
+    id: typeIdWithDefault('perm')('id').primaryKey(),
+    /** Dotted machine name, e.g. "ticket.reply_public". */
+    key: text('key').notNull(),
+    /** Coarse grouping for UI (e.g. "ticket", "org", "admin"). */
+    category: text('category').notNull(),
+    description: text('description'),
+    isSystem: boolean('is_system').default(true).notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    uniqueIndex('permissions_key_idx').on(t.key),
+    index('permissions_category_idx').on(t.category),
+  ]
+)
+
+export const rolePermissions = pgTable(
+  'role_permissions',
+  {
+    id: typeIdWithDefault('role_perm')('id').primaryKey(),
+    roleId: typeIdColumn('role')('role_id')
+      .notNull()
+      .references(() => roles.id, { onDelete: 'cascade' }),
+    permissionId: typeIdColumn('perm')('permission_id')
+      .notNull()
+      .references(() => permissions.id, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    uniqueIndex('role_permissions_role_permission_idx').on(t.roleId, t.permissionId),
+    index('role_permissions_permission_idx').on(t.permissionId),
+  ]
+)
+
+/**
+ * principal_role_assignments — which roles a principal holds.
+ *
+ * `team_id` NULL = workspace-wide grant. Non-null = grant only applies to
+ * actions whose scope evaluator matches that team.
+ */
+export const principalRoleAssignments = pgTable(
+  'principal_role_assignments',
+  {
+    id: typeIdWithDefault('role_asgn')('id').primaryKey(),
+    principalId: typeIdColumn('principal')('principal_id')
+      .notNull()
+      .references(() => principal.id, { onDelete: 'cascade' }),
+    roleId: typeIdColumn('role')('role_id')
+      .notNull()
+      .references(() => roles.id, { onDelete: 'cascade' }),
+    /** NULL = workspace-wide grant. */
+    teamId: typeIdColumnNullable('team')('team_id').references(() => teams.id, {
+      onDelete: 'cascade',
+    }),
+    /** Principal that performed the grant; null = system / migration. */
+    grantedByPrincipalId: typeIdColumnNullable('principal')('granted_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    // Same role can't be granted twice for the same scope.
+    uniqueIndex('principal_role_assignments_principal_role_team_idx')
+      .on(t.principalId, t.roleId, t.teamId)
+      .where(sql`team_id IS NOT NULL`),
+    uniqueIndex('principal_role_assignments_principal_role_workspace_idx')
+      .on(t.principalId, t.roleId)
+      .where(sql`team_id IS NULL`),
+    index('principal_role_assignments_principal_idx').on(t.principalId),
+    index('principal_role_assignments_team_idx').on(t.teamId),
+  ]
+)
diff --git a/packages/db/src/schema/routing-rules.ts b/packages/db/src/schema/routing-rules.ts
new file mode 100644
index 000000000..c8e7ccfce
--- /dev/null
+++ b/packages/db/src/schema/routing-rules.ts
@@ -0,0 +1,57 @@
+/**
+ * Routing rules — Phase 4 of the ticketing rollout.
+ *
+ * A routing rule is a JSON-encoded predicate plus a list of actions, evaluated
+ * against incoming tickets at create time. Rules are first-match-wins ordered
+ * by `(priority asc, createdAt asc)`.
+ *
+ * The conditions/actions JSON shape is enforced at the application layer
+ * (`domains/inboxes/routing.types.ts` Zod schemas) — keeping them as opaque
+ * jsonb at the database layer lets us evolve the rule grammar without
+ * destructive migrations.
+ */
+import { pgTable, text, timestamp, jsonb, boolean, integer, index } from 'drizzle-orm/pg-core'
+import type { AuditJsonValue } from './audit-events'
+import { relations } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { inboxes } from './inboxes'
+
+export const routingRules = pgTable(
+  'routing_rules',
+  {
+    id: typeIdWithDefault('route_rule')('id').primaryKey(),
+    name: text('name').notNull(),
+    description: text('description'),
+    /** Lower priority value runs first. */
+    priority: integer('priority').notNull().default(100),
+    enabled: boolean('enabled').notNull().default(true),
+    /** `{ match: 'all' | 'any', conditions: RoutingCondition[] }` */
+    conditions: jsonb('conditions').$type<AuditJsonValue>().notNull(),
+    /** `RoutingAction[]` */
+    actions: jsonb('actions').$type<AuditJsonValue>().notNull(),
+    /** Optional inbox scope: when set, the rule is only evaluated for tickets
+     *  bound to this inbox. NULL = workspace-wide. */
+    inboxIdScope: typeIdColumnNullable('inbox')('inbox_id_scope').references(() => inboxes.id, {
+      onDelete: 'set null',
+    }),
+    lastMatchedAt: timestamp('last_matched_at', { withTimezone: true }),
+    matchCount: integer('match_count').notNull().default(0),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    index('routing_rules_priority_idx').on(t.priority),
+    index('routing_rules_inbox_scope_idx').on(t.inboxIdScope),
+    index('routing_rules_enabled_idx').on(t.enabled),
+  ]
+)
+
+export const routingRulesRelations = relations(routingRules, ({ one }) => ({
+  inboxScope: one(inboxes, {
+    fields: [routingRules.inboxIdScope],
+    references: [inboxes.id],
+  }),
+}))
diff --git a/packages/db/src/schema/segments.ts b/packages/db/src/schema/segments.ts
index 61fa7aa6b..86eb6ee2e 100644
--- a/packages/db/src/schema/segments.ts
+++ b/packages/db/src/schema/segments.ts
@@ -47,6 +47,11 @@ export type SegmentRuleAttribute =
   | 'last_active_days_ago'
   | 'signup_source'
   | 'principal_type'
+  | 'contact_title'
+  | 'contact_metadata_key'
+  | 'organization_domain'
+  | 'organization_external_id'
+  | 'organization_metadata_key'
 
 export interface SegmentCondition {
   attribute: SegmentRuleAttribute
@@ -191,8 +196,12 @@ export const userSegments = pgTable(
 // Relations
 // ============================================
 
-export const segmentsRelations = relations(segments, ({ many }) => ({
+export const segmentsRelations = relations(segments, ({ many, one }) => ({
   members: many(userSegments),
+  portalTabOverride: one(portalTabSegmentOverrides, {
+    fields: [segments.id],
+    references: [portalTabSegmentOverrides.segmentId],
+  }),
 }))
 
