@kici-dev/orchestrator 0.1.26 → 0.1.27

package/dist/cli.js

@@ -5,8 +5,8 @@ import * as path$1 from "node:path";
 import path, { dirname, join, resolve } from "node:path";
 import * as fs$1 from "node:fs";
 import fs, { chmodSync, closeSync, createReadStream, createWriteStream, existsSync, mkdtempSync, openSync, promises, readFileSync, realpathSync, statSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
-import { Command } from "commander";
-import { BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteEnvironmentDirect, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeEnvironmentsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
+import { Command, Option } from "commander";
+import { BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createContextTemplateDirect, createDb, createDbRole, createLogger, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteContextDirect, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listContextsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedContextBindingDirect, seedContextDirect, setContextPolicyDirect, setContextSecretDirect, sha256, showContextDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
 import crypto, { createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { createInterface } from "node:readline";
 import { KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, ScalerBackendType, ScalerEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, attestationVerifyStatusSchema, getAccessLogColdDays, getSecretAuditLogColdDays, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseHostPropertyAssignments, scalerAgentLabels, secretAuditLogWarmSqlCase } from "@kici-dev/engine";
@@ -180,20 +180,35 @@ var AdminApiClient = class {
 	async deleteSecret(orgId, scope, key) {
 		return this.request("DELETE", `/api/v1/admin/secrets/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}/${encodeURIComponent(key)}`);
 	}
-	async listVariables(orgId, environment) {
+	/**
+	* Create (or upsert) a deployment context. `allowLocalExecution` lets
+	* CLI-initiated / local runs resolve secrets through this context.
+	*/
+	async createContext(data) {
+		return this.request("POST", `/api/v1/admin/contexts`, data);
+	}
+	/**
+	* Bind a scope pattern to a context so its scoped secrets resolve at dispatch.
+	* `hostPattern` defaults to `**` (every host) server-side.
+	*/
+	async bindContext(data) {
+		const { name, ...body } = data;
+		return this.request("POST", `/api/v1/admin/contexts/${encodeURIComponent(name)}/bind`, body);
+	}
+	async listVariables(orgId, context) {
 		const params = new URLSearchParams({ orgId });
-		return this.request("GET", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables?${params}`);
+		return this.request("GET", `/api/v1/admin/contexts/${encodeURIComponent(context)}/variables?${params}`);
 	}
-	async setVariable(orgId, environment, key, value, locked) {
+	async setVariable(orgId, context, key, value, locked) {
 		const params = new URLSearchParams({ orgId });
-		return this.request("PUT", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables/${encodeURIComponent(key)}?${params}`, {
+		return this.request("PUT", `/api/v1/admin/contexts/${encodeURIComponent(context)}/variables/${encodeURIComponent(key)}?${params}`, {
 			value,
 			locked
 		});
 	}
-	async deleteVariable(orgId, environment, key) {
+	async deleteVariable(orgId, context, key) {
 		const params = new URLSearchParams({ orgId });
-		return this.request("DELETE", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables/${encodeURIComponent(key)}?${params}`);
+		return this.request("DELETE", `/api/v1/admin/contexts/${encodeURIComponent(context)}/variables/${encodeURIComponent(key)}?${params}`);
 	}
 	async rotateKey() {
 		return this.request("POST", "/api/v1/admin/rotate-key");
@@ -631,23 +646,23 @@ function registerSecretCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	sec.command("set [orgId] [scope] [key]").description("Set a secret value. Positional form: \"set <orgId> <scope> <key>\". Sugar form (environment scope): \"set --org <id> --environment <env> --key <k>\". Value comes from one of: --prompt (default on TTY), --from-stdin (default on pipe), --from-file <path>, --from-env <VAR>, --value <plaintext> (discouraged).").option("--value <value>", "Secret value via argv (visible in shell history; prefer --prompt)").option("--org <orgId>", "Org ID (use with --environment + --key; mutually exclusive with positional form)").option("--environment <name>", "Environment scope — sugar for positional <scope>. Requires --org and --key.").option("--key <key>", "Secret key name (use with --org + --environment)").option("--prompt", "Interactive no-echo prompt (requires TTY)").option("--from-stdin", "Read value from piped stdin until EOF").option("--from-file <path>", "Read value from a file (trailing newline trimmed)").option("--from-env <var>", "Read value from a named environment variable").option("--no-trim", "When reading --from-file, keep the trailing newline (default: trim once)").option("--confirm-fingerprint <sha256hex>", "Refuse the write unless SHA-256(value) matches this 64-hex string").option("--dry-run", "Parse + validate the value, print fingerprint + length, do not write").option("--database-url <url>", "Direct-DB mode: write encrypted_value verbatim to scoped_secrets (offline; skips HTTP + encryption)").action(async (posOrgId, posScope, posKey, opts) => {
+	sec.command("set [orgId] [scope] [key]").description("Set a secret value. Positional form: \"set <orgId> <scope> <key>\". Sugar form (context scope): \"set --org <id> --context <env> --key <k>\". Value comes from one of: --prompt (default on TTY), --from-stdin (default on pipe), --from-file <path>, --from-env <VAR>, --value <plaintext> (discouraged).").option("--value <value>", "Secret value via argv (visible in shell history; prefer --prompt)").option("--org <orgId>", "Org ID (use with --context + --key; mutually exclusive with positional form)").option("--context <name>", "Context scope — sugar for positional <scope>. Requires --org and --key.").option("--key <key>", "Secret key name (use with --org + --context)").option("--prompt", "Interactive no-echo prompt (requires TTY)").option("--from-stdin", "Read value from piped stdin until EOF").option("--from-file <path>", "Read value from a file (trailing newline trimmed)").option("--from-env <var>", "Read value from a named environment variable").option("--no-trim", "When reading --from-file, keep the trailing newline (default: trim once)").option("--confirm-fingerprint <sha256hex>", "Refuse the write unless SHA-256(value) matches this 64-hex string").option("--dry-run", "Parse + validate the value, print fingerprint + length, do not write").option("--database-url <url>", "Direct-DB mode: write encrypted_value verbatim to scoped_secrets (offline; skips HTTP + encryption)").action(async (posOrgId, posScope, posKey, opts) => {
 		try {
 			const hasPositional = Boolean(posOrgId || posScope || posKey);
-			const hasSugar = Boolean(opts.org || opts.environment || opts.key);
-			if (hasPositional && hasSugar) throw new Error("Cannot mix positional <orgId> <scope> <key> form with --org/--environment/--key flags. Pick one.");
+			const hasSugar = Boolean(opts.org || opts.context || opts.key);
+			if (hasPositional && hasSugar) throw new Error("Cannot mix positional <orgId> <scope> <key> form with --org/--context/--key flags. Pick one.");
 			let orgId;
 			let scope;
 			let key;
 			if (hasSugar) {
-				if (!opts.org) throw new Error("--org is required when using --environment sugar form");
-				if (!opts.environment) throw new Error("--environment is required in sugar form (use --environment <name>)");
-				if (!opts.key) throw new Error("--key is required when using --environment sugar form");
+				if (!opts.org) throw new Error("--org is required when using --context sugar form");
+				if (!opts.context) throw new Error("--context is required in sugar form (use --context <name>)");
+				if (!opts.key) throw new Error("--key is required when using --context sugar form");
 				orgId = opts.org;
-				scope = opts.environment;
+				scope = opts.context;
 				key = opts.key;
 			} else {
-				if (!posOrgId || !posScope || !posKey) throw new Error("Missing arguments: supply either <orgId> <scope> <key> positionally, or --org + --environment + --key.");
+				if (!posOrgId || !posScope || !posKey) throw new Error("Missing arguments: supply either <orgId> <scope> <key> positionally, or --org + --context + --key.");
 				orgId = posOrgId;
 				scope = posScope;
 				key = posKey;
@@ -659,9 +674,9 @@ function registerSecretCommands(program, getClient) {
 			}
 			const dbUrl = resolveDirectDbUrl$9(opts.databaseUrl);
 			if (dbUrl) {
-				await setEnvironmentSecretDirect(dbUrl, {
+				await setContextSecretDirect(dbUrl, {
 					orgId,
-					environment: scope,
+					context: scope,
 					key,
 					encryptedValue: value
 				});
@@ -1590,8 +1605,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$65,
-	up: () => up$65
+	down: () => down$67,
+	up: () => up$67
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -2283,7 +2298,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$65(db) {
+async function up$67(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2305,7 +2320,7 @@ async function up$65(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$65(db) {
+async function down$67(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2352,8 +2367,8 @@ async function down$65(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$64,
-	up: () => up$64
+	down: () => down$66,
+	up: () => up$66
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -2367,13 +2382,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$64(db) {
+async function up$66(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$64(db) {
+async function down$66(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2382,8 +2397,8 @@ async function down$64(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$63,
-	up: () => up$63
+	down: () => down$65,
+	up: () => up$65
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2407,7 +2422,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$63(db) {
+async function up$65(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2445,28 +2460,28 @@ async function up$63(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$63(db) {
+async function down$65(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$62,
-	up: () => up$62
+	down: () => down$64,
+	up: () => up$64
 });
-async function up$62(db) {
+async function up$64(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$62(db) {
+async function down$64(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$61,
-	up: () => up$61
+	down: () => down$63,
+	up: () => up$63
 });
 /**
 * Cold-store chunk counter table.
