brnch-cli 0.18.1 → 0.18.3

package/brnch.mjs

@@ -6044,9 +6044,9 @@ var require_lexer = __commonJS({
         }
       }
       *parseQuotedScalar() {
-        const quote2 = this.charAt(0);
-        let end2 = this.buffer.indexOf(quote2, this.pos + 1);
-        if (quote2 === "'") {
+        const quote3 = this.charAt(0);
+        let end2 = this.buffer.indexOf(quote3, this.pos + 1);
+        if (quote3 === "'") {
           while (end2 !== -1 && this.buffer[end2 + 1] === "'")
             end2 = this.buffer.indexOf("'", end2 + 2);
         } else {
@@ -9960,7 +9960,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
     const negativeNumberArg = (arg) => {
       if (!/^-(\d+|\d*\.\d+)(e[+-]?\d+)?$/.test(arg)) return false;
       return !this._getCommandAndAncestors().some(
-        (cmd) => cmd.options.map((opt) => opt.short).some((short2) => /^-\d$/.test(short2))
+        (cmd) => cmd.options.map((opt) => opt.short).some((short3) => /^-\d$/.test(short3))
       );
     };
     let activeVariadicOption = null;
@@ -21407,8 +21407,8 @@ var error43 = () => {
       case "not_multiple_of":
         return `N\xFAmero inv\xE1lido: deve ser m\xFAltiplo de ${issue2.divisor}`;
       case "unrecognized_keys": {
-        const plural3 = issue2.keys.length > 1 ? "s" : "";
-        return `Chave${plural3} inv\xE1lida${plural3}: ${joinValues(issue2.keys, ", ")}`;
+        const plural4 = issue2.keys.length > 1 ? "s" : "";
+        return `Chave${plural4} inv\xE1lida${plural4}: ${joinValues(issue2.keys, ", ")}`;
       }
       case "invalid_key":
         return `Entrada inv\xE1lida n${translateOriginWithArticle(issue2.origin, "definite")}`;
@@ -21552,8 +21552,8 @@ var error44 = () => {
       case "not_multiple_of":
         return `N\xFAmero inv\xE1lido: deve ser m\xFAltiplo de ${issue2.divisor}`;
       case "unrecognized_keys": {
-        const plural3 = issue2.keys.length > 1 ? "s" : "";
-        return `Chave${plural3} inv\xE1lida${plural3}: ${joinValues(issue2.keys, ", ")}`;
+        const plural4 = issue2.keys.length > 1 ? "s" : "";
+        return `Chave${plural4} inv\xE1lida${plural4}: ${joinValues(issue2.keys, ", ")}`;
       }
       case "invalid_key":
         return `Entrada inv\xE1lida n${translateOriginWithArticle(issue2.origin, "definite")}`;
@@ -30572,7 +30572,8 @@ var PLATFORM_TOKEN_PREFIXES = {
   finv: "organization invitation token",
   fsfa: "pending second-factor sign-in",
   fbkc: "Buildkite checkout token",
-  fsvw: "staff read-only view"
+  fsvw: "staff read-only view",
+  fcrt: "container registry token"
 };
 var PLATFORM_TOKEN_RE = new RegExp(`^(${Object.keys(PLATFORM_TOKEN_PREFIXES).join("|")})_[0-9a-f]{64}$`);
 
@@ -31545,15 +31546,15 @@ function redactText(input3, opts = {}) {
     hit("auth-header");
     return `${prefix}${REDACTED}`;
   });
-  text2 = text2.replace(ASSIGNMENT, (w, prefix, quote2, value) => {
+  text2 = text2.replace(ASSIGNMENT, (w, prefix, quote3, value) => {
     if (isReference(value) || value.startsWith(REDACTED)) return w;
     hit("assignment");
-    return `${prefix}${quote2}${REDACTED}${quote2}`;
+    return `${prefix}${quote3}${REDACTED}${quote3}`;
   });
-  text2 = text2.replace(FLAG, (w, prefix, quote2, value) => {
+  text2 = text2.replace(FLAG, (w, prefix, quote3, value) => {
     if (isReference(value) || value.startsWith(REDACTED)) return w;
     hit("flag");
-    return `${prefix}${quote2}${REDACTED}${quote2}`;
+    return `${prefix}${quote3}${REDACTED}${quote3}`;
   });
   if (opts.entropy !== false) {
     text2 = text2.replace(TOKENISH, (w) => {
@@ -31632,6 +31633,7 @@ var looksLikeHostedLabel = (label2) => /^brnch-hosted(?:-|$)/.test(label2);
 // packages/domain/src/deploy.ts
 var DEPLOY_LIMITS = {
   maxStepsPerTarget: 12,
+  maxWatchPaths: 50,
   maxTargetsPerRepository: 10,
   maxCommandLength: 2e3,
   maxSummaryLength: 500,
@@ -31645,6 +31647,21 @@ var DEPLOY_LIMITS = {
 var DEPLOY_RUNNER_LABELS = HOSTED_SIZES.map((s) => HOSTED_SIZE_SPECS[s].label);
 var DEFAULT_DEPLOY_RUNNER = HOSTED_SIZE_SPECS.basic.label;
 
+// packages/domain/src/db-migrations.ts
+var DB_MIGRATION_LIMITS = {
+  sourcesPerRepo: 20,
+  /** Migration files read from one directory. */
+  files: 2e3,
+  fileBytes: 1024 * 1024,
+  dirBytes: 16 * 1024 * 1024,
+  /** Per statement; queue work is bounded by the platform's 15-minute limit. */
+  statementTimeoutMaxS: 600,
+  lockTimeoutMaxS: 60,
+  sessionSettings: 20,
+  /** How long a worker holds a run before another may take it over. */
+  leaseMs: 15 * 6e4
+};
+
 // packages/domain/src/isolated-preview.ts
 function parseJsonc(text2) {
   let out = "";
@@ -31683,6 +31700,8 @@ var DELEGATION_MATRIX = Object.freeze({
   "cloudflare/resources": { userToOrg: false, userToRepo: false, orgToRepo: true },
   "cloudflare/d1_migrations": { userToOrg: false, userToRepo: false, orgToRepo: true },
   "cloudflare/secrets_store": { userToOrg: false, userToRepo: false, orgToRepo: true },
+  // Database migrations (ADR-0084) apply one repository's migration directory to the PlanetScale database it is bound to.
+  "planetscale/db_migrations": { userToOrg: false, userToRepo: false, orgToRepo: true },
   // A secret source is read by a repository's workflow runs.
   "infisical/secrets_source": { userToOrg: false, userToRepo: false, orgToRepo: true },
   // AI code review keys (ADR-0051): an organization's key reviews the changes of its repositories.
@@ -31734,7 +31753,7 @@ var PLANS = Object.freeze({
     monthly_cents: 800,
     annual_cents: 8e3,
     per_seat: false,
-    features: ["private_review_rules", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "assistant"],
+    features: ["private_review_rules", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "database_migrations", "assistant"],
     minutes_base: 5e3,
     minutes_per_seat: 0,
     concurrent_hosted_jobs: 4,
@@ -31753,7 +31772,7 @@ var PLANS = Object.freeze({
     monthly_cents: 1e3,
     annual_cents: 9600,
     per_seat: true,
-    features: ["private_review_rules", "private_members_unlimited", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "premium_ai_models", "assistant", "assistant_proactive"],
+    features: ["private_review_rules", "private_members_unlimited", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "database_migrations", "premium_ai_models", "assistant", "assistant_proactive"],
     minutes_base: 3e3,
     minutes_per_seat: 1e3,
     concurrent_hosted_jobs: 10,
@@ -31772,7 +31791,7 @@ var PLANS = Object.freeze({
     monthly_cents: null,
     annual_cents: null,
     per_seat: true,
-    features: ["private_review_rules", "private_members_unlimited", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "premium_ai_models", "assistant", "assistant_proactive"],
+    features: ["private_review_rules", "private_members_unlimited", "ai_code_review_services", "hosted_delegation", "cloudflare_previews", "cloudflare_d1_migrations", "database_migrations", "premium_ai_models", "assistant", "assistant_proactive"],
     minutes_base: 5e4,
     minutes_per_seat: 0,
     concurrent_hosted_jobs: 50,
@@ -32864,6 +32883,22 @@ var ActionsSettingsRequest = external_exports.object({
   allow_untrusted_jobs_on_self_hosted_runners: external_exports.boolean().optional()
 });
 var RunnerLabel = external_exports.string().min(1).max(50).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "letters, digits, '.', '_' and '-'");
+var ResourceBytes = external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var RunnerResourceSnapshot = external_exports.object({
+  cpu_percent: external_exports.number().min(0).max(100).nullable(),
+  cpu_count: external_exports.number().int().min(1).max(65536),
+  cpu_interval_ms: external_exports.number().int().min(1).max(6e5).nullable(),
+  memory_total_bytes: ResourceBytes.positive(),
+  memory_available_bytes: ResourceBytes,
+  disk_total_bytes: ResourceBytes.positive().nullable(),
+  disk_available_bytes: ResourceBytes.nullable(),
+  uptime_seconds: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  job_slots: external_exports.number().int().min(1).max(32)
+}).strict().superRefine((s, ctx) => {
+  if (s.memory_available_bytes > s.memory_total_bytes) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["memory_available_bytes"], message: "available memory exceeds total memory" });
+  if (s.disk_total_bytes === null !== (s.disk_available_bytes === null) || s.disk_available_bytes !== null && s.disk_available_bytes > s.disk_total_bytes) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["disk_available_bytes"], message: "disk readings must be a valid pair" });
+  if (s.cpu_percent === null !== (s.cpu_interval_ms === null)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["cpu_interval_ms"], message: "CPU usage requires a sample interval" });
+});
 var TestRunnerRequest = external_exports.object({
   repository_id: external_exports.string().max(64).nullable().default(null)
 });
@@ -32888,8 +32923,9 @@ var PollJobsRequest = external_exports.object({
   wait_seconds: external_exports.number().int().min(0).max(25).default(20)
 });
 var HeartbeatRequest = external_exports.object({
-  running_jobs: external_exports.array(external_exports.string().max(64)).max(32).default([])
-});
+  running_jobs: external_exports.array(external_exports.string().max(64)).max(32).default([]),
+  resources: RunnerResourceSnapshot.optional()
+}).strict();
 var StepUpdateRequest = external_exports.object({
   name: external_exports.string().max(500),
   status: external_exports.enum(["in_progress", "completed"]),
@@ -33618,7 +33654,7 @@ var CODING_AGENT_SESSION_SCOPES = [
 var EnsureCodingAgentRequest = external_exports.object({ tool: external_exports.enum(AGENT_RUNTIMES) }).strict();
 
 // packages/protocol/src/connections.ts
-var CONNECTION_PURPOSES = ["impact", "secrets_store", "import", "secrets_source", "deploy", "resources", "d1_migrations", "code_review"];
+var CONNECTION_PURPOSES = ["impact", "secrets_store", "import", "secrets_source", "deploy", "resources", "d1_migrations", "db_migrations", "code_review"];
 var Name3 = external_exports.string().trim().min(1).max(100);
 var Secret2 = external_exports.string().min(1).max(4e3);
 var Id2 = external_exports.string().min(1).max(200).regex(/^[A-Za-z0-9._:-]+$/, "letters, digits, '.', '_', ':' and '-' only");
@@ -33657,9 +33693,10 @@ var CreateConnectionRequest = external_exports.discriminatedUnion("auth", [
     auth: external_exports.literal("api_token"),
     // Cloudflare API tokens (impact, secrets_store, deploy), GitHub fine-grained personal access tokens (import) and
     // AI code review keys (code_review, ADR-0051): CodeRabbit, Greptile, an OpenAI key for Codex, an Anthropic key for
-    // Claude Code. The provider/purpose pair is checked server-side.
-    provider: external_exports.enum(["cloudflare", "github", "coderabbit", "greptile", "codex", "claude"]),
-    purpose: external_exports.enum(["impact", "secrets_store", "import", "deploy", "resources", "d1_migrations", "code_review"]),
+    // Claude Code, a PlanetScale service token (`<id>:<token>`, db_migrations). The provider/purpose pair is checked
+    // server-side.