 export const userSegmentsRelations = relations(userSegments, ({ one }) => ({
@@ -205,3 +214,62 @@ export const userSegmentsRelations = relations(userSegments, ({ one }) => ({
     references: [principal.id],
   }),
 }))
+
+// ============================================
+// Portal Tab Configuration
+// ============================================
+
+/**
+ * Portal tab visibility structure.
+ * Each field represents whether that tab is visible to the user.
+ * Used for org-level defaults and segment-level overrides.
+ */
+export interface PortalTabConfig {
+  feedback?: boolean
+  roadmap?: boolean
+  changelog?: boolean
+  myTickets?: boolean
+  helpCenter?: boolean
+  support?: boolean
+}
+
+/**
+ * Segment-level portal tab visibility overrides.
+ *
+ * When set, these overrides take precedence over org-level defaults
+ * for users in this segment. If a user is in multiple segments with
+ * overrides, the union of enabled tabs is shown (any segment enabling
+ * a tab makes it visible).
+ */
+export const portalTabSegmentOverrides = pgTable(
+  'portal_tab_segment_overrides',
+  {
+    id: typeIdWithDefault('portal_tab_override')('id').primaryKey(),
+    segmentId: typeIdColumn('segment')('segment_id')
+      .notNull()
+      .references(() => segments.id, { onDelete: 'cascade' })
+      .unique(),
+    /**
+     * Override configuration (JSON)
+     * Structure: { feedback?, roadmap?, changelog?, myTickets?, helpCenter?, support? }
+     * Null/absent fields inherit from org-level defaults.
+     */
+    overrides: jsonb('overrides').$type<PortalTabConfig>().notNull().default({}),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (table) => [index('portal_tab_segment_overrides_segment_id_idx').on(table.segmentId)]
+)
+
+export const portalTabSegmentOverridesRelations = relations(
+  portalTabSegmentOverrides,
+  ({ one }) => ({
+    segment: one(segments, {
+      fields: [portalTabSegmentOverrides.segmentId],
+      references: [segments.id],
+    }),
+  })
+)
diff --git a/packages/db/src/schema/sla.ts b/packages/db/src/schema/sla.ts
new file mode 100644
index 000000000..82aa63d3f
--- /dev/null
+++ b/packages/db/src/schema/sla.ts
@@ -0,0 +1,395 @@
+/**
+ * SLA + escalations schema — Phase 5 of the ticketing rollout.
+ *
+ * Six tables in one module to keep relations tight:
+ *   - `business_hours`         IANA-tz weekly schedules + holidays
+ *   - `sla_policies`           workspace/team/inbox-scoped policy header
+ *   - `sla_targets`            per-policy {first_response, next_response, resolution} minutes
+ *   - `ticket_sla_clocks`      per-ticket clocks (running/paused/met/breached)
+ *   - `escalation_rules`       per-policy "fire N minutes before/after due"
+ *   - `sla_escalation_log`     audit row per escalation firing
+ *
+ * Note: `tickets.slaPolicyId` was reserved as text in Phase 3; the migration
+ * for this phase converts it to uuid + FK -> sla_policies(id) ON DELETE SET NULL.
+ */
+import {
+  pgTable,
+  text,
+  timestamp,
+  integer,
+  bigint,
+  jsonb,
+  boolean,
+  index,
+  uniqueIndex,
+  check,
+} from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { teams } from './teams'
+import { inboxes } from './inboxes'
+import { tickets, TICKET_PRIORITIES } from './tickets'
+import type { AuditJsonValue } from './audit-events'
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+export const SLA_TARGET_KINDS = ['first_response', 'next_response', 'resolution'] as const
+export type SlaTargetKind = (typeof SLA_TARGET_KINDS)[number]
+
+export const SLA_CLOCK_STATES = ['running', 'paused', 'met', 'breached', 'cancelled'] as const
+export type SlaClockState = (typeof SLA_CLOCK_STATES)[number]
+
+export const SLA_POLICY_SCOPES = ['workspace', 'team', 'inbox'] as const
+export type SlaPolicyScope = (typeof SLA_POLICY_SCOPES)[number]
+
+export const ESCALATION_RECIPIENT_TYPES = [
+  'assignee',
+  'team',
+  'principals',
+  'inbox_members',
+] as const
+export type EscalationRecipientType = (typeof ESCALATION_RECIPIENT_TYPES)[number]
+
+export const ESCALATION_CHANNELS = ['in_app', 'email', 'webhook'] as const
+export type EscalationChannel = (typeof ESCALATION_CHANNELS)[number]
+
+// ---------------------------------------------------------------------------
+// Business-hours JSON shapes
+// ---------------------------------------------------------------------------
+
+/**
+ * `{ start, end }` are 24h "HH:MM" strings (local to the calendar's timezone).
+ * Multiple ranges per day allow a lunch break (e.g. 09:00–12:00 + 13:00–17:00).
+ */
+export interface BusinessHoursRange {
+  start: string
+  end: string
+}
+
+export interface BusinessHoursWeek {
+  mon: BusinessHoursRange[]
+  tue: BusinessHoursRange[]
+  wed: BusinessHoursRange[]
+  thu: BusinessHoursRange[]
+  fri: BusinessHoursRange[]
+  sat: BusinessHoursRange[]
+  sun: BusinessHoursRange[]
+}
+
+export interface BusinessHoursHoliday {
+  /** ISO date `YYYY-MM-DD` interpreted in the calendar's timezone. */
+  date: string
+  label?: string
+}
+
+// ---------------------------------------------------------------------------
+// business_hours
+// ---------------------------------------------------------------------------
+
+export const businessHours = pgTable(
+  'business_hours',
+  {
+    id: typeIdWithDefault('bizhrs')('id').primaryKey(),
+    name: text('name').notNull(),
+    /** IANA timezone e.g. 'America/New_York'. Default 'UTC'. */
+    timezone: text('timezone').notNull().default('UTC'),
+    /** Per-weekday range arrays. `[]` for a day means closed. */
+    schedule: jsonb('schedule').$type<BusinessHoursWeek>().notNull(),
+    /** Holiday dates (closed all-day). */
+    holidays: jsonb('holidays').$type<BusinessHoursHoliday[]>().notNull().default([]),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    index('business_hours_archived_at_idx').on(t.archivedAt),
+    uniqueIndex('business_hours_active_name_idx')
+      .on(sql`lower(${t.name})`)
+      .where(sql`archived_at IS NULL`),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// sla_policies
+// ---------------------------------------------------------------------------
+
+export const slaPolicies = pgTable(
+  'sla_policies',
+  {
+    id: typeIdWithDefault('sla_pol')('id').primaryKey(),
+    name: text('name').notNull(),
+    description: text('description'),
+    /** Lower priority value runs first when multiple match. */
+    priority: integer('priority').notNull().default(100),
+    enabled: boolean('enabled').notNull().default(true),
+    scope: text('scope', { enum: SLA_POLICY_SCOPES }).notNull(),
+    scopeTeamId: typeIdColumnNullable('team')('scope_team_id').references(() => teams.id, {
+      onDelete: 'set null',
+    }),
+    scopeInboxId: typeIdColumnNullable('inbox')('scope_inbox_id').references(() => inboxes.id, {
+      onDelete: 'set null',
+    }),
+    /** Empty array = applies to any priority. */
+    appliesToPriorities: text('applies_to_priorities', { enum: TICKET_PRIORITIES })
+      .array()
+      .notNull()
+      .default(sql`'{}'::text[]`),
+    /** NULL = 24/7 (no business-hours math). */
+    businessHoursId: typeIdColumnNullable('bizhrs')('business_hours_id').references(
+      () => businessHours.id,
+      { onDelete: 'set null' }
+    ),
+    pauseOnPending: boolean('pause_on_pending').notNull().default(true),
+    pauseOnOnHold: boolean('pause_on_on_hold').notNull().default(true),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    index('sla_policies_enabled_priority_idx').on(t.enabled, t.priority),
+    index('sla_policies_scope_team_idx').on(t.scopeTeamId),
+    index('sla_policies_scope_inbox_idx').on(t.scopeInboxId),
+    index('sla_policies_archived_at_idx').on(t.archivedAt),
+    check(
+      'sla_policies_scope_team_required',
+      sql`(scope <> 'team') OR (scope_team_id IS NOT NULL)`
+    ),
+    check(
+      'sla_policies_scope_inbox_required',
+      sql`(scope <> 'inbox') OR (scope_inbox_id IS NOT NULL)`
+    ),
+    check(
+      'sla_policies_workspace_no_scope',
+      sql`(scope <> 'workspace') OR (scope_team_id IS NULL AND scope_inbox_id IS NULL)`
+    ),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// sla_targets
+// ---------------------------------------------------------------------------
+
+export const slaTargets = pgTable(
+  'sla_targets',
+  {
+    id: typeIdWithDefault('sla_tgt')('id').primaryKey(),
+    policyId: typeIdColumn('sla_pol')('policy_id')
+      .notNull()
+      .references(() => slaPolicies.id, { onDelete: 'cascade' }),
+    kind: text('kind', { enum: SLA_TARGET_KINDS }).notNull(),
+    minutes: integer('minutes').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    uniqueIndex('sla_targets_policy_kind_idx').on(t.policyId, t.kind),
+    index('sla_targets_policy_idx').on(t.policyId),
+    check('sla_targets_minutes_positive', sql`minutes > 0`),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// ticket_sla_clocks
+// ---------------------------------------------------------------------------
+
+export const ticketSlaClocks = pgTable(
+  'ticket_sla_clocks',
+  {
+    id: typeIdWithDefault('sla_clk')('id').primaryKey(),
+    ticketId: typeIdColumn('ticket')('ticket_id')
+      .notNull()
+      .references(() => tickets.id, { onDelete: 'cascade' }),
+    policyId: typeIdColumnNullable('sla_pol')('policy_id').references(() => slaPolicies.id, {
+      onDelete: 'set null',
+    }),
+    targetId: typeIdColumnNullable('sla_tgt')('target_id').references(() => slaTargets.id, {
+      onDelete: 'set null',
+    }),
+    kind: text('kind', { enum: SLA_TARGET_KINDS }).notNull(),
+    state: text('state', { enum: SLA_CLOCK_STATES }).notNull().default('running'),
+    /** Original target duration captured at clock-creation time. */
+    targetMinutes: integer('target_minutes').notNull(),
+    startedAt: timestamp('started_at', { withTimezone: true }).notNull(),
+    dueAt: timestamp('due_at', { withTimezone: true }).notNull(),
+    pausedAt: timestamp('paused_at', { withTimezone: true }),
+    /** Cumulative ms spent paused across all pause/resume cycles. */
+    accumulatedPausedMs: bigint('accumulated_paused_ms', { mode: 'number' }).notNull().default(0),
+    breachedAt: timestamp('breached_at', { withTimezone: true }),
+    metAt: timestamp('met_at', { withTimezone: true }),
+    /** Anti-spam anchor for escalations. */
+    lastEscalatedAt: timestamp('last_escalated_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    index('ticket_sla_clocks_ticket_idx').on(t.ticketId),
+    index('ticket_sla_clocks_policy_idx').on(t.policyId),
+    index('ticket_sla_clocks_state_due_idx').on(t.state, t.dueAt),
+    uniqueIndex('ticket_sla_clocks_active_kind_idx')
+      .on(t.ticketId, t.kind)
+      .where(sql`state IN ('running', 'paused')`),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// escalation_rules
+// ---------------------------------------------------------------------------
+
+export const escalationRules = pgTable(
+  'escalation_rules',
+  {
+    id: typeIdWithDefault('esc_rule')('id').primaryKey(),
+    policyId: typeIdColumn('sla_pol')('policy_id')
+      .notNull()
+      .references(() => slaPolicies.id, { onDelete: 'cascade' }),
+    name: text('name').notNull(),
+    /** Positive = N minutes before due; 0 = at-breach; negative = after-breach reminder. */
+    leadMinutes: integer('lead_minutes').notNull(),
+    targetKind: text('target_kind', { enum: SLA_TARGET_KINDS }).notNull(),
+    recipientType: text('recipient_type', { enum: ESCALATION_RECIPIENT_TYPES }).notNull(),
+    recipientTeamId: typeIdColumnNullable('team')('recipient_team_id').references(() => teams.id, {
+      onDelete: 'set null',
+    }),
+    /** Stable principal IDs (text array; we don't FK into principal here). */
+    recipientPrincipalIds: text('recipient_principal_ids')
+      .array()
+      .notNull()
+      .default(sql`'{}'::text[]`),
+    channels: text('channels', { enum: ESCALATION_CHANNELS })
+      .array()
+      .notNull()
+      .default(sql`'{in_app}'::text[]`),
+    enabled: boolean('enabled').notNull().default(true),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    index('escalation_rules_policy_lead_idx').on(t.policyId, t.leadMinutes),
+    index('escalation_rules_enabled_kind_idx').on(t.enabled, t.targetKind),
+    check(
+      'escalation_rules_team_required',
+      sql`(recipient_type <> 'team') OR (recipient_team_id IS NOT NULL)`
+    ),
+    check(
+      'escalation_rules_principals_required',
+      sql`(recipient_type <> 'principals') OR (array_length(recipient_principal_ids, 1) >= 1)`
+    ),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// sla_escalation_log
+// ---------------------------------------------------------------------------
+
+export const slaEscalationLog = pgTable(
+  'sla_escalation_log',
+  {
+    id: typeIdWithDefault('esc_log')('id').primaryKey(),
+    clockId: typeIdColumn('sla_clk')('clock_id')
+      .notNull()
+      .references(() => ticketSlaClocks.id, { onDelete: 'cascade' }),
+    ruleId: typeIdColumnNullable('esc_rule')('rule_id').references(() => escalationRules.id, {
+      onDelete: 'set null',
+    }),
+    firedAt: timestamp('fired_at', { withTimezone: true }).defaultNow().notNull(),
+    recipientPrincipalIds: text('recipient_principal_ids')
+      .array()
+      .notNull()
+      .default(sql`'{}'::text[]`),
+    channels: text('channels', { enum: ESCALATION_CHANNELS })
+      .array()
+      .notNull()
+      .default(sql`'{}'::text[]`),
+    context: jsonb('context').$type<{ [k: string]: AuditJsonValue }>(),
+  },
+  (t) => [
+    index('sla_escalation_log_clock_fired_idx').on(t.clockId, t.firedAt),
+    index('sla_escalation_log_rule_idx').on(t.ruleId),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// Relations
+// ---------------------------------------------------------------------------
+
+export const businessHoursRelations = relations(businessHours, ({ many }) => ({
+  policies: many(slaPolicies),
+}))
+
+export const slaPoliciesRelations = relations(slaPolicies, ({ one, many }) => ({
+  scopeTeam: one(teams, {
+    fields: [slaPolicies.scopeTeamId],
+    references: [teams.id],
+  }),
+  scopeInbox: one(inboxes, {
+    fields: [slaPolicies.scopeInboxId],
+    references: [inboxes.id],
+  }),
+  businessHours: one(businessHours, {
+    fields: [slaPolicies.businessHoursId],
+    references: [businessHours.id],
+  }),
+  targets: many(slaTargets),
+  escalationRules: many(escalationRules),
+  clocks: many(ticketSlaClocks),
+}))
+
+export const slaTargetsRelations = relations(slaTargets, ({ one, many }) => ({
+  policy: one(slaPolicies, {
+    fields: [slaTargets.policyId],
+    references: [slaPolicies.id],
+  }),
+  clocks: many(ticketSlaClocks),
+}))
+
+export const ticketSlaClocksRelations = relations(ticketSlaClocks, ({ one, many }) => ({
+  ticket: one(tickets, {
+    fields: [ticketSlaClocks.ticketId],
+    references: [tickets.id],
+  }),
+  policy: one(slaPolicies, {
+    fields: [ticketSlaClocks.policyId],
+    references: [slaPolicies.id],
+  }),
+  target: one(slaTargets, {
+    fields: [ticketSlaClocks.targetId],
+    references: [slaTargets.id],
+  }),
+  escalationLogs: many(slaEscalationLog),
+}))
+
+export const escalationRulesRelations = relations(escalationRules, ({ one, many }) => ({
+  policy: one(slaPolicies, {
+    fields: [escalationRules.policyId],
+    references: [slaPolicies.id],
+  }),
+  recipientTeam: one(teams, {
+    fields: [escalationRules.recipientTeamId],
+    references: [teams.id],
+  }),
+  logs: many(slaEscalationLog),
+}))
+
+export const slaEscalationLogRelations = relations(slaEscalationLog, ({ one }) => ({
+  clock: one(ticketSlaClocks, {
+    fields: [slaEscalationLog.clockId],
+    references: [ticketSlaClocks.id],
+  }),
+  rule: one(escalationRules, {
+    fields: [slaEscalationLog.ruleId],
+    references: [escalationRules.id],
+  }),
+}))
diff --git a/packages/db/src/schema/teams.ts b/packages/db/src/schema/teams.ts
new file mode 100644
index 000000000..d2d0685e5
--- /dev/null
+++ b/packages/db/src/schema/teams.ts
@@ -0,0 +1,80 @@
+/**
+ * Teams schema — first-class grouping for principals.
+ *
+ * Teams are used by the ticketing module to:
+ *   - own queues and shared inboxes,
+ *   - scope ticket visibility (`team`, `shared`),
+ *   - group permission grants (a user can be assigned a role *within* a team).
+ *
+ * A principal may belong to multiple teams; one of those memberships may be
+ * marked `lead` to denote supervisor-style permissions.
+ */
+import { pgTable, text, timestamp, index, uniqueIndex } from 'drizzle-orm/pg-core'
+import { relations } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn } from '@quackback/ids/drizzle'
+import { principal } from './auth'
+
+export const teams = pgTable(
+  'teams',
+  {
+    id: typeIdWithDefault('team')('id').primaryKey(),
+    /** Stable URL-friendly identifier (lowercase, kebab). */
+    slug: text('slug').notNull(),
+    name: text('name').notNull(),
+    description: text('description'),
+    /** Optional short label used as a coloured chip in the UI (e.g. "T1", "BIL"). */
+    shortLabel: text('short_label'),
+    /** Hex colour for UI chips. Optional; UI falls back to a hash of the id. */
+    color: text('color'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+  },
+  (t) => [uniqueIndex('teams_slug_idx').on(t.slug), index('teams_archived_at_idx').on(t.archivedAt)]
+)
+
+/**
+ * team_memberships — N:M between principals and teams.
+ *
+ * `role` is the *team-local* role (`lead` | `member`) and is independent from
+ * the global RBAC `roles` table. Use the role-assignments table for permission
+ * grants scoped to a team.
+ */
+export const teamMemberships = pgTable(
+  'team_memberships',
+  {
+    id: typeIdWithDefault('team_member')('id').primaryKey(),
+    teamId: typeIdColumn('team')('team_id')
+      .notNull()
+      .references(() => teams.id, { onDelete: 'cascade' }),
+    principalId: typeIdColumn('principal')('principal_id')
+      .notNull()
+      .references(() => principal.id, { onDelete: 'cascade' }),
+    role: text('role', { enum: ['lead', 'member'] })
+      .default('member')
+      .notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    uniqueIndex('team_memberships_team_principal_idx').on(t.teamId, t.principalId),
+    index('team_memberships_principal_idx').on(t.principalId),
+  ]
+)
+
+export const teamsRelations = relations(teams, ({ many }) => ({
+  memberships: many(teamMemberships),
+}))
+
+export const teamMembershipsRelations = relations(teamMemberships, ({ one }) => ({
+  team: one(teams, {
+    fields: [teamMemberships.teamId],
+    references: [teams.id],
+  }),
+  principal: one(principal, {
+    fields: [teamMemberships.principalId],
+    references: [principal.id],
+  }),
+}))
diff --git a/packages/db/src/schema/ticket-external-links.ts b/packages/db/src/schema/ticket-external-links.ts
new file mode 100644
index 000000000..a77102efe
--- /dev/null
+++ b/packages/db/src/schema/ticket-external-links.ts
@@ -0,0 +1,65 @@
+import { pgTable, text, timestamp, varchar, index, unique, foreignKey } from 'drizzle-orm/pg-core'
+import { relations } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { tickets } from './tickets'
+import { integrations } from './integrations'
+
+/**
+ * External links between tickets and external platform issues.
+ * Created when an outbound hook creates an issue in an external tracker,
+ * or when an inbound webhook creates a ticket from an external issue.
+ * Used for reverse lookups during bidirectional sync.
+ */
+export const ticketExternalLinks = pgTable(
+  'ticket_external_links',
+  {
+    id: typeIdWithDefault('linked_entity')('id').primaryKey(),
+    ticketId: typeIdColumn('ticket')('ticket_id').notNull(),
+    // Nullable: manually-created links don't require a full integration record
+    integrationId: typeIdColumnNullable('integration')('integration_id'),
+    integrationType: varchar('integration_type', { length: 50 }).notNull(),
+    externalId: text('external_id').notNull(),
+    /** Human-friendly display label (e.g. "#142"). Falls back to externalId when null. */
+    externalDisplayId: text('external_display_id'),
