@bettercms-ai/db 0.11.0 → 0.12.0

package/dist/index.js

@@ -11654,18 +11654,18 @@ var require_common = __commonJS({
           if (typeof args[0] !== "string") {
             args.unshift("%O");
           }
-          let index111 = 0;
+          let index113 = 0;
           args[0] = args[0].replace(/%([a-zA-Z%])/g, (match, format) => {
             if (match === "%%") {
               return "%";
             }
-            index111++;
+            index113++;
             const formatter = createDebug.formatters[format];
             if (typeof formatter === "function") {
-              const val = args[index111];
+              const val = args[index113];
               match = formatter.call(self2, val);
-              args.splice(index111, 1);
-              index111--;
+              args.splice(index113, 1);
+              index113--;
             }
             return match;
           });
@@ -11901,15 +11901,15 @@ var require_browser = __commonJS({
       }
       const c = "color: " + this.color;
       args.splice(1, 0, c, "color: inherit");
-      let index111 = 0;
+      let index113 = 0;
       let lastC = 0;
       args[0].replace(/%[a-zA-Z%]/g, (match) => {
         if (match === "%%") {
           return;
         }
-        index111++;
+        index113++;
         if (match === "%c") {
-          lastC = index111;
+          lastC = index113;
         }
       });
       args.splice(lastC, 0, c);
@@ -14470,10 +14470,10 @@ var require_axios = __commonJS({
             value = stringifyWithDepthLimit(value, 1);
           } else if (utils$1.isArray(value) && isFlatArray(value) || (utils$1.isFileList(value) || utils$1.endsWith(key, "[]")) && (arr = utils$1.toArray(value))) {
             key = removeBrackets(key);
-            arr.forEach(function each(el, index111) {
+            arr.forEach(function each(el, index113) {
               !(utils$1.isUndefined(el) || el === null) && formData.append(
                 // eslint-disable-next-line no-nested-ternary
-                indexes === true ? renderKey([key], index111, dots) : indexes === null ? key : key + "[]",
+                indexes === true ? renderKey([key], index113, dots) : indexes === null ? key : key + "[]",
                 convertValue(el)
               );
             });
@@ -14774,9 +14774,9 @@ var require_axios = __commonJS({
       });
     }
     var MAX_DEPTH = DEFAULT_FORM_DATA_MAX_DEPTH;
-    function throwIfDepthExceeded(index111) {
-      if (index111 > MAX_DEPTH) {
-        throw new AxiosError("FormData field is too deeply nested (" + index111 + " levels). Max depth: " + MAX_DEPTH, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED);
+    function throwIfDepthExceeded(index113) {
+      if (index113 > MAX_DEPTH) {
+        throw new AxiosError("FormData field is too deeply nested (" + index113 + " levels). Max depth: " + MAX_DEPTH, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED);
       }
     }
     function parsePropPath(name) {
@@ -14802,12 +14802,12 @@ var require_axios = __commonJS({
       return obj;
     }
     function formDataToJSON(formData) {
-      function buildPath(path2, value, target, index111) {
-        throwIfDepthExceeded(index111);
-        let name = path2[index111++];
+      function buildPath(path2, value, target, index113) {
+        throwIfDepthExceeded(index113);
+        let name = path2[index113++];
         if (name === "__proto__") return true;
         const isNumericKey = Number.isFinite(+name);
-        const isLast = index111 >= path2.length;
+        const isLast = index113 >= path2.length;
         name = !name && utils$1.isArray(target) ? target.length : name;
         if (isLast) {
           if (utils$1.hasOwnProp(target, name)) {
@@ -14820,7 +14820,7 @@ var require_axios = __commonJS({
         if (!utils$1.hasOwnProp(target, name) || !utils$1.isObject(target[name])) {
           target[name] = [];
         }
-        const result = buildPath(path2, value, target[name], index111);
+        const result = buildPath(path2, value, target[name], index113);
         if (result && utils$1.isArray(target[name])) {
           target[name] = arrayToObject(target[name]);
         }
@@ -15489,20 +15489,20 @@ var require_axios = __commonJS({
       if (parts[0] !== "127") return false;
       return parts.every((p) => /^\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255);
     };
-    var parseIPv4Octet = (text128) => {
-      if (/^0[xX][0-9a-fA-F]+$/.test(text128)) {
-        const n = parseInt(text128.slice(2), 16);
+    var parseIPv4Octet = (text130) => {
+      if (/^0[xX][0-9a-fA-F]+$/.test(text130)) {
+        const n = parseInt(text130.slice(2), 16);
         return Number.isFinite(n) ? n : null;
       }
-      if (text128.length > 1 && /^0[0-7]+$/.test(text128)) {
-        const n = parseInt(text128, 8);
+      if (text130.length > 1 && /^0[0-7]+$/.test(text130)) {
+        const n = parseInt(text130, 8);
         return Number.isFinite(n) ? n : null;
       }
-      if (text128.length > 1 && /^0[0-9]+$/.test(text128)) {
+      if (text130.length > 1 && /^0[0-9]+$/.test(text130)) {
         return null;
       }
-      if (/^[0-9]+$/.test(text128)) {
-        const n = parseInt(text128, 10);
+      if (/^[0-9]+$/.test(text130)) {
+        const n = parseInt(text130, 10);
         return Number.isFinite(n) ? n : null;
       }
       return null;
@@ -15840,12 +15840,12 @@ var require_axios = __commonJS({
       };
     }
     function throttle(fn, freq) {
-      let timestamp119 = 0;
+      let timestamp121 = 0;
       let threshold = 1e3 / freq;
       let lastArgs;
       let timer;
       const invoke = (args, now = Date.now()) => {
-        timestamp119 = now;
+        timestamp121 = now;
         lastArgs = null;
         if (timer) {
           clearTimeout(timer);
@@ -15855,7 +15855,7 @@ var require_axios = __commonJS({
       };
       const throttled = (...args) => {
         const now = Date.now();
-        const passed = now - timestamp119;
+        const passed = now - timestamp121;
         if (passed >= threshold) {
           invoke(args, now);
         } else {
@@ -18242,9 +18242,9 @@ var require_axios = __commonJS({
         if (!this._listeners) {
           return;
         }
-        const index111 = this._listeners.indexOf(listener);
-        if (index111 !== -1) {
-          this._listeners.splice(index111, 1);
+        const index113 = this._listeners.indexOf(listener);
+        if (index113 !== -1) {
+          this._listeners.splice(index113, 1);
         }
       }
       toAbortSignal() {
@@ -21914,6 +21914,8 @@ var require_Typesense = __commonJS({
 // src/schema/_index.ts
 var index_exports = {};
 __export(index_exports, {
+  BINDING_DECISION_OPS: () => BINDING_DECISION_OPS,
+  BINDING_DECISION_STATES: () => BINDING_DECISION_STATES,
   BUILD_TRIGGER_KINDS: () => BUILD_TRIGGER_KINDS,
   CONTENT_LOCK_MODES: () => CONTENT_LOCK_MODES,
   CONTENT_LOCK_TARGET_KINDS: () => CONTENT_LOCK_TARGET_KINDS,
@@ -21983,6 +21985,7 @@ __export(index_exports, {
   billingAddons: () => billingAddons,
   billingAlerts: () => billingAlerts,
   billingCustomers: () => billingCustomers,
+  bindingDecisions: () => bindingDecisions,
   branchColumns: () => branchColumns,
   branchPreviewGrants: () => branchPreviewGrants,
   branchPreviewShares: () => branchPreviewShares,
@@ -22031,6 +22034,7 @@ __export(index_exports, {
   deployTargets: () => deployTargets,
   deviceAuthorizations: () => deviceAuthorizations,
   emailSuppressions: () => emailSuppressions,
+  entrySlotModels: () => entrySlotModels,
   externalDeployments: () => externalDeployments,
   folders: () => folders,
   foldersRelations: () => foldersRelations,
@@ -23362,6 +23366,10 @@ var projects = pgTable10(
     // deploy-pass deploys under /srv/bcms/<subdomain>. Unique index + LDH check live
     // in migration 0036 (applied via setup-db). NULL = no staging site yet.
     subdomain: varchar10("subdomain", { length: 63 }),
+    // The staging name the owner chose: <alias>.bettercms.site serves the same site as the
+    // handle, which never changes (it keys the release dirs, R2 pointers and runtimes).
+    // Unique across live projects, and never equal to any handle — both enforced in 0468.
+    subdomainAlias: varchar10("subdomain_alias", { length: 63 }),
     // Site access visibility (FLO-159): 'workspace' = every workspace member can view
     // (default = legacy behaviour); 'restricted' = only workspace owners/admins and
     // explicitly-added project_members. See src/lib/auth/project-access.ts.
@@ -27049,50 +27057,78 @@ var savedBlocks = pgTable86(
   (t) => [index73("saved_blocks_project_idx").on(t.workspaceId, t.projectId, t.createdAt)]
 );
 
+// src/schema/entry_slot_models.ts
+import { index as index74, integer as integer41, jsonb as jsonb47, pgTable as pgTable87, primaryKey as primaryKey8, real as real2, text as text88, timestamp as timestamp80, varchar as varchar64 } from "drizzle-orm/pg-core";
+var entrySlotModels = pgTable87(
+  "entry_slot_models",
+  {
+    workspaceId: text88("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text88("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    releaseSha: text88("release_sha").notNull(),
+    templateSig: text88("template_sig").notNull(),
+    path: text88("path").notNull(),
+    /** The collection's name as the catalog spells it (its page slug). */
+    collectionId: text88("collection_id").notNull(),
+    slotKey: text88("slot_key").notNull(),
+    /** The display function (`Fx`, @bettercms-ai/entry-bind). */
+    fx: jsonb47("fx").$type().notNull(),
+    support: integer41("support").notNull(),
+    conf: real2("conf").notNull(),
+    /** `induced` | `declared` | `guest` | `override` (CHECK in the migration). */
+    source: varchar64("source", { length: 16 }).notNull(),
+    createdBy: text88("created_by").references(() => users.id, { onDelete: "set null" }),
+    createdAt: timestamp80("created_at").notNull().defaultNow()
+  },
+  (t) => [
+    primaryKey8({ name: "entry_slot_models_pkey", columns: [t.projectId, t.releaseSha, t.templateSig, t.path] }),
+    index74("entry_slot_models_project_sha_idx").on(t.workspaceId, t.projectId, t.releaseSha)
+  ]
+);
+
 // src/schema/content_model_versions.ts
-import { index as index74, integer as integer41, jsonb as jsonb47, pgTable as pgTable87, text as text88, timestamp as timestamp80 } from "drizzle-orm/pg-core";
-var contentModelVersions = pgTable87(
+import { index as index75, integer as integer42, jsonb as jsonb48, pgTable as pgTable88, text as text89, timestamp as timestamp81 } from "drizzle-orm/pg-core";
+var contentModelVersions = pgTable88(
   "content_model_versions",
   {
-    id: text88("id").primaryKey(),
-    workspaceId: text88("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    modelId: text88("model_id").notNull().references(() => contentModels.id, { onDelete: "cascade" }),
-    version: integer41("version").notNull(),
+    id: text89("id").primaryKey(),
+    workspaceId: text89("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    modelId: text89("model_id").notNull().references(() => contentModels.id, { onDelete: "cascade" }),
+    version: integer42("version").notNull(),
     /** The model as written. @see ContentModelSnapshot */
-    snapshot: jsonb47("snapshot").$type().notNull(),
+    snapshot: jsonb48("snapshot").$type().notNull(),
     /** What changed against the state this write replaced. @see ContentModelChangeSummary */
-    summary: jsonb47("summary").$type().notNull().default({}),
-    origin: text88("origin").$type().notNull(),
-    createdBy: text88("created_by").references(() => users.id, { onDelete: "set null" }),
-    createdAt: timestamp80("created_at").notNull().defaultNow()
+    summary: jsonb48("summary").$type().notNull().default({}),
+    origin: text89("origin").$type().notNull(),
+    createdBy: text89("created_by").references(() => users.id, { onDelete: "set null" }),
+    createdAt: timestamp81("created_at").notNull().defaultNow()
   },
-  (t) => [index74("content_model_versions_model_version_idx").on(t.modelId, t.version.desc())]
+  (t) => [index75("content_model_versions_model_version_idx").on(t.modelId, t.version.desc())]
 );
 
 // src/schema/component_variants.ts
 import {
-  pgTable as pgTable88,
-  text as text89,
-  varchar as varchar64,
-  timestamp as timestamp81,
-  jsonb as jsonb48,
-  integer as integer42,
-  index as index75,
+  pgTable as pgTable89,
+  text as text90,
+  varchar as varchar65,
+  timestamp as timestamp82,
+  jsonb as jsonb49,
+  integer as integer43,
+  index as index76,
   unique as unique4,
   uniqueIndex as uniqueIndex37
 } from "drizzle-orm/pg-core";
 import { relations as relations15 } from "drizzle-orm/relations";
 import { sql as sql20 } from "drizzle-orm";
-var componentVariants = pgTable88(
+var componentVariants = pgTable89(
   "component_variants",
   {
-    id: text89("id").primaryKey(),
-    workspaceId: text89("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    componentId: text89("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    name: varchar64("name", { length: 255 }).notNull(),
+    id: text90("id").primaryKey(),
+    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    componentId: text90("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    name: varchar65("name", { length: 255 }).notNull(),
     // `<component-root>-<variant-name>`, e.g. `footer-compact`.
-    key: varchar64("key", { length: 356 }).notNull(),
-    delta: jsonb48("delta").$type().notNull().default({
+    key: varchar65("key", { length: 356 }).notNull(),
+    delta: jsonb49("delta").$type().notNull().default({
       fieldOverrides: [],
       addedProps: [],
       removedFieldKeys: [],
@@ -27100,13 +27136,13 @@ var componentVariants = pgTable88(
       valueOverrides: {},
       addedBlocks: []
     }),
-    publishedDelta: jsonb48("published_delta").$type(),
-    status: varchar64("status", { length: 20 }).$type().notNull().default("draft"),
-    publishedAt: timestamp81("published_at"),
-    optimisticVersion: integer42("optimistic_version").notNull().default(0),
-    createdAt: timestamp81("created_at").notNull().defaultNow(),
-    updatedAt: timestamp81("updated_at").notNull().defaultNow(),
-    deletedAt: timestamp81("deleted_at")
+    publishedDelta: jsonb49("published_delta").$type(),
+    status: varchar65("status", { length: 20 }).$type().notNull().default("draft"),
+    publishedAt: timestamp82("published_at"),
+    optimisticVersion: integer43("optimistic_version").notNull().default(0),
+    createdAt: timestamp82("created_at").notNull().defaultNow(),
+    updatedAt: timestamp82("updated_at").notNull().defaultNow(),
+    deletedAt: timestamp82("deleted_at")
   },
   (table) => [
     unique4("component_variants_id_workspace_component_unique").on(
@@ -27114,8 +27150,8 @@ var componentVariants = pgTable88(
       table.workspaceId,
       table.componentId
     ),
-    index75("component_variants_workspace_idx").on(table.workspaceId),
-    index75("component_variants_component_idx").on(table.componentId),
+    index76("component_variants_workspace_idx").on(table.workspaceId),
+    index76("component_variants_component_idx").on(table.componentId),
     uniqueIndex37("component_variants_component_key_unique").on(table.componentId, table.key).where(sql20`${table.deletedAt} IS NULL`)
   ]
 );
@@ -27134,37 +27170,37 @@ var componentVariantsRelations = relations15(componentVariants, ({ one }) => ({
 import {
   bigint as bigint4,
   foreignKey as foreignKey6,
-  index as index76,
-  integer as integer43,
-  jsonb as jsonb49,
-  pgTable as pgTable89,
-  text as text90,
-  timestamp as timestamp82,
+  index as index77,
+  integer as integer44,
+  jsonb as jsonb50,
+  pgTable as pgTable90,
+  text as text91,
+  timestamp as timestamp83,
   unique as unique5,
   uniqueIndex as uniqueIndex38,
   uuid as uuid2,
-  varchar as varchar65
+  varchar as varchar66
 } from "drizzle-orm/pg-core";
 import { sql as sql21 } from "drizzle-orm";
-var componentImplementationCandidates = pgTable89(
+var componentImplementationCandidates = pgTable90(
   "component_implementation_candidates",
   {
-    id: text90("id").primaryKey(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    componentId: text90("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    variantGroupId: text90("variant_group_id"),
-    familyKey: text90("family_key").notNull(),
-    familyContractHash: varchar65("family_contract_hash", { length: 64 }).notNull(),
+    id: text91("id").primaryKey(),
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    componentId: text91("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    variantGroupId: text91("variant_group_id"),
+    familyKey: text91("family_key").notNull(),
+    familyContractHash: varchar66("family_contract_hash", { length: 64 }).notNull(),
     // Exact value-bearing family contract. Unlike `contract.canonicalInputs` (the
     // renderer/schema projection), this snapshot deliberately retains defaults because it
     // becomes the immutable public-input source pinned by each published variant.
-    familyContract: jsonb49("family_contract").$type(),
-    schemaHash: varchar65("schema_hash", { length: 64 }).notNull(),
-    brandContractHash: varchar65("brand_contract_hash", { length: 64 }).notNull(),
-    contract: jsonb49("contract").$type().notNull(),
-    createdBy: text90("created_by"),
-    createdAt: timestamp82("created_at").notNull().defaultNow()
+    familyContract: jsonb50("family_contract").$type(),
+    schemaHash: varchar66("schema_hash", { length: 64 }).notNull(),
+    brandContractHash: varchar66("brand_contract_hash", { length: 64 }).notNull(),
+    contract: jsonb50("contract").$type().notNull(),
+    createdBy: text91("created_by"),
+    createdAt: timestamp83("created_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey6({
@@ -27183,26 +27219,26 @@ var componentImplementationCandidates = pgTable89(
       table.familyContractHash
     ).where(sql21`${table.familyContract} IS NOT NULL`),
     unique5("component_implementation_candidate_scope_unique").on(table.id, table.projectId, table.componentId),
-    index76("component_implementation_candidates_component_idx").on(table.projectId, table.componentId)
+    index77("component_implementation_candidates_component_idx").on(table.projectId, table.componentId)
   ]
 );
-var componentFamilyManifests = pgTable89(
+var componentFamilyManifests = pgTable90(
   "component_family_manifests",
   {
-    id: text90("id").primaryKey(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    familyKey: text90("family_key").notNull(),
-    familyContractHash: varchar65("family_contract_hash", { length: 64 }).notNull(),
-    familyContract: jsonb49("family_contract").$type(),
-    commitSha: varchar65("commit_sha", { length: 64 }).notNull(),
-    adapterHash: varchar65("adapter_hash", { length: 64 }).notNull(),
-    manifestHash: varchar65("manifest_hash", { length: 64 }).notNull(),
-    previewOrigin: text90("preview_origin").notNull(),
-    nativeViewports: jsonb49("native_viewports").$type().notNull(),
-    adapter: jsonb49("adapter").$type().notNull(),
-    createdBy: text90("created_by"),
-    createdAt: timestamp82("created_at").notNull().defaultNow()
+    id: text91("id").primaryKey(),
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    familyKey: text91("family_key").notNull(),
+    familyContractHash: varchar66("family_contract_hash", { length: 64 }).notNull(),
+    familyContract: jsonb50("family_contract").$type(),
+    commitSha: varchar66("commit_sha", { length: 64 }).notNull(),
+    adapterHash: varchar66("adapter_hash", { length: 64 }).notNull(),
+    manifestHash: varchar66("manifest_hash", { length: 64 }).notNull(),
+    previewOrigin: text91("preview_origin").notNull(),
+    nativeViewports: jsonb50("native_viewports").$type().notNull(),
+    adapter: jsonb50("adapter").$type().notNull(),
+    createdBy: text91("created_by"),
+    createdAt: timestamp83("created_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey6({
@@ -27214,47 +27250,47 @@ var componentFamilyManifests = pgTable89(
     unique5("component_family_manifests_id_project_unique").on(table.id, table.projectId),
     unique5("component_family_manifests_evidence_unique").on(table.id, table.projectId, table.manifestHash),
     uniqueIndex38("component_family_manifest_tuple_unique").on(table.projectId, table.familyKey, table.manifestHash),
-    index76("component_family_manifests_family_idx").on(table.projectId, table.familyKey, table.createdAt)
+    index77("component_family_manifests_family_idx").on(table.projectId, table.familyKey, table.createdAt)
   ]
 );
-var componentImplementationRequests = pgTable89(
+var componentImplementationRequests = pgTable90(
   "component_implementation_requests",
   {
-    id: text90("id").primaryKey(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    componentId: text90("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    candidateId: text90("candidate_id").notNull(),
-    componentVersion: integer43("component_version").notNull(),
-    provider: varchar65("provider", { length: 20 }).$type().notNull(),
-    status: varchar65("status", { length: 20 }).$type().notNull(),
-    familyKey: text90("family_key").notNull(),
-    familyContractHash: varchar65("family_contract_hash", { length: 64 }).notNull(),
-    schemaHash: varchar65("schema_hash", { length: 64 }).notNull(),
-    brandContractHash: varchar65("brand_contract_hash", { length: 64 }).notNull(),
-    dependenciesHash: varchar65("dependencies_hash", { length: 64 }).notNull(),
-    commitSha: varchar65("commit_sha", { length: 64 }),
-    adapterHash: varchar65("adapter_hash", { length: 64 }),
-    familyManifestHash: varchar65("family_manifest_hash", { length: 64 }),
-    previewOrigin: text90("preview_origin"),
-    nativeViewports: jsonb49("native_viewports").$type(),
-    adapter: jsonb49("adapter").$type(),
-    providerProvenance: jsonb49("provider_provenance").$type(),
-    claimedByApiKeyId: text90("claimed_by_api_key_id"),
-    claimCredentialHash: varchar65("claim_credential_hash", { length: 64 }),
-    claimCredentialExpiresAt: timestamp82("claim_credential_expires_at", { withTimezone: true }),
-    claimCredentialConsumedAt: timestamp82("claim_credential_consumed_at", { withTimezone: true }),
-    completionHash: varchar65("completion_hash", { length: 64 }),
-    evidenceId: text90("evidence_id"),
-    errorCode: text90("error_code"),
-    errorMessage: text90("error_message"),
-    requestedBy: text90("requested_by"),
-    createdAt: timestamp82("created_at", { withTimezone: true }).notNull().defaultNow(),
-    expiresAt: timestamp82("expires_at", { withTimezone: true }).notNull(),
-    claimedAt: timestamp82("claimed_at", { withTimezone: true }),
-    completedAt: timestamp82("completed_at", { withTimezone: true }),
-    failedAt: timestamp82("failed_at", { withTimezone: true }),
-    updatedAt: timestamp82("updated_at", { withTimezone: true }).notNull().defaultNow()
+    id: text91("id").primaryKey(),
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    componentId: text91("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    candidateId: text91("candidate_id").notNull(),
+    componentVersion: integer44("component_version").notNull(),
+    provider: varchar66("provider", { length: 20 }).$type().notNull(),
+    status: varchar66("status", { length: 20 }).$type().notNull(),
+    familyKey: text91("family_key").notNull(),
+    familyContractHash: varchar66("family_contract_hash", { length: 64 }).notNull(),
+    schemaHash: varchar66("schema_hash", { length: 64 }).notNull(),
+    brandContractHash: varchar66("brand_contract_hash", { length: 64 }).notNull(),
+    dependenciesHash: varchar66("dependencies_hash", { length: 64 }).notNull(),
+    commitSha: varchar66("commit_sha", { length: 64 }),
+    adapterHash: varchar66("adapter_hash", { length: 64 }),
+    familyManifestHash: varchar66("family_manifest_hash", { length: 64 }),
+    previewOrigin: text91("preview_origin"),
+    nativeViewports: jsonb50("native_viewports").$type(),
+    adapter: jsonb50("adapter").$type(),
+    providerProvenance: jsonb50("provider_provenance").$type(),
+    claimedByApiKeyId: text91("claimed_by_api_key_id"),
+    claimCredentialHash: varchar66("claim_credential_hash", { length: 64 }),
+    claimCredentialExpiresAt: timestamp83("claim_credential_expires_at", { withTimezone: true }),
+    claimCredentialConsumedAt: timestamp83("claim_credential_consumed_at", { withTimezone: true }),
+    completionHash: varchar66("completion_hash", { length: 64 }),
+    evidenceId: text91("evidence_id"),
+    errorCode: text91("error_code"),
+    errorMessage: text91("error_message"),
+    requestedBy: text91("requested_by"),
+    createdAt: timestamp83("created_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp83("expires_at", { withTimezone: true }).notNull(),
+    claimedAt: timestamp83("claimed_at", { withTimezone: true }),
+    completedAt: timestamp83("completed_at", { withTimezone: true }),
+    failedAt: timestamp83("failed_at", { withTimezone: true }),
+    updatedAt: timestamp83("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey6({
@@ -27269,35 +27305,35 @@ var componentImplementationRequests = pgTable89(
     }).onDelete("cascade"),
     unique5("component_implementation_requests_scope_unique").on(table.id, table.projectId, table.componentId),
     uniqueIndex38("component_implementation_requests_active_unique").on(table.projectId, table.componentId).where(sql21`${table.status} IN ('pending', 'claimed')`),
-    index76("component_implementation_requests_claimable_idx").on(table.projectId, table.status, table.expiresAt, table.createdAt)
+    index77("component_implementation_requests_claimable_idx").on(table.projectId, table.status, table.expiresAt, table.createdAt)
   ]
 );
-var componentImplementationEvidence = pgTable89(
+var componentImplementationEvidence = pgTable90(
   "component_implementation_evidence",
   {
-    id: text90("id").primaryKey(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    componentId: text90("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    candidateId: text90("candidate_id").notNull(),
-    familyManifestId: text90("family_manifest_id").notNull(),
-    familyManifestHash: varchar65("family_manifest_hash", { length: 64 }).notNull(),
-    variantBindingHash: varchar65("variant_binding_hash", { length: 64 }).notNull(),
-    variantBinding: jsonb49("variant_binding").$type().notNull(),
-    requestId: text90("request_id"),
-    schemaHash: varchar65("schema_hash", { length: 64 }).notNull(),
-    brandContractHash: varchar65("brand_contract_hash", { length: 64 }).notNull(),
-    commitSha: varchar65("commit_sha", { length: 64 }).notNull(),
-    adapterHash: varchar65("adapter_hash", { length: 64 }).notNull(),
-    previewOrigin: text90("preview_origin").notNull(),
-    nativeViewports: jsonb49("native_viewports").$type().notNull(),
-    adapter: jsonb49("adapter").$type().notNull(),
-    status: varchar65("status", { length: 20 }).$type().notNull(),
-    checks: jsonb49("checks").$type().notNull(),
-    evidenceDigest: varchar65("evidence_digest", { length: 128 }).notNull(),
-    evidenceTupleHash: varchar65("evidence_tuple_hash", { length: 64 }).notNull(),
-    createdBy: text90("created_by"),
-    createdAt: timestamp82("created_at").notNull().defaultNow()
+    id: text91("id").primaryKey(),
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    componentId: text91("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    candidateId: text91("candidate_id").notNull(),
+    familyManifestId: text91("family_manifest_id").notNull(),
+    familyManifestHash: varchar66("family_manifest_hash", { length: 64 }).notNull(),
+    variantBindingHash: varchar66("variant_binding_hash", { length: 64 }).notNull(),
+    variantBinding: jsonb50("variant_binding").$type().notNull(),
+    requestId: text91("request_id"),
+    schemaHash: varchar66("schema_hash", { length: 64 }).notNull(),
+    brandContractHash: varchar66("brand_contract_hash", { length: 64 }).notNull(),
+    commitSha: varchar66("commit_sha", { length: 64 }).notNull(),
+    adapterHash: varchar66("adapter_hash", { length: 64 }).notNull(),
+    previewOrigin: text91("preview_origin").notNull(),
+    nativeViewports: jsonb50("native_viewports").$type().notNull(),
+    adapter: jsonb50("adapter").$type().notNull(),
+    status: varchar66("status", { length: 20 }).$type().notNull(),
+    checks: jsonb50("checks").$type().notNull(),
+    evidenceDigest: varchar66("evidence_digest", { length: 128 }).notNull(),
+    evidenceTupleHash: varchar66("evidence_tuple_hash", { length: 64 }).notNull(),
+    createdBy: text91("created_by"),
+    createdAt: timestamp83("created_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey6({
@@ -27323,20 +27359,20 @@ var componentImplementationEvidence = pgTable89(
     uniqueIndex38("component_implementation_evidence_digest_unique").on(table.projectId, table.componentId, table.evidenceDigest),
     uniqueIndex38("component_implementation_evidence_request_unique").on(table.requestId).where(sql21`${table.requestId} IS NOT NULL`),
     unique5("component_implementation_evidence_scope_unique").on(table.id, table.projectId, table.componentId),
-    index76("component_implementation_evidence_candidate_idx").on(table.candidateId, table.createdAt)
+    index77("component_implementation_evidence_candidate_idx").on(table.candidateId, table.createdAt)
   ]
 );
-var componentImplementationApprovals = pgTable89(
+var componentImplementationApprovals = pgTable90(
   "component_implementation_approvals",
   {
-    id: text90("id").primaryKey(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    componentId: text90("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    candidateId: text90("candidate_id").notNull(),
-    evidenceId: text90("evidence_id").notNull(),
-    approvedBy: text90("approved_by").notNull(),
-    approvedAt: timestamp82("approved_at").notNull().defaultNow()
+    id: text91("id").primaryKey(),
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    componentId: text91("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    candidateId: text91("candidate_id").notNull(),
+    evidenceId: text91("evidence_id").notNull(),
+    approvedBy: text91("approved_by").notNull(),
+    approvedAt: timestamp83("approved_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey6({
@@ -27356,10 +27392,10 @@ var componentImplementationApprovals = pgTable89(
     }).onDelete("cascade"),
     uniqueIndex38("component_implementation_approval_evidence_unique").on(table.evidenceId),
     unique5("component_implementation_approval_scope_unique").on(table.id, table.projectId, table.componentId),
-    index76("component_implementation_approvals_component_idx").on(table.projectId, table.componentId)
+    index77("component_implementation_approvals_component_idx").on(table.projectId, table.componentId)
   ]
 );
-var componentImplementationAdapters = pgTable89(
+var componentImplementationAdapters = pgTable90(
   "component_implementation_adapters",
   {
     // uuid generated BY THE DATABASE, unlike this file's older `text` ids with app-side prefixes.
@@ -27367,15 +27403,15 @@ var componentImplementationAdapters = pgTable89(
     // (project_id, component_id), which is unique — so there is nothing for a readable prefix to
     // help with, and one fewer identifier for a writer to have to mint correctly.
     id: uuid2("id").primaryKey().defaultRandom(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull(),
-    componentId: text90("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    adapter: jsonb49("adapter").$type().notNull(),
-    adapterHash: varchar65("adapter_hash", { length: 64 }).notNull(),
-    source: varchar65("source", { length: 24 }).$type().notNull(),
-    declaredBy: text90("declared_by"),
-    declaredAt: timestamp82("declared_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp82("updated_at", { withTimezone: true }).notNull().defaultNow()
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull(),
+    componentId: text91("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    adapter: jsonb50("adapter").$type().notNull(),
+    adapterHash: varchar66("adapter_hash", { length: 64 }).notNull(),
+    source: varchar66("source", { length: 24 }).$type().notNull(),
+    declaredBy: text91("declared_by"),
+    declaredAt: timestamp83("declared_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp83("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey6({
@@ -27384,30 +27420,30 @@ var componentImplementationAdapters = pgTable89(
       name: "component_implementation_adapters_scope_fkey"
     }).onDelete("cascade"),
     unique5("component_implementation_adapters_component_unique").on(table.projectId, table.componentId),
-    index76("component_implementation_adapters_project_idx").on(table.projectId, table.componentId)
+    index77("component_implementation_adapters_project_idx").on(table.projectId, table.componentId)
   ]
 );
-var componentImplementationStates = pgTable89(
+var componentImplementationStates = pgTable90(
   "component_implementation_states",
   {
-    id: text90("id").primaryKey(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    componentId: text90("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    selectedCandidateId: text90("selected_candidate_id").references(() => componentImplementationCandidates.id, { onDelete: "set null" }),
-    selectedEvidenceId: text90("selected_evidence_id").references(() => componentImplementationEvidence.id, { onDelete: "set null" }),
-    selectedApprovalId: text90("selected_approval_id").references(() => componentImplementationApprovals.id, { onDelete: "set null" }),
-    publishedCandidateId: text90("published_candidate_id").references(() => componentImplementationCandidates.id, { onDelete: "set null" }),
-    publishedEvidenceId: text90("published_evidence_id").references(() => componentImplementationEvidence.id, { onDelete: "set null" }),
-    publishedApprovalId: text90("published_approval_id").references(() => componentImplementationApprovals.id, { onDelete: "set null" }),
-    requestId: text90("request_id"),
-    requestProvider: varchar65("request_provider", { length: 20 }).$type(),
-    requestStatus: varchar65("request_status", { length: 20 }).$type().notNull().default("not-requested"),
-    requestErrorCode: text90("request_error_code"),
-    requestErrorMessage: text90("request_error_message"),
-    requestedBy: text90("requested_by"),
-    requestedAt: timestamp82("requested_at"),
-    updatedAt: timestamp82("updated_at").notNull().defaultNow()
+    id: text91("id").primaryKey(),
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    componentId: text91("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    selectedCandidateId: text91("selected_candidate_id").references(() => componentImplementationCandidates.id, { onDelete: "set null" }),
+    selectedEvidenceId: text91("selected_evidence_id").references(() => componentImplementationEvidence.id, { onDelete: "set null" }),
+    selectedApprovalId: text91("selected_approval_id").references(() => componentImplementationApprovals.id, { onDelete: "set null" }),
+    publishedCandidateId: text91("published_candidate_id").references(() => componentImplementationCandidates.id, { onDelete: "set null" }),
+    publishedEvidenceId: text91("published_evidence_id").references(() => componentImplementationEvidence.id, { onDelete: "set null" }),
+    publishedApprovalId: text91("published_approval_id").references(() => componentImplementationApprovals.id, { onDelete: "set null" }),
+    requestId: text91("request_id"),
+    requestProvider: varchar66("request_provider", { length: 20 }).$type(),
+    requestStatus: varchar66("request_status", { length: 20 }).$type().notNull().default("not-requested"),
+    requestErrorCode: text91("request_error_code"),
+    requestErrorMessage: text91("request_error_message"),
+    requestedBy: text91("requested_by"),
+    requestedAt: timestamp83("requested_at"),
+    updatedAt: timestamp83("updated_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey6({
@@ -27416,24 +27452,24 @@ var componentImplementationStates = pgTable89(
       name: "component_implementation_states_project_workspace_fkey"
     }).onDelete("cascade"),
     uniqueIndex38("component_implementation_states_component_unique").on(table.projectId, table.componentId),
-    index76("component_implementation_states_workspace_idx").on(table.workspaceId)
+    index77("component_implementation_states_workspace_idx").on(table.workspaceId)
   ]
 );
-var componentPreviewSources = pgTable89(
+var componentPreviewSources = pgTable90(
   "component_preview_sources",
   {
     id: uuid2("id").primaryKey().defaultRandom(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull(),
-    componentId: text90("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    sourcePath: text90("source_path").notNull(),
-    sourceExport: varchar65("source_export", { length: 128 }).notNull().default("default"),
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull(),
+    componentId: text91("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    sourcePath: text91("source_path").notNull(),
+    sourceExport: varchar66("source_export", { length: 128 }).notNull().default("default"),
     /** `file`: props are the component's fields. `section`: codemod-extracted, props `{ blockId, bind, overrides, page }` (0321). */
-    sourceKind: varchar65("source_kind", { length: 16 }).$type().notNull().default("file"),
-    recordedBy: varchar65("recorded_by", { length: 24 }).$type().notNull().default("agent"),
-    updatedBy: text90("updated_by"),
-    createdAt: timestamp82("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp82("updated_at", { withTimezone: true }).notNull().defaultNow()
+    sourceKind: varchar66("source_kind", { length: 16 }).$type().notNull().default("file"),
+    recordedBy: varchar66("recorded_by", { length: 24 }).$type().notNull().default("agent"),
+    updatedBy: text91("updated_by"),
+    createdAt: timestamp83("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp83("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey6({
@@ -27442,28 +27478,28 @@ var componentPreviewSources = pgTable89(
       name: "component_preview_sources_scope_fkey"
     }).onDelete("cascade"),
     unique5("component_preview_sources_component_unique").on(table.projectId, table.componentId),
-    index76("component_preview_sources_project_idx").on(table.projectId)
+    index77("component_preview_sources_project_idx").on(table.projectId)
   ]
 );
-var componentPreviewBundles = pgTable89(
+var componentPreviewBundles = pgTable90(
   "component_preview_bundles",
   {
     id: uuid2("id").primaryKey().defaultRandom(),
-    workspaceId: text90("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text90("project_id").notNull(),
-    commitSha: varchar65("commit_sha", { length: 64 }).notNull(),
-    artifactKey: text90("artifact_key").notNull(),
-    checksum: varchar65("checksum", { length: 80 }).notNull(),
+    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text91("project_id").notNull(),
+    commitSha: varchar66("commit_sha", { length: 64 }).notNull(),
+    artifactKey: text91("artifact_key").notNull(),
+    checksum: varchar66("checksum", { length: 80 }).notNull(),
     sizeBytes: bigint4("size_bytes", { mode: "number" }).notNull(),
-    createdAt: timestamp82("created_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp83("created_at", { withTimezone: true }).notNull().defaultNow(),
     /** The preview-runtime version that built this bundle (0330); null from a runner before 0.5.0. */
-    runtimeVersion: text90("runtime_version"),
+    runtimeVersion: text91("runtime_version"),
     /** The latest runtime refresh of this commit: rebuilt with a newer runner without re-validating (0330). */
     refreshId: uuid2("refresh_id"),
-    refreshStatus: text90("refresh_status"),
-    refreshErrorCode: text90("refresh_error_code"),
-    refreshErrorMessage: text90("refresh_error_message"),
-    refreshDispatchedAt: timestamp82("refresh_dispatched_at", { withTimezone: true })
+    refreshStatus: text91("refresh_status"),
+    refreshErrorCode: text91("refresh_error_code"),
+    refreshErrorMessage: text91("refresh_error_message"),
+    refreshDispatchedAt: timestamp83("refresh_dispatched_at", { withTimezone: true })
   },
   (table) => [
     foreignKey6({
@@ -27472,7 +27508,7 @@ var componentPreviewBundles = pgTable89(
       name: "component_preview_bundles_scope_fkey"
     }).onDelete("cascade"),
     unique5("component_preview_bundles_commit_unique").on(table.projectId, table.commitSha),
-    index76("component_preview_bundles_project_idx").on(table.projectId, table.createdAt)
+    index77("component_preview_bundles_project_idx").on(table.projectId, table.createdAt)
   ]
 );
 
