@kici-dev/orchestrator 0.1.20 → 0.1.22

package/dist/cli.js

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 import * as path$1 from "node:path";
 import path, { join, resolve } from "node:path";
 import * as fs$1 from "node:fs";
-import fs, { chmodSync, closeSync, createReadStream, createWriteStream, existsSync, openSync, promises, readFileSync, realpathSync, statSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
+import fs, { chmodSync, closeSync, createReadStream, createWriteStream, existsSync, mkdtempSync, openSync, promises, readFileSync, realpathSync, statSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
 import { Command } from "commander";
 import { BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, decodeChunk, deleteEnvironmentDirect, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
 import crypto, { createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID } from "node:crypto";
@@ -12,22 +12,24 @@ import { createInterface } from "node:readline";
 import { access, chmod, constants, copyFile, link, mkdir, open, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { parse, stringify } from "yaml";
 import { z } from "zod";
-import os from "node:os";
+import os, { platform, tmpdir } from "node:os";
 import { getDatabaseCollationDrift, refreshDatabaseCollationVersion, reindexDatabaseConcurrently } from "@kici-dev/shared/db-collation";
 import { sql } from "kysely";
 import { Migrator } from "kysely/migration";
 import "jsonpath-plus";
-import { execFile, execFileSync, execSync, spawn } from "node:child_process";
+import { exec, execFile, execFileSync, execSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
+import { KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, ScalerBackendType, ScalerEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, getAccessLogColdDays, getSecretAuditLogColdDays, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseHostPropertyAssignments, scalerAgentLabels, secretAuditLogWarmSqlCase } from "@kici-dev/engine";
+import { Octokit } from "@octokit/rest";
+import { createAppAuth } from "@octokit/auth-app";
+import http, { createServer } from "node:http";
 import { ZipArchive } from "archiver";
 import { confirm, input, password, select } from "@inquirer/prompts";
 import JSZip from "jszip";
 import { pipeline } from "node:stream/promises";
 import "pg";
-import { KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, ScalerBackendType, ScalerEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, getAccessLogColdDays, getSecretAuditLogColdDays, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, scalerAgentLabels, secretAuditLogWarmSqlCase } from "@kici-dev/engine";
 import { DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DashboardWriteCategory, DashboardWriteSensitivity } from "@kici-dev/engine/protocol/dashboard-write-operations";
 import { CLUSTER_NAME_FORMAT_MESSAGE } from "@kici-dev/engine/protocol/cluster-name";
-import http from "node:http";
 import { PassThrough } from "node:stream";
 import Docker from "dockerode";
 var __defProp = Object.defineProperty;
@@ -1554,8 +1556,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -2247,7 +2249,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$41(db) {
+async function up$49(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2269,7 +2271,7 @@ async function up$41(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$41(db) {
+async function down$49(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2316,8 +2318,8 @@ async function down$41(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -2331,13 +2333,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$40(db) {
+async function up$48(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$40(db) {
+async function down$48(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2346,8 +2348,8 @@ async function down$40(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2371,7 +2373,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$39(db) {
+async function up$47(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2409,28 +2411,28 @@ async function up$39(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$39(db) {
+async function down$47(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$46,
+	up: () => up$46
 });
-async function up$38(db) {
+async function up$46(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$38(db) {
+async function down$46(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Cold-store chunk counter table.
@@ -2447,7 +2449,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$37(db) {
+async function up$45(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2465,14 +2467,14 @@ async function up$37(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$37(db) {
+async function down$45(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -2508,7 +2510,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$36(db) {
+async function up$44(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2553,7 +2555,7 @@ async function up$36(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$36(db) {
+async function down$44(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2578,8 +2580,8 @@ async function down$36(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -2619,7 +2621,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$35(db) {
+async function up$43(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2640,7 +2642,7 @@ async function up$35(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$35(db) {
+async function down$43(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2668,8 +2670,8 @@ async function down$35(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -2707,7 +2709,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$34(db) {
+async function up$42(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2723,7 +2725,7 @@ async function up$34(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$34(db) {
+async function down$42(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2742,8 +2744,8 @@ async function down$34(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -2756,7 +2758,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$33(db) {
+async function up$41(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2765,14 +2767,14 @@ async function up$33(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$33(db) {
+async function down$41(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -2804,7 +2806,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$32(db) {
+async function up$40(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -2831,14 +2833,14 @@ async function up$32(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$32(db) {
+async function down$40(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -2857,11 +2859,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$31(db) {
+async function up$39(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$31(db) {
+async function down$39(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -2900,8 +2902,8 @@ async function down$31(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -2927,7 +2929,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$30(db) {
+async function up$38(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -2945,14 +2947,14 @@ async function up$30(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$30(db) {
+async function down$38(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -2971,7 +2973,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$29(db) {
+async function up$37(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -2981,15 +2983,15 @@ async function up$29(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$29(db) {
+async function down$37(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -3023,7 +3025,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$28(db) {
+async function up$36(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3054,7 +3056,7 @@ async function up$28(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$28(db) {
+async function down$36(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -3072,8 +3074,8 @@ async function down$28(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -3101,7 +3103,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$27(db) {
+async function up$35(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3226,7 +3228,7 @@ async function up$27(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$27(db) {
+async function down$35(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3251,8 +3253,8 @@ async function down$27(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3265,7 +3267,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$26(db) {
+async function up$34(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3279,7 +3281,7 @@ async function up$26(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$26(db) {
+async function down$34(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3287,8 +3289,8 @@ async function down$26(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -3328,17 +3330,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$25(db) {
+async function up$33(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$25(db) {
+async function down$33(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3383,19 +3385,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$24(db) {
+async function up$32(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$24(db) {
+async function down$32(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -3418,7 +3420,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$23(db) {
+async function up$31(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3439,15 +3441,15 @@ async function up$23(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$23(db) {
+async function down$31(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -3462,7 +3464,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$22(db) {
+async function up$30(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3476,7 +3478,7 @@ async function up$22(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$22(db) {
+async function down$30(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -3484,8 +3486,8 @@ async function down$22(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -3509,7 +3511,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$21(db) {
+async function up$29(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -3540,14 +3542,14 @@ async function up$21(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$21(db) {
+async function down$29(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -3574,7 +3576,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$20(db) {
+async function up$28(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3624,7 +3626,7 @@ async function up$20(db) {
     `.execute(db);
 	}
 }
-async function down$20(db) {
+async function down$28(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -3632,8 +3634,8 @@ async function down$20(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -3657,7 +3659,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$19(db) {
+async function up$27(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3682,7 +3684,7 @@ async function up$19(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$19(db) {
+async function down$27(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -3694,8 +3696,8 @@ async function down$19(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -3711,7 +3713,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$18(db) {
+async function up$26(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3727,7 +3729,7 @@ async function up$18(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$18(db) {
+async function down$26(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -3735,8 +3737,8 @@ async function down$18(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -3750,7 +3752,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$17(db) {
+async function up$25(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3770,7 +3772,7 @@ async function up$17(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$17(db) {
+async function down$25(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -3781,8 +3783,8 @@ async function down$17(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -3791,7 +3793,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$16(db) {
+async function up$24(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3801,7 +3803,7 @@ async function up$16(db) {
     ])))
   `.execute(db);
 }
-async function down$16(db) {
+async function down$24(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3814,8 +3816,8 @@ async function down$16(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -3833,13 +3835,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$15(db) {
+async function up$23(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$15(db) {
+async function down$23(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -3847,8 +3849,8 @@ async function down$15(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -3877,7 +3879,7 @@ async function columnExists(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$14(db) {
+async function up$22(db) {
 	if (!await columnExists(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
@@ -3887,7 +3889,7 @@ async function up$14(db) {
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$14(db) {
+async function down$22(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -3898,8 +3900,8 @@ async function down$14(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -3913,7 +3915,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$13(db) {
+async function up$21(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3926,7 +3928,7 @@ async function up$13(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$13(db) {
+async function down$21(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -3934,8 +3936,8 @@ async function down$13(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -3946,14 +3948,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$12(db) {
+async function up$20(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$12(db) {
+async function down$20(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -3963,8 +3965,8 @@ async function down$12(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -3981,7 +3983,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$11(db) {
+async function up$19(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4006,7 +4008,7 @@ async function up$11(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$11(db) {
+async function down$19(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -4014,8 +4016,8 @@ async function down$11(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -4027,7 +4029,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$10(db) {
+async function up$18(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4041,7 +4043,7 @@ async function up$10(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$10(db) {
+async function down$18(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -4049,8 +4051,8 @@ async function down$10(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -4067,7 +4069,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$9(db) {
+async function up$17(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4087,7 +4089,7 @@ async function up$9(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$9(db) {
+async function down$17(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -4098,8 +4100,8 @@ async function down$9(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -4121,7 +4123,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$8(db) {
+async function up$16(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4154,7 +4156,7 @@ async function up$8(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$8(db) {
+async function down$16(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -4164,8 +4166,8 @@ async function down$8(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -4174,7 +4176,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$7(db) {
+async function up$15(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -4184,14 +4186,14 @@ async function up$7(db) {
     )
   `.execute(db);
 }
-async function down$7(db) {
+async function down$15(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -4204,7 +4206,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$6(db) {
+async function up$14(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4230,14 +4232,14 @@ async function up$6(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$6(db) {
+async function down$14(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -4254,7 +4256,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$5(db) {
+async function up$13(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4270,7 +4272,7 @@ async function up$5(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$5(db) {
+async function down$13(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4289,8 +4291,8 @@ async function down$5(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -4302,7 +4304,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$4(db) {
+async function up$12(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4321,14 +4323,14 @@ async function up$4(db) {
     )
   `.execute(db);
 }
-async function down$4(db) {
+async function down$12(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -4345,7 +4347,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$3(db) {
+async function up$11(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4375,14 +4377,14 @@ async function up$3(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$3(db) {
+async function down$11(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -4399,7 +4401,7 @@ var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has any column is a no-op.