+    externalUrl: text('external_url'),
+    status: varchar('status', { length: 20 }).notNull().default('active'),
+    /** Direction this link was created from: outbound (ticket→issue), inbound (issue→ticket), bidirectional */
+    syncDirection: varchar('sync_direction', { length: 20 }).notNull().default('outbound'),
+    /** Last time this link's data was verified/synced with the external system */
+    lastSyncedAt: timestamp('last_synced_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (table) => [
+    foreignKey({
+      name: 'ticket_external_links_ticket_fk',
+      columns: [table.ticketId],
+      foreignColumns: [tickets.id],
+    }).onDelete('cascade'),
+    foreignKey({
+      name: 'ticket_external_links_integration_fk',
+      columns: [table.integrationId],
+      foreignColumns: [integrations.id],
+    }).onDelete('cascade'),
+    // One external issue can link to one ticket per type (unique per type+externalId+ticketId)
+    unique('ticket_external_links_type_external_ticket_unique').on(
+      table.integrationType,
+      table.externalId,
+      table.ticketId
+    ),
+    index('ticket_external_links_ticket_id_idx').on(table.ticketId),
+    index('ticket_external_links_type_external_id_idx').on(table.integrationType, table.externalId),
+    index('ticket_external_links_ticket_status_idx').on(table.ticketId, table.status),
+  ]
+)
+
+// Relations
+export const ticketExternalLinksRelations = relations(ticketExternalLinks, ({ one }) => ({
+  ticket: one(tickets, {
+    fields: [ticketExternalLinks.ticketId],
+    references: [tickets.id],
+  }),
+  integration: one(integrations, {
+    fields: [ticketExternalLinks.integrationId],
+    references: [integrations.id],
+  }),
+}))
diff --git a/packages/db/src/schema/ticket-statuses.ts b/packages/db/src/schema/ticket-statuses.ts
new file mode 100644
index 000000000..05e1acb9e
--- /dev/null
+++ b/packages/db/src/schema/ticket-statuses.ts
@@ -0,0 +1,99 @@
+/**
+ * Ticket statuses — workflow states for the ticketing module.
+ *
+ * Intentionally separate from `post_statuses` (feedback workflow) so the two
+ * pipelines can evolve independently and a status configuration change in
+ * one product never accidentally surfaces tickets on the public roadmap.
+ *
+ * Categories
+ *   - `open`     active queue items awaiting agent action
+ *   - `pending`  waiting on the customer (pauses SLA in Phase 5)
+ *   - `on_hold`  waiting on a third party / engineering (pauses SLA)
+ *   - `solved`   agent considers the issue resolved (resolution timer stops)
+ *   - `closed`   no further activity expected
+ */
+import { pgTable, text, timestamp, integer, boolean, index } from 'drizzle-orm/pg-core'
+import { typeIdWithDefault } from '@quackback/ids/drizzle'
+
+export const TICKET_STATUS_CATEGORIES = ['open', 'pending', 'on_hold', 'solved', 'closed'] as const
+export type TicketStatusCategory = (typeof TICKET_STATUS_CATEGORIES)[number]
+
+export const ticketStatuses = pgTable(
+  'ticket_statuses',
+  {
+    id: typeIdWithDefault('ticket_status')('id').primaryKey(),
+    name: text('name').notNull(),
+    slug: text('slug').notNull().unique(),
+    color: text('color').notNull().default('#6b7280'),
+    category: text('category', { enum: TICKET_STATUS_CATEGORIES }).notNull().default('open'),
+    position: integer('position').notNull().default(0),
+    isDefault: boolean('is_default').notNull().default(false),
+    isSystem: boolean('is_system').notNull().default(false),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+  },
+  (t) => [
+    index('ticket_statuses_position_idx').on(t.category, t.position),
+    index('ticket_statuses_deleted_at_idx').on(t.deletedAt),
+  ]
+)
+
+/**
+ * Default statuses seeded by migration 0050. Mirrors `DEFAULT_STATUSES` for
+ * posts but uses ticket-appropriate categories.
+ */
+export const DEFAULT_TICKET_STATUSES: Array<{
+  name: string
+  slug: string
+  color: string
+  category: TicketStatusCategory
+  position: number
+  isDefault: boolean
+  isSystem: boolean
+}> = [
+  {
+    name: 'Open',
+    slug: 'open',
+    color: '#3b82f6',
+    category: 'open',
+    position: 0,
+    isDefault: true,
+    isSystem: true,
+  },
+  {
+    name: 'Pending',
+    slug: 'pending',
+    color: '#eab308',
+    category: 'pending',
+    position: 1,
+    isDefault: false,
+    isSystem: true,
+  },
+  {
+    name: 'On hold',
+    slug: 'on_hold',
+    color: '#a855f7',
+    category: 'on_hold',
+    position: 2,
+    isDefault: false,
+    isSystem: true,
+  },
+  {
+    name: 'Solved',
+    slug: 'solved',
+    color: '#22c55e',
+    category: 'solved',
+    position: 3,
+    isDefault: false,
+    isSystem: true,
+  },
+  {
+    name: 'Closed',
+    slug: 'closed',
+    color: '#6b7280',
+    category: 'closed',
+    position: 4,
+    isDefault: false,
+    isSystem: true,
+  },
+]
diff --git a/packages/db/src/schema/ticket-subscriptions.ts b/packages/db/src/schema/ticket-subscriptions.ts
new file mode 100644
index 000000000..ed8088cb6
--- /dev/null
+++ b/packages/db/src/schema/ticket-subscriptions.ts
@@ -0,0 +1,73 @@
+import { pgTable, text, timestamp, boolean, index, uniqueIndex } from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn } from '@quackback/ids/drizzle'
+import { tickets } from './tickets'
+import { principal } from './auth'
+
+/**
+ * Per-(ticket, principal) subscription rows.
+ *
+ * Mirrors `post_subscriptions` but adds richer flags appropriate for the
+ * ticketing domain (assignment changes, status, participant/share churn,
+ * SLA events, …) and a `mutedUntil` window for temporary suppression.
+ *
+ * `source` differentiates manual subscribes from auto-created ones so the
+ * service layer can refuse to overwrite manual preferences with auto values.
+ */
+export const ticketSubscriptions = pgTable(
+  'ticket_subscriptions',
+  {
+    id: typeIdWithDefault('tkt_sub')('id').primaryKey(),
+    ticketId: typeIdColumn('ticket')('ticket_id')
+      .notNull()
+      .references(() => tickets.id, { onDelete: 'cascade' }),
+    principalId: typeIdColumn('principal')('principal_id')
+      .notNull()
+      .references(() => principal.id, { onDelete: 'cascade' }),
+    notifyThreads: boolean('notify_threads').default(true).notNull(),
+    notifyProperties: boolean('notify_properties').default(true).notNull(),
+    notifyStatus: boolean('notify_status').default(true).notNull(),
+    notifyAssignment: boolean('notify_assignment').default(true).notNull(),
+    notifyParticipants: boolean('notify_participants').default(false).notNull(),
+    notifyShares: boolean('notify_shares').default(false).notNull(),
+    notifySla: boolean('notify_sla').default(true).notNull(),
+    mutedUntil: timestamp('muted_until', { withTimezone: true }),
+    // CHECK ∈ ('auto_assigned','auto_participant','auto_team_member','manual')
+    source: text('source').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (table) => [
+    uniqueIndex('ticket_subscriptions_unique').on(table.ticketId, table.principalId),
+    index('ticket_subscriptions_principal_idx').on(table.principalId, table.ticketId),
+    index('ticket_subscriptions_ticket_threads_idx')
+      .on(table.ticketId)
+      .where(sql`notify_threads = true`),
+    index('ticket_subscriptions_ticket_status_idx')
+      .on(table.ticketId)
+      .where(sql`notify_status = true`),
+    index('ticket_subscriptions_ticket_assignment_idx')
+      .on(table.ticketId)
+      .where(sql`notify_assignment = true`),
+    index('ticket_subscriptions_ticket_sla_idx')
+      .on(table.ticketId)
+      .where(sql`notify_sla = true`),
+  ]
+)
+
+export const ticketSubscriptionsRelations = relations(ticketSubscriptions, ({ one }) => ({
+  ticket: one(tickets, {
+    fields: [ticketSubscriptions.ticketId],
+    references: [tickets.id],
+  }),
+  principal: one(principal, {
+    fields: [ticketSubscriptions.principalId],
+    references: [principal.id],
+  }),
+}))
+
+export type TicketSubscriptionSource =
+  | 'auto_assigned'
+  | 'auto_participant'
+  | 'auto_team_member'
+  | 'manual'
diff --git a/packages/db/src/schema/ticket-thread-external-links.ts b/packages/db/src/schema/ticket-thread-external-links.ts
new file mode 100644
index 000000000..367e63188
--- /dev/null
+++ b/packages/db/src/schema/ticket-thread-external-links.ts
@@ -0,0 +1,77 @@
+import { pgTable, text, timestamp, varchar, index, unique, foreignKey } from 'drizzle-orm/pg-core'
+import { relations } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn } from '@quackback/ids/drizzle'
+import { tickets, ticketThreads } from './tickets'
+import { integrations } from './integrations'
+
+/**
+ * External links between ticket threads and external platform comments.
+ * Used for bidirectional comment sync and webhook retry idempotency.
+ */
+export const ticketThreadExternalLinks = pgTable(
+  'ticket_thread_external_links',
+  {
+    id: typeIdWithDefault('linked_entity')('id').primaryKey(),
+    ticketId: typeIdColumn('ticket')('ticket_id').notNull(),
+    threadId: typeIdColumn('ticket_thread')('thread_id').notNull(),
+    integrationId: typeIdColumn('integration')('integration_id').notNull(),
+    integrationType: varchar('integration_type', { length: 50 }).notNull(),
+    externalIssueId: text('external_issue_id').notNull(),
+    externalCommentId: text('external_comment_id').notNull(),
+    externalUrl: text('external_url'),
+    status: varchar('status', { length: 20 }).notNull().default('active'),
+    syncDirection: varchar('sync_direction', { length: 20 }).notNull().default('outbound'),
+    lastSyncedAt: timestamp('last_synced_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (table) => [
+    foreignKey({
+      name: 'ticket_thread_external_links_ticket_fk',
+      columns: [table.ticketId],
+      foreignColumns: [tickets.id],
+    }).onDelete('cascade'),
+    foreignKey({
+      name: 'ticket_thread_external_links_thread_fk',
+      columns: [table.threadId],
+      foreignColumns: [ticketThreads.id],
+    }).onDelete('cascade'),
+    foreignKey({
+      name: 'ticket_thread_external_links_integration_fk',
+      columns: [table.integrationId],
+      foreignColumns: [integrations.id],
+    }).onDelete('cascade'),
+    unique('ticket_thread_external_links_integration_comment_unique').on(
+      table.integrationId,
+      table.externalCommentId
+    ),
+    unique('ticket_thread_external_links_integration_thread_unique').on(
+      table.integrationId,
+      table.threadId
+    ),
+    index('ticket_thread_external_links_ticket_idx').on(table.ticketId),
+    index('ticket_thread_external_links_issue_idx').on(table.integrationId, table.externalIssueId),
+    index('ticket_thread_external_links_thread_status_idx').on(table.threadId, table.status),
+  ]
+)
+
+export const ticketThreadExternalLinksRelations = relations(
+  ticketThreadExternalLinks,
+  ({ one }) => ({
+    ticket: one(tickets, {
+      fields: [ticketThreadExternalLinks.ticketId],
+      references: [tickets.id],
+    }),
+    thread: one(ticketThreads, {
+      fields: [ticketThreadExternalLinks.threadId],
+      references: [ticketThreads.id],
+    }),
+    integration: one(integrations, {
+      fields: [ticketThreadExternalLinks.integrationId],
+      references: [integrations.id],
+    }),
+  })
+)
diff --git a/packages/db/src/schema/tickets.ts b/packages/db/src/schema/tickets.ts
new file mode 100644
index 000000000..eb9812465
--- /dev/null
+++ b/packages/db/src/schema/tickets.ts
@@ -0,0 +1,417 @@
+/**
+ * Ticket core schema — Phase 3 of the ticketing rollout.
+ *
+ * Six tables in one module to keep the relations import graph tight:
+ *   - `tickets`              header / state / assignment / visibility
+ *   - `ticket_threads`       messages on a ticket (public/internal/shared)
+ *   - `ticket_attachments`   metadata for files attached to a thread
+ *   - `ticket_participants`  watchers / collaborators / cc'd contacts
+ *   - `ticket_shares`        cross-team share grants with access level
+ *   - `ticket_activity`      per-ticket timeline (mirror of post_activity)
+ *
+ * `inboxId` and `slaPolicyId` are reserved as nullable text columns now to
+ * avoid a destructive ALTER later when Phases 4 (inboxes) and 5 (SLA) add
+ * the foreign keys.
+ *
+ * Search vector + embedding columns are intentionally deferred to Phase 7
+ * to avoid having to backfill them twice.
+ */
+import {
+  pgTable,
+  text,
+  timestamp,
+  integer,
+  jsonb,
+  index,
+  uniqueIndex,
+  check,
+} from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn, typeIdColumnNullable } from '@quackback/ids/drizzle'
+import { principal } from './auth'
+import { teams } from './teams'
+import { contacts, organizations } from './organizations'
+import { ticketStatuses } from './ticket-statuses'
+import { widgetEnvironmentProfiles } from './widget-profiles'
+import type { TiptapContent } from '../types'
+
+export const TICKET_PRIORITIES = ['low', 'normal', 'high', 'urgent'] as const
+export type TicketPriority = (typeof TICKET_PRIORITIES)[number]
+
+export const TICKET_CHANNELS = ['portal', 'email', 'api', 'widget'] as const
+export type TicketChannel = (typeof TICKET_CHANNELS)[number]
+
+export const TICKET_VISIBILITY_SCOPES = ['team', 'org', 'shared', 'private'] as const
+export type TicketVisibilityScope = (typeof TICKET_VISIBILITY_SCOPES)[number]
+
+export const TICKET_THREAD_AUDIENCES = ['public', 'internal', 'shared_team'] as const
+export type TicketThreadAudience = (typeof TICKET_THREAD_AUDIENCES)[number]
+
+export const TICKET_PARTICIPANT_ROLES = ['watcher', 'collaborator', 'cc'] as const
+export type TicketParticipantRole = (typeof TICKET_PARTICIPANT_ROLES)[number]
+
+export const TICKET_SHARE_LEVELS = ['read', 'comment', 'full'] as const
+export type TicketShareLevel = (typeof TICKET_SHARE_LEVELS)[number]
+
+// ---------------------------------------------------------------------------
+// tickets
+// ---------------------------------------------------------------------------
+
+export const tickets = pgTable(
+  'tickets',
+  {
+    id: typeIdWithDefault('ticket')('id').primaryKey(),
+    subject: text('subject').notNull(),
+    /** Rich-text body of the original request (TipTap JSON). */
+    descriptionJson: jsonb('description_json').$type<TiptapContent>(),
+    /** Plain-text mirror of the rich body for search and previews. */
+    descriptionText: text('description_text'),
+    priority: text('priority', { enum: TICKET_PRIORITIES }).notNull().default('normal'),
+    channel: text('channel', { enum: TICKET_CHANNELS }).notNull().default('api'),
+    sourceWidgetProfileId: typeIdColumnNullable('widget_profile')(
+      'source_widget_profile_id'
+    ).references(() => widgetEnvironmentProfiles.id, { onDelete: 'set null' }),
+    visibilityScope: text('visibility_scope', { enum: TICKET_VISIBILITY_SCOPES })
+      .notNull()
+      .default('team'),
+    statusId: typeIdColumnNullable('ticket_status')('status_id').references(
+      () => ticketStatuses.id,
+      { onDelete: 'set null' }
+    ),
+    /** Authenticated portal user who filed the ticket (null for unauthenticated/api intake). */
+    requesterPrincipalId: typeIdColumnNullable('principal')('requester_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    /** CRM contact representing the customer (preferred identifier for B2B context). */
+    requesterContactId: typeIdColumnNullable('contact')('requester_contact_id').references(
+      () => contacts.id,
+      { onDelete: 'set null' }
+    ),
+    organizationId: typeIdColumnNullable('org')('organization_id').references(
+      () => organizations.id,
+      { onDelete: 'set null' }
+    ),
+    /** Currently-assigned individual agent (nullable when only a team owns it). */
+    assigneePrincipalId: typeIdColumnNullable('principal')('assignee_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    assigneeTeamId: typeIdColumnNullable('team')('assignee_team_id').references(() => teams.id, {
+      onDelete: 'set null',
+    }),
+    /** Team that owns this ticket's queue (used for `view_team` scope). */
+    primaryTeamId: typeIdColumnNullable('team')('primary_team_id').references(() => teams.id, {
+      onDelete: 'set null',
+    }),
+    /** Inbox the ticket belongs to (Phase 4). FK is added by migration 0051. */
+    inboxId: typeIdColumnNullable('inbox')('inbox_id'),
+    /** SLA policy bound at creation time (Phase 5). FK added by migration 0052. */
+    slaPolicyId: typeIdColumnNullable('sla_pol')('sla_policy_id'),
+    /** Lifecycle timestamps. */
+    firstResponseAt: timestamp('first_response_at', { withTimezone: true }),
+    resolvedAt: timestamp('resolved_at', { withTimezone: true }),
+    reopenedAt: timestamp('reopened_at', { withTimezone: true }),
+    closedAt: timestamp('closed_at', { withTimezone: true }),
+    createdByPrincipalId: typeIdColumnNullable('principal')('created_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    /** Bumped on every meaningful change; powers queue ordering. */
+    lastActivityAt: timestamp('last_activity_at', { withTimezone: true }).defaultNow().notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+    deletedByPrincipalId: typeIdColumnNullable('principal')('deleted_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+  },
+  (t) => [
+    index('tickets_status_id_idx').on(t.statusId),
+    index('tickets_assignee_principal_idx').on(t.assigneePrincipalId),
+    index('tickets_primary_team_idx').on(t.primaryTeamId),
+    index('tickets_organization_idx').on(t.organizationId),
+    index('tickets_requester_contact_idx').on(t.requesterContactId),
+    index('tickets_source_widget_profile_idx').on(t.sourceWidgetProfileId),
+    index('tickets_created_at_idx').on(t.createdAt),
+    index('tickets_last_activity_at_idx').on(t.lastActivityAt),
+    index('tickets_deleted_at_idx').on(t.deletedAt),
+    // Composite for queue queries ("my team's open tickets, newest first")
+    index('tickets_team_status_idx').on(t.primaryTeamId, t.statusId),
+    // Active-only partial index — most queue queries exclude soft-deleted rows
+    index('tickets_active_last_activity_idx')
+      .on(t.lastActivityAt)
+      .where(sql`deleted_at IS NULL`),
+    // SLA policy lookup (Phase 5)
+    index('tickets_sla_policy_idx').on(t.slaPolicyId),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// ticket_threads
+// ---------------------------------------------------------------------------
+
+export const ticketThreads = pgTable(
+  'ticket_threads',
+  {
+    id: typeIdWithDefault('ticket_thread')('id').primaryKey(),
+    ticketId: typeIdColumn('ticket')('ticket_id')
+      .notNull()
+      .references(() => tickets.id, { onDelete: 'cascade' }),
+    /** Author principal; NULL = system-generated (e.g. status change message). */
+    principalId: typeIdColumnNullable('principal')('principal_id').references(() => principal.id, {
+      onDelete: 'set null',
+    }),
+    audience: text('audience', { enum: TICKET_THREAD_AUDIENCES }).notNull(),
+    bodyJson: jsonb('body_json').$type<TiptapContent>(),
+    bodyText: text('body_text').notNull(),
+    /** Required when audience='shared_team', null otherwise. */
+    sharedWithTeamId: typeIdColumnNullable('team')('shared_with_team_id').references(
+      () => teams.id,
+      { onDelete: 'set null' }
+    ),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    editedAt: timestamp('edited_at', { withTimezone: true }),
+    editedByPrincipalId: typeIdColumnNullable('principal')('edited_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+  },
+  (t) => [
+    index('ticket_threads_ticket_id_created_at_idx').on(t.ticketId, t.createdAt),
+    index('ticket_threads_audience_idx').on(t.audience),
+    check(
+      'ticket_threads_shared_team_required',
+      sql`(audience <> 'shared_team') OR (shared_with_team_id IS NOT NULL)`
+    ),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// ticket_attachments
+// ---------------------------------------------------------------------------
+
+export const ticketAttachments = pgTable(
+  'ticket_attachments',
+  {
+    id: typeIdWithDefault('ticket_att')('id').primaryKey(),
+    threadId: typeIdColumn('ticket_thread')('thread_id')