@@ -27481,17 +27517,17 @@ import { sql as sql22 } from "drizzle-orm";
 import {
   check as check5,
   foreignKey as foreignKey7,
-  index as index77,
-  integer as integer44,
-  jsonb as jsonb50,
-  pgTable as pgTable90,
-  primaryKey as primaryKey8,
-  text as text91,
-  timestamp as timestamp83,
+  index as index78,
+  integer as integer45,
+  jsonb as jsonb51,
+  pgTable as pgTable91,
+  primaryKey as primaryKey9,
+  text as text92,
+  timestamp as timestamp84,
   unique as unique6,
   uniqueIndex as uniqueIndex39,
   uuid as uuid3,
-  varchar as varchar66
+  varchar as varchar67
 } from "drizzle-orm/pg-core";
 var ORCHESTRATION_RUN_STATUSES = [
   "open",
@@ -27501,15 +27537,15 @@ var ORCHESTRATION_RUN_STATUSES = [
   "completed",
   "abandoned"
 ];
-var projectOrchestrationStates = pgTable90(
+var projectOrchestrationStates = pgTable91(
   "project_orchestration_states",
   {
-    projectId: text91("project_id").primaryKey().references(() => projects.id, { onDelete: "cascade" }),
-    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    generation: integer44("generation").notNull().default(2),
-    enabledBy: text91("enabled_by").notNull(),
-    enabledAt: timestamp83("enabled_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp83("updated_at", { withTimezone: true }).notNull().defaultNow()
+    projectId: text92("project_id").primaryKey().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    generation: integer45("generation").notNull().default(2),
+    enabledBy: text92("enabled_by").notNull(),
+    enabledAt: timestamp84("enabled_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey7({
@@ -27519,31 +27555,31 @@ var projectOrchestrationStates = pgTable90(
     }).onDelete("cascade"),
     unique6("project_orchestration_states_scope_unique").on(table.projectId, table.workspaceId),
     check5("project_orchestration_states_generation_check", sql22`${table.generation} >= 2`),
-    index77("project_orchestration_states_workspace_idx").on(table.workspaceId)
+    index78("project_orchestration_states_workspace_idx").on(table.workspaceId)
   ]
 );
-var orchestrationRuns = pgTable90(
+var orchestrationRuns = pgTable91(
   "orchestration_runs",
   {
     id: uuid3("id").primaryKey().defaultRandom(),
-    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    projectGeneration: integer44("project_generation").notNull(),
-    startIdempotencyKey: text91("start_idempotency_key").notNull(),
-    targetKind: varchar66("target_kind", { length: 32 }).$type().notNull().default("component-variant"),
-    targetId: text91("target_id").notNull().references(() => components.id, { onDelete: "no action" }),
-    targetVariantId: text91("target_variant_id"),
-    targetMetadata: jsonb50("target_metadata").$type().notNull(),
-    status: varchar66("status", { length: 20 }).$type().notNull().default("open"),
-    activeStage: varchar66("active_stage", { length: 64 }).notNull().default("awaiting-executor"),
-    version: integer44("version").notNull().default(1),
-    preferredExecutorId: text91("preferred_executor_id"),
-    cancellationRequestedAt: timestamp83("cancellation_requested_at", { withTimezone: true }),
-    cancellationRequestedBy: text91("cancellation_requested_by"),
-    createdBy: text91("created_by").notNull(),
-    policyVersion: varchar66("policy_version", { length: 64 }).notNull().default("orchestration-v2"),
-    createdAt: timestamp83("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp83("updated_at", { withTimezone: true }).notNull().defaultNow()
+    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    projectGeneration: integer45("project_generation").notNull(),
+    startIdempotencyKey: text92("start_idempotency_key").notNull(),
+    targetKind: varchar67("target_kind", { length: 32 }).$type().notNull().default("component-variant"),
+    targetId: text92("target_id").notNull().references(() => components.id, { onDelete: "no action" }),
+    targetVariantId: text92("target_variant_id"),
+    targetMetadata: jsonb51("target_metadata").$type().notNull(),
+    status: varchar67("status", { length: 20 }).$type().notNull().default("open"),
+    activeStage: varchar67("active_stage", { length: 64 }).notNull().default("awaiting-executor"),
+    version: integer45("version").notNull().default(1),
+    preferredExecutorId: text92("preferred_executor_id"),
+    cancellationRequestedAt: timestamp84("cancellation_requested_at", { withTimezone: true }),
+    cancellationRequestedBy: text92("cancellation_requested_by"),
+    createdBy: text92("created_by").notNull(),
+    policyVersion: varchar67("policy_version", { length: 64 }).notNull().default("orchestration-v2"),
+    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey7({
@@ -27567,14 +27603,14 @@ var orchestrationRuns = pgTable90(
       table.startIdempotencyKey
     ),
     uniqueIndex39("orchestration_runs_nonterminal_project_unique").on(table.projectId).where(sql22`${table.status} IN ('open', 'paused', 'cancelling')`),
-    index77("orchestration_runs_project_target_idx").on(
+    index78("orchestration_runs_project_target_idx").on(
       table.projectId,
       table.targetKind,
       table.targetId,
       table.targetVariantId,
       table.createdAt
     ),
-    index77("orchestration_runs_workspace_status_idx").on(
+    index78("orchestration_runs_workspace_status_idx").on(
       table.workspaceId,
       table.status,
       table.updatedAt
@@ -27661,49 +27697,49 @@ var orchestrationRuns = pgTable90(
     check5("orchestration_runs_timestamps_check", sql22`${table.updatedAt} >= ${table.createdAt}`)
   ]
 );
-var orchestrationRunStartKeys = pgTable90(
+var orchestrationRunStartKeys = pgTable91(
   "orchestration_run_start_keys",
   {
-    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    idempotencyKey: text91("idempotency_key").notNull(),
+    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    idempotencyKey: text92("idempotency_key").notNull(),
     runId: uuid3("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
-    createdAt: timestamp83("created_at", { withTimezone: true }).notNull().defaultNow()
+    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    primaryKey8({ columns: [table.projectId, table.idempotencyKey] }),
+    primaryKey9({ columns: [table.projectId, table.idempotencyKey] }),
     foreignKey7({
       columns: [table.runId, table.workspaceId, table.projectId],
       foreignColumns: [orchestrationRuns.id, orchestrationRuns.workspaceId, orchestrationRuns.projectId],
       name: "orchestration_run_start_keys_run_scope_fkey"
     }).onDelete("cascade"),
-    index77("orchestration_run_start_keys_run_created_idx").on(table.runId, table.createdAt),
+    index78("orchestration_run_start_keys_run_created_idx").on(table.runId, table.createdAt),
     check5(
       "orchestration_run_start_keys_idempotency_key_check",
       sql22`length(btrim(${table.idempotencyKey})) BETWEEN 1 AND 255`
     )
   ]
 );
-var orchestrationRunEvents = pgTable90(
+var orchestrationRunEvents = pgTable91(
   "orchestration_run_events",
   {
     id: uuid3("id").primaryKey().defaultRandom(),
     runId: uuid3("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
-    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    sequence: integer44("sequence").notNull(),
-    schemaVersion: integer44("schema_version").notNull().default(1),
-    idempotencyKey: text91("idempotency_key").notNull(),
-    type: varchar66("type", { length: 100 }).notNull(),
-    actorType: varchar66("actor_type", { length: 32 }).notNull(),
-    actorId: text91("actor_id").notNull(),
-    causationId: text91("causation_id"),
-    correlationId: text91("correlation_id"),
-    payload: jsonb50("payload").$type().notNull().default({}),
-    payloadDigest: varchar66("payload_digest", { length: 71 }).generatedAlwaysAs(
+    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    sequence: integer45("sequence").notNull(),
+    schemaVersion: integer45("schema_version").notNull().default(1),
+    idempotencyKey: text92("idempotency_key").notNull(),
+    type: varchar67("type", { length: 100 }).notNull(),
+    actorType: varchar67("actor_type", { length: 32 }).notNull(),
+    actorId: text92("actor_id").notNull(),
+    causationId: text92("causation_id"),
+    correlationId: text92("correlation_id"),
+    payload: jsonb51("payload").$type().notNull().default({}),
+    payloadDigest: varchar67("payload_digest", { length: 71 }).generatedAlwaysAs(
       sql22`'sha256:' || encode(digest(payload::text, 'sha256'), 'hex')`
     ),
-    createdAt: timestamp83("created_at", { withTimezone: true }).notNull().defaultNow()
+    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey7({
@@ -27713,7 +27749,7 @@ var orchestrationRunEvents = pgTable90(
     }).onDelete("cascade"),
     unique6("orchestration_run_events_sequence_unique").on(table.runId, table.sequence),
     unique6("orchestration_run_events_idempotency_unique").on(table.runId, table.idempotencyKey),
-    index77("orchestration_run_events_project_created_idx").on(table.projectId, table.createdAt),
+    index78("orchestration_run_events_project_created_idx").on(table.projectId, table.createdAt),
     check5("orchestration_run_events_sequence_check", sql22`${table.sequence} >= 1`),
     check5("orchestration_run_events_schema_version_check", sql22`${table.schemaVersion} >= 1`),
     check5(
@@ -27729,20 +27765,20 @@ var orchestrationRunEvents = pgTable90(
     )
   ]
 );
-var orchestrationRunCommandResults = pgTable90(
+var orchestrationRunCommandResults = pgTable91(
   "orchestration_run_command_results",
   {
     commandId: uuid3("command_id").primaryKey(),
-    workspaceId: text91("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text91("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid3("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
-    command: varchar66("command", { length: 20 }).$type().notNull(),
-    expectedVersion: integer44("expected_version").notNull(),
-    resultingVersion: integer44("resulting_version").notNull(),
-    actorId: text91("actor_id").notNull(),
+    command: varchar67("command", { length: 20 }).$type().notNull(),
+    expectedVersion: integer45("expected_version").notNull(),
+    resultingVersion: integer45("resulting_version").notNull(),
+    actorId: text92("actor_id").notNull(),
     eventId: uuid3("event_id").notNull().references(() => orchestrationRunEvents.id, { onDelete: "cascade" }),
-    resultPayload: jsonb50("result_payload").$type().notNull(),
-    createdAt: timestamp83("created_at", { withTimezone: true }).notNull().defaultNow()
+    resultPayload: jsonb51("result_payload").$type().notNull(),
+    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey7({
@@ -27750,8 +27786,8 @@ var orchestrationRunCommandResults = pgTable90(
       foreignColumns: [orchestrationRuns.id, orchestrationRuns.workspaceId, orchestrationRuns.projectId],
       name: "orchestration_run_command_results_run_scope_fkey"
     }).onDelete("cascade"),
-    index77("orchestration_run_command_results_run_created_idx").on(table.runId, table.createdAt),
-    index77("orchestration_run_command_results_project_created_idx").on(
+    index78("orchestration_run_command_results_run_created_idx").on(table.runId, table.createdAt),
+    index78("orchestration_run_command_results_project_created_idx").on(
       table.projectId,
       table.createdAt
     ),
@@ -27785,16 +27821,16 @@ import {
   boolean as boolean30,
   check as check6,
   foreignKey as foreignKey8,
-  index as index78,
-  integer as integer45,
-  jsonb as jsonb51,
-  pgTable as pgTable91,
-  text as text92,
-  timestamp as timestamp84,
+  index as index79,
+  integer as integer46,
+  jsonb as jsonb52,
+  pgTable as pgTable92,
+  text as text93,
+  timestamp as timestamp85,
   unique as unique7,
   uniqueIndex as uniqueIndex40,
   uuid as uuid4,
-  varchar as varchar67
+  varchar as varchar68
 } from "drizzle-orm/pg-core";
 var EXECUTOR_KINDS = ["dashboard-agent", "native-bridge"];
 var EXECUTOR_INSTALLATION_STATUSES = ["active", "revoked", "incompatible"];
@@ -27835,20 +27871,20 @@ var EXECUTOR_COMMAND_KINDS = [
   "cancel",
   "handoff"
 ];
-var orchestrationExecutorInstallations = pgTable91(
+var orchestrationExecutorInstallations = pgTable92(
   "orchestration_executor_installations",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    kind: varchar67("kind", { length: 24 }).$type().notNull(),
-    grantId: text92("grant_id").references(() => deviceAuthorizations.id, { onDelete: "cascade" }),
-    protocolVersion: varchar67("protocol_version", { length: 16 }).notNull(),
-    capabilityDigest: text92("capability_digest").notNull(),
-    repositoryClaim: jsonb51("repository_claim").$type().notNull().default({}),
-    status: varchar67("status", { length: 20 }).$type().notNull().default("active"),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    kind: varchar68("kind", { length: 24 }).$type().notNull(),
+    grantId: text93("grant_id").references(() => deviceAuthorizations.id, { onDelete: "cascade" }),
+    protocolVersion: varchar68("protocol_version", { length: 16 }).notNull(),
+    capabilityDigest: text93("capability_digest").notNull(),
+    repositoryClaim: jsonb52("repository_claim").$type().notNull().default({}),
+    status: varchar68("status", { length: 20 }).$type().notNull().default("active"),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey8({
@@ -27861,7 +27897,7 @@ var orchestrationExecutorInstallations = pgTable91(
       table.workspaceId,
       table.projectId
     ),
-    index78("orchestration_executor_installations_project_status_idx").on(
+    index79("orchestration_executor_installations_project_status_idx").on(
       table.projectId,
       table.status
     ),
@@ -27898,24 +27934,24 @@ var orchestrationExecutorInstallations = pgTable91(
     )
   ]
 );
-var orchestrationExecutorSessions = pgTable91(
+var orchestrationExecutorSessions = pgTable92(
   "orchestration_executor_sessions",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     installationId: uuid4("installation_id").notNull().references(() => orchestrationExecutorInstallations.id, { onDelete: "cascade" }),
-    sessionEpoch: integer45("session_epoch").notNull().default(1),
-    credentialAudience: varchar67("credential_audience", { length: 64 }).notNull(),
-    state: varchar67("state", { length: 20 }).$type().notNull().default("open"),
+    sessionEpoch: integer46("session_epoch").notNull().default(1),
+    credentialAudience: varchar68("credential_audience", { length: 64 }).notNull(),
+    state: varchar68("state", { length: 20 }).$type().notNull().default("open"),
     clientCursor: bigint5("client_cursor", { mode: "number" }).notNull().default(0),
     serverCursor: bigint5("server_cursor", { mode: "number" }).notNull().default(0),
-    connectedAt: timestamp84("connected_at", { withTimezone: true }).notNull().defaultNow(),
-    lastHeartbeatAt: timestamp84("last_heartbeat_at", { withTimezone: true }),
-    serverReceivedAt: timestamp84("server_received_at", { withTimezone: true }),
-    closedAt: timestamp84("closed_at", { withTimezone: true }),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    connectedAt: timestamp85("connected_at", { withTimezone: true }).notNull().defaultNow(),
+    lastHeartbeatAt: timestamp85("last_heartbeat_at", { withTimezone: true }),
+    serverReceivedAt: timestamp85("server_received_at", { withTimezone: true }),
+    closedAt: timestamp85("closed_at", { withTimezone: true }),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey8({
@@ -27936,11 +27972,11 @@ var orchestrationExecutorSessions = pgTable91(
       table.installationId,
       table.sessionEpoch
     ),
-    index78("orchestration_executor_sessions_installation_state_idx").on(
+    index79("orchestration_executor_sessions_installation_state_idx").on(
       table.installationId,
       table.state
     ),
-    index78("orchestration_executor_sessions_liveness_idx").on(table.serverReceivedAt).where(sql23`${table.state} = 'open'`),
+    index79("orchestration_executor_sessions_liveness_idx").on(table.serverReceivedAt).where(sql23`${table.state} = 'open'`),
     check6("orchestration_executor_sessions_epoch_check", sql23`${table.sessionEpoch} >= 1`),
     check6(
       "orchestration_executor_sessions_state_check",
@@ -27964,39 +28000,39 @@ var orchestrationExecutorSessions = pgTable91(
     )
   ]
 );
-var orchestrationImplementationAttempts = pgTable91(
+var orchestrationImplementationAttempts = pgTable92(
   "orchestration_implementation_attempts",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
     installationId: uuid4("installation_id").notNull().references(() => orchestrationExecutorInstallations.id, { onDelete: "cascade" }),
-    attemptNumber: integer45("attempt_number").notNull(),
-    targetKind: varchar67("target_kind", { length: 32 }).notNull().default("component-variant"),
-    targetId: text92("target_id").notNull(),
-    targetBindingDigest: text92("target_binding_digest").notNull(),
+    attemptNumber: integer46("attempt_number").notNull(),
+    targetKind: varchar68("target_kind", { length: 32 }).notNull().default("component-variant"),
+    targetId: text93("target_id").notNull(),
+    targetBindingDigest: text93("target_binding_digest").notNull(),
     repositoryId: bigint5("repository_id", { mode: "number" }),
-    baseBranch: varchar67("base_branch", { length: 255 }),
-    baseSha: varchar67("base_sha", { length: 64 }),
+    baseBranch: varchar68("base_branch", { length: 255 }),
+    baseSha: varchar68("base_sha", { length: 64 }),
     /**
      * The branch this attempt created, recorded BEFORE the first write lands on it. This is the
      * crash-safety line: if the process dies holding a branch, cancellation and reconciliation can
      * still find it. Null until the branch exists. Shape-checked to run branches only (0278).
      */
-    createdRef: text92("created_ref"),
-    status: varchar67("status", { length: 24 }).$type().notNull().default("preflight"),
+    createdRef: text93("created_ref"),
+    status: varchar68("status", { length: 24 }).$type().notNull().default("preflight"),
     supersededBy: uuid4("superseded_by"),
     /**
      * Withdrawal (0284): the three facts travel together or not at all, enforced by a CHECK. A
      * withdrawn attempt's pull request is kept BY URL, so a reader of the run never has to
      * discover from GitHub that one used to exist here.
      */
-    withdrawnAt: timestamp84("withdrawn_at", { withTimezone: true }),
-    withdrawnBy: text92("withdrawn_by"),
-    withdrawnPullRequestUrl: text92("withdrawn_pull_request_url"),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    withdrawnAt: timestamp85("withdrawn_at", { withTimezone: true }),
+    withdrawnBy: text93("withdrawn_by"),
+    withdrawnPullRequestUrl: text93("withdrawn_pull_request_url"),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey8({
@@ -28031,7 +28067,7 @@ var orchestrationImplementationAttempts = pgTable91(
       table.runId,
       table.attemptNumber
     ),
-    index78("orchestration_implementation_attempts_run_created_idx").on(
+    index79("orchestration_implementation_attempts_run_created_idx").on(
       table.runId,
       table.createdAt
     ),
@@ -28062,135 +28098,135 @@ var orchestrationImplementationAttempts = pgTable91(
     )
   ]
 );
-var orchestrationPlanSnapshots = pgTable91(
+var orchestrationPlanSnapshots = pgTable92(
   "orchestration_plan_snapshots",
   {
-    planDigest: text92("plan_digest").primaryKey(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    baseHeadOid: varchar67("base_head_oid", { length: 64 }).notNull(),
-    budget: jsonb51("budget").notNull(),
-    files: jsonb51("files").notNull(),
-    fileCount: integer45("file_count").notNull(),
+    planDigest: text93("plan_digest").primaryKey(),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    baseHeadOid: varchar68("base_head_oid", { length: 64 }).notNull(),
+    budget: jsonb52("budget").notNull(),
+    files: jsonb52("files").notNull(),
+    fileCount: integer46("file_count").notNull(),
     byteCount: bigint5("byte_count", { mode: "number" }).notNull(),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow()
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow()
   },
-  (table) => [index78("orchestration_plan_snapshots_project_idx").on(table.workspaceId, table.projectId, table.createdAt)]
+  (table) => [index79("orchestration_plan_snapshots_project_idx").on(table.workspaceId, table.projectId, table.createdAt)]
 );
-var orchestrationVisualApprovals = pgTable91(
+var orchestrationVisualApprovals = pgTable92(
   "orchestration_visual_approvals",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull(),
     attemptId: uuid4("attempt_id").notNull(),
-    headSha: varchar67("head_sha", { length: 64 }).notNull(),
+    headSha: varchar68("head_sha", { length: 64 }).notNull(),
     evidenceId: uuid4("evidence_id").notNull(),
-    authorizedBy: text92("authorized_by").notNull(),
-    idempotencyKey: text92("idempotency_key").notNull(),
-    expiresAt: timestamp84("expires_at", { withTimezone: true }).notNull(),
-    consumedAt: timestamp84("consumed_at", { withTimezone: true }),
-    consumedByRef: text92("consumed_by_ref"),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    authorizedBy: text93("authorized_by").notNull(),
+    idempotencyKey: text93("idempotency_key").notNull(),
+    expiresAt: timestamp85("expires_at", { withTimezone: true }).notNull(),
+    consumedAt: timestamp85("consumed_at", { withTimezone: true }),
+    consumedByRef: text93("consumed_by_ref"),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   }
 );
-var orchestrationMergeAuthorizations = pgTable91(
+var orchestrationMergeAuthorizations = pgTable92(
   "orchestration_merge_authorizations",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull(),
     attemptId: uuid4("attempt_id").notNull(),
-    pullRequestNumber: integer45("pull_request_number").notNull(),
-    expectedHeadSha: varchar67("expected_head_sha", { length: 64 }).notNull(),
+    pullRequestNumber: integer46("pull_request_number").notNull(),
+    expectedHeadSha: varchar68("expected_head_sha", { length: 64 }).notNull(),
     visualApprovalId: uuid4("visual_approval_id").notNull(),
     /**
      * 0285. A void is a first-class END, not a consumption with a special ref: consumption records
      * what an authorization BOUGHT, and a void bought nothing. A CHECK keeps the three together and
      * forbids a row that is both spent and voided.
      */
-    voidedAt: timestamp84("voided_at", { withTimezone: true }),
-    voidedBy: text92("voided_by"),
-    voidReason: text92("void_reason"),
-    authorizedBy: text92("authorized_by").notNull(),
-    idempotencyKey: text92("idempotency_key").notNull(),
-    expiresAt: timestamp84("expires_at", { withTimezone: true }).notNull(),
-    consumedAt: timestamp84("consumed_at", { withTimezone: true }),
-    consumedByRef: text92("consumed_by_ref"),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    voidedAt: timestamp85("voided_at", { withTimezone: true }),
+    voidedBy: text93("voided_by"),
+    voidReason: text93("void_reason"),
+    authorizedBy: text93("authorized_by").notNull(),
+    idempotencyKey: text93("idempotency_key").notNull(),
+    expiresAt: timestamp85("expires_at", { withTimezone: true }).notNull(),
+    consumedAt: timestamp85("consumed_at", { withTimezone: true }),
+    consumedByRef: text93("consumed_by_ref"),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   }
 );
-var orchestrationDeploymentAuthorizations = pgTable91(
+var orchestrationDeploymentAuthorizations = pgTable92(
   "orchestration_deployment_authorizations",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull(),
     attemptId: uuid4("attempt_id").notNull(),
-    mergeSha: varchar67("merge_sha", { length: 64 }).notNull(),
-    artifactChecksum: varchar67("artifact_checksum", { length: 80 }).notNull(),
+    mergeSha: varchar68("merge_sha", { length: 64 }).notNull(),
+    artifactChecksum: varchar68("artifact_checksum", { length: 80 }).notNull(),
     mergeAuthorizationId: uuid4("merge_authorization_id").notNull(),
-    authorizedBy: text92("authorized_by").notNull(),
-    idempotencyKey: text92("idempotency_key").notNull(),
-    expiresAt: timestamp84("expires_at", { withTimezone: true }).notNull(),
-    consumedAt: timestamp84("consumed_at", { withTimezone: true }),
-    consumedByRef: text92("consumed_by_ref"),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    authorizedBy: text93("authorized_by").notNull(),
+    idempotencyKey: text93("idempotency_key").notNull(),
+    expiresAt: timestamp85("expires_at", { withTimezone: true }).notNull(),
+    consumedAt: timestamp85("consumed_at", { withTimezone: true }),
+    consumedByRef: text93("consumed_by_ref"),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   }
 );
-var orchestrationDeploymentRequests = pgTable91(
+var orchestrationDeploymentRequests = pgTable92(
   "orchestration_deployment_requests",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull(),
     attemptId: uuid4("attempt_id").notNull(),
     authorizationId: uuid4("authorization_id").notNull(),
-    expectedMergeSha: varchar67("expected_merge_sha", { length: 64 }).notNull(),
-    artifactChecksum: varchar67("artifact_checksum", { length: 80 }).notNull(),
-    state: varchar67("state", { length: 12 }).$type().notNull().default("live"),
-    voidReason: text92("void_reason"),
-    releaseId: text92("release_id"),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    expectedMergeSha: varchar68("expected_merge_sha", { length: 64 }).notNull(),
+    artifactChecksum: varchar68("artifact_checksum", { length: 80 }).notNull(),
+    state: varchar68("state", { length: 12 }).$type().notNull().default("live"),
+    voidReason: text93("void_reason"),
+    releaseId: text93("release_id"),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   }
 );
-var orchestrationExecutionApprovals = pgTable91(
+var orchestrationExecutionApprovals = pgTable92(
   "orchestration_execution_approvals",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
     attemptId: uuid4("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
     installationId: uuid4("installation_id").notNull().references(() => orchestrationExecutorInstallations.id, { onDelete: "cascade" }),
-    idempotencyKey: text92("idempotency_key").notNull(),
-    approvedBy: text92("approved_by").notNull(),
-    targetKind: varchar67("target_kind", { length: 32 }).notNull().default("component-variant"),
-    targetId: text92("target_id").notNull(),
-    targetBindingDigest: text92("target_binding_digest").notNull(),
+    idempotencyKey: text93("idempotency_key").notNull(),
+    approvedBy: text93("approved_by").notNull(),
+    targetKind: varchar68("target_kind", { length: 32 }).notNull().default("component-variant"),
+    targetId: text93("target_id").notNull(),
+    targetBindingDigest: text93("target_binding_digest").notNull(),
     repositoryId: bigint5("repository_id", { mode: "number" }),
-    baseBranch: varchar67("base_branch", { length: 255 }),
-    baseSha: varchar67("base_sha", { length: 64 }),
+    baseBranch: varchar68("base_branch", { length: 255 }),
+    baseSha: varchar68("base_sha", { length: 64 }),
     /** Set when the approval is spent. 0274 grants UPDATE on THESE TWO COLUMNS ONLY, so every
      *  other field on a row a human signed stays as unwritable as it was before. */
-    consumedAt: timestamp84("consumed_at", { withTimezone: true }),
+    consumedAt: timestamp85("consumed_at", { withTimezone: true }),
     consumedByAttemptId: uuid4("consumed_by_attempt_id"),
-    pathPolicy: jsonb51("path_policy").$type().notNull().default({}),
-    operationClasses: jsonb51("operation_classes").$type().notNull().default([]),
-    mutationBudget: jsonb51("mutation_budget").$type().notNull().default({}),
-    planDigest: text92("plan_digest").notNull(),
-    capabilityDigest: text92("capability_digest").notNull(),
-    validationDigest: text92("validation_digest").notNull(),
-    expiresAt: timestamp84("expires_at", { withTimezone: true }).notNull(),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow()
+    pathPolicy: jsonb52("path_policy").$type().notNull().default({}),
+    operationClasses: jsonb52("operation_classes").$type().notNull().default([]),
+    mutationBudget: jsonb52("mutation_budget").$type().notNull().default({}),
+    planDigest: text93("plan_digest").notNull(),
+    capabilityDigest: text93("capability_digest").notNull(),
+    validationDigest: text93("validation_digest").notNull(),
+    expiresAt: timestamp85("expires_at", { withTimezone: true }).notNull(),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey8({
@@ -28227,7 +28263,7 @@ var orchestrationExecutionApprovals = pgTable91(
     // One approval per attempt. A running implementation never introduces a second approval; a
     // changed binding requires a NEW attempt, which is what makes the authority auditable.
     unique7("orchestration_execution_approvals_attempt_unique").on(table.attemptId),
-    index78("orchestration_execution_approvals_run_created_idx").on(table.runId, table.createdAt),
+    index79("orchestration_execution_approvals_run_created_idx").on(table.runId, table.createdAt),
     check6(
       "orchestration_execution_approvals_idempotency_key_check",
       sql23`length(btrim(${table.idempotencyKey})) BETWEEN 1 AND 255`
@@ -28274,23 +28310,23 @@ var orchestrationExecutionApprovals = pgTable91(
     )
   ]
 );
-var orchestrationExecutorLeases = pgTable91(
+var orchestrationExecutorLeases = pgTable92(
   "orchestration_executor_leases",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
     attemptId: uuid4("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
     sessionId: uuid4("session_id").notNull().references(() => orchestrationExecutorSessions.id, { onDelete: "cascade" }),
-    leaseEpoch: integer45("lease_epoch").notNull().default(1),
-    state: varchar67("state", { length: 20 }).$type().notNull().default("active"),
-    heartbeatDeadline: timestamp84("heartbeat_deadline", { withTimezone: true }).notNull(),
-    acquiredAt: timestamp84("acquired_at", { withTimezone: true }).notNull().defaultNow(),
-    releasedAt: timestamp84("released_at", { withTimezone: true }),
-    releaseReason: varchar67("release_reason", { length: 32 }).$type(),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    leaseEpoch: integer46("lease_epoch").notNull().default(1),
+    state: varchar68("state", { length: 20 }).$type().notNull().default("active"),
+    heartbeatDeadline: timestamp85("heartbeat_deadline", { withTimezone: true }).notNull(),
+    acquiredAt: timestamp85("acquired_at", { withTimezone: true }).notNull().defaultNow(),
+    releasedAt: timestamp85("released_at", { withTimezone: true }),
+    releaseReason: varchar68("release_reason", { length: 32 }).$type(),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey8({
@@ -28328,7 +28364,7 @@ var orchestrationExecutorLeases = pgTable91(
     unique7("orchestration_executor_leases_epoch_unique").on(table.attemptId, table.leaseEpoch),
     // Plan invariant 6, enforced in the database: a run has at most one active executor lease.
     uniqueIndex40("orchestration_executor_leases_one_active_per_run").on(table.runId).where(sql23`${table.state} = 'active'`),
-    index78("orchestration_executor_leases_deadline_idx").on(table.heartbeatDeadline).where(sql23`${table.state} = 'active'`),
+    index79("orchestration_executor_leases_deadline_idx").on(table.heartbeatDeadline).where(sql23`${table.state} = 'active'`),
     check6("orchestration_executor_leases_epoch_check", sql23`${table.leaseEpoch} >= 1`),
     check6(
       "orchestration_executor_leases_state_check",
@@ -28348,32 +28384,32 @@ var orchestrationExecutorLeases = pgTable91(
     )
   ]
 );
-var orchestrationExecutorCommands = pgTable91(
+var orchestrationExecutorCommands = pgTable92(
   "orchestration_executor_commands",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
     attemptId: uuid4("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
     leaseId: uuid4("lease_id").references(() => orchestrationExecutorLeases.id, {
       onDelete: "set null"
     }),
-    leaseEpoch: integer45("lease_epoch"),
+    leaseEpoch: integer46("lease_epoch"),
     approvalId: uuid4("approval_id").references(() => orchestrationExecutionApprovals.id, {
       onDelete: "set null"
     }),
     sequence: bigint5("sequence", { mode: "number" }).notNull(),
-    kind: varchar67("kind", { length: 32 }).$type().notNull(),
-    idempotencyKey: text92("idempotency_key").notNull(),
-    expectedRunVersion: integer45("expected_run_version").notNull(),
-    payload: jsonb51("payload").$type().notNull().default({}),
-    payloadDigest: varchar67("payload_digest", { length: 71 }).generatedAlwaysAs(
+    kind: varchar68("kind", { length: 32 }).$type().notNull(),
+    idempotencyKey: text93("idempotency_key").notNull(),
+    expectedRunVersion: integer46("expected_run_version").notNull(),
+    payload: jsonb52("payload").$type().notNull().default({}),
+    payloadDigest: varchar68("payload_digest", { length: 71 }).generatedAlwaysAs(
       sql23`'sha256:' || encode(digest(payload::text, 'sha256'), 'hex')`
     ),
-    deliveredAt: timestamp84("delivered_at", { withTimezone: true }),
-    acknowledgedAt: timestamp84("acknowledged_at", { withTimezone: true }),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow()
+    deliveredAt: timestamp85("delivered_at", { withTimezone: true }),
+    acknowledgedAt: timestamp85("acknowledged_at", { withTimezone: true }),
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey8({
@@ -28399,9 +28435,9 @@ var orchestrationExecutorCommands = pgTable91(
       table.runId,
       table.idempotencyKey
     ),
-    index78("orchestration_executor_commands_run_sequence_idx").on(table.runId, table.sequence),
+    index79("orchestration_executor_commands_run_sequence_idx").on(table.runId, table.sequence),
     // The long-poll cursor read: unacknowledged commands for a run, in order.
-    index78("orchestration_executor_commands_pending_idx").on(table.runId, table.sequence).where(sql23`${table.acknowledgedAt} IS NULL`),
+    index79("orchestration_executor_commands_pending_idx").on(table.runId, table.sequence).where(sql23`${table.acknowledgedAt} IS NULL`),
     check6("orchestration_executor_commands_sequence_check", sql23`${table.sequence} >= 1`),
     check6(
       "orchestration_executor_commands_kind_check",
@@ -28431,25 +28467,25 @@ var orchestrationExecutorCommands = pgTable91(
   ]
 );
 var PATCH_OPERATIONS = ["create", "update", "delete"];
-var orchestrationPatchManifests = pgTable91(
+var orchestrationPatchManifests = pgTable92(
   "orchestration_patch_manifests",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
     attemptId: uuid4("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
     approvalId: uuid4("approval_id").references(() => orchestrationExecutionApprovals.id, {
       onDelete: "set null"
     }),
-    sequence: integer45("sequence").notNull(),
-    path: text92("path").notNull(),
-    operation: varchar67("operation", { length: 16 }).$type().notNull(),
-    fileMode: varchar67("file_mode", { length: 6 }).notNull().default("100644"),
-    expectedBefore: varchar67("expected_before", { length: 64 }),
-    resultingBlobSha: varchar67("resulting_blob_sha", { length: 64 }),
+    sequence: integer46("sequence").notNull(),
+    path: text93("path").notNull(),
+    operation: varchar68("operation", { length: 16 }).$type().notNull(),
+    fileMode: varchar68("file_mode", { length: 6 }).notNull().default("100644"),
+    expectedBefore: varchar68("expected_before", { length: 64 }),
+    resultingBlobSha: varchar68("resulting_blob_sha", { length: 64 }),
     byteCount: bigint5("byte_count", { mode: "number" }).notNull().default(0),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow()
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey8({
@@ -28472,7 +28508,7 @@ var orchestrationPatchManifests = pgTable91(
     }).onDelete("cascade"),
     unique7("orchestration_patch_manifests_sequence_unique").on(table.attemptId, table.sequence),
     unique7("orchestration_patch_manifests_path_unique").on(table.attemptId, table.path),
-    index78("orchestration_patch_manifests_attempt_sequence_idx").on(table.attemptId, table.sequence),
+    index79("orchestration_patch_manifests_attempt_sequence_idx").on(table.attemptId, table.sequence),
     check6("orchestration_patch_manifests_sequence_check", sql23`${table.sequence} >= 1`),
     check6(
       "orchestration_patch_manifests_operation_check",
@@ -28498,30 +28534,30 @@ var orchestrationPatchManifests = pgTable91(
     check6("orchestration_patch_manifests_byte_count_check", sql23`${table.byteCount} >= 0`)
   ]
 );
-var orchestrationPullRequestReceipts = pgTable91(
+var orchestrationPullRequestReceipts = pgTable92(
   "orchestration_pull_request_receipts",
   {
     id: uuid4("id").primaryKey().defaultRandom(),
-    workspaceId: text92("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text92("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     runId: uuid4("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
     attemptId: uuid4("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
     repositoryId: bigint5("repository_id", { mode: "number" }).notNull(),
     installationId: bigint5("installation_id", { mode: "number" }),
     pullRequestId: bigint5("pull_request_id", { mode: "number" }).notNull(),
-    pullRequestNumber: integer45("pull_request_number").notNull(),
-    pullRequestUrl: text92("pull_request_url").notNull(),
-    baseRef: varchar67("base_ref", { length: 255 }).notNull(),
-    baseSha: varchar67("base_sha", { length: 64 }).notNull(),
-    headRef: varchar67("head_ref", { length: 255 }).notNull(),
-    headSha: varchar67("head_sha", { length: 64 }).notNull(),
+    pullRequestNumber: integer46("pull_request_number").notNull(),
+    pullRequestUrl: text93("pull_request_url").notNull(),
+    baseRef: varchar68("base_ref", { length: 255 }).notNull(),
+    baseSha: varchar68("base_sha", { length: 64 }).notNull(),
+    headRef: varchar68("head_ref", { length: 255 }).notNull(),
+    headSha: varchar68("head_sha", { length: 64 }).notNull(),
     /** True when BetterCMS created and owns the head branch. A head we do not own is observable
      *  but never advanceable by the adapter. */
     branchOwned: boolean30("branch_owned").notNull().default(true),
-    generation: integer45("generation").notNull().default(1),
+    generation: integer46("generation").notNull().default(1),
     isDraft: boolean30("is_draft").notNull().default(true),
-    createdAt: timestamp84("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp84("updated_at", { withTimezone: true }).notNull().defaultNow()
+    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp85("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     foreignKey8({
@@ -28546,11 +28582,11 @@ var orchestrationPullRequestReceipts = pgTable91(
       table.attemptId,
       table.generation
     ),
-    index78("orchestration_pull_request_receipts_attempt_generation_idx").on(
+    index79("orchestration_pull_request_receipts_attempt_generation_idx").on(
       table.attemptId,
       table.generation
     ),
-    index78("orchestration_pull_request_receipts_head_idx").on(table.repositoryId, table.headSha),
+    index79("orchestration_pull_request_receipts_head_idx").on(table.repositoryId, table.headSha),
     check6("orchestration_pull_request_receipts_generation_check", sql23`${table.generation} >= 1`),
     check6("orchestration_pull_request_receipts_number_check", sql23`${table.pullRequestNumber} >= 1`),
     check6(
@@ -28579,24 +28615,24 @@ var orchestrationPullRequestReceipts = pgTable91(
 