+    provider: external_exports.enum(["cloudflare", "planetscale", "github", "coderabbit", "greptile", "codex", "claude"]),
+    purpose: external_exports.enum(["impact", "secrets_store", "import", "deploy", "resources", "d1_migrations", "db_migrations", "code_review"]),
     name: Name3,
     credentials: external_exports.object({ api_token: Secret2 })
   }),
@@ -33762,6 +33799,11 @@ var targetFields = {
   preview_check_name: external_exports.string().trim().min(1).max(100).nullable(),
   /** The hosted runner size the deploy jobs run on, by its `runs-on` label: `brnch-hosted` … `brnch-hosted-4` (ADR-0066). */
   runs_on: external_exports.string().trim().min(1).max(40),
+  /**
+   * Paths whose changes deploy the target (CODEOWNERS patterns such as `apps/web/` or `packages/**`, `!` excludes; the
+   * last matching pattern decides). Empty: every change deploys it.
+   */
+  watch_paths: external_exports.array(external_exports.string().trim().min(1).max(500)).max(50),
   steps: external_exports.array(DeployStepSpecBody).max(12)
 };
 var CreateDeployTargetRequest = external_exports.object({
@@ -33779,6 +33821,7 @@ var CreateDeployTargetRequest = external_exports.object({
   preview_agent_changes: targetFields.preview_agent_changes.default(false),
   preview_check_name: targetFields.preview_check_name.default(null),
   runs_on: targetFields.runs_on.default("brnch-hosted"),
+  watch_paths: targetFields.watch_paths.default([]),
   steps: targetFields.steps.default([])
 });
 var UpdateDeployTargetRequest = external_exports.object(targetFields).partial().extend({
@@ -33844,6 +33887,77 @@ var UpsertWorkerEnvRequest = external_exports.object({
   if (v.kind === "var" && v.source !== "value") c8.addIssue({ code: "custom", message: "plain vars take a value", path: ["source"] });
 });
 
+// packages/protocol/src/db-migrations.ts
+var DB_MIGRATION_FORMATS = ["atlas", "plain", "golang_migrate", "drizzle", "prisma"];
+var DB_ENGINE_KINDS = ["postgres", "vitess"];
+var DB_EXEC_ORDERS = ["linear", "linear_skip", "non_linear"];
+var DB_CREDENTIAL_MODES = ["managed_role", "dsn", "branch_password"];
+var Ident2 = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_$]{0,62}$/, "letters, digits and _ only (at most 63)");
+var PsName = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/, "a PlanetScale name: letters, digits, '.', '_' and '-'");
+var SourceFields = {
+  name: external_exports.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9_-]*$/, "lowercase letters, digits, - and _"),
+  /** Directory relative to the repository root ("" = the root). */
+  path: external_exports.string().max(300),
+  format: external_exports.enum(DB_MIGRATION_FORMATS),
+  engine: external_exports.enum(DB_ENGINE_KINDS),
+  /** Branch whose merges create runs; the repository's default branch when omitted. */
+  branch: external_exports.string().min(1).max(200).optional(),
+  /** PlanetScale connection (purpose `db_migrations`) of the organization or the repository. */
+  connection_id: external_exports.string().min(1).max(64),
+  ps_organization: PsName,
+  ps_database: PsName,
+  /** The production branch migrations are applied to. */
+  ps_branch: PsName.default("main"),
+  /** Where the format's revisions table lives (Postgres schema; Atlas default `atlas_schema_revisions`). */
+  revisions_schema: Ident2.nullable().default(null),
+  revisions_table: Ident2.nullable().default(null),
+  /** With no revision history yet, record this version as a baseline instead of applying files up to it. */
+  baseline_version: external_exports.string().min(1).max(100).nullable().default(null),
+  exec_order: external_exports.enum(DB_EXEC_ORDERS).default("linear"),
+  /** Postgres session settings for migration sessions (`lock_timeout`, custom `prefix.name`, …). */
+  session_settings: external_exports.record(external_exports.string().max(126), external_exports.string().max(500)).default({}),
+  statement_timeout_s: external_exports.number().int().min(1).max(600).default(300),
+  lock_timeout_s: external_exports.number().int().min(1).max(60).default(10),
+  credential_mode: external_exports.enum(DB_CREDENTIAL_MODES).optional(),
+  /** Postgres: the role new objects belong to (`SET ROLE`); `postgres` by default for managed roles, none for a DSN. */
+  run_as_role: external_exports.string().regex(/^[a-z_][a-z0-9_]{0,62}$/).nullable().optional(),
+  /** `approval`: merges create runs that wait for approval. `manual_only`: runs start only by hand. */
+  on_merge: external_exports.enum(["approval", "manual_only"]).default("approval"),
+  /** Validate the directory on changes (evidence `migrations/<name>`). */
+  change_checks: external_exports.boolean().default(true)
+};
+var CreateDbMigrationSourceRequest = external_exports.object({
+  ...SourceFields,
+  /** Postgres `credential_mode: dsn` only: `postgresql://user:password@host:5432/db?sslmode=verify-full`. Write-only. */
+  dsn: external_exports.string().min(10).max(2e3).optional()
+});
+var UpdateDbMigrationSourceRequest = external_exports.object({
+  path: SourceFields.path,
+  branch: SourceFields.branch,
+  connection_id: SourceFields.connection_id,
+  ps_organization: SourceFields.ps_organization,
+  ps_database: SourceFields.ps_database,
+  ps_branch: PsName,
+  revisions_schema: Ident2.nullable(),
+  revisions_table: Ident2.nullable(),
+  baseline_version: external_exports.string().min(1).max(100).nullable(),
+  exec_order: external_exports.enum(DB_EXEC_ORDERS),
+  session_settings: external_exports.record(external_exports.string().max(126), external_exports.string().max(500)),
+  statement_timeout_s: SourceFields.statement_timeout_s.unwrap(),
+  lock_timeout_s: SourceFields.lock_timeout_s.unwrap(),
+  credential_mode: external_exports.enum(DB_CREDENTIAL_MODES),
+  run_as_role: external_exports.string().regex(/^[a-z_][a-z0-9_]{0,62}$/).nullable(),
+  on_merge: external_exports.enum(["approval", "manual_only"]),
+  change_checks: external_exports.boolean(),
+  state: external_exports.enum(["active", "disabled"]),
+  dsn: external_exports.string().min(10).max(2e3).nullable()
+}).partial().extend({ version: external_exports.number().int().min(1) });
+var StartDbMigrationRunRequest = external_exports.object({
+  /** Branch, tag or commit to apply; the source's branch when omitted. */
+  ref: external_exports.string().min(1).max(200).optional()
+});
+var DecideDbMigrationRunRequest = external_exports.object({ reason: external_exports.string().max(500).optional() });
+
 // packages/protocol/src/buildkite.ts
 var BUILDKITE_TRUST_MODES = ["contributor_controlled", "pipeline_settings", "target_ref_upload"];
 var Slug3 = external_exports.string().trim().min(1).max(100).regex(/^[a-z0-9][a-z0-9-_]*$/i, "a Buildkite slug (letters, digits, '-' and '_')");
@@ -36403,6 +36517,38 @@ function tasksGroup(t) {
   };
 }
 
+// packages/sdk/src/groups/db-migrations.ts
+function dbMigrationsGroup(t) {
+  const decide = (decision) => (id2, reason, o) => t.json({ method: "POST", path: path2`/v1/db-migration-runs/${id2}/${decision}`, json: validate2(DecideDbMigrationRunRequest, reason ? { reason } : {}, "DecideDbMigrationRunRequest"), options: o });
+  return {
+    sources: {
+      list: (repo, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/sources`, options: o }),
+      create: (repo, body, o) => t.json({ method: "POST", path: path2`/v1/repos/${repo}/db-migrations/sources`, json: validate2(CreateDbMigrationSourceRequest, body, "CreateDbMigrationSourceRequest"), options: o }),
+      get: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${id2}`, options: o }),
+      update: (id2, body, o) => t.json({ method: "PATCH", path: path2`/v1/db-migration-sources/${id2}`, json: validate2(UpdateDbMigrationSourceRequest, body, "UpdateDbMigrationSourceRequest"), options: o }),
+      delete: (id2, o) => t.void({ method: "DELETE", path: path2`/v1/db-migration-sources/${id2}`, options: o })
+    },
+    /** Migration directories found in the repository tree; `configured` marks those a source already covers. */
+    suggestions: (repo, ref, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/suggestions`, query: ref ? { ref } : {}, options: o }),
+    /** What applying the source at `ref` would do. `live` reads the database now instead of the last snapshot. */
+    plan: (sourceId2, q = {}, o) => t.json({ method: "GET", path: path2`/v1/db-migration-sources/${sourceId2}/plan`, query: { ref: q.ref, live: q.live ? "true" : void 0 }, options: o }),
+    /** Reads the applied versions from the database again and returns the plan at the source's branch. */
+    refresh: (sourceId2, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/refresh`, options: o }),
+    /** A manual run: the caller's request is the approval. `run` is null when nothing is pending. */
+    startRun: (sourceId2, body = {}, o) => t.json({ method: "POST", path: path2`/v1/db-migration-sources/${sourceId2}/runs`, json: validate2(StartDbMigrationRunRequest, body, "StartDbMigrationRunRequest"), options: o }),
+    runs: {
+      list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/db-migrations/runs`, query: { ...q }, options: o }),
+      get: (id2, o) => t.json({ method: "GET", path: path2`/v1/db-migration-runs/${id2}`, options: o })
+    },
+    approve: decide("approve"),
+    reject: decide("reject"),
+    retry: decide("retry"),
+    cancel: decide("cancel"),
+    /** The plan of every source a change touches, with the files the change adds or edits marked. */
+    changePlans: (changeId, o) => t.json({ method: "GET", path: path2`/v1/changes/${changeId}/db-migrations`, options: o })
+  };
+}
+
 // packages/sdk/src/groups/deploy.ts
 function deployGroup(t) {
   return {
@@ -36475,6 +36621,8 @@ function packagesGroup(t) {
     list: (repo, q = {}, o) => t.json({ method: "GET", path: path2`/v1/repos/${repo}/packages`, query: { ...q }, options: o }),
     get: (image, o) => t.json({ method: "GET", path: path2`/v1/packages/${image}`, options: o }),
     versions: (image, q = {}, o) => t.json({ method: "GET", path: path2`/v1/packages/${image}/versions`, query: { ...q }, options: o }),
+    /** Deletes an image with no versions left (`CONFLICT` otherwise). */
+    delete: (image, o) => t.void({ method: "DELETE", path: path2`/v1/packages/${image}`, options: o }),
     deleteVersion: (image, digest, o) => t.void({ method: "DELETE", path: path2`/v1/packages/${image}/versions/${digest}`, options: o }),
     deleteTag: (image, tag, o) => t.void({ method: "DELETE", path: path2`/v1/packages/${image}/tags/${tag}`, options: o }),
     usage: (org, o) => t.json({ method: "GET", path: path2`/v1/orgs/${org}/registry`, options: o }),
@@ -36569,6 +36717,7 @@ function createClient(options) {
     secretSyncs: secretSyncsGroup(t),
     grants: grantsGroup(t),
     deploy: deployGroup(t),
+    dbMigrations: dbMigrationsGroup(t),
