@kici-dev/orchestrator 0.1.21 → 0.1.22

package/dist/cli.js

@@ -1556,8 +1556,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -2249,7 +2249,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$45(db) {
+async function up$49(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2271,7 +2271,7 @@ async function up$45(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$45(db) {
+async function down$49(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2318,8 +2318,8 @@ async function down$45(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -2333,13 +2333,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$44(db) {
+async function up$48(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$44(db) {
+async function down$48(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2348,8 +2348,8 @@ async function down$44(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2373,7 +2373,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$43(db) {
+async function up$47(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2411,28 +2411,28 @@ async function up$43(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$43(db) {
+async function down$47(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$46,
+	up: () => up$46
 });
-async function up$42(db) {
+async function up$46(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$42(db) {
+async function down$46(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Cold-store chunk counter table.
@@ -2449,7 +2449,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$41(db) {
+async function up$45(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2467,14 +2467,14 @@ async function up$41(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$41(db) {
+async function down$45(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -2510,7 +2510,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$40(db) {
+async function up$44(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2555,7 +2555,7 @@ async function up$40(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$40(db) {
+async function down$44(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2580,8 +2580,8 @@ async function down$40(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -2621,7 +2621,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$39(db) {
+async function up$43(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2642,7 +2642,7 @@ async function up$39(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$39(db) {
+async function down$43(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2670,8 +2670,8 @@ async function down$39(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -2709,7 +2709,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$38(db) {
+async function up$42(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2725,7 +2725,7 @@ async function up$38(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$38(db) {
+async function down$42(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2744,8 +2744,8 @@ async function down$38(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -2758,7 +2758,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$37(db) {
+async function up$41(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2767,14 +2767,14 @@ async function up$37(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$37(db) {
+async function down$41(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -2806,7 +2806,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$36(db) {
+async function up$40(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -2833,14 +2833,14 @@ async function up$36(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$36(db) {
+async function down$40(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -2859,11 +2859,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$35(db) {
+async function up$39(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$35(db) {
+async function down$39(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -2902,8 +2902,8 @@ async function down$35(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -2929,7 +2929,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$34(db) {
+async function up$38(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -2947,14 +2947,14 @@ async function up$34(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$34(db) {
+async function down$38(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -2973,7 +2973,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$33(db) {
+async function up$37(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -2983,15 +2983,15 @@ async function up$33(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$33(db) {
+async function down$37(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -3025,7 +3025,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$32(db) {
+async function up$36(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3056,7 +3056,7 @@ async function up$32(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$32(db) {
+async function down$36(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -3074,8 +3074,8 @@ async function down$32(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -3103,7 +3103,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$31(db) {
+async function up$35(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3228,7 +3228,7 @@ async function up$31(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$31(db) {
+async function down$35(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3253,8 +3253,8 @@ async function down$31(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3267,7 +3267,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$30(db) {
+async function up$34(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3281,7 +3281,7 @@ async function up$30(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$30(db) {
+async function down$34(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3289,8 +3289,8 @@ async function down$30(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -3330,17 +3330,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$29(db) {
+async function up$33(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$29(db) {
+async function down$33(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3385,19 +3385,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$28(db) {
+async function up$32(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$28(db) {
+async function down$32(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -3420,7 +3420,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$27(db) {
+async function up$31(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3441,15 +3441,15 @@ async function up$27(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$27(db) {
+async function down$31(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -3464,7 +3464,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$26(db) {
+async function up$30(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3478,7 +3478,7 @@ async function up$26(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$26(db) {
+async function down$30(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -3486,8 +3486,8 @@ async function down$26(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -3511,7 +3511,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$25(db) {
+async function up$29(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -3542,14 +3542,14 @@ async function up$25(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$25(db) {
