@kici-dev/orchestrator 0.1.3 → 0.1.6

package/dist/cli.js

@@ -5,13 +5,16 @@ __cjs_dirname(__cjs_fileURLToPath(import.meta.url));
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { BaseColdStore, ChunkLru, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, decodeChunk, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
+import * as fs$1 from "node:fs";
+import fs, { createWriteStream, promises, readFileSync } from "node:fs";
+import crypto, { createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { createInterface } from "node:readline";
 import { readFile, writeFile } from "node:fs/promises";
 import { stringify } from "yaml";
-import crypto, { createDecipheriv, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
 import "node:os";
 import os from "node:os";
+import { getDatabaseCollationDrift, refreshDatabaseCollationVersion, reindexDatabaseConcurrently } from "@kici-dev/shared/db-collation";
 import { sql } from "kysely";
 import { Migrator } from "kysely/migration";
 import "jsonpath-plus";
@@ -19,13 +22,13 @@ import { execFile, execFileSync, execSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import * as path$1 from "node:path";
 import path from "node:path";
-import * as fs$1 from "node:fs";
-import fs, { createWriteStream, readFileSync } from "node:fs";
 import archiver from "archiver";
 import JSZip from "jszip";
 import { confirm, input, password, select } from "@inquirer/prompts";
 import { pipeline } from "node:stream/promises";
 import "pg";
+import { DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DashboardWriteCategory, DashboardWriteSensitivity } from "@kici-dev/engine/protocol/dashboard-write-operations";
+import { CLUSTER_NAME_FORMAT_MESSAGE } from "@kici-dev/engine/protocol/cluster-name";
 import { TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, getAccessLogColdDays, getSecretAuditLogColdDays, minAccessLogWarmDays, minSecretAuditLogWarmDays, secretAuditLogWarmSqlCase } from "@kici-dev/engine";
 var __defProp = Object.defineProperty;
 var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -92,6 +95,12 @@ var AdminApiClient = class {
 		return this.request("PATCH", path, body);
 	}
 	/**
+	* Public PUT request returning parsed JSON.
+	*/
+	async put(path, body) {
+		return this.request("PUT", path, body);
+	}
+	/**
 	* Public DELETE request returning parsed JSON.
 	*/
 	async delete(path) {
@@ -125,6 +134,21 @@ var AdminApiClient = class {
 	async deleteSecret(orgId, scope, key) {
 		return this.request("DELETE", `/api/v1/admin/secrets/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}/${encodeURIComponent(key)}`);
 	}
+	async listVariables(orgId, environment) {
+		const params = new URLSearchParams({ orgId });
+		return this.request("GET", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables?${params}`);
+	}
+	async setVariable(orgId, environment, key, value, locked) {
+		const params = new URLSearchParams({ orgId });
+		return this.request("PUT", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables/${encodeURIComponent(key)}?${params}`, {
+			value,
+			locked
+		});
+	}
+	async deleteVariable(orgId, environment, key) {
+		const params = new URLSearchParams({ orgId });
+		return this.request("DELETE", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables/${encodeURIComponent(key)}?${params}`);
+	}
 	async rotateKey() {
 		return this.request("POST", "/api/v1/admin/rotate-key");
 	}
@@ -384,6 +408,140 @@ var AdminApiClient = class {
 	}
 };
 //#endregion
+//#region src/cli/commands/shared/secret-input.ts
+/**
+* Shared input-mode helper for `kici-admin secret set` and
+* `kici-admin variable set`.
+*
+* Resolves a value from exactly one of:
+*   --value <plaintext>   — argv literal (warned; goes into shell history)
+*   --prompt              — interactive no-echo prompt (TTY only)
+*   --from-stdin          — pipe (full stdin until EOF)
+*   --from-file <path>    — file contents (--trim default-on)
+*   --from-env  <VAR>     — env var contents
+*
+* Default-mode resolution when no flag is provided:
+*   TTY     -> --prompt
+*   non-TTY -> --from-stdin
+*
+* Optional checks:
+*   --confirm-fingerprint <hex>  — SHA-256 fingerprint guard against
+*     paste corruption.
+*
+* The helper does NOT print to stdout (it returns the value). It DOES
+* write to stderr for the `--value` warning, the prompt label, and any
+* "empty value" warning. Stdout is reserved for the caller's confirmation
+* output so the caller's `--dry-run` summary stays clean.
+*/
+const INPUT_MODE_FLAGS = [
+	"value",
+	"fromStdin",
+	"fromFile",
+	"fromEnv",
+	"prompt"
+];
+const FINGERPRINT_RE = /^[0-9a-f]{64}$/i;
+async function resolveSecretInput(opts, stderr = process.stderr, stdin = process.stdin) {
+	const explicit = INPUT_MODE_FLAGS.filter((flag) => {
+		const v = opts[flag];
+		return v !== void 0 && v !== false;
+	});
+	if (explicit.length > 1) throw new Error(`Ambiguous input mode: pick exactly one of --value, --from-stdin, --from-file, --from-env, --prompt (got: ${explicit.map((f) => "--" + f.replace(/[A-Z]/g, (m) => "-" + m.toLowerCase())).join(", ")}).`);
+	let result;
+	if (opts.value !== void 0) {
+		stderr.write("warning: --value puts the secret in shell history. Prefer --prompt, --from-stdin, --from-env, or --from-file.\n");
+		result = {
+			value: opts.value,
+			source: "value"
+		};
+	} else if (opts.fromEnv !== void 0) {
+		const envValue = process.env[opts.fromEnv];
+		if (envValue === void 0) throw new Error(`--from-env ${opts.fromEnv}: environment variable is not set.`);
+		result = {
+			value: envValue,
+			source: "env"
+		};
+	} else if (opts.fromFile !== void 0) {
+		const raw = await promises.readFile(opts.fromFile, "utf8");
+		result = {
+			value: opts.trim === false ? raw : raw.replace(/\r?\n$/, ""),
+			source: "file"
+		};
+	} else if (opts.prompt) {
+		if (!stdin.isTTY) throw new Error("--prompt requires a TTY; use --from-stdin to read piped input.");
+		result = {
+			value: await promptSecret$1(stderr, stdin),
+			source: "prompt"
+		};
+	} else if (opts.fromStdin) {
+		if (stdin.isTTY) throw new Error("--from-stdin requires piped input (no TTY); pipe the value in or use --prompt to enter interactively.");
+		result = {
+			value: await readAllStdin(stdin),
+			source: "stdin"
+		};
+	} else if (stdin.isTTY) result = {
+		value: await promptSecret$1(stderr, stdin),
+		source: "prompt"
+	};
+	else result = {
+		value: await readAllStdin(stdin),
+		source: "stdin"
+	};
+	if (result.value.length === 0) stderr.write("warning: value is empty.\n");
+	if (opts.confirmFingerprint !== void 0) {
+		if (!FINGERPRINT_RE.test(opts.confirmFingerprint)) throw new Error("--confirm-fingerprint must be a SHA-256 hex string (64 lowercase hex characters).");
+		const actual = createHash("sha256").update(result.value, "utf8").digest("hex");
+		if (actual !== opts.confirmFingerprint.toLowerCase()) throw new Error(`--confirm-fingerprint mismatch: expected ${opts.confirmFingerprint.toLowerCase()}, got ${actual}. Value not written.`);
+	}
+	return result;
+}
+async function readAllStdin(stdin) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		stdin.on("data", (chunk) => {
+			chunks.push(typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk);
+		});
+		stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "")));
+		stdin.on("error", reject);
+	});
+}
+async function promptSecret$1(stderr, stdin) {
+	const { createInterface } = await import("node:readline");
+	const rl = createInterface({
+		input: stdin,
+		output: stderr
+	});
+	if (stdin.setRawMode) stdin.setRawMode(true);
+	return new Promise((resolve) => {
+		stderr.write("Enter value: ");
+		let value = "";
+		function onData(chunk) {
+			const str = chunk.toString("utf8");
+			for (const char of str) if (char === "\n" || char === "\r") {
+				stdin.removeListener("data", onData);
+				if (stdin.setRawMode) stdin.setRawMode(false);
+				stderr.write("\n");
+				rl.close();
+				resolve(value);
+				return;
+			} else if (char === "" || char === "\b") value = value.slice(0, -1);
+			else if (char === "") {
+				stderr.write("\n");
+				process.exit(1);
+			} else value += char;
+		}
+		stdin.on("data", onData);
+	});
+}
+/**
+* Compute the canonical SHA-256 fingerprint for a value. Helper for
+* callers (tests, --dry-run output) that want to display the same hex
+* the user would pass to `--confirm-fingerprint`.