     codeReview: codeReviewGroup(t),
     releases: releasesGroup(t),
     packages: packagesGroup(t),
@@ -36901,7 +37050,7 @@ function invalidAgentToolFlag(flag) {
 }
 
 // packages/cli/package.json
-var version2 = "0.18.1";
+var version2 = "0.18.3";
 
 // packages/cli/src/brand.ts
 var BRAND = {
@@ -38972,6 +39121,67 @@ ${final.join("\n")}
   deps.stderr.write("\n");
 }
 
+// packages/cli/src/program-status.ts
+var MSG_MAX_BYTES = 512;
+function encodeMsg(text2) {
+  let line2 = text2.replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
+  const enc3 = new TextEncoder();
+  while (enc3.encode(line2).length > MSG_MAX_BYTES) line2 = [...line2].slice(0, -1).join("");
+  return Buffer.from(line2, "utf8").toString("base64");
+}
+function programStatus(r) {
+  const pairs = [`state=${r.state}`, `app=${BRAND.cli}`];
+  if (r.state === "blocked") pairs.push(`kind=${r.kind}`);
+  if (r.state === "working" && r.progress !== void 0 && Number.isFinite(r.progress)) pairs.push(`progress=${Math.min(100, Math.max(0, Math.round(r.progress)))}`);
+  if (r.msg) pairs.push(`msg=${encodeMsg(r.msg)}`);
+  return `\x1B]7501;${pairs.join(":")}\x1B\\`;
+}
+function programStatusEnabled(deps, agent) {
+  const off = deps.env[envName("PROGRAM_STATUS")]?.trim().toLowerCase();
+  if (off === "0" || off === "false" || off === "off" || off === "no") return false;
+  return deps.stderrIsTTY && !agent && !deps.env.CI && deps.env.TERM !== "dumb";
+}
+var silentStatus = {
+  working: () => {
+  },
+  blocked: () => {
+  },
+  ask: () => () => {
+  },
+  finish: () => {
+  }
+};
+function statusReporter(out) {
+  let current = null;
+  let waited = false;
+  let last = "";
+  const send = (r) => {
+    const s = programStatus(r);
+    if (s === last) return;
+    last = s;
+    out.write(s);
+  };
+  const report3 = (r) => {
+    current = r;
+    waited = true;
+    send(r);
+  };
+  return {
+    working: (msg, progress) => report3({ state: "working", msg, ...progress !== void 0 ? { progress } : {} }),
+    blocked: (kind, msg) => report3({ state: "blocked", kind, msg }),
+    ask() {
+      send({ state: "blocked", kind: "question", msg: "Waiting for your answer" });
+      return () => send(current ?? { state: "working" });
+    },
+    finish(ok, msg) {
+      if (!waited) return;
+      send({ state: ok ? "done" : "error", msg });
+      waited = false;
+      current = null;
+    }
+  };
+}
+
 // packages/cli/src/context.ts
 async function findProjectFile(deps) {
   let dir = deps.cwd;
@@ -39316,6 +39526,8 @@ async function createContext(deps, globals, state2) {
     busy: (label2) => {
       if (motion) state2.spinner?.start(label2);
     },
+    /** Tell the terminal what the command waits on (program-status.ts): the server (`working`) or the person (`blocked`). */
+    status: state2.status ?? silentStatus,
     /** Clear the spinner before handing the terminal to something that does not write through `deps` (rt.invoke). */
     idle: () => state2.spinner?.stop(),
     result,
@@ -42184,6 +42396,30 @@ function input2(deps, o) {
   });
 }
 
+// packages/cli/src/step-up.ts
+function needsCliStepUp(e) {
+  const err = isBrnchApiError(e) ? e : e;
+  return err?.code === "MFA_REQUIRED" && err.details?.step_up === "cli";
+}
+function sameOrigin(ctx, start) {
+  try {
+    return new URL(start.verification_uri_complete).origin === new URL(ctx.baseUrl).origin;
+  } catch {
+    return false;
+  }
+}
+async function awaitStepUp(ctx, start) {
+  const deadline = Date.parse(start.expires_at);
+  ctx.status.blocked("auth", `Confirm it's you in the browser (code ${start.user_code})`);
+  for (; ; ) {
+    await ctx.deps.sleep(start.interval * 1e3);
+    const s = await ctx.client("user").auth.stepUp.status(start.id);
+    if (s.status === "approved") return s.step_up_expires_at;
+    if (s.status === "denied") throw new CliError("the step-up was denied in the browser", EXIT.UNAUTHENTICATED, "access_denied");
+    if (s.status === "expired" || ctx.deps.sys.now() > deadline + 5e3) throw new CliError(`the code expired before it was approved; run \`${BRAND.cli} auth step-up\` again`, EXIT.UNAUTHENTICATED, "expired_token");
+  }
+}
+
 // packages/cli/src/pending-login.ts
 import { mkdir as mkdir11, readFile as readFile9, rm as rm7, writeFile as writeFile10 } from "node:fs/promises";
 import { dirname as dirname11, join as join18 } from "node:path";
@@ -42372,6 +42608,7 @@ var accountChoice = (a) => ({
 });
 async function finishLogin(ctx, start, agentRuntime, hooks) {
   const oauth = ctx.client("user", { anonymous: true }).oauth;
+  ctx.status.blocked("auth", `Approve the sign-in in your browser (code ${start.user_code})`);
   let tok;
   try {
     tok = await pollDeviceToken(oauth, start, CLI_OAUTH_CLIENT_ID, { sleep: ctx.deps.sleep });
@@ -42455,7 +42692,7 @@ function registerAuth(program2, rt) {
           `This sign-in is for ${agentSignIn.label}, an AI coding agent (detected from ${agentSignIn.source}). The browser asks you to approve an agent sign-in: it can read and start agent sessions you sponsor, and never acts as you. To sign in as yourself, run this in your own terminal (or pass --as-human).`
         );
       }
-      const sameOrigin = (() => {
+      const sameOrigin2 = (() => {
         try {
           return new URL(start.verification_uri_complete).origin === new URL(ctx.baseUrl).origin;
         } catch {
@@ -42466,7 +42703,7 @@ function registerAuth(program2, rt) {
 ${codeBox(start.user_code, paint(true))}
 ` : `! Your one-time code: ${start.user_code}`);
       let opened = false;
-      if (o.browser && ctx.interactive && sameOrigin && (!canPick(ctx) || await pressEnter(ctx.deps, `Press Enter to open ${new URL(start.verification_uri).host} in your browser`)))
+      if (o.browser && ctx.interactive && sameOrigin2 && (!canPick(ctx) || await pressEnter(ctx.deps, `Press Enter to open ${new URL(start.verification_uri).host} in your browser`)))
         opened = await ctx.deps.openUrl(start.verification_uri_complete);
       ctx.info(
         opened ? `Opened ${start.verification_uri} in your browser. ${paint(colorEnabled(ctx.deps, "stderr")).dim("Check that it shows the same code, then approve.")}` : `Open ${start.verification_uri_complete}
@@ -42651,18 +42888,11 @@ Store them somewhere safe and offline (a password manager or on paper).`
         }
       }
       const start = await stepUp.start();
-      const sameOrigin = (() => {
-        try {
-          return new URL(start.verification_uri_complete).origin === new URL(ctx.baseUrl).origin;
-        } catch {
-          return false;
-        }
-      })();
       ctx.info(ctx.motion ? `
 ${codeBox(start.user_code, paint(true))}
 ` : `! Your one-time code: ${start.user_code}`);
       let opened = false;
-      if (o.browser && ctx.interactive && sameOrigin && (!canPick(ctx) || await pressEnter(ctx.deps, `Press Enter to open ${new URL(start.verification_uri).host} and confirm it's you`)))
+      if (o.browser && ctx.interactive && sameOrigin(ctx, start) && (!canPick(ctx) || await pressEnter(ctx.deps, `Press Enter to open ${new URL(start.verification_uri).host} and confirm it's you`)))
         opened = await ctx.deps.openUrl(start.verification_uri_complete);
       ctx.info(
         opened ? `Opened ${start.verification_uri} in your browser. Check that it shows the same code, then approve and confirm it's you.` : `Open ${start.verification_uri_complete}
@@ -42670,20 +42900,12 @@ ${codeBox(start.user_code, paint(true))}
       );
       if (ctx.motion) ctx.busy(`waiting for you to confirm it's you in the browser \xB7 the code expires in ${minutesLeft(start.expires_at, ctx.deps.sys.now())}`);
       else ctx.info("Waiting for approval\u2026");
-      const deadline = Date.parse(start.expires_at);
-      for (; ; ) {
-        await ctx.deps.sleep(start.interval * 1e3);
-        const s = await stepUp.status(start.id);
-        if (s.status === "approved") {
-          return ctx.result(
-            { status: "approved", step_up_expires_at: s.step_up_expires_at },
-            (v) => `${p.ok("\u2713")} Stepped up until ${v.step_up_expires_at ? `${clockTime(v.step_up_expires_at)}${left(v.step_up_expires_at)}` : "the server's limit"}: administrative actions work from this login until then.
+      const until = await awaitStepUp(ctx, start);
+      return ctx.result(
+        { status: "approved", step_up_expires_at: until },
+        (v) => `${p.ok("\u2713")} Stepped up until ${v.step_up_expires_at ? `${clockTime(v.step_up_expires_at)}${left(v.step_up_expires_at)}` : "the server's limit"}: administrative actions work from this login until then.
   ${p.dim(`End it sooner: ${BRAND.cli} auth step-up --end`)}`
-          );
-        }
-        if (s.status === "denied") throw new CliError("the step-up was denied in the browser", EXIT.UNAUTHENTICATED, "access_denied");
-        if (s.status === "expired" || Date.now() > deadline + 5e3) throw new CliError(`the code expired before it was approved; run \`${BRAND.cli} auth step-up\` again`, EXIT.UNAUTHENTICATED, "expired_token");
-      }
+      );
     })
   );
   auth.command("git-credential").description("git credential helper: answers `get` for the configured server with your token (store/erase are no-ops)").argument("<operation>", "get | store | erase (invoked by git)").action(
@@ -43459,6 +43681,7 @@ var Wizard = class {
   /** The spinner says what the step is checking until it prints, asks, or hands over to a composed command. */
   busy(step2) {
     this.ctx.busy(STEP_BUSY[step2]);
+    this.ctx.status.working(STEP_BUSY[step2]);
   }
   /** Global flags every composed command must keep (same server, credential and account). */
   globalArgs() {
@@ -44359,6 +44582,7 @@ var Quickstart = class {
   /** The board row says what is happening now (no-op without a board). */
   running(row, text2) {
     this.board?.run(row, text2);
+    this.ctx.status.working(text2);
   }
   /** A step's outcome: kept for the result, and shown on the board (`show`) or as a line. */
   record(step2, status, detail, show2 = detail) {
@@ -44376,6 +44600,41 @@ var Quickstart = class {
     const g2 = this.ctx.globals;
     return [...g2.url ? ["--url", g2.url] : [], ...g2.token ? ["--token", g2.token] : [], ...g2.account ? ["--account", g2.account] : [], ...g2.asHuman ? ["--as-human"] : [], ...g2.agentTool ? ["--agent-tool", g2.agentTool] : []];
   }
+  /** Whether this run already asked the person to step up (once: a second refusal is the answer). */
+  steppedUp = false;
+  /**
+   * `run`, and again after the person confirms it's them in the browser when the organization requires a second factor
+   * for it (ADR-0062): quickstart runs long enough that a step-up approved before it may have lapsed by the deploy.
+   * `refusal` finds the error in a composed command's `--json` output.