+async function down$29(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -3576,7 +3576,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$24(db) {
+async function up$28(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3626,7 +3626,7 @@ async function up$24(db) {
     `.execute(db);
 	}
 }
-async function down$24(db) {
+async function down$28(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -3634,8 +3634,8 @@ async function down$24(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -3659,7 +3659,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$23(db) {
+async function up$27(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3684,7 +3684,7 @@ async function up$23(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$23(db) {
+async function down$27(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -3696,8 +3696,8 @@ async function down$23(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -3713,7 +3713,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$22(db) {
+async function up$26(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3729,7 +3729,7 @@ async function up$22(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$22(db) {
+async function down$26(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -3737,8 +3737,8 @@ async function down$22(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -3752,7 +3752,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$21(db) {
+async function up$25(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3772,7 +3772,7 @@ async function up$21(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$21(db) {
+async function down$25(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -3783,8 +3783,8 @@ async function down$21(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -3793,7 +3793,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$20(db) {
+async function up$24(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3803,7 +3803,7 @@ async function up$20(db) {
     ])))
   `.execute(db);
 }
-async function down$20(db) {
+async function down$24(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3816,8 +3816,8 @@ async function down$20(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -3835,13 +3835,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$19(db) {
+async function up$23(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$19(db) {
+async function down$23(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -3849,8 +3849,8 @@ async function down$19(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -3879,7 +3879,7 @@ async function columnExists(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$18(db) {
+async function up$22(db) {
 	if (!await columnExists(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
@@ -3889,7 +3889,7 @@ async function up$18(db) {
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$18(db) {
+async function down$22(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -3900,8 +3900,8 @@ async function down$18(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -3915,7 +3915,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$17(db) {
+async function up$21(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3928,7 +3928,7 @@ async function up$17(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$17(db) {
+async function down$21(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -3936,8 +3936,8 @@ async function down$17(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -3948,14 +3948,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$16(db) {
+async function up$20(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$16(db) {
+async function down$20(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -3965,8 +3965,8 @@ async function down$16(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -3983,7 +3983,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$15(db) {
+async function up$19(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4008,7 +4008,7 @@ async function up$15(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$15(db) {
+async function down$19(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -4016,8 +4016,8 @@ async function down$15(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -4029,7 +4029,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$14(db) {
+async function up$18(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4043,7 +4043,7 @@ async function up$14(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$14(db) {
+async function down$18(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -4051,8 +4051,8 @@ async function down$14(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -4069,7 +4069,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$13(db) {
+async function up$17(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4089,7 +4089,7 @@ async function up$13(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$13(db) {
+async function down$17(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -4100,8 +4100,8 @@ async function down$13(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -4123,7 +4123,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$12(db) {
+async function up$16(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4156,7 +4156,7 @@ async function up$12(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$12(db) {
+async function down$16(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -4166,8 +4166,8 @@ async function down$12(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -4176,7 +4176,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$11(db) {
+async function up$15(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -4186,14 +4186,14 @@ async function up$11(db) {
     )
   `.execute(db);
 }
-async function down$11(db) {
+async function down$15(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -4206,7 +4206,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$10(db) {
+async function up$14(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4232,14 +4232,14 @@ async function up$10(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$10(db) {
+async function down$14(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -4256,7 +4256,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$9(db) {
+async function up$13(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4272,7 +4272,7 @@ async function up$9(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$9(db) {
+async function down$13(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4291,8 +4291,8 @@ async function down$9(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -4304,7 +4304,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$8(db) {
+async function up$12(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4323,14 +4323,14 @@ async function up$8(db) {
     )
   `.execute(db);
 }
-async function down$8(db) {
+async function down$12(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -4347,7 +4347,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$7(db) {
+async function up$11(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4377,14 +4377,14 @@ async function up$7(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$7(db) {
+async function down$11(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -4401,7 +4401,7 @@ var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has any column is a no-op.
