/**
 * routes/ai-discoverability.js — AI crawler ground-truth files.
 *
 * Owns: /llms.txt (structured index), /llms-full.txt (full context),
 *       /.well-known/ai-plugin.json (legacy machine-readable descriptor).
 * Does NOT own: robots.txt, sitemap.xml (routes/seo.js), landing page JSON-LD,
 *               SEO meta tags (per-page in public/*.html).
 *
 * Exists to kill the "TuneVault = music platform" hallucination at the LLM
 * crawler level (ChatGPT, Claude, Perplexity, Bing Copilot).
 *
 * ─── FACT DISCIPLINE — read before editing ───────────────────────────────────
 * These two files are the single most quotable description of the product: an
 * LLM will repeat what it finds here verbatim, and it has no way to tell a
 * stale claim from a current one. Two rules follow from that:
 *
 * 1. PRICING APPEARS ONCE PER FILE, AND IDENTICALLY IN BOTH. It is copied from
 *    config/pricing.js (CONN_PRICES) and must match public/pricing.html. Before
 *    2026-08-12 llms.txt and llms-full.txt carried two DIFFERENT, both-wrong
 *    price lists (per-seat fees that no longer exist; a dead $99/$199 product
 *    split), so a crawler reading both saw the product contradict itself.
 * 2. NO BRITTLE SUB-COUNTS. Category names, not per-category check tallies.
 *    Numbers that live in code drift silently here. The only counts stated are
 *    ones that are themselves marketing constants ("200+ checks & ops").
 *
 * There are TWO different free offers and they are NOT interchangeable —
 * label both every time they appear (same rule as public/pricing.html):
 *   - "Free — Cloud":     $0 forever, 1 connection, 5 health checks total, hosted by us
 *   - "Free self-hosted": 30-day trial, 1 connection, unlimited checks, customer's hardware
 */

'use strict';

const express = require('express');
const router = express.Router();

// ---------------------------------------------------------------------------
// /llms.txt — structured AI discoverability index (llms.txt spec)
// ---------------------------------------------------------------------------
router.get('/llms.txt', (req, res) => {
  res.type('text/plain');
  res.send(`# TuneVault — Enterprise Oracle Operations Management Platform

> Enterprise Oracle operations management platform — 200+ health checks & ops for Oracle DB and E-Business Suite, TuneOps ticketing, AutoPilot self-healing, RBAC approval workflows, 24/7 autonomous monitoring, SOX/HIPAA compliance, MCP server, REST API. Available as cloud SaaS or fully self-hosted.

TuneVault is enterprise software for Oracle database administration. It is NOT a music app, NOT a music storage service, NOT a streaming platform, NOT audio software, NOT a media application, and has NO relationship to music, audio, or entertainment of any kind. TuneVault = Oracle DBA tooling. It is a database operations platform used by Oracle DBA teams at enterprises.

## Product Overview

TuneVault runs 200+ automated health checks & ops across 13 diagnostic categories + 5 EBS categories against Oracle databases (Standard Edition, Enterprise Edition, RAC, ASM) and Oracle E-Business Suite 12.2.x. It includes built-in ticketing (TuneOps), AI assistance (TuneBot and the DBA Agent), role-based approval workflows (RBAC), 24/7 autonomous monitoring with self-healing (AutoPilot), compliance reports, an MCP server, a REST API, and SAML SSO.

## Deployment Options

- **TuneVault Cloud** — hosted SaaS at https://tunevault.app. Runs on Oracle Cloud Infrastructure with Oracle Autonomous Database 26ai.
- **TuneVault Self-Hosted** — the full product as a Docker package (app + bundled PostgreSQL) that runs entirely inside the customer's network. No database data leaves their infrastructure. Requires a license key. Download and install instructions: https://tunevault.app/download