+*/
+function fingerprintValue(value) {
+	return createHash("sha256").update(value, "utf8").digest("hex");
+}
+//#endregion
 //#region src/cli/commands/secret.ts
 function resolveDirectDbUrl$9(explicit) {
 	return explicit ?? process.env.KICI_DATABASE_URL ?? null;
@@ -416,7 +574,7 @@ function registerSecretCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	sec.command("set [orgId] [scope] [key]").description("Set a secret value. Positional form: \"set <orgId> <scope> <key>\". Sugar form (environment scope): \"set --org <id> --environment <env> --key <k>\". Value is read from stdin if piped, from --value, or prompted interactively.").option("--value <value>", "Secret value (reads from stdin or prompts if omitted)").option("--org <orgId>", "Org ID (use with --environment + --key; mutually exclusive with positional form)").option("--environment <name>", "Environment scope — sugar for positional <scope>. Requires --org and --key.").option("--key <key>", "Secret key name (use with --org + --environment)").option("--from-stdin", "Read value from stdin (required when piping but no TTY)").option("--database-url <url>", "Direct-DB mode: write encrypted_value verbatim to scoped_secrets (offline; skips HTTP + encryption)").action(async (posOrgId, posScope, posKey, opts) => {
+	sec.command("set [orgId] [scope] [key]").description("Set a secret value. Positional form: \"set <orgId> <scope> <key>\". Sugar form (environment scope): \"set --org <id> --environment <env> --key <k>\". Value comes from one of: --prompt (default on TTY), --from-stdin (default on pipe), --from-file <path>, --from-env <VAR>, --value <plaintext> (discouraged).").option("--value <value>", "Secret value via argv (visible in shell history; prefer --prompt)").option("--org <orgId>", "Org ID (use with --environment + --key; mutually exclusive with positional form)").option("--environment <name>", "Environment scope — sugar for positional <scope>. Requires --org and --key.").option("--key <key>", "Secret key name (use with --org + --environment)").option("--prompt", "Interactive no-echo prompt (requires TTY)").option("--from-stdin", "Read value from piped stdin until EOF").option("--from-file <path>", "Read value from a file (trailing newline trimmed)").option("--from-env <var>", "Read value from a named environment variable").option("--no-trim", "When reading --from-file, keep the trailing newline (default: trim once)").option("--confirm-fingerprint <sha256hex>", "Refuse the write unless SHA-256(value) matches this 64-hex string").option("--dry-run", "Parse + validate the value, print fingerprint + length, do not write").option("--database-url <url>", "Direct-DB mode: write encrypted_value verbatim to scoped_secrets (offline; skips HTTP + encryption)").action(async (posOrgId, posScope, posKey, opts) => {
 		try {
 			const hasPositional = Boolean(posOrgId || posScope || posKey);
 			const hasSugar = Boolean(opts.org || opts.environment || opts.key);
@@ -437,9 +595,11 @@ function registerSecretCommands(program, getClient) {
 				scope = posScope;
 				key = posKey;
 			}
-			let value = opts.value;
-			if (opts.fromStdin) value = await readPipedStdin();
-			else if (value === void 0) value = await readSecretValue();
+			const { value, source } = await resolveSecretInput(opts);
+			if (opts.dryRun) {
+				console.log(`[dry-run] would set secret '${key}' in scope '${scope}' for org ${orgId} (${value.length} chars, source=${source}, sha256=${fingerprintValue(value)})`);
+				return;
+			}
 			const dbUrl = resolveDirectDbUrl$9(opts.databaseUrl);
 			if (dbUrl) {
 				await setEnvironmentSecretDirect(dbUrl, {
@@ -461,7 +621,7 @@ function registerSecretCommands(program, getClient) {
 	sec.command("delete <orgId> <scope> <key>").description("Delete a secret").option("--yes", "Skip confirmation prompt").action(async (orgId, scope, key, opts) => {
 		try {
 			if (!opts.yes) {
-				if (!await confirm$3(`Are you sure you want to delete secret '${key}' from scope '${scope}'?`)) {
+				if (!await confirm$4(`Are you sure you want to delete secret '${key}' from scope '${scope}'?`)) {
 					console.log("Aborted.");
 					return;
 				}
@@ -474,63 +634,7 @@ function registerSecretCommands(program, getClient) {
 		}
 	});
 }
-/**
-* Read all of piped stdin as a string, trimmed. Throws if stdin is a TTY
-* (no pipe attached). Used by `--from-stdin` in scripted callers (E2E,
-* deploy scripts) that want deterministic piping semantics.
-*/
-async function readPipedStdin() {
-	if (process.stdin.isTTY) throw new Error("--from-stdin requires piped input (no TTY); pipe the value in or omit the flag to prompt.");
-	return new Promise((resolve, reject) => {
-		const chunks = [];
-		process.stdin.on("data", (chunk) => chunks.push(chunk));
-		process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString().trim()));
-		process.stdin.on("error", reject);
-	});
-}
-/**
-* Read a secret value from stdin (pipe) or interactive prompt.
-*
-* - If stdin is piped, reads the entire input as the value.
-* - If stdin is a TTY, prompts for the value with hidden input.
-*/
-async function readSecretValue() {
-	if (!process.stdin.isTTY) return new Promise((resolve, reject) => {
-		const chunks = [];
-		process.stdin.on("data", (chunk) => chunks.push(chunk));
-		process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString().trim()));
-		process.stdin.on("error", reject);
-	});
-	const { createInterface } = await import("node:readline");
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stderr
-	});
-	if (process.stdin.setRawMode) process.stdin.setRawMode(true);
-	return new Promise((resolve) => {
-		process.stderr.write("Enter secret value: ");
-		let value = "";
-		process.stdin.on("data", function onData(chunk) {
-			const str = chunk.toString();
-			for (const char of str) if (char === "\n" || char === "\r") {
-				process.stdin.removeListener("data", onData);
-				if (process.stdin.setRawMode) process.stdin.setRawMode(false);
-				process.stderr.write("\n");
-				rl.close();
-				resolve(value);
-				return;
-			} else if (char === "" || char === "\b") value = value.slice(0, -1);
-			else if (char === "") {
-				process.stderr.write("\n");
-				process.exit(1);
-			} else value += char;
-		});
-	});
-}
-/**
-* Simple confirmation prompt.
-*/
-async function confirm$3(message) {
+async function confirm$4(message) {
 	const { createInterface } = await import("node:readline");
 	const rl = createInterface({
 		input: process.stdin,
@@ -610,7 +714,7 @@ function formatTokenTable(tokens) {
 }
 function registerTokenCommands(program, getClient) {
 	const tok = program.command("token").description("Manage admin API tokens");
-	tok.command("create <label>").description("Create a new admin API token").requiredOption("--role <role>", "Token role (owner, admin, auditor)").option("--routing-key <key>", "Optional routing key scope").action(async (label, opts) => {
+	tok.command("create <label>").description("Create a new admin API token").requiredOption("--role <role>", "Token role (owner, admin, auditor)").option("--routing-key <key>", "Restrict the token to a single source routing key (e.g. \"github:42\"). The token can only act on requests targeting that routing key. Without this, the token has full orchestrator access.").action(async (label, opts) => {
 		try {
 			const result = await getClient().createToken({
 				label,
@@ -1412,8 +1516,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -2105,7 +2209,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$17(db) {
+async function up$22(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2127,7 +2231,7 @@ async function up$17(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$17(db) {
+async function down$22(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2174,8 +2278,8 @@ async function down$17(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -2189,13 +2293,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$16(db) {
+async function up$21(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$16(db) {
+async function down$21(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2204,8 +2308,8 @@ async function down$16(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2229,7 +2333,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$15(db) {
+async function up$20(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2267,28 +2371,28 @@ async function up$15(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$15(db) {
+async function down$20(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$19,
+	up: () => up$19
 });
-async function up$14(db) {
+async function up$19(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$14(db) {
+async function down$19(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Cold-store chunk counter table.
@@ -2305,7 +2409,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$13(db) {
+async function up$18(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2323,14 +2427,14 @@ async function up$13(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$13(db) {
+async function down$18(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -2366,7 +2470,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$12(db) {
+async function up$17(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2411,7 +2515,7 @@ async function up$12(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$12(db) {
+async function down$17(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2436,8 +2540,8 @@ async function down$12(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -2477,7 +2581,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$11(db) {
+async function up$16(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2498,7 +2602,7 @@ async function up$11(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$11(db) {
+async function down$16(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2526,8 +2630,8 @@ async function down$11(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -2565,7 +2669,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$10(db) {
+async function up$15(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2581,7 +2685,7 @@ async function up$10(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$10(db) {
+async function down$15(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2600,8 +2704,8 @@ async function down$10(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -2614,7 +2718,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$9(db) {
+async function up$14(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2623,14 +2727,14 @@ async function up$9(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$9(db) {
+async function down$14(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -2662,7 +2766,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$8(db) {
+async function up$13(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -2689,14 +2793,14 @@ async function up$8(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$8(db) {
+async function down$13(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -2715,11 +2819,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$7(db) {
+async function up$12(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$7(db) {
+async function down$12(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -2758,8 +2862,8 @@ async function down$7(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -2785,7 +2889,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$6(db) {
+async function up$11(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -2803,14 +2907,14 @@ async function up$6(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$6(db) {
+async function down$11(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -2829,7 +2933,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$5(db) {
+async function up$10(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -2839,15 +2943,15 @@ async function up$5(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$5(db) {
+async function down$10(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -2881,7 +2985,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$4(db) {
+async function up$9(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -2912,7 +3016,7 @@ async function up$4(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$4(db) {
+async function down$9(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -2930,8 +3034,8 @@ async function down$4(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -2959,7 +3063,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$3(db) {
+async function up$8(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3084,7 +3188,7 @@ async function up$3(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$3(db) {
+async function down$8(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3109,8 +3213,8 @@ async function down$3(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3123,7 +3227,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$2(db) {
+async function up$7(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3137,7 +3241,7 @@ async function up$2(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$2(db) {
+async function down$7(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3145,8 +3249,8 @@ async function down$2(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -3186,17 +3290,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$1(db) {
+async function up$6(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$1(db) {
+async function down$6(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3213,41 +3317,341 @@ var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
 * `environment_bindings`, `environment_source_overrides`,
 * `environment_variables`).