 */
-async function colExists$4(db, table, name) {
+async function colExists$5(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4411,18 +4411,18 @@ async function colExists$4(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$6(db) {
-	if (!await colExists$4(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
-	if (!await colExists$4(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
-	if (!await colExists$4(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
-	if (!await colExists$4(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
+async function up$10(db) {
+	if (!await colExists$5(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
+	if (!await colExists$5(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
+	if (!await colExists$5(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
+	if (!await colExists$5(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_pinned_agent
       ON public.dispatch_queue (pinned_agent_id)
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$6(db) {
+async function down$10(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -4432,8 +4432,8 @@ async function down$6(db) {
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -4453,7 +4453,7 @@ var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the columns is a no-op.
 */
-async function colExists$3(db, table, name) {
+async function colExists$4(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4463,16 +4463,16 @@ async function colExists$3(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$5(db) {
-	if (!await colExists$3(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
-	if (!await colExists$3(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
-	if (!await colExists$3(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
+async function up$9(db) {
+	if (!await colExists$4(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
+	if (!await colExists$4(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
+	if (!await colExists$4(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_execution_jobs_wave
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$5(db) {
+async function down$9(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -4481,8 +4481,8 @@ async function down$5(db) {
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
@@ -4498,7 +4498,7 @@ var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the columns is a no-op.
 */
-async function colExists$2(db, table, name) {
+async function colExists$3(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4508,19 +4508,19 @@ async function colExists$2(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$4(db) {
-	if (!await colExists$2(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
-	if (!await colExists$2(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+async function up$8(db) {
+	if (!await colExists$3(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+	if (!await colExists$3(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$4(db) {
+async function down$8(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -4531,7 +4531,7 @@ var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function colExists$1(db, table, name) {
+async function colExists$2(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4541,17 +4541,17 @@ async function colExists$1(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$3(db) {
-	if (!await colExists$1(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
+async function up$7(db) {
+	if (!await colExists$2(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$3(db) {
+async function down$7(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Add idempotent check-mode columns:
@@ -4568,7 +4568,7 @@ var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
 * All nullable. Idempotent: re-running on a DB that already has the columns is
 * a no-op.
 */
-async function colExists(db, table, name) {
+async function colExists$1(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4578,13 +4578,13 @@ async function colExists(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$2(db) {
-	if (!await colExists(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
-	if (!await colExists(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
-	if (!await colExists(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
-	if (!await colExists(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
+async function up$6(db) {
+	if (!await colExists$1(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
+	if (!await colExists$1(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
+	if (!await colExists$1(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
+	if (!await colExists$1(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$2(db) {
+async function down$6(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -4593,8 +4593,8 @@ async function down$2(db) {
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Add the typed host-vars dimension to the host roster:
@@ -4608,18 +4608,18 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive column).
 */
-async function up$1(db) {
+async function up$5(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$1(db) {
+async function down$5(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Record the joining peer's instanceId at first consumption of a join token:
@@ -4634,14 +4634,163 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive nullable column).
 */
-async function up(db) {
+async function up$4(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down(db) {
+async function down$4(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 //#endregion
+//#region src/db/migrations/047_needs_run_on.ts
+var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* Migrate `execution_job_needs` from the binary `if_failed` policy to a
+* programmable `run_on` status-set:
+*
+* - Add `run_on text` (JSON-encoded array of upstream terminal statuses) with a
+*   default of `'["success"]'`.
+* - Backfill from the existing `if_failed`: `skip` → `["success"]`,
+*   `run` → every terminal job status.
+* - Drop `if_failed`.
+*
+* Idempotent: column-exists guarded so re-running on a DB that already has
+* `run_on` (and no `if_failed`) is a no-op. Existing rows are preserved
+* (staging data is not dropped).