 */
-async function colExists$2(db, table, name) {
+async function colExists$5(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4409,18 +4411,18 @@ async function colExists$2(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$2(db) {
-	if (!await colExists$2(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
-	if (!await colExists$2(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
-	if (!await colExists$2(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
-	if (!await colExists$2(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
+async function up$10(db) {
+	if (!await colExists$5(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
+	if (!await colExists$5(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
+	if (!await colExists$5(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
+	if (!await colExists$5(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_pinned_agent
       ON public.dispatch_queue (pinned_agent_id)
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$2(db) {
+async function down$10(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -4428,91 +4430,365 @@ async function down$2(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS base_job_name`.execute(db);
 }
 //#endregion
-//#region src/db/migrations/041_wave_gated.ts
-var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/041_wave_gated.ts
+var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$9,
+	up: () => up$9
+});
+/**
+* Add the rolling fan-out wave-gate columns:
+*
+* - `execution_jobs.wave_gated boolean NOT NULL DEFAULT false` — when a fan-out
+*   job declares `maxParallel`, children beyond the sliding window are persisted
+*   `wave_gated=true` (held, not enqueued). The dispatch loop skips them; the
+*   wave-scheduler clears the flag one-per-terminal as siblings complete (or, on
+*   `failFast`, skips the held remainder).
+* - `execution_jobs.wave_max_parallel int` / `wave_fail_fast boolean` — the
+*   base's wave policy, stamped on every fan-out child so the wave-scheduler can
+*   read it at terminal time without re-fetching the lock file (the tracker has
+*   no lock access). NULL for any job not part of a bounded wave.
+*
+* A composite index on (run_id, base_job_name, wave_gated) supports the
+* wave-scheduler's "next held sibling of this base" lookups.
+*
+* Idempotent: re-running on a DB that already has the columns is a no-op.
+*/
+async function colExists$4(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$9(db) {
+	if (!await colExists$4(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
+	if (!await colExists$4(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
+	if (!await colExists$4(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
+	await sql`
+    CREATE INDEX IF NOT EXISTS idx_execution_jobs_wave
+      ON public.execution_jobs (run_id, base_job_name, wave_gated)
+  `.execute(db);
+}
+async function down$9(db) {
+	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_gated`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/042_dispatch_queue_patterns.ts
+var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$8,
+	up: () => up$8
+});
+/**
+* Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
+* exclude_labels (the SQL @> prefilter); regex matchers go here and are applied
+* as a JS post-filter at drain time, since Postgres `~` regex semantics differ
+* from JavaScript `RegExp` and the engine's `matcherSatisfiedBy` is the single
+* matching authority.
+*
+* - `runs_on_patterns jsonb NOT NULL DEFAULT '[]'` — regex matchers the agent's
+*   labels must satisfy.
+* - `exclude_patterns jsonb NOT NULL DEFAULT '[]'` — regex matchers that
+*   disqualify an agent.
+*
+* Idempotent: re-running on a DB that already has the columns is a no-op.
+*/
+async function colExists$3(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$8(db) {
+	if (!await colExists$3(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+	if (!await colExists$3(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+}
+async function down$8(db) {
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/043_rerouted_to_peer.ts
+var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$7,
+	up: () => up$7
+});
+/**
+* Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
+* means the job was rerouted to a remote worker peer (the value is that
+* peer's instance id); NULL means the job runs locally. The run-recovery
+* sweepers read it so a rerouted job whose worker is still connected is not
+* prematurely failed.
+*
+* Idempotent: re-running on a DB that already has the column is a no-op.
+*/
+async function colExists$2(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$7(db) {
+	if (!await colExists$2(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
+}
+async function down$7(db) {
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/044_check_mode.ts
+var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$6,
+	up: () => up$6
+});
+/**
+* Add idempotent check-mode columns:
+*
+* - `execution_runs.check_mode text` — the run's mode (`apply` | `check` |
+*   `check-fail-on-drift`). NULL means a legacy/apply run.
+* - `execution_steps.check_outcome text` — the per-step `CheckStepOutcome`
+*   (`skipped` | `applied` | `declined` | `dry-run` | `no_check`). NULL when
+*   the step ran without a check mode.
+* - `execution_steps.drift_summary text` — the human-readable `summarize(drift)`
+*   line. NULL when no drift.
+* - `execution_steps.drift jsonb` — the structured drift value. NULL when no drift.
+*
+* All nullable. Idempotent: re-running on a DB that already has the columns is
+* a no-op.
+*/
+async function colExists$1(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$6(db) {
+	if (!await colExists$1(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
+	if (!await colExists$1(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
+	if (!await colExists$1(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
+	if (!await colExists$1(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
+}
+async function down$6(db) {
+	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
+	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
+	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS check_mode`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/045_host_properties.ts
+var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/**
+* Add the typed host-vars dimension to the host roster:
+*
+* - `host_roster.host_properties jsonb NOT NULL DEFAULT '{}'` — the typed
+*   property bag (`string | number | boolean` values) reported by the agent at
+*   registration and/or declared by the operator (`kici-admin host declare
+*   --prop`). Labels stay the flat-string grouping dimension; properties are
+*   the separate queryable host-vars dimension.
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
+* the column is a no-op. Staging data is preserved (additive column).
+*/
+async function up$5(db) {
+	await sql`ALTER TABLE public.host_roster
+    ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
+}
+async function down$5(db) {
+	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/046_join_token_consumed_by_instance.ts
+var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* Record the joining peer's instanceId at first consumption of a join token:
+*
+* - `join_tokens.consumed_by_instance text` — the `instanceId` of the peer that
+*   consumed the token. This is the *joining peer*, distinct from `consumed_by`
+*   (the coordinator that processed the claim). It lets a token be reused by the
+*   same peer instance until `expires_at`, so a peer that lost its credential
+*   (transient outage / deleted credential file) self-heals by re-presenting the
+*   join token already in its env — no operator action, no cluster redeploy.
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
+* the column is a no-op. Staging data is preserved (additive nullable column).
+*/
+async function up$4(db) {
+	await sql`ALTER TABLE public.join_tokens
+    ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
+}
+async function down$4(db) {
+	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/047_needs_run_on.ts
+var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* Migrate `execution_job_needs` from the binary `if_failed` policy to a
+* programmable `run_on` status-set:
+*
+* - Add `run_on text` (JSON-encoded array of upstream terminal statuses) with a
+*   default of `'["success"]'`.
+* - Backfill from the existing `if_failed`: `skip` → `["success"]`,
+*   `run` → every terminal job status.
+* - Drop `if_failed`.
+*
+* Idempotent: column-exists guarded so re-running on a DB that already has
+* `run_on` (and no `if_failed`) is a no-op. Existing rows are preserved
+* (staging data is not dropped).