+      .notNull()
+      .references(() => ticketThreads.id, { onDelete: 'cascade' }),
+    uploadedByPrincipalId: typeIdColumnNullable('principal')('uploaded_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    filename: text('filename').notNull(),
+    mimeType: text('mime_type').notNull(),
+    sizeBytes: integer('size_bytes').notNull(),
+    /** S3-style storage key (set by the existing upload pipeline). */
+    storageKey: text('storage_key').notNull(),
+    publicUrl: text('public_url'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [index('ticket_attachments_thread_idx').on(t.threadId)]
+)
+
+// ---------------------------------------------------------------------------
+// ticket_participants  (watcher / collaborator / cc — principal OR contact)
+// ---------------------------------------------------------------------------
+
+export const ticketParticipants = pgTable(
+  'ticket_participants',
+  {
+    id: typeIdWithDefault('ticket_part')('id').primaryKey(),
+    ticketId: typeIdColumn('ticket')('ticket_id')
+      .notNull()
+      .references(() => tickets.id, { onDelete: 'cascade' }),
+    principalId: typeIdColumnNullable('principal')('principal_id').references(() => principal.id, {
+      onDelete: 'cascade',
+    }),
+    contactId: typeIdColumnNullable('contact')('contact_id').references(() => contacts.id, {
+      onDelete: 'cascade',
+    }),
+    role: text('role', { enum: TICKET_PARTICIPANT_ROLES }).notNull(),
+    addedByPrincipalId: typeIdColumnNullable('principal')('added_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    uniqueIndex('ticket_participants_ticket_principal_idx')
+      .on(t.ticketId, t.principalId)
+      .where(sql`principal_id IS NOT NULL`),
+    uniqueIndex('ticket_participants_ticket_contact_idx')
+      .on(t.ticketId, t.contactId)
+      .where(sql`contact_id IS NOT NULL`),
+    check(
+      'ticket_participants_one_subject',
+      sql`(principal_id IS NOT NULL)::int + (contact_id IS NOT NULL)::int = 1`
+    ),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// ticket_shares  (cross-team grants)
+// ---------------------------------------------------------------------------
+
+export const ticketShares = pgTable(
+  'ticket_shares',
+  {
+    id: typeIdWithDefault('ticket_share')('id').primaryKey(),
+    ticketId: typeIdColumn('ticket')('ticket_id')
+      .notNull()
+      .references(() => tickets.id, { onDelete: 'cascade' }),
+    teamId: typeIdColumn('team')('team_id')
+      .notNull()
+      .references(() => teams.id, { onDelete: 'cascade' }),
+    accessLevel: text('access_level', { enum: TICKET_SHARE_LEVELS }).notNull().default('read'),
+    grantedByPrincipalId: typeIdColumnNullable('principal')('granted_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    revokedByPrincipalId: typeIdColumnNullable('principal')('revoked_by_principal_id').references(
+      () => principal.id,
+      { onDelete: 'set null' }
+    ),
+  },
+  (t) => [
+    uniqueIndex('ticket_shares_ticket_team_active_idx')
+      .on(t.ticketId, t.teamId)
+      .where(sql`revoked_at IS NULL`),
+    index('ticket_shares_team_idx').on(t.teamId),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// ticket_activity (per-ticket timeline mirror of post_activity)
+// ---------------------------------------------------------------------------
+
+export const ticketActivity = pgTable(
+  'ticket_activity',
+  {
+    id: typeIdWithDefault('ticket_act')('id').primaryKey(),
+    ticketId: typeIdColumn('ticket')('ticket_id')
+      .notNull()
+      .references(() => tickets.id, { onDelete: 'cascade' }),
+    principalId: typeIdColumnNullable('principal')('principal_id').references(() => principal.id, {
+      onDelete: 'set null',
+    }),
+    type: text('type').notNull(),
+    metadata: jsonb('metadata').notNull().default({}),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (t) => [
+    index('ticket_activity_ticket_id_created_idx').on(t.ticketId, t.createdAt),
+    index('ticket_activity_type_idx').on(t.type),
+  ]
+)
+
+// ---------------------------------------------------------------------------
+// Relations
+// ---------------------------------------------------------------------------
+
+export const ticketsRelations = relations(tickets, ({ one, many }) => ({
+  status: one(ticketStatuses, {
+    fields: [tickets.statusId],
+    references: [ticketStatuses.id],
+  }),
+  requesterContact: one(contacts, {
+    fields: [tickets.requesterContactId],
+    references: [contacts.id],
+  }),
+  organization: one(organizations, {
+    fields: [tickets.organizationId],
+    references: [organizations.id],
+  }),
+  assigneePrincipal: one(principal, {
+    fields: [tickets.assigneePrincipalId],
+    references: [principal.id],
+    relationName: 'ticketAssignee',
+  }),
+  assigneeTeam: one(teams, {
+    fields: [tickets.assigneeTeamId],
+    references: [teams.id],
+    relationName: 'ticketAssigneeTeam',
+  }),
+  primaryTeam: one(teams, {
+    fields: [tickets.primaryTeamId],
+    references: [teams.id],
+    relationName: 'ticketPrimaryTeam',
+  }),
+  sourceWidgetProfile: one(widgetEnvironmentProfiles, {
+    fields: [tickets.sourceWidgetProfileId],
+    references: [widgetEnvironmentProfiles.id],
+  }),
+  threads: many(ticketThreads),
+  participants: many(ticketParticipants),
+  shares: many(ticketShares),
+  activity: many(ticketActivity),
+}))
+
+export const ticketThreadsRelations = relations(ticketThreads, ({ one, many }) => ({
+  ticket: one(tickets, {
+    fields: [ticketThreads.ticketId],
+    references: [tickets.id],
+  }),
+  author: one(principal, {
+    fields: [ticketThreads.principalId],
+    references: [principal.id],
+  }),
+  sharedWithTeam: one(teams, {
+    fields: [ticketThreads.sharedWithTeamId],
+    references: [teams.id],
+  }),
+  attachments: many(ticketAttachments),
+}))
+
+export const ticketAttachmentsRelations = relations(ticketAttachments, ({ one }) => ({
+  thread: one(ticketThreads, {
+    fields: [ticketAttachments.threadId],
+    references: [ticketThreads.id],
+  }),
+}))
+
+export const ticketParticipantsRelations = relations(ticketParticipants, ({ one }) => ({
+  ticket: one(tickets, {
+    fields: [ticketParticipants.ticketId],
+    references: [tickets.id],
+  }),
+  principal: one(principal, {
+    fields: [ticketParticipants.principalId],
+    references: [principal.id],
+  }),
+  contact: one(contacts, {
+    fields: [ticketParticipants.contactId],
+    references: [contacts.id],
+  }),
+}))
+
+export const ticketSharesRelations = relations(ticketShares, ({ one }) => ({
+  ticket: one(tickets, {
+    fields: [ticketShares.ticketId],
+    references: [tickets.id],
+  }),
+  team: one(teams, {
+    fields: [ticketShares.teamId],
+    references: [teams.id],
+  }),
+}))
+
+export const ticketActivityRelations = relations(ticketActivity, ({ one }) => ({
+  ticket: one(tickets, {
+    fields: [ticketActivity.ticketId],
+    references: [tickets.id],
+  }),
+  actor: one(principal, {
+    fields: [ticketActivity.principalId],
+    references: [principal.id],
+  }),
+}))
diff --git a/packages/db/src/schema/webhook-deliveries.ts b/packages/db/src/schema/webhook-deliveries.ts
new file mode 100644
index 000000000..eb1555c23
--- /dev/null
+++ b/packages/db/src/schema/webhook-deliveries.ts
@@ -0,0 +1,74 @@
+import {
+  pgTable,
+  text,
+  timestamp,
+  integer,
+  bigint,
+  boolean,
+  index,
+  jsonb,
+} from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn } from '@quackback/ids/drizzle'
+import { webhooks } from './webhooks'
+
+/**
+ * Append-only audit log of webhook delivery attempts. One row per attempt,
+ * keyed by `(webhookId, eventId, attemptNumber)` semantically (not via a
+ * unique constraint — duplicates from at-least-once jobs are tolerated).
+ *
+ * `status` ∈ ('queued','success','failed_retryable','failed_terminal','blocked_ssrf').
+ *
+ * `responseBodySnippet` is truncated to ≤500 chars by the writer.
+ *
+ * `requestPayloadJson` stores the full event envelope (`{id,type,createdAt,data}`)
+ * exactly as it was POSTed, so the operator-facing redeliver action can replay
+ * the original byte-for-byte. Capped at ~32 KB by the writer; oversized
+ * payloads are stored as `null` with `requestPayloadTruncated = true` and
+ * become non-redeliverable (rare for ticketing payloads).
+ */
+export const webhookDeliveries = pgTable(
+  'webhook_deliveries',
+  {
+    id: typeIdWithDefault('wh_deliv')('id').primaryKey(),
+    webhookId: typeIdColumn('webhook')('webhook_id')
+      .notNull()
+      .references(() => webhooks.id, { onDelete: 'cascade' }),
+    eventId: text('event_id').notNull(),
+    eventType: text('event_type').notNull(),
+    attemptNumber: integer('attempt_number').notNull(),
+    status: text('status').notNull(),
+    httpStatus: integer('http_status'),
+    errorMessage: text('error_message'),
+    requestUrl: text('request_url').notNull(),
+    requestPayloadBytes: integer('request_payload_bytes').notNull(),
+    requestPayloadJson: jsonb('request_payload_json'),
+    requestPayloadTruncated: boolean('request_payload_truncated').default(false).notNull(),
+    responseBodySnippet: text('response_body_snippet'),
+    latencyMs: integer('latency_ms'),
+    signatureTimestamp: bigint('signature_timestamp', { mode: 'number' }).notNull(),
+    attemptedAt: timestamp('attempted_at', { withTimezone: true }).defaultNow().notNull(),
+    nextRetryAt: timestamp('next_retry_at', { withTimezone: true }),
+  },
+  (table) => [
+    index('webhook_deliveries_webhook_attempted_idx').on(table.webhookId, table.attemptedAt),
+    index('webhook_deliveries_event_idx').on(table.eventId),
+    index('webhook_deliveries_failed_idx')
+      .on(table.status, table.attemptedAt)
+      .where(sql`status IN ('failed_retryable', 'failed_terminal')`),
+  ]
+)
+
+export const webhookDeliveriesRelations = relations(webhookDeliveries, ({ one }) => ({
+  webhook: one(webhooks, {
+    fields: [webhookDeliveries.webhookId],
+    references: [webhooks.id],
+  }),
+}))
+
+export type WebhookDeliveryStatus =
+  | 'queued'
+  | 'success'
+  | 'failed_retryable'
+  | 'failed_terminal'
+  | 'blocked_ssrf'
diff --git a/packages/db/src/schema/webhooks.ts b/packages/db/src/schema/webhooks.ts
index a5a52b604..e5df52534 100644
--- a/packages/db/src/schema/webhooks.ts
+++ b/packages/db/src/schema/webhooks.ts
@@ -31,6 +31,8 @@ export const webhooks = pgTable(
     events: text('events').array().notNull(),
     /** Optional filter: only trigger for posts in these boards */
     boardIds: text('board_ids').array(),
+    /** Optional filter: only trigger for tickets in these inboxes */
+    inboxIds: text('inbox_ids').array(),
     /** Webhook status: active or disabled */
     status: text('status', { enum: ['active', 'disabled'] })
       .notNull()
diff --git a/packages/db/src/schema/widget-profiles.ts b/packages/db/src/schema/widget-profiles.ts
new file mode 100644
index 000000000..ac670a22a
--- /dev/null
+++ b/packages/db/src/schema/widget-profiles.ts
@@ -0,0 +1,193 @@
+/**
+ * Environment-specific widget profiles.
+ *
+ * A widget application is a stable public integration key for an external app.
+ * Each application can have one profile per environment (local, development,
+ * staging, production, or a tenant-defined value). Profiles scope embedded
+ * widget configuration, content filters, and inbox-backed support categories.
+ */
+import { pgTable, text, timestamp, boolean, jsonb, index, uniqueIndex } from 'drizzle-orm/pg-core'
+import { relations, sql } from 'drizzle-orm'
+import { typeIdWithDefault, typeIdColumn } from '@quackback/ids/drizzle'
+import type {
+  BoardId,
+  ChangelogCategoryId,
+  ChangelogId,
+  ChangelogProductId,
+  HelpCenterArticleId,
+  HelpCenterCategoryId,
+  InboxId,
+  StatusId,
+  TagId,
+} from '@quackback/ids'
+
+export const WIDGET_PROFILE_ENVIRONMENTS = [
+  'default',
+  'local',
+  'development',
+  'staging',
+  'production',
+] as const
+export type WidgetProfileKnownEnvironment = (typeof WIDGET_PROFILE_ENVIRONMENTS)[number]
+
+export const WIDGET_PROFILE_CHANGELOG_MODES = [
+  'all_published',
+  'linked_to_allowed_feedback',
+  'selected_entries',
+] as const
+export type WidgetProfileChangelogMode = (typeof WIDGET_PROFILE_CHANGELOG_MODES)[number]
+
+export const WIDGET_PROFILE_TICKET_LIST_SCOPES = [
+  'same_profile_allowed_inboxes',
+  'allowed_inboxes',
+  'requester_owned',
+] as const
+export type WidgetProfileTicketListScope = (typeof WIDGET_PROFILE_TICKET_LIST_SCOPES)[number]
+
+export type WidgetProfileTicketPriority = 'low' | 'normal' | 'high' | 'urgent'
+
+export interface WidgetProfileConfigOverrides {
+  enabled?: boolean
+  defaultBoard?: string | null
+  position?: 'bottom-right' | 'bottom-left'
+  identifyVerification?: boolean
+  tabs?: {
+    home?: boolean
+    feedback?: boolean
+    changelog?: boolean
+    help?: boolean
+    chat?: boolean
+  }
+  imageUploadsInWidget?: boolean
+  ticketing?: {
+    enabled?: boolean
+  }
+  chat?: Record<string, unknown>
+}
+
+export interface WidgetProfileContentFilters {
+  feedback?: {
+    boardIds?: BoardId[]
+    boardSlugs?: string[]
+    statusIds?: StatusId[]
+    tagIds?: TagId[]
+    tagSlugs?: string[]
+  }
+  changelog?: {
+    mode?: WidgetProfileChangelogMode
+    entryIds?: ChangelogId[]
+    categoryIds?: ChangelogCategoryId[]
+    categorySlugs?: string[]
+    productIds?: ChangelogProductId[]
+    productSlugs?: string[]
+  }
+  help?: {
+    categoryIds?: HelpCenterCategoryId[]
+    articleIds?: HelpCenterArticleId[]
+  }
+}
+
+export interface WidgetProfileSupportDisplayRules {
+  showPrioritySelector?: boolean
+  showAttachments?: boolean
+  showResolveAction?: boolean
+  showReopenAction?: boolean
+  emptyStateTitle?: string
+  emptyStateDescription?: string
+}
+
+export interface WidgetProfileSupportCategory {
+  categoryKey: string
+  label: string
+  description?: string
+  icon?: string
+  inboxId: InboxId
+  defaultPriority?: WidgetProfileTicketPriority
+  allowedPriorities?: WidgetProfileTicketPriority[]
+  visible?: boolean
+  display?: WidgetProfileSupportDisplayRules
+}
+
+export interface WidgetProfileSupportConfig {
+  categories?: WidgetProfileSupportCategory[]
+  ticketListScope?: WidgetProfileTicketListScope
+  defaultDisplay?: WidgetProfileSupportDisplayRules
+}
+
+export const widgetApplications = pgTable(
+  'widget_applications',
+  {
+    id: typeIdWithDefault('widget_app')('id').primaryKey(),
+    /** Stable public key passed by host apps, e.g. "customer-dashboard". */
+    key: text('key').notNull(),
+    name: text('name').notNull(),
+    description: text('description'),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    uniqueIndex('widget_applications_key_idx').on(t.key),
+    index('widget_applications_archived_at_idx').on(t.archivedAt),
+  ]
+)
+
+export const widgetEnvironmentProfiles = pgTable(
+  'widget_environment_profiles',
+  {
+    id: typeIdWithDefault('widget_profile')('id').primaryKey(),
+    applicationId: typeIdColumn('widget_app')('application_id')
+      .notNull()
+      .references(() => widgetApplications.id, { onDelete: 'cascade' }),
+    /** Environment name passed by host apps; stored normalized lowercase. */
+    environment: text('environment').notNull(),
+    displayName: text('display_name').notNull(),
+    enabled: boolean('enabled').notNull().default(true),
+    /** Exact origins, wildcard subdomains, and local patterns like http://localhost:*. */
+    allowedOrigins: jsonb('allowed_origins').$type<string[]>().notNull().default([]),
+    configOverrides: jsonb('config_overrides')
+      .$type<WidgetProfileConfigOverrides>()
+      .notNull()
+      .default({}),
+    contentFilters: jsonb('content_filters')
+      .$type<WidgetProfileContentFilters>()
+      .notNull()
+      .default({}),
+    supportConfig: jsonb('support_config')
+      .$type<WidgetProfileSupportConfig>()
+      .notNull()
+      .default({}),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (t) => [
+    index('widget_profiles_application_idx').on(t.applicationId),
+    index('widget_profiles_environment_idx').on(t.environment),
+    index('widget_profiles_enabled_idx').on(t.enabled),
+    index('widget_profiles_archived_at_idx').on(t.archivedAt),
+    uniqueIndex('widget_profiles_application_environment_active_idx')
+      .on(t.applicationId, t.environment)
+      .where(sql`archived_at IS NULL`),
+  ]
+)
+
+export const widgetApplicationsRelations = relations(widgetApplications, ({ many }) => ({
+  profiles: many(widgetEnvironmentProfiles),
+}))
+
+export const widgetEnvironmentProfilesRelations = relations(
+  widgetEnvironmentProfiles,
+  ({ one }) => ({
+    application: one(widgetApplications, {
+      fields: [widgetEnvironmentProfiles.applicationId],
+      references: [widgetApplications.id],
+    }),
+  })
+)
diff --git a/packages/db/src/seed.ts b/packages/db/src/seed.ts
index 0a1f1e93e..16e703328 100644
--- a/packages/db/src/seed.ts
+++ b/packages/db/src/seed.ts
@@ -21,13 +21,20 @@ import type {
   UserId,
   WorkspaceId,
   ChangelogId,
+  ChangelogCategoryId,
+  ChangelogProductId,
   RawFeedbackItemId,
 } from '@quackback/ids'
 import { user, account, settings, principal } from './schema/auth'
 import { boards, tags, roadmaps } from './schema/boards'
 import { posts, postTags, postRoadmaps, votes, comments } from './schema/posts'
 import { postStatuses, DEFAULT_STATUSES } from './schema/statuses'
-import { changelogEntries, changelogEntryPosts } from './schema/changelog'
+import {
+  changelogCategories,
+  changelogEntries,
+  changelogEntryPosts,
+  changelogProducts,
+} from './schema/changelog'
 import { segments } from './schema/segments'
 import type { SegmentRules } from './schema/segments'
 import { feedbackSources, rawFeedbackItems, feedbackSignals } from './schema/feedback'
@@ -214,6 +221,8 @@ const changelogPresets = [
       'We heard your feedback loud and clear! Dark mode is finally here. Toggle it from Settings > Appearance or let your system preference decide. This update also includes improved contrast ratios for better accessibility.',
     status: 'published' as const,
     daysAgo: 3,
+    category: 'Feature',
+    product: 'Core app',
   },
   {
     title: 'Slack Integration Now Available',
@@ -221,6 +230,8 @@ const changelogPresets = [
       'Connect your workspace to Slack and get real-time notifications for new feedback, votes, and status changes. Set up custom channels for different boards and never miss important updates from your users.',
     status: 'published' as const,
     daysAgo: 14,
+    category: 'Integration',
+    product: 'Integrations',
   },
   {
     title: 'Export Your Data to CSV',
@@ -228,6 +239,8 @@ const changelogPresets = [
       'You can now export your posts, votes, and comments to CSV format. Perfect for reporting, analysis, or backing up your data. Find the export option in Settings > Data.',
     status: 'published' as const,
     daysAgo: 30,
+    category: 'Improvement',
+    product: 'Admin portal',
   },
   {
     title: 'Coming Soon: Mobile App',
@@ -235,12 +248,16 @@ const changelogPresets = [
       'We are excited to announce that our mobile app is in development! Stay tuned for iOS and Android apps that let you manage feedback on the go. Beta testing will begin next month.',
     status: 'scheduled' as const,
     daysAhead: 7,
+    category: 'Announcement',
+    product: 'Mobile',
   },
   {
     title: 'Improved Search & Filtering',
     content:
       'Finding feedback just got easier. Our new search now supports fuzzy matching, filters by status/board/tag, and remembers your recent searches. Plus, saved views are coming soon!',
     status: 'draft' as const,
+    category: 'Improvement',
+    product: 'Core app',
   },
   {
     title: 'Q1 2025 Roadmap Update',
@@ -248,9 +265,25 @@ const changelogPresets = [
       'Here is what we shipped this quarter and what is coming next. Thank you to everyone who submitted feedback - your input directly shapes our product direction.',
     status: 'published' as const,
     daysAgo: 45,
+    category: 'Announcement',
+    product: 'Core app',
   },
 ]
 