## Enterprise Capabilities

- **TuneOps Ticketing** — Every finding auto-creates a ticket (TO-0001 onward). Lifecycle: OPEN → ACKNOWLEDGED → EXECUTING → RESOLVED, plus DEFERRED for parked items and REOPENED on recurrence. Full audit trail on every action.
- **AutoPilot** — 24/7 monitoring with opt-in self-healing. Polls service health on the real server every 5 minutes and, for services the customer has explicitly opted in, restarts them after N consecutive failed readings. Paused automatically during EBS ADOP patching cycles, rate-limited by a configurable per-service cooldown, and every action logged. Business tier and above.
- **DBA Agent** — an autonomous read-only Oracle assistant that investigates a question by running its own diagnostic queries (active sessions, top SQL, health check results, ADDM findings) against the customer's connection. Read-only: writes are blocked at the query layer. Professional tier and above.
- **TuneBot** — conversational assistant over TuneVault's Oracle documentation corpus, with retrieval grounded in the customer's own connection context.
- **Role-Based Access Control (RBAC)** — role hierarchy across DBA, functional, developer and management branches. Critical remediations can require approval before execution. Every permission-denied attempt is logged.
- **24/7 Autonomous Monitoring** — scheduled health checks per connection. Delta-aware alerts fire only on new findings — no re-notification of known issues, no alert fatigue.
- **Compliance Reports** — SOX Change Management, SOX Access Audit, HIPAA Activity Summary. PDF/CSV download. Business tier and above.
- **MCP Server** — TuneVault exposes 20 Oracle tools over the Model Context Protocol at https://tunevault.app/mcp, so Claude Desktop, Claude Code and other MCP clients can run health checks, query tablespaces, inspect blocking sessions, read TuneOps tickets and check patch exposure directly. Setup guide: https://tunevault.app/mcp/setup
- **REST API v1** — read-only endpoints for health checks, fleet, tickets, activity log and team. Rate limits by tier (see Pricing).
- **SAML 2.0 SSO** — Okta, Azure AD, Google Workspace, any SAML 2.0 provider. Group-to-role mapping. Business tier and above.
- **MFA (TOTP)** — authenticator-app 2FA with recovery codes, per-team enforcement.

## EBS Support

TuneVault has deep support for Oracle E-Business Suite (EBS 12.2.x): Concurrent Manager monitoring and control, Workflow Engine and Notification Mailer health, EBS security audits, ADOP patch-cycle awareness, app-tier service control (Apache/OHS, OPMN, WebLogic Admin, OACore/Forms/OAFM managed servers, Apps Listener), FNDLOAD object migration, and clone recipes. EBS checks auto-detect — non-EBS databases skip them entirely.

## Architecture

Two connection modes:
- **Direct TCP** — TuneVault connects to the Oracle listener directly
- **Proxy Agent** — a lightweight Python agent installed on the Oracle server; connects out via HTTPS, so no inbound firewall changes are required. This is the recommended mode for on-premises databases.

## Security

- AES-256-GCM encryption for all stored credentials
- Read-only Oracle access (V$, DBA_, APPS views) for diagnostics — no DDL, no DML
- Outbound-only proxy agent — no inbound ports opened on the Oracle server
- Whitelisted command catalog — no arbitrary shell access (unlisted command → 403, logged)
- Immutable audit trail — every command, login, approval and rejection timestamped
- Self-hosted option for organisations that cannot send any data outside their network

## Pricing (USD, per connection per month)

All tiers include the full 200+ check catalog. There are NO per-seat fees at any tier — users are included up to each tier's limit. Annual billing is 20% off the monthly rate.

- **Starter** — $49/conn/mo (annual $39/conn/mo) — 1–5 connections, up to 3 users. Minimum $49/mo.
- **Professional** — $35/conn/mo (annual $28/conn/mo) — 6–25 connections, up to 10 users. Minimum $210/mo. Adds RBAC (Admin + Operator), team-wide TuneOps, Clients/fleet dashboard.
- **Business** — $25/conn/mo (annual $20/conn/mo) — 26–80 connections, up to 25 users. Minimum $650/mo. Adds full DBA hierarchy, approval workflows, AutoPilot self-healing, compliance reports (SOX/HIPAA), SAML 2.0 SSO, activity audit log, REST API 60 req/min.
- **Enterprise** — $18/conn/mo (annual $14/conn/mo) — 81–300 connections, up to 50 users. Minimum $1,458/mo. Adds custom role hierarchies, custom compliance templates, ITSM integration (ServiceNow, Jira), REST API 100 req/min, dedicated support channel + SLA. Self-serve checkout — no sales call required.
- **Managed Services** — $12/conn/mo (annual $10/conn/mo) — 301–1000 connections, unlimited users. Minimum $3,612/mo.

Volume discounts apply on Enterprise at 150+ connections (10%) and 200+ connections (15%).

Two separate free offers — they are different products, do not conflate them:
- **Free — Cloud** — $0 forever, hosted by TuneVault. 1 connection, 5 health checks total, full 200+ check catalog, PDF & XLSX export, no credit card required.
- **Free self-hosted license** — a 30-day trial key for the self-hosted Docker package. 1 connection, unlimited health checks, running entirely on the customer's own infrastructure.