@@ -2483,7 +2498,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$61(db) {
+async function up$63(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2501,14 +2516,14 @@ async function up$61(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$61(db) {
+async function down$63(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$60,
-	up: () => up$60
+	down: () => down$62,
+	up: () => up$62
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -2544,7 +2559,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$60(db) {
+async function up$62(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2589,7 +2604,7 @@ async function up$60(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$60(db) {
+async function down$62(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2614,8 +2629,8 @@ async function down$60(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$59,
-	up: () => up$59
+	down: () => down$61,
+	up: () => up$61
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -2655,7 +2670,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$59(db) {
+async function up$61(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2676,7 +2691,7 @@ async function up$59(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$59(db) {
+async function down$61(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2704,8 +2719,8 @@ async function down$59(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$58,
-	up: () => up$58
+	down: () => down$60,
+	up: () => up$60
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -2743,7 +2758,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$58(db) {
+async function up$60(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2759,7 +2774,7 @@ async function up$58(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$58(db) {
+async function down$60(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2778,8 +2793,8 @@ async function down$58(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$57,
-	up: () => up$57
+	down: () => down$59,
+	up: () => up$59
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -2792,7 +2807,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$57(db) {
+async function up$59(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2801,14 +2816,14 @@ async function up$57(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$57(db) {
+async function down$59(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$56,
-	up: () => up$56
+	down: () => down$58,
+	up: () => up$58
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -2840,7 +2855,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$56(db) {
+async function up$58(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -2867,14 +2882,14 @@ async function up$56(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$56(db) {
+async function down$58(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$55,
-	up: () => up$55
+	down: () => down$57,
+	up: () => up$57
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -2893,11 +2908,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$55(db) {
+async function up$57(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$55(db) {
+async function down$57(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -2936,8 +2951,8 @@ async function down$55(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$54,
-	up: () => up$54
+	down: () => down$56,
+	up: () => up$56
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -2963,7 +2978,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$54(db) {
+async function up$56(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -2981,14 +2996,14 @@ async function up$54(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$54(db) {
+async function down$56(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$53,
-	up: () => up$53
+	down: () => down$55,
+	up: () => up$55
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -3007,7 +3022,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$53(db) {
+async function up$55(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -3017,15 +3032,15 @@ async function up$53(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$53(db) {
+async function down$55(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$52,
-	up: () => up$52
+	down: () => down$54,
+	up: () => up$54
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -3059,7 +3074,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$52(db) {
+async function up$54(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3090,7 +3105,7 @@ async function up$52(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$52(db) {
+async function down$54(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -3108,8 +3123,8 @@ async function down$52(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$51,
-	up: () => up$51
+	down: () => down$53,
+	up: () => up$53
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -3137,7 +3152,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$51(db) {
+async function up$53(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3262,7 +3277,7 @@ async function up$51(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$51(db) {
+async function down$53(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3287,8 +3302,8 @@ async function down$51(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$50,
-	up: () => up$50
+	down: () => down$52,
+	up: () => up$52
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3301,7 +3316,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$50(db) {
+async function up$52(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3315,7 +3330,7 @@ async function up$50(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$50(db) {
+async function down$52(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3323,8 +3338,8 @@ async function down$50(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$49,
-	up: () => up$49
+	down: () => down$51,
+	up: () => up$51
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -3364,17 +3379,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$49(db) {
+async function up$51(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$49(db) {
+async function down$51(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$48,
-	up: () => up$48
+	down: () => down$50,
+	up: () => up$50
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3419,19 +3434,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$48(db) {
+async function up$50(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$48(db) {
+async function down$50(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$47,
-	up: () => up$47
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -3454,7 +3469,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$47(db) {
+async function up$49(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3475,15 +3490,15 @@ async function up$47(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$47(db) {
+async function down$49(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$46,
-	up: () => up$46
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -3498,7 +3513,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$46(db) {
+async function up$48(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3512,7 +3527,7 @@ async function up$46(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$46(db) {
+async function down$48(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -3520,8 +3535,8 @@ async function down$46(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -3545,7 +3560,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$45(db) {
+async function up$47(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -3576,14 +3591,14 @@ async function up$45(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$45(db) {
+async function down$47(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$46,
+	up: () => up$46
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -3610,7 +3625,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$44(db) {
+async function up$46(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3660,7 +3675,7 @@ async function up$44(db) {
     `.execute(db);
 	}
 }
-async function down$44(db) {
+async function down$46(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -3668,8 +3683,8 @@ async function down$44(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -3693,7 +3708,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$43(db) {
+async function up$45(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3718,7 +3733,7 @@ async function up$43(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$43(db) {
+async function down$45(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -3730,8 +3745,8 @@ async function down$43(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -3747,7 +3762,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$42(db) {
+async function up$44(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3763,7 +3778,7 @@ async function up$42(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$42(db) {
+async function down$44(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -3771,8 +3786,8 @@ async function down$42(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -3786,7 +3801,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$41(db) {
+async function up$43(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3806,7 +3821,7 @@ async function up$41(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$41(db) {
+async function down$43(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -3817,8 +3832,8 @@ async function down$41(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -3827,7 +3842,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$40(db) {
+async function up$42(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3837,7 +3852,7 @@ async function up$40(db) {
     ])))
   `.execute(db);
 }
-async function down$40(db) {
+async function down$42(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3850,8 +3865,8 @@ async function down$40(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -3869,13 +3884,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$39(db) {
+async function up$41(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$39(db) {
+async function down$41(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -3883,8 +3898,8 @@ async function down$39(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -3913,7 +3928,7 @@ async function columnExists$1(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$38(db) {
+async function up$40(db) {
 	if (!await columnExists$1(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
@@ -3923,7 +3938,7 @@ async function up$38(db) {
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$38(db) {
+async function down$40(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -3934,8 +3949,8 @@ async function down$38(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -3949,7 +3964,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$37(db) {
+async function up$39(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3962,7 +3977,7 @@ async function up$37(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$37(db) {
+async function down$39(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -3970,8 +3985,8 @@ async function down$37(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -3982,14 +3997,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$36(db) {
+async function up$38(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$36(db) {
+async function down$38(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -3999,8 +4014,8 @@ async function down$36(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -4017,7 +4032,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$35(db) {
+async function up$37(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4042,7 +4057,7 @@ async function up$35(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$35(db) {
+async function down$37(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -4050,8 +4065,8 @@ async function down$35(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -4063,7 +4078,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$34(db) {
+async function up$36(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4077,7 +4092,7 @@ async function up$34(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$34(db) {
+async function down$36(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -4085,8 +4100,8 @@ async function down$34(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -4103,7 +4118,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$33(db) {
+async function up$35(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4123,7 +4138,7 @@ async function up$33(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$33(db) {
+async function down$35(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -4134,8 +4149,8 @@ async function down$33(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -4157,7 +4172,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$32(db) {
+async function up$34(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4190,7 +4205,7 @@ async function up$32(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$32(db) {
+async function down$34(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -4200,8 +4215,8 @@ async function down$32(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -4210,7 +4225,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$31(db) {
+async function up$33(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -4220,14 +4235,14 @@ async function up$31(db) {
     )
   `.execute(db);
 }
-async function down$31(db) {
+async function down$33(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -4240,7 +4255,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$30(db) {
+async function up$32(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4266,14 +4281,14 @@ async function up$30(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$30(db) {
+async function down$32(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -4290,7 +4305,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$29(db) {
+async function up$31(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4306,7 +4321,7 @@ async function up$29(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$29(db) {
+async function down$31(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4325,8 +4340,8 @@ async function down$29(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -4338,7 +4353,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$28(db) {
+async function up$30(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4357,14 +4372,14 @@ async function up$28(db) {
     )
   `.execute(db);
 }
-async function down$28(db) {
+async function down$30(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -4381,7 +4396,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$27(db) {
+async function up$29(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4411,14 +4426,14 @@ async function up$27(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$27(db) {
+async function down$29(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -4445,7 +4460,7 @@ async function colExists$11(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$26(db) {
+async function up$28(db) {
 	if (!await colExists$11(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
 	if (!await colExists$11(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
 	if (!await colExists$11(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
@@ -4456,7 +4471,7 @@ async function up$26(db) {
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$26(db) {
+async function down$28(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -4466,8 +4481,8 @@ async function down$26(db) {
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -4497,7 +4512,7 @@ async function colExists$10(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$25(db) {
+async function up$27(db) {
 	if (!await colExists$10(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
 	if (!await colExists$10(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
 	if (!await colExists$10(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
@@ -4506,7 +4521,7 @@ async function up$25(db) {
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$25(db) {
+async function down$27(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -4515,8 +4530,8 @@ async function down$25(db) {
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
@@ -4542,19 +4557,19 @@ async function colExists$9(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$24(db) {
+async function up$26(db) {
 	if (!await colExists$9(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 	if (!await colExists$9(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$24(db) {
+async function down$26(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -4575,17 +4590,17 @@ async function colExists$8(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$23(db) {
+async function up$25(db) {
 	if (!await colExists$8(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$23(db) {
+async function down$25(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Add idempotent check-mode columns:
@@ -4612,13 +4627,13 @@ async function colExists$7(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$22(db) {
+async function up$24(db) {
 	if (!await colExists$7(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
 	if (!await colExists$7(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
 	if (!await colExists$7(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
 	if (!await colExists$7(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$22(db) {
+async function down$24(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -4627,8 +4642,8 @@ async function down$22(db) {
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add the typed host-vars dimension to the host roster:
@@ -4642,18 +4657,18 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive column).