+*/
+const ALL_TERMINAL_JSON = JSON.stringify([
+	"success",
+	"failed",
+	"cancelled",
+	"skipped",
+	"timed_out_stale",
+	"drift_dropped"
+]);
+const SUCCESS_ONLY_JSON = JSON.stringify(["success"]);
+async function colExists(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
+async function up$3(db) {
+	if (!await colExists(db, "execution_job_needs", "run_on")) await sql`
+      ALTER TABLE public.execution_job_needs
+        ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
+    `.execute(db);
+	if (await colExists(db, "execution_job_needs", "if_failed")) {
+		await sql`
+      UPDATE public.execution_job_needs
+         SET run_on = ${ALL_TERMINAL_JSON}
+       WHERE if_failed = 'run'
+    `.execute(db);
+		await sql`
+      UPDATE public.execution_job_needs
+         SET run_on = ${SUCCESS_ONLY_JSON}
+       WHERE if_failed = 'skip'
+    `.execute(db);
+		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
+	}
+}
+async function down$3(db) {
+	if (!await colExists(db, "execution_job_needs", "if_failed")) await sql`
+      ALTER TABLE public.execution_job_needs
+        ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
+    `.execute(db);
+	if (await colExists(db, "execution_job_needs", "run_on")) {
+		await sql`
+      UPDATE public.execution_job_needs
+         SET if_failed = CASE WHEN run_on = ${SUCCESS_ONLY_JSON} THEN 'skip' ELSE 'run' END
+    `.execute(db);
+		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN run_on`.execute(db);
+	}
+}
+//#endregion
+//#region src/db/migrations/048_host_reboot_pending.ts
+var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
+* reboot-pending flag for workflow-level host restart.
+*
+* Set when an agent's `restartHost()` step calls `host.requestReboot` (so it
+* survives an orchestrator restart during the host's reboot window). While the
+* value is in the future it (1) makes the agent's imminent disconnect an
+* expected reboot rather than a recovery-fail, (2) gates the pinned-drain off
+* so the post-restart job is not dispatched into the about-to-reboot box, and
+* (3) clears on the next reconnect (down-then-up), releasing the held job. NULL
+* = no reboot pending.
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
+*/
+async function up$2(db) {
+	await sql`ALTER TABLE public.host_roster
+    ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
+}
+async function down$2(db) {
+	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/049_held_runs_payload.ts
+var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$1,
 	up: () => up$1
 });
 /**
-* Add the rolling fan-out wave-gate columns:
-*
-* - `execution_jobs.wave_gated boolean NOT NULL DEFAULT false` — when a fan-out
-*   job declares `maxParallel`, children beyond the sliding window are persisted
-*   `wave_gated=true` (held, not enqueued). The dispatch loop skips them; the
-*   wave-scheduler clears the flag one-per-terminal as siblings complete (or, on
-*   `failFast`, skips the held remainder).
-* - `execution_jobs.wave_max_parallel int` / `wave_fail_fast boolean` — the
-*   base's wave policy, stamped on every fan-out child so the wave-scheduler can
-*   read it at terminal time without re-fetching the lock file (the tracker has
-*   no lock access). NULL for any job not part of a bounded wave.
-*
-* A composite index on (run_id, base_job_name, wave_gated) supports the
-* wave-scheduler's "next held sibling of this base" lookups.
+* Add `held_runs.payload jsonb NULL` — the drift payload captured when a
+* `when: 'drift'` step-approval gate fires. Holds `{ summaryMarkdown, drift }`:
+* the author's `summarize(drift)` rendering plus the structured drift blob, so
+* the dashboard approval queue and the CLI render the computed diff the
+* operator approves. NULL for every non-drift hold.
 *
-* Idempotent: re-running on a DB that already has the columns is a no-op.
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
 */
-async function colExists$1(db, table, name) {
-	return (await sql`
-    SELECT EXISTS (
-      SELECT 1 FROM information_schema.columns
-       WHERE table_schema = 'public'
-         AND table_name = ${table}
-         AND column_name = ${name}
-    ) AS exists
-  `.execute(db)).rows[0]?.exists ?? false;
-}
 async function up$1(db) {
-	if (!await colExists$1(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
-	if (!await colExists$1(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
-	if (!await colExists$1(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
-	await sql`
-    CREATE INDEX IF NOT EXISTS idx_execution_jobs_wave
-      ON public.execution_jobs (run_id, base_job_name, wave_gated)
-  `.execute(db);
+	await sql`ALTER TABLE public.held_runs
+    ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
 async function down$1(db) {
-	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
-	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
-	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
-	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_gated`.execute(db);
+	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 //#endregion
-//#region src/db/migrations/042_dispatch_queue_patterns.ts
-var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/050_sources_slug.ts
+var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 	down: () => down,
 	up: () => up
 });
 /**
-* Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
-* exclude_labels (the SQL @> prefilter); regex matchers go here and are applied
-* as a JS post-filter at drain time, since Postgres `~` regex semantics differ
-* from JavaScript `RegExp` and the engine's `matcherSatisfiedBy` is the single
-* matching authority.
+* Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
+* GitHub assigns, e.g. `my-kici-app`).
 *
-* - `runs_on_patterns jsonb NOT NULL DEFAULT '[]'` — regex matchers the agent's
-*   labels must satisfy.
-* - `exclude_patterns jsonb NOT NULL DEFAULT '[]'` — regex matchers that
-*   disqualify an agent.
+* For GitHub-App sources GitHub is the source of truth for both the display
+* `name` and the `slug`: both are captured at creation and kept fresh by the
+* daily refresher + `kici-admin source refresh`. NULL when the identity fetch
+* hasn't populated it yet (manual `--app-id` flow whose initial fetch failed,
+* or a row created before the rollout).
 *
-* Idempotent: re-running on a DB that already has the columns is a no-op.
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
 */
-async function colExists(db, table, name) {
-	return (await sql`
-    SELECT EXISTS (
-      SELECT 1 FROM information_schema.columns
-       WHERE table_schema = 'public'
-         AND table_name = ${table}
-         AND column_name = ${name}
-    ) AS exists
-  `.execute(db)).rows[0]?.exists ?? false;
-}
 async function up(db) {
-	if (!await colExists(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
-	if (!await colExists(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+	await sql`ALTER TABLE public.sources
+    ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
 async function down(db) {
-	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
-	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
+	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 //#endregion
 //#region src/db/migration-provider.ts
@@ -4560,7 +4836,15 @@ function createMigrationProvider() {
 			"039_host_roster": _039_host_roster_exports,
 			"040_runsonall_pin": _040_runsonall_pin_exports,
 			"041_wave_gated": _041_wave_gated_exports,
-			"042_dispatch_queue_patterns": _042_dispatch_queue_patterns_exports
+			"042_dispatch_queue_patterns": _042_dispatch_queue_patterns_exports,
+			"043_rerouted_to_peer": _043_rerouted_to_peer_exports,
+			"044_check_mode": _044_check_mode_exports,
+			"045_host_properties": _045_host_properties_exports,
+			"046_join_token_consumed_by_instance": _046_join_token_consumed_by_instance_exports,
+			"047_needs_run_on": _047_needs_run_on_exports,
+			"048_host_reboot_pending": _048_host_reboot_pending_exports,
+			"049_held_runs_payload": _049_held_runs_payload_exports,
+			"050_sources_slug": _050_sources_slug_exports
 		};
 	} };
 }
@@ -5187,6 +5471,419 @@ function installPostReceiveHook(repoPath, script) {
 	return hookPath;
 }
 //#endregion
+//#region src/providers/github/auth.ts
+/**
+* GitHub clone token provider and authentication utilities.
+*
+* Implements the CloneTokenProvider interface from @kici-dev/engine for GitHub.
+* Uses GitHub App installation tokens for repository access.
+*/
+/**
+* Create an Octokit instance authenticated as a GitHub App installation.
+*
+* Uses @octokit/auth-app to handle:
+* - JWT generation for app-level authentication
+* - Installation token creation and automatic refresh
+*
+* Each call creates a new Octokit instance scoped to the specific installation.
+* The auth-app strategy handles token caching internally per Octokit instance.