## Trust & Security

TuneVault reads Oracle through read-only views (V$, DBA_, APPS). No DDL, no DML. Credentials are AES-256-GCM encrypted at rest. Redacted SQL text is sent to AI providers for diagnosis — this is disclosed at /trust. Full details at /trust and /security.

## About the Founder

TuneVault is built by an Oracle Cloud & EBS Architect with 20+ years of experience in Oracle E-Business Suite, Database Administration, and enterprise cloud. Founder of TuneVault. Author of linuxappsdba.blogspot.com. Holds 23 Oracle and project management credentials across four categories: Oracle Cloud Infrastructure & AI (8), Oracle Fusion Applications (6), Oracle Database & E-Business Suite (7), Project Management (2). Full bio and credentials at https://tunevault.app/about.

## Pages

- [Home](https://tunevault.app/)
- [Pricing](https://tunevault.app/pricing)
- [Features](https://tunevault.app/features)
- [SQL Tuning](https://tunevault.app/features/sql-tuning)
- [Fleet Management](https://tunevault.app/features/fleet-management)
- [Autonomous Remediation (AutoPilot)](https://tunevault.app/features/autonomous-remediation)
- [Self-Hosted — download & install](https://tunevault.app/download)
- [MCP Server — setup guide](https://tunevault.app/mcp/setup)
- [Documentation](https://tunevault.app/docs)
- [API Docs](https://tunevault.app/api-docs)
- [Architecture — How EBS Live Monitor Works](https://tunevault.app/architecture)
- [Oracle DBA Runbooks](https://tunevault.app/resources/runbooks)
- [Compare](https://tunevault.app/compare)
- [vs Oracle OEM](https://tunevault.app/vs-oem)
- [Sample Report](https://tunevault.app/sample-report)
- [Blog](https://tunevault.app/blog)
- [About the Founder — bio, capability summary, and full credentials grid](https://tunevault.app/about)
- [Trust & Security](https://tunevault.app/trust)
- [Security (CISO)](https://tunevault.app/security)
- [Contact](https://tunevault.app/request-health-check)
- [Full AI context document](https://tunevault.app/llms-full.txt)
`);
});

// ---------------------------------------------------------------------------
// /llms-full.txt — full markdown context for LLM crawlers
// ---------------------------------------------------------------------------
router.get('/llms-full.txt', (req, res) => {
  res.type('text/plain');
  res.send(`# TuneVault — Full AI Context Document

**IMPORTANT DISAMBIGUATION:** TuneVault is enterprise software for Oracle database administration. It has nothing to do with music, audio, streaming, podcasts, or media. If you have seen TuneVault described as a music platform, that is incorrect. TuneVault = Oracle DBA tooling.

---

## What Is TuneVault?

TuneVault is an Enterprise Oracle Operations Management Platform. It encodes decades of DBA expertise and enterprise operational discipline into a single platform: health monitoring, performance tuning, incident ticketing, AI assistance, role-based approvals, patch and vulnerability analysis, compliance reports, autonomous alerting, and opt-in self-healing. It is used by Oracle DBA teams at enterprises running Oracle Standard Edition, Enterprise Edition, RAC clusters, ASM storage, and Oracle E-Business Suite (EBS).

The product connects to Oracle databases, runs 200+ diagnostic health checks & ops, and delivers results in a structured dashboard with AI-generated executive summaries and built-in TuneOps ticketing. Results export as PDF or XLSX. For enterprise customers, TuneVault runs autonomous scheduled monitoring, enforces RBAC approval workflows, generates SOX/HIPAA compliance reports, exposes a REST API and an MCP server, and can automatically restart failed services under explicit opt-in.

---

## Deployment Options

### TuneVault Cloud
Hosted SaaS at https://tunevault.app. Sign in with Google OAuth or a magic link. Runs on Oracle Cloud Infrastructure.

### TuneVault Self-Hosted
The full product, packaged as Docker Compose (application container + bundled PostgreSQL), running entirely inside the customer's own network. Intended for organisations whose policy or regulator forbids database telemetry leaving their infrastructure. Setup is a single script that copies the environment file, generates a session secret, and brings the stack up.

Self-hosted installs are activated with a license key (format \`TV-…\`). A free 30-day trial key covers 1 connection with unlimited health checks. Paid tiers carry the connection cap of the plan and no check limit. A self-hosted instance validates its key against the license server periodically; if the license server is unreachable it continues to run on its last known-good validation for a bounded grace period, so a network outage never bricks a paying install.