+   */
+  async withStepUp(row, run3, refusal = () => null) {
+    try {
+      const v = await run3();
+      if (!needsCliStepUp(refusal(v)) || !await this.stepUp(row)) return v;
+    } catch (e) {
+      if (!needsCliStepUp(e) || !await this.stepUp(row)) throw e;
+    }
+    return run3();
+  }
+  async stepUp(row) {
+    const { ctx } = this;
+    if (!ctx.interactive || this.steppedUp) return false;
+    this.steppedUp = true;
+    const start = await ctx.client("user").auth.stepUp.start();
+    const opened = sameOrigin(ctx, start) && await ctx.deps.openUrl(start.verification_uri_complete);
+    const todo = `Your organization asks for a second factor here: confirm it's you ${opened ? "in the page that just opened" : `at ${start.verification_uri_complete}`} (code ${start.user_code})`;
+    if (this.board) {
+      this.running(row, "waiting for you to confirm it's you in the browser");
+      this.board.hint(`${todo} ${this.errPaint.dim("(Ctrl-C stops; the repository is ready either way)")}`);
+    } else ctx.info(`  ${todo}. Waiting for it\u2026`);
+    try {
+      await awaitStepUp(ctx, start);
+    } finally {
+      this.board?.hint(null);
+    }
+    this.note(row, "confirmed: continuing");
+    return true;
+  }
   /** A composed command, in `cwd`, as JSON. Under the board it runs quietly (its stderr and git's are returned instead). */
   async runJson(argv, cwd) {
     this.ctx.idle();
@@ -44625,7 +44884,7 @@ async function stepDeploy(q, dir, ns, name, o, home2) {
   const later = `connect Cloudflare at ${integrationsUrl(ctx, ns)}, then \`${BRAND.cli} --repo ${spec} deploy setup\` and \`${BRAND.cli} --repo ${spec} deploy run production --wait\``;
   q.running("deploy", "looking for a Cloudflare connection");
   const repo = await ctx.repoId(spec, "user");
-  const usable = async () => (await ctx.client("user").deploy.connections(repo)).items.some((c8) => c8.state === "active");
+  const usable = () => q.withStepUp("deploy", async () => (await ctx.client("user").deploy.connections(repo)).items.some((c8) => c8.state === "active"));
   if (!await usable()) {
     if (!ctx.interactive) {
       q.record("deploy", "planned", later, `connect Cloudflare, then \`${BRAND.cli} deploy setup\``);
@@ -44638,6 +44897,7 @@ async function stepDeploy(q, dir, ns, name, o, home2) {
       q.running("deploy", "waiting for Cloudflare to be connected");
       q.board.hint(`${todo} ${q.errPaint.dim("(Ctrl-C stops; the repository is ready either way)")}`);
     } else ctx.info(`  ${todo}. Waiting for it (Ctrl-C stops; the repository is ready either way)\u2026`);
+    ctx.status.blocked("auth", "Connect Cloudflare in the browser");
     const deadline2 = ctx.deps.sys.now() + o.connectTimeout * 1e3;
     let ready = false;
     while (!ready && ctx.deps.sys.now() < deadline2) {
@@ -44652,7 +44912,11 @@ async function stepDeploy(q, dir, ns, name, o, home2) {
   }
   q.running("deploy", "creating the deploy target");
   const pinned = home2.cloudflare ? ["--connection", home2.cloudflare.connection, "--account-id", home2.cloudflare.account] : [];
-  const setup = await q.runJson(["--repo", spec, "deploy", "setup", ...pinned], dir);
+  const setup = await q.withStepUp(
+    "deploy",
+    () => q.runJson(["--repo", spec, "deploy", "setup", ...pinned], dir),
+    (r) => r.value?.error
+  );
   if (setup.code === EXIT.USAGE) {
     q.record("deploy", "planned", `choose what deploys it, then \`${BRAND.cli} --repo ${spec} deploy setup --connection <icn_\u2026> [--account-id <id>]\` and \`${BRAND.cli} --repo ${spec} deploy run production --wait\`${setup.reason}`, `choose a Cloudflare connection: \`${BRAND.cli} deploy setup --connection \u2026\``);
     return;
@@ -44662,7 +44926,8 @@ async function stepDeploy(q, dir, ns, name, o, home2) {
     return;
   }
   const deploy = ctx.client("user").deploy;
-  let d = await deploy.targets.deploy(setup.value.id, {});
+  const target = setup.value.id;
+  let d = await q.withStepUp("deploy", () => deploy.targets.deploy(target, {}));
   const deadline = ctx.deps.sys.now() + o.deployTimeout * 1e3;
   let last = "";
   for (; ; ) {
@@ -46237,6 +46502,7 @@ async function waitDone(ctx, change, interval, timeout) {
     const now = f.reviews.map((r) => `${CODE_REVIEW_PROVIDER_NAMES[r.provider]}: ${r.status}`).join(", ");
     if (now && now !== said) ctx.info(now);
     said = now;
+    ctx.status.working(now ? `AI review: ${now}` : "Waiting for AI review");
     if (!f.pending || Date.now() > deadline) return f;
     await ctx.deps.sleep(Math.max(1, interval) * 1e3);
   }
@@ -46402,6 +46668,7 @@ async function followLive(ctx, c8, first2, deadline, interval) {
   const stop = ctx.deps.ticker(250, draw2);
   try {
     while (!TERMINAL3.has(cur.state) && Date.now() < deadline) {
+      ctx.status.working(`Merge ${cur.state}`);
       await ctx.deps.sleep(Math.max(1, interval) * 1e3);
       cur = await c8.promotions.get(cur.id);
       reached = stepOf(cur.state, reached);
@@ -46426,6 +46693,7 @@ function registerMerge(program2, rt) {
           let last = p.state;
           ctx.info(`promotion ${p.id}: ${p.state}`);
           while (!TERMINAL3.has(p.state) && Date.now() < deadline) {
+            ctx.status.working(`Merge ${p.state}`);
             await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
             p = await c8.promotions.get(p.id);
             if (p.state !== last) ctx.info(`promotion ${p.id}: ${last = p.state}`);
@@ -46703,6 +46971,7 @@ function registerSecretScanning(program2, rt) {
       const c8 = ctx.client("user");
       let job2 = await c8.secretScanning.scans.start(repo);
       while (o.wait && (job2.state === "queued" || job2.state === "running")) {
+        ctx.status.working(`History scan ${job2.state}`);
         await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
         job2 = await c8.secretScanning.scans.get(repo, job2.id);
       }
@@ -46992,9 +47261,9 @@ async function findItems(client, specs) {
 }
 async function itemIds(client, specs) {
   const full = (s) => /^notif_[0-9a-z]{26}$/.test(s);
-  const short2 = specs.filter((s) => !full(s));
-  const items = short2.length ? await findItems(client, short2) : [];
-  return specs.map((s) => full(s) ? s : items[short2.indexOf(s)].id);
+  const short3 = specs.filter((s) => !full(s));
+  const items = short3.length ? await findItems(client, short3) : [];
+  return specs.map((s) => full(s) ? s : items[short3.indexOf(s)].id);
 }
 async function repoNames(client, items) {
   const ids = [...new Set(items.map((i) => i.repository_id))];
@@ -47739,6 +48008,187 @@ function registerIntegrations(program2, rt) {
   integrations.command("inherit <provider> <purpose>").description("Drop --repo's choice and inherit the nearest shared connection again").action(act(rt, async (ctx, _o, [provider, purpose]) => ctx.result(await ctx.client("user").grants.inherit(await ctx.repoId(void 0, "user"), provider, purpose), renderRepo)));
 }
 
+// packages/cli/src/commands/db.ts
+async function sourceId(ctx, ref, repo) {
+  if (ref.startsWith("dms_")) return ref;
+  const { items } = await ctx.client("user").dbMigrations.sources.list(repo?.id ?? await ctx.repoId(void 0, "user"));
+  const s = items.find((x) => x.name === ref);
+  if (!s) throw new CliError(`no migration source named "${ref}" (have: ${items.map((x) => x.name).join(", ") || "none"})`, EXIT.NOT_FOUND, "NOT_FOUND");
+  return s.id;
+}
+var plural3 = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
+var short = (oid) => oid.slice(0, 12);
+var database = (s) => `${s.ps_organization}/${s.ps_database}@${s.ps_branch}`;
+function issueLines(issues) {
+  if (!issues.length) return [];
+  return ["issues:", ...issues.map((i) => `  ${i.level.padEnd(7)}  ${i.code}  ${i.file ? `${i.file}: ` : ""}${i.message}`)];
+}
+var renderSources = (v) => table(
+  v.items.map((s) => ({ ...s, database: database(s), applied: s.snapshot ? `${s.snapshot.applied.length} (read ${s.snapshot.read_at})` : "not read yet" })),
+  ["name", "id", "path", "format", "engine", "database", "branch", "on_merge", "state", "applied"]
+);
+var renderSource = (s) => `${kv({ ...s, database: database(s), path: s.path || "(repository root)" }, ["id", "name", "path", "format", "engine", "database", "branch", "revisions_location", "baseline_version", "exec_order", "credential_mode", "dsn_set", "run_as_role", "on_merge", "change_checks", "state", "version"])}
+
+` + (s.on_merge === "approval" ? `Merges to ${s.branch} that add migrations create a run waiting for approval: ${BRAND.cli} db runs` : `Runs start only by hand: ${BRAND.cli} db apply ${s.name}`);
+var renderSuggestions = (v) => v.items.length ? table(
+  v.items.map((s) => ({ ...s, path: s.path || "(root)", configured: s.configured ? "yes" : "no" })),
+  ["path", "format", "files", "revisions_schema", "baseline_version", "configured", "evidence"]
+) : "no migration directories found";
+function renderPlan2(p) {
+  const db = p.database === "live" ? "read now" : p.database === "snapshot" ? `as last read${p.read_at ? ` ${p.read_at}` : ""}` : `not read${p.note ? `: ${p.note}` : ""}`;
+  const lines2 = [`${p.source_name} at ${p.ref} (${short(p.commit_oid)}): ${p.ok ? "ok" : "has errors"}`, `database: ${db}`, `files: ${p.files}, applied: ${p.applied.length}${p.applied.length ? ` (latest ${p.applied[p.applied.length - 1]})` : ""}`];
+  if (p.baseline) lines2.push(`baseline: ${p.baseline}${p.no_history ? " (recorded, not applied: the database has no revision history)" : ""}`);
+  else if (p.no_history && p.database !== "none") lines2.push("no revision history yet: every file is pending");
+  if (p.database !== "live" && p.note) lines2.push(`note: ${p.note}`);
+  if (!p.pending.length) lines2.push("nothing pending");
+  else {
+    lines2.push(`pending (${p.pending.length}):`);
+    for (const f of p.pending) {
+      const notes = [f.resume_from ? `resumes at statement ${f.resume_from + 1}` : "", f.tx_mode === "none" ? "no transaction" : "", f.introduced_by_change ? "in this change" : ""].filter(Boolean);
+      lines2.push(`  ${f.name}  ${plural3(f.statements, "statement")}${notes.length ? `  (${notes.join(", ")})` : ""}`);
+    }
+  }
+  return [...lines2, ...issueLines(p.issues)].join("\n");
+}
+var renderPlans = (v) => v.items.length ? v.items.map(renderPlan2).join("\n\n") : "no migration sources";
+var NEXT = {
+  awaiting_approval: (id2) => `Waiting for a repository admin: ${BRAND.cli} db approve ${id2} (or reject)`,
+  failed: (id2) => `Fix the migration and merge it, then: ${BRAND.cli} db retry ${id2}`,
+  needs_attention: (id2) => `Look at the run in PlanetScale, then: ${BRAND.cli} db retry ${id2} or cancel`
+};
+function renderRun(r) {
+  const ps = r.planetscale;
+  const head = kv(
+    {
+      ...r,
+      commit: short(r.commit_oid),
+      change: r.change_id ?? "-",
+      requested_by: r.requested_by ? `${r.requested_by.type} ${r.requested_by.id}` : "-",
+      deploy_request: ps?.deploy_request_url ?? (ps?.deploy_request ? `#${ps.deploy_request}` : null),
+      deployment_state: ps?.deployment_state ?? null
+    },
+    ["id", "source_name", "status", "kind", "engine", "commit", "change", "baseline", "requested_by", "approved_by", "approved_at", "decision_reason", "deploy_request", "deployment_state", "error", "note", "created_at"]
+  );
+  const files = r.files.length ? table(
+    r.files.map((f) => ({ ...f, statements: f.applied_statements ? `${f.applied_statements}/${f.statements}` : f.statements, error: f.error ? `${f.error}${f.error_statement ? ` (in: ${f.error_statement})` : ""}` : null })),