+*/
+const ALL_TERMINAL_JSON = JSON.stringify([
+	"success",
+	"failed",
+	"cancelled",
+	"skipped",
+	"timed_out_stale",
+	"drift_dropped"
+]);
+const SUCCESS_ONLY_JSON = JSON.stringify(["success"]);
+async function colExists(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
+async function up$3(db) {
+	if (!await colExists(db, "execution_job_needs", "run_on")) await sql`
+      ALTER TABLE public.execution_job_needs
+        ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
+    `.execute(db);
+	if (await colExists(db, "execution_job_needs", "if_failed")) {
+		await sql`
+      UPDATE public.execution_job_needs
+         SET run_on = ${ALL_TERMINAL_JSON}
+       WHERE if_failed = 'run'
+    `.execute(db);
+		await sql`
+      UPDATE public.execution_job_needs
+         SET run_on = ${SUCCESS_ONLY_JSON}
+       WHERE if_failed = 'skip'
+    `.execute(db);
+		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
+	}
+}
+async function down$3(db) {
+	if (!await colExists(db, "execution_job_needs", "if_failed")) await sql`
+      ALTER TABLE public.execution_job_needs
+        ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
+    `.execute(db);
+	if (await colExists(db, "execution_job_needs", "run_on")) {
+		await sql`
+      UPDATE public.execution_job_needs
+         SET if_failed = CASE WHEN run_on = ${SUCCESS_ONLY_JSON} THEN 'skip' ELSE 'run' END
+    `.execute(db);
+		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN run_on`.execute(db);
+	}
+}
+//#endregion
+//#region src/db/migrations/048_host_reboot_pending.ts
+var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
+* reboot-pending flag for workflow-level host restart.
+*
+* Set when an agent's `restartHost()` step calls `host.requestReboot` (so it
+* survives an orchestrator restart during the host's reboot window). While the
+* value is in the future it (1) makes the agent's imminent disconnect an
+* expected reboot rather than a recovery-fail, (2) gates the pinned-drain off
+* so the post-restart job is not dispatched into the about-to-reboot box, and
+* (3) clears on the next reconnect (down-then-up), releasing the held job. NULL
+* = no reboot pending.
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
+*/
+async function up$2(db) {
+	await sql`ALTER TABLE public.host_roster
+    ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
+}
+async function down$2(db) {
+	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/049_held_runs_payload.ts
+var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Add `held_runs.payload jsonb NULL` — the drift payload captured when a
+* `when: 'drift'` step-approval gate fires. Holds `{ summaryMarkdown, drift }`:
+* the author's `summarize(drift)` rendering plus the structured drift blob, so
+* the dashboard approval queue and the CLI render the computed diff the
+* operator approves. NULL for every non-drift hold.
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
+*/
+async function up$1(db) {
+	await sql`ALTER TABLE public.held_runs
+    ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
+}
+async function down$1(db) {
+	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/050_sources_slug.ts
+var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
+* GitHub assigns, e.g. `my-kici-app`).
+*
+* For GitHub-App sources GitHub is the source of truth for both the display
+* `name` and the `slug`: both are captured at creation and kept fresh by the
+* daily refresher + `kici-admin source refresh`. NULL when the identity fetch
+* hasn't populated it yet (manual `--app-id` flow whose initial fetch failed,
+* or a row created before the rollout).
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
+*/
+async function up(db) {
+	await sql`ALTER TABLE public.sources
+    ADD COLUMN IF NOT EXISTS slug text`.execute(db);
+}
+async function down(db) {
+	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
+}
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -4691,7 +4840,11 @@ function createMigrationProvider() {
 			"043_rerouted_to_peer": _043_rerouted_to_peer_exports,
 			"044_check_mode": _044_check_mode_exports,
 			"045_host_properties": _045_host_properties_exports,
-			"046_join_token_consumed_by_instance": _046_join_token_consumed_by_instance_exports
+			"046_join_token_consumed_by_instance": _046_join_token_consumed_by_instance_exports,
+			"047_needs_run_on": _047_needs_run_on_exports,
+			"048_host_reboot_pending": _048_host_reboot_pending_exports,
+			"049_held_runs_payload": _049_held_runs_payload_exports,
+			"050_sources_slug": _050_sources_slug_exports
 		};
 	} };
 }
@@ -5361,6 +5514,23 @@ function createInstallationOctokit(config, installationId) {
 * registration and returns it on the conversion response, so both GitHub and
 * the Platform end up sharing the same secret with zero operator effort.