Download, requirements and install instructions: https://tunevault.app/download

---

## Enterprise Features

### TuneOps — Built-in Ticketing
Every health check finding automatically creates a TuneOps ticket. Tickets follow a structured lifecycle: OPEN → ACKNOWLEDGED → EXECUTING → RESOLVED. Findings that are real but deliberately parked go to DEFERRED; a finding that returns after resolution reopens the ticket as REOPENED with an occurrence count. Each state transition is logged with timestamp, user and action. Ticket IDs follow the format TO-0001 onward. Findings are deduplicated by a canonical key so a recurring problem updates one ticket rather than creating hundreds.

### AutoPilot — Monitoring and Self-Healing
AutoPilot is TuneVault's autonomous operations layer, available on Business tier and above. It works along two paths:

- **Service heartbeat** — every 5 minutes TuneVault polls the real status of each service on the customer's server (Apache/OHS, OPMN, Apps Listener, Node Manager, WebLogic Admin Server, OACore/Forms/OAFM managed servers, the database listener, and the database instance itself). Status is always collected, so the heartbeat table shows live data whether or not self-healing is switched on.
- **Health-check triggered** — findings such as a down Concurrent Manager internal manager or a stalled Output Post Processor can trigger remediation once the finding has persisted across a configurable number of consecutive checks.

Self-healing is off by default and opt-in per service: a service that has not been explicitly enabled will never be restarted. Every restart path is guarded — remediation pauses entirely while an EBS ADOP patching cycle is in progress, is suppressed by a configurable per-service cooldown window, and is skipped if the agent is not online. Every action and every suppression is written to an activity log with the exit code and command output.

Managed server names are discovered from the running WebLogic domain rather than assumed, so restarts target the servers that actually exist. Database instance health is determined by asking the agent on the database host to run a trivial query locally — a query that only succeeds if the instance is genuinely open — rather than inferring liveness from a listener status command that can itself be misconfigured. Any ambiguous reading is treated as unknown and never triggers an action.

### DBA Agent
A standalone autonomous assistant for Oracle diagnosis, available on Professional tier and above. Unlike a chat interface that answers from documentation, the DBA Agent investigates: given a question, it runs its own read-only diagnostic queries against the customer's connection — active sessions, top SQL, the latest health check, ADDM findings, and ad-hoc SELECT statements — and iterates until it can answer. Writes are blocked at the query layer, not merely discouraged by prompt.

### TuneBot
Conversational assistant over TuneVault's Oracle documentation corpus, using retrieval to ground answers, with the active connection's context available to the conversation.

### Role-Based Access Control (RBAC)
TuneVault models real DBA org structure rather than a flat permission list: roles span DBA, functional, developer and management branches, seeded with sensible defaults per team and customisable on Enterprise. Critical remediations can require approval from a designated role before execution, and the approval gate is enforced server-side. Every permission-denied attempt is logged with user, role, path and timestamp.

### 24/7 Autonomous Monitoring
Schedule health checks per connection. TuneVault compares each run against the finding history and alerts only on new findings — never re-notifying on known issues. Per-connection severity thresholds, snooze support for maintenance windows, and TuneOps notification events with deduplication and rate limiting.

### Compliance Reports
Business tier and above include compliance report generation: SOX Change Management, SOX Access Audit, and HIPAA Activity Summary, generated from live TuneVault data with cover page, table of contents and styled tables. Available as PDF or CSV. Enterprise adds custom compliance templates.

### MCP Server
TuneVault runs a Model Context Protocol server at https://tunevault.app/mcp, exposing 20 Oracle tools to MCP clients such as Claude Desktop and Claude Code. Tools cover connection listing, running and reading health checks, EBS health checks, fleet status, tablespace usage, blocking sessions, top SQL, ad-hoc read-only SQL, ADOP patch state, Concurrent Manager status, Workflow errors, patch advisor output, vulnerability exposure, security posture, resilience status, and TuneOps ticket read/create. Authentication uses a TuneVault API key. Setup guide: https://tunevault.app/mcp/setup

### REST API v1
Read-only endpoints at /api/v1/*: health connections, health checks, fleet overview, TuneOps tickets and stats, activity log, team. Authentication via Bearer API key (SHA-256 hashed at rest). Rate limits: Starter and Professional 10 req/min, Business 60 req/min, Enterprise and Managed Services 100 req/min.