+*
+* @param config - GitHub App credentials (appId + privateKey)
+* @param installationId - GitHub App installation ID for the target account/org
+* @returns Octokit instance with auto-refreshing installation tokens
+*/
+function createInstallationOctokit(config, installationId) {
+	return new Octokit({
+		authStrategy: createAppAuth,
+		auth: {
+			appId: config.appId,
+			privateKey: config.privateKey,
+			installationId
+		}
+	});
+}
+//#endregion
+//#region src/providers/github/manifest.ts
+/**
+* GitHub App Manifest flow helpers. The manifest encodes KiCI's exact
+* permissions + events + webhook config so the operator never picks them by
+* hand — GitHub creates a correctly-configured App from this object in one
+* click. See docs.github.com "Registering a GitHub App from a manifest".
+*
+* The webhook secret is NOT part of the manifest: GitHub generates it during
+* registration and returns it on the conversion response, so both GitHub and
+* the Platform end up sharing the same secret with zero operator effort.
+*/
+/**
+* Validate a self-hosted webhook URL supplied via `source add github
+* --webhook-url`. Must be a well-formed absolute `https://` URL. Returns the URL
+* verbatim on success; throws a clear error otherwise. The validated URL is
+* baked into `manifest.hook_attributes.url` as-is — KiCI adds no ingress and
+* does not receive events at it; the operator owns delivery.
+*/
+function validateWebhookUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`--webhook-url must be a valid absolute URL: ${value}`);
+	}
+	if (url.protocol !== "https:") throw new Error(`--webhook-url must be an https:// URL (got ${url.protocol}//…)`);
+	return value;
+}
+function buildGithubAppManifest(input) {
+	return {
+		name: input.name,
+		url: "https://kici.dev",
+		hook_attributes: {
+			url: input.webhookUrl,
+			active: true
+		},
+		redirect_url: input.redirectUrl,
+		...input.setupUrl ? { setup_url: input.setupUrl } : {},
+		public: false,
+		default_permissions: {
+			contents: "read",
+			metadata: "read",
+			pull_requests: "read",
+			checks: "write",
+			members: "read"
+		},
+		default_events: [
+			"push",
+			"pull_request",
+			"check_run",
+			"check_suite"
+		]
+	};
+}
+/**
+* Exchange the short-lived manifest `code` for the App's id, private key, and
+* webhook secret. Runs server-to-server directly against GitHub — the private
+* key never transits the Platform.
+*/
+async function convertManifestCode(code, deps = {}) {
+	const { data } = await (deps.octokit ?? new Octokit()).request("POST /app-manifests/{code}/conversions", { code });
+	const d = data;
+	if (!d.webhook_secret) throw new Error("GitHub returned no webhook secret for the new App — cannot verify inbound events. Re-run the setup, or configure a webhook secret manually with source update.");
+	return {
+		appId: String(d.id),
+		slug: d.slug,
+		name: d.name,
+		privateKey: d.pem,
+		webhookSecret: d.webhook_secret,
+		clientId: d.client_id,
+		clientSecret: d.client_secret,
+		htmlUrl: d.html_url
+	};
+}
+function appOctokitFor(creds) {
+	return new Octokit({
+		authStrategy: createAppAuth,
+		auth: {
+			appId: creds.appId,
+			privateKey: creds.privateKey
+		}
+	});
+}
+/**
+* Poll GitHub (as the App, via a JWT) until at least one installation exists,
+* returning the first installation's id + account login. Throws on timeout.
+*/
+async function waitForInstallation(creds, opts) {
+	const now = opts.now ?? Date.now;
+	const octokit = opts.appOctokit ?? appOctokitFor(creds);
+	const deadline = now() + opts.timeoutMs;
+	for (;;) {
+		const { data } = await octokit.request("GET /app/installations", { per_page: 1 });
+		const installs = data;
+		if (Array.isArray(installs) && installs.length > 0) return {
+			installationId: installs[0].id,
+			accountLogin: installs[0].account?.login ?? ""
+		};
+		if (now() >= deadline) throw new Error("Timed out waiting for the GitHub App to be installed");
+		await new Promise((r) => setTimeout(r, opts.pollMs));
+	}
+}
+/**
+* Mint an installation token from the captured private key and confirm the App
+* can reach repos — proves the key works end-to-end (the same path the agent's
+* clone uses at runtime).
+*/
+async function verifyRepoAccess(creds, installationId, deps = {}) {
+	const { data } = await (deps.octokit ?? createInstallationOctokit(creds, installationId)).request("GET /installation/repositories", { per_page: 1 });
+	return { repoCount: data.total_count };
+}
+//#endregion
+//#region src/providers/github/manifest-form.ts
+/**
+* GitHub's create-from-manifest flow is an HTML form POST (the `manifest`
+* JSON cannot ride in a query string). These helpers render the auto-submitting
+* form and the headless code-display page. Pure string builders — no IO — so
+* both the CLI loopback server and the static marketing-site page can reuse the
+* same shapes.
+*/
+function escapeHtml(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function manifestCreateUrl(githubOrg) {
+	return githubOrg ? `https://github.com/organizations/${githubOrg}/settings/apps/new` : "https://github.com/settings/apps/new";
+}
+function renderManifestFormHtml(opts) {
+	return `<!doctype html><html><head><meta charset="utf-8"><title>Create your KiCI GitHub App</title></head>
+<body>
+<p>Redirecting you to GitHub to create your KiCI GitHub App…</p>
+<form id="f" method="post" action="${escapeHtml(`${opts.createUrl}?state=${encodeURIComponent(opts.state)}`)}">
+  <input type="hidden" name="manifest" value="${escapeHtml(opts.manifestJson)}">
+  <noscript><button type="submit">Continue to GitHub</button></noscript>
+</form>
+<script>document.getElementById('f').submit();<\/script>
+</body></html>`;
+}
+function renderCodeDisplayHtml(code) {
+	return `<!doctype html><html><head><meta charset="utf-8"><title>KiCI — copy your setup code</title></head>
+<body>
+<p>App created. Copy this code back into the <code>kici-admin</code> prompt:</p>
+<pre id="c" style="font-size:1.2rem;padding:12px;border:1px solid #ccc">${escapeHtml(code)}</pre>
+<button onclick="navigator.clipboard.writeText(document.getElementById('c').textContent)">Copy</button>
+</body></html>`;
+}
+//#endregion
+//#region src/cli/loopback-callback.ts
+function startManifestLoopback(opts) {
+	return new Promise((resolveServer) => {
+		let outcome;
+		const waiters = [];
+		const resolveCode = (value) => {
+			if (outcome) return;
+			outcome = {
+				ok: true,
+				value
+			};
+			for (const w of waiters) w.resolve(value);
+		};
+		const rejectCode = (error) => {
+			if (outcome) return;
+			outcome = {
+				ok: false,
+				error
+			};
+			for (const w of waiters) w.reject(error);
+		};
+		const server = createServer((req, res) => {
+			const url = new URL(req.url ?? "/", "http://127.0.0.1");
+			if (url.pathname === "/cb") {
+				const code = url.searchParams.get("code") ?? "";
+				const state = url.searchParams.get("state") ?? "";
+				res.writeHead(200, { "content-type": "text/html" });
+				res.end(renderCodeDisplayHtml(code));
+				if (state !== opts.state) rejectCode(/* @__PURE__ */ new Error("OAuth state mismatch — aborting"));
+				else resolveCode({
+					code,
+					state
+				});
+				return;
+			}
+			res.writeHead(200, { "content-type": "text/html" });
+			res.end(renderManifestFormHtml({
+				createUrl: opts.createUrl,
+				state: opts.state,
+				manifestJson: opts.manifestJson
+			}));
+		});
+		server.on("clientError", () => {});
+		server.listen(0, "127.0.0.1", () => {
+			const base = `http://127.0.0.1:${server.address().port}`;
+			resolveServer({
+				redirectUrl: `${base}/cb`,
+				formUrl: `${base}/`,
+				waitForCode: (timeoutMs) => new Promise((resolve, reject) => {
+					if (outcome) {
+						outcome.ok ? resolve(outcome.value) : reject(outcome.error);
+						return;
+					}
+					const timer = setTimeout(() => reject(/* @__PURE__ */ new Error("Timed out waiting for GitHub callback")), timeoutMs);
+					waiters.push({
+						resolve: (v) => {
+							clearTimeout(timer);
+							resolve(v);
+						},
+						reject: (e) => {
+							clearTimeout(timer);
+							reject(e);
+						}
+					});
+				}),
+				close: () => server.close()
+			});
+		});
+	});
+}
+//#endregion
+//#region src/cli/open-browser.ts
+/**
+* Open a URL in the operator's default browser, best-effort. Used by the GitHub
+* App manifest setup flow to launch the create / install pages. Failure is
+* non-fatal — the caller always prints the URL too, so a headless host (or a
+* blocked launcher) just falls back to copy-paste.
