@kici-dev/orchestrator 0.1.22 → 0.1.23

package/dist/cli.js

@@ -1556,8 +1556,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$49,
-	up: () => up$49
+	down: () => down$52,
+	up: () => up$52
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -2249,7 +2249,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$49(db) {
+async function up$52(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2271,7 +2271,7 @@ async function up$49(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$49(db) {
+async function down$52(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2318,8 +2318,8 @@ async function down$49(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$48,
-	up: () => up$48
+	down: () => down$51,
+	up: () => up$51
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -2333,13 +2333,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$48(db) {
+async function up$51(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$48(db) {
+async function down$51(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2348,8 +2348,8 @@ async function down$48(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$47,
-	up: () => up$47
+	down: () => down$50,
+	up: () => up$50
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2373,7 +2373,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$47(db) {
+async function up$50(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2411,28 +2411,28 @@ async function up$47(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$47(db) {
+async function down$50(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$46,
-	up: () => up$46
+	down: () => down$49,
+	up: () => up$49
 });
-async function up$46(db) {
+async function up$49(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$46(db) {
+async function down$49(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Cold-store chunk counter table.
@@ -2449,7 +2449,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$45(db) {
+async function up$48(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2467,14 +2467,14 @@ async function up$45(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$45(db) {
+async function down$48(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -2510,7 +2510,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$44(db) {
+async function up$47(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2555,7 +2555,7 @@ async function up$44(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$44(db) {
+async function down$47(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2580,8 +2580,8 @@ async function down$44(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$46,
+	up: () => up$46
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -2621,7 +2621,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$43(db) {
+async function up$46(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2642,7 +2642,7 @@ async function up$43(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$43(db) {
+async function down$46(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2670,8 +2670,8 @@ async function down$43(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -2709,7 +2709,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$42(db) {
+async function up$45(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2725,7 +2725,7 @@ async function up$42(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$42(db) {
+async function down$45(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2744,8 +2744,8 @@ async function down$42(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -2758,7 +2758,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$41(db) {
+async function up$44(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2767,14 +2767,14 @@ async function up$41(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$41(db) {
+async function down$44(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -2806,7 +2806,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$40(db) {
+async function up$43(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -2833,14 +2833,14 @@ async function up$40(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$40(db) {
+async function down$43(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -2859,11 +2859,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$39(db) {
+async function up$42(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$39(db) {
+async function down$42(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -2902,8 +2902,8 @@ async function down$39(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -2929,7 +2929,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$38(db) {
+async function up$41(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -2947,14 +2947,14 @@ async function up$38(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$38(db) {
+async function down$41(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -2973,7 +2973,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$37(db) {
+async function up$40(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -2983,15 +2983,15 @@ async function up$37(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$37(db) {
+async function down$40(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -3025,7 +3025,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$36(db) {
+async function up$39(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3056,7 +3056,7 @@ async function up$36(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$36(db) {
+async function down$39(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -3074,8 +3074,8 @@ async function down$36(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -3103,7 +3103,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$35(db) {
+async function up$38(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3228,7 +3228,7 @@ async function up$35(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$35(db) {
+async function down$38(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3253,8 +3253,8 @@ async function down$35(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3267,7 +3267,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$34(db) {
+async function up$37(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3281,7 +3281,7 @@ async function up$34(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$34(db) {
+async function down$37(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3289,8 +3289,8 @@ async function down$34(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -3330,17 +3330,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$33(db) {
+async function up$36(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$33(db) {
+async function down$36(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3385,19 +3385,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$32(db) {
+async function up$35(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$32(db) {
+async function down$35(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -3420,7 +3420,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$31(db) {
+async function up$34(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3441,15 +3441,15 @@ async function up$31(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$31(db) {