 // src/schema/conversion_proposals.ts
 import { sql as sql24 } from "drizzle-orm";
-import { check as check7, foreignKey as foreignKey9, index as index79, integer as integer46, jsonb as jsonb52, pgTable as pgTable92, text as text93, timestamp as timestamp85, unique as unique8, uuid as uuid5, varchar as varchar68 } from "drizzle-orm/pg-core";
+import { check as check7, foreignKey as foreignKey9, index as index80, integer as integer47, jsonb as jsonb53, pgTable as pgTable93, text as text94, timestamp as timestamp86, unique as unique8, uuid as uuid5, varchar as varchar69 } from "drizzle-orm/pg-core";
 var CONVERSION_PROPOSAL_STATUSES = ["draft", "approved", "superseded"];
-var conversionProposals = pgTable92(
+var conversionProposals = pgTable93(
   "conversion_proposals",
   {
     id: uuid5("id").primaryKey().defaultRandom(),
-    workspaceId: text93("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text93("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text94("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text94("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     /** The plan snapshot holding the proposed file contents. */
-    planDigest: text93("plan_digest").notNull().references(() => orchestrationPlanSnapshots.planDigest),
+    planDigest: text94("plan_digest").notNull().references(() => orchestrationPlanSnapshots.planDigest),
     /** sha256 of the canonical brief — what the CMS held when this was proposed. */
-    briefDigest: text93("brief_digest").notNull(),
-    baseHeadOid: varchar68("base_head_oid", { length: 64 }).notNull(),
-    baseBranch: text93("base_branch").notNull(),
+    briefDigest: text94("brief_digest").notNull(),
+    baseHeadOid: varchar69("base_head_oid", { length: 64 }).notNull(),
+    baseBranch: text94("base_branch").notNull(),
     /** Brief paths whose `original` was not found in any source file. */
-    unlocated: jsonb52("unlocated").notNull().default(sql24`'[]'::jsonb`),
+    unlocated: jsonb53("unlocated").notNull().default(sql24`'[]'::jsonb`),
     /** Files that matched a brief original but fell outside the acquisition caps. */
-    omittedByCap: jsonb52("omitted_by_cap").notNull().default(sql24`'[]'::jsonb`),
+    omittedByCap: jsonb53("omitted_by_cap").notNull().default(sql24`'[]'::jsonb`),
     /**
      * The codemod's receipt (migration 0296) — every path it bound, and every one it could not.
      *
@@ -28604,25 +28640,25 @@ var conversionProposals = pgTable92(
      * pending list for those, which is exactly the silent "nothing left to do" this lane refuses.
      * Informative: `proposeConversion` re-derives every claim it acts on from the proposed files.
      */
-    receipt: jsonb52("receipt"),
-    status: text93("status").notNull().default("draft"),
-    version: integer46("version").notNull().default(1),
-    idempotencyKey: text93("idempotency_key").notNull(),
+    receipt: jsonb53("receipt"),
+    status: text94("status").notNull().default("draft"),
+    version: integer47("version").notNull().default(1),
+    idempotencyKey: text94("idempotency_key").notNull(),
     /**
      * The key of the transition that put this row in its CURRENT terminal state — the approve, or
      * the manual supersede. Separate from `idempotencyKey`, which belongs to the create: a client
      * retrying one act must never be answered with the result of another.
      */
-    transitionIdempotencyKey: text93("transition_idempotency_key"),
-    createdBy: text93("created_by").notNull(),
-    createdAt: timestamp85("created_at", { withTimezone: true }).notNull().defaultNow(),
-    approvedBy: text93("approved_by"),
-    approvedAt: timestamp85("approved_at", { withTimezone: true }),
-    supersededAt: timestamp85("superseded_at", { withTimezone: true }),
-    supersededReason: text93("superseded_reason")
+    transitionIdempotencyKey: text94("transition_idempotency_key"),
+    createdBy: text94("created_by").notNull(),
+    createdAt: timestamp86("created_at", { withTimezone: true }).notNull().defaultNow(),
+    approvedBy: text94("approved_by"),
+    approvedAt: timestamp86("approved_at", { withTimezone: true }),
+    supersededAt: timestamp86("superseded_at", { withTimezone: true }),
+    supersededReason: text94("superseded_reason")
   },
   (table) => [
-    index79("conversion_proposals_project_idx").on(table.workspaceId, table.projectId, table.createdAt),
+    index80("conversion_proposals_project_idx").on(table.workspaceId, table.projectId, table.createdAt),
     unique8("conversion_proposals_idempotency_unique").on(table.projectId, table.idempotencyKey),
     foreignKey9({
       columns: [table.projectId, table.workspaceId],
@@ -28640,28 +28676,28 @@ var conversionProposals = pgTable92(
 