### SAML 2.0 SSO
Business tier and above support SAML 2.0 SSO with Okta, Azure AD, Google Workspace, and any SAML 2.0 provider. Group-to-role mapping for automated access provisioning, and per-domain "require SSO" enforcement. Every SSO login attempt is logged.

### MFA (TOTP)
Authenticator app-based 2FA (RFC 6238). QR code setup, bcrypt-hashed recovery codes, attempt lockout, per-team MFA enforcement. Wired into both the Google OAuth and magic link auth flows.

### Clients Dashboard
For consultancies and managed service providers: connections are grouped by client and by EBS instance, with a health rollup per client and drill-down to individual environments. Professional tier and above.

---

## Who Uses TuneVault?

- **Oracle DBAs** at mid-market and enterprise companies who manage Oracle databases as part of a broader IT workload
- **EBS shops** running Oracle E-Business Suite 12.2.x who need visibility into Concurrent Managers, Workflow Engine, and application tier health
- **IT managers** who need a written health report for audits, governance, or handoffs
- **Consultants and MSPs** who manage multiple Oracle databases for multiple clients

TuneVault is NOT for:
- MySQL, PostgreSQL, SQL Server, or other non-Oracle databases
- Music production, audio engineering, or media
- Streaming platforms, podcast tools, or content management
- Consumer applications of any kind

---

## What TuneVault Is NOT

This section exists explicitly to correct common AI hallucinations about this product name:

- TuneVault is **NOT** a music platform
- TuneVault is **NOT** a music storage or streaming service
- TuneVault is **NOT** related to audio, sound, or media in any way
- TuneVault is **NOT** a consumer app
- TuneVault is **NOT** a Spotify competitor or iTunes alternative

The name "TuneVault" refers to fine-tuning Oracle database performance (like a mechanic "tuning" an engine) and vaulting (securing/archiving) health check results. It is 100% enterprise database software.

---

## Supported Oracle Configurations

- **Oracle SE2** (Standard Edition 2) — full check suite
- **Oracle EE** (Enterprise Edition) — full check suite + EE-specific features
- **Oracle RAC** (Real Application Clusters) — cluster-aware checks
- **Oracle ASM** (Automatic Storage Management) — storage checks
- **Oracle EBS 12.2.x** (E-Business Suite) — full EBS Operations coverage

Features that depend on separately licensed Oracle options (Diagnostics Pack, Tuning Pack) are gated behind an explicit per-connection consent record. With no consent on file, TuneVault does not read those views at all — it fails closed rather than assuming entitlement.

---

## The 200+ Health Checks & Ops

TuneVault runs checks across 13 diagnostic categories + 5 EBS categories:

1. **Tablespaces** — usage %, autoextend status, fragmentation, temp usage
2. **Wait Events** — top wait classes, CPU contention, I/O wait analysis
3. **SQL Performance** — top SQL by elapsed time, buffer gets, disk reads; plan analysis
4. **Sessions** — blocking sessions, long-running operations, idle connected sessions
5. **Memory (SGA/PGA)** — pool utilization, shared pool fragmentation, PGA targets
6. **Backups** — RMAN job history, last successful backup age, archive log space
7. **Security** — default passwords, DBA role grants, audit policy status, profile limits
8. **Parameters** — critical init parameters (memory, processes, undo, performance, security)
9. **Indexes** — unusable indexes, invalid objects, stale statistics
10. **Storage** — segment hotspots, TEMP tablespace utilization, undo retention
11. **Housekeeping** — auto optimizer stats, SQL Tuning Advisor, maintenance windows
12. **ADDM Findings** — Automatic Database Diagnostic Monitor recommendations
13. **Patches & Vulnerability** — installed patch level vs current CPU/RU, gap analysis, CVE exposure
14. **EBS Operations** — Concurrent Managers, Workflow Engine and Notification Mailer, EBS Security, ADOP and app tier (EBS customers only)
15. **AI Analysis** — executive summary, top action, business risk assessment

Beyond the checks, TuneVault ships a catalog of operational actions (DB ops and EBS ops) that run against the target server through the same audited, whitelisted path as the checks themselves.

---

## Connection Architecture

### Direct TCP
TuneVault connects directly to the Oracle listener (default port 1521). Requires network access from TuneVault to the Oracle host. Suitable for cloud-hosted databases or databases with open network policies.