+async function down$34(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -3464,7 +3464,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$30(db) {
+async function up$33(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3478,7 +3478,7 @@ async function up$30(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$30(db) {
+async function down$33(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -3486,8 +3486,8 @@ async function down$30(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -3511,7 +3511,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$29(db) {
+async function up$32(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -3542,14 +3542,14 @@ async function up$29(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$29(db) {
+async function down$32(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -3576,7 +3576,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$28(db) {
+async function up$31(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3626,7 +3626,7 @@ async function up$28(db) {
     `.execute(db);
 	}
 }
-async function down$28(db) {
+async function down$31(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -3634,8 +3634,8 @@ async function down$28(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -3659,7 +3659,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$27(db) {
+async function up$30(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3684,7 +3684,7 @@ async function up$27(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$27(db) {
+async function down$30(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -3696,8 +3696,8 @@ async function down$27(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -3713,7 +3713,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$26(db) {
+async function up$29(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3729,7 +3729,7 @@ async function up$26(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$26(db) {
+async function down$29(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -3737,8 +3737,8 @@ async function down$26(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -3752,7 +3752,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$25(db) {
+async function up$28(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3772,7 +3772,7 @@ async function up$25(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$25(db) {
+async function down$28(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -3783,8 +3783,8 @@ async function down$25(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -3793,7 +3793,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$24(db) {
+async function up$27(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3803,7 +3803,7 @@ async function up$24(db) {
     ])))
   `.execute(db);
 }
-async function down$24(db) {
+async function down$27(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3816,8 +3816,8 @@ async function down$24(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -3835,13 +3835,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$23(db) {
+async function up$26(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$23(db) {
+async function down$26(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -3849,8 +3849,8 @@ async function down$23(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -3879,7 +3879,7 @@ async function columnExists(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$22(db) {
+async function up$25(db) {
 	if (!await columnExists(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
@@ -3889,7 +3889,7 @@ async function up$22(db) {
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$22(db) {
+async function down$25(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -3900,8 +3900,8 @@ async function down$22(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -3915,7 +3915,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$21(db) {
+async function up$24(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3928,7 +3928,7 @@ async function up$21(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$21(db) {
+async function down$24(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -3936,8 +3936,8 @@ async function down$21(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -3948,14 +3948,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$20(db) {
+async function up$23(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$20(db) {
+async function down$23(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -3965,8 +3965,8 @@ async function down$20(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -3983,7 +3983,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$19(db) {
+async function up$22(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4008,7 +4008,7 @@ async function up$19(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$19(db) {
+async function down$22(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -4016,8 +4016,8 @@ async function down$19(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -4029,7 +4029,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$18(db) {
+async function up$21(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4043,7 +4043,7 @@ async function up$18(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$18(db) {
+async function down$21(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -4051,8 +4051,8 @@ async function down$18(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -4069,7 +4069,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$17(db) {
+async function up$20(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4089,7 +4089,7 @@ async function up$17(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$17(db) {
+async function down$20(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -4100,8 +4100,8 @@ async function down$17(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -4123,7 +4123,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$16(db) {
+async function up$19(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4156,7 +4156,7 @@ async function up$16(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$16(db) {
+async function down$19(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -4166,8 +4166,8 @@ async function down$16(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -4176,7 +4176,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$15(db) {
+async function up$18(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -4186,14 +4186,14 @@ async function up$15(db) {
     )
   `.execute(db);
 }
-async function down$15(db) {
+async function down$18(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -4206,7 +4206,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$14(db) {
+async function up$17(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4232,14 +4232,14 @@ async function up$14(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$14(db) {
+async function down$17(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -4256,7 +4256,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$13(db) {
+async function up$16(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4272,7 +4272,7 @@ async function up$13(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$13(db) {