+const changelogCategoryPresets = [
+  { name: 'Feature', slug: 'feature', color: '#22c55e' },
+  { name: 'Improvement', slug: 'improvement', color: '#3b82f6' },
+  { name: 'Integration', slug: 'integration', color: '#8b5cf6' },
+  { name: 'Announcement', slug: 'announcement', color: '#f59e0b' },
+]
+
+const changelogProductPresets = [
+  { name: 'Core app', slug: 'core-app' },
+  { name: 'Admin portal', slug: 'admin-portal' },
+  { name: 'Integrations', slug: 'integrations' },
+  { name: 'Mobile', slug: 'mobile' },
+]
+
 const statusSlugs = ['open', 'under_review', 'planned', 'in_progress', 'complete', 'closed']
 const statusWeights = [30, 20, 20, 15, 10, 5] // Weighted distribution
 
@@ -593,6 +626,23 @@ async function seed() {
     // Create changelog entries
     console.log('Creating changelog entries...')
 
+    const changelogCategoryRecords = changelogCategoryPresets.map((category) => ({
+      id: generateId('changelog_cat') as ChangelogCategoryId,
+      ...category,
+    }))
+    const changelogProductRecords = changelogProductPresets.map((product) => ({
+      id: generateId('changelog_prod') as ChangelogProductId,
+      ...product,
+    }))
+    await db.insert(changelogCategories).values(changelogCategoryRecords)
+    await db.insert(changelogProducts).values(changelogProductRecords)
+    const changelogCategoryByName = new Map(
+      changelogCategoryRecords.map((category) => [category.name, category.id])
+    )
+    const changelogProductByName = new Map(
+      changelogProductRecords.map((product) => [product.name, product.id])
+    )
+
     // Get posts with 'complete' status for linking
     const completePosts = postRecords.filter((p) => p.statusSlug === 'complete')
     let completePostIndex = 0
@@ -621,6 +671,8 @@ async function seed() {
         content: preset.content,
         contentJson: textToTipTapJson(preset.content),
         principalId: author.id,
+        categoryId: changelogCategoryByName.get(preset.category) ?? null,
+        productId: changelogProductByName.get(preset.product) ?? null,
         publishedAt,
         createdAt: publishedAt ?? new Date(),
         updatedAt: new Date(),
diff --git a/packages/db/src/types.ts b/packages/db/src/types.ts
index 0cbe95c1b..4a08e2cf8 100644
--- a/packages/db/src/types.ts
+++ b/packages/db/src/types.ts
@@ -11,7 +11,12 @@ import type {
   postNotes,
 } from './schema/posts'
 import type { integrations } from './schema/integrations'
-import type { changelogEntries, changelogEntryPosts } from './schema/changelog'
+import type {
+  changelogCategories,
+  changelogEntries,
+  changelogEntryPosts,
+  changelogProducts,
+} from './schema/changelog'
 import type {
   conversations,
   chatMessages,
@@ -21,12 +26,38 @@ import type {
   chatMessageFlags,
 } from './schema/chat'
 import type { principal } from './schema/auth'
+import type { teams, teamMemberships } from './schema/teams'
+import type { roles, permissions, rolePermissions, principalRoleAssignments } from './schema/roles'
+import type { auditEvents } from './schema/audit-events'
+import type { organizations, contacts, contactUserLinks } from './schema/organizations'
+import type { ticketStatuses } from './schema/ticket-statuses'
+import type {
+  tickets,
+  ticketThreads,
+  ticketAttachments,
+  ticketParticipants,
+  ticketShares,
+  ticketActivity,
+} from './schema/tickets'
+import type { inboxes, inboxChannels, inboxMemberships } from './schema/inboxes'
+import type { routingRules } from './schema/routing-rules'
+import type {
+  businessHours,
+  slaPolicies,
+  slaTargets,
+  ticketSlaClocks,
+  escalationRules,
+  slaEscalationLog,
+} from './schema/sla'
+import type { ticketSubscriptions } from './schema/ticket-subscriptions'
+import type { webhookDeliveries } from './schema/webhook-deliveries'
+import type { widgetApplications, widgetEnvironmentProfiles } from './schema/widget-profiles'
 
 // Status categories (defined here to avoid circular imports in tests)
 export const STATUS_CATEGORIES = ['active', 'complete', 'closed'] as const
 export type StatusCategory = (typeof STATUS_CATEGORIES)[number]
 
-// Moderation states for posts — single source of truth, kept in sync with
+// Moderation states for posts - single source of truth, kept in sync with
 // the posts.moderation_state column enum (schema.test.ts pins the match).
 export const MODERATION_STATES = [
   'published',
@@ -50,13 +81,13 @@ export interface BoardSettings {
 // ----------------------------------------------------------------------
 // Per-action access tiers (View+Vote / Comment / Submit) and per-board
 // approval overrides. The legacy `BoardAudience` discriminated union was
-// removed in migration 0080 — every reader now consults `BoardAccess`.
+// removed in migration 0080 - every reader now consults `BoardAccess`.
 // ----------------------------------------------------------------------
 
 export const ACCESS_TIERS = ['anonymous', 'authenticated', 'segments', 'team'] as const
 export type AccessTier = (typeof ACCESS_TIERS)[number]
 
-/** Restriction rank — higher number is stricter. Used for tier-invariant
+/** Restriction rank - higher number is stricter. Used for tier-invariant
  *  checks: a derived action (comment / submit) cannot be more permissive
  *  than view. */
 export const ACCESS_TIER_RANK: Record<AccessTier, number> = {
@@ -80,7 +111,7 @@ export interface BoardAccess {
   vote: AccessTier
   comment: AccessTier
   submit: AccessTier
-  /** Per-action segment allowlists — used wherever the matching tier is
+  /** Per-action segment allowlists - used wherever the matching tier is
    *  'segments'. A board can say "Active Users can view & comment, but
    *  only Beta testers can submit." Invalid (and rejected on save) when
    *  an action's tier is 'segments' but that action's list is empty. */
@@ -220,9 +251,11 @@ export interface SetupState {
     boards: boolean // At least one board created or explicitly skipped
   }
   completedAt?: string // ISO timestamp when onboarding was fully completed
+  source: 'cloud' | 'self-hosted' // How this instance was provisioned
   useCase?: UseCaseType // Product type for personalized board recommendations
 }
 
+// Default setup state for new instances (self-hosted starts with workspace incomplete)
 export const DEFAULT_SETUP_STATE: SetupState = {
   version: 1,
   steps: {
@@ -230,13 +263,15 @@ export const DEFAULT_SETUP_STATE: SetupState = {
     workspace: false,
     boards: false,
   },
+  source: 'self-hosted',
 }
 
 // Helper to parse setup state from settings
 export function getSetupState(setupStateJson: string | null): SetupState | null {
   if (!setupStateJson) return null
   try {
-    return JSON.parse(setupStateJson) as SetupState
+    const parsed = JSON.parse(setupStateJson) as SetupState
+    return { ...parsed, source: parsed.source ?? 'self-hosted' }
   } catch {
     return null
   }
@@ -292,7 +327,7 @@ export type NewPostNote = InferInsertModel<typeof postNotes>
 export type CommentReaction = InferSelectModel<typeof commentReactions>
 export type NewCommentReaction = InferInsertModel<typeof commentReactions>
 
-// Support-inbox conversation statuses — kept in sync with the conversations.status
+// Support-inbox conversation statuses - kept in sync with the conversations.status
 // column enum (schema.test.ts pins the match).
 export const CONVERSATION_STATUSES = ['open', 'pending', 'closed'] as const
 export type ConversationStatus = (typeof CONVERSATION_STATUSES)[number]
@@ -317,19 +352,19 @@ export type ConversationEndReason = (typeof CONVERSATION_END_REASONS)[number]
 export const AGENT_AVAILABILITY_VALUES = ['online', 'away'] as const
 export type AgentAvailability = (typeof AGENT_AVAILABILITY_VALUES)[number]
 