 */
+/**
+* Validate a self-hosted webhook URL supplied via `source add github
+* --webhook-url`. Must be a well-formed absolute `https://` URL. Returns the URL
+* verbatim on success; throws a clear error otherwise. The validated URL is
+* baked into `manifest.hook_attributes.url` as-is — KiCI adds no ingress and
+* does not receive events at it; the operator owns delivery.
+*/
+function validateWebhookUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`--webhook-url must be a valid absolute URL: ${value}`);
+	}
+	if (url.protocol !== "https:") throw new Error(`--webhook-url must be an https:// URL (got ${url.protocol}//…)`);
+	return value;
+}
 function buildGithubAppManifest(input) {
 	return {
 		name: input.name,
@@ -5399,6 +5569,7 @@ async function convertManifestCode(code, deps = {}) {
 	return {
 		appId: String(d.id),
 		slug: d.slug,
+		name: d.name,
 		privateKey: d.pem,
 		webhookSecret: d.webhook_secret,
 		clientId: d.client_id,
@@ -5647,7 +5818,8 @@ async function storeAndRegister(opts, client, deps, creds) {
 	try {
 		return await client.post("/api/v1/admin/sources", {
 			provider: "github",
-			name: opts.name,
+			name: creds.name,
+			slug: creds.slug,
 			appId: creds.appId,
 			privateKey: creds.privateKey,
 			webhookSecret: creds.webhookSecret
@@ -5664,7 +5836,7 @@ async function storeAndRegister(opts, client, deps, creds) {
 	}
 }
 async function runGithubManifestSetup(opts, client, deps = realManifestSetupDeps) {
-	const webhookUrl = await resolveWebhookUrl(client);
+	const webhookUrl = opts.webhookUrl ? validateWebhookUrl(opts.webhookUrl) : await resolveWebhookUrl(client);
 	const state = randomBytes(16).toString("hex");
 	const createUrl = manifestCreateUrl(opts.githubOrg);
 	const loopback = await deps.startLoopback({
@@ -5793,6 +5965,16 @@ async function readFromStdin() {
 	for await (const line of rl) chunks.push(line);
 	return chunks.join("\n");
 }
+/** Print a `source refresh` result, showing old → new for name + slug. */
+function printRefreshResult(r) {
+	if (!r.changed) {
+		console.log(`${r.routingKey}: up to date (name "${r.newName}", slug "${r.newSlug}")`);
+		return;
+	}
+	console.log(`${r.routingKey}: updated`);
+	if (r.oldName !== r.newName) console.log(`  name: ${r.oldName} → ${r.newName}`);
+	if (r.oldSlug !== r.newSlug) console.log(`  slug: ${r.oldSlug ?? "(none)"} → ${r.newSlug}`);
+}
 /**
 * Format a generic source for display.