+*
+* `KICI_BROWSER_CMD` overrides the launcher: `none` suppresses it entirely
+* (E2E / headless capture), any other value is run with `{url}` substituted —
+* mirroring the `kici login` convention.
+*/
+function openBrowserBestEffort(url) {
+	const override = process.env.KICI_BROWSER_CMD;
+	if (override === "none") return;
+	if (override) {
+		exec(override.replace("{url}", url), () => {});
+		return;
+	}
+	exec(platform() === "darwin" ? `open ${JSON.stringify(url)}` : platform() === "win32" ? `start "" ${JSON.stringify(url)}` : `xdg-open ${JSON.stringify(url)}`, () => {});
+}
+//#endregion
+//#region src/cli/commands/source-manifest.ts
+/**
+* `kici-admin source add github --manifest` — the one-click GitHub App setup
+* flow. Drives GitHub's App Manifest flow end-to-end: builds a pre-configured
+* manifest (KiCI's exact permissions/events/webhook URL), hands it to GitHub via
+* an auto-submitting form, catches the returned short-lived setup code over a
+* localhost loopback (or copy-paste in --no-browser mode), exchanges it for the
+* App's id + private key + webhook secret, then reuses the existing source
+* storage + Platform-registration path.
+*
+* The private-key-bearing conversion happens entirely here on the orchestrator
+* host — it never transits the Platform (sovereignty invariant).
+*/
+/** Static marketing-site page the CLI points at in headless paste-code mode. */
+const STATIC_CALLBACK_URL = "https://kici.dev/gh-manifest-callback";
+/** How long to wait for the operator to click "Create" on GitHub. */
+const CREATE_TIMEOUT_MS = 5 * 6e4;
+/** How long to wait for the operator to install the App on at least one repo. */
+const INSTALL_TIMEOUT_MS = 5 * 6e4;
+const INSTALL_POLL_MS = 3e3;
+function defaultReadLine(prompt) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	return new Promise((resolve) => {
+		rl.question(prompt, (answer) => {
+			rl.close();
+			resolve(answer.trim());
+		});
+	});
+}
+function defaultWriteRecoveryFile(appId, pem) {
+	const file = join(mkdtempSync(join(tmpdir(), "kici-gh-app-")), `app-${appId}.private-key.pem`);
+	writeFileSync(file, pem, { mode: 384 });
+	return file;
+}
+const realManifestSetupDeps = {
+	startLoopback: startManifestLoopback,
+	openBrowser: openBrowserBestEffort,
+	readLine: defaultReadLine,
+	convert: (code) => convertManifestCode(code),
+	waitForInstallation,
+	verifyRepoAccess,
+	writeRecoveryFile: defaultWriteRecoveryFile
+};
+/** Resolve the org-scoped webhook URL via the pre-flight route; abort if null. */
+async function resolveWebhookUrl(client) {
+	const pre = await client.get("/api/v1/admin/sources/github-webhook-url");
+	if (!pre.webhookUrl) throw new Error(`Cannot resolve the GitHub webhook URL${pre.webhookNote ? ` (${pre.webhookNote})` : ""}. The manifest flow needs it to configure the App. Ensure the orchestrator is connected to the Platform and has identified its org, then retry.`);
+	return pre.webhookUrl;
+}
+/**
+* Catch the short-lived setup code: over the loopback (browser mode) or by
+* printing the static-site URL and reading the pasted code (headless mode).
+*/
+async function captureCode(opts, deps, manifestJson, state, redirectUrl, createUrl, loopback) {
+	if (opts.noBrowser) {
+		const url = `${STATIC_CALLBACK_URL}#m=${Buffer.from(manifestJson, "utf-8").toString("base64url")}&state=${encodeURIComponent(state)}&createUrl=${encodeURIComponent(createUrl)}`;
+		console.log("Open this URL in a browser to create your App:");
+		console.log(`  ${url}`);
+		console.log("After clicking \"Create\", copy the setup code shown on the page.");
+		const code = await deps.readLine("Paste the setup code here: ");
+		if (!code) throw new Error("No setup code was provided");
+		return code;
+	}
+	console.log("→ Opening GitHub to create your App…");
+	await deps.openBrowser(loopback.formUrl);
+	console.log(`  (if your browser did not open, visit ${loopback.formUrl} )`);
+	const { code } = await loopback.waitForCode(CREATE_TIMEOUT_MS);
+	return code;
+}
+/** Store credentials + register; on failure, save the PEM so the App is not orphaned. */
+async function storeAndRegister(opts, client, deps, creds) {
+	try {
+		return await client.post("/api/v1/admin/sources", {
+			provider: "github",
+			name: creds.name,
+			slug: creds.slug,
+			appId: creds.appId,
+			privateKey: creds.privateKey,
+			webhookSecret: creds.webhookSecret
+		});
+	} catch (err) {
+		const file = deps.writeRecoveryFile(creds.appId, creds.privateKey);
+		console.error("");
+		console.error("⚠ The GitHub App was created but storing it on the orchestrator failed.");
+		console.error(`  App id: ${creds.appId}`);
+		console.error(`  Private key saved to: ${file}`);
+		console.error("  Recover with:");
+		console.error(`    kici-admin source add github --name "${opts.name}" --app-id ${creds.appId} --private-key @${file} --webhook-secret ${creds.webhookSecret}`);
+		throw err;
+	}
+}
+async function runGithubManifestSetup(opts, client, deps = realManifestSetupDeps) {
+	const webhookUrl = opts.webhookUrl ? validateWebhookUrl(opts.webhookUrl) : await resolveWebhookUrl(client);
+	const state = randomBytes(16).toString("hex");
+	const createUrl = manifestCreateUrl(opts.githubOrg);
+	const loopback = await deps.startLoopback({
+		state,
+		manifestJson: "{}",
+		createUrl
+	});
+	try {
+		const manifest = buildGithubAppManifest({
+			name: opts.name,
+			webhookUrl,
+			redirectUrl: opts.noBrowser ? STATIC_CALLBACK_URL : loopback.redirectUrl
+		});
+		const manifestJson = JSON.stringify(manifest);
+		loopback.close();
+		const lb = await deps.startLoopback({
+			state,
+			manifestJson,
+			createUrl
+		});
+		try {
+			const code = await captureCode(opts, deps, manifestJson, state, lb.redirectUrl, createUrl, lb);
+			const creds = await deps.convert(code);
+			console.log(`→ ✓ App created (id ${creds.appId}), credentials captured`);
+			const stored = await storeAndRegister(opts, client, deps, creds);
+			console.log(`→ ✓ Stored on orchestrator (encrypted), registered as ${stored.routingKey}`);
+			const installUrl = `https://github.com/apps/${creds.slug}/installations/new`;
+			console.log(`→ Install the App on your repos: ${installUrl}`);
+			if (!opts.noBrowser) await deps.openBrowser(installUrl);
+			const { installationId, accountLogin } = await deps.waitForInstallation(creds, {
+				timeoutMs: INSTALL_TIMEOUT_MS,
+				pollMs: INSTALL_POLL_MS
+			});
+			console.log(`→ ✓ Installation detected (account ${accountLogin})`);
+			const { repoCount } = await deps.verifyRepoAccess(creds, installationId);
+			console.log(`→ ✓ Credentials verified (${repoCount} repositories reachable)`);
+			console.log("");
+			console.log(`GitHub App "${opts.name}" is live.`);
+			console.log(`  Webhook: ${webhookUrl}`);
+		} finally {
+			lb.close();
+		}
+	} finally {
+		loopback.close();
+	}
+}
+//#endregion
 //#region src/cli/commands/source.ts
 /**
 * Source management commands for kici-admin.