+    ["name", "status", "statements", "execution_ms", "error"]
+  ) : "no files";
+  const next = NEXT[r.status]?.(r.id);
+  return [head, "", files, ...r.issues.length ? ["", ...issueLines(r.issues)] : [], ...next ? ["", next] : []].join("\n");
+}
+var renderRuns = (v) => listWithCursor(
+  { ...v, items: v.items.map((r) => ({ ...r, commit: short(r.commit_oid), files: `${r.files.filter((f) => f.status === "applied").length}/${r.files.length} applied` })) },
+  ["id", "source_name", "status", "kind", "commit", "files", "created_at"]
+);
+var oneOf = (flag, values) => (v) => {
+  if (!values.includes(v)) throw usage(`${flag} must be one of ${values.join(", ")}`);
+  return v;
+};
+function sessionSettings(pairs) {
+  if (!pairs) return void 0;
+  const out = {};
+  for (const p of pairs) {
+    const eq = p.indexOf("=");
+    if (eq < 1) throw usage(`--session-setting must be name=value (got "${p}")`);
+    out[p.slice(0, eq)] = p.slice(eq + 1);
+  }
+  return out;
+}
+function registerDb(program2, rt) {
+  const db = program2.command("db").description("Database migrations on PlanetScale for --repo: sources, plans, and runs applied after merge and approval");
+  const sources = db.command("sources").description("Migration sources of --repo: a directory bound to a PlanetScale database branch").action(act(rt, async (ctx) => ctx.result(await ctx.client("user").dbMigrations.sources.list(await ctx.repoId(void 0, "user")), renderSources)));
+  sources.command("add").description("Add a migration source (repository admins). The source is checked against PlanetScale; `db suggest` shows the directories found").requiredOption("--name <name>", "source name (lowercase letters, digits, - and _)").requiredOption("--path <dir>", 'migration directory relative to the repository root ("" for the root)').requiredOption("--format <format>", DB_MIGRATION_FORMATS.join(" | "), oneOf("--format", DB_MIGRATION_FORMATS)).requiredOption("--engine <engine>", DB_ENGINE_KINDS.join(" | "), oneOf("--engine", DB_ENGINE_KINDS)).requiredOption("--connection <connection>", "PlanetScale connection for database migrations (icn_\u2026)").requiredOption("--organization <org>", "PlanetScale organization").requiredOption("--database <db>", "PlanetScale database").option("--ps-branch <branch>", "PlanetScale branch migrations are applied to", "main").option("--branch <branch>", "repository branch whose merges create runs (default: the default branch)").option("--revisions-schema <schema>", "where the revisions table lives (Postgres schema)").option("--revisions-table <table>", "revisions table name (default: the format's own)").option("--baseline <version>", "with no revision history yet, record this version as applied instead of applying files up to it").option("--exec-order <order>", DB_EXEC_ORDERS.join(" | "), oneOf("--exec-order", DB_EXEC_ORDERS)).option("--on-merge <mode>", "approval (merges create runs waiting for approval) | manual_only", oneOf("--on-merge", ["approval", "manual_only"])).option("--credential-mode <mode>", DB_CREDENTIAL_MODES.join(" | "), oneOf("--credential-mode", DB_CREDENTIAL_MODES)).option("--run-as-role <role>", "Postgres: SET ROLE for migration sessions").option("--session-setting <name=value>", "Postgres session setting for migration sessions (repeatable)", repeat).option("--statement-timeout <seconds>", "statement timeout (at most 600)", (v) => parseIntOption(v, "--statement-timeout")).option("--lock-timeout <seconds>", "lock timeout (at most 60)", (v) => parseIntOption(v, "--lock-timeout")).option("--no-change-checks", "do not validate the directory on changes").option("--dsn-file <path|->", "--credential-mode dsn: file holding the connection string, or - for stdin (never a flag value; never printed)").action(
+    act(rt, async (ctx, o) => {
+      let dsn;
+      if (o.dsnFile !== void 0) {
+        if (o.dsnFile === "-" && ctx.deps.stdinIsTTY) throw usage(`pipe the connection string on stdin, e.g. \`pbpaste | ${BRAND.cli} db sources add \u2026 --dsn-file -\``);
+        dsn = (await readText(fileSpec(o.dsnFile), ctx.input)).trim();
+        if (!dsn) throw usage("the connection string is empty");
+        ctx.addSecret(dsn);
+        const password = /^[a-z]+:\/\/[^:/@]*:([^@]+)@/i.exec(dsn)?.[1];
+        if (password) ctx.addSecret(password);
+      }
+      const body = {
+        name: o.name,
+        path: o.path,
+        format: o.format,
+        engine: o.engine,
+        connection_id: o.connection,
+        ps_organization: o.organization,
+        ps_database: o.database,
+        ps_branch: o.psBranch,
+        change_checks: o.changeChecks,
+        ...o.branch ? { branch: o.branch } : {},
+        ...o.revisionsSchema ? { revisions_schema: o.revisionsSchema } : {},
+        ...o.revisionsTable ? { revisions_table: o.revisionsTable } : {},
+        ...o.baseline ? { baseline_version: o.baseline } : {},
+        ...o.execOrder ? { exec_order: o.execOrder } : {},
+        ...o.onMerge ? { on_merge: o.onMerge } : {},
+        ...o.credentialMode ? { credential_mode: o.credentialMode } : {},
+        ...o.runAsRole ? { run_as_role: o.runAsRole } : {},
+        ...o.sessionSetting ? { session_settings: sessionSettings(o.sessionSetting) } : {},
+        ...o.statementTimeout !== void 0 ? { statement_timeout_s: o.statementTimeout } : {},
+        ...o.lockTimeout !== void 0 ? { lock_timeout_s: o.lockTimeout } : {},
+        ...dsn ? { dsn } : {}
+      };
+      ctx.result(await ctx.client("user").dbMigrations.sources.create(await ctx.repoId(void 0, "user"), body), renderSource);
+    })
+  );
+  sources.command("rm <source>").description("Delete a migration source (name or id; its runs stay listed). Requires --yes when non-interactive").action(
+    act(rt, async (ctx, _o, [ref]) => {
+      const id2 = await sourceId(ctx, ref);
+      await ctx.confirm(`delete migration source ${ref}`);
+      await ctx.client("user").dbMigrations.sources.delete(id2);
+      ctx.result({ deleted: id2 }, `deleted ${ref}`);
+    })
+  );
+  db.command("suggest").description("Migration directories found in --repo (atlas.sum, drizzle journals, *.up.sql, numbered SQL files), and whether a source covers each").option("--ref <ref>", "branch, tag or commit (default: the default branch)").action(act(rt, async (ctx, o) => ctx.result(await ctx.client("user").dbMigrations.suggestions(await ctx.repoId(void 0, "user"), o.ref), renderSuggestions)));
+  db.command("plan [source]").description("What applying a source (every source when omitted) would do: pending files and issues. Exits 7 when a plan has errors").option("--ref <ref>", "branch, tag or commit (default: the source's branch)").option("--live", "read the database now instead of its last snapshot (repository admins)").action(
+    act(rt, async (ctx, o, [ref]) => {
+      const c8 = ctx.client("user").dbMigrations;
+      const q = { ref: o.ref, live: o.live };
+      if (ref) {
+        const p = await c8.plan(await sourceId(ctx, ref), q);
+        ctx.result(p, renderPlan2);
+        if (!p.ok) ctx.setExit(EXIT.NOT_READY);
+        return;
+      }
+      const { items } = await c8.sources.list(await ctx.repoId(void 0, "user"));
+      const plans = { items: await Promise.all(items.filter((s) => s.state === "active").map((s) => c8.plan(s.id, q))) };
+      ctx.result(plans, renderPlans);
+      if (plans.items.some((p) => !p.ok)) ctx.setExit(EXIT.NOT_READY);
+    })
+  );
+  db.command("refresh <source>").description("Read the applied versions from the database now and show the plan at the source's branch (repository admins)").action(act(rt, async (ctx, _o, [ref]) => ctx.result(await ctx.client("user").dbMigrations.refresh(await sourceId(ctx, ref)), renderPlan2)));
+  db.command("runs").description("Migration runs of --repo, newest first").option("--source <source>", "only this source (name or id)").option("--limit <n>", "page size", (v) => parseIntOption(v, "--limit")).option("--cursor <cursor>", "page cursor").action(
+    act(rt, async (ctx, o) => {
+      const repo = { id: await ctx.repoId(void 0, "user") };
+      const q = { ...o.source ? { source_id: await sourceId(ctx, o.source, repo) } : {}, ...o.limit ? { limit: o.limit } : {}, ...o.cursor ? { cursor: o.cursor } : {} };
+      ctx.result(await ctx.client("user").dbMigrations.runs.list(repo.id, q), renderRuns);
+    })
+  );
+  db.command("run <run>").description("One migration run: status, files and issues").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").dbMigrations.runs.get(id2), renderRun)));
+  db.command("apply <source>").description("Apply a source's pending migrations now (repository admins; your request is the approval). Requires --yes when non-interactive").option("--ref <ref>", "branch, tag or commit to apply (default: the source's branch)").action(
+    act(rt, async (ctx, o, [ref]) => {
+      const id2 = await sourceId(ctx, ref);
+      await ctx.confirm(`apply the pending migrations of ${ref}${o.ref ? ` at ${o.ref}` : ""} to its database`);
+      const r = await ctx.client("user").dbMigrations.startRun(id2, o.ref ? { ref: o.ref } : {});
+      ctx.result(r, (v) => v.run ? renderRun(v.run) : `nothing to apply
+
+${renderPlan2(v.plan)}`);
+    })
+  );
+  const decisions = [
+    ["approve", "Approve a run waiting for approval: Brnch applies exactly the files it shows (repository admins)"],
+    ["reject", "Reject a run waiting for approval; nothing is applied (repository admins)"],
+    ["retry", "Retry a failed run from where it stopped (repository admins)"],
+    ["cancel", "Cancel a run that has not finished (repository admins)"]
+  ];
+  for (const [decision, description] of decisions) {
+    db.command(`${decision} <run>`).description(description).option("--reason <text>", "why (recorded with the decision)").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").dbMigrations[decision](id2, o.reason), renderRun)));
+  }
+}
+
 // packages/cli/src/commands/deploy.ts
 var TERMINAL4 = /* @__PURE__ */ new Set(["succeeded", "failed", "cancelled", "superseded", "blocked"]);
 var NO_DO_PREVIEWS = "previews off: Cloudflare makes no version URLs for Workers that implement a Durable Object (--previews --preview-mode worker_previews uses Worker Previews; it needs a `previews` block in the Wrangler configuration)";
@@ -47746,7 +48196,7 @@ var renderTargets = (v) => table(
   v.items.map((t) => ({ ...t, resource: t.resource_name, env: t.environment ?? "-", last_production: t.last_production ? `${t.last_production.status} ${t.last_production.commit_oid.slice(0, 12)}` : "-" })),
   ["name", "id", "platform", "resource", "env", "branch", "runs_on", "previews", "state", "last_production"]
 );
-var renderTarget = (t) => kv({ ...t, connection: t.connection ? `${t.connection.name} (${t.connection.id}, ${t.connection.state})` : "-", last_production: t.last_production ? `${t.last_production.id} ${t.last_production.status}` : "-" }, [
+var renderTarget = (t) => kv({ ...t, watch_paths: t.watch_paths?.length ? t.watch_paths.join(" ") : "every change", connection: t.connection ? `${t.connection.name} (${t.connection.id}, ${t.connection.state})` : "-", last_production: t.last_production ? `${t.last_production.id} ${t.last_production.status}` : "-" }, [
   "id",
   "name",
   "platform",
@@ -47761,6 +48211,7 @@ var renderTarget = (t) => kv({ ...t, connection: t.connection ? `${t.connection.