-// The inbound channel a conversation arrived on — kept in sync with the
+// The inbound channel a conversation arrived on - kept in sync with the
 // conversations.channel column enum. Existing live-chat threads default to
 // 'live_chat'; 'email' and 'web_form' are wired up in later phases. This turns
 // "live chat vs ticket" into one polymorphic conversation with a channel field.
 export const CHANNELS = ['live_chat', 'email', 'web_form'] as const
 export type Channel = (typeof CHANNELS)[number]
 
-// Agent-set conversation priority for inbox triage — kept in sync with the
+// Agent-set conversation priority for inbox triage - kept in sync with the
 // conversations.priority column enum. 'none' = unset (the default).
 export const CONVERSATION_PRIORITIES = ['none', 'low', 'medium', 'high', 'urgent'] as const
 export type ConversationPriority = (typeof CONVERSATION_PRIORITIES)[number]
 
-// Which side of a conversation a message came from — kept in sync with the
+// Which side of a conversation a message came from - kept in sync with the
 // chat_messages.sender_type column enum. 'system' rows are status events (e.g.
 // assignment) shown to both sides; attributed to the relevant agent's principal
 // and never counted as unread.
@@ -357,7 +392,7 @@ export interface ChatSystemEvent {
 }
 
 // An agent-only suggestion (carried on an internal note) to track a resolved
-// conversation as a feedback post. Surfaced exclusively via the agent DTO — it
+// conversation as a feedback post. Surfaced exclusively via the agent DTO - it
 // never reaches the visitor.
 export interface PostSuggestion {
   boardId: string
@@ -406,11 +441,114 @@ export type ChangelogEntry = InferSelectModel<typeof changelogEntries>
 export type NewChangelogEntry = InferInsertModel<typeof changelogEntries>
 export type ChangelogEntryPost = InferSelectModel<typeof changelogEntryPosts>
 export type NewChangelogEntryPost = InferInsertModel<typeof changelogEntryPosts>
+export type ChangelogCategory = InferSelectModel<typeof changelogCategories>
+export type NewChangelogCategory = InferInsertModel<typeof changelogCategories>
+export type ChangelogProduct = InferSelectModel<typeof changelogProducts>
+export type NewChangelogProduct = InferInsertModel<typeof changelogProducts>
 
 // Principal types
 export type Principal = InferSelectModel<typeof principal>
 export type NewPrincipal = InferInsertModel<typeof principal>
 
+// Ticketing — Phase 1
+export type Team = InferSelectModel<typeof teams>
+export type NewTeam = InferInsertModel<typeof teams>
+export type TeamMembership = InferSelectModel<typeof teamMemberships>
+export type NewTeamMembership = InferInsertModel<typeof teamMemberships>
+export type RoleRecord = InferSelectModel<typeof roles>
+export type NewRoleRecord = InferInsertModel<typeof roles>
+export type PermissionRecord = InferSelectModel<typeof permissions>
+export type NewPermissionRecord = InferInsertModel<typeof permissions>
+export type RolePermission = InferSelectModel<typeof rolePermissions>
+export type NewRolePermission = InferInsertModel<typeof rolePermissions>
+export type PrincipalRoleAssignment = InferSelectModel<typeof principalRoleAssignments>
+export type NewPrincipalRoleAssignment = InferInsertModel<typeof principalRoleAssignments>
+export type AuditEvent = InferSelectModel<typeof auditEvents>
+export type NewAuditEvent = InferInsertModel<typeof auditEvents>
+
+// Ticketing — Phase 2 (organizations & contacts)
+export type Organization = InferSelectModel<typeof organizations>
+export type NewOrganization = InferInsertModel<typeof organizations>
+export type Contact = InferSelectModel<typeof contacts>
+export type NewContact = InferInsertModel<typeof contacts>
+export type ContactUserLink = InferSelectModel<typeof contactUserLinks>
+export type NewContactUserLink = InferInsertModel<typeof contactUserLinks>
+
+// Ticketing — Phase 3 (ticket core)
+export type TicketStatusEntity = InferSelectModel<typeof ticketStatuses>
+export type NewTicketStatusEntity = InferInsertModel<typeof ticketStatuses>
+export type Ticket = InferSelectModel<typeof tickets>
+export type NewTicket = InferInsertModel<typeof tickets>
+export type TicketThread = InferSelectModel<typeof ticketThreads>
+export type NewTicketThread = InferInsertModel<typeof ticketThreads>
+export type TicketAttachment = InferSelectModel<typeof ticketAttachments>
+export type NewTicketAttachment = InferInsertModel<typeof ticketAttachments>
+export type TicketParticipant = InferSelectModel<typeof ticketParticipants>
+export type NewTicketParticipant = InferInsertModel<typeof ticketParticipants>
+export type TicketShare = InferSelectModel<typeof ticketShares>
+export type NewTicketShare = InferInsertModel<typeof ticketShares>
+export type TicketActivity = InferSelectModel<typeof ticketActivity>
+export type NewTicketActivity = InferInsertModel<typeof ticketActivity>
+
+// Ticketing — Phase 4 (inboxes, channels, routing)
+export type Inbox = InferSelectModel<typeof inboxes>
+export type NewInbox = InferInsertModel<typeof inboxes>
+export type InboxChannel = InferSelectModel<typeof inboxChannels>
+export type NewInboxChannel = InferInsertModel<typeof inboxChannels>
+export type InboxMembership = InferSelectModel<typeof inboxMemberships>
+export type NewInboxMembership = InferInsertModel<typeof inboxMemberships>
+export type RoutingRule = InferSelectModel<typeof routingRules>
+export type NewRoutingRule = InferInsertModel<typeof routingRules>
+
+// Ticketing — Phase 5 (SLA + escalations)
+export type BusinessHours = InferSelectModel<typeof businessHours>
+export type NewBusinessHours = InferInsertModel<typeof businessHours>
+export type SlaPolicy = InferSelectModel<typeof slaPolicies>
+export type NewSlaPolicy = InferInsertModel<typeof slaPolicies>
+export type SlaTarget = InferSelectModel<typeof slaTargets>
+export type NewSlaTarget = InferInsertModel<typeof slaTargets>
+export type TicketSlaClock = InferSelectModel<typeof ticketSlaClocks>
+export type NewTicketSlaClock = InferInsertModel<typeof ticketSlaClocks>
+export type EscalationRule = InferSelectModel<typeof escalationRules>
+export type NewEscalationRule = InferInsertModel<typeof escalationRules>
+export type SlaEscalationLogEntry = InferSelectModel<typeof slaEscalationLog>
+export type NewSlaEscalationLogEntry = InferInsertModel<typeof slaEscalationLog>
+
+export type TicketSubscription = InferSelectModel<typeof ticketSubscriptions>
+export type NewTicketSubscription = InferInsertModel<typeof ticketSubscriptions>
+
+export type WebhookDelivery = InferSelectModel<typeof webhookDeliveries>
+export type NewWebhookDelivery = InferInsertModel<typeof webhookDeliveries>
+
+// Widget applications and environment profiles
+export type WidgetApplication = InferSelectModel<typeof widgetApplications>
+export type NewWidgetApplication = InferInsertModel<typeof widgetApplications>
+export type WidgetEnvironmentProfile = InferSelectModel<typeof widgetEnvironmentProfiles>
+export type NewWidgetEnvironmentProfile = InferInsertModel<typeof widgetEnvironmentProfiles>
+
+// Re-export SLA literal-union types & business-hours interfaces from the schema.
+export type {
+  SlaTargetKind,
+  SlaClockState,
+  SlaPolicyScope,
+  EscalationRecipientType,
+  EscalationChannel,
+  BusinessHoursRange,
+  BusinessHoursWeek,
+  BusinessHoursHoliday,
+} from './schema/sla'
+// Re-export ticket-related literal-union types used by the SLA domain.
+export type {
+  TicketPriority,
+  TicketChannel,
+  TicketVisibilityScope,
+  TicketThreadAudience,
+  TicketParticipantRole,
+  TicketShareLevel,
+} from './schema/tickets'
+export type { TicketStatusCategory } from './schema/ticket-statuses'
+export type { AuditDiff, AuditJsonValue } from './schema/audit-events'
+
 // Extended types for queries with relations
 export type CommentWithReplies = Comment & {
   replies: CommentWithReplies[]
diff --git a/packages/email/src/__tests__/send-ticket-event-email.test.ts b/packages/email/src/__tests__/send-ticket-event-email.test.ts
new file mode 100644
index 000000000..304a50a5b
--- /dev/null
+++ b/packages/email/src/__tests__/send-ticket-event-email.test.ts
@@ -0,0 +1,107 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+
+const sendMailMock = vi.fn().mockResolvedValue({ messageId: 'ticket-msg-id' })
+vi.mock('nodemailer', () => ({
+  default: {
+    createTransport: () => ({ sendMail: sendMailMock }),
+  },
+}))
+
+import { sendTicketEventEmail } from '../index'
+
+const ENV_KEYS = [
+  'EMAIL_SMTP_HOST',
+  'EMAIL_SMTP_PORT',
+  'EMAIL_SMTP_USER',
+  'EMAIL_SMTP_PASS',
+  'EMAIL_RESEND_API_KEY',
+  'RESEND_API_KEY',
+  'EMAIL_FROM',
+]
+
+describe('sendTicketEventEmail', () => {
+  const saved: Record<string, string | undefined> = {}
+
+  beforeEach(() => {
+    for (const key of ENV_KEYS) {
+      saved[key] = process.env[key]
+      delete process.env[key]
+    }
+    process.env.EMAIL_SMTP_HOST = 'smtp.example.com'
+    process.env.EMAIL_FROM = 'noreply@example.com'
+    sendMailMock.mockClear()
+  })
+
+  afterEach(() => {
+    for (const key of ENV_KEYS) {
+      if (saved[key] !== undefined) {
+        process.env[key] = saved[key]
+      } else {
+        delete process.env[key]
+      }
+    }
+  })
+
+  it('renders structured ticket details and quote content', async () => {
+    const result = await sendTicketEventEmail({
+      to: 'customer@example.com',
+      title: 'New reply: Billing question',
+      summary: 'The requester replied to this ticket.',
+      eventLabel: 'New reply',
+      actorName: 'Alex Morgan',
+      occurredAt: 'Jun 16, 2026, 10:15 AM',
+      ticketSubject: 'Billing question',
+      ticketUrl: 'https://example.com/tickets/ticket_123',
+      workspaceName: 'Acme',
+      unsubscribeUrl: 'https://example.com/settings/notifications',
+      statusLabel: 'Open',
+      priorityLabel: 'High',
+      details: [
+        { label: 'Current status', value: 'Open' },
+        { label: 'Priority', value: 'High' },
+        { label: 'Requester', value: 'Jamie (jamie@example.com)' },
+      ],
+      contentSections: [
+        {
+          title: 'Requester reply',
+          body: 'I can share the invoice number if that helps.\n\nHere is the full context from the customer.',
+          tone: 'quote',
+        },
+        {
+          title: 'Attachment details',
+          rows: [
+            { label: 'File', value: 'invoice.pdf' },
+            { label: 'Size', value: '1.5 KB' },
+          ],
+        },
+      ],
+      quote: 'I can share the invoice number if that helps.',
+    })
+
+    expect(result).toEqual({ sent: true })
+    expect(sendMailMock).toHaveBeenCalledTimes(1)
+    const call = sendMailMock.mock.calls[0][0] as {
+      to: string
+      subject: string
+      html: string
+      from: string
+    }
+    expect(call.to).toBe('customer@example.com')
+    expect(call.subject).toBe('New reply: Billing question')
+    expect(call.html).toContain('The requester replied to this ticket.')
+    expect(call.html).toContain('New reply')
+    expect(call.html).toContain('Alex Morgan')
+    expect(call.html).toContain('Billing question')
+    expect(call.html).toContain('Current status')
+    expect(call.html).toContain('Action content')
+    expect(call.html).toContain('Requester reply')
+    expect(call.html).toContain('Here is the full context from the customer.')
+    expect(call.html).toContain('Attachment details')
+    expect(call.html).toContain('invoice.pdf')
+    expect(call.html).toContain('Current ticket')
+    expect(call.html).toContain('Jamie (jamie@example.com)')
+    expect(call.html).toContain('I can share the invoice number if that helps.')
+    expect(call.html).toContain('https://example.com/tickets/ticket_123')
+    expect(call.html).toContain('https://example.com/settings/notifications')
+  })
+})
diff --git a/packages/email/src/templates/tickets/ticket-event.tsx b/packages/email/src/templates/tickets/ticket-event.tsx
new file mode 100644
index 000000000..4a2c6f04a
--- /dev/null
+++ b/packages/email/src/templates/tickets/ticket-event.tsx
@@ -0,0 +1,216 @@
+/**
+ * Generic ticket-event email template.
+ *
+ * One template covers all 8 ticket events + 2 SLA events. The caller is
+ * responsible for the title/body copy — this component handles layout,
+ * branding, the CTA and the unsubscribe footer.
+ */
+
+import { Button, Heading, Section, Text } from '@react-email/components'
+import { EmailLayout, NotificationFooter } from '../email-layout'
+import { typography, button, colors } from '../shared-styles'
+
+export interface TicketEventDetail {
+  label: string
+  value: string
+}
+
+export interface TicketEventContentSection {
+  title: string
+  body?: string
+  rows?: TicketEventDetail[]
+  tone?: 'default' | 'quote' | 'warning'
+}
+
+export interface TicketEventEmailProps {
+  /** Headline shown at the top of the email body. */
+  title: string
+  /** Optional body paragraph rendered between the headline and the CTA. */
+  body?: string
+  /** Concise explanation of what changed and why the recipient is seeing this. */
+  summary?: string
+  /** Human-readable event category, e.g. "Status changed". */
+  eventLabel?: string
+  /** Actor name when available and safe to show. */
+  actorName?: string
+  /** ISO or preformatted timestamp for the event. */
+  occurredAt?: string
+  /** Structured event-specific details. */
+  details?: TicketEventDetail[]
+  /** Rich action-specific content that explains the event without opening the ticket. */
+  contentSections?: TicketEventContentSection[]
+  /** Optional quoted ticket reply/update preview. */
+  quote?: string
+  /** Ticket subject. Surfaced as a labelled card below the headline. */
+  ticketSubject: string
+  /** Direct link to the ticket in the agent UI. */
+  ticketUrl: string
+  /** Workspace label for branding + the footer. */
+  organizationName: string
+  /** Per-recipient unsubscribe / preferences link. */
+  unsubscribeUrl: string
+  logoUrl?: string
+  /** Status label (e.g. "open", "solved") shown next to the ticket subject. */
+  statusLabel?: string
+  /** Priority label (e.g. "high", "urgent"). */
+  priorityLabel?: string
+}
+
+export function TicketEventEmail({
+  title,
+  body,
+  summary,
+  eventLabel,
+  actorName,
+  occurredAt,
+  details = [],
+  contentSections = [],
+  quote,
+  ticketSubject,
+  ticketUrl,
+  organizationName,
+  unsubscribeUrl,
+  logoUrl,
+  statusLabel,
+  priorityLabel,
+}: TicketEventEmailProps) {
+  const meta = [statusLabel, priorityLabel].filter(Boolean).join(' · ')
+  const context = [eventLabel, actorName ? `by ${actorName}` : undefined, occurredAt]
+    .filter(Boolean)
+    .join(' · ')
+  const message = summary ?? body
+
+  return (
+    <EmailLayout preview={title} logoUrl={logoUrl} logoAlt={organizationName}>
+      <Heading style={typography.h1}>{title}</Heading>
+      {context ? (
+        <Text style={{ ...typography.textSmall, color: colors.textMuted }}>{context}</Text>
+      ) : null}
+      {message ? <Text style={typography.text}>{message}</Text> : null}
+
+      {contentSections.length > 0 ? (
+        <Section style={{ marginTop: '20px', marginBottom: '16px' }}>
+          <Text style={{ ...typography.text, fontWeight: '600', margin: '0 0 12px' }}>
+            Action content
+          </Text>
+          {contentSections.map((section) => (
+            <Section
+              key={section.title}
+              style={{
+                backgroundColor:
+                  section.tone === 'warning'
+                    ? '#FEF3C7'
+                    : section.tone === 'quote'
+                      ? colors.surfaceMuted
+                      : '#FFFFFF',
+                border: `1px solid ${colors.border}`,
+                borderLeft:
+                  section.tone === 'quote'
+                    ? `4px solid ${colors.border}`
+                    : `1px solid ${colors.border}`,
+                borderRadius: '8px',
+                padding: '14px 18px',
+                marginBottom: '12px',
+              }}
+            >
+              <Text style={{ ...typography.textSmall, fontWeight: '600', margin: '0 0 8px' }}>
+                {section.title}
+              </Text>
+              {section.body ? (
+                <Text style={{ ...typography.text, whiteSpace: 'pre-wrap', margin: '0 0 10px' }}>
+                  {section.body}
+                </Text>
+              ) : null}
+              {section.rows?.map((row) => (
+                <Text
+                  key={`${section.title}-${row.label}`}
+                  style={{ ...typography.textSmall, margin: '0 0 8px' }}
+                >
+                  <strong>{row.label}:</strong> {row.value}
+                </Text>
+              ))}
+            </Section>
+          ))}
+        </Section>
+      ) : null}
+
+      <Section
+        style={{
+          backgroundColor: colors.surfaceMuted,
+          borderRadius: '8px',
+          padding: '16px 20px',
+          marginBottom: '16px',
+        }}
+      >
+        <Text
+          style={{
+            ...typography.textSmall,
+            marginTop: '0',
+            marginBottom: '4px',
+            color: colors.textMuted,
+          }}
+        >
+          Ticket
+        </Text>
+        <Text style={{ ...typography.text, marginTop: '0', marginBottom: '0', fontWeight: '600' }}>
+          {ticketSubject}
+        </Text>
+        {meta ? (
+          <Text
+            style={{
+              ...typography.textSmall,
+              marginTop: '4px',
+              marginBottom: '0',
+              color: colors.textMuted,
+            }}
+          >
+            {meta}
+          </Text>
+        ) : null}
+      </Section>
+
+      {details.length > 0 ? (
+        <Section
+          style={{
+            border: `1px solid ${colors.border}`,
+            borderRadius: '8px',
+            padding: '16px 20px',
+            marginBottom: '16px',
+          }}
+        >
+          <Text style={{ ...typography.textSmall, fontWeight: '600', margin: '0 0 10px' }}>
+            Current ticket
+          </Text>
+          {details.map((detail) => (
+            <Text key={detail.label} style={{ ...typography.textSmall, margin: '0 0 8px' }}>
+              <strong>{detail.label}:</strong> {detail.value}
+            </Text>
+          ))}
+        </Section>
+      ) : null}
+
+      {quote ? (
+        <Section
+          style={{
+            borderLeft: `4px solid ${colors.border}`,
+            paddingLeft: '16px',
+            marginBottom: '16px',
+          }}
+        >
+          <Text style={{ ...typography.text, color: colors.textMuted }}>{quote}</Text>
+        </Section>
+      ) : null}
+
+      <Section style={{ textAlign: 'center', marginTop: '32px', marginBottom: '32px' }}>
+        <Button style={button.primary} href={ticketUrl}>
+          View Ticket
+        </Button>
+      </Section>
+
+      <NotificationFooter
+        reason="You received this email because you are subscribed to this ticket."
+        unsubscribeUrl={unsubscribeUrl}
+      />
+    </EmailLayout>
+  )
+}
diff --git a/packages/ids/src/index.ts b/packages/ids/src/index.ts
index 6a5c3405c..2658cd28a 100644
--- a/packages/ids/src/index.ts
+++ b/packages/ids/src/index.ts
@@ -78,6 +78,10 @@ export type {
   NoteId,
   RoadmapId,
   ChangelogId,
+  ChangelogCategoryId,
+  ChangelogProductId,
+  WidgetApplicationId,
+  WidgetProfileId,
   ConversationId,
   ChatMessageId,
   ChatTagId,
@@ -126,6 +130,41 @@ export type {
   // Billing
   SubscriptionId,
   InvoiceId,
+  // Ticketing — Phase 1
+  TeamId,
+  TeamMembershipId,
+  RoleId,
+  PermissionId,
+  RolePermissionId,
+  RoleAssignmentId,
+  AuditEventId,
+  // Ticketing — Phase 2
+  OrganizationId,
+  ContactId,
+  ContactUserLinkId,
+  // Ticketing — Phase 3
+  TicketId,
+  TicketStatusId,
+  TicketThreadId,
+  TicketAttachmentId,
+  TicketParticipantId,
+  TicketShareId,
+  TicketActivityId,
+  // Ticketing — Phase 4
+  InboxId,
+  InboxChannelId,
+  InboxMembershipId,
+  RoutingRuleId,
+  // Ticketing — Phase 5
+  BusinessHoursId,
+  SlaPolicyId,
+  SlaTargetId,
+  TicketSlaClockId,
+  EscalationRuleId,
+  SlaEscalationLogId,
+  // Ticketing — Phase 7
+  TicketSubscriptionId,
+  WebhookDeliveryId,
   // Utilities
   ExtractPrefix,
   EntityIdMap,
@@ -159,6 +198,8 @@ export {
   reactionIdSchema,
   roadmapIdSchema,
   changelogIdSchema,
+  changelogCategoryIdSchema,
+  changelogProductIdSchema,
   conversationIdSchema,
   chatMessageIdSchema,
   integrationIdSchema,
@@ -187,6 +228,8 @@ export {
   flexibleReactionIdSchema,
   flexibleRoadmapIdSchema,
   flexibleChangelogIdSchema,
+  flexibleChangelogCategoryIdSchema,
+  flexibleChangelogProductIdSchema,
   flexibleIntegrationIdSchema,
   flexibleWorkspaceIdSchema,
   flexibleUserIdSchema,
diff --git a/packages/ids/src/prefixes.ts b/packages/ids/src/prefixes.ts
index b02aa046b..e548290f5 100644
--- a/packages/ids/src/prefixes.ts
+++ b/packages/ids/src/prefixes.ts
@@ -27,6 +27,13 @@ export const ID_PREFIXES = {
   // Planning domain
   roadmap: 'roadmap',
   changelog: 'changelog',
+  changelog_category: 'changelog_cat',
+  changelog_product: 'changelog_prod',
+  changelog_segment_visibility: 'clseg_vis',
+
+  // Widget embedding
+  widget_application: 'widget_app',
+  widget_profile: 'widget_profile',
 