@@ -5268,6 +5965,16 @@ async function readFromStdin() {
 	for await (const line of rl) chunks.push(line);
 	return chunks.join("\n");
 }
+/** Print a `source refresh` result, showing old → new for name + slug. */
+function printRefreshResult(r) {
+	if (!r.changed) {
+		console.log(`${r.routingKey}: up to date (name "${r.newName}", slug "${r.newSlug}")`);
+		return;
+	}
+	console.log(`${r.routingKey}: updated`);
+	if (r.oldName !== r.newName) console.log(`  name: ${r.oldName} → ${r.newName}`);
+	if (r.oldSlug !== r.newSlug) console.log(`  slug: ${r.oldSlug ?? "(none)"} → ${r.newSlug}`);
+}
 /**
 * Format a generic source for display.
 */
@@ -5375,8 +6082,26 @@ async function buildUniversalGitConfigFromOpts(opts) {
 function registerSourceCommands(program, getClient) {
 	const src = program.command("source").description("Manage webhook sources");
 	const add = src.command("add").description("Add a new webhook source");
-	add.command("github").description("Add a new GitHub App source").requiredOption("--name <name>", "Human-readable source name").requiredOption("--app-id <id>", "GitHub App ID").option("--private-key <pathOrValue>", "Private key (prefix with @ for file path)").option("--webhook-secret <secret>", "Webhook secret").option("--from-env <varName>", "Read private key from environment variable").option("--stdin", "Read private key from stdin").option("--json", "Emit raw JSON (the API response) instead of formatted text").action(async (opts) => {
+	add.command("github").description("Add a new GitHub App source").requiredOption("--name <name>", "Human-readable source name").option("--app-id <id>", "GitHub App ID (omit when using --manifest)").option("--private-key <pathOrValue>", "Private key (prefix with @ for file path)").option("--webhook-secret <secret>", "Webhook secret").option("--from-env <varName>", "Read private key from environment variable").option("--stdin", "Read private key from stdin").option("--manifest", "One-click setup: create and configure a new GitHub App via the App Manifest flow").option("--no-browser", "Headless manifest setup: print a URL and paste the setup code back").option("--github-org <slug>", "Create the App under a GitHub org instead of your personal account").option("--webhook-url <url>", "Advanced/self-hosted: bake this https:// URL into the App webhook verbatim and skip platform-mode URL resolution. KiCI adds no ingress at this URL — your own infra owns delivery.").option("--json", "Emit raw JSON (the API response) instead of formatted text").action(async (opts) => {
+		if (opts.manifest) {
+			try {
+				await runGithubManifestSetup({
+					name: opts.name,
+					noBrowser: !opts.browser,
+					githubOrg: opts.githubOrg,
+					webhookUrl: opts.webhookUrl
+				}, getClient());
+			} catch (err) {
+				console.error(`Error: ${toErrorMessage(err)}`);
+				process.exit(1);
+			}
+			return;
+		}
 		try {
+			if (!opts.appId) {
+				console.error("Error: --app-id is required (or use --manifest for one-click setup)");
+				process.exit(1);
+			}
 			const privateKey = await resolveSecret({
 				value: opts.privateKey,
 				stdin: opts.stdin,
@@ -5605,6 +6330,34 @@ function registerSourceCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	src.command("refresh [routingKey]").description("Re-sync a GitHub source's name and slug from GitHub (use --all for every source)").option("--all", "Refresh every GitHub source").option("--json", "Emit raw JSON instead of formatted text").action(async (routingKey, opts) => {
+		try {
+			if (opts.all) {
+				const res = await getClient().post("/api/v1/admin/sources/refresh-all", {});
+				if (opts.json) {
+					console.log(JSON.stringify(res, null, 2));
+					return;
+				}
+				for (const r of res.results) printRefreshResult(r);
+				for (const e of res.errors) console.error(`  ${e.routingKey}: ${e.error}`);
+				if (res.results.length === 0 && res.errors.length === 0) console.log("No GitHub sources to refresh.");
+				return;
+			}
+			if (!routingKey) {
+				console.error("Error: provide a <routingKey> or use --all");
+				process.exit(1);
+			}
+			const result = await getClient().post(`/api/v1/admin/sources/${encodeURIComponent(routingKey)}/refresh`, {});
+			if (opts.json) {
+				console.log(JSON.stringify(result, null, 2));
+				return;
+			}
+			printRefreshResult(result);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 	src.command("update-generic <id>").description("Update a generic webhook source").option("--name <name>", "New name").option("--verification <method>", "Verification method: hmac_sha256, bearer_token, ip_allowlist, none").option("--secret <value>", "New verification secret (prefix with @ for file)").option("--from-env <varName>", "Read verification secret from environment variable").option("--stdin", "Read verification secret from stdin").option("--event-type-header <header>", "Header name for event type extraction").option("--event-type-path <jsonpath>", "JSONPath for event type extraction from body").option("--idempotency-key-header <header>", "Header name for idempotency key").option("--idempotency-key-path <jsonpath>", "JSONPath for idempotency key from body").option("--dedup-window <seconds>", "Dedup window in seconds", parseInt).option("--max-payload <bytes>", "Maximum payload size in bytes", parseInt).option("--allowed-events <events>", "Comma-separated list of allowed event types").option("--strip-headers <headers>", "Comma-separated list of headers to strip").option("--rate-limit <rpm>", "Rate limit in requests per minute", parseInt).option("--preset <name>", "Universal-git preset").option("--git-url-template <url>", "Clone URL template").option("--credential-ref <key>", "Secret key name").option("--credential-store <backend>", "Secret backend name").option("--credential-type <type>", "Credential type: pat, basic, ssh").option("--credential-user <user>", "Username for PAT/basic auth").option("--ssh-host-key-policy <policy>", "SSH host-key policy: accept-new, pinned").option("--ssh-known-hosts-pem <pathOrValue>", "Pinned SSH known_hosts (prefix with @ for file)").option("--clear-git-config", "Revert this source back to a payload-only generic webhook").option("--provider-type <type>", "Provider implementation: generic (default) or local (a git repo on the agent filesystem cloned via file://)").option("--json", "Emit raw JSON (the full source row) instead of formatted text").action(async (id, opts) => {
 		try {
 			const secret = await resolveSecret({
@@ -8597,11 +9350,17 @@ var init_image_digests = __esmMin((() => {
 * a container-based service management backend that works on any
 * platform with Docker or Podman installed.
 */
-var compose_exports = /* @__PURE__ */ __exportAll({ ComposeServiceManager: () => ComposeServiceManager });
+var compose_exports = /* @__PURE__ */ __exportAll({
+	ComposeServiceManager: () => ComposeServiceManager,
+	detectRuntime: () => detectRuntime$1
+});
 /**
 * Detect which container runtime is available.
 * Tries podman compose first, then docker compose.
 *
+* Exported so the orchestrator installer can resolve the runtime once when
+* injecting the `KICI_DEPLOY_CONTAINER_RUNTIME` env var for a compose deploy.
+*
 * @throws When neither runtime is found.
 */
 function detectRuntime$1() {
@@ -8851,7 +9610,36 @@ function resolveServiceExecutable(opts) {
 	};
 }
 //#endregion
+//#region src/cli/service/deploy-env.ts
+/** Prefix every line uses; also the strip marker for idempotent re-install. */
+const DEPLOY_ENV_PREFIX = "KICI_DEPLOY_";
+/**
+* Build the `KICI_DEPLOY_*` env lines for a given deployment shape. The mode
+* line is always emitted; container name + runtime are emitted only for the
+* `compose` platform (the only shape with a container to `exec` into).
+*/
+function buildDeployEnvLines(input) {
+	const lines = [`KICI_DEPLOY_MODE=${input.platform}`];
+	if (input.platform === "compose") {
+		lines.push(`KICI_DEPLOY_CONTAINER=${input.serviceName}`);
+		if (input.containerRuntime) lines.push(`KICI_DEPLOY_CONTAINER_RUNTIME=${input.containerRuntime}`);
+	}
+	return lines;
+}
+/**
+* Append the freshly-computed deploy lines to existing env-file content,
+* idempotently: any pre-existing `KICI_DEPLOY_*` line is stripped first so a
+* re-install / upgrade heals the shape rather than duplicating it.
+*/
+function upsertDeployEnvLines(existingContent, lines) {
+	const kept = existingContent.split("\n").filter((line) => !line.trimStart().startsWith(DEPLOY_ENV_PREFIX));
+	while (kept.length > 0 && kept[kept.length - 1].trim() === "") kept.pop();
+	const body = kept.join("\n");
+	return `${body.length > 0 ? `${body}\n` : ""}${lines.join("\n")}\n`;
+}
+//#endregion
 //#region src/cli/commands/shared/versioned-upgrade.ts
+init_compose();
 /**
 * Shared versioned directory upgrade logic for kici-admin upgrade commands.
