@kici-dev/orchestrator 0.1.13 → 0.1.15

package/dist/cli.js

@@ -1,10 +1,7 @@
 #!/usr/bin/env node
-import { fileURLToPath as __cjs_fileURLToPath } from "node:url";
-import { dirname as __cjs_dirname } from "node:path";
-__cjs_dirname(__cjs_fileURLToPath(import.meta.url));
 import { createRequire } from "node:module";
 import { Command } from "commander";
-import { BaseColdStore, ChunkLru, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, decodeChunk, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
+import { BaseColdStore, ChunkLru, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, decodeChunk, deleteEnvironmentDirect, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
 import * as fs$1 from "node:fs";
 import fs, { createWriteStream, promises, readFileSync } from "node:fs";
 import crypto, { createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID } from "node:crypto";
@@ -989,6 +986,8 @@ var init_schema = __esmMin((() => {
 		cacheTtlDays: z.coerce.number().optional(),
 		cacheBuildTimeoutMs: z.coerce.number().optional(),
 		cacheMaxTarballBytes: z.coerce.number().optional(),
+		userCacheQuotaBytes: z.coerce.number().optional(),
+		userCacheTtlMs: z.coerce.number().optional(),
 		eventRouter: z.object({
 			maxChainDepth: z.coerce.number().optional(),
 			rateLimitPerWorkflowPerMinute: z.coerce.number().optional(),
@@ -1063,6 +1062,8 @@ var init_schema = __esmMin((() => {
 		cacheTtlDays: z.coerce.number().default(30),
 		cacheBuildTimeoutMs: z.coerce.number().default(6e5),
 		cacheMaxTarballBytes: z.coerce.number().default(524288e3),
+		userCacheQuotaBytes: z.coerce.number().default(5 * 1024 * 1024 * 1024),
+		userCacheTtlMs: z.coerce.number().default(10080 * 60 * 1e3),
 		eventRouterMaxChainDepth: z.coerce.number().default(10),
 		eventRouterRateLimitPerWorkflowPerMinute: z.coerce.number().default(100),
 		eventRouterEventTtlSeconds: z.coerce.number().default(604800),
@@ -1517,8 +1518,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -2210,7 +2211,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$23(db) {
+async function up$31(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2232,7 +2233,7 @@ async function up$23(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$23(db) {
+async function down$31(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2279,8 +2280,8 @@ async function down$23(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -2294,13 +2295,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$22(db) {
+async function up$30(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$22(db) {
+async function down$30(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2309,8 +2310,8 @@ async function down$22(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2334,7 +2335,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$21(db) {
+async function up$29(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2372,28 +2373,28 @@ async function up$21(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$21(db) {
+async function down$29(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$28,
+	up: () => up$28
 });
-async function up$20(db) {
+async function up$28(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$20(db) {
+async function down$28(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Cold-store chunk counter table.
@@ -2410,7 +2411,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$19(db) {
+async function up$27(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2428,14 +2429,14 @@ async function up$19(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$19(db) {
+async function down$27(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -2471,7 +2472,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$18(db) {
+async function up$26(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2516,7 +2517,7 @@ async function up$18(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$18(db) {
+async function down$26(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2541,8 +2542,8 @@ async function down$18(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -2582,7 +2583,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$17(db) {
+async function up$25(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2603,7 +2604,7 @@ async function up$17(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$17(db) {
+async function down$25(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2631,8 +2632,8 @@ async function down$17(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -2670,7 +2671,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$16(db) {
+async function up$24(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2686,7 +2687,7 @@ async function up$16(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$16(db) {
+async function down$24(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2705,8 +2706,8 @@ async function down$16(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -2719,7 +2720,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$15(db) {
+async function up$23(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2728,14 +2729,14 @@ async function up$15(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$15(db) {
+async function down$23(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -2767,7 +2768,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$14(db) {
+async function up$22(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -2794,14 +2795,14 @@ async function up$14(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$14(db) {
+async function down$22(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -2820,11 +2821,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$13(db) {
+async function up$21(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$13(db) {
+async function down$21(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -2863,8 +2864,8 @@ async function down$13(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -2890,7 +2891,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$12(db) {
+async function up$20(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -2908,14 +2909,14 @@ async function up$12(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$12(db) {
+async function down$20(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -2934,7 +2935,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$11(db) {
+async function up$19(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -2944,15 +2945,15 @@ async function up$11(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$11(db) {
+async function down$19(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -2986,7 +2987,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$10(db) {