 // src/schema/conversion_briefs_issued.ts
 import { sql as sql25 } from "drizzle-orm";
-import { check as check8, foreignKey as foreignKey10, index as index80, jsonb as jsonb53, pgTable as pgTable93, text as text94, timestamp as timestamp86, unique as unique9, uuid as uuid6 } from "drizzle-orm/pg-core";
-var conversionBriefsIssued = pgTable93(
+import { check as check8, foreignKey as foreignKey10, index as index81, jsonb as jsonb54, pgTable as pgTable94, text as text95, timestamp as timestamp87, unique as unique9, uuid as uuid6 } from "drizzle-orm/pg-core";
+var conversionBriefsIssued = pgTable94(
   "conversion_briefs_issued",
   {
     id: uuid6("id").primaryKey().defaultRandom(),
-    workspaceId: text94("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text94("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    workspaceId: text95("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text95("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
     /** sha256 of the canonical brief — `briefDigest`, computed identically by the codemod. */
-    briefDigest: text94("brief_digest").notNull(),
+    briefDigest: text95("brief_digest").notNull(),
     /** `[{ route, scope, path, kind, locator? }]` — every bindable path the brief listed. */
-    paths: jsonb53("paths").notNull().default(sql25`'[]'::jsonb`),
+    paths: jsonb54("paths").notNull().default(sql25`'[]'::jsonb`),
     /**
      * The codemod's account of the run against THIS digest (`submit_conversion_receipt`): which
      * paths it rewrote, which it could not, and why. Null until one is submitted — a hand
      * conversion never submits one and still counts toward coverage.
      */
-    receipt: jsonb53("receipt"),
+    receipt: jsonb54("receipt"),
     /** The LAST time this pin was issued. What a retention sweep keys on. */
-    issuedAt: timestamp86("issued_at", { withTimezone: true }).notNull().defaultNow()
+    issuedAt: timestamp87("issued_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index80("conversion_briefs_issued_project_issued_idx").on(table.projectId, table.issuedAt),
+    index81("conversion_briefs_issued_project_issued_idx").on(table.projectId, table.issuedAt),
     unique9("conversion_briefs_issued_digest_unique").on(table.projectId, table.briefDigest),
     foreignKey10({
       columns: [table.projectId, table.workspaceId],
@@ -28673,25 +28709,64 @@ var conversionBriefsIssued = pgTable93(
   ]
 );
 
-// src/schema/orchestration_validation.ts
+// src/schema/binding_decisions.ts
 import { sql as sql26 } from "drizzle-orm";
-import {
-  bigint as bigint6,
-  check as check9,
-  foreignKey as foreignKey11,
-  index as index81,
-  integer as integer47,
-  jsonb as jsonb54,
-  pgTable as pgTable94,
-  text as text95,
-  timestamp as timestamp87,
-  unique as unique10,
-  uniqueIndex as uniqueIndex41,
-  uuid as uuid7,
-  varchar as varchar69
-} from "drizzle-orm/pg-core";
-var VALIDATION_ENVELOPE_STATUSES = [
-  "queued",
+import { index as index82, jsonb as jsonb55, pgTable as pgTable95, smallint as smallint2, text as text96, timestamp as timestamp88, uniqueIndex as uniqueIndex41, uuid as uuid7 } from "drizzle-orm/pg-core";
+var BINDING_DECISION_OPS = ["bind", "code", "reject"];
+var BINDING_DECISION_STATES = ["stored", "materialized", "proven", "live", "lost"];
+var bindingDecisions = pgTable95(
+  "binding_decisions",
+  {
+    id: uuid7("id").primaryKey().defaultRandom(),
+    workspaceId: text96("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text96("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    /** `current` | `staging` (CHECK in the migration): the slot the decision's release lands in. */
+    slot: text96("slot").notNull(),
+    target: text96("target").notNull(),
+    /** `bind` | `code` | `reject` | `rule` (CHECK; `rule` since 0467, archive sites). An `accept` is stored as the op it expands to. */
+    op: text96("op").notNull(),
+    payload: jsonb55("payload").$type().notNull().default(sql26`'{}'::jsonb`),
+    /** `person` | `ai` (CHECK), from the request's write origin only. */
+    byKind: text96("by_kind").notNull(),
+    by: text96("by"),
+    /** `stored` | `materialized` | `proven` | `live` | `lost` (CHECK). */
+    state: text96("state").notNull().default("stored"),
+    /** The `force` reason an AI gave over a person's decision. */
+    reason: text96("reason"),
+    receiptsSeen: smallint2("receipts_seen").notNull().default(0),
+    materializedSha: text96("materialized_sha"),
+    provenSha: text96("proven_sha"),
+    /** Non-null: no longer live (replaced, overridden or cleared), kept as the record. */
+    supersededReason: text96("superseded_reason"),
+    createdAt: timestamp88("created_at").notNull().defaultNow(),
+    updatedAt: timestamp88("updated_at").notNull().defaultNow()
+  },
+  (t) => [
+    uniqueIndex41("binding_decisions_target_op_unique").on(t.projectId, t.slot, t.target, t.op),
+    uniqueIndex41("binding_decisions_live_target_unique").on(t.projectId, t.slot, t.target).where(sql26`superseded_reason IS NULL`),
+    index82("binding_decisions_project_slot_state_idx").on(t.projectId, t.slot, t.state)
+  ]
+);
+
+// src/schema/orchestration_validation.ts
+import { sql as sql27 } from "drizzle-orm";
+import {
+  bigint as bigint6,
+  check as check9,
+  foreignKey as foreignKey11,
+  index as index83,
+  integer as integer48,
+  jsonb as jsonb56,
+  pgTable as pgTable96,
+  text as text97,
+  timestamp as timestamp89,
+  unique as unique10,
+  uniqueIndex as uniqueIndex42,
+  uuid as uuid8,
+  varchar as varchar70
+} from "drizzle-orm/pg-core";
+var VALIDATION_ENVELOPE_STATUSES = [
+  "queued",
   "dispatched",
   "action_required",
   "passed",
@@ -28701,51 +28776,51 @@ var VALIDATION_ENVELOPE_STATUSES = [
   "cancelled"
 ];
 var VALIDATION_LIVE_STATUSES = ["queued", "dispatched", "action_required"];
-var orchestrationValidationEnvelopes = pgTable94(
+var orchestrationValidationEnvelopes = pgTable96(
   "orchestration_validation_envelopes",
   {
-    id: uuid7("id").primaryKey().defaultRandom(),
-    workspaceId: text95("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text95("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    runId: uuid7("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
-    attemptId: uuid7("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
+    id: uuid8("id").primaryKey().defaultRandom(),
+    workspaceId: text97("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text97("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    runId: uuid8("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
+    attemptId: uuid8("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
     /** Null until a receipt writer exists (Phase 6). The head below is pinned regardless. */
-    receiptId: uuid7("receipt_id").references(() => orchestrationPullRequestReceipts.id, {
+    receiptId: uuid8("receipt_id").references(() => orchestrationPullRequestReceipts.id, {
       onDelete: "set null"
     }),
-    receiptGeneration: integer47("receipt_generation").notNull().default(1),
+    receiptGeneration: integer48("receipt_generation").notNull().default(1),
     // The pinned tuple. Every field here is compared against returned evidence, and each mismatch
     // has its own error code — "wrong repository" and "wrong head" are different recoveries.
     repositoryId: bigint6("repository_id", { mode: "number" }).notNull(),
     pullRequestId: bigint6("pull_request_id", { mode: "number" }).notNull(),
-    pullRequestNumber: integer47("pull_request_number").notNull(),
+    pullRequestNumber: integer48("pull_request_number").notNull(),
     /** The exact commit this validation is about. A validation proves nothing about any other. */
-    headSha: varchar69("head_sha", { length: 64 }).notNull(),
-    baseSha: varchar69("base_sha", { length: 64 }).notNull(),
-    bindingDigest: varchar69("binding_digest", { length: 71 }).notNull(),
-    schemaHash: varchar69("schema_hash", { length: 64 }).notNull(),
-    brandContractHash: varchar69("brand_contract_hash", { length: 64 }).notNull(),
-    baselineDigest: varchar69("baseline_digest", { length: 71 }).notNull(),
-    toolchainHash: varchar69("toolchain_hash", { length: 64 }).notNull(),
-    validatorVersion: text95("validator_version").notNull(),
-    workflowSha256: varchar69("workflow_sha256", { length: 64 }).notNull(),
+    headSha: varchar70("head_sha", { length: 64 }).notNull(),
+    baseSha: varchar70("base_sha", { length: 64 }).notNull(),
+    bindingDigest: varchar70("binding_digest", { length: 71 }).notNull(),
+    schemaHash: varchar70("schema_hash", { length: 64 }).notNull(),
+    brandContractHash: varchar70("brand_contract_hash", { length: 64 }).notNull(),
+    baselineDigest: varchar70("baseline_digest", { length: 71 }).notNull(),
+    toolchainHash: varchar70("toolchain_hash", { length: 64 }).notNull(),
+    validatorVersion: text97("validator_version").notNull(),
+    workflowSha256: varchar70("workflow_sha256", { length: 64 }).notNull(),
     /** Digest only. The single-use credential itself is handed to the validator and never stored. */
-    nonceHash: varchar69("nonce_hash", { length: 64 }).notNull(),
-    nonceExpiresAt: timestamp87("nonce_expires_at", { withTimezone: true }).notNull(),
-    nonceConsumedAt: timestamp87("nonce_consumed_at", { withTimezone: true }),
-    status: varchar69("status", { length: 20 }).notNull().default("queued"),
-    errorCode: text95("error_code"),
-    errorMessage: text95("error_message"),
+    nonceHash: varchar70("nonce_hash", { length: 64 }).notNull(),
+    nonceExpiresAt: timestamp89("nonce_expires_at", { withTimezone: true }).notNull(),
+    nonceConsumedAt: timestamp89("nonce_consumed_at", { withTimezone: true }),
+    status: varchar70("status", { length: 20 }).notNull().default("queued"),
+    errorCode: text97("error_code"),
+    errorMessage: text97("error_message"),
     /** Composite-FK'd to (evidence.id, evidence.envelope_id) in 0273, so an envelope cannot be
      *  marked passed while pointing at a DIFFERENT envelope's evidence. */
-    evidenceId: uuid7("evidence_id"),
+    evidenceId: uuid8("evidence_id"),
     /** Written on pass, read by nothing. The unlock that consumes it is a later phase. */
-    attestationDigest: varchar69("attestation_digest", { length: 71 }),
-    dispatchedAt: timestamp87("dispatched_at", { withTimezone: true }),
+    attestationDigest: varchar70("attestation_digest", { length: 71 }),
+    dispatchedAt: timestamp89("dispatched_at", { withTimezone: true }),
     /** A retry is a NEW row with a NEW nonce, linked back — never a status reset on this one. */
-    retryOf: uuid7("retry_of"),
-    createdAt: timestamp87("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp87("updated_at", { withTimezone: true }).notNull().defaultNow()
+    retryOf: uuid8("retry_of"),
+    createdAt: timestamp89("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp89("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     unique10("orchestration_validation_envelopes_scope_unique").on(
@@ -28769,15 +28844,15 @@ var orchestrationValidationEnvelopes = pgTable94(
     }).onDelete("set null"),
     // One live envelope per (attempt, head): two validators can never both be authoritative for
     // the same commit. The index arbitrates, so no read-then-write can lose the race.
-    uniqueIndex41("orchestration_validation_envelopes_one_live_per_head").on(table.attemptId, table.headSha).where(sql26`status IN ('queued', 'dispatched', 'action_required')`),
-    index81("orchestration_validation_envelopes_attempt_idx").on(
+    uniqueIndex42("orchestration_validation_envelopes_one_live_per_head").on(table.attemptId, table.headSha).where(sql27`status IN ('queued', 'dispatched', 'action_required')`),
+    index83("orchestration_validation_envelopes_attempt_idx").on(
       table.attemptId,
       table.createdAt.desc()
     ),
-    index81("orchestration_validation_envelopes_sweep_idx").on(table.status, table.nonceExpiresAt).where(sql26`status IN ('queued', 'dispatched')`),
+    index83("orchestration_validation_envelopes_sweep_idx").on(table.status, table.nonceExpiresAt).where(sql27`status IN ('queued', 'dispatched')`),
     check9(
       "orchestration_validation_envelopes_status_check",
-      sql26`${table.status} IN ('queued', 'dispatched', 'action_required', 'passed', 'failed', 'superseded', 'timed_out', 'cancelled')`
+      sql27`${table.status} IN ('queued', 'dispatched', 'action_required', 'passed', 'failed', 'superseded', 'timed_out', 'cancelled')`
     ),
     // Passing is not assignable. It requires evidence that was ingested, an attestation that was
     // written, and a nonce that was consumed — so executor success alone cannot spell it.
@@ -28786,32 +28861,32 @@ var orchestrationValidationEnvelopes = pgTable94(
     // evidence, which is exactly what an honest failing result is.
     check9(
       "orchestration_validation_envelopes_passed_requires_evidence",
-      sql26`${table.status} <> 'passed' OR (${table.evidenceId} IS NOT NULL AND ${table.attestationDigest} IS NOT NULL AND ${table.nonceConsumedAt} IS NOT NULL)`
+      sql27`${table.status} <> 'passed' OR (${table.evidenceId} IS NOT NULL AND ${table.attestationDigest} IS NOT NULL AND ${table.nonceConsumedAt} IS NOT NULL)`
     )
   ]
 );
-var orchestrationValidationEvidence = pgTable94(
+var orchestrationValidationEvidence = pgTable96(
   "orchestration_validation_evidence",
   {
-    id: uuid7("id").primaryKey().defaultRandom(),
-    workspaceId: text95("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text95("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    runId: uuid7("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
-    attemptId: uuid7("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
-    envelopeId: uuid7("envelope_id").notNull().references(() => orchestrationValidationEnvelopes.id, { onDelete: "cascade" }),
-    headSha: varchar69("head_sha", { length: 64 }).notNull(),
-    evidenceDigest: varchar69("evidence_digest", { length: 71 }).notNull(),
-    artifactDigest: varchar69("artifact_digest", { length: 71 }).notNull(),
-    validatorVersion: text95("validator_version").notNull(),
+    id: uuid8("id").primaryKey().defaultRandom(),
+    workspaceId: text97("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text97("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    runId: uuid8("run_id").notNull().references(() => orchestrationRuns.id, { onDelete: "cascade" }),
+    attemptId: uuid8("attempt_id").notNull().references(() => orchestrationImplementationAttempts.id, { onDelete: "cascade" }),
+    envelopeId: uuid8("envelope_id").notNull().references(() => orchestrationValidationEnvelopes.id, { onDelete: "cascade" }),
+    headSha: varchar70("head_sha", { length: 64 }).notNull(),
+    evidenceDigest: varchar70("evidence_digest", { length: 71 }).notNull(),
+    artifactDigest: varchar70("artifact_digest", { length: 71 }).notNull(),
+    validatorVersion: text97("validator_version").notNull(),
     /** The BrandKit contract this evidence is filed under. 0273 ties it to
      *  `checks->brandKit->contractHash`, so a payload cannot claim a different one. Comparing it
      *  against the ENVELOPE's hash is an ingest check — a CHECK cannot reach another table. */
-    brandContractHash: varchar69("brand_contract_hash", { length: 64 }).notNull(),
-    status: varchar69("status", { length: 10 }).notNull(),
+    brandContractHash: varchar70("brand_contract_hash", { length: 64 }).notNull(),
+    status: varchar70("status", { length: 10 }).notNull(),
     /** brandKit / runtime / visual. The shape is enforced by CHECK in 0273, not by the writer. */
-    checks: jsonb54("checks").notNull(),
-    createdBy: text95("created_by"),
-    createdAt: timestamp87("created_at", { withTimezone: true }).notNull().defaultNow()
+    checks: jsonb56("checks").notNull(),
+    createdBy: text97("created_by"),
+    createdAt: timestamp89("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     unique10("orchestration_validation_evidence_scope_unique").on(
@@ -28838,37 +28913,37 @@ var orchestrationValidationEvidence = pgTable94(
       table.attemptId,
       table.evidenceDigest
     ),
-    index81("orchestration_validation_evidence_envelope_idx").on(table.envelopeId),
+    index83("orchestration_validation_evidence_envelope_idx").on(table.envelopeId),
     check9(
       "orchestration_validation_evidence_status_check",
-      sql26`${table.status} IN ('passed', 'failed')`
+      sql27`${table.status} IN ('passed', 'failed')`
     )
   ]
 );
 
 // src/schema/orchestration_executor_grants.ts
-import { sql as sql27 } from "drizzle-orm";
-import { check as check10, foreignKey as foreignKey12, index as index82, integer as integer48, pgTable as pgTable95, text as text96, timestamp as timestamp88, unique as unique11, uniqueIndex as uniqueIndex42, uuid as uuid8, varchar as varchar70 } from "drizzle-orm/pg-core";
+import { sql as sql28 } from "drizzle-orm";
+import { check as check10, foreignKey as foreignKey12, index as index84, integer as integer49, pgTable as pgTable97, text as text98, timestamp as timestamp90, unique as unique11, uniqueIndex as uniqueIndex43, uuid as uuid9, varchar as varchar71 } from "drizzle-orm/pg-core";
 var EXECUTOR_GRANT_STATUSES = ["active", "revoked", "expired"];
-var orchestrationExecutorGrants = pgTable95(
+var orchestrationExecutorGrants = pgTable97(
   "orchestration_executor_grants",
   {
-    id: text96("id").primaryKey().default(sql27`gen_random_uuid()`),
-    workspaceId: text96("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text96("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    installationId: uuid8("installation_id").notNull().references(() => orchestrationExecutorInstallations.id, { onDelete: "cascade" }),
+    id: text98("id").primaryKey().default(sql28`gen_random_uuid()`),
+    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    installationId: uuid9("installation_id").notNull().references(() => orchestrationExecutorInstallations.id, { onDelete: "cascade" }),
     /** Digest only. The credential is returned once at mint and never stored. */
-    credentialHash: varchar70("credential_hash", { length: 64 }).notNull(),
-    credentialAudience: text96("credential_audience").notNull(),
-    credentialExpiresAt: timestamp88("credential_expires_at", { withTimezone: true }).notNull(),
+    credentialHash: varchar71("credential_hash", { length: 64 }).notNull(),
+    credentialAudience: text98("credential_audience").notNull(),
+    credentialExpiresAt: timestamp90("credential_expires_at", { withTimezone: true }).notNull(),
     /** The epoch this credential is valid for. A fenced session's credential dies before it expires. */
-    sessionEpoch: integer48("session_epoch").notNull(),
-    status: varchar70("status", { length: 16 }).notNull().default("active"),
-    revokedAt: timestamp88("revoked_at", { withTimezone: true }),
-    revokedBy: text96("revoked_by"),
-    createdBy: text96("created_by"),
-    createdAt: timestamp88("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp88("updated_at", { withTimezone: true }).notNull().defaultNow()
+    sessionEpoch: integer49("session_epoch").notNull(),
+    status: varchar71("status", { length: 16 }).notNull().default("active"),
+    revokedAt: timestamp90("revoked_at", { withTimezone: true }),
+    revokedBy: text98("revoked_by"),
+    createdBy: text98("created_by"),
+    createdAt: timestamp90("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp90("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     unique11("orchestration_executor_grants_scope_unique").on(
@@ -28887,42 +28962,42 @@ var orchestrationExecutorGrants = pgTable95(
     }).onDelete("cascade"),
     // One live credential per installation. Two would mean two processes can each present a valid
     // one, and the exclusion argument collapses before the lease layer is reached.
-    uniqueIndex42("orchestration_executor_grants_one_active_per_installation").on(table.installationId).where(sql27`status = 'active'`),
-    index82("orchestration_executor_grants_credential_idx").on(table.workspaceId, table.credentialHash).where(sql27`status = 'active'`),
+    uniqueIndex43("orchestration_executor_grants_one_active_per_installation").on(table.installationId).where(sql28`status = 'active'`),
+    index84("orchestration_executor_grants_credential_idx").on(table.workspaceId, table.credentialHash).where(sql28`status = 'active'`),
     check10(
       "orchestration_executor_grants_status_check",
-      sql27`${table.status} IN ('active', 'revoked', 'expired')`
+      sql28`${table.status} IN ('active', 'revoked', 'expired')`
     ),
     check10(
       "orchestration_executor_grants_revocation_paired",
-      sql27`(${table.status} = 'revoked') = (${table.revokedAt} IS NOT NULL)`
+      sql28`(${table.status} = 'revoked') = (${table.revokedAt} IS NOT NULL)`
     )
   ]
 );
 