 *
@@ -9663,6 +10451,18 @@ function registerOrchestratorInstall(orchestrator) {
 				fs.appendFileSync(envFilePath, `\nKICI_DATABASE_URL=${devDbUrl}\n`);
 				console.log(`Appended KICI_DATABASE_URL to ${envFilePath}`);
 			}
+			let composeRuntime;
+			if (platform === "compose") try {
+				composeRuntime = detectRuntime$1();
+			} catch {
+				composeRuntime = void 0;
+			}
+			const deployLines = buildDeployEnvLines({
+				platform,
+				serviceName,
+				containerRuntime: composeRuntime
+			});
+			fs.writeFileSync(envFilePath, upsertDeployEnvLines(fs.readFileSync(envFilePath, "utf-8"), deployLines), "utf-8");
 			const entryScript = opts.binary ? void 0 : fileURLToPath(import.meta.resolve(`@kici-dev/orchestrator/${selectServerEntry(fs.readFileSync(envFilePath, "utf-8"))}`));
 			const { executablePath, args } = resolveServiceExecutable({
 				binary: opts.binary ? path.resolve(opts.binary) : void 0,
@@ -10677,19 +11477,33 @@ var JoinTokenManager = class {
 	* `peer_credentials_active_uniq` partial unique index).
 	*
 	* On a 0-row claim, a follow-up SELECT disambiguates not-found / expired
-	* / already-used so callers can branch on the specific reason — the
-	* recovery path in peer-handler.ts keys on the "already used" string
-	* specifically. The follow-up only fires on the unhappy path.
+	* / already-used / reusable-by-same-instance so callers can branch on the
+	* specific reason — the recovery path in peer-handler.ts keys on the
+	* "already used" string specifically. The follow-up only fires on the
+	* unhappy path.
+	*
+	* Self-healing reuse: a join token is re-consumable by the same joining
+	* peer (`peerInstanceId`) until its `expires_at`. A peer that lost its
+	* credential (transient outage / deleted credential file) re-presents the
+	* still-valid join token already in its env; the coordinator accepts the
+	* reuse and issues a fresh credential — no operator action, no cluster
+	* redeploy. Reuse is bounded by BOTH `expires_at` AND the consuming
+	* instanceId, so it never widens a leaked token's usefulness beyond the
+	* instance that first consumed it.
 	*/
-	async validateAndConsumeToken(token, consumedBy) {
+	async validateAndConsumeToken(token, consumedBy, peerInstanceId) {
 		const parsed = parseToken(token);
 		const keys = deriveKeys(Buffer.from(parsed.secretHex, "hex"));
 		const updateResult = await this.deps.db.updateTable("join_tokens").set({
 			consumed_at: /* @__PURE__ */ new Date(),
-			consumed_by: consumedBy
+			consumed_by: consumedBy,
+			consumed_by_instance: peerInstanceId
 		}).where("token_hash", "=", keys.validationHash).where("consumed_at", "is", null).where("expires_at", ">", /* @__PURE__ */ new Date()).executeTakeFirst();
 		if (Number(updateResult?.numUpdatedRows ?? 0n) > 0) {
-			joinTokenLogger.info("Consumed join token", { consumedBy });
+			joinTokenLogger.info("Consumed join token", {
+				consumedBy,
+				peerInstanceId
+			});
 			return {
 				routing: parsed.routing,
 				keys
@@ -10697,8 +11511,21 @@ var JoinTokenManager = class {
 		}
 		const row = await this.deps.db.selectFrom("join_tokens").selectAll().where("token_hash", "=", keys.validationHash).executeTakeFirst();
 		if (!row) throw new Error("Invalid join token");
-		if (row.consumed_at) throw new Error(TOKEN_ALREADY_USED_MESSAGE);
-		throw new Error("Join token has expired. Generate a new token with: kici admin create-join-token");
+		if (new Date(row.expires_at).getTime() <= Date.now()) throw new Error("Join token has expired. Generate a new token with: kici admin create-join-token");
+		if (row.consumed_at) {
+			if (row.consumed_by_instance === peerInstanceId) {
+				joinTokenLogger.info("Re-validated join token for returning instance", {
+					consumedBy,
+					peerInstanceId
+				});
+				return {
+					routing: parsed.routing,
+					keys
+				};
+			}
+			throw new Error(TOKEN_ALREADY_USED_MESSAGE);
+		}
+		throw new Error("Invalid join token");
 	}
 };
 /**
@@ -10765,14 +11592,24 @@ var PeerCredentialStore = class {
 		this.db = db;
 	}
 	/**
-	* Save a new peer credential.
+	* Save a new peer credential, revoking any prior active credential for the
+	* same instanceId (the `peer_credentials_active_uniq` partial unique index
+	* permits exactly one active credential per instanceId).
+	*
+	* Returns `{ revokedCount }` — how many previously-active credentials this
+	* save revoked. Because a coordinator's peer-clients share one
+	* identity-scoped credential, a `revokedCount > 0` here means every sibling
+	* peer-client of `instanceId` that was authenticating with the old
+	* credential is now invalidated and will be rejected on its next proof. The
+	* caller logs this so a revoke that cascades sibling rejections is visible in
+	* the orchestrator logs.
 	*/
 	async save(opts) {
 		const expiryDays = opts.expiryDays ?? DEFAULT_EXPIRY_DAYS;
 		const expiresAt = new Date(Date.now() + expiryDays * 24 * 60 * 60 * 1e3);
 		const runOnce = async () => {
-			await this.db.transaction().execute(async (trx) => {
-				await trx.updateTable("peer_credentials").set({ revoked_at: /* @__PURE__ */ new Date() }).where("instance_id", "=", opts.instanceId).where("revoked_at", "is", null).execute();
+			return this.db.transaction().execute(async (trx) => {
+				const revokeResult = await trx.updateTable("peer_credentials").set({ revoked_at: /* @__PURE__ */ new Date() }).where("instance_id", "=", opts.instanceId).where("revoked_at", "is", null).executeTakeFirst();
 				await trx.insertInto("peer_credentials").values({
 					instance_id: opts.instanceId,
 					credential_hash: opts.credentialHash,
@@ -10781,15 +11618,13 @@ var PeerCredentialStore = class {
 					source_token_hash: opts.sourceTokenHash ?? null,
 					expires_at: expiresAt
 				}).execute();
+				return Number(revokeResult?.numUpdatedRows ?? 0n);
 			});
 		};
 		try {
-			await runOnce();
+			return { revokedCount: await runOnce() };
 		} catch (err) {
-			if (err instanceof Error && "code" in err && err.code === "23505") {
-				await runOnce();
-				return;
-			}
+			if (err instanceof Error && "code" in err && err.code === "23505") return { revokedCount: await runOnce() };
 			throw err;
 		}
 	}
@@ -11005,6 +11840,23 @@ function deriveHostStatus(row, nowMs, graceMs) {
 	return "unreachable";
 }
 /**
+* Normalize a stored `host_properties` value into a typed host-vars bag. The pg
+* driver returns parsed JSON for a `jsonb` column, but accept a JSON string too
+* (defensive for non-pg paths / tests). Non-object / null reads back as `{}`.
+*/
+function parseHostProperties(value) {
+	const parsed = typeof value === "string" ? safeJsonParse(value) : value;
+	if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	return {};
+}
+function safeJsonParse(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return null;
+	}
+}
+/**
 * Durable, cluster-shared roster of every agent the cluster has ever enrolled.