 *
-* This migration walks both column families — `org_id` and
-* `customer_id` — and applies the same `'org_' || value` prefix to
-* every row whose value is not the platform-admin sentinel
-* `kici-admin`. After it runs, the orchestrator's `WHERE org_id = $1`
-* / `WHERE customer_id = $1` filters match the prefixed canonical IDs
-* that Platform now sends.
+* This migration walks both column families — `org_id` and
+* `customer_id` — and applies the same `'org_' || value` prefix to
+* every row whose value is not the platform-admin sentinel
+* `kici-admin`. After it runs, the orchestrator's `WHERE org_id = $1`
+* / `WHERE customer_id = $1` filters match the prefixed canonical IDs
+* that Platform now sends.
+*
+* Idempotency: the `WHERE NOT LIKE 'org\\_%'` guard makes the
+* migration a no-op on rows already prefixed (e.g. a re-run after a
+* fresh deploy populated some rows already), so applying it twice is
+* safe.
+*/
+const ORG_ID_TABLES = [
+	"access_log",
+	"environment_bindings",
+	"environment_source_overrides",
+	"environment_variables",
+	"environments",
+	"event_log",
+	"held_runs",
+	"scoped_secrets"
+];
+const CUSTOMER_ID_TABLES = [
+	"sources",
+	"generic_webhook_sources",
+	"workflow_registrations",
+	"org_settings"
+];
+async function up$5(db) {
+	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
+	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
+}
+async function down$5(db) {
+	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
+	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
+}
+//#endregion
+//#region src/db/migrations/019_generic_sources_change_notify.ts
+var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* Add a Postgres trigger on `generic_webhook_sources` that emits
+* `pg_notify('generic_sources_change', routing_key)` on every INSERT,
+* UPDATE, and DELETE. Soft-deletes (UPDATE that sets `deleted_at`) ride
+* the same UPDATE path — the listener treats a row with `deleted_at IS
+* NOT NULL` (or a row that no longer exists for that routing_key) as a
+* de-registration signal.
+*
+* The consumer is `GenericSourcesChangeListener`
+* (`packages/orchestrator/src/webhook/generic-sources-listener.ts`),
+* which runs in every orchestrator peer, LISTENs on the channel, and
+* mutates the local `ProviderRegistry` in place
+* (`registerProviderBundleForSource` for INSERT/UPDATE; `unregister` for
+* DELETE / soft-delete). Without this round-trip, peers other than the
+* one that handled `kici-admin source add generic` would 404 incoming
+* webhooks until restart.
+*
+* Mirrors the existing GitHub-app `sources` trigger
+* (`notify_sources_change()` + `sources_change_trigger`, defined in
+* `001_initial.ts`).
+*/
+async function up$4(db) {
+	await sql`
+    CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
+      LANGUAGE plpgsql
+      AS $$
+    BEGIN
+      IF TG_OP = 'DELETE' THEN
+        PERFORM pg_notify('generic_sources_change', OLD.routing_key);
+      ELSE
+        PERFORM pg_notify('generic_sources_change', NEW.routing_key);
+      END IF;
+      RETURN NULL;
+    END;
+    $$
+  `.execute(db);
+	await sql`
+    CREATE TRIGGER generic_sources_change_trigger
+      AFTER INSERT OR UPDATE OR DELETE ON public.generic_webhook_sources
+      FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
+  `.execute(db);
+}
+async function down$4(db) {
+	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
+	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
+var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
+*
+* Stores the per-customer policy that decides which Platform-routed
+* dashboard.* write operations the orchestrator accepts. An empty
+* JSONB object means everything is enabled (permissive default). To
+* disable an operation, set its key to `false`, e.g.
+* `{"secrets.set": false, "variables.set": false}`. Unknown / missing
+* keys are treated as `true` by the resolver in
+* `@kici-dev/engine/protocol/dashboard-write-operations`.
+*
+* Idempotent: a re-run on a DB that already has the column is a no-op.
+*/
+async function up$3(db) {
+	if ((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'org_settings'
+         AND column_name = 'dashboard_write_policy'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists) return;
+	await sql`
+    ALTER TABLE public.org_settings
+      ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
+  `.execute(db);
+}
+async function down$3(db) {
+	await sql`
+    ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/021_check_run_tracking.ts
+var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* Add `check_run_tracking` table for HA-safe check-run state persistence.
+*
+* The `CommitStatusReporter` previously held all of its check-run bookkeeping
+* in per-process `Map`s. Under HA (Raft leader switch / coord crash) those
+* maps reset to empty on the replacement coord, leaving GitHub check runs
+* stuck in `queued` forever.
+*
+* Single composite-keyed table per (provider, owner, repo, sha, check_name):
+*
+*   - `check_run_id`            replaces in-memory `checkRunIds`.
+*   - `build_creation_state`    replaces `pendingBuildCreations` Promise map.
+*   - `step_progress_json`      replaces `stepProgress` array map.
+*   - `in_progress_sent_at`     replaces `inProgressSent` boolean map.
+*   - `run_id`                  indexed; replaces `runIdToKeys` reverse map.
+*
+* Progress-timer debounce state (the `progressTimers` Map) is NOT persisted —
+* timers are recreated on demand when an update arrives and the row's
+* `updated_at` is older than the debounce window.
+*
+* Idempotent: a re-run on a DB that already has the table is a no-op.
+*/
+async function up$2(db) {
+	if ((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.tables
+       WHERE table_schema = 'public'
+         AND table_name = 'check_run_tracking'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists) return;
+	await sql`
+    CREATE TABLE public.check_run_tracking (
+      provider              TEXT NOT NULL,
+      owner                 TEXT NOT NULL,
+      repo                  TEXT NOT NULL,
+      sha                   TEXT NOT NULL,
+      check_name            TEXT NOT NULL,
+      check_run_id          BIGINT,
+      build_creation_state  TEXT,
+      step_progress_json    JSONB NOT NULL DEFAULT '[]'::jsonb,
+      in_progress_sent_at   TIMESTAMPTZ,
+      run_id                TEXT,
+      created_at            TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      updated_at            TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      PRIMARY KEY (provider, owner, repo, sha, check_name)
+    )
+  `.execute(db);
+	await sql`
+    CREATE INDEX idx_check_run_tracking_run_id
+      ON public.check_run_tracking (run_id)
+      WHERE run_id IS NOT NULL
+  `.execute(db);
+}
+async function down$2(db) {
+	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/022_scaler_manager_state.ts
+var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Add three tables persisting `ScalerManager` per-coord state:
+*
+*  - `scaler_spawning_agents`: agents spawned via Docker/Podman/Firecracker
+*    that have not yet registered via WS. Carries the `bound_job_id` so a
+*    replacement coord still issues the eager-dispatch hop on register.
+*
+*  - `scaler_agent_jobs`: agentId → (runId, jobId) correlation for
+*    scaler-lifecycle event routing. Inserted on `correlateAgentToJob`,
+*    deleted on disconnect / job completion.
+*
+*  - `scaler_reservations`: outstanding resource reservations keyed by
+*    agentId. Per-scaler / global usage counters are derived state —
+*    recomputed on coord boot as `SUM(...) GROUP BY scaler_name` so the
+*    cap-check critical section stays correct.
+*
+* Without these tables, a coord crash mid-spawn orphans the agent (eager
+* dispatch lost), strands the reservation (resource leak until backend
+* GC eventually disconnects the WS, minutes later), and loses every
+* scaler-lifecycle event emitted before correlation (execution-tracker
+* sees a hole in the run timeline).
+*
+* Idempotent: a re-run on a DB that already has any of these tables
+* leaves the existing one alone.
+*/
+async function up$1(db) {
+	const tableExists = async (name) => {
+		return (await sql`
+      SELECT EXISTS (
+        SELECT 1 FROM information_schema.tables
+         WHERE table_schema = 'public' AND table_name = ${name}
+      ) AS exists
+    `.execute(db)).rows[0]?.exists ?? false;
+	};
+	if (!await tableExists("scaler_spawning_agents")) {
+		await sql`
+      CREATE TABLE public.scaler_spawning_agents (
+        agent_id       TEXT PRIMARY KEY,
+        scaler_name    TEXT NOT NULL,
+        label_set      JSONB NOT NULL,
+        run_id         TEXT,
+        job_id         TEXT,
+        bound_job_id   TEXT,
+        spawned_at     TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `.execute(db);
+		await sql`
+      CREATE INDEX idx_scaler_spawning_agents_spawned_at
+        ON public.scaler_spawning_agents (spawned_at)
+    `.execute(db);
+	}
+	if (!await tableExists("scaler_agent_jobs")) await sql`
+      CREATE TABLE public.scaler_agent_jobs (
+        agent_id        TEXT PRIMARY KEY,
+        run_id          TEXT NOT NULL,
+        job_id          TEXT NOT NULL,
+        correlated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `.execute(db);
+	if (!await tableExists("scaler_reservations")) {
+		await sql`
+      CREATE TABLE public.scaler_reservations (
+        agent_id      TEXT PRIMARY KEY,
+        scaler_name   TEXT NOT NULL,
+        cpu_units     DOUBLE PRECISION NOT NULL,
+        mem_bytes     BIGINT NOT NULL,
+        reserved_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `.execute(db);
+		await sql`
+      CREATE INDEX idx_scaler_reservations_scaler_name
+        ON public.scaler_reservations (scaler_name)
+    `.execute(db);
+	}
+}
+async function down$1(db) {
+	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
+	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
+	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
+var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
+* `dispatch_queue.recovery_agent_id TEXT` columns persisting per-job
+* recovery state for HA-safe agent-disconnect handling.