 */
-async function up$21(db) {
+async function up$23(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$21(db) {
+async function down$23(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Record the joining peer's instanceId at first consumption of a join token:
@@ -4668,18 +4683,18 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive nullable column).
 */
-async function up$20(db) {
+async function up$22(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down$20(db) {
+async function down$22(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/047_needs_run_on.ts
 var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Migrate `execution_job_needs` from the binary `if_failed` policy to a
@@ -4715,7 +4730,7 @@ async function colExists$6(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
-async function up$19(db) {
+async function up$21(db) {
 	if (!await colExists$6(db, "execution_job_needs", "run_on")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
@@ -4734,7 +4749,7 @@ async function up$19(db) {
 		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
 	}
 }
-async function down$19(db) {
+async function down$21(db) {
 	if (!await colExists$6(db, "execution_job_needs", "if_failed")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
@@ -4750,8 +4765,8 @@ async function down$19(db) {
 //#endregion
 //#region src/db/migrations/048_host_reboot_pending.ts
 var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
@@ -4768,18 +4783,18 @@ var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$18(db) {
+async function up$20(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
 }
-async function down$18(db) {
+async function down$20(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/049_held_runs_payload.ts
 var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Add `held_runs.payload jsonb NULL` — the drift payload captured when a
@@ -4791,18 +4806,18 @@ var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$17(db) {
+async function up$19(db) {
 	await sql`ALTER TABLE public.held_runs
     ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
-async function down$17(db) {
+async function down$19(db) {
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/050_sources_slug.ts
 var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
@@ -4817,18 +4832,18 @@ var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$16(db) {
+async function up$18(db) {
 	await sql`ALTER TABLE public.sources
     ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
-async function down$16(db) {
+async function down$18(db) {
 	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/051_binding_host_pattern.ts
 var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add a per-host dimension to environment secret bindings:
@@ -4844,7 +4859,7 @@ var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has the column / index is a no-op.
 * Additive — staging data is preserved.
 */
-async function up$15(db) {
+async function up$17(db) {
 	await sql`ALTER TABLE public.environment_bindings
     ADD COLUMN IF NOT EXISTS host_pattern text NOT NULL DEFAULT '**'`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
@@ -4852,7 +4867,7 @@ async function up$15(db) {
 	await sql`CREATE UNIQUE INDEX IF NOT EXISTS environment_bindings_env_scope_host_uniq
     ON public.environment_bindings (environment_id, scope_pattern, host_pattern)`.execute(db);
 }
-async function down$15(db) {
+async function down$17(db) {
 	await sql`DROP INDEX IF EXISTS public.environment_bindings_env_scope_host_uniq`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
     DROP COLUMN IF EXISTS host_pattern`.execute(db);
@@ -4862,8 +4877,8 @@ async function down$15(db) {
 //#endregion
 //#region src/db/migrations/052_host_reach_metadata.ts
 var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Add pre-agent reach metadata to the host roster so a declared host (no agent
@@ -4880,14 +4895,14 @@ var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
 * behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
 * so staging data is preserved.
 */
-async function up$14(db) {
+async function up$16(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS address text,
     ADD COLUMN IF NOT EXISTS ssh_user text,
     ADD COLUMN IF NOT EXISTS ssh_port integer,
     ADD COLUMN IF NOT EXISTS ssh_key_secret text`.execute(db);
 }
-async function down$14(db) {
+async function down$16(db) {
 	await sql`ALTER TABLE public.host_roster
     DROP COLUMN IF EXISTS address,
     DROP COLUMN IF EXISTS ssh_user,
@@ -4897,8 +4912,8 @@ async function down$14(db) {
 //#endregion
 //#region src/db/migrations/053_agent_token_single_use.ts
 var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Add a single-use marker to agent tokens for the bootstrap (init-runner)
@@ -4913,19 +4928,19 @@ var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$13(db) {
+async function up$15(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS consumed_at timestamptz`.execute(db);
 }
-async function down$13(db) {
+async function down$15(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS consumed_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/054_local_working_tree.ts
 var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Mark runs that executed an uploaded local working tree (`kici run remote`):
@@ -4938,19 +4953,19 @@ var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
 * data is preserved.