 // src/schema/component_presets.ts
-import { pgTable as pgTable96, text as text97, varchar as varchar71, timestamp as timestamp89, jsonb as jsonb55, integer as integer49, index as index83, uniqueIndex as uniqueIndex43 } from "drizzle-orm/pg-core";
+import { pgTable as pgTable98, text as text99, varchar as varchar72, timestamp as timestamp91, jsonb as jsonb57, integer as integer50, index as index85, uniqueIndex as uniqueIndex44 } from "drizzle-orm/pg-core";
 import { relations as relations16 } from "drizzle-orm";
-var componentPresets = pgTable96(
+var componentPresets = pgTable98(
   "component_presets",
   {
-    id: text97("id").primaryKey(),
-    workspaceId: text97("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    componentId: text97("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
-    name: varchar71("name", { length: 255 }).notNull(),
+    id: text99("id").primaryKey(),
+    workspaceId: text99("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    componentId: text99("component_id").notNull().references(() => components.id, { onDelete: "cascade" }),
+    name: varchar72("name", { length: 255 }).notNull(),
     /** ^[a-z0-9-]+$, unique per component — stable across renames. */
-    slug: varchar71("slug", { length: 255 }).notNull(),
+    slug: varchar72("slug", { length: 255 }).notNull(),
     /** Prop key → value. Validated against the component's `props` on every write. */
-    values: jsonb55("values").$type().notNull().default({}),
-    position: integer49("position").notNull().default(0),
-    createdAt: timestamp89("created_at").notNull().defaultNow(),
-    updatedAt: timestamp89("updated_at").notNull().defaultNow(),
-    createdBy: text97("created_by"),
-    updatedBy: text97("updated_by")
+    values: jsonb57("values").$type().notNull().default({}),
+    position: integer50("position").notNull().default(0),
+    createdAt: timestamp91("created_at").notNull().defaultNow(),
+    updatedAt: timestamp91("updated_at").notNull().defaultNow(),
+    createdBy: text99("created_by"),
+    updatedBy: text99("updated_by")
   },
   (t) => [
-    index83("component_presets_component_position_idx").on(t.componentId, t.position, t.createdAt, t.id),
-    uniqueIndex43("component_presets_component_slug_key").on(t.componentId, t.slug)
+    index85("component_presets_component_position_idx").on(t.componentId, t.position, t.createdAt, t.id),
+    uniqueIndex44("component_presets_component_slug_key").on(t.componentId, t.slug)
   ]
 );
 var componentPresetsRelations = relations16(componentPresets, ({ one }) => ({
@@ -28935,17 +29010,17 @@ var componentPresetsRelations = relations16(componentPresets, ({ one }) => ({
 // src/schema/section_zones.ts
 import {
   foreignKey as foreignKey13,
-  index as index84,
-  integer as integer50,
-  jsonb as jsonb56,
-  pgTable as pgTable97,
-  text as text98,
-  timestamp as timestamp90,
+  index as index86,
+  integer as integer51,
+  jsonb as jsonb58,
+  pgTable as pgTable99,
+  text as text100,
+  timestamp as timestamp92,
   unique as unique12,
-  uniqueIndex as uniqueIndex44,
-  varchar as varchar72
+  uniqueIndex as uniqueIndex45,
+  varchar as varchar73
 } from "drizzle-orm/pg-core";
-import { sql as sql28 } from "drizzle-orm";
+import { sql as sql29 } from "drizzle-orm";
 var SECTION_IMPLEMENTATION_REQUEST_STATUSES = [
   "queued",
   "dispatching",
@@ -28954,15 +29029,15 @@ var SECTION_IMPLEMENTATION_REQUEST_STATUSES = [
   "passed",
   "failed"
 ];
-var sectionDefinitions = pgTable97(
+var sectionDefinitions = pgTable99(
   "section_definitions",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    apiId: varchar72("api_id", { length: 100 }).notNull(),
-    firstPublishedAt: timestamp90("first_published_at"),
-    archivedAt: timestamp90("archived_at"),
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    apiId: varchar73("api_id", { length: 100 }).notNull(),
+    firstPublishedAt: timestamp92("first_published_at"),
+    archivedAt: timestamp92("archived_at"),
     ...auditColumns
   },
   (table) => [
@@ -28972,24 +29047,24 @@ var sectionDefinitions = pgTable97(
       name: "section_definitions_project_workspace_fkey"
     }).onDelete("cascade").onUpdate("cascade"),
     unique12("section_definitions_id_project_unique").on(table.id, table.projectId),
-    uniqueIndex44("section_definitions_project_api_id_unique").on(table.projectId, table.apiId),
-    index84("section_definitions_workspace_idx").on(table.workspaceId),
-    index84("section_definitions_project_idx").on(table.projectId)
+    uniqueIndex45("section_definitions_project_api_id_unique").on(table.projectId, table.apiId),
+    index86("section_definitions_workspace_idx").on(table.workspaceId),
+    index86("section_definitions_project_idx").on(table.projectId)
   ]
 );
-var sectionDefinitionVersions = pgTable97(
+var sectionDefinitionVersions = pgTable99(
   "section_definition_versions",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    sectionDefinitionId: text98("section_definition_id").notNull(),
-    version: integer50("version").notNull(),
-    label: varchar72("label", { length: 255 }).notNull(),
-    fields: jsonb56("fields").$type().notNull().default([]),
-    schemaHash: varchar72("schema_hash", { length: 64 }).notNull(),
-    createdBy: text98("created_by"),
-    createdAt: timestamp90("created_at").notNull().defaultNow()
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    sectionDefinitionId: text100("section_definition_id").notNull(),
+    version: integer51("version").notNull(),
+    label: varchar73("label", { length: 255 }).notNull(),
+    fields: jsonb58("fields").$type().notNull().default([]),
+    schemaHash: varchar73("schema_hash", { length: 64 }).notNull(),
+    createdBy: text100("created_by"),
+    createdAt: timestamp92("created_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey13({
@@ -29008,20 +29083,20 @@ var sectionDefinitionVersions = pgTable97(
       table.version,
       table.projectId
     ),
-    index84("section_definition_versions_project_idx").on(table.projectId)
+    index86("section_definition_versions_project_idx").on(table.projectId)
   ]
 );
-var sectionZones = pgTable97(
+var sectionZones = pgTable99(
   "section_zones",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    schemaKind: varchar72("schema_kind", { length: 20 }).$type().notNull(),
-    schemaId: text98("schema_id").notNull(),
-    fieldKey: varchar72("field_key", { length: 255 }).notNull(),
-    draftRevision: integer50("draft_revision").notNull().default(1),
-    publishedRevision: integer50("published_revision"),
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    schemaKind: varchar73("schema_kind", { length: 20 }).$type().notNull(),
+    schemaId: text100("schema_id").notNull(),
+    fieldKey: varchar73("field_key", { length: 255 }).notNull(),
+    draftRevision: integer51("draft_revision").notNull().default(1),
+    publishedRevision: integer51("published_revision"),
     ...auditColumns
   },
   (table) => [
@@ -29031,21 +29106,21 @@ var sectionZones = pgTable97(
       name: "section_zones_project_workspace_fkey"
     }).onDelete("cascade").onUpdate("cascade"),
     unique12("section_zones_id_project_unique").on(table.id, table.projectId),
-    uniqueIndex44("section_zones_schema_owner_unique").on(table.projectId, table.schemaKind, table.schemaId),
-    index84("section_zones_workspace_idx").on(table.workspaceId)
+    uniqueIndex45("section_zones_schema_owner_unique").on(table.projectId, table.schemaKind, table.schemaId),
+    index86("section_zones_workspace_idx").on(table.workspaceId)
   ]
 );
-var sectionZoneAttachments = pgTable97(
+var sectionZoneAttachments = pgTable99(
   "section_zone_attachments",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    zoneId: text98("zone_id").notNull(),
-    sectionDefinitionId: text98("section_definition_id").notNull(),
-    draftVersion: integer50("draft_version").notNull(),
-    publishedVersion: integer50("published_version"),
-    position: integer50("position").notNull().default(0),
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    zoneId: text100("zone_id").notNull(),
+    sectionDefinitionId: text100("section_definition_id").notNull(),
+    draftVersion: integer51("draft_version").notNull(),
+    publishedVersion: integer51("published_version"),
+    position: integer51("position").notNull().default(0),
     ...auditColumns
   },
   (table) => [
@@ -29082,24 +29157,24 @@ var sectionZoneAttachments = pgTable97(
       ],
       name: "section_zone_attachments_published_version_fkey"
     }).onDelete("restrict"),
-    uniqueIndex44("section_zone_attachments_zone_definition_unique").on(table.zoneId, table.sectionDefinitionId),
-    index84("section_zone_attachments_zone_position_idx").on(table.zoneId, table.position, table.id)
+    uniqueIndex45("section_zone_attachments_zone_definition_unique").on(table.zoneId, table.sectionDefinitionId),
+    index86("section_zone_attachments_zone_position_idx").on(table.zoneId, table.position, table.id)
   ]
 );
-var sectionManifests = pgTable97(
+var sectionManifests = pgTable99(
   "section_manifests",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    sectionDefinitionId: text98("section_definition_id").notNull(),
-    sectionVersion: integer50("section_version").notNull(),
-    apiId: varchar72("api_id", { length: 100 }).notNull(),
-    schemaHash: varchar72("schema_hash", { length: 64 }).notNull(),
-    commitSha: varchar72("commit_sha", { length: 64 }).notNull(),
-    manifest: jsonb56("manifest").$type().notNull(),
-    createdBy: text98("created_by"),
-    createdAt: timestamp90("created_at").notNull().defaultNow()
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    sectionDefinitionId: text100("section_definition_id").notNull(),
+    sectionVersion: integer51("section_version").notNull(),
+    apiId: varchar73("api_id", { length: 100 }).notNull(),
+    schemaHash: varchar73("schema_hash", { length: 64 }).notNull(),
+    commitSha: varchar73("commit_sha", { length: 64 }).notNull(),
+    manifest: jsonb58("manifest").$type().notNull(),
+    createdBy: text100("created_by"),
+    createdAt: timestamp92("created_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey13({
@@ -29117,26 +29192,26 @@ var sectionManifests = pgTable97(
       name: "section_manifests_definition_version_project_fkey"
     }).onDelete("cascade"),
     unique12("section_manifests_id_project_unique").on(table.id, table.projectId),
-    index84("section_manifests_definition_version_idx").on(table.sectionDefinitionId, table.sectionVersion, table.createdAt)
+    index86("section_manifests_definition_version_idx").on(table.sectionDefinitionId, table.sectionVersion, table.createdAt)
   ]
 );
-var sectionValidationRuns = pgTable97(
+var sectionValidationRuns = pgTable99(
   "section_validation_runs",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    sectionDefinitionId: text98("section_definition_id").notNull(),
-    sectionVersion: integer50("section_version").notNull(),
-    manifestId: text98("manifest_id").notNull(),
-    status: varchar72("status", { length: 20 }).$type().notNull(),
-    schemaHash: varchar72("schema_hash", { length: 64 }).notNull(),
-    commitSha: varchar72("commit_sha", { length: 64 }).notNull(),
-    fixtureHash: varchar72("fixture_hash", { length: 64 }).notNull(),
-    evidenceDigest: varchar72("evidence_digest", { length: 128 }).notNull(),
-    results: jsonb56("results").$type().notNull(),
-    createdBy: text98("created_by"),
-    createdAt: timestamp90("created_at").notNull().defaultNow()
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    sectionDefinitionId: text100("section_definition_id").notNull(),
+    sectionVersion: integer51("section_version").notNull(),
+    manifestId: text100("manifest_id").notNull(),
+    status: varchar73("status", { length: 20 }).$type().notNull(),
+    schemaHash: varchar73("schema_hash", { length: 64 }).notNull(),
+    commitSha: varchar73("commit_sha", { length: 64 }).notNull(),
+    fixtureHash: varchar73("fixture_hash", { length: 64 }).notNull(),
+    evidenceDigest: varchar73("evidence_digest", { length: 128 }).notNull(),
+    results: jsonb58("results").$type().notNull(),
+    createdBy: text100("created_by"),
+    createdAt: timestamp92("created_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey13({
@@ -29159,25 +29234,25 @@ var sectionValidationRuns = pgTable97(
       name: "section_validation_runs_manifest_project_fkey"
     }).onDelete("restrict"),
     unique12("section_validation_runs_id_project_unique").on(table.id, table.projectId),
-    index84("section_validation_runs_definition_version_idx").on(table.sectionDefinitionId, table.sectionVersion, table.createdAt)
+    index86("section_validation_runs_definition_version_idx").on(table.sectionDefinitionId, table.sectionVersion, table.createdAt)
   ]
 );
-var sectionVisualApprovals = pgTable97(
+var sectionVisualApprovals = pgTable99(
   "section_visual_approvals",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    sectionDefinitionId: text98("section_definition_id").notNull(),
-    sectionVersion: integer50("section_version").notNull(),
-    manifestId: text98("manifest_id").notNull(),
-    validationRunId: text98("validation_run_id").notNull(),
-    schemaHash: varchar72("schema_hash", { length: 64 }).notNull(),
-    commitSha: varchar72("commit_sha", { length: 64 }).notNull(),
-    fixtureHash: varchar72("fixture_hash", { length: 64 }).notNull(),
-    evidenceDigest: varchar72("evidence_digest", { length: 128 }).notNull(),
-    approvedBy: text98("approved_by").notNull(),
-    createdAt: timestamp90("created_at").notNull().defaultNow()
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    sectionDefinitionId: text100("section_definition_id").notNull(),
+    sectionVersion: integer51("section_version").notNull(),
+    manifestId: text100("manifest_id").notNull(),
+    validationRunId: text100("validation_run_id").notNull(),
+    schemaHash: varchar73("schema_hash", { length: 64 }).notNull(),
+    commitSha: varchar73("commit_sha", { length: 64 }).notNull(),
+    fixtureHash: varchar73("fixture_hash", { length: 64 }).notNull(),
+    evidenceDigest: varchar73("evidence_digest", { length: 128 }).notNull(),
+    approvedBy: text100("approved_by").notNull(),
+    createdAt: timestamp92("created_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey13({
@@ -29204,36 +29279,36 @@ var sectionVisualApprovals = pgTable97(
       foreignColumns: [sectionValidationRuns.id, sectionValidationRuns.projectId],
       name: "section_visual_approvals_validation_project_fkey"
     }).onDelete("restrict"),
-    index84("section_visual_approvals_definition_version_idx").on(table.sectionDefinitionId, table.sectionVersion, table.createdAt)
+    index86("section_visual_approvals_definition_version_idx").on(table.sectionDefinitionId, table.sectionVersion, table.createdAt)
   ]
 );
-var sectionImplementationRequests = pgTable97(
+var sectionImplementationRequests = pgTable99(
   "section_implementation_requests",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    sectionDefinitionId: text98("section_definition_id").notNull(),
-    sectionVersion: integer50("section_version").notNull(),
-    provider: varchar72("provider", { length: 20 }).$type().notNull(),
-    status: varchar72("status", { length: 20 }).$type().notNull().default("queued"),
-    schemaHash: varchar72("schema_hash", { length: 64 }).notNull(),
-    targetCommitSha: varchar72("target_commit_sha", { length: 64 }),
-    providerRunId: varchar72("provider_run_id", { length: 255 }),
-    providerRunUrl: text98("provider_run_url"),
-    manifestId: text98("manifest_id"),
-    validationRunId: text98("validation_run_id"),
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    sectionDefinitionId: text100("section_definition_id").notNull(),
+    sectionVersion: integer51("section_version").notNull(),
+    provider: varchar73("provider", { length: 20 }).$type().notNull(),
+    status: varchar73("status", { length: 20 }).$type().notNull().default("queued"),
+    schemaHash: varchar73("schema_hash", { length: 64 }).notNull(),
+    targetCommitSha: varchar73("target_commit_sha", { length: 64 }),
+    providerRunId: varchar73("provider_run_id", { length: 255 }),
+    providerRunUrl: text100("provider_run_url"),
+    manifestId: text100("manifest_id"),
+    validationRunId: text100("validation_run_id"),
     /** SHA-256 of the request-scoped GitHub callback bearer. The plaintext is never persisted. */
-    callbackTokenHash: varchar72("callback_token_hash", { length: 64 }),
-    requestedBy: text98("requested_by").notNull(),
-    claimedBy: text98("claimed_by"),
-    errorCode: varchar72("error_code", { length: 100 }),
-    errorMessage: text98("error_message"),
-    dispatchedAt: timestamp90("dispatched_at"),
-    startedAt: timestamp90("started_at"),
-    completedAt: timestamp90("completed_at"),
-    createdAt: timestamp90("created_at").notNull().defaultNow(),
-    updatedAt: timestamp90("updated_at").notNull().defaultNow()
+    callbackTokenHash: varchar73("callback_token_hash", { length: 64 }),
+    requestedBy: text100("requested_by").notNull(),
+    claimedBy: text100("claimed_by"),
+    errorCode: varchar73("error_code", { length: 100 }),
+    errorMessage: text100("error_message"),
+    dispatchedAt: timestamp92("dispatched_at"),
+    startedAt: timestamp92("started_at"),
+    completedAt: timestamp92("completed_at"),
+    createdAt: timestamp92("created_at").notNull().defaultNow(),
+    updatedAt: timestamp92("updated_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey13({
@@ -29261,21 +29336,21 @@ var sectionImplementationRequests = pgTable97(
       name: "section_implementation_requests_validation_project_fkey"
     }).onDelete("restrict"),
     unique12("section_implementation_requests_id_project_unique").on(table.id, table.projectId),
-    uniqueIndex44("section_implementation_requests_one_active_unique").on(table.projectId, table.sectionDefinitionId, table.sectionVersion, table.schemaHash).where(sql28`${table.status} IN ('queued', 'dispatching', 'dispatched', 'running')`),
-    index84("section_implementation_requests_project_created_idx").on(table.projectId, table.createdAt)
+    uniqueIndex45("section_implementation_requests_one_active_unique").on(table.projectId, table.sectionDefinitionId, table.sectionVersion, table.schemaHash).where(sql29`${table.status} IN ('queued', 'dispatching', 'dispatched', 'running')`),
+    index86("section_implementation_requests_project_created_idx").on(table.projectId, table.createdAt)
   ]
 );
-var sectionZoneReleases = pgTable97(
+var sectionZoneReleases = pgTable99(
   "section_zone_releases",
   {
-    id: text98("id").primaryKey(),
-    workspaceId: text98("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    projectId: text98("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-    zoneId: text98("zone_id").notNull(),
-    revision: integer50("revision").notNull(),
-    snapshot: jsonb56("snapshot").$type().notNull(),
-    publishedBy: text98("published_by").notNull(),
-    publishedAt: timestamp90("published_at").notNull().defaultNow()
+    id: text100("id").primaryKey(),
+    workspaceId: text100("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    projectId: text100("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+    zoneId: text100("zone_id").notNull(),
+    revision: integer51("revision").notNull(),
+    snapshot: jsonb58("snapshot").$type().notNull(),
+    publishedBy: text100("published_by").notNull(),
+    publishedAt: timestamp92("published_at").notNull().defaultNow()
   },
   (table) => [
     foreignKey13({
@@ -29289,13 +29364,13 @@ var sectionZoneReleases = pgTable97(
       name: "section_zone_releases_zone_project_fkey"
     }).onDelete("cascade"),
     unique12("section_zone_releases_zone_revision_unique").on(table.zoneId, table.revision),
-    index84("section_zone_releases_project_published_idx").on(table.projectId, table.publishedAt)
+    index86("section_zone_releases_project_published_idx").on(table.projectId, table.publishedAt)
   ]
 );
 
 // src/schema/content_locks.ts
-import { check as check11, index as index85, jsonb as jsonb57, pgTable as pgTable98, text as text99, timestamp as timestamp91 } from "drizzle-orm/pg-core";
-import { sql as sql29 } from "drizzle-orm";
+import { check as check11, index as index87, jsonb as jsonb59, pgTable as pgTable100, text as text101, timestamp as timestamp93 } from "drizzle-orm/pg-core";
+import { sql as sql30 } from "drizzle-orm";
 var CONTENT_LOCK_TARGET_KINDS = [
   "page",
   "content_entry",
@@ -29303,32 +29378,32 @@ var CONTENT_LOCK_TARGET_KINDS = [
   "component_definition"
 ];
 var CONTENT_LOCK_MODES = ["all", "agents"];
-var contentLocks = pgTable98(
+var contentLocks = pgTable100(
   "content_locks",
   {
-    id: text99("id").primaryKey(),
-    workspaceId: text99("workspace_id").notNull(),
-    projectId: text99("project_id").notNull(),
-    targetKind: text99("target_kind").$type().notNull(),
-    targetId: text99("target_id").notNull(),
-    blockId: text99("block_id"),
+    id: text101("id").primaryKey(),
+    workspaceId: text101("workspace_id").notNull(),
+    projectId: text101("project_id").notNull(),
+    targetKind: text101("target_kind").$type().notNull(),
+    targetId: text101("target_id").notNull(),
+    blockId: text101("block_id"),
     // Deterministic structural path plus block ancestry captured when the lock is created.
     // Nullable so Wave 5 remains compatible with locks created before this fingerprint existed.
-    blockFingerprint: jsonb57("block_fingerprint").$type(),
-    fieldPath: text99("field_path").array(),
-    mode: text99("mode").$type().notNull().default("all"),
-    reason: text99("reason"),
-    createdBy: text99("created_by").notNull(),
-    createdAt: timestamp91("created_at").notNull().defaultNow(),
-    releasedBy: text99("released_by"),
-    releasedAt: timestamp91("released_at")
+    blockFingerprint: jsonb59("block_fingerprint").$type(),
+    fieldPath: text101("field_path").array(),
+    mode: text101("mode").$type().notNull().default("all"),
+    reason: text101("reason"),
+    createdBy: text101("created_by").notNull(),
+    createdAt: timestamp93("created_at").notNull().defaultNow(),
+    releasedBy: text101("released_by"),
+    releasedAt: timestamp93("released_at")
   },
   (table) => [
-    index85("content_locks_workspace_idx").on(table.workspaceId),
-    index85("content_locks_project_idx").on(table.projectId),
-    index85("content_locks_target_idx").on(table.targetKind, table.targetId).where(sql29`${table.releasedAt} IS NULL`),
-    check11("content_locks_target_kind_check", sql29`${table.targetKind} IN ('page','content_entry','singleton_entry','component_definition')`),
-    check11("content_locks_mode_check", sql29`${table.mode} IN ('all','agents')`)
+    index87("content_locks_workspace_idx").on(table.workspaceId),
+    index87("content_locks_project_idx").on(table.projectId),
+    index87("content_locks_target_idx").on(table.targetKind, table.targetId).where(sql30`${table.releasedAt} IS NULL`),
+    check11("content_locks_target_kind_check", sql30`${table.targetKind} IN ('page','content_entry','singleton_entry','component_definition')`),
+    check11("content_locks_mode_check", sql30`${table.mode} IN ('all','agents')`)
     // `content_locks_shape_check` lives in migration 0192 ONLY: it calls
     // content_lock_field_path_valid(), which that migration creates. Declared here it went into
     // `drizzle-kit push`'s CREATE TABLE on an empty database, where the function does not exist
@@ -29342,75 +29417,75 @@ var contentLocks = pgTable98(
 
 // src/schema/project_transfers.ts
 import {
-  pgTable as pgTable99,
-  text as text100,
-  varchar as varchar73,
-  timestamp as timestamp92,
-  index as index86,
-  uniqueIndex as uniqueIndex45
+  pgTable as pgTable101,
+  text as text102,
+  varchar as varchar74,
+  timestamp as timestamp94,
+  index as index88,
+  uniqueIndex as uniqueIndex46
 } from "drizzle-orm/pg-core";
-import { sql as sql30 } from "drizzle-orm";
-var projectTransfers = pgTable99(
+import { sql as sql31 } from "drizzle-orm";
+var projectTransfers = pgTable101(
   "project_transfers",
   {
-    id: text100("id").primaryKey(),
+    id: text102("id").primaryKey(),
     // nanoid
-    token: text100("token").notNull(),
+    token: text102("token").notNull(),
     // nanoid(32) — recipient handshake / magic link
-    status: varchar73("status", { length: 20 }).notNull().default("pending"),
+    status: varchar74("status", { length: 20 }).notNull().default("pending"),
     // pending | accepted (transient) | completed | declined | cancelled | expired | failed
-    projectId: text100("project_id").notNull(),
+    projectId: text102("project_id").notNull(),
     // FK → projects.id (ON DELETE CASCADE, via migration)
-    fromWorkspaceId: text100("from_workspace_id").notNull(),
+    fromWorkspaceId: text102("from_workspace_id").notNull(),
     // FK → workspaces.id (source)
-    toWorkspaceId: text100("to_workspace_id"),
+    toWorkspaceId: text102("to_workspace_id"),
     // FK → workspaces.id — resolved at accept (null while pending)
-    initiatedBy: text100("initiated_by").notNull(),
+    initiatedBy: text102("initiated_by").notNull(),
     // FK → users.id (source owner)
-    recipientEmail: varchar73("recipient_email", { length: 255 }).notNull(),
+    recipientEmail: varchar74("recipient_email", { length: 255 }).notNull(),
     // lowercased
-    note: text100("note"),
+    note: text102("note"),
     // optional message to the recipient
-    resolvedAt: timestamp92("resolved_at"),
+    resolvedAt: timestamp94("resolved_at"),
     // set on accept/decline/cancel/expire
-    resolvedBy: text100("resolved_by"),
+    resolvedBy: text102("resolved_by"),
     // FK → users.id (accepter/decliner/canceller)
-    error: text100("error"),
+    error: text102("error"),
     // failure detail when status='failed'
-    expiresAt: timestamp92("expires_at").notNull(),
+    expiresAt: timestamp94("expires_at").notNull(),
     // createdAt + 7d
-    createdAt: timestamp92("created_at").notNull().defaultNow(),
-    updatedAt: timestamp92("updated_at").notNull().defaultNow()
+    createdAt: timestamp94("created_at").notNull().defaultNow(),
+    updatedAt: timestamp94("updated_at").notNull().defaultNow()
   },
   (table) => [
     // At most one OPEN transfer per project. Partial-unique so completed/declined/
     // cancelled/expired/failed rows never wedge a re-initiation.
-    uniqueIndex45("project_transfers_one_pending_idx").on(table.projectId).where(sql30`${table.status} = 'pending'`),
+    uniqueIndex46("project_transfers_one_pending_idx").on(table.projectId).where(sql31`${table.status} = 'pending'`),
     // Recipient inbox lookup (GET /me/transfers by email + status).
-    index86("project_transfers_recipient_idx").on(
+    index88("project_transfers_recipient_idx").on(
       table.recipientEmail,
       table.status
     ),
     // Source-side list (GET /projects/:id/transfers) + cancel.
-    index86("project_transfers_from_ws_idx").on(table.fromWorkspaceId),
-    index86("project_transfers_project_idx").on(table.projectId),
+    index88("project_transfers_from_ws_idx").on(table.fromWorkspaceId),
+    index88("project_transfers_project_idx").on(table.projectId),
     // Magic-link resolution.
-    uniqueIndex45("project_transfers_token_idx").on(table.token),
+    uniqueIndex46("project_transfers_token_idx").on(table.token),
     // Expiry sweep — only pending rows are ever candidates.
-    index86("project_transfers_expires_idx").on(table.expiresAt).where(sql30`${table.status} = 'pending'`)
+    index88("project_transfers_expires_idx").on(table.expiresAt).where(sql31`${table.status} = 'pending'`)
   ]
 );
 
 // src/schema/backups.ts
 import {
-  pgTable as pgTable100,
-  text as text101,
-  varchar as varchar74,
-  integer as integer51,
+  pgTable as pgTable102,
+  text as text103,
+  varchar as varchar75,
+  integer as integer52,
   bigint as bigint7,
-  jsonb as jsonb58,
-  timestamp as timestamp93,
-  index as index87
+  jsonb as jsonb60,
+  timestamp as timestamp95,
+  index as index89
 } from "drizzle-orm/pg-core";
 var FULL_BACKUP_SCOPE = {
   content: true,
@@ -29419,315 +29494,315 @@ var FULL_BACKUP_SCOPE = {
   submissions: true,
   analytics: true
 };
-var backups = pgTable100(
+var backups = pgTable102(
   "backups",
   {
-    id: text101("id").primaryKey(),
+    id: text103("id").primaryKey(),
     // nanoid
-    workspaceId: text101("workspace_id").notNull(),
+    workspaceId: text103("workspace_id").notNull(),
     // FK → workspaces.id (RLS scope)
-    projectId: text101("project_id").notNull(),
+    projectId: text103("project_id").notNull(),
     // FK → projects.id
-    name: varchar74("name", { length: 255 }).notNull(),
-    source: varchar74("source", { length: 20 }).notNull().default("manual"),
-    status: varchar74("status", { length: 20 }).notNull().default("pending"),
-    manifestKey: text101("manifest_key"),
+    name: varchar75("name", { length: 255 }).notNull(),
+    source: varchar75("source", { length: 20 }).notNull().default("manual"),
+    status: varchar75("status", { length: 20 }).notNull().default("pending"),
+    manifestKey: text103("manifest_key"),
     // R2 key of the gzipped manifest; NULL until ready
-    manifestVersion: integer51("manifest_version").notNull().default(1),
+    manifestVersion: integer52("manifest_version").notNull().default(1),
     // forward-compat
     sizeBytes: bigint7("size_bytes", { mode: "number" }),
-    counts: jsonb58("counts").$type().notNull().default({}),
+    counts: jsonb60("counts").$type().notNull().default({}),
     // R2 object keys this snapshot references. Powers the media-GC hold:
     // `list_backup_referenced_media_keys()` keeps these keys alive while the
     // backup is live, so a restore never finds a garbage-collected object.
-    mediaKeys: jsonb58("media_keys").$type().notNull().default([]),
-    scope: jsonb58("scope").$type().notNull().default(FULL_BACKUP_SCOPE),
-    error: text101("error"),
-    createdBy: text101("created_by"),
+    mediaKeys: jsonb60("media_keys").$type().notNull().default([]),
+    scope: jsonb60("scope").$type().notNull().default(FULL_BACKUP_SCOPE),
+    error: text103("error"),
+    createdBy: text103("created_by"),
     // FK → users(id); NULL = system-initiated
-    createdAt: timestamp93("created_at").notNull().defaultNow(),
-    readyAt: timestamp93("ready_at"),
-    expiresAt: timestamp93("expires_at"),
+    createdAt: timestamp95("created_at").notNull().defaultNow(),
+    readyAt: timestamp95("ready_at"),
+    expiresAt: timestamp95("expires_at"),
     // retention horizon; NULL = keep until count-pruned
-    deletedAt: timestamp93("deleted_at")
+    deletedAt: timestamp95("deleted_at")
   },
   (t) => [
-    index87("backups_project_idx").on(t.projectId, t.createdAt),
-    index87("backups_workspace_idx").on(t.workspaceId)
+    index89("backups_project_idx").on(t.projectId, t.createdAt),
+    index89("backups_workspace_idx").on(t.workspaceId)
   ]
 );
 