+*
+* `Dispatcher.recoveringJobs` previously held the timer handle, agent
+* ID, and deadline entirely in process memory. A coord crash between
+* starting the timer and it firing dropped the timer; the replacement
+* coord saw the row as `status='recovering'` but had no record of when
+* the deadline expired or which agent owned the job. Jobs lingered
+* forever.
 *
-* Idempotency: the `WHERE NOT LIKE 'org\\_%'` guard makes the
-* migration a no-op on rows already prefixed (e.g. a re-run after a
-* fresh deploy populated some rows already), so applying it twice is
-* safe.
+* The new columns make the deadline durable. A leader-gated sweep
+* (`Dispatcher.sweepExpiredRecoveries`) scans
+* `WHERE status='recovering' AND recovery_deadline < now()` and marks
+* each row failed; on coord boot, `Dispatcher.recoverState()`
+* hydrates the in-memory Map by re-creating timers from the persisted
+* deadlines.
+*
+* Idempotent: re-running on a DB that already has either column is a
+* no-op.
 */
-const ORG_ID_TABLES = [
-	"access_log",
-	"environment_bindings",
-	"environment_source_overrides",
-	"environment_variables",
-	"environments",
-	"event_log",
-	"held_runs",
-	"scoped_secrets"
-];
-const CUSTOMER_ID_TABLES = [
-	"sources",
-	"generic_webhook_sources",
-	"workflow_registrations",
-	"org_settings"
-];
 async function up(db) {
-	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
-	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
+	const colExists = async (name) => {
+		return (await sql`
+      SELECT EXISTS (
+        SELECT 1 FROM information_schema.columns
+         WHERE table_schema = 'public'
+           AND table_name = 'dispatch_queue'
+           AND column_name = ${name}
+      ) AS exists
+    `.execute(db)).rows[0]?.exists ?? false;
+	};
+	if (!await colExists("recovery_deadline")) await sql`
+      ALTER TABLE public.dispatch_queue
+        ADD COLUMN recovery_deadline TIMESTAMPTZ
+    `.execute(db);
+	if (!await colExists("recovery_agent_id")) await sql`
+      ALTER TABLE public.dispatch_queue
+        ADD COLUMN recovery_agent_id TEXT
+    `.execute(db);
+	await sql`
+    CREATE INDEX IF NOT EXISTS idx_dispatch_queue_recovery_deadline
+      ON public.dispatch_queue (recovery_deadline)
+      WHERE recovery_deadline IS NOT NULL
+  `.execute(db);
 }
 async function down(db) {
-	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
-	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
+	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
+	await sql`
+    ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
+  `.execute(db);
+	await sql`
+    ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_deadline
+  `.execute(db);
 }
 //#endregion
 //#region src/db/migration-provider.ts
@@ -3271,7 +3675,12 @@ function createMigrationProvider() {
 			"015_org_settings_customer_scoped": _015_org_settings_customer_scoped_exports,
 			"016_org_settings_allow_http_npm": _016_org_settings_allow_http_npm_exports,
 			"017_org_id_widen": _017_org_id_widen_exports,
-			"018_org_id_prefix_backfill": _018_org_id_prefix_backfill_exports
+			"018_org_id_prefix_backfill": _018_org_id_prefix_backfill_exports,
+			"019_generic_sources_change_notify": _019_generic_sources_change_notify_exports,
+			"020_org_settings_dashboard_write_policy": _020_org_settings_dashboard_write_policy_exports,
+			"021_check_run_tracking": _021_check_run_tracking_exports,
+			"022_scaler_manager_state": _022_scaler_manager_state_exports,
+			"023_dispatch_queue_recovery_deadline": _023_dispatch_queue_recovery_deadline_exports
 		};
 	} };
 }
@@ -3321,12 +3730,15 @@ async function runMigrations(opts) {
 /**
 * Database management commands for kici-admin.
 *
-*   db migrate              Run pending migrations (HTTP — orchestrator must be up)
-*   db fresh                DROP + CREATE + migrate + store content hash (direct DB)
-*   db ensure <name>        CREATE DATABASE IF NOT EXISTS (direct DB)
-*   db create-role          CREATE ROLE LOGIN [CREATEDB] (direct DB)
-*   db create-readonly-user Read-only role + GRANT SELECT (direct DB)
-*   db check-schema         Compare bundled migrations vs live schema (direct DB)
+*   db migrate                    Run pending migrations (HTTP — orchestrator must be up)
+*   db fresh                      DROP + CREATE + migrate + store content hash (direct DB)
+*   db ensure <name>              CREATE DATABASE IF NOT EXISTS (direct DB)
+*   db create-role                CREATE ROLE LOGIN [CREATEDB] (direct DB)
+*   db create-readonly-user       Read-only role + GRANT SELECT (direct DB)
+*   db check-schema               Compare bundled migrations vs live schema (direct DB)
+*   db collation-check            Check pg_database.datcollversion vs running libc (direct DB)
+*   db reindex                    REINDEX DATABASE CONCURRENTLY (direct DB)
+*   db refresh-collation-version  ALTER DATABASE REFRESH COLLATION VERSION (direct DB)
 *
 * The direct-DB subcommands cannot go through HTTP because the target database
 * may not exist yet or is about to be dropped. They follow the same pattern
@@ -3410,15 +3822,19 @@ function registerDbCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	db.command("ensure <name>").description("CREATE DATABASE IF NOT EXISTS (idempotent)").option("--database-url <url>", "Admin DB URL (else KICI_DATABASE_URL / DATABASE_URL)").action(async (name, opts) => {
+	db.command("ensure <name>").description("CREATE DATABASE IF NOT EXISTS (idempotent)").option("--database-url <url>", "Admin DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--owner <role>", "DB owner role (default: URL user). Pass when the admin connection is privileged but the new DB should be owned by a separate non-privileged role.").option("--revoke-connect-public", "After ensure, REVOKE CONNECT ON DATABASE \"<name>\" FROM PUBLIC (recommended on shared clusters).").action(async (name, opts) => {
 		try {
 			const baseUrl = resolveDatabaseUrl$1(opts.databaseUrl);
 			const url = new URL(baseUrl);
 			url.pathname = `/${name}`;
 			const targetUrl = url.toString();
 			logInvocation(`ensure ${name}`, targetUrl);
-			const outcome = await ensureDatabase(targetUrl);
-			console.log(`db ensure: ${name} — ${outcome}`);
+			const outcome = await ensureDatabase(targetUrl, {
+				owner: opts.owner,
+				revokeConnectFromPublic: !!opts.revokeConnectPublic
+			});
+			const suffix = (opts.owner ? ` (owner=${opts.owner})` : "") + (opts.revokeConnectPublic ? " [revoked CONNECT from PUBLIC]" : "");
+			console.log(`db ensure: ${name} — ${outcome}${suffix}`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
@@ -3471,6 +3887,70 @@ function registerDbCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	db.command("collation-check").description("Compare pg_database.datcollversion against the running libc collation version. Exit 2 on drift.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--json", "Emit JSON instead of a human-readable line", false).action(async (opts) => {
+		try {
+			const url = resolveDatabaseUrl$1(opts.databaseUrl);
+			const { dbName } = parseDatabaseUrl(url);
+			const pool = createPool(url);
+			try {
+				const drift = await getDatabaseCollationDrift(pool, dbName);
+				if (drift) {
+					if (opts.json) process.stdout.write(JSON.stringify({
+						clean: false,
+						database: dbName,
+						stamped: drift.stamped,
+						actual: drift.actual
+					}) + "\n");
+					else console.log(`db collation-check: ${dbName} — drift: stamped=${drift.stamped} actual=${drift.actual}`);
+					process.exit(2);
+				}
+				if (opts.json) process.stdout.write(JSON.stringify({
+					clean: true,
+					database: dbName
+				}) + "\n");
+				else console.log(`db collation-check: ${dbName} — clean`);
+			} finally {
+				await pool.end().catch(() => void 0);
+			}
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	db.command("reindex").description("REINDEX DATABASE CONCURRENTLY <db>. Rebuilds every index under the running libc collation rules. Non-blocking but takes minutes + ~2× temp disk.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--confirm", "Explicit confirmation (destructive — long-running)").requiredOption("--reason <text>", "Reason (recorded in stderr banner)").action(async (opts) => {
+		try {
+			const url = resolveDatabaseUrl$1(opts.databaseUrl);
+			const { dbName } = parseDatabaseUrl(url);
+			logInvocation(`reindex ${dbName} (${opts.reason})`, url);
+			const pool = createPool(url);
+			try {
+				await reindexDatabaseConcurrently(pool, dbName);
+				console.log(`db reindex: ${dbName} — REINDEX DATABASE CONCURRENTLY completed`);
+			} finally {
+				await pool.end().catch(() => void 0);
+			}
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	db.command("refresh-collation-version").description("ALTER DATABASE <db> REFRESH COLLATION VERSION. Metadata-only bump; pair with db reindex after a libc-base image rebuild.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--reason <text>", "Reason (recorded in stderr banner)").action(async (opts) => {
+		try {
+			const url = resolveDatabaseUrl$1(opts.databaseUrl);
+			const { dbName } = parseDatabaseUrl(url);
+			logInvocation(`refresh-collation-version ${dbName} (${opts.reason})`, url);
+			const pool = createPool(url);
+			try {
+				await refreshDatabaseCollationVersion(pool, dbName);
+				console.log(`db refresh-collation-version: ${dbName} — ALTER DATABASE REFRESH COLLATION VERSION completed`);
+			} finally {
+				await pool.end().catch(() => void 0);
+			}
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 }
 //#endregion
 //#region src/providers/universal-git/config.ts
@@ -3734,6 +4214,26 @@ createLogger({ prefix: "universal-git:clone-token" });
 *   --stdin                    Read from stdin
 */
 /**
+* Short reason shown in `(unavailable — <reason>)` when no webhook URL could be
+* resolved for an added source.