+async function up$18(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3017,7 +3018,7 @@ async function up$10(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$10(db) {
+async function down$18(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -3035,8 +3036,8 @@ async function down$10(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -3064,7 +3065,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$9(db) {
+async function up$17(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3189,7 +3190,7 @@ async function up$9(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$9(db) {
+async function down$17(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3214,8 +3215,8 @@ async function down$9(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3228,7 +3229,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$8(db) {
+async function up$16(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3242,7 +3243,7 @@ async function up$8(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$8(db) {
+async function down$16(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3250,8 +3251,8 @@ async function down$8(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -3291,17 +3292,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$7(db) {
+async function up$15(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$7(db) {
+async function down$15(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3346,19 +3347,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$6(db) {
+async function up$14(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$6(db) {
+async function down$14(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -3381,7 +3382,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$5(db) {
+async function up$13(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3402,15 +3403,15 @@ async function up$5(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$5(db) {
+async function down$13(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -3425,7 +3426,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$4(db) {
+async function up$12(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3439,7 +3440,7 @@ async function up$4(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$4(db) {
+async function down$12(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -3447,8 +3448,8 @@ async function down$4(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -3472,7 +3473,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$3(db) {
+async function up$11(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -3503,14 +3504,14 @@ async function up$3(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$3(db) {
+async function down$11(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -3537,7 +3538,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$2(db) {
+async function up$10(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3587,7 +3588,7 @@ async function up$2(db) {
     `.execute(db);
 	}
 }
-async function down$2(db) {
+async function down$10(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -3595,8 +3596,8 @@ async function down$2(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -3620,7 +3621,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$1(db) {
+async function up$9(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3645,7 +3646,7 @@ async function up$1(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$1(db) {
+async function down$9(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -3657,8 +3658,8 @@ async function down$1(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -3674,7 +3675,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up(db) {
+async function up$8(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3690,12 +3691,326 @@ async function up(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down(db) {
+async function down$8(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
 }
 //#endregion
+//#region src/db/migrations/025_init_failure.ts
+var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$7,
+	up: () => up$7
+});
+/**
+* Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
+*
+* Presence of this column on a row means the run/job never executed a step
+* because of an init-phase failure; absence (NULL) means a normal run.
+* Shape on the wire is `InitFailure` from `@kici-dev/engine`. The dashboard
+* reads this column directly so it can render the right banner without
+* round-tripping to the orchestrator (which may be offline).
+*
+* Idempotent: re-running on a DB that already has either column is a no-op
+* for that column.
+*/
+async function up$7(db) {
+	const colExists = async (table, name) => {
+		return (await sql`
+      SELECT EXISTS (
+        SELECT 1 FROM information_schema.columns
+         WHERE table_schema = 'public'
+           AND table_name = ${table}
+           AND column_name = ${name}
+      ) AS exists
+    `.execute(db)).rows[0]?.exists ?? false;
+	};
+	if (!await colExists("execution_runs", "init_failure")) await sql`
+      ALTER TABLE public.execution_runs
+        ADD COLUMN init_failure JSONB DEFAULT NULL
+    `.execute(db);
+	if (!await colExists("execution_jobs", "init_failure")) await sql`
+      ALTER TABLE public.execution_jobs
+        ADD COLUMN init_failure JSONB DEFAULT NULL
+    `.execute(db);
+}
+async function down$7(db) {
+	await sql`
+    ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
+  `.execute(db);
+	await sql`
+    ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS init_failure
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/026_event_log_lockfile_corrupt.ts
+var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$6,
+	up: () => up$6
+});
+/**
+* Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
+* orchestrator can log a delivery whose lock file was present but unparseable.
+* Orchestrator-only: the Platform event_log uses a separate, narrower status set.
+*
+* Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
+*/
+async function up$6(db) {
+	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
+	await sql`
+    ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
+    CHECK ((status = ANY (ARRAY[
+      'received'::text, 'processed'::text, 'duplicate'::text,
+      'lockfile_missing'::text, 'lockfile_corrupt'::text, 'failed'::text
+    ])))
+  `.execute(db);
+}
+async function down$6(db) {
+	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
+	await sql`
+    ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
+    CHECK ((status = ANY (ARRAY[
+      'received'::text, 'processed'::text, 'duplicate'::text,
+      'lockfile_missing'::text, 'failed'::text
+    ])))
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/027_workflow_timeout.ts
+var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/**
+* Add `workflow_timeout_ms integer` to `execution_runs`.