 *
 * The in-memory `AgentRegistry` reconciles into this table on register
@@ -11022,6 +11874,7 @@ var HostRosterStore = class {
 	/** Idempotent upsert on agent_id; stamps connected_instance_id + last_seen. */
 	async upsert(input) {
 		const labelsJson = JSON.stringify(input.labels);
+		const reportedJson = JSON.stringify(input.properties ?? {});
 		await this.db.insertInto("host_roster").values({
 			agent_id: input.agentId,
 			token_id: input.tokenId,
@@ -11031,6 +11884,7 @@ var HostRosterStore = class {
 			platform: input.platform,
 			arch: input.arch,
 			connected_instance_id: input.instanceId,
+			host_properties: reportedJson,
 			last_seen: sql`now()`,
 			updated_at: sql`now()`
 		}).onConflict((oc) => oc.column("agent_id").doUpdateSet({
@@ -11041,6 +11895,7 @@ var HostRosterStore = class {
 			platform: input.platform,
 			arch: input.arch,
 			connected_instance_id: input.instanceId,
+			host_properties: sql`COALESCE(host_roster.host_properties, '{}'::jsonb) || ${reportedJson}::jsonb`,
 			last_seen: sql`now()`,
 			updated_at: sql`now()`
 		})).execute();
@@ -11065,6 +11920,7 @@ var HostRosterStore = class {
 			labels: JSON.stringify(input.labels),
 			hostname: input.hostname ?? null,
 			connected_instance_id: null,
+			host_properties: JSON.stringify(input.properties ?? {}),
 			last_seen: sql`now()`,
 			updated_at: sql`now()`
 		}).onConflict((oc) => oc.column("agent_id").doNothing()).execute();
@@ -11099,13 +11955,51 @@ var HostRosterStore = class {
 				connectedInstanceId: row.connected_instance_id,
 				status: deriveHostStatus(row, now, graceMs),
 				platform: row.platform,
-				arch: row.arch
+				arch: row.arch,
+				properties: parseHostProperties(row.host_properties)
 			});
 		}
 		out.sort((a, b) => a.agentId.localeCompare(b.agentId));
 		return out;
 	}
 	/**
+	* Map a roster row to the canonical {@link HostInventoryEntry} — the queryable
+	* shape returned by the `inventory.query`/`inventory.get` RPC and typed on the
+	* SDK's `ctx.kici.inventory`. Status is derived the same way `findMatching`
+	* derives it (live + fresh ⇒ ready; declared-but-absent static ⇒ unreachable;
+	* ephemeral past ttl ⇒ stale).
+	*/
+	toInventoryEntry(row, graceMs) {
+		return {
+			agentId: row.agent_id,
+			labels: JSON.parse(row.labels),
+			properties: parseHostProperties(row.host_properties),
+			hostname: row.hostname,
+			platform: row.platform,
+			arch: row.arch,
+			lifecycleClass: row.lifecycle_class,
+			status: deriveHostStatus(row, Date.now(), graceMs),
+			lastSeen: new Date(row.last_seen).toISOString()
+		};
+	}
+	/**
+	* Query the roster as canonical {@link HostInventoryEntry} records. With a
+	* selector, reuses `findMatching`'s label filtering (server-side, glob/regex);
+	* property filtering is done client-side in the workflow. Omit the selector ⇒
+	* every host.
+	*/
+	async queryInventory(selector, graceMs) {
+		if (!selector || !selector.include && !selector.exclude) return (await this.listAll()).map((r) => this.toInventoryEntry(r, graceMs));
+		const matched = await this.findMatching(selector.include ?? [], selector.exclude ?? [], graceMs);
+		const byId = new Map(matched.map((m) => [m.agentId, m]));
+		return (await this.listAll()).filter((r) => byId.has(r.agent_id)).map((r) => this.toInventoryEntry(r, graceMs));
+	}
+	/** Single-host inventory lookup; null when the agent is not in the roster. */
+	async getInventory(agentId, graceMs) {
+		const row = await this.get(agentId);
+		return row ? this.toInventoryEntry(row, graceMs) : null;
+	}
+	/**
 	* Count `static` (declared) hosts whose derived status is `unreachable` —
 	* the "declared-but-absent" alarm population. Reuses the single-source
 	* {@link deriveHostStatus} so the count never diverges from what
@@ -11118,14 +12012,54 @@ var HostRosterStore = class {
 		const now = Date.now();
 		return rows.filter((r) => deriveHostStatus(r, now, graceMs) === "unreachable").length;
 	}
+	/** Remove a host from the roster by agent id. Returns rows deleted. */
+	async removeStatic(agentId) {
+		const res = await this.db.deleteFrom("host_roster").where("agent_id", "=", agentId).executeTakeFirst();
+		return Number(res.numDeletedRows ?? 0n);
+	}
 	/** Delete ephemeral rows whose last_seen is older than ttl. Returns count. */
 	async reapEphemeralPastTtl(ttlMs) {
 		const res = await this.db.deleteFrom("host_roster").where("lifecycle_class", "=", "ephemeral").where("last_seen", "<", sql`now() - (${ttlMs}::text || ' milliseconds')::interval`).executeTakeFirst();
 		return Number(res.numDeletedRows ?? 0n);
 	}
+	/**
+	* Mark a host as about-to-reboot until `until`. Set by the `host.requestReboot`
+	* API handler when an agent's `restartHost()` step runs. While the value is in
+	* the future, the host's disconnect is the expected reboot and its pinned
+	* post-restart job is held.
+	*/
+	async setRebootPending(agentId, until) {
+		await this.db.updateTable("host_roster").set({
+			reboot_pending_until: until,
+			updated_at: sql`now()`
+		}).where("agent_id", "=", agentId).execute();
+	}
+	/** Clear the reboot-pending flag (on reconnect, deadline expiry, or cancel). */
+	async clearRebootPending(agentId) {
+		await this.db.updateTable("host_roster").set({
+			reboot_pending_until: null,
+			updated_at: sql`now()`
+		}).where("agent_id", "=", agentId).execute();
+	}
+	/** True when the host has a reboot-pending deadline still in the future at `nowMs`. */
+	async isRebootPending(agentId, nowMs) {
+		const row = await this.db.selectFrom("host_roster").select("reboot_pending_until").where("agent_id", "=", agentId).executeTakeFirst();
+		return (row?.reboot_pending_until ? new Date(row.reboot_pending_until).getTime() : 0) > nowMs;
+	}
+	/**
+	* Agent ids whose reboot-pending deadline has passed at `nowMs`. The deadline
+	* sweep clears these; the held post-restart job then hits the queue timeout.
+	*/
+	async listExpiredRebootPending(nowMs) {
+		return (await this.db.selectFrom("host_roster").select("agent_id").where("reboot_pending_until", "is not", null).where("reboot_pending_until", "<=", new Date(nowMs)).execute()).map((r) => r.agent_id);
+	}
 };
 //#endregion
 //#region src/cli/commands/host.ts
+/** Collect a repeatable `--prop key=value` flag into an array. */
+function collectProp(value, previous) {
+	return [...previous, value];
+}
 /**
 * The CLI reads the roster DB directly (no full orchestrator config load), so
 * it sources the grace window from the same env var the orchestrator config
@@ -11179,13 +12113,15 @@ function registerHostCommands(program) {
 			process.exit(1);
 		}
 	});
-	host.command("declare").description("Pre-declare a static host before it connects").requiredOption("--agent-id <id>", "Agent id the host will register as").option("--labels <labels>", "Comma-separated labels", "").option("--hostname <name>", "Hostname").action(async (opts) => {
+	host.command("declare").description("Pre-declare a static host before it connects").requiredOption("--agent-id <id>", "Agent id the host will register as").option("--labels <labels>", "Comma-separated labels", "").option("--hostname <name>", "Hostname").option("--prop <key=value>", "Typed host property (repeatable; true/false ⇒ boolean, numeric ⇒ number)", collectProp, []).action(async (opts) => {
 		try {
 			const labels = opts.labels ? String(opts.labels).split(",").map((s) => s.trim()).filter(Boolean) : [];
+			const properties = parseHostPropertyAssignments(opts.prop);
 			await withDb((db) => new HostRosterStore(db).declareStatic({
 				agentId: opts.agentId,
 				labels,
-				hostname: opts.hostname
+				hostname: opts.hostname,
+				properties
 			}));
 			console.log(`Declared static host: ${opts.agentId}`);
 		} catch (err) {
@@ -11193,6 +12129,18 @@ function registerHostCommands(program) {
 			process.exit(1);
 		}
 	});
+	host.command("remove").description("Remove a host from the roster").requiredOption("--agent-id <id>", "Agent id to remove").action(async (opts) => {
+		try {
+			if (await withDb((db) => new HostRosterStore(db).removeStatic(opts.agentId)) === 0) {
+				console.error(`No host found: ${opts.agentId}`);
+				process.exit(1);
+			}
+			console.log(`Removed host: ${opts.agentId}`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 }
 //#endregion
 //#region src/cli/commands/org-settings.ts