 */
@@ -5900,13 +6082,14 @@ async function buildUniversalGitConfigFromOpts(opts) {
 function registerSourceCommands(program, getClient) {
 	const src = program.command("source").description("Manage webhook sources");
 	const add = src.command("add").description("Add a new webhook source");
-	add.command("github").description("Add a new GitHub App source").requiredOption("--name <name>", "Human-readable source name").option("--app-id <id>", "GitHub App ID (omit when using --manifest)").option("--private-key <pathOrValue>", "Private key (prefix with @ for file path)").option("--webhook-secret <secret>", "Webhook secret").option("--from-env <varName>", "Read private key from environment variable").option("--stdin", "Read private key from stdin").option("--manifest", "One-click setup: create and configure a new GitHub App via the App Manifest flow").option("--no-browser", "Headless manifest setup: print a URL and paste the setup code back").option("--github-org <slug>", "Create the App under a GitHub org instead of your personal account").option("--json", "Emit raw JSON (the API response) instead of formatted text").action(async (opts) => {
+	add.command("github").description("Add a new GitHub App source").requiredOption("--name <name>", "Human-readable source name").option("--app-id <id>", "GitHub App ID (omit when using --manifest)").option("--private-key <pathOrValue>", "Private key (prefix with @ for file path)").option("--webhook-secret <secret>", "Webhook secret").option("--from-env <varName>", "Read private key from environment variable").option("--stdin", "Read private key from stdin").option("--manifest", "One-click setup: create and configure a new GitHub App via the App Manifest flow").option("--no-browser", "Headless manifest setup: print a URL and paste the setup code back").option("--github-org <slug>", "Create the App under a GitHub org instead of your personal account").option("--webhook-url <url>", "Advanced/self-hosted: bake this https:// URL into the App webhook verbatim and skip platform-mode URL resolution. KiCI adds no ingress at this URL — your own infra owns delivery.").option("--json", "Emit raw JSON (the API response) instead of formatted text").action(async (opts) => {
 		if (opts.manifest) {
 			try {
 				await runGithubManifestSetup({
 					name: opts.name,
 					noBrowser: !opts.browser,
-					githubOrg: opts.githubOrg
+					githubOrg: opts.githubOrg,
+					webhookUrl: opts.webhookUrl
 				}, getClient());
 			} catch (err) {
 				console.error(`Error: ${toErrorMessage(err)}`);
@@ -6147,6 +6330,34 @@ function registerSourceCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	src.command("refresh [routingKey]").description("Re-sync a GitHub source's name and slug from GitHub (use --all for every source)").option("--all", "Refresh every GitHub source").option("--json", "Emit raw JSON instead of formatted text").action(async (routingKey, opts) => {
+		try {
+			if (opts.all) {
+				const res = await getClient().post("/api/v1/admin/sources/refresh-all", {});
+				if (opts.json) {
+					console.log(JSON.stringify(res, null, 2));
+					return;
+				}
+				for (const r of res.results) printRefreshResult(r);
+				for (const e of res.errors) console.error(`  ${e.routingKey}: ${e.error}`);
+				if (res.results.length === 0 && res.errors.length === 0) console.log("No GitHub sources to refresh.");
+				return;
+			}
+			if (!routingKey) {
+				console.error("Error: provide a <routingKey> or use --all");
+				process.exit(1);
+			}
+			const result = await getClient().post(`/api/v1/admin/sources/${encodeURIComponent(routingKey)}/refresh`, {});
+			if (opts.json) {
+				console.log(JSON.stringify(result, null, 2));
+				return;
+			}
+			printRefreshResult(result);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 	src.command("update-generic <id>").description("Update a generic webhook source").option("--name <name>", "New name").option("--verification <method>", "Verification method: hmac_sha256, bearer_token, ip_allowlist, none").option("--secret <value>", "New verification secret (prefix with @ for file)").option("--from-env <varName>", "Read verification secret from environment variable").option("--stdin", "Read verification secret from stdin").option("--event-type-header <header>", "Header name for event type extraction").option("--event-type-path <jsonpath>", "JSONPath for event type extraction from body").option("--idempotency-key-header <header>", "Header name for idempotency key").option("--idempotency-key-path <jsonpath>", "JSONPath for idempotency key from body").option("--dedup-window <seconds>", "Dedup window in seconds", parseInt).option("--max-payload <bytes>", "Maximum payload size in bytes", parseInt).option("--allowed-events <events>", "Comma-separated list of allowed event types").option("--strip-headers <headers>", "Comma-separated list of headers to strip").option("--rate-limit <rpm>", "Rate limit in requests per minute", parseInt).option("--preset <name>", "Universal-git preset").option("--git-url-template <url>", "Clone URL template").option("--credential-ref <key>", "Secret key name").option("--credential-store <backend>", "Secret backend name").option("--credential-type <type>", "Credential type: pat, basic, ssh").option("--credential-user <user>", "Username for PAT/basic auth").option("--ssh-host-key-policy <policy>", "SSH host-key policy: accept-new, pinned").option("--ssh-known-hosts-pem <pathOrValue>", "Pinned SSH known_hosts (prefix with @ for file)").option("--clear-git-config", "Revert this source back to a payload-only generic webhook").option("--provider-type <type>", "Provider implementation: generic (default) or local (a git repo on the agent filesystem cloned via file://)").option("--json", "Emit raw JSON (the full source row) instead of formatted text").action(async (id, opts) => {
 		try {
 			const secret = await resolveSecret({
@@ -9139,11 +9350,17 @@ var init_image_digests = __esmMin((() => {
 * a container-based service management backend that works on any
 * platform with Docker or Podman installed.