 */
-async function up$12(db) {
+async function up$14(db) {
 	await sql`ALTER TABLE public.execution_runs
     ADD COLUMN IF NOT EXISTS local_working_tree boolean NOT NULL DEFAULT false`.execute(db);
 }
-async function down$12(db) {
+async function down$14(db) {
 	await sql`ALTER TABLE public.execution_runs
     DROP COLUMN IF EXISTS local_working_tree`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/055_agent_token_mandatory_labels.ts
 var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Add a token-bound mandatory-label taint to agent tokens:
@@ -4966,19 +4981,19 @@ var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$11(db) {
+async function up$13(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS mandatory_labels text`.execute(db);
 }
-async function down$11(db) {
+async function down$13(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS mandatory_labels`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/056_execution_jobs_environments.ts
 var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Add a per-job bound deployment-environment list to `execution_jobs`:
@@ -4993,19 +5008,19 @@ var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$10(db) {
+async function up$12(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS environments text`.execute(db);
 }
-async function down$10(db) {
+async function down$12(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS environments`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/057_step_concurrency.ts
 var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add parallel step-group concurrency columns to `execution_steps`:
@@ -5028,19 +5043,19 @@ async function colExists$5(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$9(db) {
+async function up$11(db) {
 	if (!await colExists$5(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
 	if (!await colExists$5(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
 }
-async function down$9(db) {
+async function down$11(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS group_id`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS concurrency_kind`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/058_access_log_agent_label.ts
 var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add `access_log.agent_label text` — the human-set name of the agent that
@@ -5060,17 +5075,17 @@ async function colExists$4(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$8(db) {
+async function up$10(db) {
 	if (!await colExists$4(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
 }
-async function down$8(db) {
+async function down$10(db) {
 	await sql`ALTER TABLE public.access_log DROP COLUMN IF EXISTS agent_label`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/059_attestation_verdict.ts
 var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add server-side verification verdict columns to `attestations`, plus the
@@ -5097,7 +5112,7 @@ async function colExists$3(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$7(db) {
+async function up$9(db) {
 	if (await colExists$3(db, "attestations", "verify_status")) return;
 	await sql`
     ALTER TABLE public.attestations
@@ -5110,7 +5125,7 @@ async function up$7(db) {
 	await sql`CREATE INDEX idx_attestations_verify_status ON public.attestations (verify_status)`.execute(db);
 	await sql`CREATE INDEX idx_attestations_created_at ON public.attestations (created_at)`.execute(db);
 }
-async function down$7(db) {
+async function down$9(db) {
 	await sql`DROP INDEX IF EXISTS idx_attestations_created_at`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_verify_status`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_subject_name`.execute(db);
@@ -5125,8 +5140,8 @@ async function down$7(db) {
 //#endregion
 //#region src/db/migrations/060_run_trigger_actor.ts
 var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Add the triggering-actor columns to `execution_runs`:
@@ -5154,12 +5169,12 @@ async function colExists$2(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$6(db) {
+async function up$8(db) {
 	if (!await colExists$2(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
 	if (!await colExists$2(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
 	if (!await colExists$2(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
 }
-async function down$6(db) {
+async function down$8(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_provider`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_username`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_user_id`.execute(db);
@@ -5167,8 +5182,8 @@ async function down$6(db) {
 //#endregion
 //#region src/db/migrations/061_execution_runs_environment_id.ts
 var _061_execution_runs_environment_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Add `environment_id` to `execution_runs` so environment run-history can be
@@ -5204,7 +5219,7 @@ async function colExists$1(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$5(db) {
+async function up$7(db) {
 	if (!await colExists$1(db, "execution_runs", "environment_id")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN environment_id uuid
@@ -5226,15 +5241,15 @@ async function up$5(db) {
              WHERE e2.type = 'fixed' AND e2.name = er.environment) = 1
   `.execute(db);
 }
-async function down$5(db) {
+async function down$7(db) {
 	await sql`DROP INDEX IF EXISTS idx_execution_runs_environment_id`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS environment_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/062_execution_runs_agent_label.ts
 var _062_execution_runs_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Add the agent-provenance columns to `execution_runs`:
@@ -5259,19 +5274,19 @@ async function colExists(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$4(db) {
+async function up$6(db) {
 	if (!await colExists(db, "execution_runs", "triggered_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN triggered_by_agent_label text`.execute(db);
 	if (!await colExists(db, "execution_runs", "cancelled_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN cancelled_by_agent_label text`.execute(db);
 }
-async function down$4(db) {
+async function down$6(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS triggered_by_agent_label`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancelled_by_agent_label`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/063_access_log_agent_label_index.ts
 var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Index `access_log.agent_label` (column added by migration 058) so the
@@ -5279,17 +5294,17 @@ var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
 * the dashboard "agent name" filter) does an indexed exact-match lookup
 * instead of a scan. Idempotent.
 */
-async function up$3(db) {
+async function up$5(db) {
 	await sql`CREATE INDEX IF NOT EXISTS access_log_agent_label_idx ON public.access_log (agent_label)`.execute(db);
 }
-async function down$3(db) {
+async function down$5(db) {
 	await sql`DROP INDEX IF EXISTS access_log_agent_label_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/064_execution_jobs_skipped_environments.ts
 var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Add the test-run skipped-environment columns to `execution_jobs`:
@@ -5304,13 +5319,13 @@ var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportA
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$2(db) {
+async function up$4(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS skipped_environments text`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS env_warning text`.execute(db);
 }
-async function down$2(db) {
+async function down$4(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS skipped_environments`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
@@ -5319,8 +5334,8 @@ async function down$2(db) {
 //#endregion
 //#region src/db/migrations/065_pending_attestations.ts
 var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * Add the `pending_attestations` deferred-attestation outbox and an idempotency
@@ -5340,7 +5355,7 @@ var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$1(db) {
+async function up$3(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5379,15 +5394,15 @@ async function up$1(db) {
       ON public.attestations (run_id, job_id, subject_digest)
   `.execute(db);
 }
-async function down$1(db) {
+async function down$3(db) {
 	await sql`DROP INDEX IF EXISTS uq_attestations_run_job_subject`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.pending_attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/066_pending_attestations_rejected.ts
 var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * Add `rejected_at` to `pending_attestations`: the terminal-rejection marker for
@@ -5398,14 +5413,14 @@ var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up(db) {
+async function up$2(db) {
 	if (await columnExists(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
       ADD COLUMN rejected_at TIMESTAMPTZ
   `.execute(db);
 }
-async function down(db) {
+async function down$2(db) {
 	if (!await columnExists(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
@@ -5421,6 +5436,117 @@ async function columnExists(db, table, column) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 //#endregion
+//#region src/db/migrations/067_environments_to_contexts.ts
+var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Rename the named-policy object from "environment" to "context" across the
+* orchestrator schema. Data-preserving rename-in-place (never drop/recreate):
+*
+* Tables:
+*  - `environments`               → `contexts`
+*  - `environment_bindings`       → `context_bindings`
+*  - `environment_variables`      → `context_variables`
+*  - `environment_source_overrides` → `context_source_overrides`
+*
+* Columns:
+*  - `context_bindings.environment_id`         → `context_id`
+*  - `context_variables.environment_id`        → `context_id`
+*  - `context_source_overrides.environment_id` → `context_id`
+*  - `held_runs.environment_id`                → `context_id`
+*  - `execution_runs.environment`              → `context`
+*  - `execution_runs.environment_id`           → `context_id`
+*  - `execution_jobs.environments`             → `contexts`
+*  - `execution_jobs.skipped_environments`     → `skipped_contexts`
+*
+* Index:
+*  - `idx_execution_runs_environment_id` → `idx_execution_runs_context_id`
+*
+* Held-run enum values + defaults: `held_runs.queue_type` /
+* `held_runs.trigger_source` default `'environment'` → `'context'` and existing
+* `'environment'` rows are migrated to `'context'` (the `HeldRunQueueType` value
+* rename).
+*
+* Foreign keys and remaining constraints/indexes follow the renamed tables and
+* columns automatically (Postgres references them by identity, not name), so
+* only the one hand-named index above needs an explicit rename.