+async function down$16(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4291,8 +4291,8 @@ async function down$13(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -4304,7 +4304,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$12(db) {
+async function up$15(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4323,14 +4323,14 @@ async function up$12(db) {
     )
   `.execute(db);
 }
-async function down$12(db) {
+async function down$15(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -4347,7 +4347,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$11(db) {
+async function up$14(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4377,14 +4377,14 @@ async function up$11(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$11(db) {
+async function down$14(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -4411,7 +4411,7 @@ async function colExists$5(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$10(db) {
+async function up$13(db) {
 	if (!await colExists$5(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
 	if (!await colExists$5(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
 	if (!await colExists$5(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
@@ -4422,7 +4422,7 @@ async function up$10(db) {
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$10(db) {
+async function down$13(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -4432,8 +4432,8 @@ async function down$10(db) {
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -4463,7 +4463,7 @@ async function colExists$4(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$9(db) {
+async function up$12(db) {
 	if (!await colExists$4(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
 	if (!await colExists$4(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
 	if (!await colExists$4(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
@@ -4472,7 +4472,7 @@ async function up$9(db) {
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$9(db) {
+async function down$12(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -4481,8 +4481,8 @@ async function down$9(db) {
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
@@ -4508,19 +4508,19 @@ async function colExists$3(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$8(db) {
+async function up$11(db) {
 	if (!await colExists$3(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 	if (!await colExists$3(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$8(db) {
+async function down$11(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -4541,17 +4541,17 @@ async function colExists$2(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$7(db) {
+async function up$10(db) {
 	if (!await colExists$2(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$7(db) {
+async function down$10(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add idempotent check-mode columns:
@@ -4578,13 +4578,13 @@ async function colExists$1(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$6(db) {
+async function up$9(db) {
 	if (!await colExists$1(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
 	if (!await colExists$1(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
 	if (!await colExists$1(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
 	if (!await colExists$1(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$6(db) {
+async function down$9(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -4593,8 +4593,8 @@ async function down$6(db) {
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Add the typed host-vars dimension to the host roster:
@@ -4608,18 +4608,18 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive column).
 */
-async function up$5(db) {
+async function up$8(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$5(db) {
+async function down$8(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Record the joining peer's instanceId at first consumption of a join token:
@@ -4634,18 +4634,18 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive nullable column).
 */
-async function up$4(db) {
+async function up$7(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down$4(db) {
+async function down$7(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/047_needs_run_on.ts
 var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Migrate `execution_job_needs` from the binary `if_failed` policy to a
@@ -4681,7 +4681,7 @@ async function colExists(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
-async function up$3(db) {
+async function up$6(db) {
 	if (!await colExists(db, "execution_job_needs", "run_on")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
@@ -4700,7 +4700,7 @@ async function up$3(db) {
 		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
 	}
 }
-async function down$3(db) {
+async function down$6(db) {
 	if (!await colExists(db, "execution_job_needs", "if_failed")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
@@ -4716,8 +4716,8 @@ async function down$3(db) {
 //#endregion
 //#region src/db/migrations/048_host_reboot_pending.ts
 var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
@@ -4734,18 +4734,18 @@ var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$2(db) {
+async function up$5(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
 }
-async function down$2(db) {
+async function down$5(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/049_held_runs_payload.ts
 var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Add `held_runs.payload jsonb NULL` — the drift payload captured when a
@@ -4757,18 +4757,18 @@ var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$1(db) {
+async function up$4(db) {
 	await sql`ALTER TABLE public.held_runs
     ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
-async function down$1(db) {
+async function down$4(db) {
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/050_sources_slug.ts
 var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
@@ -4783,14 +4783,111 @@ var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up(db) {
+async function up$3(db) {
 	await sql`ALTER TABLE public.sources
     ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
-async function down(db) {
+async function down$3(db) {
 	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 //#endregion
+//#region src/db/migrations/051_binding_host_pattern.ts
+var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* Add a per-host dimension to environment secret bindings:
+*
+* - `environment_bindings.host_pattern text NOT NULL DEFAULT '**'` — the host
+*   selector a binding applies to (exact / glob / regex, matched against a
+*   fan-out child's agentId / hostname / labels). `'**'` matches every host, so
+*   existing rows are backfilled to `'**'` and keep their fleet-wide behaviour.
+* - The binding unique key widens from `(environment_id, scope_pattern)` to
+*   `(environment_id, scope_pattern, host_pattern)` so the same scope can carry
+*   distinct per-host selectors.
+*
+* Idempotent: re-running on a DB that already has the column / index is a no-op.
+* Additive — staging data is preserved.