 */
-var compose_exports = /* @__PURE__ */ __exportAll({ ComposeServiceManager: () => ComposeServiceManager });
+var compose_exports = /* @__PURE__ */ __exportAll({
+	ComposeServiceManager: () => ComposeServiceManager,
+	detectRuntime: () => detectRuntime$1
+});
 /**
 * Detect which container runtime is available.
 * Tries podman compose first, then docker compose.
 *
+* Exported so the orchestrator installer can resolve the runtime once when
+* injecting the `KICI_DEPLOY_CONTAINER_RUNTIME` env var for a compose deploy.
+*
 * @throws When neither runtime is found.
 */
 function detectRuntime$1() {
@@ -9393,7 +9610,36 @@ function resolveServiceExecutable(opts) {
 	};
 }
 //#endregion
+//#region src/cli/service/deploy-env.ts
+/** Prefix every line uses; also the strip marker for idempotent re-install. */
+const DEPLOY_ENV_PREFIX = "KICI_DEPLOY_";
+/**
+* Build the `KICI_DEPLOY_*` env lines for a given deployment shape. The mode
+* line is always emitted; container name + runtime are emitted only for the
+* `compose` platform (the only shape with a container to `exec` into).
+*/
+function buildDeployEnvLines(input) {
+	const lines = [`KICI_DEPLOY_MODE=${input.platform}`];
+	if (input.platform === "compose") {
+		lines.push(`KICI_DEPLOY_CONTAINER=${input.serviceName}`);
+		if (input.containerRuntime) lines.push(`KICI_DEPLOY_CONTAINER_RUNTIME=${input.containerRuntime}`);
+	}
+	return lines;
+}
+/**
+* Append the freshly-computed deploy lines to existing env-file content,
+* idempotently: any pre-existing `KICI_DEPLOY_*` line is stripped first so a
+* re-install / upgrade heals the shape rather than duplicating it.
+*/
+function upsertDeployEnvLines(existingContent, lines) {
+	const kept = existingContent.split("\n").filter((line) => !line.trimStart().startsWith(DEPLOY_ENV_PREFIX));
+	while (kept.length > 0 && kept[kept.length - 1].trim() === "") kept.pop();
+	const body = kept.join("\n");
+	return `${body.length > 0 ? `${body}\n` : ""}${lines.join("\n")}\n`;
+}
+//#endregion
 //#region src/cli/commands/shared/versioned-upgrade.ts
+init_compose();
 /**
 * Shared versioned directory upgrade logic for kici-admin upgrade commands.