+*/
+function webhookNoteReason(note) {
+	switch (note) {
+		case "github-ingress-platform-only": return "this orchestrator runs in independent mode";
+		case "platform-no-public-url": return "the Platform has no public webhook URL configured";
+		case "platform-unavailable": return "could not reach the Platform";
+		default: return "webhook URL could not be determined";
+	}
+}
+/** Actionable next-step hint paired with {@link webhookNoteReason}. */
+function webhookNoteHint(note) {
+	switch (note) {
+		case "github-ingress-platform-only": return "GitHub App ingress is served by the KiCI Platform; find the URL in the dashboard under Sources.";
+		case "platform-unavailable": return "Retry once the orchestrator reconnects, or find the URL in the dashboard under Sources.";
+		default: return "Find the webhook URL in the dashboard under Sources.";
+	}
+}
+/**
 * Resolve a secret value from various input modes.
 * Returns undefined if no input mode is specified.
 */
@@ -3877,7 +4377,16 @@ function registerSourceCommands(program, getClient) {
 				webhookSecret: opts.webhookSecret
 			});
 			if (opts.json) console.log(JSON.stringify(result, null, 2));
-			else console.log(`Source added: ${result.routingKey} (${result.name})`);
+			else {
+				console.log(`Source added: ${result.routingKey} (${result.name})`);
+				if (result.webhookUrl) {
+					console.log(`Webhook URL:  ${result.webhookUrl}`);
+					console.log(`  ↳ Paste this into your GitHub App's "Webhook URL" field.`);
+				} else {
+					console.log(`Webhook URL:  (unavailable — ${webhookNoteReason(result.webhookNote)})`);
+					console.log(`  ↳ ${webhookNoteHint(result.webhookNote)}`);
+				}
+			}
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
@@ -4844,7 +5353,7 @@ function registerBackendCommands(program, getClient) {
 				try {
 					scopeInfo = ` has ${(await getClient().getBackend(name)).scopeCount ?? 0} discovered scopes -- they will become unavailable.`;
 				} catch {}
-				if (!await confirm$2(`Backend "${name}"${scopeInfo} Continue? [y/N] `)) {
+				if (!await confirm$3(`Backend "${name}"${scopeInfo} Continue? [y/N] `)) {
 					console.log("Aborted.");
 					return;
 				}
@@ -5034,7 +5543,7 @@ function printBackendSummary(b) {
 /**
 * Simple confirmation prompt.
 */
-async function confirm$2(message) {
+async function confirm$3(message) {
 	const rl = createInterface({
 		input: process.stdin,
 		output: process.stderr
@@ -5594,6 +6103,18 @@ function getCacheDir() {
 }
 var init_platform_detect = __esmMin((() => {}));
 //#endregion
+//#region src/cli/service/privilege.ts
+init_platform_detect();
+function resolveUserLevel(opts) {
+	if (opts.system && opts.userLevel) throw new Error("`--system` and `--user-level` are mutually exclusive. Pick one (or neither for auto-detect).");
+	if (opts.system) {
+		if (!isRoot()) throw new Error("`--system` requires root privileges. Re-run under sudo, e.g. `sudo kici-admin orchestrator install --system ...`.");
+		return false;
+	}
+	if (opts.userLevel) return true;
+	return !isRoot();
+}
+//#endregion
 //#region src/cli/service/systemd.ts
 /**
 * systemd service manager implementation.
@@ -5885,26 +6406,79 @@ var init_launchd = __esmMin((() => {
 			lines.push("");
 			return lines.join("\n");
 		}
+		/**
+		* Resolve the launchctl domain string for a service config.
+		*
+		*   - User-level (LaunchAgent at `~/Library/LaunchAgents/…`) → `gui/<uid>`
+		*   - System-level (LaunchDaemon at `/Library/LaunchDaemons/…`) → `system`
+		*
+		* The legacy `launchctl load` / `unload` verbs implicitly inferred the
+		* domain from the plist's filesystem location, but they fail silently on
+		* headless macOS hosts where no GUI session exists (the `gui/<uid>` domain
+		* is not available without a console login). The modern `bootstrap` /
+		* `bootout` / `kickstart` / `kill` verbs take the domain explicitly, so a
+		* system-level LaunchDaemon loads regardless of whether anyone is logged
+		* in at the console — exactly what we need for headless deploy targets.
+		*/
+		domain(config) {
+			return config.isUserLevel ? `gui/${os.userInfo().uid}` : "system";
+		}
+		/** `<domain>/<label>` — the target string for kickstart/kill/print/enable. */
+		domainTarget(config) {
+			return `${this.domain(config)}/${this.label(config)}`;
+		}
+		/** Is the service currently loaded in its target domain? */
+		isLoaded(config) {
+			try {
+				execFileSync("launchctl", ["print", this.domainTarget(config)], { stdio: "ignore" });
+				return true;
+			} catch {
+				return false;
+			}
+		}
 		async install(config) {
 			const plistFile = this.plistPath(config);
 			const plistContent = this.generatePlist(config);
 			fs.mkdirSync(path.dirname(plistFile), { recursive: true });
-			fs.mkdirSync(this.logDir(config), { recursive: true });
+			const logDirectory = this.logDir(config);
+			fs.mkdirSync(logDirectory, { recursive: true });
+			if (!config.isUserLevel && config.user) execFileSync("chown", [
+				"-R",
+				`${config.user}:staff`,
+				logDirectory
+			], { stdio: "inherit" });
 			fs.writeFileSync(plistFile, plistContent, "utf-8");
-			execFileSync("launchctl", ["load", plistFile], { stdio: "inherit" });
+			if (this.isLoaded(config)) try {
+				execFileSync("launchctl", ["bootout", this.domainTarget(config)], { stdio: "inherit" });
+			} catch {}
+			execFileSync("launchctl", [
+				"bootstrap",
+				this.domain(config),
+				plistFile
+			], { stdio: "inherit" });
 		}
 		async uninstall(config) {
 			const plistFile = this.plistPath(config);
 			try {
-				execFileSync("launchctl", ["unload", plistFile], { stdio: "inherit" });
+				execFileSync("launchctl", ["bootout", this.domainTarget(config)], { stdio: "inherit" });
+			} catch {}
+			try {
+				fs.unlinkSync(plistFile);
 			} catch {}
-			fs.unlinkSync(plistFile);
 		}
 		async start(config) {
-			execFileSync("launchctl", ["start", this.label(config)], { stdio: "inherit" });
+			execFileSync("launchctl", [
+				"kickstart",
+				"-k",
+				this.domainTarget(config)
+			], { stdio: "inherit" });
 		}
 		async stop(config) {
-			execFileSync("launchctl", ["stop", this.label(config)], { stdio: "inherit" });
+			execFileSync("launchctl", [
+				"kill",
+				"TERM",
+				this.domainTarget(config)
+			], { stdio: "inherit" });
 		}
 		async restart(config) {
 			await this.stop(config);
@@ -6397,6 +6971,11 @@ function getRestartMode(config) {
 * Uses a manual YAML builder to avoid adding a YAML library dependency.
 * The generated file includes the service definition with env_file,
 * restart policy, and volume mounts.
+*
+* The `image:` line points at `quay.io/kici-dev/<service-name>:latest`.
+* Source of truth for the publish targets: packages/ci/src/publish-images.ts.
+* See .claude/rules/container-publish-registry.md — Quay is the sole
+* registry for public KiCI images we publish.