   "build_command",
   "output_directory",
   "runs_on",
+  "watch_paths",
   "previews",
   "preview_check_name",
   "last_production",
@@ -47797,7 +48248,7 @@ async function stepsOf(ctx, spec) {
   return v;
 }
 function targetOptions(cmd) {
-  return cmd.option("--platform <platform>", "workers | pages").option("--connection <connection>", "deploy connection (icn_\u2026)").option("--account-id <id>", "Cloudflare account id").option("--env <name>", "Wrangler environment (deploys with --env)").option("--worker <name>", "Worker name (or Pages project name)").option("--root <dir>", "root directory (where the Wrangler config lives)").option("--branch <name>", "production branch (default: the repository's default branch)").option("--install <cmd>", "install command").option("--build <cmd>", "build command").option("--output-dir <dir>", "Pages: the built site").option("--previews", "upload a preview of every open change").option("--no-previews", "no previews").option("--preview-agent-changes", "also preview changes made by agents or integrations, isolated (Worker Previews only)").option("--no-preview-agent-changes", "previews only for changes people upload").option("--preview-mode <mode>", "versions (preview version with an alias) | worker_previews (`wrangler preview`: Durable Objects allowed, bindings from the `previews` block)").option("--preview-check <name>", "report previews as this check").option("--runs-on <label>", "hosted runner size for the deploy jobs: brnch-hosted (default), brnch-hosted-1 \u2026 brnch-hosted-4 (your plan sets the largest)").option("--name <name>", "target name").option("--steps <json>", `pre/post steps as a JSON array, @file or - (replaces the list), e.g. '[{"id":"migrate","kind":"d1_migrations","phase":"pre"}]'`);
+  return cmd.option("--platform <platform>", "workers | pages").option("--connection <connection>", "deploy connection (icn_\u2026)").option("--account-id <id>", "Cloudflare account id").option("--env <name>", "Wrangler environment (deploys with --env)").option("--worker <name>", "Worker name (or Pages project name)").option("--root <dir>", "root directory (where the Wrangler config lives)").option("--branch <name>", "production branch (default: the repository's default branch)").option("--install <cmd>", "install command").option("--build <cmd>", "build command").option("--output-dir <dir>", "Pages: the built site").option("--previews", "upload a preview of every open change").option("--no-previews", "no previews").option("--preview-agent-changes", "also preview changes made by agents or integrations, isolated (Worker Previews only)").option("--no-preview-agent-changes", "previews only for changes people upload").option("--preview-mode <mode>", "versions (preview version with an alias) | worker_previews (`wrangler preview`: Durable Objects allowed, bindings from the `previews` block)").option("--preview-check <name>", "report previews as this check").option("--runs-on <label>", "hosted runner size for the deploy jobs: brnch-hosted (default), brnch-hosted-1 \u2026 brnch-hosted-4 (your plan sets the largest)").option("--watch-path <pattern>", "deploy only when these paths change (repeatable; replaces the list): CODEOWNERS patterns like apps/web/ or packages/**, ! excludes", (v, prev = []) => [...prev, v]).option("--watch-all", "deploy on every change (clears the watch paths)").option("--name <name>", "target name").option("--steps <json>", `pre/post steps as a JSON array, @file or - (replaces the list), e.g. '[{"id":"migrate","kind":"d1_migrations","phase":"pre"}]'`);
 }
 async function planSetup(ctx, repo, o) {
   const c8 = ctx.client("user").deploy;
@@ -47872,6 +48323,7 @@ async function planSetup(ctx, repo, o) {
     ...o.previewAgentChanges !== void 0 ? { preview_agent_changes: o.previewAgentChanges } : {},
     preview_check_name: o.previewCheck ?? null,
     ...o.runsOn ? { runs_on: o.runsOn } : {},
+    ...o.watchPath ? { watch_paths: o.watchPath } : {},
     ...o.branch ? { branch: o.branch } : {},
     ...o.steps !== void 0 ? { steps: await stepsOf(ctx, o.steps) } : {}
   };
@@ -47883,6 +48335,7 @@ async function waitFor(ctx, d, interval, timeout) {
   for (; ; ) {
     if (d.status !== last) ctx.info(`${d.id}: ${d.status}${d.status_reason ? ` (${d.status_reason})` : ""}`);
     last = d.status;
+    ctx.status.working(`Deploy ${d.status}`);
     if (TERMINAL4.has(d.status) || Date.now() > deadline) return d;
     await ctx.deps.sleep(Math.max(1, interval) * 1e3);
     d = await ctx.client("user").deploy.deployments.get(d.id);
@@ -47907,6 +48360,7 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
   targetOptions(deploy.command("update <target>").description("Change a deploy target (only the given flags; an empty value clears a command or the environment)")).option("--disable", "stop deploying (merges no longer deploy)").option("--enable", "deploy again").action(
     act(rt, async (ctx, o, [ref]) => {
       if (o.disable && o.enable) throw usage("give either --disable or --enable");
+      if (o.watchAll && o.watchPath) throw usage("give either --watch-path or --watch-all");
       const c8 = ctx.client("user").deploy.targets;
       const cur = await c8.get(await targetId(ctx, ref));
       const patch = {
@@ -47926,6 +48380,7 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
         preview_agent_changes: o.previewAgentChanges,
         preview_check_name: orNull(o.previewCheck),
         runs_on: o.runsOn,
+        watch_paths: o.watchAll ? [] : o.watchPath,
         state: o.disable ? "disabled" : o.enable ? "active" : void 0,
         steps: await stepsOf(ctx, o.steps)
       };
@@ -47972,7 +48427,7 @@ Merges to ${v.branch} deploy automatically. Deploy now: brnch deploy run ${v.id}
 var ITERATION_DONE = /* @__PURE__ */ new Set(["succeeded", "no_changes", "failed", "cancelled"]);
 var STATES = ["working", "waiting", "stopped"];
 var who2 = (a) => a.display_name ?? `${a.type} ${a.id}`;
-var short = (oid) => oid ? oid.slice(0, 12) : null;
+var short2 = (oid) => oid ? oid.slice(0, 12) : null;
 function vendorArg(v) {
   if (!CODING_AGENT_VENDORS.includes(v)) throw usage(`unknown agent "${v}"; one of ${CODING_AGENT_VENDORS.join(", ")}`);
   return v;
@@ -47992,7 +48447,7 @@ function renderIterations(d) {
     ...i,
     trigger: i.trigger_ref ? `${i.trigger} (${i.trigger_ref})` : i.trigger,
     by: who2(i.trigger_actor),
-    head: short(i.head_oid)
+    head: short2(i.head_oid)
   }));
   const claims = d.iterations.map(reported).filter((x) => !!x);
   const errors = d.iterations.filter((i) => i.error).map((i) => `  #${i.number}: ${i.error}`);
@@ -48055,6 +48510,7 @@ async function waitForIteration(ctx, start, o) {
     const line2 = `${delegationStatusLabel(d)}${it ? ` (iteration #${it.number}: ${it.state})` : ""}`;
     if (line2 !== last) ctx.info(line2);
     last = line2;
+    ctx.status.working(`${d.agent.name}: ${line2}`);
     if (it ? ITERATION_DONE.has(it.state) : d.state !== "working") return { d, timedOut: false };
     if (Date.now() > deadline) return { d, timedOut: true };
     await ctx.deps.sleep(Math.max(1, o.interval) * 1e3);
@@ -49006,15 +49462,16 @@ function registerImage(program2, rt) {
       ctx.result(page, (p) => listWithCursor(p, ["reference", "tags", "versions", "updated_at"]));
     })
   );
-  image.command("delete <ref>").description("Delete a tag (`<image>:<tag>`) or a version and all its tags (`<image>@sha256:\u2026`); untagged versions are also collected after the retention window").action(
+  image.command("delete <ref>").description("Delete a tag (`<image>:<tag>`), a version and all its tags (`<image>@sha256:\u2026`), or an image with no versions left (`<image>`); untagged versions are also collected after the retention window").action(
     act(rt, async (ctx, _o, [spec]) => {
       const ref = parseImageRef(spec, await registryHost(ctx));
-      if (!ref || !ref.tag && !ref.digest) throw usage(`invalid image reference "${spec}": expected <namespace>/<repository>[/<image>]:<tag> or \u2026@sha256:<digest>`);
+      if (!ref) throw usage(`invalid image reference "${spec}": expected <namespace>/<repository>[/<image>][:<tag>|@sha256:<digest>]`);
       const img = await findImage(ctx, ref.name);
       if (ref.digest) await ctx.client().packages.deleteVersion(img.id, ref.digest);
-      else await ctx.client().packages.deleteTag(img.id, ref.tag);
-      const what = ref.digest ? `version ${ref.digest}` : `tag ${ref.tag}`;
-      ctx.result({ image: img.full_name, deleted: ref.digest ? { digest: ref.digest } : { tag: ref.tag } }, `Deleted ${what} of ${img.full_name}.`);
+      else if (ref.tag) await ctx.client().packages.deleteTag(img.id, ref.tag);
+      else await ctx.client().packages.delete(img.id);
+      const what = ref.digest ? `version ${ref.digest} of ${img.full_name}` : ref.tag ? `tag ${ref.tag} of ${img.full_name}` : `image ${img.full_name}`;
+      ctx.result({ image: img.full_name, deleted: ref.digest ? { digest: ref.digest } : ref.tag ? { tag: ref.tag } : { image: img.id } }, `Deleted ${what}.`);
     })
   );
 }
@@ -49260,6 +49717,7 @@ async function waitForPromotion(ctx, p, timeout, interval) {
   let last = p.state;
   ctx.info(`promotion ${p.id}: ${p.state}`);
   while (!TERMINAL5.has(p.state) && Date.now() < deadline) {
+    ctx.status.working(`Merge ${p.state}`);
     await ctx.deps.sleep(Math.max(1, interval) * 1e3);
     p = await ctx.client().promotions.get(p.id);
     if (p.state !== last) ctx.info(`promotion ${p.id}: ${last = p.state}`);
@@ -51633,7 +52091,7 @@ function safeLegs(m) {
 }
 
 // packages/cli/src/commands/actions.ts