+*/
+async function up$1(db) {
+	await sql`ALTER TABLE public.environments RENAME TO contexts`.execute(db);
+	await sql`ALTER TABLE public.environment_bindings RENAME TO context_bindings`.execute(db);
+	await sql`ALTER TABLE public.environment_variables RENAME TO context_variables`.execute(db);
+	await sql`ALTER TABLE public.environment_source_overrides RENAME TO context_source_overrides`.execute(db);
+	await sql`ALTER TABLE public.context_bindings RENAME COLUMN environment_id TO context_id`.execute(db);
+	await sql`ALTER TABLE public.context_variables RENAME COLUMN environment_id TO context_id`.execute(db);
+	await sql`ALTER TABLE public.context_source_overrides RENAME COLUMN environment_id TO context_id`.execute(db);
+	await sql`ALTER TABLE public.held_runs RENAME COLUMN environment_id TO context_id`.execute(db);
+	await sql`ALTER TABLE public.execution_runs RENAME COLUMN environment TO context`.execute(db);
+	await sql`ALTER TABLE public.execution_runs RENAME COLUMN environment_id TO context_id`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs RENAME COLUMN environments TO contexts`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs RENAME COLUMN skipped_environments TO skipped_contexts`.execute(db);
+	await sql`ALTER INDEX IF EXISTS idx_execution_runs_environment_id RENAME TO idx_execution_runs_context_id`.execute(db);
+	await sql`UPDATE public.held_runs SET queue_type = 'context' WHERE queue_type = 'environment'`.execute(db);
+	await sql`UPDATE public.held_runs SET trigger_source = 'context' WHERE trigger_source = 'environment'`.execute(db);
+	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'context'`.execute(db);
+	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'context'`.execute(db);
+}
+async function down$1(db) {
+	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'environment'`.execute(db);
+	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'environment'`.execute(db);
+	await sql`UPDATE public.held_runs SET trigger_source = 'environment' WHERE trigger_source = 'context'`.execute(db);
+	await sql`UPDATE public.held_runs SET queue_type = 'environment' WHERE queue_type = 'context'`.execute(db);
+	await sql`ALTER INDEX IF EXISTS idx_execution_runs_context_id RENAME TO idx_execution_runs_environment_id`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs RENAME COLUMN skipped_contexts TO skipped_environments`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs RENAME COLUMN contexts TO environments`.execute(db);
+	await sql`ALTER TABLE public.execution_runs RENAME COLUMN context_id TO environment_id`.execute(db);
+	await sql`ALTER TABLE public.execution_runs RENAME COLUMN context TO environment`.execute(db);
+	await sql`ALTER TABLE public.held_runs RENAME COLUMN context_id TO environment_id`.execute(db);
+	await sql`ALTER TABLE public.context_source_overrides RENAME COLUMN context_id TO environment_id`.execute(db);
+	await sql`ALTER TABLE public.context_variables RENAME COLUMN context_id TO environment_id`.execute(db);
+	await sql`ALTER TABLE public.context_bindings RENAME COLUMN context_id TO environment_id`.execute(db);
+	await sql`ALTER TABLE public.context_source_overrides RENAME TO environment_source_overrides`.execute(db);
+	await sql`ALTER TABLE public.context_variables RENAME TO environment_variables`.execute(db);
+	await sql`ALTER TABLE public.context_bindings RENAME TO environment_bindings`.execute(db);
+	await sql`ALTER TABLE public.contexts RENAME TO environments`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/068_request_idempotency.ts
+var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add the `request_idempotency` claim table: a `request_id`-keyed record that
+* makes run-minting dashboard requests (`run.rerun.request`,
+* `run.manual_schedule.request`) idempotent on the Platform `requestId`. HA
+* coordinator siblings share one orchestrator DB, so when the Platform relay
+* fails over and re-sends the same request to a sibling, the atomic `INSERT …
+* ON CONFLICT DO NOTHING` on `request_id` lets exactly one coordinator win —
+* the loser returns the winner's `new_run_id` instead of minting a second run.
+* Rows are pruned after 1h (far past the ~10s request budget) by the periodic
+* cleanup tick.
+*
+* Idempotent: guarded on table existence.
+*/
+async function up(db) {
+	if (await tableExists(db, "request_idempotency")) return;
+	await db.schema.createTable("request_idempotency").addColumn("request_id", "text", (c) => c.primaryKey()).addColumn("new_run_id", "text", (c) => c.notNull()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).execute();
+	await db.schema.createIndex("idx_request_idempotency_created_at").on("request_idempotency").column("created_at").execute();
+}
+async function down(db) {
+	await db.schema.dropTable("request_idempotency").ifExists().execute();
+}
+async function tableExists(db, table) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.tables
+       WHERE table_schema = 'public' AND table_name = ${table}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -5490,7 +5616,9 @@ function createMigrationProvider() {
 			"063_access_log_agent_label_index": _063_access_log_agent_label_index_exports,
 			"064_execution_jobs_skipped_environments": _064_execution_jobs_skipped_environments_exports,
 			"065_pending_attestations": _065_pending_attestations_exports,
-			"066_pending_attestations_rejected": _066_pending_attestations_rejected_exports
+			"066_pending_attestations_rejected": _066_pending_attestations_rejected_exports,
+			"067_environments_to_contexts": _067_environments_to_contexts_exports,
+			"068_request_idempotency": _068_request_idempotency_exports
 		};
 	} };
 }
@@ -6020,7 +6148,16 @@ const LocalSourceConfigSchema = z.object({
 	repoBasePath: z.string().min(1).refine((p) => path.isAbsolute(p), { message: "repoBasePath must be an absolute path" }),
 	/** Optional network clone base (git:// / http://) for remote agents that do
 	*  not share the orchestrator's filesystem. When unset, file:// is used. */
-	cloneUrlBase: z.string().min(1).optional()
+	cloneUrlBase: z.string().min(1).optional(),
+	/**
+	* In-place profile: the `repoBasePath` IS the operator's real working tree,
+	* so a dispatched run skips the source-pack `__build__` job and each job runs
+	* the tree directly (the agent, under its `KICI_IN_PLACE` profile, uses the
+	* `file://` path as workDir with no clone). Set only by the local dev plane
+	* for a `kici run --local --in-place` run. Only meaningful for `file://`
+	* (no `cloneUrlBase`) local sources on a host-sharing scaler.
+	*/
+	inPlace: z.boolean().optional()
 }).strict();
 //#endregion
 //#region src/cli/commands/local-trigger.ts
@@ -7845,6 +7982,9 @@ const baseSchema = z.object({
 	secretKeyOld: z.string().optional(),
 	secretKeyFileOld: z.string().optional(),
 	bootstrapAdminToken: z.string().optional(),
+	independentSecrets: z.enum(["true", "false"]).default("false").transform((v) => v === "true"),
+	independentIdentity: z.enum(["true", "false"]).default("false").transform((v) => v === "true"),
+	devIdentityKeyFile: z.string().optional(),
 	pgCustomerSecrets: z.enum(["true", "false"]).default("true").transform((v) => v === "true"),
 	agentAuth: z.enum(["token", "none"]).default("token"),
 	agentTokenTtlMs: z.coerce.number().default(36e5),
@@ -7885,6 +8025,23 @@ const baseSchema = z.object({
 	* unless `KICI_TEST_MODE=1`. Production deployments leave this unset.
 	*/
 	testMintDeferAudience: z.string().optional(),
+	/**
+	* **Test-only.** When set (and `KICI_TEST_MODE=1`), the orchestrator forces
+	* the *initial* agent provenance mint to DEFER for any job whose requested
+	* OIDC `audience` equals this value (same as `testMintDeferAudience`), AND the
+	* retrier's later re-mint to TERMINALLY REJECT it — so an E2E can exercise the
+	* `markRejected` → gauge-exclusion → `--include-rejected` re-arm cycle with a
+	* REAL run. Ignored unless `KICI_TEST_MODE=1`. Production leaves this unset.
+	*/
+	testMintRejectAudience: z.string().optional(),
+	/**
+	* **Test-only.** When set (and `KICI_TEST_MODE=1`), `handleRerunRequest`
+	* sleeps this many milliseconds before invoking `onRerun`, so an HA E2E can
+	* make the first coordinator slow enough that the Platform relay fails over
+	* to a sibling — exercising the `requestId` idempotency claim. Ignored unless
+	* `KICI_TEST_MODE=1`. Production deployments leave this unset.
+	*/
+	testRerunDelayMs: z.coerce.number().optional(),
 	eventLogMaxPayloadBytes: z.coerce.number().default(5 * 1024 * 1024),
 	logLevel: z.enum([
 		"debug",
@@ -8055,6 +8212,9 @@ const envDef = defineEnv({
 		secretKeyOld: "KICI_SECRET_KEY_OLD",
 		secretKeyFileOld: "KICI_SECRET_KEY_FILE_OLD",
 		bootstrapAdminToken: "KICI_BOOTSTRAP_ADMIN_TOKEN",
+		independentSecrets: "KICI_INDEPENDENT_SECRETS",
+		independentIdentity: "KICI_INDEPENDENT_IDENTITY",
+		devIdentityKeyFile: "KICI_DEV_IDENTITY_KEY_FILE",
 		pgCustomerSecrets: "KICI_PG_CUSTOMER_SECRETS",
 		agentAuth: "KICI_AGENT_AUTH",
 		agentTokenTtlMs: "KICI_AGENT_TOKEN_TTL_MS",
@@ -8075,6 +8235,8 @@ const envDef = defineEnv({
 		testMode: "KICI_TEST_MODE",
 		testEventFailFirstN: "KICI_TEST_EVENT_FAIL_FIRST_N",
 		testMintDeferAudience: "KICI_TEST_MINT_DEFER_AUDIENCE",
+		testMintRejectAudience: "KICI_TEST_MINT_REJECT_AUDIENCE",
+		testRerunDelayMs: "KICI_TEST_RERUN_DELAY_MS",
 		eventLogMaxPayloadBytes: "KICI_EVENT_LOG_MAX_PAYLOAD_BYTES",
 		logLevel: "KICI_LOG_LEVEL",
 		nodeEnv: "NODE_ENV",
@@ -8765,6 +8927,16 @@ function createProvenanceTrustRoot(opts = {}) {
 	const ttlMs = opts.ttlMs ?? 5 * 6e4;
 	let issuer = opts.issuer ?? null;
 	let cache = null;
+	if (opts.staticJwks) {
+		const staticJwks = opts.staticJwks;
+		return {
+			getIssuer: () => issuer,
+			getJwks: async () => staticJwks,
+			setIssuer: (next) => {
+				issuer = next;
+			}
+		};
+	}
 	async function fetchJwks() {
 		if (!issuer) return null;
 		try {
@@ -9643,7 +9815,7 @@ function registerDiagnoseCommand(program, getClient) {
 * Register the debug-bundle command on the CLI program.