+*
+* Persists the workflow-level wall-clock timeout (in milliseconds) read from
+* the lock workflow at run creation. NULL means no workflow-level cap is
+* configured. The WorkflowDeadlineDetector reads this column to find runs
+* whose `started_at + workflow_timeout_ms` has passed and cancels them with
+* the distinct workflow-timeout reason.
+*
+* Typed INTEGER to match the existing `*_ms` columns (`duration_ms`,
+* `concurrency_timeout_ms`), which keeps the pg read representation a plain
+* number rather than the BIGINT-as-string shape. INTEGER caps the timeout at
+* ~24.8 days, far beyond any sane workflow wall-clock budget.
+*
+* Idempotent: re-running on a DB that already has the column is a no-op.
+*/
+async function up$5(db) {
+	await sql`
+    ALTER TABLE public.execution_runs
+      ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
+  `.execute(db);
+}
+async function down$5(db) {
+	await sql`
+    ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/028_org_settings_user_cache.ts
+var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* Add `org_settings.user_cache_quota_bytes bigint` and
+* `org_settings.user_cache_ttl_ms bigint`, both NULLABLE.
+*
+* These make the user-facing cache per-org byte quota and per-entry TTL
+* cluster-configurable (runtime-editable per `customer_id` via the admin
+* route + `kici-admin org-settings user-cache` CLI). A NULL value means
+* "use the cluster-wide default" — the `KICI_USER_CACHE_QUOTA_BYTES` /
+* `KICI_USER_CACHE_TTL_MS` env vars (5 GiB / 7 days) resolved in config.ts.
+*
+* BIGINT because a quota in bytes (5 GiB = 5_368_709_120) and a TTL in ms
+* (7 days = 604_800_000) both exceed the safe range only at extreme values,
+* but a quota can legitimately reach tens of GiB; BIGINT keeps headroom and
+* matches the sibling `log_bytes` bigint columns.
+*
+* Idempotent: a re-run on a DB that already has either column skips it.
+*/
+async function columnExists(db, column) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'org_settings'
+         AND column_name = ${column}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$4(db) {
+	if (!await columnExists(db, "user_cache_quota_bytes")) await sql`
+      ALTER TABLE public.org_settings
+        ADD COLUMN user_cache_quota_bytes bigint
+    `.execute(db);
+	if (!await columnExists(db, "user_cache_ttl_ms")) await sql`
+      ALTER TABLE public.org_settings
+        ADD COLUMN user_cache_ttl_ms bigint
+    `.execute(db);
+}
+async function down$4(db) {
+	await sql`
+    ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
+  `.execute(db);
+	await sql`
+    ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_ttl_ms
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/029_dispatch_queue_attempts.ts
+var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
+*
+* Counts how many times a job has been returned to `pending` for
+* re-dispatch after a failed delivery attempt (agent sent job.reject, or
+* a scaler-managed agent disconnected before the job started). The
+* dispatcher fails the job permanently once the counter reaches
+* MAX_DISPATCH_ATTEMPTS, bounding requeue loops; `expires_at` remains the
+* time-based backstop.
+*
+* Idempotent: re-running on a DB that already has the column is a no-op.
+*/
+async function up$3(db) {
+	if (!((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'dispatch_queue'
+         AND column_name = 'dispatch_attempts'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false)) await sql`
+      ALTER TABLE public.dispatch_queue
+        ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
+    `.execute(db);
+}
+async function down$3(db) {
+	await sql`
+    ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/030_held_runs_env_set_null.ts
+var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* held_runs.environment_id becomes nullable with ON DELETE SET NULL so
+* terminal held-run history survives environment deletion (a null
+* environment_id means the environment was since deleted). Pending held
+* runs still block deletion — enforced in EnvironmentStore.delete.
+*
+* Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
+* re-run, and the constraint is re-created with the SET NULL action.