-var renderRun = (r) => kv({ ...r, actor: r.actor.display_name ?? r.actor.id, trust: `${r.definition.source} ${r.definition.ref}${r.definition.trusted ? " (trusted)" : " (contributor-controlled)"}` }, [
+var renderRun2 = (r) => kv({ ...r, actor: r.actor.display_name ?? r.actor.id, trust: `${r.definition.source} ${r.definition.ref}${r.definition.trusted ? " (trusted)" : " (contributor-controlled)"}` }, [
   "id",
   "workflow_name",
   "run_number",
@@ -51698,7 +52156,7 @@ function registerWorkflow(program2, rt) {
         inputs[kvp.slice(0, i)] = kvp.slice(i + 1);
       }
       const r = await ctx.client("user").actions.workflows.dispatch(await ctx.repoId(void 0, "user"), file2, { ...o.ref ? { ref: o.ref } : {}, inputs });
-      ctx.result(r, renderRun);
+      ctx.result(r, renderRun2);
     })
   );
 }
@@ -51722,6 +52180,8 @@ async function watchRun(ctx, runId, interval, timeout, logs) {
 ${text2.trimEnd()}`);
       }
     }
+    const finished = r.jobs.filter((j) => j.status === "completed").length;
+    ctx.status.working(`Run ${r.status}: ${finished}/${r.jobs.length} jobs done`, r.jobs.length ? finished / r.jobs.length * 100 : void 0);
     if (TERMINAL6.has(r.status) || Date.now() > deadline) return r;
     await ctx.deps.sleep(Math.max(1, interval) * 1e3);
   }
@@ -51741,13 +52201,13 @@ function registerRun(program2, rt) {
       const r = await c8.actions.runs.get(id2);
       if (o.log) for (const j of r.jobs) ctx.info(`\u2500\u2500 ${j.name} (${j.status}${j.conclusion ? `/${j.conclusion}` : ""}) \u2500\u2500
 ${(await c8.actions.jobs.logs(j.id)).trimEnd()}`);
-      ctx.result(r, renderRun);
+      ctx.result(r, renderRun2);
     })
   );
   run3.command("watch <run>").description("Follow a run until it completes. Exit 0 when it succeeded, 1 when it failed or was cancelled, 7 on timeout").option("--interval <seconds>", "poll interval", (v) => parseIntOption(v, "--interval"), 2).option("--timeout <seconds>", "give up after", (v) => parseIntOption(v, "--timeout"), 3600).option("--log", "print each job's log when it completes").action(
     act(rt, async (ctx, o, [id2]) => {
       const r = await watchRun(ctx, id2, o.interval, o.timeout, !!o.log);
-      ctx.result(r, renderRun);
+      ctx.result(r, renderRun2);
       ctx.setExit(runExit(r));
     })
   );
@@ -51772,8 +52232,8 @@ ${(await c8.actions.jobs.logs(j.id)).trimEnd()}`);
       ctx.result({ job_id: job2, conclusion: status }, `job ${job2}: ${status}`);
     })
   );
-  run3.command("cancel <run>").description("Cancel a run (running jobs are stopped on their runners)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").actions.runs.cancel(id2), renderRun)));
-  run3.command("rerun <run>").description("Re-run a completed run (all jobs, or --failed and their dependents)").option("--failed", "only failed/cancelled jobs and jobs that depend on them").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").actions.runs.rerun(id2, { failed_only: !!o.failed }), renderRun)));
+  run3.command("cancel <run>").description("Cancel a run (running jobs are stopped on their runners)").action(act(rt, async (ctx, _o, [id2]) => ctx.result(await ctx.client("user").actions.runs.cancel(id2), renderRun2)));
+  run3.command("rerun <run>").description("Re-run a completed run (all jobs, or --failed and their dependents)").option("--failed", "only failed/cancelled jobs and jobs that depend on them").action(act(rt, async (ctx, o, [id2]) => ctx.result(await ctx.client("user").actions.runs.rerun(id2, { failed_only: !!o.failed }), renderRun2)));
 }
 function registerSecret(program2, rt) {
   const secret = program2.command("secret").description("Actions secrets of --repo (default) or the organization (--org-level). Values are write-only");
@@ -52354,6 +52814,10 @@ ${res.stdout.slice(-8e3)}`;
 // packages/cli/src/runner/build-image-step.ts
 var BUILDKIT_IMAGE = "moby/buildkit:v0.34.0@sha256:b059f8d7226d0b326bc871af489a5dddf65e36af4d20d14251b072974d9ee87c";
 var COSIGN_IMAGE = "ghcr.io/sigstore/cosign/cosign:v3.1.3@sha256:9e5c2f2edc34351160407ca3416c61855bdf9403c3c5936e0f0be7fc261611b8";
+var BUILDKIT_RELEASE = { url: "https://github.com/moby/buildkit/releases/download/v0.34.0/buildkit-v0.34.0.linux-amd64.tar.gz", sha256: "14813b1fb2a40082114e6d386c6fc5e7dd5298176ce7ee1a18bc33e73e109ac3" };
+var COSIGN_RELEASE = { url: "https://github.com/sigstore/cosign/releases/download/v3.1.3/cosign-linux-amd64", sha256: "4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71" };
+var HOSTED_DIRS = { tools: "/opt/brnch/tools", state: "/var/lib/brnch-buildkit", run: "/run/brnch-buildkit", client: "/run/brnch-buildkit-client", context: "/run/brnch-build-context" };
+var BUILD_UID = 10999;
 var MAX_METADATA_OUTPUT = 32 * 1024;
 var list2 = (v) => (v ?? "").split(/[\n,]/).map((s) => s.trim()).filter(Boolean);
 var lines = (v) => (v ?? "").split("\n").map((s) => s.trim()).filter(Boolean);
@@ -52406,15 +52870,15 @@ function inside2(p) {
   }
   return parts.join("/");
 }
-function buildctlArgs(i, metadataFile) {
-  const ctx = inside2(i.context);
+function buildLayout(i) {
+  const context = inside2(i.context);
   const file2 = inside2(i.file ?? `${i.context}/Dockerfile`);
-  if (ctx === null) return `context: ${i.context} is outside the workspace`;
-  if (file2 === null) return `file: ${i.file} is outside the workspace`;
-  const slash = file2.lastIndexOf("/");
-  const dir = slash >= 0 ? file2.slice(0, slash) : "";
-  const base2 = slash >= 0 ? file2.slice(slash + 1) : file2;
-  const args = ["build", "--frontend", "dockerfile.v0", "--local", `context=/workspace/${ctx}`.replace(/\/$/, ""), "--local", `dockerfile=/workspace/${dir}`.replace(/\/$/, ""), "--opt", `filename=${base2}`];
+  if (context === null) return `context: ${i.context} is outside the workspace`;
+  if (file2 === null || file2 === "") return `file: ${i.file} is outside the workspace`;
+  return { context, file: file2, filename: file2.slice(file2.lastIndexOf("/") + 1) };
+}
+function buildctlArgs(i, layout, metadataFile, root = "/workspace") {
+  const args = ["build", "--frontend", "dockerfile.v0", "--local", `context=${root}/context`, "--local", `dockerfile=${root}/dockerfile`, "--opt", `filename=${layout.filename}`];
   args.push("--opt", `platform=${i.platforms.join(",")}`);
   if (i.target) args.push("--opt", `target=${i.target}`);
   for (const [k, v] of Object.entries(i.buildArgs)) args.push("--opt", `build-arg:${k}=${v}`);
@@ -52427,6 +52891,215 @@ function buildctlArgs(i, metadataFile) {
   args.push("--metadata-file", metadataFile);
   return args;
 }
+var quote2 = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+async function copyContext(d, layout, owner) {
+  const fresh2 = async (hosted) => {
+    if (d.hosted) return await d.run(["sh", "-c", `rm -rf ${hosted} && install -d -m 0700 ${hosted}`], { env: d.env, timeoutMs: 6e4 }) === 0 ? hosted : null;
+    const made = await d.capture(["mktemp", "-d", "/tmp/brnch-build-context.XXXXXXXX"], { env: d.env });
+    const dir2 = made.stdout.trim();
+    return made.code === 0 && dir2.startsWith("/tmp/brnch-build-context.") ? dir2 : null;
+  };
+  const staging = await fresh2(`${HOSTED_DIRS.context}-staging`);
+  const dir = staging && await fresh2(HOSTED_DIRS.context);
+  if (!staging || !dir) {
+    if (staging) await d.run(["rm", "-rf", staging], { env: d.env, timeoutMs: 6e4 });
+    return { error: "could not prepare the build context" };
+  }
+  const asStep = d.stepUser ? ["setpriv", `--reuid=${d.stepUser.uid}`, `--regid=${d.stepUser.gid}`, "--clear-groups", "--"] : [];
+  const asOwner = owner !== null && owner !== 0 ? ["setpriv", `--reuid=${owner}`, `--regid=${owner}`, "--clear-groups", "--"] : [];
+  const ws = (rel) => rel ? `${d.workspace}/${rel}` : d.workspace;
+  const ignore = `${layout.filename}.dockerignore`;
+  const stage = [
+    "set -e",
+    `w=$(cd -- ${quote2(d.workspace)} && pwd -P)`,
+    'inside() { case "$1" in "$w"/*) ;; *) echo "brnch/build-image@v1: $2 is outside the workspace" >&2; exit 3;; esac; }',
+    `c=$(cd -- ${quote2(ws(layout.context))} && pwd -P)`,
+    'case "$c" in "$w"|"$w"/*) ;; *) echo "brnch/build-image@v1: the context is outside the workspace" >&2; exit 3;; esac',
+    `fd=$(cd -- "$(dirname -- ${quote2(ws(layout.file))})" && pwd -P)`,
+    `r=$(realpath -- "$fd/$(basename -- ${quote2(ws(layout.file))})")`,
+    `inside "$r" ${quote2(layout.file)}`,
+    `cp -a -- "$c/." ${quote2(`${staging}/context`)}`,
+    `mkdir -- ${quote2(`${staging}/dockerfile`)}`,
+    `cp -- "$r" ${quote2(`${staging}/dockerfile/${layout.filename}`)}`,
+    // The name is the step's input: quoted into a variable, never into shell source (review of #287).
+    `ig=${quote2(ignore)}`,
+    'if [ -e "$fd/$ig" ]; then i=$(realpath -- "$fd/$ig"); inside "$i" "$ig"; cp -- "$i" ' + quote2(`${staging}/dockerfile/${ignore}`) + "; fi",
+    // Readable by the builder user for stage 2; the step's own files, nothing else.
+    `chmod -R a+rX ${quote2(staging)}`
+  ].join("; ");
+  const fail = async () => {
+    await d.run(["rm", "-rf", staging, dir], { env: d.env, timeoutMs: 6e4 });
+    return { error: `could not copy the build context (${layout.context || "."}) and ${layout.file}: they must be a directory and a file in the workspace that the job can read` };
+  };
+  for (const cmd of [
+    ...d.stepUser ? [["chown", `${d.stepUser.uid}:${d.stepUser.gid}`, staging], ["chmod", "0755", staging]] : [],
+    [...asStep, "sh", "-c", stage],
+    ...owner === null ? [] : [["chown", `${owner}:${owner}`, dir]],
+    // No trailing "/.": a top directory swapped for a link is copied as that link, and refused below.