 */
 function generateComposeYaml(config) {
 	const restartMode = getRestartMode(config);
@@ -6406,7 +6985,7 @@ function generateComposeYaml(config) {
 		"",
 		"services:",
 		`  ${config.name}:`,
-		`    image: ghcr.io/kici-dev/kici:latest`,
+		`    image: quay.io/kici-dev/${config.name}:latest`,
 		`    container_name: ${config.name}`,
 		`    restart: ${restartMode}`,
 		"    env_file:",
@@ -6604,8 +7183,9 @@ var orchestrator_wizard_exports = /* @__PURE__ */ __exportAll({ runOrchestratorW
 * 2. Database URL
 * 3. Port
 * 4. Secrets encryption key
-* 5. Platform URL + token (if platform/hybrid mode)
-* 6. Webhook secret (if hybrid/independent mode)
+* 5. Bootstrap admin token (for kici-admin authentication)
+* 6. Platform URL + token (if platform/hybrid mode)
+* 7. Webhook secret (if hybrid/independent mode)
 */
 async function runOrchestratorWizard() {
 	console.log("");
@@ -6639,6 +7219,13 @@ async function runOrchestratorWizard() {
 	let secretsKey;
 	if (useGenerated) secretsKey = generatedKey;
 	else secretsKey = await promptSecret("Enter custom secrets encryption key (64 hex chars):");
+	console.log("");
+	const generatedAdminToken = randomBytes(32).toString("hex");
+	console.log(`Generated bootstrap admin token: ${generatedAdminToken}`);
+	const useGeneratedAdminToken = await promptConfirm("Use this token?");
+	let bootstrapAdminToken;
+	if (useGeneratedAdminToken) bootstrapAdminToken = generatedAdminToken;
+	else bootstrapAdminToken = await promptSecret("Enter custom bootstrap admin token:");
 	let platformUrl;
 	let platformToken;
 	if (mode === "platform" || mode === "hybrid") {
@@ -6678,6 +7265,7 @@ async function runOrchestratorWizard() {
 	console.log(`  Mode:     ${mode}`);
 	console.log(`  Database: ${databaseUrl.replace(/:[^@]*@/, ":***@")}`);
 	console.log(`  Port:     ${port}`);
+	console.log(`  Admin token: ${bootstrapAdminToken.slice(0, 8)}…`);
 	console.log(`  Platform:     ${platformUrl ?? "N/A"}`);
 	if (source) console.log(`  Source:   ${source.provider}:${source.appId} (${source.name})`);
 	console.log("");
@@ -6686,6 +7274,7 @@ async function runOrchestratorWizard() {
 		databaseUrl,
 		port,
 		secretsKey,
+		bootstrapAdminToken,
 		platformUrl,
 		platformToken,
 		source
@@ -6724,18 +7313,18 @@ function startDevPostgres(containerName) {
 		if (err instanceof Error && err.message.includes("already exists")) throw err;
 	}
 	console.log(`Starting dev PostgreSQL container "${containerName}" on port ${port}...`);
-	execSync(`${runtime} run -d --name ${containerName} -p ${port}:5432 -e POSTGRES_PASSWORD=${password} -e POSTGRES_DB=kici postgres:18-alpine`, { stdio: "inherit" });
+	execSync(`${runtime} run -d --name ${containerName} -p ${port}:5432 -e POSTGRES_PASSWORD=${password} -e POSTGRES_DB=kici postgres:18-trixie`, { stdio: "inherit" });
 	return `postgresql://postgres:${password}@localhost:${port}/kici`;
 }
 function registerOrchestratorInstall(orchestrator) {
-	orchestrator.command("install").description("Install the orchestrator as a system service").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--env-file <path>", "Path to existing env/config file to use").option("--binary <path>", "Path to orchestrator binary (default: current executable)").option("--dev", "Dev mode: spin up PostgreSQL container on port 15432").option("--wizard", "Interactive wizard for guided setup").option("--name <name>", "Service name", "kici-orchestrator").action(async (opts) => {
+	orchestrator.command("install").description("Install the orchestrator as a system service").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--env-file <path>", "Path to existing env/config file to use").option("--binary <path>", "Path to orchestrator binary (default: current executable)").option("--dev", "Dev mode: spin up PostgreSQL container on port 15432").option("--wizard", "Interactive wizard for guided setup").option("--name <name>", "Service name", "kici-orchestrator").option("--system", "Install as system-level service (requires root)").option("--user-level", "Install as user-level service (no root required)").option("--user <name>", "Run the service as the named user (system-level launchd only; sets UserName in plist so the daemon drops privileges)").action(async (opts) => {
 		try {
 			if (opts.wizard && opts.envFile) {
 				console.error("Error: Cannot use --wizard with --env-file");
 				process.exit(1);
 			}
 			const platform = detectPlatform(opts.platform);
-			const userLevel = !isRoot();
+			const userLevel = resolveUserLevel(opts);
 			const serviceName = opts.name;
 			console.log(`Platform: ${platform}`);
 			console.log(`Privilege: ${userLevel ? "user" : "system"}`);
@@ -6755,9 +7344,10 @@ function registerOrchestratorInstall(orchestrator) {
 				const wizardConfig = await runOrchestratorWizard();
 				let envContent = "# KiCI orchestrator configuration (generated by setup wizard)\n";
 				envContent += `KICI_MODE=${wizardConfig.mode}\n`;
-				envContent += `DATABASE_URL=${wizardConfig.databaseUrl}\n`;
+				envContent += `KICI_DATABASE_URL=${wizardConfig.databaseUrl}\n`;
 				envContent += `KICI_PORT=${wizardConfig.port}\n`;
-				envContent += `KICI_SECRETS_KEY=${wizardConfig.secretsKey}\n`;
+				envContent += `KICI_SECRET_KEY=${wizardConfig.secretsKey}\n`;
+				envContent += `KICI_BOOTSTRAP_ADMIN_TOKEN=${wizardConfig.bootstrapAdminToken}\n`;
 				if (wizardConfig.platformUrl) envContent += `KICI_PLATFORM_URL=${wizardConfig.platformUrl}\n`;
 				if (wizardConfig.platformToken) envContent += `KICI_PLATFORM_TOKEN=${wizardConfig.platformToken}\n`;
 				fs.writeFileSync(envFilePath, envContent, "utf-8");
@@ -6772,12 +7362,12 @@ function registerOrchestratorInstall(orchestrator) {
 				console.log(`Copied env file to ${envFilePath}`);
 			} else if (!fs.existsSync(envFilePath)) {
 				let envContent = `# KiCI orchestrator configuration\n# See docs for all available options\n`;
-				if (devDbUrl) envContent += `DATABASE_URL=${devDbUrl}\n`;
+				if (devDbUrl) envContent += `KICI_DATABASE_URL=${devDbUrl}\n`;
 				fs.writeFileSync(envFilePath, envContent, "utf-8");
 				console.log(`Created env file at ${envFilePath}`);
 			} else if (devDbUrl) {
-				fs.appendFileSync(envFilePath, `\nDATABASE_URL=${devDbUrl}\n`);
-				console.log(`Appended DATABASE_URL to ${envFilePath}`);
+				fs.appendFileSync(envFilePath, `\nKICI_DATABASE_URL=${devDbUrl}\n`);
+				console.log(`Appended KICI_DATABASE_URL to ${envFilePath}`);
 			}
 			const executablePath = opts.binary ? path.resolve(opts.binary) : process.argv[0];
 			if (userLevel) try {
@@ -6796,6 +7386,7 @@ function registerOrchestratorInstall(orchestrator) {
 				envFilePath,
 				workingDirectory: configDir,
 				isUserLevel: userLevel,
+				user: opts.user,
 				restartPolicy: DEFAULT_RESTART_POLICY
 			};
 			await (await createServiceManager(platform)).install(config);
@@ -6814,10 +7405,10 @@ function registerOrchestratorInstall(orchestrator) {
 //#endregion
 //#region src/cli/commands/orchestrator-service/uninstall.ts
 function registerOrchestratorUninstall(orchestrator) {
-	orchestrator.command("uninstall").description("Remove the orchestrator service registration").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--name <name>", "Service name", "kici-orchestrator").action(async (opts) => {
+	orchestrator.command("uninstall").description("Remove the orchestrator service registration").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--name <name>", "Service name", "kici-orchestrator").option("--system", "Operate against the system-level service (requires root)").option("--user-level", "Operate against the user-level service").action(async (opts) => {
 		try {
 			const platform = detectPlatform(opts.platform);
-			const userLevel = !isRoot();
+			const userLevel = resolveUserLevel(opts);
 			const serviceName = opts.name;
 			const configDir = getConfigDir(serviceName, userLevel);
 			const logDir = getLogDir(serviceName, userLevel);
@@ -6857,10 +7448,10 @@ function registerOrchestratorUninstall(orchestrator) {
 //#endregion
 //#region src/cli/commands/orchestrator-service/start.ts
 function registerOrchestratorStart(orchestrator) {
-	orchestrator.command("start").description("Start the orchestrator service").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--name <name>", "Service name", "kici-orchestrator").action(async (opts) => {
+	orchestrator.command("start").description("Start the orchestrator service").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--name <name>", "Service name", "kici-orchestrator").option("--system", "Operate against the system-level service (requires root)").option("--user-level", "Operate against the user-level service").action(async (opts) => {
 		try {
 			const platform = detectPlatform(opts.platform);
-			const userLevel = !isRoot();
+			const userLevel = resolveUserLevel(opts);
 			const serviceName = opts.name;
 			const configDir = getConfigDir(serviceName, userLevel);
 			const config = {
@@ -6890,10 +7481,10 @@ function registerOrchestratorStart(orchestrator) {
 //#endregion
 //#region src/cli/commands/orchestrator-service/stop.ts
 function registerOrchestratorStop(orchestrator) {
-	orchestrator.command("stop").description("Stop the orchestrator service").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--name <name>", "Service name", "kici-orchestrator").action(async (opts) => {