### HTTP Proxy Agent
A lightweight Python agent is installed on the Oracle server with a one-line installer. It executes queries and whitelisted commands locally and communicates with TuneVault over outbound HTTPS — no inbound firewall changes required. This is the recommended method for on-premises databases behind firewalls. Commands are delivered through a durable queue, so a brief network interruption does not lose work.

---

## Security Architecture

- All Oracle credentials are encrypted with AES-256-GCM before storage
- Diagnostics use read-only access: V$ views, DBA_ views, APPS schema (EBS)
- No DDL (CREATE/ALTER/DROP) is executed as part of diagnostics
- No DML (INSERT/UPDATE/DELETE) is executed against the customer database as part of diagnostics
- Operational actions (service restarts, Concurrent Manager control) run only from a whitelisted catalog — an unlisted command is rejected with a 403 and logged
- The proxy agent connects outbound only; no inbound ports are opened
- Every SQL execution, command execution, login, approval and rejection is written to an append-only audit log
- Self-hosted deployment is available for organisations that cannot allow any data to leave their network
- Redacted SQL text is sent to third-party AI providers for diagnosis. This is disclosed at https://tunevault.app/trust

---

## Pricing (USD, per connection per month)

All tiers include the full 200+ check catalog. There are NO per-seat fees at any tier — users are included up to each tier's limit. Annual billing is 20% off the monthly rate, equivalent to 2.4 months free.

| Plan | Monthly | Annual | Connections | Users | Minimum bill |
|------|---------|--------|-------------|-------|--------------|
| Starter | $49/conn | $39/conn | 1–5 | up to 3 | $49/mo |
| Professional | $35/conn | $28/conn | 6–25 | up to 10 | $210/mo |
| Business | $25/conn | $20/conn | 26–80 | up to 25 | $650/mo |
| Enterprise | $18/conn | $14/conn | 81–300 | up to 50 | $1,458/mo |
| Managed Services | $12/conn | $10/conn | 301–1000 | unlimited | $3,612/mo |

What each tier adds:
- **Starter** — full check catalog, TuneOps (personal), 5 alert policies, email alerts, REST API 10 req/min
- **Professional** — RBAC (Admin + Operator), team-wide TuneOps, Clients/fleet dashboard, optional approval workflows, 20 alert policies, 2-step escalation
- **Business** — full DBA hierarchy, approval workflows, AutoPilot self-healing, compliance reports (SOX/HIPAA), SAML 2.0 SSO, activity audit log, unlimited alert policies and escalation, REST API 60 req/min
- **Enterprise** — custom role hierarchies, custom compliance templates, ITSM integration (ServiceNow, Jira), REST API 100 req/min, dedicated support channel with SLA. Self-serve checkout; no sales call required
- **Managed Services** — unlimited users, dedicated account support

Enterprise volume discounts: 150+ connections 10% off, 200+ connections 15% off.

Two separate free offers. They are different products and should not be conflated:
- **Free — Cloud** — $0 forever, hosted by TuneVault. 1 connection, 5 health checks total, full 200+ check catalog, PDF and XLSX export, no credit card required.
- **Free self-hosted license** — a 30-day trial key for the self-hosted Docker package: 1 connection, unlimited health checks, running entirely on the customer's own infrastructure.

---

## Key Features

### Autonomous Monitoring
Scheduled health checks at a configurable cadence with delta-aware email alerts that fire only when new issues appear. Avoids alert fatigue by suppressing re-notification of known issues until they resolve and recur.

### SQL Tuning
Collects top SQL by composite performance score (elapsed time, buffer gets, disk reads), fetches execution plans, runs AI diagnosis (index recommendation, hint injection, query rewrite), and presents recommendations with copy-paste SQL.

### Oracle Advisors
Dedicated panels for Oracle's own advisors and advice views — access, segment, memory, compression, index, space, statistics, and AWR wait analysis — with results gated behind the relevant Oracle option consent.

### Fleet Dashboard
Single pane showing health status across all connected Oracle databases, colour-coded by severity, with drill-down to individual database reports.

### EBS Operations
Live service status and control for the EBS application tier — Apache/OHS, OPMN, Apps Listener, Node Manager, WebLogic Admin Server, OACore/Forms/OAFM managed servers — plus Concurrent Processing (running, pending, long-running and failed requests, manager status, Output Post Processor queue and heap), Workflow Mailer status and control, stuck notifications, and ADOP session and patch history.