+*/
+async function up$2(db) {
+	await sql`ALTER TABLE public.environment_bindings
+    ADD COLUMN IF NOT EXISTS host_pattern text NOT NULL DEFAULT '**'`.execute(db);
+	await sql`ALTER TABLE public.environment_bindings
+    DROP CONSTRAINT IF EXISTS environment_bindings_env_id_scope_unique`.execute(db);
+	await sql`CREATE UNIQUE INDEX IF NOT EXISTS environment_bindings_env_scope_host_uniq
+    ON public.environment_bindings (environment_id, scope_pattern, host_pattern)`.execute(db);
+}
+async function down$2(db) {
+	await sql`DROP INDEX IF EXISTS public.environment_bindings_env_scope_host_uniq`.execute(db);
+	await sql`ALTER TABLE public.environment_bindings
+    DROP COLUMN IF EXISTS host_pattern`.execute(db);
+	await sql`ALTER TABLE public.environment_bindings
+    ADD CONSTRAINT environment_bindings_env_id_scope_unique UNIQUE (environment_id, scope_pattern)`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/052_host_reach_metadata.ts
+var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Add pre-agent reach metadata to the host roster so a declared host (no agent
+* yet) can be reached over SSH for bootstrap bring-up:
+*
+* - `host_roster.address text NULL` — IP / hostname to SSH to.
+* - `host_roster.ssh_user text NULL` — SSH login user (defaults to `root` at use site).
+* - `host_roster.ssh_port int NULL` — SSH port (defaults to 22 at use site).
+* - `host_roster.ssh_key_secret text NULL` — scoped-secret ref (`scope/key`)
+*   holding the bring-up private key. The orchestrator resolves it server-side;
+*   the key never lives in the roster.
+*
+* All nullable: a host with no reach metadata simply cannot be bootstrapped and
+* behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
+* so staging data is preserved.
+*/
+async function up$1(db) {
+	await sql`ALTER TABLE public.host_roster
+    ADD COLUMN IF NOT EXISTS address text,
+    ADD COLUMN IF NOT EXISTS ssh_user text,
+    ADD COLUMN IF NOT EXISTS ssh_port integer,
+    ADD COLUMN IF NOT EXISTS ssh_key_secret text`.execute(db);
+}
+async function down$1(db) {
+	await sql`ALTER TABLE public.host_roster
+    DROP COLUMN IF EXISTS address,
+    DROP COLUMN IF EXISTS ssh_user,
+    DROP COLUMN IF EXISTS ssh_port,
+    DROP COLUMN IF EXISTS ssh_key_secret`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/053_agent_token_single_use.ts
+var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add a single-use marker to agent tokens for the bootstrap (init-runner)
+* bring-up flow:
+*
+* - `agent_tokens.consumed_at timestamptz NULL` — set the first time a
+*   single-use bootstrap token is consumed (at `agent.register`). A second
+*   register with the same token is rejected. NULL = never consumed (the
+*   default for every existing static / ephemeral token, which stay reusable
+*   until expiry).
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
+*/
+async function up(db) {
+	await sql`ALTER TABLE public.agent_tokens
+    ADD COLUMN IF NOT EXISTS consumed_at timestamptz`.execute(db);
+}
+async function down(db) {
+	await sql`ALTER TABLE public.agent_tokens
+    DROP COLUMN IF EXISTS consumed_at`.execute(db);
+}
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -4844,7 +4941,10 @@ function createMigrationProvider() {
 			"047_needs_run_on": _047_needs_run_on_exports,
 			"048_host_reboot_pending": _048_host_reboot_pending_exports,
 			"049_held_runs_payload": _049_held_runs_payload_exports,
-			"050_sources_slug": _050_sources_slug_exports
+			"050_sources_slug": _050_sources_slug_exports,
+			"051_binding_host_pattern": _051_binding_host_pattern_exports,
+			"052_host_reach_metadata": _052_host_reach_metadata_exports,
+			"053_agent_token_single_use": _053_agent_token_single_use_exports
 		};
 	} };
 }
@@ -11911,19 +12011,67 @@ var HostRosterStore = class {
 	async stampLastSeen(agentId, instanceId) {
 		await this.db.updateTable("host_roster").set({ last_seen: sql`now()` }).where("agent_id", "=", agentId).where("connected_instance_id", "=", instanceId).execute();
 	}
-	/** Operator pre-declare of a static host before its agent dials in. */
+	/**
+	* Operator pre-declare of a static host. A re-declare of an existing agent_id
+	* converges the operator-owned columns (labels, hostname, reach,
+	* host_properties) to the newly-declared values while preserving the
+	* agent-reported liveness/identity columns (connected_instance_id, last_seen,
+	* platform, arch, lifecycle_class, token_id, reboot_pending_until). The
+	* optional reach fields (`address`/`sshUser`/`sshPort`/`sshKeySecret`) carry
+	* how to SSH to the host for bootstrap bring-up. Each operator field is
+	* preserve-on-omit: an omitted field keeps the existing column value.