 */
 function registerDebugBundleCommand(program, getClient) {
-	program.command("debug-bundle").description("Generate a diagnostic debug bundle ZIP for troubleshooting").option("-o, --output <path>", "Output ZIP file path", `kici-debug-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}.zip`).option("--log-dir <path>", "Directory with rotated *.log files to include (defaults to $KICI_LOG_DIR)").option("--log-window <hours>", "Hours of log history to include in the bundle", (value) => parseInt(value, 10), 4).option("--fleet", "Collect logs from every node in the cluster (server-side fan-out)").option("--list", "With --fleet: print the fleet topology and exit (no collection)").option("--json", "With --fleet --list: emit the topology as JSON").option("--pick [selectors]", "With --fleet: comma-separated selectors (id/host*/label:k=v); bare flag opens an interactive picker on a TTY").option("--fleet-timeout <seconds>", "Per-node deadline for --fleet", (value) => parseInt(value, 10), 60).action(async (opts) => {
+	program.command("debug-bundle").description("Generate a diagnostic debug bundle ZIP for troubleshooting").addOption(new Option("-o, --output <path>", "Output ZIP file path").default(`kici-debug-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}.zip`, "kici-debug-<timestamp>.zip")).option("--log-dir <path>", "Directory with rotated *.log files to include (defaults to $KICI_LOG_DIR)").option("--log-window <hours>", "Hours of log history to include in the bundle", (value) => parseInt(value, 10), 4).option("--fleet", "Collect logs from every node in the cluster (server-side fan-out)").option("--list", "With --fleet: print the fleet topology and exit (no collection)").option("--json", "With --fleet --list: emit the topology as JSON").option("--pick [selectors]", "With --fleet: comma-separated selectors (id/host*/label:k=v); bare flag opens an interactive picker on a TTY").option("--fleet-timeout <seconds>", "Per-node deadline for --fleet", (value) => parseInt(value, 10), 60).action(async (opts) => {
 		try {
 			const client = getClient();
 			if (opts.fleet) {
@@ -11186,7 +11358,21 @@ var init_windows = __esmMin((() => {
 	init_registry();
 	init_platform_detect();
 	WindowsServiceManager = class {
+		/**
+		* Check whether a Windows service is currently registered.
+		* `sc.exe query` exits non-zero (execSync throws) when the service does
+		* not exist; exit 0 means it exists (possibly pending-delete).
+		*/
+		serviceExists(name) {
+			try {
+				execSync(`sc.exe query ${name}`, { stdio: "pipe" });
+				return true;
+			} catch {
+				return false;
+			}
+		}
 		async install(config) {
+			if (this.serviceExists(config.name)) await this.uninstall(config);
 			const depMeta = getDepMetadata("shawl");
 			const depPath = await ensureDep(depMeta, getCacheDir());
 			const shawlExe = path.join(depPath, depMeta.extractPath);
@@ -15179,7 +15365,7 @@ function registerMaintenanceCommands(program, getClient) {
 	});
 }
 //#endregion
-//#region src/cli/commands/environment.ts
+//#region src/cli/commands/context.ts
 function resolveDirectDbUrl$4(explicit) {
 	return explicit ?? process.env.KICI_DATABASE_URL ?? null;
 }
@@ -15218,9 +15404,9 @@ function summarizePolicy(env) {
 	if (env.minimum_trust) parts.push(`trust=${env.minimum_trust}`);
 	return parts.length === 0 ? "-" : parts.join(" ");
 }
-function printEnvironmentTable(rows) {
+function printContextTable(rows) {
 	if (rows.length === 0) {
-		console.log("No environments found.");
+		console.log("No contexts found.");
 		return;
 	}
 	const header = [
@@ -15240,8 +15426,8 @@ function printEnvironmentTable(rows) {
 	console.log(header.map((h, i) => pad(h, widths[i])).join("  "));
 	for (const row of data) console.log(row.map((c, i) => pad(c, widths[i])).join("  "));
 }
-function printShowEnvironment(res) {
-	const e = res.environment;
+function printShowContext(res) {
+	const e = res.context;
 	console.log(`id:      ${e.id}`);
 	console.log(`org:     ${e.org_id}`);
 	console.log(`name:    ${e.name}`);
@@ -15260,9 +15446,9 @@ function printShowEnvironment(res) {
 		}
 	} else console.log("bindings: none");
 }
-function registerEnvironmentCommands(program, getClient) {
-	const env = program.command("environment").description("Environment management (dual-mode)");
-	env.command("create").description("Upsert an environment (idempotent by org+name)").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Environment name").option("--type <t>", "Environment type (fixed|glob|template)", "fixed").option("--glob-pattern <pattern>", "Glob pattern matched against declared environment names (required with --type glob)").option("--enabled <bool>", "Enabled flag (true|false)", "true").option("--branch-restrictions <json>", "JSON array of allowed branches (e.g. '[\"main\"]')").option("--required-reviewers <csv>", "CSV of required reviewer user IDs (or empty to clear)").option("--wait-timer <seconds>", "Wait timer before release (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+function registerContextCommands(program, getClient) {
+	const env = program.command("context").description("Context management (dual-mode)");
+	env.command("create").description("Upsert a context (idempotent by org+name)").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Context name").option("--type <t>", "Context type (fixed|glob|template)", "fixed").option("--glob-pattern <pattern>", "Glob pattern matched against declared context names (required with --type glob)").option("--enabled <bool>", "Enabled flag (true|false)", "true").option("--branch-restrictions <json>", "JSON array of allowed branches (e.g. '[\"main\"]')").option("--required-reviewers <csv>", "CSV of required reviewer user IDs (or empty to clear)").option("--wait-timer <seconds>", "Wait timer before release (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			if (opts.type === "glob" && !opts.globPattern) throw new Error("--type glob requires --glob-pattern <pattern>");
 			if (opts.type !== "glob" && opts.globPattern !== void 0) throw new Error("--glob-pattern requires --type glob");
@@ -15284,40 +15470,40 @@ function registerEnvironmentCommands(program, getClient) {
 				minimumTrust: opts.minimumTrust
 			};
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
-			const result = dbUrl ? await seedEnvironmentDirect(dbUrl, payload) : await getClient().post("/api/v1/admin/environments", payload);
+			const result = dbUrl ? await seedContextDirect(dbUrl, payload) : await getClient().post("/api/v1/admin/contexts", payload);
 			if (opts.json) console.log(JSON.stringify(result));
-			else console.log(`environment create: envId=${result.envId} created=${result.created}${dbUrl ? " (direct)" : ""}`);
+			else console.log(`context create: envId=${result.envId} created=${result.created}${dbUrl ? " (direct)" : ""}`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
 		}
 	});
-	env.command("bind").description("Upsert an environment_bindings row (scope_pattern → environment)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Environment name").requiredOption("--scope <pattern>", "Scope pattern (e.g. \"staging\" or \"aws/prod/**\")").option("--host <pattern>", "Host selector (exact/glob/regex over agentId/host/labels); \"**\" = all hosts", "**").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("bind").description("Upsert a context_bindings row (scope_pattern → context)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Context name").requiredOption("--scope <pattern>", "Scope pattern (e.g. \"staging\" or \"aws/prod/**\")").option("--host <pattern>", "Host selector (exact/glob/regex over agentId/host/labels); \"**\" = all hosts", "**").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
 			const payload = {
 				orgId: opts.org,
-				envName: opts.env,
+				contextName: opts.env,
 				scopePattern: opts.scope,
 				hostPattern: opts.host
 			};
-			const result = dbUrl ? await seedEnvironmentBindingDirect(dbUrl, payload) : await getClient().post(`/api/v1/admin/environments/${encodeURIComponent(opts.env)}/bind`, {
+			const result = dbUrl ? await seedContextBindingDirect(dbUrl, payload) : await getClient().post(`/api/v1/admin/contexts/${encodeURIComponent(opts.env)}/bind`, {
 				orgId: opts.org,
 				scopePattern: opts.scope,
 				hostPattern: opts.host
 			});
 			if (opts.json) console.log(JSON.stringify(result));
-			else console.log(`environment bind: created=${result.created}${dbUrl ? " (direct)" : ""}`);
+			else console.log(`context bind: created=${result.created}${dbUrl ? " (direct)" : ""}`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
 		}
 	});