+	orchestrator.command("stop").description("Stop the orchestrator service").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--name <name>", "Service name", "kici-orchestrator").option("--system", "Operate against the system-level service (requires root)").option("--user-level", "Operate against the user-level service").action(async (opts) => {
 		try {
 			const platform = detectPlatform(opts.platform);
-			const userLevel = !isRoot();
+			const userLevel = resolveUserLevel(opts);
 			const serviceName = opts.name;
 			const configDir = getConfigDir(serviceName, userLevel);
 			const config = {
@@ -6917,10 +7508,10 @@ function registerOrchestratorStop(orchestrator) {
 //#endregion
 //#region src/cli/commands/orchestrator-service/restart.ts
 function registerOrchestratorRestart(orchestrator) {
-	orchestrator.command("restart").description("Restart the orchestrator service").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--name <name>", "Service name", "kici-orchestrator").action(async (opts) => {
+	orchestrator.command("restart").description("Restart the orchestrator service").option("--platform <type>", "Service platform (systemd, launchd, windows, compose)").option("--name <name>", "Service name", "kici-orchestrator").option("--system", "Operate against the system-level service (requires root)").option("--user-level", "Operate against the user-level service").action(async (opts) => {
 		try {
 			const platform = detectPlatform(opts.platform);
-			const userLevel = !isRoot();
+			const userLevel = resolveUserLevel(opts);
 			const serviceName = opts.name;
 			const configDir = getConfigDir(serviceName, userLevel);
 			const config = {
@@ -7106,7 +7697,7 @@ function registerLogsCommand(parent) {
 * - Optional cleanup of old versions
 */
 /** Prompt the user for confirmation (returns true if yes). */
-async function confirm$1(message) {
+async function confirm$2(message) {
 	const rl = createInterface({
 		input: process.stdin,
 		output: process.stdout
@@ -7322,7 +7913,7 @@ async function performVersionedUpgrade(component, opts) {
 			console.log(`  Install path: ${versionedDirPath}`);
 			console.log("  The service will be stopped during upgrade.");
 			console.log("");
-			if (!await confirm$1("Proceed with upgrade?")) {
+			if (!await confirm$2("Proceed with upgrade?")) {
 				console.log("Upgrade cancelled.");
 				return;
 			}
@@ -7404,7 +7995,7 @@ async function handleRollback(component, platform, installBase, config, manager,
 		console.log(`  Current version: ${currentVersion}`);
 		console.log(`  Rollback to: ${previousVersion}`);
 		console.log("");
-		if (!await confirm$1("Proceed with rollback?")) {
+		if (!await confirm$2("Proceed with rollback?")) {
 			console.log("Rollback cancelled.");
 			return;
 		}
@@ -7968,30 +8559,39 @@ var JoinTokenManager = class {
 		return token;
 	}
 	/**
-	* Validate a token: check hash exists in DB, not expired, not consumed.
-	* Returns routing info and derived keys on success.
+	* Atomically validate and consume a token in one DB round-trip.
+	*
+	* Single UPDATE with `WHERE token_hash = ? AND consumed_at IS NULL AND
+	* expires_at > NOW()` — only one caller can win the claim across a
+	* shared-DB multi-coordinator mesh. The winner gets `{ routing, keys }`;
+	* every other concurrent caller gets `TOKEN_ALREADY_USED_MESSAGE` and is
+	* expected to fall into the idempotent recovery branch in
+	* `peer-handler.ts` (which serialises credential issuance via the
+	* `peer_credentials_active_uniq` partial unique index).
+	*
+	* On a 0-row claim, a follow-up SELECT disambiguates not-found / expired
+	* / already-used so callers can branch on the specific reason — the
+	* recovery path in peer-handler.ts keys on the "already used" string
+	* specifically. The follow-up only fires on the unhappy path.
 	*/
-	async validateToken(token) {
+	async validateAndConsumeToken(token, consumedBy) {
 		const parsed = parseToken(token);
 		const keys = deriveKeys(Buffer.from(parsed.secretHex, "hex"));
+		const updateResult = await this.deps.db.updateTable("join_tokens").set({
+			consumed_at: /* @__PURE__ */ new Date(),
+			consumed_by: consumedBy
+		}).where("token_hash", "=", keys.validationHash).where("consumed_at", "is", null).where("expires_at", ">", /* @__PURE__ */ new Date()).executeTakeFirst();
+		if (Number(updateResult?.numUpdatedRows ?? 0n) > 0) {
+			joinTokenLogger.info("Consumed join token", { consumedBy });
+			return {
+				routing: parsed.routing,
+				keys
+			};
+		}
 		const row = await this.deps.db.selectFrom("join_tokens").selectAll().where("token_hash", "=", keys.validationHash).executeTakeFirst();
 		if (!row) throw new Error("Invalid join token");
 		if (row.consumed_at) throw new Error(TOKEN_ALREADY_USED_MESSAGE);
-		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) throw new Error("Join token has expired. Generate a new token with: kici admin create-join-token");
-		return {
-			routing: parsed.routing,
-			keys
-		};
-	}
-	/**
-	* Mark token as consumed (one-time use).
-	*/
-	async consumeToken(validationHash, consumedBy) {
-		await this.deps.db.updateTable("join_tokens").set({
-			consumed_at: /* @__PURE__ */ new Date(),
-			consumed_by: consumedBy
-		}).where("token_hash", "=", validationHash).execute();
-		joinTokenLogger.info("Consumed join token", { consumedBy });
+		throw new Error("Join token has expired. Generate a new token with: kici admin create-join-token");
 	}
 };
 /**
@@ -8347,6 +8947,7 @@ function registerOrgSettingsCommands(program, getClient) {
 	registerListMutators(gw, getClient, "allow", "allowedRepos");
 	registerListMutators(gw, getClient, "deny", "deniedRepos");
 	registerListMutators(gw, getClient, "elevate", "elevatedRepos");
+	registerDashboardWritesCommands(orgSettings, getClient);
 	orgSettings.command("allow-http-npm <value>").description("Permit plain http:// npm registry URLs in workflow registries:. Default false; loopback / *.local are always allowed regardless.").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (value, opts) => {
 		const allow = value === "true" ? true : value === "false" ? false : void 0;
 		if (allow === void 0) {
@@ -8432,6 +9033,173 @@ function label(prefix) {
 	if (prefix === "deny") return "source-repo deny-list";
 	return "elevated-access list";
 }
+function formatDashboardWrites(response, format, filter) {
+	if (format === "json") return JSON.stringify(response, null, 2);
+	const lines = [];
+	lines.push(`Customer/org id: ${response.customerId}`);
+	lines.push("");
+	const byCategory = /* @__PURE__ */ new Map();
+	for (const descriptor of DASHBOARD_WRITE_OPERATIONS) {
+		if (filter?.category && descriptor.category !== filter.category) continue;
+		if (filter?.sensitivity && descriptor.sensitivity !== filter.sensitivity) continue;
+		const list = byCategory.get(descriptor.category) ?? [];
+		list.push(descriptor);
+		byCategory.set(descriptor.category, list);
+	}
+	for (const [category, descriptors] of byCategory) {
+		lines.push(`${category.toUpperCase()}`);
+		for (const descriptor of descriptors) {
+			const state = response.effective[descriptor.name] ?? true ? "enabled " : "disabled";
+			lines.push(`  ${state}  ${descriptor.name.padEnd(40)}  (${descriptor.cliEquivalent})`);
+		}
+		lines.push("");
+	}
+	return lines.join("\n").trimEnd();
+}
+function parseOpFlag(value, previous) {
+	const eq = value.indexOf("=");
+	if (eq < 1 || eq === value.length - 1) {
+		console.error(`Error: --op expects <operation>=<true|false>, got: ${value}`);
+		process.exit(1);
+	}
+	const op = value.slice(0, eq);
+	const bool = value.slice(eq + 1).toLowerCase();
+	if (bool !== "true" && bool !== "false") {
+		console.error(`Error: --op value must be "true" or "false", got: ${bool}`);
+		process.exit(1);
+	}
+	if (!DASHBOARD_WRITE_OPERATIONS_BY_NAME.has(op)) {
+		console.error(`Error: unknown operation "${op}". Run "kici-admin org-settings dashboard-writes show" to list valid operations.`);
+		process.exit(1);
+	}
+	previous.push([op, bool === "true"]);
+	return previous;
+}
+function registerDashboardWritesCommands(orgSettings, getClient) {
+	const dw = orgSettings.command("dashboard-writes").description("Manage per-orch dashboard write policy (which Platform-routed dashboard.* writes the orch accepts)");
+	dw.command("show").description("Print current dashboard-write policy. Empty = all enabled.").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--category <name>", "Filter to one category (Secrets|Variables|Environments|Bindings|\"Held runs\"|DLQ|Registrations|Topology)").option("--sensitivity <name>", "Filter to one sensitivity bucket (plaintext|authority|dispatch)").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const response = await getClient().get(`/api/v1/admin/org-settings/dashboard-writes?customerId=${encodeURIComponent(customerId)}`);
+			const filter = parseFilters(opts);
+			console.log(formatDashboardWrites(response, opts.format, filter));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	dw.command("set").description("Set one or more operations. Use --op <name>=<true|false> per operation. Sugar: --category or --sensitivity + --enabled <bool> expands to the matching operations.").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--op <op=bool>", "Single operation flip; repeatable (e.g. --op secrets.set=false --op variables.set=false)", parseOpFlag, []).option("--category <name>", "Apply --enabled to every operation in this category").option("--sensitivity <name>", "Apply --enabled to every operation in this sensitivity bucket").option("--enabled <bool>", "Pair with --category or --sensitivity to flip the whole group").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const updates = collectUpdates(opts);