+*/
+async function up$2(db) {
+	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
+	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
+	await sql`ALTER TABLE public.held_runs
+    ADD CONSTRAINT held_runs_environment_id_fkey
+    FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
+}
+async function down$2(db) {
+	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
+	await sql`ALTER TABLE public.held_runs
+    ADD CONSTRAINT held_runs_environment_id_fkey
+    FOREIGN KEY (environment_id) REFERENCES public.environments(id)`.execute(db);
+	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id SET NOT NULL`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
+var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
+* `dispatch_queue.ack_agent_id TEXT` persisting the per-dispatch
+* acknowledgment deadline for HA-safe lost-dispatch detection.
+*
+* The dispatcher stamps both when a job.dispatch is sent and clears them
+* when the agent answers (job.ack / job.reject / job.status running). A
+* `dispatched` row past its deadline is requeued — by the owning coord's
+* in-memory timer, or by the leader-gated sweep
+* (`Dispatcher.sweepExpiredAckDeadlines`) when the owning coord crashed.
+* On coord boot, `Dispatcher.recoverState()` re-arms timers from the
+* persisted deadlines.
+*
+* Idempotent: re-running on a DB that already has either column is a no-op.
+*/
+async function up$1(db) {
+	const colExists = async (name) => {
+		return (await sql`
+      SELECT EXISTS (
+        SELECT 1 FROM information_schema.columns
+         WHERE table_schema = 'public'
+           AND table_name = 'dispatch_queue'
+           AND column_name = ${name}
+      ) AS exists
+    `.execute(db)).rows[0]?.exists ?? false;
+	};
+	if (!await colExists("ack_deadline")) await sql`
+      ALTER TABLE public.dispatch_queue
+        ADD COLUMN ack_deadline TIMESTAMPTZ
+    `.execute(db);
+	if (!await colExists("ack_agent_id")) await sql`
+      ALTER TABLE public.dispatch_queue
+        ADD COLUMN ack_agent_id TEXT
+    `.execute(db);
+	await sql`
+    CREATE INDEX IF NOT EXISTS idx_dispatch_queue_ack_deadline
+      ON public.dispatch_queue (ack_deadline)
+      WHERE ack_deadline IS NOT NULL
+  `.execute(db);
+}
+async function down$1(db) {
+	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
+var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
+*
+* Per-org override of the dispatch-acknowledgment deadline. NULL falls
+* back to the cluster-wide default (`KICI_DISPATCH_ACK_TIMEOUT_MS`,
+* default 10s). Operators raise it on high-latency networks via
+* `kici-admin org-settings`.
+*
+* Idempotent: a re-run on a DB that already has the column is a no-op.
+*/
+async function up(db) {
+	if ((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'org_settings'
+         AND column_name = 'dispatch_ack_timeout_ms'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists) return;
+	await sql`
+    ALTER TABLE public.org_settings
+      ADD COLUMN dispatch_ack_timeout_ms BIGINT
+  `.execute(db);
+}
+async function down(db) {
+	await sql`
+    ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
+  `.execute(db);
+}
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -3723,7 +4038,15 @@ function createMigrationProvider() {
 			"021_check_run_tracking": _021_check_run_tracking_exports,
 			"022_scaler_manager_state": _022_scaler_manager_state_exports,
 			"023_dispatch_queue_recovery_deadline": _023_dispatch_queue_recovery_deadline_exports,
-			"024_dispatch_queue_provisioning_error": _024_dispatch_queue_provisioning_error_exports
+			"024_dispatch_queue_provisioning_error": _024_dispatch_queue_provisioning_error_exports,
+			"025_init_failure": _025_init_failure_exports,
+			"026_event_log_lockfile_corrupt": _026_event_log_lockfile_corrupt_exports,
+			"027_workflow_timeout": _027_workflow_timeout_exports,
+			"028_org_settings_user_cache": _028_org_settings_user_cache_exports,
+			"029_dispatch_queue_attempts": _029_dispatch_queue_attempts_exports,