-	env.command("set-policy").description("Update policy fields on an environment (only provided fields change)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Environment name").option("--branch-restrictions <json>", "JSON array of allowed branches").option("--required-reviewers <csv>", "CSV of required reviewer user IDs (empty to clear)").option("--wait-timer <seconds>", "Wait timer before release (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted, or \"null\" to clear)").option("--enabled <bool>", "Enabled flag (true|false)").option("--allow-local-execution <bool>", "Allow CLI/test runs to resolve this env (true|false)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("set-policy").description("Update policy fields on a context (only provided fields change)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Context name").option("--branch-restrictions <json>", "JSON array of allowed branches").option("--required-reviewers <csv>", "CSV of required reviewer user IDs (empty to clear)").option("--wait-timer <seconds>", "Wait timer before release (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted, or \"null\" to clear)").option("--enabled <bool>", "Enabled flag (true|false)").option("--allow-local-execution <bool>", "Allow CLI/test runs to resolve this env (true|false)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const payload = {
 				orgId: opts.org,
-				envName: opts.env
+				contextName: opts.env
 			};
 			if (opts.branchRestrictions !== void 0) payload.branchRestrictions = parseJsonOption(opts.branchRestrictions, "--branch-restrictions");
 			if (opts.requiredReviewers !== void 0) payload.requiredReviewers = parseCsvOption(opts.requiredReviewers);
@@ -15327,73 +15513,73 @@ function registerEnvironmentCommands(program, getClient) {
 			if (opts.enabled !== void 0) payload.enabled = opts.enabled === "false" ? false : true;
 			if (opts.allowLocalExecution !== void 0) payload.allowLocalExecution = opts.allowLocalExecution === "false" ? false : true;
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
-			if (dbUrl) await setEnvironmentPolicyDirect(dbUrl, payload);
-			else await getClient().patch(`/api/v1/admin/environments/${encodeURIComponent(opts.env)}/policy`, payload);
+			if (dbUrl) await setContextPolicyDirect(dbUrl, payload);
+			else await getClient().patch(`/api/v1/admin/contexts/${encodeURIComponent(opts.env)}/policy`, payload);
 			if (opts.json) console.log(JSON.stringify({ updated: true }));
-			else console.log(`environment set-policy: updated (env=${opts.env})${dbUrl ? " (direct)" : ""}`);
+			else console.log(`context set-policy: updated (env=${opts.env})${dbUrl ? " (direct)" : ""}`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
 		}
 	});
-	env.command("list").description("List environments for an org").requiredOption("--org <id>", "Org ID").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("list").description("List contexts for an org").requiredOption("--org <id>", "Org ID").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
-			const result = dbUrl ? await listEnvironmentsDirect(dbUrl, { orgId: opts.org }) : await getClient().get(`/api/v1/admin/environments?orgId=${encodeURIComponent(opts.org)}`);
+			const result = dbUrl ? await listContextsDirect(dbUrl, { orgId: opts.org }) : await getClient().get(`/api/v1/admin/contexts?orgId=${encodeURIComponent(opts.org)}`);
 			if (opts.json) console.log(JSON.stringify(result));
-			else printEnvironmentTable(result.environments);
+			else printContextTable(result.contexts);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
 		}
 	});
-	env.command("show").description("Show a single environment with variables + bindings").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Environment name").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("show").description("Show a single context with variables + bindings").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Context name").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
-			const result = dbUrl ? await showEnvironmentDirect(dbUrl, {
+			const result = dbUrl ? await showContextDirect(dbUrl, {
 				orgId: opts.org,
 				name: opts.name
-			}) : await getClient().get(`/api/v1/admin/environments/${encodeURIComponent(opts.name)}?orgId=${encodeURIComponent(opts.org)}`);
+			}) : await getClient().get(`/api/v1/admin/contexts/${encodeURIComponent(opts.name)}?orgId=${encodeURIComponent(opts.org)}`);
 			if (opts.json) console.log(JSON.stringify(result));
-			else printShowEnvironment(result);
+			else printShowContext(result);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
 		}
 	});
-	env.command("delete").description("Delete an environment (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Environment name").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("delete").description("Delete a context (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)").requiredOption("--org <id>", "Org ID").requiredOption("--name <name>", "Context name").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
 			let deleted;
-			if (dbUrl) ({deleted} = await deleteEnvironmentDirect(dbUrl, {
+			if (dbUrl) ({deleted} = await deleteContextDirect(dbUrl, {
 				orgId: opts.org,
 				name: opts.name
 			}));
-			else deleted = (await getClient().delete(`/api/v1/admin/environments/${encodeURIComponent(opts.name)}?orgId=${encodeURIComponent(opts.org)}`)).deleted;
-			if (!deleted) throw new Error(`environment not found (org=${opts.org}, name=${opts.name})`);
+			else deleted = (await getClient().delete(`/api/v1/admin/contexts/${encodeURIComponent(opts.name)}?orgId=${encodeURIComponent(opts.org)}`)).deleted;
+			if (!deleted) throw new Error(`context not found (org=${opts.org}, name=${opts.name})`);
 			if (opts.json) console.log(JSON.stringify({ deleted: true }));
-			else console.log(`environment delete: deleted=true${dbUrl ? " (direct)" : ""}`);
+			else console.log(`context delete: deleted=true${dbUrl ? " (direct)" : ""}`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
 		}
 	});
-	env.command("purge").description("Delete all environments (and held runs) for an org — direct-DB break-glass / warm-start reset").option("--database-url <url>", "Use direct DB access (or KICI_DATABASE_URL)").option("--org <id>", "Restrict purge to a single org (omit to purge all orgs)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("purge").description("Delete all contexts (and held runs) for an org — direct-DB break-glass / warm-start reset").option("--database-url <url>", "Use direct DB access (or KICI_DATABASE_URL)").option("--org <id>", "Restrict purge to a single org (omit to purge all orgs)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
 			if (!dbUrl) {
 				console.error("Error: --database-url or KICI_DATABASE_URL is required (direct-DB only)");
 				process.exit(1);
 			}
-			const result = await purgeEnvironmentsDirect(dbUrl, opts.org);
+			const result = await purgeContextsDirect(dbUrl, opts.org);
 			if (opts.json) console.log(JSON.stringify(result));
-			else console.log(`environment purge: environmentsDeleted=${result.environmentsDeleted} heldRunsDeleted=${result.heldRunsDeleted}` + (opts.org ? ` (org ${opts.org})` : " (all orgs)"));
+			else console.log(`context purge: contextsDeleted=${result.contextsDeleted} heldRunsDeleted=${result.heldRunsDeleted}` + (opts.org ? ` (org ${opts.org})` : " (all orgs)"));
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
 		}
 	});
-	env.command("create-template").description("Create or update an environment template + its seed variables").requiredOption("--org <id>", "Org ID").requiredOption("--template <name>", "Template name").option("--type <t>", "Environment type (defaults to \"template\")", "template").option("--branch-restrictions <json>", "JSON array of allowed branches").option("--required-reviewers <csv>", "CSV of required reviewer user IDs").option("--wait-timer <seconds>", "Wait timer (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted)").option("--variables <json>", "JSON object of env variables to seed (e.g. '{\"K\":\"V\"}')").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("create-template").description("Create or update a context template + its seed variables").requiredOption("--org <id>", "Org ID").requiredOption("--template <name>", "Template name").option("--type <t>", "Context type (defaults to \"template\")", "template").option("--branch-restrictions <json>", "JSON array of allowed branches").option("--required-reviewers <csv>", "CSV of required reviewer user IDs").option("--wait-timer <seconds>", "Wait timer (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted)").option("--variables <json>", "JSON object of env variables to seed (e.g. '{\"K\":\"V\"}')").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const branchRestrictions = parseJsonOption(opts.branchRestrictions, "--branch-restrictions");