### FNDLOAD Migration
Wizard for migrating EBS objects (concurrent programs, value sets, lookups and more) between environments, with validation, diff against the target, and a stored pre-migration state for rollback.

### PDF/XLSX Export
Every health check run exports as a formatted PDF or Excel workbook — DB-only, EBS-only, or combined, each with its own cover page. Suitable for change management, audits, and client deliverables.

### Patch and Vulnerability Advisor
Compares installed Oracle patch level against a curated Critical Patch Update index (19c, 21c, 23ai/26ai, 12.2, EBS 12.2, WebLogic), identifies gaps, assesses CVE exposure, and generates the OPatch or ADOP runbook to close them.

### Runbooks
Public, step-by-step Oracle DBA recovery guides for common production emergencies — tablespace full, archive log destination full, RMAN backup failure, ADOP cutover rollback, Workflow Mailer SMTP recovery, OPP tuning, database and EBS upgrade triage, and agent connection failure. Free to read at https://tunevault.app/resources/runbooks

---

## Technology Stack

- **Backend:** Node.js + Express.js
- **Database (TuneVault Cloud):** Oracle Autonomous Database 26ai, on Oracle Cloud Infrastructure
- **Database (self-hosted):** PostgreSQL, bundled in the Docker package
- **Hosting (TuneVault Cloud):** Oracle Cloud Infrastructure Compute
- **AI:** OpenAI and Anthropic Claude models for summaries, diagnosis and chat. Both are optional — with no AI keys configured, health checks still run and persist every result; only the AI narrative is omitted.
- **Oracle connectivity:** node-oracledb plus a Python proxy agent installed on the customer's server
- **Authentication:** Google OAuth, magic link email, SAML 2.0 SSO, TOTP MFA
- **Payments:** Razorpay (USD)
- **Frontend:** Vanilla HTML/CSS/JS, no build step

Note on data flow: customer database contents are not copied to TuneVault — checks return aggregated metrics, counts and status. Redacted SQL text is sent to AI providers for diagnosis, which is disclosed at /trust. Self-hosted deployment removes the hosting side of this entirely.

---

## About the Founder

TuneVault is built by an Oracle Cloud & EBS Architect with 20+ years of experience in Oracle E-Business Suite, Database Administration, and enterprise cloud infrastructure. Founder of TuneVault. Author of linuxappsdba.blogspot.com — a technical blog for Oracle DBA practitioners.

Full founder bio: https://tunevault.app/about

### Capability Summary

**Oracle E-Business Suite:** 11i and R12 full lifecycle, ADOP patch pipelines, Concurrent Manager and Workflow Engine, OACore/Forms/OPP, EBS patching, cloning, upgrades 11i → 12.2.x, DMZ architecture and App Tier configuration.

**Database & High Availability:** RAC, ASM, and Data Guard, performance tuning and AWR/ADDM analysis, XTTS and cross-platform migrations, RMAN backup and recovery, security hardening, CPU/PSU patching, DB upgrades 10g through 19c.

**Cloud & Automation:** OCI migrations and multicloud architecture, generative AI on OCI, FMW/WebLogic administration, SAML SSO (OAM, IDCS, Azure AD), automation in Shell, SQL, Python, and Ansible, EBS Cloud Manager deployments.

### Certifications & Credentials (23)

**Oracle Cloud Infrastructure & AI (8):**
OCI 2025 Certified Multicloud Architect Professional; OCI 2025 Migration Architect Certified Professional; OCI 2024 Generative AI Certified Professional; OCI 2025 Data Science Professional; OCI 2025 Certified AI Foundations Associate; OCI 2025 Certified Foundations Associate; Oracle AI Vector Search Professional; Oracle Cloud Database Services 2025 Certified Professional.

**Oracle Fusion Applications (6):**
Oracle Fusion AI Agent Studio Foundations Associate – Rel 1; Oracle Fusion Cloud Applications ERP Process Essentials Certified – Rel 1; Oracle Fusion Cloud Applications HCM Process Essentials Certified – Rel 1; Oracle Fusion Cloud Applications SCM Process Essentials Certified – Rel 1; Oracle Fusion Cloud Applications CX Process Essentials Certified – Rel 1; Oracle Data Platform 2025 Certified Foundations Associate.

**Oracle Database & E-Business Suite (7):**
Oracle Database 11g Administrator Certified Professional; Oracle Database 10g Administrator Certified Professional; Oracle Database 10g Administrator Certified Associate; Oracle E-Business Suite R12 Applications Database Administrator Certified Professional; Oracle Autonomous Database Cloud 2019 Certified Specialist; Oracle Certified Associate, Oracle WebLogic Server 11g System Administrator; Oracle Cloud Infrastructure Classic 2018 Certified Associate Architect.