+	*
+	* Returns `{ created: true }` when the declare inserted a new row,
+	* `{ created: false }` when it converged an existing one.
+	*/
 	async declareStatic(input) {
-		await this.db.insertInto("host_roster").values({
+		const labelsBind = input.labels === void 0 ? null : JSON.stringify(input.labels);
+		const propsBind = input.properties === void 0 ? null : JSON.stringify(input.properties);
+		return { created: !!(await this.db.insertInto("host_roster").values({
 			agent_id: input.agentId,
 			token_id: null,
 			lifecycle_class: "static",
-			labels: JSON.stringify(input.labels),
+			labels: JSON.stringify(input.labels ?? []),
 			hostname: input.hostname ?? null,
 			connected_instance_id: null,
 			host_properties: JSON.stringify(input.properties ?? {}),
+			address: input.address ?? null,
+			ssh_user: input.sshUser ?? null,
+			ssh_port: input.sshPort ?? null,
+			ssh_key_secret: input.sshKeySecret ?? null,
 			last_seen: sql`now()`,
 			updated_at: sql`now()`
-		}).onConflict((oc) => oc.column("agent_id").doNothing()).execute();
+		}).onConflict((oc) => oc.column("agent_id").doUpdateSet({
+			labels: sql`COALESCE(${labelsBind}, host_roster.labels)`,
+			hostname: sql`COALESCE(${input.hostname ?? null}, host_roster.hostname)`,
+			host_properties: sql`COALESCE(host_roster.host_properties, '{}'::jsonb) || COALESCE(${propsBind}::jsonb, '{}'::jsonb)`,
+			address: sql`COALESCE(${input.address ?? null}, host_roster.address)`,
+			ssh_user: sql`COALESCE(${input.sshUser ?? null}, host_roster.ssh_user)`,
+			ssh_port: sql`COALESCE(${input.sshPort ?? null}, host_roster.ssh_port)`,
+			ssh_key_secret: sql`COALESCE(${input.sshKeySecret ?? null}, host_roster.ssh_key_secret)`,
+			updated_at: sql`now()`
+		})).returning(sql`(xmax = 0)`.as("created")).executeTakeFirstOrThrow()).created };
+	}
+	/**
+	* Read a host's pre-agent reach metadata. Returns null when the host is not
+	* in the roster; a host declared without reach fields reads back with nulls.