   // Live chat
   conversation: 'conversation',
@@ -43,6 +50,8 @@ export const ID_PREFIXES = {
   integration: 'integration',
   platform_cred: 'platform_cred',
   event_mapping: 'event_mapping',
+  // Shared prefix for both post_external_links and ticket_external_links.
+  // Same semantic concept (external tracker link); separate FK columns disambiguate.
   linked_entity: 'linked_entity',
   sync_log: 'sync_log',
   slack_monitor: 'slack_monitor',
@@ -58,6 +67,7 @@ export const ID_PREFIXES = {
 
   // Users
   segment: 'segment',
+  portal_tab_override: 'portal_tab_override',
   user_attr: 'user_attr',
 
   // AI
@@ -75,6 +85,50 @@ export const ID_PREFIXES = {
   merge_suggestion: 'merge_sug',
   activity: 'activity',
 
+  // Ticketing — access & visibility (Phase 1: RBAC + teams + audit)
+  team: 'team',
+  team_membership: 'team_member',
+  role: 'role',
+  permission: 'perm',
+  role_permission: 'role_perm',
+  role_assignment: 'role_asgn',
+  // Shares 'audit' prefix with audit_log (better-auth security events).
+  // Both store UUIDs internally; prefix is display-layer only. Safe because no
+  // code resolves entity type from a TypeID prefix string across tables.
+  audit_event: 'audit',
+
+  // Ticketing — Phase 2: organizations & contacts
+  organization: 'org',
+  contact: 'contact',
+  contact_user_link: 'cu_link',
+
+  // Ticketing — Phase 3: ticket core
+  ticket: 'ticket',
+  ticket_status: 'ticket_status',
+  ticket_thread: 'ticket_thread',
+  ticket_attachment: 'ticket_att',
+  ticket_participant: 'ticket_part',
+  ticket_share: 'ticket_share',
+  ticket_activity: 'ticket_act',
+
+  // Ticketing — Phase 4: inboxes, channels, routing
+  inbox: 'inbox',
+  inbox_channel: 'inbox_ch',
+  inbox_membership: 'inbox_mem',
+  routing_rule: 'route_rule',
+
+  // Ticketing — Phase 5: SLA + escalations
+  business_hours: 'bizhrs',
+  sla_policy: 'sla_pol',
+  sla_target: 'sla_tgt',
+  ticket_sla_clock: 'sla_clk',
+  escalation_rule: 'esc_rule',
+  sla_escalation_log: 'esc_log',
+
+  // Ticketing — Phase 7: subscriptions + webhook delivery log
+  ticket_subscription: 'tkt_sub',
+  webhook_delivery: 'wh_deliv',
+
   // ============================================
   // Auth Entities (Better-auth, text primary keys)
   // ============================================
@@ -89,6 +143,8 @@ export const ID_PREFIXES = {
   domain: 'domain',
   transfer_token: 'transfer_token',
   two_factor: 'two_factor',
+  // Shares 'audit' prefix with audit_event (ticketing operational audit).
+  // See audit_event comment for rationale.
   audit_log: 'audit',
   sso_recovery_code: 'rcode',
   identity_provider: 'idp',
diff --git a/packages/ids/src/types.ts b/packages/ids/src/types.ts
index f82135b70..e11cfa62c 100644
--- a/packages/ids/src/types.ts
+++ b/packages/ids/src/types.ts
@@ -49,6 +49,21 @@ export type RoadmapId = TypeId<'roadmap'>
 /** Changelog entry ID - e.g., changelog_01h455vb4pex5vsknk084sn02q */
 export type ChangelogId = TypeId<'changelog'>
 
+/** Changelog category ID - e.g., changelog_cat_01h455vb4pex5vsknk084sn02q */
+export type ChangelogCategoryId = TypeId<'changelog_cat'>
+
+/** Changelog product ID - e.g., changelog_prod_01h455vb4pex5vsknk084sn02q */
+export type ChangelogProductId = TypeId<'changelog_prod'>
+
+/** Per-segment changelog visibility override ID - e.g., clseg_vis_01h455vb4pex5vsknk084sn02q */
+export type ChangelogSegmentVisibilityId = TypeId<'clseg_vis'>
+
+/** Widget application ID - e.g., widget_app_01h455vb4pex5vsknk084sn02q */
+export type WidgetApplicationId = TypeId<'widget_app'>
+
+/** Widget environment profile ID - e.g., widget_profile_01h455vb4pex5vsknk084sn02q */
+export type WidgetProfileId = TypeId<'widget_profile'>
+
 /** Support-inbox conversation ID - e.g., conversation_01h455vb4pex5vsknk084sn02q */
 export type ConversationId = TypeId<'conversation'>
 
@@ -211,6 +226,116 @@ export type ApiKeyId = TypeId<'api_key'>
 /** Webhook ID - e.g., webhook_01h455vb4pex5vsknk084sn02q */
 export type WebhookId = TypeId<'webhook'>
 