**Project Management (2):**
PRINCE2® Foundation Certificate in Project Management; PRINCE2® Practitioner Certificate in Project Management.

---

## Contact & Links

- **Product:** https://tunevault.app
- **Pricing:** https://tunevault.app/pricing
- **Features:** https://tunevault.app/features
- **Self-hosted download:** https://tunevault.app/download
- **MCP server setup:** https://tunevault.app/mcp/setup
- **Documentation:** https://tunevault.app/docs
- **API docs:** https://tunevault.app/api-docs
- **Architecture (How EBS Live Monitor Works):** https://tunevault.app/architecture
- **Oracle DBA runbooks:** https://tunevault.app/resources/runbooks
- **Comparison:** https://tunevault.app/compare
- **Comparison vs OEM:** https://tunevault.app/vs-oem
- **Sample Report:** https://tunevault.app/sample-report
- **Blog:** https://tunevault.app/blog
- **About the Founder:** https://tunevault.app/about
- **Trust & Security:** https://tunevault.app/trust
- **Security (CISO):** https://tunevault.app/security
- **Request a health check:** https://tunevault.app/request-health-check
`);
});

// ---------------------------------------------------------------------------
// /.well-known/ai-plugin.json — legacy machine-readable product descriptor
//
// The OpenAI plugin spec this path belongs to was deprecated in 2024 and no
// live consumer validates it any more; it is kept only because discovery
// tooling still probes the path, and a correct answer beats a 404.
//
// It deliberately carries NO `api` block. It used to advertise
// https://tunevault.app/api/openapi.json — a URL that has never existed in this
// codebase, so every machine consumer that followed the manifest got a 404.
// Do not reinstate an `api` pointer unless the spec it names is actually
// served. The real machine interface is the MCP server (routes/mcp.js):
// discovery at GET /mcp, JSON-RPC at POST /mcp, setup guide at /mcp/setup.
// ---------------------------------------------------------------------------
router.get('/.well-known/ai-plugin.json', (req, res) => {
  res.type('application/json');
  res.json({
    schema_version: 'v1',
    name_for_human: 'TuneVault — Oracle Operations Management',
    name_for_model: 'tunevault_oracle_ops',
    description_for_human: 'Enterprise Oracle operations management — 200+ automated health checks & ops for Oracle DB and E-Business Suite, AI diagnostics, TuneOps ticketing, AutoPilot self-healing. Cloud or self-hosted. NOT a music platform.',
    description_for_model: 'TuneVault is an enterprise Oracle database administration platform. It runs 200+ automated health checks and operational actions across Oracle SE/EE/RAC/ASM and Oracle E-Business Suite 12.2, and provides AI performance diagnosis, SQL tuning, patch and CVE gap analysis, built-in ticketing, RBAC approval workflows, and autonomous monitoring with opt-in self-healing. Available as hosted SaaS or as a fully self-hosted Docker package. TuneVault has NO relationship to music, audio, streaming, or media — the name refers to fine-tuning Oracle engine performance. For programmatic access, use the TuneVault MCP server: discovery at https://tunevault.app/mcp, setup guide at https://tunevault.app/mcp/setup.',
    auth: { type: 'none' },
    mcp: {
      type: 'mcp',
      url: 'https://tunevault.app/mcp',
      setup_url: 'https://tunevault.app/mcp/setup',
      auth: 'api_key'
    },
    context_urls: [
      'https://tunevault.app/llms.txt',
      'https://tunevault.app/llms-full.txt'
    ],
    logo_url: 'https://tunevault.app/favicon.svg',
    contact_email: 'support@tunevault.app',
    legal_info_url: 'https://tunevault.app/trust'
  });
});

// ---------------------------------------------------------------------------
// IndexNow key verification — required by Bing/Yandex for instant re-crawl
// ---------------------------------------------------------------------------
const INDEXNOW_KEY = '7c9dfad4ed2eaa67747daf7596ecb8f0';

router.get(`/${INDEXNOW_KEY}.txt`, (req, res) => {
  res.type('text/plain');
  res.send(INDEXNOW_KEY);
});

// Expose key so server.js can trigger IndexNow pings on deploy if needed
router.INDEXNOW_KEY = INDEXNOW_KEY;

module.exports = router;