 			const requiredReviewers = parseCsvOption(opts.requiredReviewers);
@@ -15413,9 +15599,9 @@ function registerEnvironmentCommands(program, getClient) {
 				variables
 			};
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
-			const result = dbUrl ? await createEnvironmentTemplateDirect(dbUrl, payload) : await getClient().post("/api/v1/admin/environments/templates", payload);
+			const result = dbUrl ? await createContextTemplateDirect(dbUrl, payload) : await getClient().post("/api/v1/admin/contexts/templates", payload);
 			if (opts.json) console.log(JSON.stringify(result));
-			else console.log(`environment create-template: envId=${result.envId} created=${result.created} variablesSet=${result.variablesSet}${dbUrl ? " (direct)" : ""}`);
+			else console.log(`context create-template: envId=${result.envId} created=${result.created} variablesSet=${result.variablesSet}${dbUrl ? " (direct)" : ""}`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
@@ -15425,12 +15611,12 @@ function registerEnvironmentCommands(program, getClient) {
 //#endregion
 //#region src/cli/commands/variable.ts
 function registerVariableCommands(program, getClient) {
-	const vr = program.command("variable").description("Manage environment variables");
-	vr.command("list <orgId> <environment>").description("List org-level variables in an environment").option("--values", "Print variable values inline (default: keys + locked flag only)").action(async (orgId, environment, opts) => {
+	const vr = program.command("variable").description("Manage context variables");
+	vr.command("list <orgId> <context>").description("List org-level variables in a context").option("--values", "Print variable values inline (default: keys + locked flag only)").action(async (orgId, context, opts) => {
 		try {
-			const { variables } = await getClient().listVariables(orgId, environment);
+			const { variables } = await getClient().listVariables(orgId, context);
 			if (variables.length === 0) {
-				console.log("No variables in this environment.");
+				console.log("No variables in this context.");
 				return;
 			}
 			for (const v of variables) {
@@ -15443,12 +15629,12 @@ function registerVariableCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	vr.command("get <orgId> <environment> <key>").description("Print the value of a single variable").action(async (orgId, environment, key) => {
+	vr.command("get <orgId> <context> <key>").description("Print the value of a single variable").action(async (orgId, context, key) => {
 		try {
-			const { variables } = await getClient().listVariables(orgId, environment);
+			const { variables } = await getClient().listVariables(orgId, context);
 			const match = variables.find((v) => v.key === key);
 			if (!match) {
-				console.error(`Variable '${key}' not found in environment '${environment}'.`);
+				console.error(`Variable '${key}' not found in context '${context}'.`);
 				process.exit(1);
 			}
 			console.log(match.value);
@@ -15457,31 +15643,31 @@ function registerVariableCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	vr.command("set <orgId> <environment> <key>").description("Set an environment variable. Value comes from one of: --prompt (default on TTY), --from-stdin (default on pipe), --from-file <path>, --from-env <VAR>, --value <plaintext> (discouraged).").option("--value <value>", "Variable value via argv (visible in shell history)").option("--prompt", "Interactive no-echo prompt (requires TTY)").option("--from-stdin", "Read value from piped stdin until EOF").option("--from-file <path>", "Read value from a file (trailing newline trimmed)").option("--from-env <var>", "Read value from a named environment variable").option("--no-trim", "When reading --from-file, keep the trailing newline (default: trim once)").option("--locked", "Mark the variable as locked (source overrides cannot replace it)").option("--confirm-fingerprint <sha256hex>", "Refuse the write unless SHA-256(value) matches this 64-hex string").option("--dry-run", "Parse + validate the value, print fingerprint + length, do not write").action(async (orgId, environment, key, opts) => {
+	vr.command("set <orgId> <context> <key>").description("Set a context variable. Value comes from one of: --prompt (default on TTY), --from-stdin (default on pipe), --from-file <path>, --from-env <VAR>, --value <plaintext> (discouraged).").option("--value <value>", "Variable value via argv (visible in shell history)").option("--prompt", "Interactive no-echo prompt (requires TTY)").option("--from-stdin", "Read value from piped stdin until EOF").option("--from-file <path>", "Read value from a file (trailing newline trimmed)").option("--from-env <var>", "Read value from a named environment variable").option("--no-trim", "When reading --from-file, keep the trailing newline (default: trim once)").option("--locked", "Mark the variable as locked (source overrides cannot replace it)").option("--confirm-fingerprint <sha256hex>", "Refuse the write unless SHA-256(value) matches this 64-hex string").option("--dry-run", "Parse + validate the value, print fingerprint + length, do not write").action(async (orgId, context, key, opts) => {
 		try {
 			const { value, source } = await resolveSecretInput(opts);
 			if (opts.dryRun) {
-				console.log(`[dry-run] would set variable '${key}' in environment '${environment}' for org ${orgId} (${value.length} chars, source=${source}, locked=${Boolean(opts.locked)}, sha256=${fingerprintValue(value)})`);
+				console.log(`[dry-run] would set variable '${key}' in context '${context}' for org ${orgId} (${value.length} chars, source=${source}, locked=${Boolean(opts.locked)}, sha256=${fingerprintValue(value)})`);
 				return;
 			}
-			await getClient().setVariable(orgId, environment, key, value, opts.locked);
+			await getClient().setVariable(orgId, context, key, value, opts.locked);
 			const lockTag = opts.locked ? " [locked]" : "";
-			console.log(`Variable '${key}' set in environment '${environment}' for org ${orgId}${lockTag}.`);
+			console.log(`Variable '${key}' set in context '${context}' for org ${orgId}${lockTag}.`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
 		}
 	});
-	vr.command("delete <orgId> <environment> <key>").description("Delete an environment variable").option("--yes", "Skip confirmation prompt").action(async (orgId, environment, key, opts) => {
+	vr.command("delete <orgId> <context> <key>").description("Delete a context variable").option("--yes", "Skip confirmation prompt").action(async (orgId, context, key, opts) => {
 		try {
 			if (!opts.yes) {
-				if (!await confirm$1(`Are you sure you want to delete variable '${key}' from environment '${environment}'?`)) {
+				if (!await confirm$1(`Are you sure you want to delete variable '${key}' from context '${context}'?`)) {
 					console.log("Aborted.");
 					return;
 				}
 			}
-			await getClient().deleteVariable(orgId, environment, key);
-			console.log(`Variable '${key}' deleted from environment '${environment}' for org ${orgId}.`);
+			await getClient().deleteVariable(orgId, context, key);
+			console.log(`Variable '${key}' deleted from context '${context}' for org ${orgId}.`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
@@ -15620,7 +15806,7 @@ function printRunsTable(runs) {
 		r.workflow_name,
 		r.status,
 		r.routing_key ?? "-",
-		r.environment ?? "-",
+		r.context ?? "-",
 		String(r.created_at)
 	]);
 	const widths = header.map((h, i) => Math.max(h.length, ...rows.map((row) => row[i].length)));
@@ -15637,7 +15823,7 @@ function printRunShow(run, jobs) {
 	console.log(`ref:        ${run.ref}`);
 	console.log(`sha:        ${run.sha}`);
 	console.log(`routing:    ${run.routing_key ?? "-"}`);
-	console.log(`env:        ${run.environment ?? "-"}`);
+	console.log(`env:        ${run.context ?? "-"}`);
 	console.log(`created_at: ${run.created_at}`);
 	if (run.completed_at) console.log(`completed:  ${run.completed_at}`);
 	if (run.duration_ms !== null) console.log(`duration:   ${run.duration_ms}ms`);
@@ -21296,7 +21482,7 @@ function buildProgram() {
 	registerClusterNameCommands(program, getClient);
 	registerClusterCommands(program);
 	registerMaintenanceCommands(program, getClient);
-	registerEnvironmentCommands(program, getClient);
+	registerContextCommands(program, getClient);
 	registerVariableCommands(program, getClient);
 	registerQueueCommands(program, getClient);
 	registerExecutionCommands(program, getClient);