+			"030_held_runs_env_set_null": _030_held_runs_env_set_null_exports,
+			"031_dispatch_queue_ack_deadline": _031_dispatch_queue_ack_deadline_exports,
+			"032_org_settings_dispatch_ack_timeout": _032_org_settings_dispatch_ack_timeout_exports
 		};
 	} };
 }
@@ -3762,6 +4085,8 @@ async function runMigrations(opts) {
 		const applied = (results ?? []).filter((r) => r.status === "Success");
 		if (applied.length === 0) logger$5.info("Database schema is up to date");
 		else logger$5.info(`Applied ${applied.length} migration(s)`);
+		const hash = await computeMigrationsHash(createMigrationProvider());
+		await storeMigrationContentHash(opts.pool, hash);
 		return results ?? [];
 	} finally {
 		await client.query("SELECT pg_advisory_unlock($1)", [ADVISORY_LOCK_KEY]);
@@ -3854,7 +4179,6 @@ function registerDbCommands(program, getClient) {
 					pool
 				})).filter((r) => r.status === "Success").length;
 				const hash = await computeMigrationsHash(createMigrationProvider());
-				await storeMigrationContentHash(pool, hash);
 				console.log(`db fresh: ${dbName} — applied ${applied} migration(s), content hash ${hash.slice(0, 12)}...`);
 			} finally {
 				await kdb.destroy();
@@ -3865,7 +4189,7 @@ function registerDbCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	db.command("ensure <name>").description("CREATE DATABASE IF NOT EXISTS (idempotent)").option("--database-url <url>", "Admin DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--owner <role>", "DB owner role (default: URL user). Pass when the admin connection is privileged but the new DB should be owned by a separate non-privileged role.").option("--revoke-connect-public", "After ensure, REVOKE CONNECT ON DATABASE \"<name>\" FROM PUBLIC (recommended on shared clusters).").action(async (name, opts) => {
+	db.command("ensure <name>").description("CREATE DATABASE IF NOT EXISTS (idempotent)").option("--database-url <url>", "Admin DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--owner <role>", "DB owner role (default: URL user). Pass when the admin connection is privileged but the new DB should be owned by a separate non-privileged role.").option("--revoke-connect-public", "After ensure, REVOKE CONNECT ON DATABASE \"<name>\" FROM PUBLIC (recommended on shared clusters).").option("--grant-connect-role <role>", "After ensure (and any --revoke-connect-public), GRANT CONNECT ON DATABASE \"<name>\" TO \"<role>\". Repeatable.", (val, acc) => acc.concat([val]), []).action(async (name, opts) => {
 		try {
 			const baseUrl = resolveDatabaseUrl$1(opts.databaseUrl);
 			const url = new URL(baseUrl);
@@ -3874,9 +4198,10 @@ function registerDbCommands(program, getClient) {
 			logInvocation(`ensure ${name}`, targetUrl);
 			const outcome = await ensureDatabase(targetUrl, {
 				owner: opts.owner,
-				revokeConnectFromPublic: !!opts.revokeConnectPublic
+				revokeConnectFromPublic: !!opts.revokeConnectPublic,
+				grantConnectToRoles: opts.grantConnectRole
 			});
-			const suffix = (opts.owner ? ` (owner=${opts.owner})` : "") + (opts.revokeConnectPublic ? " [revoked CONNECT from PUBLIC]" : "");
+			const suffix = (opts.owner ? ` (owner=${opts.owner})` : "") + (opts.revokeConnectPublic ? " [revoked CONNECT from PUBLIC]" : "") + (opts.grantConnectRole.length ? ` [granted CONNECT to: ${opts.grantConnectRole.join(", ")}]` : "");
 			console.log(`db ensure: ${name} — ${outcome}${suffix}`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
@@ -6236,6 +6561,23 @@ function writeManifest(instanceDir, manifest) {
 	fs.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n", "utf-8");
 	return file;
 }
+/**
+* Read the running kici-admin's version from the orchestrator package.json.
+*
+* `process.env.npm_package_version` is only populated under `npm run` and is
+* undefined when kici-admin runs as a globally-installed binary, which is the
+* actual install path. Reading from the package.json on disk is the only
+* reliable source.