+			if (Object.keys(updates).length === 0) {
+				console.error("Error: no operations specified. Pass --op <name>=<bool> or --category/--sensitivity + --enabled.");
+				process.exit(1);
+			}
+			printPlannedChange(updates, await getClient().get(`/api/v1/admin/org-settings/dashboard-writes?customerId=${encodeURIComponent(customerId)}`));
+			const response = await getClient().patch(`/api/v1/admin/org-settings/dashboard-writes`, {
+				customerId,
+				updates
+			});
+			console.log(formatDashboardWrites(response, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	dw.command("reset").description("Reset all operations to enabled (permissive default).").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const response = await getClient().patch(`/api/v1/admin/org-settings/dashboard-writes`, {
+				customerId,
+				reset: true
+			});
+			console.log(formatDashboardWrites(response, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+}
+function parseFilters(opts) {
+	if (!opts.category && !opts.sensitivity) return void 0;
+	const filter = {};
+	if (opts.category) {
+		const parsed = DashboardWriteCategory.safeParse(opts.category);
+		if (!parsed.success) throw new Error(`Unknown --category: ${opts.category}`);
+		filter.category = parsed.data;
+	}
+	if (opts.sensitivity) {
+		const parsed = DashboardWriteSensitivity.safeParse(opts.sensitivity);
+		if (!parsed.success) throw new Error(`Unknown --sensitivity: ${opts.sensitivity}`);
+		filter.sensitivity = parsed.data;
+	}
+	return filter;
+}
+function collectUpdates(opts) {
+	const updates = {};
+	for (const [op, value] of opts.op) updates[op] = value;
+	if (Boolean(opts.category || opts.sensitivity)) {
+		if (opts.enabled === void 0) throw new Error("--category / --sensitivity require --enabled <true|false>");
+		const enabled = opts.enabled.toLowerCase();
+		if (enabled !== "true" && enabled !== "false") throw new Error("--enabled must be \"true\" or \"false\"");
+		const value = enabled === "true";
+		const cat = opts.category ? DashboardWriteCategory.parse(opts.category) : void 0;
+		const sens = opts.sensitivity ? DashboardWriteSensitivity.parse(opts.sensitivity) : void 0;
+		for (const descriptor of DASHBOARD_WRITE_OPERATIONS) {
+			if (cat && descriptor.category !== cat) continue;
+			if (sens && descriptor.sensitivity !== sens) continue;
+			updates[descriptor.name] = value;
+		}
+	}
+	return updates;
+}
+function printPlannedChange(updates, before) {
+	const lines = ["Planned changes:"];
+	let any = false;
+	for (const [op, next] of Object.entries(updates)) {
+		const prior = before.effective[op] ?? true;
+		if (prior === next) continue;
+		any = true;
+		lines.push(`  ${op}: ${prior ? "enabled" : "disabled"} -> ${next ? "enabled" : "disabled"}`);
+	}
+	if (!any) lines.push("  (no effective change)");
+	console.error(lines.join("\n"));
+}
+//#endregion
+//#region src/cli/commands/cluster-name.ts
+function registerClusterNameCommands(program, getClient) {
+	const cn = program.command("cluster-name").description("Manage this orchestrator's cluster name (Platform-visible identifier)");
+	cn.command("get").description("Print the current cluster name.").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		try {
+			const response = await getClient().get("/api/v1/admin/cluster-name");
+			if (opts.format === "json") {
+				console.log(JSON.stringify(response, null, 2));
+				return;
+			}
+			console.log(`Cluster name:        ${response.clusterName}`);
+			console.log(`Looks auto-generated: ${response.looksAutoGenerated ? "yes" : "no"}`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	cn.command("set <name>").description(`Rename the cluster. ${CLUSTER_NAME_FORMAT_MESSAGE}.`).option("--format <format>", "Output format: json|table", "table").action(async (name, opts) => {
+		try {
+			const response = await getClient().put("/api/v1/admin/cluster-name", { name });
+			if (opts.format === "json") {
+				console.log(JSON.stringify(response, null, 2));
+				return;
+			}
+			if (response.prior !== null && response.prior !== response.clusterName) console.log(`Renamed: ${response.prior} -> ${response.clusterName}`);
+			else console.log(`Cluster name is already ${response.clusterName} (no change).`);
+			if (response.reconnectRequired) console.log("Reconnect to Platform to publish the new name. Restart the orchestrator or run `kici-admin orchestrator-service restart`.");
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+}
 //#endregion
 //#region src/cli/commands/maintenance.ts
 /**
@@ -8742,6 +9510,85 @@ function registerEnvironmentCommands(program, getClient) {
 	});
 }
 //#endregion
+//#region src/cli/commands/variable.ts
+function registerVariableCommands(program, getClient) {
+	const vr = program.command("variable").description("Manage environment variables");
+	vr.command("list <orgId> <environment>").description("List org-level variables in an environment").option("--values", "Print variable values inline (default: keys + locked flag only)").action(async (orgId, environment, opts) => {
+		try {
+			const { variables } = await getClient().listVariables(orgId, environment);
+			if (variables.length === 0) {
+				console.log("No variables in this environment.");
+				return;
+			}
+			for (const v of variables) {
+				const lockTag = v.locked ? " [locked]" : "";
+				if (opts.values) console.log(`  - ${v.key}=${v.value}${lockTag}`);
+				else console.log(`  - ${v.key}${lockTag}`);
+			}
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	vr.command("get <orgId> <environment> <key>").description("Print the value of a single variable").action(async (orgId, environment, key) => {
+		try {
+			const { variables } = await getClient().listVariables(orgId, environment);
+			const match = variables.find((v) => v.key === key);
+			if (!match) {
+				console.error(`Variable '${key}' not found in environment '${environment}'.`);
+				process.exit(1);
+			}
+			console.log(match.value);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	vr.command("set <orgId> <environment> <key>").description("Set an environment variable. Value comes from one of: --prompt (default on TTY), --from-stdin (default on pipe), --from-file <path>, --from-env <VAR>, --value <plaintext> (discouraged).").option("--value <value>", "Variable value via argv (visible in shell history)").option("--prompt", "Interactive no-echo prompt (requires TTY)").option("--from-stdin", "Read value from piped stdin until EOF").option("--from-file <path>", "Read value from a file (trailing newline trimmed)").option("--from-env <var>", "Read value from a named environment variable").option("--no-trim", "When reading --from-file, keep the trailing newline (default: trim once)").option("--locked", "Mark the variable as locked (source overrides cannot replace it)").option("--confirm-fingerprint <sha256hex>", "Refuse the write unless SHA-256(value) matches this 64-hex string").option("--dry-run", "Parse + validate the value, print fingerprint + length, do not write").action(async (orgId, environment, key, opts) => {
+		try {
+			const { value, source } = await resolveSecretInput(opts);
+			if (opts.dryRun) {
+				console.log(`[dry-run] would set variable '${key}' in environment '${environment}' for org ${orgId} (${value.length} chars, source=${source}, locked=${Boolean(opts.locked)}, sha256=${fingerprintValue(value)})`);
+				return;
+			}
+			await getClient().setVariable(orgId, environment, key, value, opts.locked);
+			const lockTag = opts.locked ? " [locked]" : "";
+			console.log(`Variable '${key}' set in environment '${environment}' for org ${orgId}${lockTag}.`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	vr.command("delete <orgId> <environment> <key>").description("Delete an environment variable").option("--yes", "Skip confirmation prompt").action(async (orgId, environment, key, opts) => {
+		try {
+			if (!opts.yes) {
+				if (!await confirm$1(`Are you sure you want to delete variable '${key}' from environment '${environment}'?`)) {
+					console.log("Aborted.");
+					return;
+				}
+			}
+			await getClient().deleteVariable(orgId, environment, key);
+			console.log(`Variable '${key}' deleted from environment '${environment}' for org ${orgId}.`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+}
+async function confirm$1(message) {
+	const { createInterface } = await import("node:readline");
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+	return new Promise((resolve) => {
+		rl.question(`${message} [y/N] `, (answer) => {
+			rl.close();
+			resolve(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
+		});
+	});
+}
+//#endregion
 //#region src/cli/commands/queue.ts
 function resolveDirectDbUrl$3(explicit) {
 	return explicit ?? process.env.KICI_DATABASE_URL ?? null;
@@ -11419,8 +12266,10 @@ registerOrchestratorServiceCommands(program);
 registerAgentServiceCommands(program);
 registerPeerCommands(program, getClient);
 registerOrgSettingsCommands(program, getClient);
+registerClusterNameCommands(program, getClient);
 registerMaintenanceCommands(program, getClient);
 registerEnvironmentCommands(program, getClient);
+registerVariableCommands(program, getClient);
 registerQueueCommands(program, getClient);
 registerExecutionCommands(program, getClient);
 registerRegistrationCommands(program, getClient);