 // src/schema/backup_jobs.ts
 import {
-  pgTable as pgTable101,
-  text as text102,
-  varchar as varchar75,
-  integer as integer52,
-  jsonb as jsonb59,
-  timestamp as timestamp94,
-  index as index88
+  pgTable as pgTable103,
+  text as text104,
+  varchar as varchar76,
+  integer as integer53,
+  jsonb as jsonb61,
+  timestamp as timestamp96,
+  index as index90
 } from "drizzle-orm/pg-core";
-var backupJobs = pgTable101(
+var backupJobs = pgTable103(
   "backup_jobs",
   {
-    id: text102("id").primaryKey(),
+    id: text104("id").primaryKey(),
     // nanoid
-    workspaceId: text102("workspace_id").notNull(),
-    projectId: text102("project_id").notNull(),
+    workspaceId: text104("workspace_id").notNull(),
+    projectId: text104("project_id").notNull(),
     // create → the pending backups.id this job fills; restore → the source backup.
-    backupId: text102("backup_id"),
-    operation: varchar75("operation", { length: 16 }).notNull(),
-    status: varchar75("status", { length: 16 }).notNull().default("pending"),
-    progress: integer52("progress").notNull().default(0),
+    backupId: text104("backup_id"),
+    operation: varchar76("operation", { length: 16 }).notNull(),
+    status: varchar76("status", { length: 16 }).notNull().default("pending"),
+    progress: integer53("progress").notNull().default(0),
     // 0–100
-    workingSince: timestamp94("working_since", { withTimezone: true }),
-    attempts: integer52("attempts").notNull().default(0),
-    error: text102("error"),
-    payload: jsonb59("payload").$type().notNull().default({}),
-    createdAt: timestamp94("created_at").notNull().defaultNow(),
-    updatedAt: timestamp94("updated_at").notNull().defaultNow()
+    workingSince: timestamp96("working_since", { withTimezone: true }),
+    attempts: integer53("attempts").notNull().default(0),
+    error: text104("error"),
+    payload: jsonb61("payload").$type().notNull().default({}),
+    createdAt: timestamp96("created_at").notNull().defaultNow(),
+    updatedAt: timestamp96("updated_at").notNull().defaultNow()
   },
   (t) => [
-    index88("backup_jobs_drain_idx").on(t.status, t.createdAt),
-    index88("backup_jobs_project_idx").on(t.projectId)
+    index90("backup_jobs_drain_idx").on(t.status, t.createdAt),
+    index90("backup_jobs_project_idx").on(t.projectId)
   ]
 );
 
 // src/schema/clone_links.ts
-import { pgTable as pgTable102, text as text103, boolean as boolean31, jsonb as jsonb60, timestamp as timestamp95, index as index89 } from "drizzle-orm/pg-core";
-var cloneLinks = pgTable102(
+import { pgTable as pgTable104, text as text105, boolean as boolean31, jsonb as jsonb62, timestamp as timestamp97, index as index91 } from "drizzle-orm/pg-core";
+var cloneLinks = pgTable104(
   "clone_links",
   {
-    id: text103("id").primaryKey(),
+    id: text105("id").primaryKey(),
     // nanoid
-    workspaceId: text103("workspace_id").notNull(),
+    workspaceId: text105("workspace_id").notNull(),
     // FK → workspaces.id (RLS scope)
-    projectId: text103("project_id").notNull(),
+    projectId: text105("project_id").notNull(),
     // FK → projects.id
-    token: text103("token").notNull(),
+    token: text105("token").notNull(),
     // public share token (nanoid); unique among active links
     enabled: boolean31("enabled").notNull().default(true),
-    scope: jsonb60("scope").$type().notNull(),
-    createdBy: text103("created_by"),
+    scope: jsonb62("scope").$type().notNull(),
+    createdBy: text105("created_by"),
     // FK → users(id); NULL = system-initiated
-    createdAt: timestamp95("created_at").notNull().defaultNow(),
-    updatedAt: timestamp95("updated_at").notNull().defaultNow(),
-    revokedAt: timestamp95("revoked_at")
+    createdAt: timestamp97("created_at").notNull().defaultNow(),
+    updatedAt: timestamp97("updated_at").notNull().defaultNow(),
+    revokedAt: timestamp97("revoked_at")
     // set when the link is rotated/disabled
   },
   (t) => [
-    index89("clone_links_project_idx").on(t.projectId),
-    index89("clone_links_workspace_idx").on(t.workspaceId)
+    index91("clone_links_project_idx").on(t.projectId),
+    index91("clone_links_workspace_idx").on(t.workspaceId)
   ]
 );
 
 // src/schema/clone_jobs.ts
-import { pgTable as pgTable103, text as text104, varchar as varchar76, integer as integer53, jsonb as jsonb61, timestamp as timestamp96, index as index90, uniqueIndex as uniqueIndex46 } from "drizzle-orm/pg-core";
-import { sql as sql31 } from "drizzle-orm";
-var cloneJobs = pgTable103(
+import { pgTable as pgTable105, text as text106, varchar as varchar77, integer as integer54, jsonb as jsonb63, timestamp as timestamp98, index as index92, uniqueIndex as uniqueIndex47 } from "drizzle-orm/pg-core";
+import { sql as sql32 } from "drizzle-orm";
+var cloneJobs = pgTable105(
   "clone_jobs",
   {
-    id: text104("id").primaryKey(),
+    id: text106("id").primaryKey(),
     // nanoid
-    workspaceId: text104("workspace_id").notNull(),
+    workspaceId: text106("workspace_id").notNull(),
     // = targetWorkspaceId (RLS scope)
-    sourceProjectId: text104("source_project_id").notNull(),
-    sourceWorkspaceId: text104("source_workspace_id").notNull(),
-    targetProjectId: text104("target_project_id"),
+    sourceProjectId: text106("source_project_id").notNull(),
+    sourceWorkspaceId: text106("source_workspace_id").notNull(),
+    targetProjectId: text106("target_project_id"),
     // stamped on success
-    requestedName: varchar76("requested_name", { length: 255 }),
-    requestedSlug: varchar76("requested_slug", { length: 255 }),
-    status: varchar76("status", { length: 16 }).notNull().default("pending"),
-    progress: integer53("progress").notNull().default(0),
+    requestedName: varchar77("requested_name", { length: 255 }),
+    requestedSlug: varchar77("requested_slug", { length: 255 }),
+    status: varchar77("status", { length: 16 }).notNull().default("pending"),
+    progress: integer54("progress").notNull().default(0),
     // 0–100
-    workingSince: timestamp96("working_since", { withTimezone: true }),
-    attempts: integer53("attempts").notNull().default(0),
-    error: text104("error"),
-    payload: jsonb61("payload").$type().notNull().default({}),
+    workingSince: timestamp98("working_since", { withTimezone: true }),
+    attempts: integer54("attempts").notNull().default(0),
+    error: text106("error"),
+    payload: jsonb63("payload").$type().notNull().default({}),
     // Which post-clone work the drain owes a finished job. 'clone' = none, today's behaviour.
     // Migration 0343.
-    purpose: varchar76("purpose", { length: 32 }).notNull().default("clone"),
-    initiatedBy: text104("initiated_by"),
+    purpose: varchar77("purpose", { length: 32 }).notNull().default("clone"),
+    initiatedBy: text106("initiated_by"),
     // FK → users(id); NULL = system/agent
-    createdAt: timestamp96("created_at").notNull().defaultNow(),
-    updatedAt: timestamp96("updated_at").notNull().defaultNow()
+    createdAt: timestamp98("created_at").notNull().defaultNow(),
+    updatedAt: timestamp98("updated_at").notNull().defaultNow()
   },
   (t) => [
-    index90("clone_jobs_drain_idx").on(t.status, t.createdAt),
-    index90("clone_jobs_workspace_idx").on(t.workspaceId),
+    index92("clone_jobs_drain_idx").on(t.status, t.createdAt),
+    index92("clone_jobs_workspace_idx").on(t.workspaceId),
     // One unfinished hybrid→headless switch per source (0343). The route maps its 23505 to
     // SWITCH_ALREADY_PENDING.
-    uniqueIndex46("clone_jobs_mode_switch_active_uniq").on(t.sourceProjectId).where(sql31`${t.purpose} = 'mode_switch' AND ${t.status} IN ('pending', 'working')`)
+    uniqueIndex47("clone_jobs_mode_switch_active_uniq").on(t.sourceProjectId).where(sql32`${t.purpose} = 'mode_switch' AND ${t.status} IN ('pending', 'working')`)
   ]
 );
 
 // src/schema/project_branches.ts
 import {
-  primaryKey as primaryKey9,
-  pgTable as pgTable104,
-  text as text105,
-  varchar as varchar77,
-  timestamp as timestamp97,
-  index as index91,
-  uniqueIndex as uniqueIndex47
+  primaryKey as primaryKey10,
+  pgTable as pgTable106,
+  text as text107,
+  varchar as varchar78,
+  timestamp as timestamp99,
+  index as index93,
+  uniqueIndex as uniqueIndex48
 } from "drizzle-orm/pg-core";
-import { sql as sql32 } from "drizzle-orm";
-var projectBranches = pgTable104(
+import { sql as sql33 } from "drizzle-orm";
+var projectBranches = pgTable106(
   "project_branches",
   {
-    id: text105("id").primaryKey(),
-    workspaceId: text105("workspace_id").notNull(),
-    projectId: text105("project_id").notNull(),
-    name: varchar77("name", { length: 80 }).notNull(),
-    slug: varchar77("slug", { length: 80 }).notNull(),
-    parentBranchId: text105("parent_branch_id"),
-    status: varchar77("status", { length: 16 }).$type().notNull().default("open"),
-    appliedAt: timestamp97("applied_at"),
-    abandonedAt: timestamp97("abandoned_at"),
+    id: text107("id").primaryKey(),
+    workspaceId: text107("workspace_id").notNull(),
+    projectId: text107("project_id").notNull(),
+    name: varchar78("name", { length: 80 }).notNull(),
+    slug: varchar78("slug", { length: 80 }).notNull(),
+    parentBranchId: text107("parent_branch_id"),
+    status: varchar78("status", { length: 16 }).$type().notNull().default("open"),
+    appliedAt: timestamp99("applied_at"),
+    abandonedAt: timestamp99("abandoned_at"),
     /** Set while an Apply/Pull runs (0374); a second one is refused. Stale after five minutes. */
-    applyingAt: timestamp97("applying_at"),
+    applyingAt: timestamp99("applying_at"),
     ...auditColumns
   },
   (t) => [
-    index91("project_branches_project_idx").on(t.projectId),
-    uniqueIndex47("project_branches_project_slug_open_idx").on(t.projectId, t.slug).where(sql32`${t.status} = 'open'`)
+    index93("project_branches_project_idx").on(t.projectId),
+    uniqueIndex48("project_branches_project_slug_open_idx").on(t.projectId, t.slug).where(sql33`${t.status} = 'open'`)
   ]
 );
-var branchRowSyncs = pgTable104(
+var branchRowSyncs = pgTable106(
   "branch_row_syncs",
   {
-    workspaceId: text105("workspace_id").notNull(),
-    projectId: text105("project_id").notNull(),
-    branchId: text105("branch_id").notNull(),
-    kind: text105("kind").notNull(),
-    parentRowId: text105("parent_row_id").notNull(),
-    syncedAt: timestamp97("synced_at").notNull().defaultNow()
+    workspaceId: text107("workspace_id").notNull(),
+    projectId: text107("project_id").notNull(),
+    branchId: text107("branch_id").notNull(),
+    kind: text107("kind").notNull(),
+    parentRowId: text107("parent_row_id").notNull(),
+    syncedAt: timestamp99("synced_at").notNull().defaultNow()
   },
   (t) => [
-    primaryKey9({ columns: [t.branchId, t.kind, t.parentRowId] }),
-    index91("branch_row_syncs_project_idx").on(t.projectId)
+    primaryKey10({ columns: [t.branchId, t.kind, t.parentRowId] }),
+    index93("branch_row_syncs_project_idx").on(t.projectId)
   ]
 );
 
 // src/schema/branch_preview_share.ts
-import { pgTable as pgTable105, text as text106, boolean as boolean32, timestamp as timestamp98, index as index92, uniqueIndex as uniqueIndex48 } from "drizzle-orm/pg-core";
-var branchPreviewShares = pgTable105(
+import { pgTable as pgTable107, text as text108, boolean as boolean32, timestamp as timestamp100, index as index94, uniqueIndex as uniqueIndex49 } from "drizzle-orm/pg-core";
+var branchPreviewShares = pgTable107(
   "branch_preview_shares",
   {
-    id: text106("id").primaryKey(),
-    workspaceId: text106("workspace_id").notNull(),
-    projectId: text106("project_id").notNull(),
-    branchId: text106("branch_id").notNull(),
+    id: text108("id").primaryKey(),
+    workspaceId: text108("workspace_id").notNull(),
+    projectId: text108("project_id").notNull(),
+    branchId: text108("branch_id").notNull(),
     publicEnabled: boolean32("public_enabled").notNull().default(false),
-    publicToken: text106("public_token"),
-    createdBy: text106("created_by"),
-    createdAt: timestamp98("created_at").notNull().defaultNow(),
-    updatedAt: timestamp98("updated_at").notNull().defaultNow()
+    publicToken: text108("public_token"),
+    createdBy: text108("created_by"),
+    createdAt: timestamp100("created_at").notNull().defaultNow(),
+    updatedAt: timestamp100("updated_at").notNull().defaultNow()
   },
   (t) => [
-    uniqueIndex48("branch_preview_shares_branch_idx").on(t.branchId),
-    uniqueIndex48("branch_preview_shares_active_token_idx").on(t.publicToken),
-    index92("branch_preview_shares_project_idx").on(t.projectId),
-    index92("branch_preview_shares_workspace_idx").on(t.workspaceId)
+    uniqueIndex49("branch_preview_shares_branch_idx").on(t.branchId),
+    uniqueIndex49("branch_preview_shares_active_token_idx").on(t.publicToken),
+    index94("branch_preview_shares_project_idx").on(t.projectId),
+    index94("branch_preview_shares_workspace_idx").on(t.workspaceId)
   ]
 );
-var branchPreviewGrants = pgTable105(
+var branchPreviewGrants = pgTable107(
   "branch_preview_grants",
   {
-    id: text106("id").primaryKey(),
-    workspaceId: text106("workspace_id").notNull(),
-    projectId: text106("project_id").notNull(),
-    branchId: text106("branch_id").notNull(),
-    email: text106("email").notNull(),
-    invitedBy: text106("invited_by"),
-    createdAt: timestamp98("created_at").notNull().defaultNow()
+    id: text108("id").primaryKey(),
+    workspaceId: text108("workspace_id").notNull(),
+    projectId: text108("project_id").notNull(),
+    branchId: text108("branch_id").notNull(),
+    email: text108("email").notNull(),
+    invitedBy: text108("invited_by"),
+    createdAt: timestamp100("created_at").notNull().defaultNow()
   },
   (t) => [
-    uniqueIndex48("branch_preview_grants_branch_email_idx").on(t.branchId, t.email),
-    index92("branch_preview_grants_project_idx").on(t.projectId)
+    uniqueIndex49("branch_preview_grants_branch_email_idx").on(t.branchId, t.email),
+    index94("branch_preview_grants_project_idx").on(t.projectId)
   ]
 );
 
 // src/schema/share_links.ts
-import { pgTable as pgTable106, text as text107, boolean as boolean33, timestamp as timestamp99, index as index93 } from "drizzle-orm/pg-core";
-var shareLinks = pgTable106(
+import { pgTable as pgTable108, text as text109, boolean as boolean33, timestamp as timestamp101, index as index95 } from "drizzle-orm/pg-core";
+var shareLinks = pgTable108(
   "share_links",
   {
-    id: text107("id").primaryKey(),
+    id: text109("id").primaryKey(),
     // nanoid
-    workspaceId: text107("workspace_id").notNull(),
+    workspaceId: text109("workspace_id").notNull(),
     // FK → workspaces.id (RLS scope)
-    projectId: text107("project_id").notNull(),
+    projectId: text109("project_id").notNull(),
     // FK → projects.id
-    token: text107("token").notNull(),
+    token: text109("token").notNull(),
     // public share token (nanoid); unique among active links
     enabled: boolean33("enabled").notNull().default(true),
-    createdBy: text107("created_by"),
+    createdBy: text109("created_by"),
     // FK → users(id); NULL = system-initiated
-    createdAt: timestamp99("created_at").notNull().defaultNow(),
-    updatedAt: timestamp99("updated_at").notNull().defaultNow(),
-    revokedAt: timestamp99("revoked_at")
+    createdAt: timestamp101("created_at").notNull().defaultNow(),
+    updatedAt: timestamp101("updated_at").notNull().defaultNow(),
+    revokedAt: timestamp101("revoked_at")
     // set when the link is disabled
   },
   (t) => [
-    index93("share_links_project_idx").on(t.projectId),
-    index93("share_links_workspace_idx").on(t.workspaceId)
+    index95("share_links_project_idx").on(t.projectId),
+    index95("share_links_workspace_idx").on(t.workspaceId)
   ]
 );
 
 // src/schema/templates.ts
 import {
-  pgTable as pgTable107,
-  text as text108,
-  varchar as varchar78,
-  timestamp as timestamp100,
-  jsonb as jsonb62,
-  integer as integer54,
-  index as index94,
-  uniqueIndex as uniqueIndex49
+  pgTable as pgTable109,
+  text as text110,
+  varchar as varchar79,
+  timestamp as timestamp102,
+  jsonb as jsonb64,
+  integer as integer55,
+  index as index96,
+  uniqueIndex as uniqueIndex50
 } from "drizzle-orm/pg-core";
 import { relations as relations17 } from "drizzle-orm/relations";
-import { sql as sql33 } from "drizzle-orm";
-var templates = pgTable107(
+import { sql as sql34 } from "drizzle-orm";
+var templates = pgTable109(
   "templates",
   {
-    id: text108("id").primaryKey(),
+    id: text110("id").primaryKey(),
     // nanoid
-    workspaceId: text108("workspace_id").notNull(),
+    workspaceId: text110("workspace_id").notNull(),
     // FK to workspaces.id (RLS scope / owner)
-    slug: varchar78("slug", { length: 255 }).notNull(),
+    slug: varchar79("slug", { length: 255 }).notNull(),
     // ^[a-z0-9-]+$, unique per workspace
-    name: varchar78("name", { length: 255 }).notNull(),
-    description: text108("description"),
-    scope: varchar78("scope", { length: 10 }).$type().notNull().default("project"),
+    name: varchar79("name", { length: 255 }).notNull(),
+    description: text110("description"),
+    scope: varchar79("scope", { length: 10 }).$type().notNull().default("project"),
     // 'demo' ships seed content; 'starter-kit' is the same schema with the content blanked.
     // Defaults to 'demo' because a user template is a frozen snapshot of a real project,
     // which always carries its source's content. Migration 0187.
-    category: varchar78("category", { length: 20 }).$type().notNull().default("demo"),
-    framework: varchar78("framework", { length: 20 }).$type(),
+    category: varchar79("category", { length: 20 }).$type().notNull().default("demo"),
+    framework: varchar79("framework", { length: 20 }).$type(),
     // metadata hint
-    thumbnail: varchar78("thumbnail", { length: 2048 }),
+    thumbnail: varchar79("thumbnail", { length: 2048 }),
     // Frozen snapshot manifest (stripped snapshot_project output). Never returned in
     // list/gallery responses — only read server-side to instantiate.
-    manifest: jsonb62("manifest").$type().notNull(),
-    visibility: varchar78("visibility", { length: 10 }).$type().notNull().default("private"),
-    sourceProjectId: text108("source_project_id"),
+    manifest: jsonb64("manifest").$type().notNull(),
+    visibility: varchar79("visibility", { length: 10 }).$type().notNull().default("private"),
+    sourceProjectId: text110("source_project_id"),
     // provenance (nullable — source may be deleted later)
-    createdBy: text108("created_by"),
+    createdBy: text110("created_by"),
     // user id, or null for a management-key create
-    optimisticVersion: integer54("optimistic_version").notNull().default(0),
-    createdAt: timestamp100("created_at").notNull().defaultNow(),
-    updatedAt: timestamp100("updated_at").notNull().defaultNow(),
-    deletedAt: timestamp100("deleted_at")
+    optimisticVersion: integer55("optimistic_version").notNull().default(0),
+    createdAt: timestamp102("created_at").notNull().defaultNow(),
+    updatedAt: timestamp102("updated_at").notNull().defaultNow(),
+    deletedAt: timestamp102("deleted_at")
     // soft-delete
   },
   (table) => [
-    index94("templates_workspace_idx").on(table.workspaceId),
+    index96("templates_workspace_idx").on(table.workspaceId),
     // Partial: only live rows. A soft-deleted template frees its slug (mirrors
     // components_ws_proj_slug_idx / migration 0114).
-    uniqueIndex49("templates_ws_slug_idx").on(table.workspaceId, table.slug).where(sql33`${table.deletedAt} IS NULL`),
+    uniqueIndex50("templates_ws_slug_idx").on(table.workspaceId, table.slug).where(sql34`${table.deletedAt} IS NULL`),
     // Public gallery scan (created_at DESC over live public rows).
-    index94("templates_public_idx").on(table.visibility).where(sql33`${table.visibility} = 'public' AND ${table.deletedAt} IS NULL`)
+    index96("templates_public_idx").on(table.visibility).where(sql34`${table.visibility} = 'public' AND ${table.deletedAt} IS NULL`)
   ]
 );
 var templatesRelations = relations17(templates, ({ one }) => ({
@@ -29739,179 +29814,179 @@ var templatesRelations = relations17(templates, ({ one }) => ({
 
 // src/schema/payment_records.ts
 import {
-  pgTable as pgTable108,
-  text as text109,
-  varchar as varchar79,
-  integer as integer55,
-  timestamp as timestamp101,
-  index as index95
+  pgTable as pgTable110,
+  text as text111,
+  varchar as varchar80,
+  integer as integer56,
+  timestamp as timestamp103,
+  index as index97
 } from "drizzle-orm/pg-core";
-var paymentRecords = pgTable108(
+var paymentRecords = pgTable110(
   "payment_records",
   {
-    id: text109("id").primaryKey(),
+    id: text111("id").primaryKey(),
     // nanoid
-    workspaceId: text109("workspace_id").notNull(),
+    workspaceId: text111("workspace_id").notNull(),
     // FK → workspaces.id
-    amountCents: integer55("amount_cents").notNull(),
+    amountCents: integer56("amount_cents").notNull(),
     // store money as integer cents
-    currency: varchar79("currency", { length: 3 }).notNull().default("usd"),
-    method: varchar79("method", { length: 50 }).notNull().default("manual"),
+    currency: varchar80("currency", { length: 3 }).notNull().default("usd"),
+    method: varchar80("method", { length: 50 }).notNull().default("manual"),
     // manual | stripe | wire | ...
-    note: text109("note"),
-    recordedBy: text109("recorded_by"),
+    note: text111("note"),
+    recordedBy: text111("recorded_by"),
     // FK → users.id (the admin who entered it)
-    createdAt: timestamp101("created_at").notNull().defaultNow()
+    createdAt: timestamp103("created_at").notNull().defaultNow()
   },
   (table) => [
-    index95("payment_records_workspace_idx").on(table.workspaceId, table.createdAt)
+    index97("payment_records_workspace_idx").on(table.workspaceId, table.createdAt)
   ]
 );
 
 // src/schema/plan_changes.ts
 import {
-  pgTable as pgTable109,
-  text as text110,
-  timestamp as timestamp102,
-  index as index96
+  pgTable as pgTable111,
+  text as text112,
+  timestamp as timestamp104,
+  index as index98
 } from "drizzle-orm/pg-core";
-var planChanges = pgTable109(
+var planChanges = pgTable111(
   "plan_changes",
   {
-    id: text110("id").primaryKey(),
+    id: text112("id").primaryKey(),
     // nanoid
-    workspaceId: text110("workspace_id").notNull(),
+    workspaceId: text112("workspace_id").notNull(),
     // FK → workspaces.id
-    fromPlan: text110("from_plan"),
+    fromPlan: text112("from_plan"),
     // plan_limits.id before the change (null if unknown)
-    toPlan: text110("to_plan").notNull(),
+    toPlan: text112("to_plan").notNull(),
     // plan_limits.id after the change
-    reason: text110("reason"),
-    changedBy: text110("changed_by"),
+    reason: text112("reason"),
+    changedBy: text112("changed_by"),
     // FK → users.id (the admin)
-    createdAt: timestamp102("created_at").notNull().defaultNow()
+    createdAt: timestamp104("created_at").notNull().defaultNow()
   },
   (table) => [
-    index96("plan_changes_workspace_idx").on(table.workspaceId, table.createdAt)
+    index98("plan_changes_workspace_idx").on(table.workspaceId, table.createdAt)
   ]
 );
 