+*/
+function readKiciVersion() {
+	try {
+		const pkgUrl = new URL("../../../../package.json", import.meta.url);
+		const pkg = JSON.parse(fs.readFileSync(fileURLToPath(pkgUrl), "utf-8"));
+		return typeof pkg.version === "string" ? pkg.version : "unknown";
+	} catch {
+		return "unknown";
+	}
+}
 //#endregion
 //#region src/cli/service/instance/index-file.ts
 /**
@@ -7105,11 +7447,11 @@ var init_registry = __esmMin((() => {
 		},
 		shawl: { "win32-x64": {
 			name: "shawl",
-			version: "1.8.0",
+			version: "1.9.0",
 			platform: "win32",
 			arch: "x64",
-			url: "https://github.com/mtkennerly/shawl/releases/download/v1.8.0/shawl-v1.8.0-win64.zip",
-			sha256: "ec9bd229a1bcf800509cee731c6a0324d925ca328598085dc743ab200b781678",
+			url: "https://github.com/mtkennerly/shawl/releases/download/v1.9.0/shawl-v1.9.0-win64.zip",
+			sha256: "f883c5d09c9beae2efaeabd8513e7d3f57cd1d0864cec3df4f4a7b6ee904351c",
 			extractPath: "shawl.exe",
 			archiveType: "zip"
 		} }
@@ -8221,7 +8563,18 @@ function startDevPostgres(containerName) {
 		if (err instanceof Error && err.message.includes("already exists")) throw err;
 	}
 	console.log(`Starting dev PostgreSQL container "${containerName}" on port ${port}...`);
-	execSync(`${runtime} run -d --name ${containerName} -p ${port}:5432 -e POSTGRES_PASSWORD=${password} -e POSTGRES_DB=kici postgres:18-trixie`, { stdio: "inherit" });
+	const tmpEnvFile = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "kici-dev-pg-")), "postgres.env");
+	try {
+		fs.writeFileSync(tmpEnvFile, `POSTGRES_PASSWORD=${password}\n`, { mode: 384 });
+		execSync(`${runtime} run -d --name ${containerName} -p ${port}:5432 --env-file ${tmpEnvFile} -e POSTGRES_DB=kici postgres:18-trixie`, { stdio: "inherit" });
+	} finally {
+		try {
+			fs.rmSync(path.dirname(tmpEnvFile), {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+	}
 	return `postgresql://postgres:${password}@localhost:${port}/kici`;
 }
 function registerOrchestratorInstall(orchestrator) {
@@ -8331,7 +8684,7 @@ function registerOrchestratorInstall(orchestrator) {
 				logDir,
 				installBase: getInstallBase(platform, serviceName),
 				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-				kiciVersion: process.env.npm_package_version ?? "unknown"
+				kiciVersion: readKiciVersion()
 			});
 			try {
 				appendIndexEntry(kiciRoot, {
@@ -8837,7 +9190,7 @@ function registerAgentInstall(agent) {
 				logDir,
 				installBase: getInstallBase(platform, serviceName),
 				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-				kiciVersion: process.env.npm_package_version ?? "unknown"
+				kiciVersion: readKiciVersion()
 			});
 			try {
 				appendIndexEntry(kiciRoot, {
@@ -9625,6 +9978,9 @@ function formatSettings(s, format) {
 	lines.push(`Denied source repos:   ${s.deniedRepos === null ? "(none)" : formatList(s.deniedRepos)}`);
 	lines.push(`Elevated authors:      ${s.elevatedRepos === null ? "(none)" : formatList(s.elevatedRepos)}`);
 	lines.push(`Allow http registries: ${s.allowHttpNpmRegistries}`);
+	lines.push(`User-cache quota:      ${s.userCacheQuotaBytes === null ? "(cluster default)" : `${s.userCacheQuotaBytes} bytes`}`);
+	lines.push(`User-cache TTL:        ${s.userCacheTtlMs === null ? "(cluster default)" : `${s.userCacheTtlMs} ms`}`);
+	lines.push(`Dispatch ack timeout:  ${s.dispatchAckTimeoutMs === null ? "(cluster default)" : `${s.dispatchAckTimeoutMs} ms`}`);
 	if (s.createdAt) lines.push(`Created at:            ${s.createdAt}`);
 	if (s.updatedAt) lines.push(`Updated at:            ${s.updatedAt}`);
 	return lines.join("\n");
@@ -9699,6 +10055,117 @@ function registerOrgSettingsCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	registerUserCacheCommands(orgSettings, getClient);
+	registerDispatchAckCommands(orgSettings, getClient);
+}
+/**
+* `kici-admin org-settings dispatch-ack <show|set|reset>`.
+*
+* The per-org dispatch-acknowledgment deadline (ms). A null (unset) value
+* means the cluster-wide default applies (`KICI_DISPATCH_ACK_TIMEOUT_MS`,
+* default 10s). Operators raise it on high-latency networks.