 *
@@ -10205,6 +10451,18 @@ function registerOrchestratorInstall(orchestrator) {
 				fs.appendFileSync(envFilePath, `\nKICI_DATABASE_URL=${devDbUrl}\n`);
 				console.log(`Appended KICI_DATABASE_URL to ${envFilePath}`);
 			}
+			let composeRuntime;
+			if (platform === "compose") try {
+				composeRuntime = detectRuntime$1();
+			} catch {
+				composeRuntime = void 0;
+			}
+			const deployLines = buildDeployEnvLines({
+				platform,
+				serviceName,
+				containerRuntime: composeRuntime
+			});
+			fs.writeFileSync(envFilePath, upsertDeployEnvLines(fs.readFileSync(envFilePath, "utf-8"), deployLines), "utf-8");
 			const entryScript = opts.binary ? void 0 : fileURLToPath(import.meta.resolve(`@kici-dev/orchestrator/${selectServerEntry(fs.readFileSync(envFilePath, "utf-8"))}`));
 			const { executablePath, args } = resolveServiceExecutable({
 				binary: opts.binary ? path.resolve(opts.binary) : void 0,
@@ -11754,11 +12012,47 @@ var HostRosterStore = class {
 		const now = Date.now();
 		return rows.filter((r) => deriveHostStatus(r, now, graceMs) === "unreachable").length;
 	}
+	/** Remove a host from the roster by agent id. Returns rows deleted. */
+	async removeStatic(agentId) {
+		const res = await this.db.deleteFrom("host_roster").where("agent_id", "=", agentId).executeTakeFirst();
+		return Number(res.numDeletedRows ?? 0n);
+	}
 	/** Delete ephemeral rows whose last_seen is older than ttl. Returns count. */
 	async reapEphemeralPastTtl(ttlMs) {
 		const res = await this.db.deleteFrom("host_roster").where("lifecycle_class", "=", "ephemeral").where("last_seen", "<", sql`now() - (${ttlMs}::text || ' milliseconds')::interval`).executeTakeFirst();
 		return Number(res.numDeletedRows ?? 0n);
 	}
+	/**
+	* Mark a host as about-to-reboot until `until`. Set by the `host.requestReboot`
+	* API handler when an agent's `restartHost()` step runs. While the value is in
+	* the future, the host's disconnect is the expected reboot and its pinned
+	* post-restart job is held.
+	*/
+	async setRebootPending(agentId, until) {
+		await this.db.updateTable("host_roster").set({
+			reboot_pending_until: until,
+			updated_at: sql`now()`
+		}).where("agent_id", "=", agentId).execute();
+	}
+	/** Clear the reboot-pending flag (on reconnect, deadline expiry, or cancel). */
+	async clearRebootPending(agentId) {
+		await this.db.updateTable("host_roster").set({
+			reboot_pending_until: null,
+			updated_at: sql`now()`
+		}).where("agent_id", "=", agentId).execute();
+	}
+	/** True when the host has a reboot-pending deadline still in the future at `nowMs`. */
+	async isRebootPending(agentId, nowMs) {
+		const row = await this.db.selectFrom("host_roster").select("reboot_pending_until").where("agent_id", "=", agentId).executeTakeFirst();
+		return (row?.reboot_pending_until ? new Date(row.reboot_pending_until).getTime() : 0) > nowMs;
+	}
+	/**
+	* Agent ids whose reboot-pending deadline has passed at `nowMs`. The deadline
+	* sweep clears these; the held post-restart job then hits the queue timeout.
+	*/
+	async listExpiredRebootPending(nowMs) {
+		return (await this.db.selectFrom("host_roster").select("agent_id").where("reboot_pending_until", "is not", null).where("reboot_pending_until", "<=", new Date(nowMs)).execute()).map((r) => r.agent_id);
+	}
 };
 //#endregion
 //#region src/cli/commands/host.ts
@@ -11835,6 +12129,18 @@ function registerHostCommands(program) {
 			process.exit(1);
 		}
 	});
+	host.command("remove").description("Remove a host from the roster").requiredOption("--agent-id <id>", "Agent id to remove").action(async (opts) => {
+		try {
+			if (await withDb((db) => new HostRosterStore(db).removeStatic(opts.agentId)) === 0) {
+				console.error(`No host found: ${opts.agentId}`);
+				process.exit(1);
+			}
+			console.log(`Removed host: ${opts.agentId}`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 }
 //#endregion
 //#region src/cli/commands/org-settings.ts