 // src/schema/billing_addons.ts
-import { pgTable as pgTable110, text as text111, varchar as varchar80, integer as integer56, boolean as boolean34, jsonb as jsonb63, index as index97 } from "drizzle-orm/pg-core";
-var billingAddons = pgTable110(
+import { pgTable as pgTable112, text as text113, varchar as varchar81, integer as integer57, boolean as boolean34, jsonb as jsonb65, index as index99 } from "drizzle-orm/pg-core";
+var billingAddons = pgTable112(
   "billing_addons",
   {
-    id: text111("id").primaryKey(),
+    id: text113("id").primaryKey(),
     // stable slug, e.g. "developer", "ai-1000", "localization"
-    kind: varchar80("kind", { length: 20 }).notNull(),
+    kind: varchar81("kind", { length: 20 }).notNull(),
     // seat_role | ai_credits | localization | ab_testing
-    name: varchar80("name", { length: 100 }).notNull(),
-    dodoProductId: text111("dodo_product_id"),
+    name: varchar81("name", { length: 100 }).notNull(),
+    dodoProductId: text113("dodo_product_id"),
     // NULL until the Dodo product is created
-    unitPriceCents: integer56("unit_price_cents").notNull(),
-    currency: varchar80("currency", { length: 8 }).notNull().default("usd"),
-    credits: integer56("credits"),
+    unitPriceCents: integer57("unit_price_cents").notNull(),
+    currency: varchar81("currency", { length: 8 }).notNull().default("usd"),
+    credits: integer57("credits"),
     // ai_credits packs only: credits granted per unit
     recurring: boolean34("recurring").notNull().default(false),
     // seats/localization/AB = true; credit packs = false
-    metadata: jsonb63("metadata").$type().default({})
+    metadata: jsonb65("metadata").$type().default({})
   },
-  (t) => [index97("billing_addons_kind_idx").on(t.kind)]
+  (t) => [index99("billing_addons_kind_idx").on(t.kind)]
 );
 
 // src/schema/billing_customers.ts
-import { pgTable as pgTable111, text as text112, varchar as varchar81, timestamp as timestamp103, uniqueIndex as uniqueIndex50 } from "drizzle-orm/pg-core";
-var billingCustomers = pgTable111(
+import { pgTable as pgTable113, text as text114, varchar as varchar82, timestamp as timestamp105, uniqueIndex as uniqueIndex51 } from "drizzle-orm/pg-core";
+var billingCustomers = pgTable113(
   "billing_customers",
   {
-    id: text112("id").primaryKey(),
+    id: text114("id").primaryKey(),
     // nanoid
-    workspaceId: text112("workspace_id").notNull(),
+    workspaceId: text114("workspace_id").notNull(),
     // FK → workspaces.id (RLS scope)
-    dodoCustomerId: text112("dodo_customer_id").notNull(),
-    email: varchar81("email", { length: 255 }),
-    createdAt: timestamp103("created_at").notNull().defaultNow(),
-    updatedAt: timestamp103("updated_at").notNull().defaultNow()
+    dodoCustomerId: text114("dodo_customer_id").notNull(),
+    email: varchar82("email", { length: 255 }),
+    createdAt: timestamp105("created_at").notNull().defaultNow(),
+    updatedAt: timestamp105("updated_at").notNull().defaultNow()
   },
   (t) => [
-    uniqueIndex50("billing_customers_workspace_idx").on(t.workspaceId),
-    uniqueIndex50("billing_customers_dodo_idx").on(t.dodoCustomerId)
+    uniqueIndex51("billing_customers_workspace_idx").on(t.workspaceId),
+    uniqueIndex51("billing_customers_dodo_idx").on(t.dodoCustomerId)
   ]
 );
 
 // src/schema/subscriptions.ts
-import { pgTable as pgTable112, text as text113, varchar as varchar82, boolean as boolean35, timestamp as timestamp104, index as index98, uniqueIndex as uniqueIndex51 } from "drizzle-orm/pg-core";
-import { sql as sql34 } from "drizzle-orm";
-var subscriptions = pgTable112(
+import { pgTable as pgTable114, text as text115, varchar as varchar83, boolean as boolean35, timestamp as timestamp106, index as index100, uniqueIndex as uniqueIndex52 } from "drizzle-orm/pg-core";
+import { sql as sql35 } from "drizzle-orm";
+var subscriptions = pgTable114(
   "subscriptions",
   {
-    id: text113("id").primaryKey(),
+    id: text115("id").primaryKey(),
     // nanoid
-    workspaceId: text113("workspace_id").notNull(),
+    workspaceId: text115("workspace_id").notNull(),
     // FK → workspaces.id (RLS scope)
-    projectId: text113("project_id"),
+    projectId: text115("project_id"),
     // NULL = workspace plan; set = site plan (FK → projects.id)
-    planId: text113("plan_id").notNull(),
+    planId: text115("plan_id").notNull(),
     // FK → plan_limits.id
-    dodoSubscriptionId: text113("dodo_subscription_id"),
-    dodoCustomerId: text113("dodo_customer_id"),
-    status: varchar82("status", { length: 20 }).notNull().default("active"),
+    dodoSubscriptionId: text115("dodo_subscription_id"),
+    dodoCustomerId: text115("dodo_customer_id"),
+    status: varchar83("status", { length: 20 }).notNull().default("active"),
     // active | on_hold | cancelled | expired | pending
     // Which of plan_limits' two prices this row is billed at. Without it the bill cannot tell
     // whether the owner pays price_cents or price_cents_yearly (0147).
-    interval: varchar82("interval", { length: 10 }).notNull().default("month"),
+    interval: varchar83("interval", { length: 10 }).notNull().default("month"),
     // month | year
-    currentPeriodEnd: timestamp104("current_period_end"),
+    currentPeriodEnd: timestamp106("current_period_end"),
     cancelAtPeriodEnd: boolean35("cancel_at_period_end").notNull().default(false),
-    createdAt: timestamp104("created_at").notNull().defaultNow(),
-    updatedAt: timestamp104("updated_at").notNull().defaultNow()
+    createdAt: timestamp106("created_at").notNull().defaultNow(),
+    updatedAt: timestamp106("updated_at").notNull().defaultNow()
   },
   (t) => [
-    index98("subscriptions_workspace_idx").on(t.workspaceId),
-    uniqueIndex51("subscriptions_dodo_idx").on(t.dodoSubscriptionId).where(sql34`${t.dodoSubscriptionId} IS NOT NULL`),
+    index100("subscriptions_workspace_idx").on(t.workspaceId),
+    uniqueIndex52("subscriptions_dodo_idx").on(t.dodoSubscriptionId).where(sql35`${t.dodoSubscriptionId} IS NOT NULL`),
     // At most one workspace-level subscription per workspace.
-    uniqueIndex51("subscriptions_workspace_plan_unique").on(t.workspaceId).where(sql34`${t.projectId} IS NULL`),
+    uniqueIndex52("subscriptions_workspace_plan_unique").on(t.workspaceId).where(sql35`${t.projectId} IS NULL`),
     // At most one subscription per site.
-    uniqueIndex51("subscriptions_project_unique").on(t.projectId).where(sql34`${t.projectId} IS NOT NULL`)
+    uniqueIndex52("subscriptions_project_unique").on(t.projectId).where(sql35`${t.projectId} IS NOT NULL`)
   ]
 );
 
 // src/schema/subscription_addons.ts
-import { pgTable as pgTable113, text as text114, varchar as varchar83, integer as integer57, timestamp as timestamp105, index as index99, uniqueIndex as uniqueIndex52 } from "drizzle-orm/pg-core";
-import { sql as sql35 } from "drizzle-orm";
-var subscriptionAddons = pgTable113(
+import { pgTable as pgTable115, text as text116, varchar as varchar84, integer as integer58, timestamp as timestamp107, index as index101, uniqueIndex as uniqueIndex53 } from "drizzle-orm/pg-core";
+import { sql as sql36 } from "drizzle-orm";
+var subscriptionAddons = pgTable115(
   "subscription_addons",
   {
-    id: text114("id").primaryKey(),
+    id: text116("id").primaryKey(),
     // nanoid
-    workspaceId: text114("workspace_id").notNull(),
+    workspaceId: text116("workspace_id").notNull(),
     // FK → workspaces.id (RLS scope)
-    addonId: text114("addon_id").notNull(),
+    addonId: text116("addon_id").notNull(),
     // FK → billing_addons.id
-    quantity: integer57("quantity").notNull().default(1),
-    dodoSubscriptionId: text114("dodo_subscription_id"),
+    quantity: integer58("quantity").notNull().default(1),
+    dodoSubscriptionId: text116("dodo_subscription_id"),
     // NULL for a manual/admin grant
-    status: varchar83("status", { length: 20 }).notNull().default("active"),
+    status: varchar84("status", { length: 20 }).notNull().default("active"),
     // active | cancelled | expired
-    createdAt: timestamp105("created_at").notNull().defaultNow(),
-    updatedAt: timestamp105("updated_at").notNull().defaultNow()
+    createdAt: timestamp107("created_at").notNull().defaultNow(),
+    updatedAt: timestamp107("updated_at").notNull().defaultNow()
   },
   (t) => [
-    index99("subscription_addons_workspace_idx").on(t.workspaceId),
-    uniqueIndex52("subscription_addons_dodo_idx").on(t.dodoSubscriptionId).where(sql35`${t.dodoSubscriptionId} IS NOT NULL`)
+    index101("subscription_addons_workspace_idx").on(t.workspaceId),
+    uniqueIndex53("subscription_addons_dodo_idx").on(t.dodoSubscriptionId).where(sql36`${t.dodoSubscriptionId} IS NOT NULL`)
   ]
 );
 
 // src/schema/billing_alerts.ts
-import { pgTable as pgTable114, text as text115, varchar as varchar84, timestamp as timestamp106, index as index100, uniqueIndex as uniqueIndex53 } from "drizzle-orm/pg-core";
-var billingAlerts = pgTable114(
+import { pgTable as pgTable116, text as text117, varchar as varchar85, timestamp as timestamp108, index as index102, uniqueIndex as uniqueIndex54 } from "drizzle-orm/pg-core";
+var billingAlerts = pgTable116(
   "billing_alerts",
   {
-    id: text115("id").primaryKey(),
+    id: text117("id").primaryKey(),
     // nanoid
-    workspaceId: text115("workspace_id").notNull(),
+    workspaceId: text117("workspace_id").notNull(),
     // FK → workspaces.id (internal table, no RLS)
-    kind: varchar84("kind", { length: 32 }).notNull(),
+    kind: varchar85("kind", { length: 32 }).notNull(),
     // renewal_due | bandwidth_80 | bandwidth_100
     /**
      * What "already sent" means for this alert, built by the caller (alerts.ts owns the spellings).
@@ -29919,104 +29994,104 @@ var billingAlerts = pgTable114(
      * period-end change. Bandwidth keys on the threshold + calendar month, matching the window
      * getUsage() measures — so the counter resetting on the 1st re-arms the alert.
      */
-    dedupeKey: text115("dedupe_key").notNull(),
-    sentAt: timestamp106("sent_at", { withTimezone: true }).notNull().defaultNow()
+    dedupeKey: text117("dedupe_key").notNull(),
+    sentAt: timestamp108("sent_at", { withTimezone: true }).notNull().defaultNow()
   },
   (t) => [
-    uniqueIndex53("billing_alerts_dedupe_idx").on(t.dedupeKey),
-    index100("billing_alerts_workspace_idx").on(t.workspaceId, t.sentAt)
+    uniqueIndex54("billing_alerts_dedupe_idx").on(t.dedupeKey),
+    index102("billing_alerts_workspace_idx").on(t.workspaceId, t.sentAt)
   ]
 );
 
 // src/schema/ai_credit_ledger.ts
-import { pgTable as pgTable115, text as text116, varchar as varchar85, integer as integer58, timestamp as timestamp107, index as index101, uniqueIndex as uniqueIndex54 } from "drizzle-orm/pg-core";
-import { sql as sql36 } from "drizzle-orm";
-var aiCreditLedger = pgTable115(
+import { pgTable as pgTable117, text as text118, varchar as varchar86, integer as integer59, timestamp as timestamp109, index as index103, uniqueIndex as uniqueIndex55 } from "drizzle-orm/pg-core";
+import { sql as sql37 } from "drizzle-orm";
+var aiCreditLedger = pgTable117(
   "ai_credit_ledger",
   {
-    id: text116("id").primaryKey(),
+    id: text118("id").primaryKey(),
     // nanoid
-    workspaceId: text116("workspace_id").notNull(),
+    workspaceId: text118("workspace_id").notNull(),
     // FK → workspaces.id (RLS scope)
-    delta: integer58("delta").notNull(),
+    delta: integer59("delta").notNull(),
     // signed: +purchase/grant, -consume/expire
-    reason: varchar85("reason", { length: 20 }).notNull(),
+    reason: varchar86("reason", { length: 20 }).notNull(),
     // purchase | consume | grant | expire
-    dodoPaymentId: text116("dodo_payment_id"),
+    dodoPaymentId: text118("dodo_payment_id"),
     // set for purchases
-    note: text116("note"),
-    createdAt: timestamp107("created_at").notNull().defaultNow()
+    note: text118("note"),
+    createdAt: timestamp109("created_at").notNull().defaultNow()
   },
   (t) => [
-    index101("ai_credit_ledger_workspace_idx").on(t.workspaceId, t.createdAt),
-    uniqueIndex54("ai_credit_ledger_custom_agent_run_unique").on(t.note).where(sql36`${t.reason} = 'consume' AND ${t.note} LIKE 'custom-agent-run:%'`)
+    index103("ai_credit_ledger_workspace_idx").on(t.workspaceId, t.createdAt),
+    uniqueIndex55("ai_credit_ledger_custom_agent_run_unique").on(t.note).where(sql37`${t.reason} = 'consume' AND ${t.note} LIKE 'custom-agent-run:%'`)
   ]
 );
 
 // src/schema/support_tickets.ts
 import {
-  pgTable as pgTable116,
-  text as text117,
-  varchar as varchar86,
-  timestamp as timestamp108,
+  pgTable as pgTable118,
+  text as text119,
+  varchar as varchar87,
+  timestamp as timestamp110,
   boolean as boolean36,
-  jsonb as jsonb64,
-  index as index102
+  jsonb as jsonb66,
+  index as index104
 } from "drizzle-orm/pg-core";
-var supportTickets = pgTable116(
+var supportTickets = pgTable118(
   "support_tickets",
   {
-    id: text117("id").primaryKey(),
+    id: text119("id").primaryKey(),
     // nanoid
-    workspaceId: text117("workspace_id"),
+    workspaceId: text119("workspace_id"),
     // FK → workspaces.id (nullable: account-level tickets)
     // FK → users.id (the customer). NULL for a ticket Plain created: an email or Slack
     // sender has no BetterCMS account. visibleTicketWhere() compares this to the session
     // user, and NULL never matches, so those tickets stay invisible to every customer —
     // which is correct, since there is no dashboard reply transport for them.
-    userId: text117("user_id"),
+    userId: text119("user_id"),
     // The only identity a Plain-origin ticket has. The staff list coalesces it with
     // users.email; NULL whenever userId is set.
-    customerEmail: text117("customer_email"),
-    customerName: text117("customer_name"),
-    subject: varchar86("subject", { length: 255 }).notNull(),
-    body: text117("body").notNull(),
-    status: varchar86("status", { length: 20 }).notNull().default("open"),
+    customerEmail: text119("customer_email"),
+    customerName: text119("customer_name"),
+    subject: varchar87("subject", { length: 255 }).notNull(),
+    body: text119("body").notNull(),
+    status: varchar87("status", { length: 20 }).notNull().default("open"),
     // open | pending | closed
-    priority: varchar86("priority", { length: 20 }).notNull().default("normal"),
+    priority: varchar87("priority", { length: 20 }).notNull().default("normal"),
     // low | normal | high | urgent
-    assigneeId: text117("assignee_id"),
+    assigneeId: text119("assignee_id"),
     // FK → users.id (staff member handling it)
     // Plain's ThreadChannel, lowercased. 'api' is a ticket opened in the dashboard; the
     // rest arrive from Plain. The staff reply path branches on this: 'api' threads deliver
     // nothing to the customer so we send the email ourselves, every other channel is
     // delivered by Plain.
-    channel: text117("channel").notNull().default("api"),
+    channel: text119("channel").notNull().default("api"),
     // The Plain thread this ticket mirrors. NULL until the first outbound sync succeeds,
     // hence the partial unique index rather than a unique column.
-    plainThreadId: text117("plain_thread_id"),
+    plainThreadId: text119("plain_thread_id"),
     // Files attached when the case was opened, before any message row exists.
-    attachments: jsonb64("attachments").$type().notNull().default([]),
-    createdAt: timestamp108("created_at").notNull().defaultNow(),
-    updatedAt: timestamp108("updated_at").notNull().defaultNow()
+    attachments: jsonb66("attachments").$type().notNull().default([]),
+    createdAt: timestamp110("created_at").notNull().defaultNow(),
+    updatedAt: timestamp110("updated_at").notNull().defaultNow()
   },
   (table) => [
-    index102("support_tickets_status_idx").on(table.status, table.updatedAt),
-    index102("support_tickets_workspace_idx").on(table.workspaceId),
-    index102("support_tickets_user_idx").on(table.userId),
-    index102("support_tickets_channel_idx").on(table.channel, table.updatedAt)
+    index104("support_tickets_status_idx").on(table.status, table.updatedAt),
+    index104("support_tickets_workspace_idx").on(table.workspaceId),
+    index104("support_tickets_user_idx").on(table.userId),
+    index104("support_tickets_channel_idx").on(table.channel, table.updatedAt)
   ]
 );
-var supportTicketMessages = pgTable116(
+var supportTicketMessages = pgTable118(
   "support_ticket_messages",
   {
-    id: text117("id").primaryKey(),
+    id: text119("id").primaryKey(),
     // nanoid
-    ticketId: text117("ticket_id").notNull(),
+    ticketId: text119("ticket_id").notNull(),
     // FK → support_tickets.id
-    authorId: text117("author_id"),
+    authorId: text119("author_id"),
     // FK → users.id (staff or customer)
-    body: text117("body").notNull(),
+    body: text119("body").notNull(),
     isStaff: boolean36("is_staff").notNull().default(false),
     // true = team reply
     // Staff-only triage note. NEVER leaves the platform-admin lane: the customer read
@@ -30026,99 +30101,99 @@ var supportTicketMessages = pgTable116(
     // at-least-once webhook. NULL for anything Plain never saw, and for our own replies on
     // channels whose mutation returns no entry id — replyToThread returns only an error
     // slot, which is why the echo check keys on the actor and this is the backstop.
-    plainMessageId: text117("plain_message_id"),
-    attachments: jsonb64("attachments").$type().notNull().default([]),
-    createdAt: timestamp108("created_at").notNull().defaultNow()
+    plainMessageId: text119("plain_message_id"),
+    attachments: jsonb66("attachments").$type().notNull().default([]),
+    createdAt: timestamp110("created_at").notNull().defaultNow()
   },
   (table) => [
-    index102("support_ticket_messages_ticket_idx").on(table.ticketId, table.createdAt)
+    index104("support_ticket_messages_ticket_idx").on(table.ticketId, table.createdAt)
   ]
 );
 
 // src/schema/admin_action_logs.ts
 import {
-  pgTable as pgTable117,
-  text as text118,
-  varchar as varchar87,
-  jsonb as jsonb65,
-  timestamp as timestamp109,
-  index as index103
+  pgTable as pgTable119,
+  text as text120,
+  varchar as varchar88,
+  jsonb as jsonb67,
+  timestamp as timestamp111,
+  index as index105
 } from "drizzle-orm/pg-core";
-var adminActionLogs = pgTable117(
+var adminActionLogs = pgTable119(
   "admin_action_logs",
   {
-    id: text118("id").primaryKey(),
+    id: text120("id").primaryKey(),
     // nanoid
-    actorId: text118("actor_id"),
+    actorId: text120("actor_id"),
     // FK → users.id (the staff member)
-    actorEmail: varchar87("actor_email", { length: 320 }),
+    actorEmail: varchar88("actor_email", { length: 320 }),
     // denormalized for display
-    actorRole: varchar87("actor_role", { length: 40 }),
+    actorRole: varchar88("actor_role", { length: 40 }),
     // admin_role at action time
-    action: varchar87("action", { length: 80 }).notNull(),
+    action: varchar88("action", { length: 80 }).notNull(),
     // e.g. workspace.plan_change
-    targetType: varchar87("target_type", { length: 40 }),
+    targetType: varchar88("target_type", { length: 40 }),
     // workspace | user | plan | ticket
-    targetId: text118("target_id"),
-    reason: text118("reason"),
-    metadata: jsonb65("metadata").$type().notNull().default({}),
-    ipAddress: text118("ip_address"),
-    createdAt: timestamp109("created_at").notNull().defaultNow()
+    targetId: text120("target_id"),
+    reason: text120("reason"),
+    metadata: jsonb67("metadata").$type().notNull().default({}),
+    ipAddress: text120("ip_address"),
+    createdAt: timestamp111("created_at").notNull().defaultNow()
   },
   (table) => [
-    index103("admin_action_logs_created_idx").on(table.createdAt),
-    index103("admin_action_logs_action_idx").on(table.action, table.createdAt)
+    index105("admin_action_logs_created_idx").on(table.createdAt),
+    index105("admin_action_logs_action_idx").on(table.action, table.createdAt)
   ]
 );
 
 // src/schema/admin_notes.ts
-import { pgTable as pgTable118, text as text119, varchar as varchar88, boolean as boolean37, timestamp as timestamp110, index as index104 } from "drizzle-orm/pg-core";
-var adminNotes = pgTable118(
+import { pgTable as pgTable120, text as text121, varchar as varchar89, boolean as boolean37, timestamp as timestamp112, index as index106 } from "drizzle-orm/pg-core";
+var adminNotes = pgTable120(
   "admin_notes",
   {
-    id: text119("id").primaryKey(),
+    id: text121("id").primaryKey(),
     // nanoid
-    targetType: varchar88("target_type", { length: 20 }).notNull(),
+    targetType: varchar89("target_type", { length: 20 }).notNull(),
     // user | workspace | project
-    targetId: text119("target_id").notNull(),
-    body: text119("body").notNull(),
-    authorId: text119("author_id"),
+    targetId: text121("target_id").notNull(),
+    body: text121("body").notNull(),
+    authorId: text121("author_id"),
     // FK → users.id (the staff member)
-    authorEmail: varchar88("author_email", { length: 320 }),
+    authorEmail: varchar89("author_email", { length: 320 }),
     // denormalized for display
     pinned: boolean37("pinned").notNull().default(false),
-    createdAt: timestamp110("created_at").notNull().defaultNow(),
-    updatedAt: timestamp110("updated_at").notNull().defaultNow()
+    createdAt: timestamp112("created_at").notNull().defaultNow(),
+    updatedAt: timestamp112("updated_at").notNull().defaultNow()
   },
   (t) => [
     // Pinned first, then newest — the exact order the tab renders.
-    index104("admin_notes_target_idx").on(t.targetType, t.targetId, t.pinned, t.createdAt)
+    index106("admin_notes_target_idx").on(t.targetType, t.targetId, t.pinned, t.createdAt)
   ]
 );
 
 // src/schema/admin_agent_sessions.ts
-import { pgTable as pgTable119, text as text120, varchar as varchar89, doublePrecision as doublePrecision2, timestamp as timestamp111, index as index105 } from "drizzle-orm/pg-core";
-var adminAgentSessions = pgTable119(
+import { pgTable as pgTable121, text as text122, varchar as varchar90, doublePrecision as doublePrecision2, timestamp as timestamp113, index as index107 } from "drizzle-orm/pg-core";
+var adminAgentSessions = pgTable121(
   "admin_agent_sessions",
   {
-    id: text120("id").primaryKey(),
+    id: text122("id").primaryKey(),
     // nanoid
-    actorId: text120("actor_id").notNull(),
+    actorId: text122("actor_id").notNull(),
     // FK → users.id (the staff member)
-    actorEmail: varchar89("actor_email", { length: 320 }),
-    title: varchar89("title", { length: 200 }),
-    status: varchar89("status", { length: 20 }).notNull().default("active"),
+    actorEmail: varchar90("actor_email", { length: 320 }),
+    title: varchar90("title", { length: 200 }),
+    status: varchar90("status", { length: 20 }).notNull().default("active"),
     // active | error
     costUsd: doublePrecision2("cost_usd").notNull().default(0),
-    createdAt: timestamp111("created_at").notNull().defaultNow(),
-    updatedAt: timestamp111("updated_at").notNull().defaultNow(),
-    lastActiveAt: timestamp111("last_active_at").notNull().defaultNow()
+    createdAt: timestamp113("created_at").notNull().defaultNow(),
+    updatedAt: timestamp113("updated_at").notNull().defaultNow(),
+    lastActiveAt: timestamp113("last_active_at").notNull().defaultNow()
   },
-  (t) => [index105("admin_agent_sessions_actor_idx").on(t.actorId, t.lastActiveAt)]
+  (t) => [index107("admin_agent_sessions_actor_idx").on(t.actorId, t.lastActiveAt)]
 );
 
 // src/schema/crm_deals.ts
-import { pgTable as pgTable120, text as text121, varchar as varchar90, integer as integer59, timestamp as timestamp112, index as index106, unique as unique13 } from "drizzle-orm/pg-core";
+import { pgTable as pgTable122, text as text123, varchar as varchar91, integer as integer60, timestamp as timestamp114, index as index108, unique as unique13 } from "drizzle-orm/pg-core";
 var CRM_STAGES = [
   "qualified",
   "conversation",
@@ -30126,206 +30201,206 @@ var CRM_STAGES = [
   "customer",
   "at_risk"
 ];
-var crmDeals = pgTable120(
+var crmDeals = pgTable122(
   "crm_deals",
   {
-    id: text121("id").primaryKey(),
+    id: text123("id").primaryKey(),
     // nanoid
-    workspaceId: text121("workspace_id").notNull(),
+    workspaceId: text123("workspace_id").notNull(),
     // FK → workspaces.id
-    stage: varchar90("stage", { length: 20 }).notNull().default("qualified").$type(),
-    valueCents: integer59("value_cents"),
+    stage: varchar91("stage", { length: 20 }).notNull().default("qualified").$type(),
+    valueCents: integer60("value_cents"),
     // annual contract value the rep is working toward
-    ownerId: text121("owner_id"),
+    ownerId: text123("owner_id"),
     // FK → users.id (the staff member on the account)
-    nextStep: text121("next_step"),
-    notes: text121("notes"),
-    lastTouchAt: timestamp112("last_touch_at"),
-    createdAt: timestamp112("created_at").notNull().defaultNow(),
-    updatedAt: timestamp112("updated_at").notNull().defaultNow()
+    nextStep: text123("next_step"),
+    notes: text123("notes"),
+    lastTouchAt: timestamp114("last_touch_at"),
+    createdAt: timestamp114("created_at").notNull().defaultNow(),
+    updatedAt: timestamp114("updated_at").notNull().defaultNow()
   },
   (t) => [
     unique13("crm_deals_workspace_id_key").on(t.workspaceId),
-    index106("crm_deals_stage_idx").on(t.stage, t.lastTouchAt),
-    index106("crm_deals_owner_idx").on(t.ownerId)
+    index108("crm_deals_stage_idx").on(t.stage, t.lastTouchAt),
+    index108("crm_deals_owner_idx").on(t.ownerId)
   ]
 );
 