+*/
+function registerDispatchAckCommands(orgSettings, getClient) {
+	const da = orgSettings.command("dispatch-ack").description("Manage the per-org dispatch-acknowledgment deadline (null = cluster default)");
+	da.command("show").description("Print the current per-org dispatch-acknowledgment deadline").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const settings = await fetchSettings(getClient(), customerId);
+			console.log(formatSettings(settings, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	da.command("set <value>").description("Set the per-org dispatch-acknowledgment deadline (integer milliseconds, >= 1000)").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (value, opts) => {
+		const n = Number(value);
+		if (!Number.isInteger(n) || n < 1e3) {
+			console.error("Error: value must be an integer >= 1000 (milliseconds)");
+			process.exit(1);
+		}
+		const customerId = resolveCustomerId(opts);
+		try {
+			const updated = await patchSettings(getClient(), {
+				customerId,
+				dispatchAckTimeoutMs: n
+			});
+			console.log(formatSettings(updated, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	da.command("reset").description("Clear the per-org dispatch-ack deadline override (fall back to the cluster default)").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const updated = await patchSettings(getClient(), {
+				customerId,
+				dispatchAckTimeoutMs: null
+			});
+			console.log(formatSettings(updated, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+}
+/**
+* `kici-admin org-settings user-cache <show|set-quota|set-ttl|reset-quota|reset-ttl>`.
+*
+* The per-org byte quota and per-entry TTL for the user-facing cache. A null
+* (unset) value means the cluster-wide default applies (the
+* `KICI_USER_CACHE_QUOTA_BYTES` / `KICI_USER_CACHE_TTL_MS` env vars).
+*/
+function registerUserCacheCommands(orgSettings, getClient) {
+	const uc = orgSettings.command("user-cache").description("Manage per-org user-facing cache quota + entry TTL (null = cluster default)");
+	uc.command("show").description("Print the current per-org user-cache quota + TTL settings").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const settings = await fetchSettings(getClient(), customerId);
+			console.log(formatSettings(settings, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	registerUserCacheSetter(uc, getClient, "quota");
+	registerUserCacheSetter(uc, getClient, "ttl");
+}
+/** Register `set-<knob>` and `reset-<knob>` for the byte-quota / ms-TTL knobs. */
+function registerUserCacheSetter(uc, getClient, knob) {
+	const field = knob === "quota" ? "userCacheQuotaBytes" : "userCacheTtlMs";
+	const unit = knob === "quota" ? "bytes" : "milliseconds";
+	uc.command(`set-${knob} <value>`).description(`Set the per-org user-cache ${knob} (positive integer ${unit})`).option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (value, opts) => {
+		const n = Number(value);
+		if (!Number.isInteger(n) || n <= 0) {
+			console.error(`Error: value must be a positive integer (${unit})`);
+			process.exit(1);
+		}
+		const customerId = resolveCustomerId(opts);
+		try {
+			const updated = await patchSettings(getClient(), {
+				customerId,
+				[field]: n
+			});
+			console.log(formatSettings(updated, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	uc.command(`reset-${knob}`).description(`Clear the per-org user-cache ${knob} override (fall back to the cluster default)`).option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const updated = await patchSettings(getClient(), {
+				customerId,
+				[field]: null
+			});
+			console.log(formatSettings(updated, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 }
 /** Register `<prefix>-add` and `<prefix>-remove` commands bound to a list field. */
 function registerListMutators(gw, getClient, prefix, field) {
@@ -10120,8 +10587,10 @@ function printShowEnvironment(res) {
 }
 function registerEnvironmentCommands(program, getClient) {
 	const env = program.command("environment").description("Environment management (dual-mode)");
-	env.command("create").description("Upsert an environment (idempotent by org+name)").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Environment name").option("--type <t>", "Environment type (fixed|glob|template)", "fixed").option("--enabled <bool>", "Enabled flag (true|false)", "true").option("--branch-restrictions <json>", "JSON array of allowed branches (e.g. '[\"main\"]')").option("--required-reviewers <csv>", "CSV of required reviewer user IDs (or empty to clear)").option("--wait-timer <seconds>", "Wait timer before release (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("create").description("Upsert an environment (idempotent by org+name)").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Environment name").option("--type <t>", "Environment type (fixed|glob|template)", "fixed").option("--glob-pattern <pattern>", "Glob pattern matched against declared environment names (required with --type glob)").option("--enabled <bool>", "Enabled flag (true|false)", "true").option("--branch-restrictions <json>", "JSON array of allowed branches (e.g. '[\"main\"]')").option("--required-reviewers <csv>", "CSV of required reviewer user IDs (or empty to clear)").option("--wait-timer <seconds>", "Wait timer before release (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