+	*/
+	async getReach(agentId) {
+		const row = await this.db.selectFrom("host_roster").select([
+			"agent_id",
+			"address",
+			"ssh_user",
+			"ssh_port",
+			"ssh_key_secret"
+		]).where("agent_id", "=", agentId).executeTakeFirst();
+		if (!row) return null;
+		return {
+			agentId: row.agent_id,
+			address: row.address,
+			sshUser: row.ssh_user,
+			sshPort: row.ssh_port,
+			sshKeySecret: row.ssh_key_secret
+		};
 	}
 	async get(agentId) {
 		return await this.db.selectFrom("host_roster").selectAll().where("agent_id", "=", agentId).executeTakeFirst() ?? null;
@@ -12113,15 +12261,24 @@ function registerHostCommands(program) {
 			process.exit(1);
 		}
 	});
-	host.command("declare").description("Pre-declare a static host before it connects").requiredOption("--agent-id <id>", "Agent id the host will register as").option("--labels <labels>", "Comma-separated labels", "").option("--hostname <name>", "Hostname").option("--prop <key=value>", "Typed host property (repeatable; true/false ⇒ boolean, numeric ⇒ number)", collectProp, []).action(async (opts) => {
+	host.command("declare").description("Pre-declare a static host before it connects").requiredOption("--agent-id <id>", "Agent id the host will register as").option("--labels <labels>", "Comma-separated labels", "").option("--hostname <name>", "Hostname").option("--prop <key=value>", "Typed host property (repeatable; true/false ⇒ boolean, numeric ⇒ number)", collectProp, []).option("--address <host>", "Pre-agent SSH reach address (IP / hostname) for bootstrap").option("--ssh-user <user>", "SSH login user for bootstrap bring-up").option("--ssh-port <port>", "SSH port for bootstrap bring-up").option("--ssh-key-secret <ref>", "Scoped-secret ref (scope/key) holding the bring-up private key").action(async (opts) => {
 		try {
 			const labels = opts.labels ? String(opts.labels).split(",").map((s) => s.trim()).filter(Boolean) : [];
 			const properties = parseHostPropertyAssignments(opts.prop);
+			let sshPort;
+			if (opts.sshPort !== void 0) {
+				sshPort = Number(opts.sshPort);
+				if (!Number.isInteger(sshPort) || sshPort <= 0) throw new Error(`--ssh-port must be a positive integer (got "${opts.sshPort}")`);
+			}
 			await withDb((db) => new HostRosterStore(db).declareStatic({
 				agentId: opts.agentId,
 				labels,
 				hostname: opts.hostname,
-				properties
+				properties,
+				address: opts.address,
+				sshUser: opts.sshUser,
+				sshPort,
+				sshKeySecret: opts.sshKeySecret
 			}));
 			console.log(`Declared static host: ${opts.agentId}`);
 		} catch (err) {
@@ -12817,7 +12974,10 @@ function printShowEnvironment(res) {
 	} else console.log("variables: none");
 	if (res.bindings.length > 0) {
 		console.log(`bindings (${res.bindings.length}):`);
-		for (const b of res.bindings) console.log(`  ${b.scope_pattern}`);
+		for (const b of res.bindings) {
+			const host = b.host_pattern && b.host_pattern !== "**" ? `  (host: ${b.host_pattern})` : "";
+			console.log(`  ${b.scope_pattern}${host}`);
+		}
 	} else console.log("bindings: none");
 }
 function registerEnvironmentCommands(program, getClient) {
@@ -12852,17 +13012,19 @@ function registerEnvironmentCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	env.command("bind").description("Upsert an environment_bindings row (scope_pattern → environment)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Environment name").requiredOption("--scope <pattern>", "Scope pattern (e.g. \"staging\" or \"aws/prod/**\")").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("bind").description("Upsert an environment_bindings row (scope_pattern → environment)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Environment name").requiredOption("--scope <pattern>", "Scope pattern (e.g. \"staging\" or \"aws/prod/**\")").option("--host <pattern>", "Host selector (exact/glob/regex over agentId/host/labels); \"**\" = all hosts", "**").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
 			const payload = {
 				orgId: opts.org,
 				envName: opts.env,
-				scopePattern: opts.scope
+				scopePattern: opts.scope,
+				hostPattern: opts.host
 			};
 			const result = dbUrl ? await seedEnvironmentBindingDirect(dbUrl, payload) : await getClient().post(`/api/v1/admin/environments/${encodeURIComponent(opts.env)}/bind`, {
 				orgId: opts.org,
-				scopePattern: opts.scope
+				scopePattern: opts.scope,
+				hostPattern: opts.host
 			});
 			if (opts.json) console.log(JSON.stringify(result));
 			else console.log(`environment bind: created=${result.created}${dbUrl ? " (direct)" : ""}`);