 // src/schema/project_env_vars.ts
 import {
-  pgTable as pgTable121,
-  text as text122,
-  varchar as varchar91,
-  timestamp as timestamp113,
-  index as index107,
-  uniqueIndex as uniqueIndex55
+  pgTable as pgTable123,
+  text as text124,
+  varchar as varchar92,
+  timestamp as timestamp115,
+  index as index109,
+  uniqueIndex as uniqueIndex56
 } from "drizzle-orm/pg-core";
 var ENV_VAR_SCOPES = ["production", "preview", "development"];
-var projectEnvVars = pgTable121(
+var projectEnvVars = pgTable123(
   "project_env_vars",
   {
-    id: text122("id").primaryKey(),
+    id: text124("id").primaryKey(),
     // nanoid
-    projectId: text122("project_id").notNull(),
+    projectId: text124("project_id").notNull(),
     // FK to projects.id
-    workspaceId: text122("workspace_id").notNull(),
+    workspaceId: text124("workspace_id").notNull(),
     // FK to workspaces.id — RLS scope
-    key: varchar91("key", { length: 128 }).notNull(),
-    valueEnc: text122("value_enc").notNull(),
+    key: varchar92("key", { length: 128 }).notNull(),
+    valueEnc: text124("value_enc").notNull(),
     // AES-256-GCM, `iv:tag:ciphertext` hex
-    scope: varchar91("scope", { length: 16 }).$type().notNull(),
-    updatedBy: text122("updated_by"),
+    scope: varchar92("scope", { length: 16 }).$type().notNull(),
+    updatedBy: text124("updated_by"),
     // FK to users.id, nullable
-    updatedAt: timestamp113("updated_at", { withTimezone: true }).notNull().defaultNow(),
-    createdAt: timestamp113("created_at", { withTimezone: true }).notNull().defaultNow()
+    updatedAt: timestamp115("updated_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp115("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     // One value per key per scope — the same key MAY exist in production and preview.
-    uniqueIndex55("project_env_vars_project_key_scope_idx").on(
+    uniqueIndex56("project_env_vars_project_key_scope_idx").on(
       table.projectId,
       table.key,
       table.scope
     ),
-    index107("project_env_vars_project_idx").on(table.projectId)
+    index109("project_env_vars_project_idx").on(table.projectId)
   ]
 );
 
 // src/schema/mcp_connections.ts
-import { pgTable as pgTable122, text as text123, varchar as varchar92, jsonb as jsonb66, timestamp as timestamp114, index as index108, uniqueIndex as uniqueIndex56 } from "drizzle-orm/pg-core";
-import { sql as sql37 } from "drizzle-orm";
-var mcpConnections = pgTable122(
+import { pgTable as pgTable124, text as text125, varchar as varchar93, jsonb as jsonb68, timestamp as timestamp116, index as index110, uniqueIndex as uniqueIndex57 } from "drizzle-orm/pg-core";
+import { sql as sql38 } from "drizzle-orm";
+var mcpConnections = pgTable124(
   "mcp_connections",
   {
-    id: text123("id").primaryKey(),
+    id: text125("id").primaryKey(),
     // nanoid
-    workspaceId: text123("workspace_id").notNull(),
+    workspaceId: text125("workspace_id").notNull(),
     // FK → workspaces.id (RLS scope)
-    projectId: text123("project_id").notNull(),
+    projectId: text125("project_id").notNull(),
     // FK → projects.id (application-enforced)
     /** Catalog slug (`notion` | `linear` | `hubspot` | `figma`) or `custom` for a user-added server. */
-    providerSlug: varchar92("provider_slug", { length: 32 }).notNull(),
+    providerSlug: varchar93("provider_slug", { length: 32 }).notNull(),
     /** Where tools come from. See the header note — NOT interchangeable with authMode. */
-    kind: varchar92("kind", { length: 16 }).notNull().$type(),
+    kind: varchar93("kind", { length: 16 }).notNull().$type(),
     /** How the credential is obtained. See the header note. */
-    authMode: varchar92("auth_mode", { length: 24 }).notNull().$type(),
+    authMode: varchar93("auth_mode", { length: 24 }).notNull().$type(),
     /** Display name. The catalog's name for a known provider; user-supplied for a custom one. */
-    name: varchar92("name", { length: 120 }).notNull(),
+    name: varchar93("name", { length: 120 }).notNull(),
     /** Remote Streamable-HTTP endpoint. NULL for `kind: 'rest'`, which has no MCP server. */
-    serverUrl: text123("server_url"),
+    serverUrl: text125("server_url"),
     /** Display only — the connected Notion workspace / Linear org / Figma account. */
-    accountLabel: varchar92("account_label", { length: 255 }),
-    accessTokenEnc: text123("access_token_enc"),
-    refreshTokenEnc: text123("refresh_token_enc"),
-    expiresAt: timestamp114("expires_at", { withTimezone: true }),
+    accountLabel: varchar93("account_label", { length: 255 }),
+    accessTokenEnc: text125("access_token_enc"),
+    refreshTokenEnc: text125("refresh_token_enc"),
+    expiresAt: timestamp116("expires_at", { withTimezone: true }),
     /** `custom_headers` mode only: the encrypted header map a gateway requires on every call. */
-    headersEnc: text123("headers_enc"),
+    headersEnc: text125("headers_enc"),
     /** DCR-issued or statically configured — the same two columns serve both, deliberately. */
-    oauthClientId: varchar92("oauth_client_id", { length: 255 }),
-    oauthClientSecretEnc: text123("oauth_client_secret_enc"),
+    oauthClientId: varchar93("oauth_client_id", { length: 255 }),
+    oauthClientSecretEnc: text125("oauth_client_secret_enc"),
     /** Both cleared on a successful exchange; see the header note on why they must exist at all. */
-    oauthState: text123("oauth_state"),
-    pkceVerifierEnc: text123("pkce_verifier_enc"),
+    oauthState: text125("oauth_state"),
+    pkceVerifierEnc: text125("pkce_verifier_enc"),
     /** Discovery output: authorization server metadata, token endpoint, RFC 8707 resource. */
-    authMetadata: jsonb66("auth_metadata").$type(),
-    scopes: text123("scopes").array().$type(),
+    authMetadata: jsonb68("auth_metadata").$type(),
+    scopes: text125("scopes").array().$type(),
     /**
      * Full descriptors (name, description, inputSchema, annotations) — NOT just names. The
      * read-only boundary is decided from `annotations.readOnlyHint`, so the names alone would
      * force a live listTools on the turn path to answer a governance question.
      */
-    toolsCache: jsonb66("tools_cache").$type().notNull().default([]),
-    toolsCachedAt: timestamp114("tools_cached_at", { withTimezone: true }),
+    toolsCache: jsonb68("tools_cache").$type().notNull().default([]),
+    toolsCachedAt: timestamp116("tools_cached_at", { withTimezone: true }),
     /**
      * pending | ok | invalid | revoked. `pending` is the pre-consent row; `invalid` is set on a
      * provider 401 or a decrypt failure so the UI can say "reconnect" instead of replaying the
      * same auth error on every turn forever.
      */
-    status: varchar92("status", { length: 16 }).notNull().default("pending").$type(),
+    status: varchar93("status", { length: 16 }).notNull().default("pending").$type(),
     /** Machine-readable companion to `status`, e.g. `decrypt_failed`, `provider_401`. */
-    statusReason: varchar92("status_reason", { length: 64 }),
-    lastError: text123("last_error"),
-    lastUsedAt: timestamp114("last_used_at", { withTimezone: true }),
-    connectedBy: text123("connected_by"),
+    statusReason: varchar93("status_reason", { length: 64 }),
+    lastError: text125("last_error"),
+    lastUsedAt: timestamp116("last_used_at", { withTimezone: true }),
+    connectedBy: text125("connected_by"),
     // FK → users(id), added in migration
     ...auditColumns,
     ...softDeleteColumn
   },
   (t) => [
-    index108("mcp_connections_workspace_idx").on(t.workspaceId),
-    index108("mcp_connections_project_idx").on(t.projectId),
+    index110("mcp_connections_workspace_idx").on(t.workspaceId),
+    index110("mcp_connections_project_idx").on(t.projectId),
     // Reconnecting a catalog provider UPDATEs rather than accumulating a second live credential.
     // Custom connectors are excluded: a project may legitimately add many distinct MCP servers.
-    uniqueIndex56("mcp_connections_project_provider_unique").on(t.projectId, t.providerSlug).where(sql37`deleted_at IS NULL AND provider_slug <> 'custom'`)
+    uniqueIndex57("mcp_connections_project_provider_unique").on(t.projectId, t.providerSlug).where(sql38`deleted_at IS NULL AND provider_slug <> 'custom'`)
   ]
 );
 
 // src/schema/crm_connections.ts
 import {
-  pgTable as pgTable123,
-  text as text124,
-  timestamp as timestamp115,
+  pgTable as pgTable125,
+  text as text126,
+  timestamp as timestamp117,
   boolean as boolean38,
-  jsonb as jsonb67,
-  integer as integer60,
-  uniqueIndex as uniqueIndex57
+  jsonb as jsonb69,
+  integer as integer61,
+  uniqueIndex as uniqueIndex58
 } from "drizzle-orm/pg-core";
-var crmConnections = pgTable123(
+var crmConnections = pgTable125(
   "crm_connections",
   {
-    id: text124("id").primaryKey(),
-    workspaceId: text124("workspace_id").notNull(),
-    provider: text124("provider").$type().notNull(),
-    accountId: text124("account_id").notNull(),
-    accountName: text124("account_name").notNull(),
-    instanceUrl: text124("instance_url").notNull(),
+    id: text126("id").primaryKey(),
+    workspaceId: text126("workspace_id").notNull(),
+    provider: text126("provider").$type().notNull(),
+    accountId: text126("account_id").notNull(),
+    accountName: text126("account_name").notNull(),
+    instanceUrl: text126("instance_url").notNull(),
     sandbox: boolean38("sandbox").notNull().default(false),
-    status: text124("status").notNull().default("connected"),
-    accessToken: text124("access_token").notNull(),
-    refreshToken: text124("refresh_token").notNull(),
-    expiresAt: timestamp115("expires_at").notNull(),
-    createdAt: timestamp115("created_at").notNull().defaultNow(),
-    updatedAt: timestamp115("updated_at").notNull().defaultNow()
+    status: text126("status").notNull().default("connected"),
+    accessToken: text126("access_token").notNull(),
+    refreshToken: text126("refresh_token").notNull(),
+    expiresAt: timestamp117("expires_at").notNull(),
+    createdAt: timestamp117("created_at").notNull().defaultNow(),
+    updatedAt: timestamp117("updated_at").notNull().defaultNow()
   },
   (t) => [
-    uniqueIndex57("crm_connection_account_uq").on(
+    uniqueIndex58("crm_connection_account_uq").on(
       t.workspaceId,
       t.provider,
       t.accountId
     )
   ]
 );
-var crmOauthStates = pgTable123("crm_oauth_states", {
-  id: text124("id").primaryKey(),
-  workspaceId: text124("workspace_id").notNull(),
-  userId: text124("user_id").notNull(),
-  provider: text124("provider").notNull(),
-  verifier: text124("verifier").notNull(),
-  returnPath: text124("return_path").notNull(),
+var crmOauthStates = pgTable125("crm_oauth_states", {
+  id: text126("id").primaryKey(),
+  workspaceId: text126("workspace_id").notNull(),
+  userId: text126("user_id").notNull(),
+  provider: text126("provider").notNull(),
+  verifier: text126("verifier").notNull(),
+  returnPath: text126("return_path").notNull(),
   sandbox: boolean38("sandbox").notNull(),
-  expiresAt: timestamp115("expires_at").notNull()
+  expiresAt: timestamp117("expires_at").notNull()
 });
-var formIntegrationDeliveries = pgTable123(
+var formIntegrationDeliveries = pgTable125(
   "form_integration_deliveries",
   {
-    id: text124("id").primaryKey(),
-    workspaceId: text124("workspace_id").notNull(),
-    formId: text124("form_id").notNull(),
-    integrationId: text124("integration_id").notNull(),
-    eventId: text124("event_id").notNull(),
-    submissionId: text124("submission_id").notNull(),
-    snapshot: jsonb67("snapshot").$type().notNull(),
-    data: jsonb67("data").$type().notNull(),
-    status: text124("status").notNull().default("queued"),
-    attempts: integer60("attempts").notNull().default(0),
-    lastError: text124("last_error"),
-    remoteRecordId: text124("remote_record_id"),
-    nextAttemptAt: timestamp115("next_attempt_at").notNull().defaultNow(),
-    leaseUntil: timestamp115("lease_until"),
-    createdAt: timestamp115("created_at").notNull().defaultNow(),
-    updatedAt: timestamp115("updated_at").notNull().defaultNow()
+    id: text126("id").primaryKey(),
+    workspaceId: text126("workspace_id").notNull(),
+    formId: text126("form_id").notNull(),
+    integrationId: text126("integration_id").notNull(),
+    eventId: text126("event_id").notNull(),
+    submissionId: text126("submission_id").notNull(),
+    snapshot: jsonb69("snapshot").$type().notNull(),
+    data: jsonb69("data").$type().notNull(),
+    status: text126("status").notNull().default("queued"),
+    attempts: integer61("attempts").notNull().default(0),
+    lastError: text126("last_error"),
+    remoteRecordId: text126("remote_record_id"),
+    nextAttemptAt: timestamp117("next_attempt_at").notNull().defaultNow(),
+    leaseUntil: timestamp117("lease_until"),
+    createdAt: timestamp117("created_at").notNull().defaultNow(),
+    updatedAt: timestamp117("updated_at").notNull().defaultNow()
   },
   (t) => [
-    uniqueIndex57("crm_delivery_event_uq").on(
+    uniqueIndex58("crm_delivery_event_uq").on(
       t.workspaceId,
       t.eventId,
       t.integrationId
@@ -30334,105 +30409,105 @@ var formIntegrationDeliveries = pgTable123(
 );
 
 // src/schema/platform_incidents.ts
-import { check as check12, integer as integer61, pgTable as pgTable124, smallint as smallint2, text as text125, timestamp as timestamp116, index as index109 } from "drizzle-orm/pg-core";
-import { sql as sql38 } from "drizzle-orm";
-var STATUS_IN = sql38.raw("('investigating', 'identified', 'monitoring', 'resolved')");
-var platformIncidents = pgTable124(
+import { check as check12, integer as integer62, pgTable as pgTable126, smallint as smallint3, text as text127, timestamp as timestamp118, index as index111 } from "drizzle-orm/pg-core";
+import { sql as sql39 } from "drizzle-orm";
+var STATUS_IN = sql39.raw("('investigating', 'identified', 'monitoring', 'resolved')");
+var platformIncidents = pgTable126(
   "platform_incidents",
   {
-    id: text125("id").primaryKey(),
-    number: integer61("number").generatedAlwaysAsIdentity().notNull().unique("platform_incidents_number_key"),
-    title: text125("title").notNull(),
-    severity: smallint2("severity").notNull(),
+    id: text127("id").primaryKey(),
+    number: integer62("number").generatedAlwaysAsIdentity().notNull().unique("platform_incidents_number_key"),
+    title: text127("title").notNull(),
+    severity: smallint3("severity").notNull(),
     // 1 (worst) … 4
-    status: text125("status").notNull().default("investigating"),
+    status: text127("status").notNull().default("investigating"),
     // investigating | identified | monitoring | resolved
-    services: text125("services").array().notNull().default([]),
-    commanderId: text125("commander_id"),
-    startedAt: timestamp116("started_at", { withTimezone: true }).notNull().defaultNow(),
-    resolvedAt: timestamp116("resolved_at", { withTimezone: true }),
-    createdBy: text125("created_by"),
-    createdAt: timestamp116("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp116("updated_at", { withTimezone: true }).notNull().defaultNow()
+    services: text127("services").array().notNull().default([]),
+    commanderId: text127("commander_id"),
+    startedAt: timestamp118("started_at", { withTimezone: true }).notNull().defaultNow(),
+    resolvedAt: timestamp118("resolved_at", { withTimezone: true }),
+    createdBy: text127("created_by"),
+    createdAt: timestamp118("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp118("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   // Mirrors 0375 exactly: drizzle-kit push builds fresh DBs before the migration runs.
   (t) => [
-    index109("platform_incidents_started_idx").on(t.startedAt.desc()),
-    check12("platform_incidents_severity_check", sql38`${t.severity} BETWEEN 1 AND 4`),
-    check12("platform_incidents_status_check", sql38`${t.status} IN ${STATUS_IN}`)
+    index111("platform_incidents_started_idx").on(t.startedAt.desc()),
+    check12("platform_incidents_severity_check", sql39`${t.severity} BETWEEN 1 AND 4`),
+    check12("platform_incidents_status_check", sql39`${t.status} IN ${STATUS_IN}`)
   ]
 );
-var platformIncidentUpdates = pgTable124(
+var platformIncidentUpdates = pgTable126(
   "platform_incident_updates",
   {
-    id: text125("id").primaryKey(),
-    incidentId: text125("incident_id").notNull().references(() => platformIncidents.id, { onDelete: "cascade" }),
-    status: text125("status").notNull(),
-    note: text125("note").notNull(),
-    createdBy: text125("created_by"),
-    createdAt: timestamp116("created_at", { withTimezone: true }).notNull().defaultNow()
+    id: text127("id").primaryKey(),
+    incidentId: text127("incident_id").notNull().references(() => platformIncidents.id, { onDelete: "cascade" }),
+    status: text127("status").notNull(),
+    note: text127("note").notNull(),
+    createdBy: text127("created_by"),
+    createdAt: timestamp118("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (t) => [
-    index109("platform_incident_updates_incident_idx").on(t.incidentId, t.createdAt),
-    check12("platform_incident_updates_status_check", sql38`${t.status} IN ${STATUS_IN}`)
+    index111("platform_incident_updates_incident_idx").on(t.incidentId, t.createdAt),
+    check12("platform_incident_updates_status_check", sql39`${t.status} IN ${STATUS_IN}`)
   ]
 );
 
 // src/schema/platform_vendors.ts
-import { date as date3, integer as integer62, pgTable as pgTable125, text as text126, timestamp as timestamp117, varchar as varchar93 } from "drizzle-orm/pg-core";
-var platformVendors = pgTable125("platform_vendors", {
-  id: text126("id").primaryKey(),
-  name: text126("name").notNull(),
-  category: text126("category").notNull(),
-  billingCycle: text126("billing_cycle").notNull().default("monthly"),
+import { date as date3, integer as integer63, pgTable as pgTable127, text as text128, timestamp as timestamp119, varchar as varchar94 } from "drizzle-orm/pg-core";
+var platformVendors = pgTable127("platform_vendors", {
+  id: text128("id").primaryKey(),
+  name: text128("name").notNull(),
+  category: text128("category").notNull(),
+  billingCycle: text128("billing_cycle").notNull().default("monthly"),
   // monthly | yearly | usage
-  monthlyCents: integer62("monthly_cents").notNull().default(0),
+  monthlyCents: integer63("monthly_cents").notNull().default(0),
   // normalised monthly cost
-  currency: varchar93("currency", { length: 3 }).notNull().default("usd"),
+  currency: varchar94("currency", { length: 3 }).notNull().default("usd"),
   renewsOn: date3("renews_on"),
   // YYYY-MM-DD
-  status: text126("status").notNull().default("active"),
+  status: text128("status").notNull().default("active"),
   // active | trial | cancelling | unused
-  ownerEmail: text126("owner_email"),
-  notes: text126("notes"),
-  createdBy: text126("created_by"),
-  createdAt: timestamp117("created_at", { withTimezone: true }).notNull().defaultNow(),
-  updatedAt: timestamp117("updated_at", { withTimezone: true }).notNull().defaultNow()
+  ownerEmail: text128("owner_email"),
+  notes: text128("notes"),
+  createdBy: text128("created_by"),
+  createdAt: timestamp119("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp119("updated_at", { withTimezone: true }).notNull().defaultNow()
 });
 
 // src/schema/platform_tasks.ts
-import { check as check13, date as date4, pgTable as pgTable126, text as text127, timestamp as timestamp118, index as index110 } from "drizzle-orm/pg-core";
-import { sql as sql39 } from "drizzle-orm";
-var platformTasks = pgTable126(
+import { check as check13, date as date4, pgTable as pgTable128, text as text129, timestamp as timestamp120, index as index112 } from "drizzle-orm/pg-core";
+import { sql as sql40 } from "drizzle-orm";
+var platformTasks = pgTable128(
   "platform_tasks",
   {
-    id: text127("id").primaryKey(),
-    title: text127("title").notNull(),
-    description: text127("description"),
-    status: text127("status").notNull().default("open"),
+    id: text129("id").primaryKey(),
+    title: text129("title").notNull(),
+    description: text129("description"),
+    status: text129("status").notNull().default("open"),
     // open | in_progress | done
-    priority: text127("priority").notNull().default("medium"),
+    priority: text129("priority").notNull().default("medium"),
     // low | medium | high | urgent
-    assigneeId: text127("assignee_id"),
+    assigneeId: text129("assignee_id"),
     dueOn: date4("due_on"),
     // YYYY-MM-DD
-    entityType: text127("entity_type"),
+    entityType: text129("entity_type"),
     // user | workspace | incident | deal
-    entityId: text127("entity_id"),
-    entityLabel: text127("entity_label"),
-    completedAt: timestamp118("completed_at", { withTimezone: true }),
-    createdBy: text127("created_by"),
-    createdAt: timestamp118("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp118("updated_at", { withTimezone: true }).notNull().defaultNow()
+    entityId: text129("entity_id"),
+    entityLabel: text129("entity_label"),
+    completedAt: timestamp120("completed_at", { withTimezone: true }),
+    createdBy: text129("created_by"),
+    createdAt: timestamp120("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp120("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   // Mirrors 0377 exactly: drizzle-kit push builds fresh DBs before the migration runs.
   (t) => [
-    index110("platform_tasks_open_idx").on(t.status, t.dueOn),
-    index110("platform_tasks_entity_idx").on(t.entityType, t.entityId),
-    check13("platform_tasks_status_check", sql39`${t.status} IN ('open', 'in_progress', 'done')`),
-    check13("platform_tasks_priority_check", sql39`${t.priority} IN ('low', 'medium', 'high', 'urgent')`),
-    check13("platform_tasks_entity_type_check", sql39`${t.entityType} IN ('user', 'workspace', 'incident', 'deal')`),
-    check13("platform_tasks_entity_pair_check", sql39`(${t.entityType} IS NULL) = (${t.entityId} IS NULL)`)
+    index112("platform_tasks_open_idx").on(t.status, t.dueOn),
+    index112("platform_tasks_entity_idx").on(t.entityType, t.entityId),
+    check13("platform_tasks_status_check", sql40`${t.status} IN ('open', 'in_progress', 'done')`),
+    check13("platform_tasks_priority_check", sql40`${t.priority} IN ('low', 'medium', 'high', 'urgent')`),
+    check13("platform_tasks_entity_type_check", sql40`${t.entityType} IN ('user', 'workspace', 'incident', 'deal')`),
+    check13("platform_tasks_entity_pair_check", sql40`(${t.entityType} IS NULL) = (${t.entityId} IS NULL)`)
   ]
 );
 
@@ -30500,7 +30575,7 @@ async function reserveWithDeadline() {
       })
     ]);
   } catch (err) {
-    void pending.then((sql41) => sql41.release()).catch((cause) => console.error("[db-pool] orphaned acquire failed:", cause));
+    void pending.then((sql42) => sql42.release()).catch((cause) => console.error("[db-pool] orphaned acquire failed:", cause));
     throw err;
   } finally {
     clearTimeout(timer);
@@ -30710,7 +30785,7 @@ var queries = {
 };
 
 // src/lib/workspace-context.ts
-import { sql as sql40 } from "drizzle-orm";
+import { sql as sql41 } from "drizzle-orm";
 import { eq as eq2 } from "drizzle-orm";
 import { nanoid } from "nanoid";
 var writeOrigins = new Set(WRITE_ORIGINS);
@@ -30744,7 +30819,7 @@ async function getWorkspaceSlugById(workspaceId) {
 }
 async function lookupApiKeyByHash(keyHash) {
   const rows = await db.execute(
-    sql40`SELECT * FROM lookup_api_key_by_hash(${keyHash})`
+    sql41`SELECT * FROM lookup_api_key_by_hash(${keyHash})`
   );
   const r = rows[0];
   if (!r) return null;
@@ -30775,7 +30850,7 @@ async function lookupApiKeyByHash(keyHash) {
 }
 async function publicWorkspaceBySlug(slug) {
   const rows = await db.execute(
-    sql40`SELECT id, slug FROM public_workspace_by_slug(${slug})`
+    sql41`SELECT id, slug FROM public_workspace_by_slug(${slug})`
   );
   const r = rows[0];
   return r?.id ? { id: r.id, slug: r.slug ?? slug } : null;
@@ -30785,7 +30860,7 @@ async function getDefaultWorkspaceId(userId) {
   return row?.id ?? null;
 }
 async function resolveUserWorkspace(userId, workspaceId) {
-  const rows = await db.execute(sql40`
+  const rows = await db.execute(sql41`
     SELECT workspace_id, role
     FROM resolve_user_workspace(${userId}, ${workspaceId ?? null})
   `);
@@ -30821,7 +30896,7 @@ async function ensureDefaultWorkspace(userId, name = "My Workspace", slug) {
   for (let attempt = 1; attempt <= MAX_SLUG_ATTEMPTS; attempt++) {
     console.log("[ensureDefaultWorkspace] Creating workspace + owner membership:", { workspaceId, slug: candidateSlug, attempt });
     try {
-      await db.execute(sql40`
+      await db.execute(sql41`
         SELECT create_default_workspace(${workspaceId}, ${userId}, ${memberId}, ${name}, ${candidateSlug})
       `);
       console.log("[ensureDefaultWorkspace] Workspace + owner membership created with slug:", candidateSlug);
@@ -30955,6 +31030,8 @@ function extractEntryText(data) {
 var upsertEntry = upsertPage;
 var removeEntry = removePage;
 export {
+  BINDING_DECISION_OPS,
+  BINDING_DECISION_STATES,
   BUILD_TRIGGER_KINDS,
   COLLECTION_NAME,
   CONTENT_LOCK_MODES,
@@ -31028,6 +31105,7 @@ export {
   billingAddons,
   billingAlerts,
   billingCustomers,
+  bindingDecisions,
   branchColumns,
   branchPreviewGrants,
   branchPreviewShares,
@@ -31082,6 +31160,7 @@ export {
   emailSuppressions,
   ensureCollection,
   ensureDefaultWorkspace,
+  entrySlotModels,
   externalDeployments,
   extractBlockText,
   extractEntryText,