+			if (opts.type === "glob" && !opts.globPattern) throw new Error("--type glob requires --glob-pattern <pattern>");
+			if (opts.type !== "glob" && opts.globPattern !== void 0) throw new Error("--glob-pattern requires --type glob");
 			const branchRestrictions = parseJsonOption(opts.branchRestrictions, "--branch-restrictions");
 			const requiredReviewers = parseCsvOption(opts.requiredReviewers);
 			const waitTimerSeconds = parseIntOption$3(opts.waitTimer, "--wait-timer");
@@ -10132,6 +10601,7 @@ function registerEnvironmentCommands(program, getClient) {
 				name: opts.name,
 				type: opts.type,
 				enabled,
+				globPattern: opts.globPattern,
 				branchRestrictions,
 				requiredReviewers,
 				waitTimerSeconds,
@@ -10166,7 +10636,7 @@ function registerEnvironmentCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	env.command("set-policy").description("Update policy fields on an environment (only provided fields change)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Environment name").option("--branch-restrictions <json>", "JSON array of allowed branches").option("--required-reviewers <csv>", "CSV of required reviewer user IDs (empty to clear)").option("--wait-timer <seconds>", "Wait timer before release (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted, or \"null\" to clear)").option("--enabled <bool>", "Enabled flag (true|false)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("set-policy").description("Update policy fields on an environment (only provided fields change)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Environment name").option("--branch-restrictions <json>", "JSON array of allowed branches").option("--required-reviewers <csv>", "CSV of required reviewer user IDs (empty to clear)").option("--wait-timer <seconds>", "Wait timer before release (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted, or \"null\" to clear)").option("--enabled <bool>", "Enabled flag (true|false)").option("--allow-local-execution <bool>", "Allow CLI/test runs to resolve this env (true|false)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const payload = {
 				orgId: opts.org,
@@ -10178,6 +10648,7 @@ function registerEnvironmentCommands(program, getClient) {
 			if (opts.holdExpiry !== void 0) payload.holdExpirySeconds = parseIntOption$3(opts.holdExpiry, "--hold-expiry");
 			if (opts.minimumTrust !== void 0) payload.minimumTrust = opts.minimumTrust === "null" ? null : opts.minimumTrust;
 			if (opts.enabled !== void 0) payload.enabled = opts.enabled === "false" ? false : true;
+			if (opts.allowLocalExecution !== void 0) payload.allowLocalExecution = opts.allowLocalExecution === "false" ? false : true;
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
 			if (dbUrl) await setEnvironmentPolicyDirect(dbUrl, payload);
 			else await getClient().patch(`/api/v1/admin/environments/${encodeURIComponent(opts.env)}/policy`, payload);
@@ -10213,6 +10684,23 @@ function registerEnvironmentCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	env.command("delete").description("Delete an environment (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Environment name").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+		try {
+			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
+			let deleted;
+			if (dbUrl) ({deleted} = await deleteEnvironmentDirect(dbUrl, {
+				orgId: opts.org,
+				name: opts.name
+			}));
+			else deleted = (await getClient().delete(`/api/v1/admin/environments/${encodeURIComponent(opts.name)}?orgId=${encodeURIComponent(opts.org)}`)).deleted;
+			if (!deleted) throw new Error(`environment not found (org=${opts.org}, name=${opts.name})`);
+			if (opts.json) console.log(JSON.stringify({ deleted: true }));
+			else console.log(`environment delete: deleted=true${dbUrl ? " (direct)" : ""}`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 	env.command("create-template").description("Create or update an environment template + its seed variables").requiredOption("--org <id>", "Org ID").requiredOption("--template <name>", "Template name").option("--type <t>", "Environment type (defaults to \"template\")", "template").option("--branch-restrictions <json>", "JSON array of allowed branches").option("--required-reviewers <csv>", "CSV of required reviewer user IDs").option("--wait-timer <seconds>", "Wait timer (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted)").option("--variables <json>", "JSON object of env variables to seed (e.g. '{\"K\":\"V\"}')").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const branchRestrictions = parseJsonOption(opts.branchRestrictions, "--branch-restrictions");