+// ============================================
+// Ticketing — RBAC, teams, audit (Phase 1)
+// ============================================
+
+/** Team ID - e.g., team_01h455vb4pex5vsknk084sn02q */
+export type TeamId = TypeId<'team'>
+
+/** Team membership ID - e.g., team_member_01h455vb4pex5vsknk084sn02q */
+export type TeamMembershipId = TypeId<'team_member'>
+
+/** Role ID - e.g., role_01h455vb4pex5vsknk084sn02q */
+export type RoleId = TypeId<'role'>
+
+/** Permission ID - e.g., perm_01h455vb4pex5vsknk084sn02q */
+export type PermissionId = TypeId<'perm'>
+
+/** Role-permission grant ID - e.g., role_perm_01h455vb4pex5vsknk084sn02q */
+export type RolePermissionId = TypeId<'role_perm'>
+
+/** Principal role assignment ID - e.g., role_asgn_01h455vb4pex5vsknk084sn02q */
+export type RoleAssignmentId = TypeId<'role_asgn'>
+
+/** Audit event ID - e.g., audit_01h455vb4pex5vsknk084sn02q */
+export type AuditEventId = TypeId<'audit'>
+
+// ============================================
+// Ticketing — Phase 2: organizations & contacts
+// ============================================
+
+/** Organization ID - e.g., org_01h455vb4pex5vsknk084sn02q */
+export type OrganizationId = TypeId<'org'>
+
+/** Contact ID - e.g., contact_01h455vb4pex5vsknk084sn02q */
+export type ContactId = TypeId<'contact'>
+
+/** Contact ↔ portal user link ID - e.g., cu_link_01h455vb4pex5vsknk084sn02q */
+export type ContactUserLinkId = TypeId<'cu_link'>
+
+// ============================================
+// Ticketing — Phase 3: ticket core
+// ============================================
+
+/** Ticket ID - e.g., ticket_01h455vb4pex5vsknk084sn02q */
+export type TicketId = TypeId<'ticket'>
+
+/** Ticket status ID - e.g., ticket_status_01h455vb4pex5vsknk084sn02q */
+export type TicketStatusId = TypeId<'ticket_status'>
+
+/** Ticket thread (message) ID - e.g., ticket_thread_01h455vb4pex5vsknk084sn02q */
+export type TicketThreadId = TypeId<'ticket_thread'>
+
+/** Ticket attachment ID - e.g., ticket_att_01h455vb4pex5vsknk084sn02q */
+export type TicketAttachmentId = TypeId<'ticket_att'>
+
+/** Ticket participant (watcher/collaborator/cc) ID - e.g., ticket_part_01h455vb4pex5vsknk084sn02q */
+export type TicketParticipantId = TypeId<'ticket_part'>
+
+/** Ticket share grant ID - e.g., ticket_share_01h455vb4pex5vsknk084sn02q */
+export type TicketShareId = TypeId<'ticket_share'>
+
+/** Ticket activity event ID - e.g., ticket_act_01h455vb4pex5vsknk084sn02q */
+export type TicketActivityId = TypeId<'ticket_act'>
+
+// ============================================
+// Ticketing — Inboxes, channels, routing (Phase 4)
+// ============================================
+
+/** Inbox ID - e.g., inbox_01h455vb4pex5vsknk084sn02q */
+export type InboxId = TypeId<'inbox'>
+
+/** Inbox channel ID - e.g., inbox_ch_01h455vb4pex5vsknk084sn02q */
+export type InboxChannelId = TypeId<'inbox_ch'>
+
+/** Inbox membership ID - e.g., inbox_mem_01h455vb4pex5vsknk084sn02q */
+export type InboxMembershipId = TypeId<'inbox_mem'>
+
+/** Routing rule ID - e.g., route_rule_01h455vb4pex5vsknk084sn02q */
+export type RoutingRuleId = TypeId<'route_rule'>
+
+// ============================================
+// Ticketing — SLA + escalations (Phase 5)
+// ============================================
+
+/** Business hours calendar ID - e.g., bizhrs_01h455vb4pex5vsknk084sn02q */
+export type BusinessHoursId = TypeId<'bizhrs'>
+
+/** SLA policy ID - e.g., sla_pol_01h455vb4pex5vsknk084sn02q */
+export type SlaPolicyId = TypeId<'sla_pol'>
+
+/** SLA target ID - e.g., sla_tgt_01h455vb4pex5vsknk084sn02q */
+export type SlaTargetId = TypeId<'sla_tgt'>
+
+/** Per-ticket SLA clock ID - e.g., sla_clk_01h455vb4pex5vsknk084sn02q */
+export type TicketSlaClockId = TypeId<'sla_clk'>
+
+/** Escalation rule ID - e.g., esc_rule_01h455vb4pex5vsknk084sn02q */
+export type EscalationRuleId = TypeId<'esc_rule'>
+
+/** SLA escalation log entry ID - e.g., esc_log_01h455vb4pex5vsknk084sn02q */
+export type SlaEscalationLogId = TypeId<'esc_log'>
+
+/** Per-ticket subscription ID - e.g., tkt_sub_01h455vb4pex5vsknk084sn02q */
+export type TicketSubscriptionId = TypeId<'tkt_sub'>
+
+/** Webhook delivery attempt ID - e.g., wh_deliv_01h455vb4pex5vsknk084sn02q */
+export type WebhookDeliveryId = TypeId<'wh_deliv'>
+
+/** Portal tab segment override ID - e.g., portal_tab_override_01h455vb4pex5vsknk084sn02q */
+export type PortalTabOverrideId = TypeId<'portal_tab_override'>
+
 // ============================================
 // Billing Entity IDs
 // ============================================
@@ -260,6 +385,11 @@ export interface EntityIdMap {
   merge_suggestion: MergeSuggestionId
   roadmap: RoadmapId
   changelog: ChangelogId
+  changelog_category: ChangelogCategoryId
+  changelog_product: ChangelogProductId
+  changelog_segment_visibility: ChangelogSegmentVisibilityId
+  widget_application: WidgetApplicationId
+  widget_profile: WidgetProfileId
   conversation: ConversationId
   chat_message: ChatMessageId
   chat_tag: ChatTagId
@@ -295,6 +425,50 @@ export interface EntityIdMap {
   category: HelpCenterCategoryId
   article: HelpCenterArticleId
   article_feedback: HelpCenterFeedbackId
+
+  // Ticketing — Phase 1
+  team: TeamId
+  team_membership: TeamMembershipId
+  role: RoleId
+  permission: PermissionId
+  role_permission: RolePermissionId
+  role_assignment: RoleAssignmentId
+  audit_event: AuditEventId
+
+  // Ticketing — Phase 2
+  organization: OrganizationId
+  contact: ContactId
+  contact_user_link: ContactUserLinkId
+
+  // Ticketing — Phase 3
+  ticket: TicketId
+  ticket_status: TicketStatusId
+  ticket_thread: TicketThreadId
+  ticket_attachment: TicketAttachmentId
+  ticket_participant: TicketParticipantId
+  ticket_share: TicketShareId
+  ticket_activity: TicketActivityId
+
+  // Ticketing — Phase 4
+  inbox: InboxId
+  inbox_channel: InboxChannelId
+  inbox_membership: InboxMembershipId
+  routing_rule: RoutingRuleId
+
+  // Ticketing — Phase 5
+  business_hours: BusinessHoursId
+  sla_policy: SlaPolicyId
+  sla_target: SlaTargetId
+  ticket_sla_clock: TicketSlaClockId
+  escalation_rule: EscalationRuleId
+  sla_escalation_log: SlaEscalationLogId
+
+  // Ticketing — Phase 7
+  ticket_subscription: TicketSubscriptionId
+  webhook_delivery: WebhookDeliveryId
+
+  // Portal tab configuration
+  portal_tab_override: PortalTabOverrideId
 }
 
 /**
diff --git a/packages/ids/src/zod.ts b/packages/ids/src/zod.ts
index a53bc2b10..f2f534dd0 100644
--- a/packages/ids/src/zod.ts
+++ b/packages/ids/src/zod.ts
@@ -177,6 +177,8 @@ export const statusIdSchema = typeIdSchema(ID_PREFIXES.status)
 export const reactionIdSchema = typeIdSchema(ID_PREFIXES.reaction)
 export const roadmapIdSchema = typeIdSchema(ID_PREFIXES.roadmap)
 export const changelogIdSchema = typeIdSchema(ID_PREFIXES.changelog)
+export const changelogCategoryIdSchema = typeIdSchema(ID_PREFIXES.changelog_category)
+export const changelogProductIdSchema = typeIdSchema(ID_PREFIXES.changelog_product)
 export const conversationIdSchema = typeIdSchema(ID_PREFIXES.conversation)
 export const chatMessageIdSchema = typeIdSchema(ID_PREFIXES.chat_message)
 export const integrationIdSchema = typeIdSchema(ID_PREFIXES.integration)
@@ -207,6 +209,8 @@ export const flexibleStatusIdSchema = flexibleIdSchema(ID_PREFIXES.status)
 export const flexibleReactionIdSchema = flexibleIdSchema(ID_PREFIXES.reaction)
 export const flexibleRoadmapIdSchema = flexibleIdSchema(ID_PREFIXES.roadmap)
 export const flexibleChangelogIdSchema = flexibleIdSchema(ID_PREFIXES.changelog)
+export const flexibleChangelogCategoryIdSchema = flexibleIdSchema(ID_PREFIXES.changelog_category)
+export const flexibleChangelogProductIdSchema = flexibleIdSchema(ID_PREFIXES.changelog_product)
 export const flexibleIntegrationIdSchema = flexibleIdSchema(ID_PREFIXES.integration)
 export const flexibleWorkspaceIdSchema = flexibleIdSchema(ID_PREFIXES.workspace)
 export const flexibleUserIdSchema = flexibleIdSchema(ID_PREFIXES.user)
diff --git a/packages/widget/__tests__/tickets.test.ts b/packages/widget/__tests__/tickets.test.ts
new file mode 100644
index 000000000..22585fb86
--- /dev/null
+++ b/packages/widget/__tests__/tickets.test.ts
@@ -0,0 +1,164 @@
+// @vitest-environment happy-dom
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { createSDK } from '../src/core/sdk'
+
+const ORIGIN = 'https://feedback.acme.com'
+
+function stubIframe() {
+  const postMessage = vi.fn()
+  const spy = vi
+    .spyOn(HTMLIFrameElement.prototype, 'contentWindow', 'get')
+    .mockReturnValue({ postMessage } as unknown as Window)
+  return { postMessage, spy }
+}
+
+function fireReady() {
+  window.dispatchEvent(
+    new MessageEvent('message', {
+      origin: ORIGIN,
+      data: { type: 'quackback:ready' },
+    })
+  )
+}
+
+describe('sdk: ticketing surface', () => {
+  beforeEach(() => {
+    document.body.innerHTML = ''
+    document.head.innerHTML = ''
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => ({ ok: true, json: async () => ({ theme: {} }) }))
+    )
+  })
+  afterEach(() => vi.restoreAllMocks())
+
+  it('openSupport() posts view: support to the iframe and emits an open event', () => {
+    const { postMessage, spy } = stubIframe()
+    const sdk = createSDK()
+    sdk.dispatch('init', { instanceUrl: ORIGIN })
+    fireReady()
+    const seen: unknown[] = []
+    sdk.dispatch('on', 'open', (p: unknown) => seen.push(p))
+
+    sdk.dispatch('openSupport')
+
+    expect(postMessage).toHaveBeenCalledWith(
+      { type: 'quackback:open', data: { view: 'support' } },
+      ORIGIN
+    )
+    expect(seen).toHaveLength(1)
+    expect((seen[0] as { view?: string }).view).toBe('support')
+    expect((seen[0] as { ticketId?: string }).ticketId).toBeUndefined()
+    spy.mockRestore()
+  })
+
+  it('openSupport(ticketId) deep-links into the ticket detail and surfaces ticketId', () => {
+    const { postMessage, spy } = stubIframe()
+    const sdk = createSDK()
+    sdk.dispatch('init', { instanceUrl: ORIGIN })
+    fireReady()
+    const seen: unknown[] = []
+    sdk.dispatch('on', 'open', (p: unknown) => seen.push(p))
+
+    sdk.dispatch('openSupport', 'ticket_01h')
+
+    expect(postMessage).toHaveBeenCalledWith(
+      { type: 'quackback:open', data: { view: 'support', ticketId: 'ticket_01h' } },
+      ORIGIN
+    )
+    expect(seen[0] as { view?: string; ticketId?: string }).toMatchObject({
+      view: 'support',
+      ticketId: 'ticket_01h',
+    })
+    spy.mockRestore()
+  })
+
+  it('open({ view: support, ticketId }) round-trips ticketId into the open event', () => {
+    const { postMessage, spy } = stubIframe()
+    const sdk = createSDK()
+    sdk.dispatch('init', { instanceUrl: ORIGIN })
+    fireReady()
+    const seen: unknown[] = []
+    sdk.dispatch('on', 'open', (p: unknown) => seen.push(p))
+
+    sdk.dispatch('open', { view: 'support', ticketId: 'ticket_42' })
+
+    expect(postMessage).toHaveBeenCalledWith(
+      { type: 'quackback:open', data: { view: 'support', ticketId: 'ticket_42' } },
+      ORIGIN
+    )
+    expect((seen[0] as { ticketId?: string }).ticketId).toBe('ticket_42')
+    spy.mockRestore()
+  })
+
+  it('forwards inbound ticket:created events to subscribers', () => {
+    stubIframe()
+    const sdk = createSDK()
+    sdk.dispatch('init', { instanceUrl: ORIGIN })
+    const seen: unknown[] = []
+    sdk.dispatch('on', 'ticket:created', (p: unknown) => seen.push(p))
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        origin: ORIGIN,
+        data: {
+          type: 'quackback:event',
+          name: 'ticket:created',
+          payload: {
+            id: 'ticket_1',
+            subject: 'Help',
+            statusId: 'status_1',
+            statusCategory: 'open',
+          },
+        },
+      })
+    )
+    expect(seen).toEqual([
+      {
+        id: 'ticket_1',
+        subject: 'Help',
+        statusId: 'status_1',
+        statusCategory: 'open',
+      },
+    ])
+  })
+
+  it('forwards inbound ticket:replied events to subscribers', () => {
+    stubIframe()
+    const sdk = createSDK()
+    sdk.dispatch('init', { instanceUrl: ORIGIN })
+    const seen: unknown[] = []
+    sdk.dispatch('on', 'ticket:replied', (p: unknown) => seen.push(p))
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        origin: ORIGIN,
+        data: {
+          type: 'quackback:event',
+          name: 'ticket:replied',
+          payload: { ticketId: 'ticket_1', threadId: 'thread_2' },
+        },
+      })
+    )
+    expect(seen).toEqual([{ ticketId: 'ticket_1', threadId: 'thread_2' }])
+  })
+
+  it('forwards inbound ticket:resolved events to subscribers', () => {
+    stubIframe()
+    const sdk = createSDK()
+    sdk.dispatch('init', { instanceUrl: ORIGIN })
+    const seen: unknown[] = []
+    sdk.dispatch('on', 'ticket:resolved', (p: unknown) => seen.push(p))
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        origin: ORIGIN,
+        data: {
+          type: 'quackback:event',
+          name: 'ticket:resolved',
+          payload: { ticketId: 'ticket_1', statusId: 'status_solved', alreadyResolved: false },
+        },
+      })
+    )
+    expect(seen).toEqual([
+      { ticketId: 'ticket_1', statusId: 'status_solved', alreadyResolved: false },
+    ])
+  })
+})
diff --git a/vitest.config.ts b/vitest.config.ts
index 6b2c0982e..2d3bc08da 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -11,6 +11,10 @@ export default defineConfig({
     // the module graph for later tests. 20s gives headroom; genuine hangs
     // still fail well before the suite stalls.
     testTimeout: 20000,
+    // The suite is import-heavy and several mock-based tests are sensitive to
+    // worker CPU starvation. Keep the default command stable while allowing
+    // one-off overrides such as `VITEST_MAX_WORKERS=75% bun run test -- --run`.
+    maxWorkers: process.env.VITEST_MAX_WORKERS ?? '50%',
     include: ['**/*.test.ts', '**/*.test.tsx'],
     setupFiles: [path.resolve(__dirname, './vitest.setup.ts')],
     exclude: [
@@ -25,6 +29,11 @@ export default defineConfig({
       // Widget package has its own vitest.config.ts with happy-dom — run via
       // `bun run --cwd packages/widget test`. Don't double-run from the root.
       'packages/widget/**',
+      // TanStack Router uses dots as path separators, so the route file for
+      // POST /api/v1/webhooks/:webhookId/test is named `$webhookId.test.ts`.
+      // That collides with the `*.test.ts` glob — it's a route module, not a
+      // test suite. Real route tests live under routes/**/__tests__/.
+      '**/routes/api/v1/webhooks/$webhookId.test.ts',
     ],
     // Use ts-node or vite's transformation instead of stripping
     typecheck: {
@@ -32,6 +41,37 @@ export default defineConfig({
     },
     env: {
       DATABASE_URL: 'postgresql://postgres:password@localhost:5432/quackback_test',
+      // Mirror CI's env so any test that transitively loads server config
+      // (config.ts validates baseUrl/secretKey/redisUrl on first access) is
+      // self-sufficient and does not depend on the developer's shell env.
+      BASE_URL: 'http://localhost:3000',
+      SECRET_KEY: 'test-secret-key-for-vitest-only-min-32-chars-long',
+      REDIS_URL: 'redis://localhost:6379',
+    },
+    coverage: {
+      // v8 instrumentation. Activated only with `--coverage`, so normal runs are
+      // unaffected. The JSON reporter feeds scripts/diff-coverage.mjs, which
+      // enforces 100% line/branch coverage on lines changed by this branch.
+      provider: 'v8',
+      reporter: ['text-summary', 'json', 'json-summary'],
+      reportsDirectory: './coverage',
+      // Instrument only files that tests actually load (all: false). Changed
+      // files never loaded by any test surface as missing in the report and the
+      // diff-coverage gate counts their changed lines as uncovered.
+      all: false,
+      include: ['apps/web/src/**/*.{ts,tsx}', 'packages/*/src/**/*.{ts,tsx}'],
+      exclude: [
+        '**/*.test.ts',
+        '**/*.test.tsx',
+        '**/__tests__/**',
+        '**/e2e/**',
+        '**/*.d.ts',
+        '**/types.ts',
+        // Generated / declarative route trees and config — no behavior to cover.
+        '**/routeTree.gen.ts',
+        '**/*.config.{ts,js}',
+        'apps/web/src/locales/**',
+      ],
     },
   },
   esbuild: {