+    [...asOwner, "cp", "-a", "--", `${staging}/context`, `${staging}/dockerfile`, `${dir}/`],
+    ["sh", "-c", 'for p in "$1/context" "$1/dockerfile"; do [ -d "$p" ] && [ ! -L "$p" ] || exit 1; done', "sh", dir],
+    ["rm", "-rf", staging]
+  ]) {
+    const done2 = await d.run(cmd, { env: d.env, timeoutMs: 10 * 6e4 });
+    if (done2 === null) return null;
+    if (done2 !== 0) return fail();
+  }
+  return dir;
+}
+function buildScopes(i, host, repository = "", dockerfile = "") {
+  const name = (ref) => ref.slice(host.length + 1).replace(/@.*$/, "").replace(/:[^/]*$/, "");
+  const want = /* @__PURE__ */ new Map();
+  const add = (ref, actions) => {
+    const n = name(ref);
+    want.set(n, /* @__PURE__ */ new Set([...want.get(n) ?? [], ...actions]));
+  };
+  if (i.push) for (const t of i.tags) add(t, ["pull", "push"]);
+  for (const c8 of i.cacheTo) add(/(?:^|,)ref=([^,]+)/.exec(c8)[1], ["pull", "push"]);
+  for (const c8 of i.cacheFrom) add(/(?:^|,)ref=([^,]+)/.exec(c8)[1], ["pull"]);
+  if (repository && dockerfile) {
+    for (const ref of dockerfileImages(dockerfile)) if (ownImage(ref, host, repository)) add(ref, ["pull"]);
+  }
+  return [...want].map(([n, a]) => `repository:${n}:${[...a].sort().join(",")}`);
+}
+function dockerfileImages(dockerfile) {
+  const out = [];
+  const all = dockerfile.replace(/\r\n/g, "\n").split("\n");
+  let escape = "\\";
+  for (const l of all) {
+    const d = /^\s*#\s*(syntax|escape|check)\s*=\s*(\S+)\s*$/i.exec(l);
+    if (!d) break;
+    if (d[1].toLowerCase() === "escape" && (d[2] === "`" || d[2] === "\\")) escape = d[2];
+  }
+  const uncommented = all.filter((l) => !l.trim().startsWith("#")).join("\n");
+  const lines2 = uncommented.split(`${escape}
+`).join(" ").split("\n");
+  const value = String.raw`("[^"]*"|'[^']*'|[^\s,]+)`;
+  const unquote = (v) => /^(["']).*\1$/.test(v) ? v.slice(1, -1) : v;
+  for (const raw of lines2) {
+    const line2 = raw.trim();
+    if (!line2) continue;
+    const from = /^FROM\s+(?:--platform=\S+\s+)?(\S+)/i.exec(line2);
+    if (from) out.push(from[1]);
+    if (/^(COPY|ADD)\s/i.test(line2)) for (const m of line2.matchAll(new RegExp(`--from=${value}`, "g"))) out.push(unquote(m[1]));
+    if (/^RUN\s/i.test(line2)) for (const m of line2.matchAll(new RegExp(String.raw`--mount=\S*?\bfrom=${value}`, "g"))) out.push(unquote(m[1]));
+  }
+  return out;
+}
+var OCI_PATH = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+function ownImage(ref, host, repository) {
+  const m = /^([^/]+)\/([^:@]+)(?::[\w][\w.-]{0,127})?(?:@sha256:[a-f0-9]{64})?$/.exec(ref);
+  if (!m || m[1] !== host || !OCI_PATH.test(m[2])) return false;
+  const own2 = repository.toLowerCase();
+  return m[2] === own2 || m[2].startsWith(`${own2}/`);
+}
+var BUILD_TOKEN_SECONDS = 21600;
+async function mintBuildToken(d, host, scopes) {
+  const url2 = new URL(`${new URL(d.baseUrl).protocol}//${host}/v2/token`);
+  url2.searchParams.set("service", host);
+  for (const s of scopes) url2.searchParams.append("scope", s);
+  url2.searchParams.set("expires_in", String(BUILD_TOKEN_SECONDS));
+  try {
+    const res = await d.fetch(url2.toString(), { headers: { authorization: `Bearer ${d.jobToken}` } });
+    const body = await res.json().catch(() => null);
+    if (res.ok && typeof body?.token === "string" && body.token) return body.token;
+    return { error: `the registry did not issue a token for this build (HTTP ${res.status})` };
+  } catch (e) {
+    return { error: `could not reach the registry for a token: ${e.message}` };
+  }
+}
+function dockerBuilder(d, auth, context) {
+  const name = `brnch-buildkit-${d.jobId.replace(/[^a-z0-9]/gi, "").toLowerCase()}`;
+  const docker = (a, timeoutMs = 10 * 6e4, env = d.env) => d.run(["docker", ...a], { env, timeoutMs });
+  return {
+    metadataFile: "/tmp/brnch-metadata.json",
+    contextRoot: "/workspace",
+    async start() {
+      d.log(`##[group]Start BuildKit (${BUILDKIT_IMAGE.split("@")[0]})`);
+      try {
+        const started = await docker(["run", "-d", "--rm", "--privileged", "--name", name, "-v", `${context}:/workspace:ro`, "-v", `${auth}:/root/.docker:ro`, BUILDKIT_IMAGE]);
+        if (started === null) return null;
+        if (started !== 0) return "could not start the BuildKit container";
+        return await waitReady(() => d.capture(["docker", "exec", name, "buildctl", "debug", "workers"], { env: d.env })) ? "" : "BuildKit did not become ready within 30 seconds";
+      } finally {
+        d.log("##[endgroup]");
+      }
+    },
+    buildctl: (args) => docker(["exec", name, "buildctl", ...args], null),
+    readMetadata: async () => (await d.capture(["docker", "exec", name, "cat", "/tmp/brnch-metadata.json"], { env: d.env })).stdout,
+    sign: (args, env) => docker(["run", "--rm", "--user", "0", "-v", `${auth}:/root/.docker:ro`, "-e", "DOCKER_CONFIG=/root/.docker", "-e", "COSIGN_KEY", "-e", "COSIGN_PASSWORD", COSIGN_IMAGE, ...args], 5 * 6e4, { ...d.env, ...env }),
+    stop: async () => {
+      await d.capture(["docker", "rm", "-f", name], { env: d.env });
+    }
+  };
+}
+function hostedBuilder(d, auth, signing, context) {
+  const tools = `${HOSTED_DIRS.tools}/build-image`;
+  const bin = `${tools}/buildkit/bin`;
+  const sock = `unix://${HOSTED_DIRS.client}/buildkitd.sock`;
+  const asBuilder = (cmd) => ["setpriv", `--reuid=${BUILD_UID}`, `--regid=${BUILD_UID}`, "--clear-groups", "--", ...cmd];
+  const buildctl = `${HOSTED_DIRS.client}/buildctl`;
+  const clientEnv = { ...d.env, DOCKER_CONFIG: auth, HOME: HOSTED_DIRS.client };
+  const run3 = (cmd, timeoutMs = 10 * 6e4, env = d.env) => d.run(cmd, { env, timeoutMs });
+  const fetchChecked = async (url2, sha2562, out) => {
+    const got = await run3(["curl", "-fsSL", "--retry", "3", "-o", out, url2], 5 * 6e4);
+    if (got === null) return null;
+    if (got !== 0) return `could not download ${url2}`;
+    const sum = (await d.capture(["sha256sum", out], { env: d.env })).stdout.split(/\s/)[0];
+    return sum === sha2562 ? "" : `${url2} has sha256 ${sum || "(unreadable)"}, not the pinned ${sha2562}`;
+  };
+  return {
+    metadataFile: `${HOSTED_DIRS.client}/metadata.json`,
+    contextRoot: context,
+    async start() {
+      d.log(`##[group]Start BuildKit (${BUILDKIT_RELEASE.url.split("/").at(-1)}, beside the job)`);
+      try {
+        for (const dir of [HOSTED_DIRS.tools, tools, `${tools}/buildkit`, HOSTED_DIRS.state, HOSTED_DIRS.run]) {
+          const made = await run3(["install", "-d", "-m", "0700", dir]);
+          if (made !== 0) return made === null ? null : `could not create ${dir}`;
+        }
+        for (const cmd of [["install", "-d", "-m", "0700", "-o", String(BUILD_UID), "-g", String(BUILD_UID), HOSTED_DIRS.client], ["chown", "-R", `${BUILD_UID}:${BUILD_UID}`, auth]]) {
+          const done2 = await run3(cmd);
+          if (done2 !== 0) return done2 === null ? null : `could not prepare the build user (${cmd[0]})`;
+        }
+        const tgz = `${tools}/buildkit.tar.gz`;
+        const got = await fetchChecked(BUILDKIT_RELEASE.url, BUILDKIT_RELEASE.sha256, tgz);
+        if (got !== "") return got;
+        const unpacked = await run3(["tar", "-xzf", tgz, "-C", `${tools}/buildkit`]);
+        if (unpacked !== 0) return unpacked === null ? null : "could not unpack BuildKit";
+        const client = await run3(["install", "-m", "0755", `${bin}/buildctl`, buildctl]);
+        if (client !== 0) return client === null ? null : "could not install buildctl for the build user";
+        if (signing) {
+          const cosign = await fetchChecked(COSIGN_RELEASE.url, COSIGN_RELEASE.sha256, `${tools}/cosign`);
+          if (cosign !== "") return cosign;
+          if (await run3(["chmod", "0700", `${tools}/cosign`]) !== 0) return "could not install cosign";
+        }
+        const daemon = `${bin}/buildkitd --root ${HOSTED_DIRS.state} --addr ${sock} --group ${BUILD_UID} --oci-worker-snapshotter=overlayfs --containerd-worker=false`;
+        const started = await run3(["sh", "-c", `PATH=${bin}:$PATH nohup ${daemon} > ${HOSTED_DIRS.run}/buildkitd.log 2>&1 & echo $! > ${HOSTED_DIRS.run}/buildkitd.pid`]);
+        if (started !== 0) return started === null ? null : "could not start buildkitd";
+        if (await waitReady(() => d.capture(asBuilder([buildctl, "--addr", sock, "debug", "workers"]), { env: clientEnv }))) return "";
+        d.log((await d.capture(["tail", "-20", `${HOSTED_DIRS.run}/buildkitd.log`], { env: d.env })).stdout);
+        return "BuildKit did not become ready within 30 seconds";
+      } finally {
+        d.log("##[endgroup]");
+      }
+    },
+    // buildctl reads registry credentials from DOCKER_CONFIG on the client side and hands them to buildkitd's session.
+    buildctl: (args) => run3(asBuilder([buildctl, "--addr", sock, ...args]), null, clientEnv),
+    readMetadata: async () => (await d.capture(["cat", `${HOSTED_DIRS.client}/metadata.json`], { env: d.env })).stdout,
+    sign: (args, env) => run3([`${tools}/cosign`, ...args], 5 * 6e4, { ...d.env, ...env, DOCKER_CONFIG: auth, HOME: auth }),
+    stop: async () => {
+      const pid = `${HOSTED_DIRS.run}/buildkitd.pid`;
+      await d.capture(["sh", "-c", `p=$(cat ${pid} 2>/dev/null); if [ -n "$p" ]; then kill $p 2>/dev/null; for i in 1 2 3 4 5 6 7 8 9 10; do kill -0 $p 2>/dev/null || break; sleep 1; done; kill -9 $p 2>/dev/null; fi; rm -rf ${HOSTED_DIRS.client} ${pid}`], { env: d.env });
+    }
+  };
+}
+async function waitReady(probe) {
+  for (let i = 0; i < 30; i++) {
+    if ((await probe()).code === 0) return true;
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return false;
+}
 async function runBuildImage(w, d) {
   const fail = (msg) => {
     d.log(`##[error]brnch/build-image@v1: ${msg}`);
@@ -52438,41 +53111,46 @@ async function runBuildImage(w, d) {
   const bad = checkRefs(parsed, host, d.repository);
   if (bad) return fail(bad);
   if (parsed.push && !parsed.tags.length) return fail("tags are required when pushing (or set push: false)");
-  if (d.hosted) {
-    return fail("hosted runners cannot build images yet: BuildKit inside Cloudflare Containers is waiting on a capability probe (ADR-0083 \xA76). Run this job on a self-hosted runner with Docker (runs-on: [self-hosted, \u2026]).");
-  }
-  if ((await d.capture(["docker", "info", "--format", "{{.ServerVersion}}"], { env: d.env })).code !== 0) {
+  if (d.hosted && parsed.platforms.some((p) => p !== "linux/amd64")) return fail("hosted runners are x86_64 and build linux/amd64 only; build linux/arm64 on a self-hosted runner that can");
+  if (!d.hosted && (await d.capture(["docker", "info", "--format", "{{.ServerVersion}}"], { env: d.env })).code !== 0) {
     return fail("this runner has no usable Docker (docker info failed); install Docker or run the job on a runner that has it");
   }
-  const args = buildctlArgs(parsed, "/tmp/brnch-metadata.json");
-  if (typeof args === "string") return fail(args);
-  const auth = `${d.temp}/build-image-${d.jobId}`;
-  d.writePrivate(`${auth}/config.json`, JSON.stringify({ auths: { [host]: { auth: btoa(`brnch:${d.jobToken}`) } } }));
-  const name = `brnch-buildkit-${d.jobId.replace(/[^a-z0-9]/gi, "").toLowerCase()}`;
-  const docker = (a, timeoutMs = 10 * 6e4, env = d.env) => d.run(["docker", ...a], { env, timeoutMs });
+  const layout = buildLayout(parsed);
+  if (typeof layout === "string") return fail(layout);
+  const context = await copyContext(d, layout, d.hosted ? BUILD_UID : d.stepUser ? 0 : null);
+  if (context === null) return { outcome: "cancelled", outputs: {} };
+  if (typeof context !== "string") return fail(context.error);
+  const auth = d.hosted ? `${HOSTED_DIRS.client}/docker` : `${d.temp}/build-image-${d.jobId}`;
+  const builder = d.hosted ? hostedBuilder(d, auth, !!parsed.cosignKey && parsed.push, context) : dockerBuilder(d, auth, context);
+  const args = buildctlArgs(parsed, layout, builder.metadataFile, builder.contextRoot);
+  const dockerfile = (await d.capture(["cat", "--", `${context}/dockerfile/${layout.filename}`], { env: d.env })).stdout;
+  const scopes = buildScopes(parsed, host, d.repository, dockerfile);
+  let credential = null;
+  if (scopes.length) {
+    const minted = await mintBuildToken(d, host, scopes);
+    if (typeof minted !== "string") {
+      await d.run(["rm", "-rf", context], { env: d.env, timeoutMs: 6e4 });
+      return fail(minted.error);
+    }
+    credential = minted;
+  }
+  d.writePrivate(`${auth}/config.json`, JSON.stringify({ auths: credential ? { [host]: { auth: btoa(`brnch:${credential}`) } } : {} }));
   try {
-    d.log(`##[group]Start BuildKit (${BUILDKIT_IMAGE.split("@")[0]})`);
-    const started = await docker(["run", "-d", "--rm", "--privileged", "--name", name, "-v", `${d.workspace}:/workspace:ro`, "-v", `${auth}:/root/.docker:ro`, BUILDKIT_IMAGE]);
-    if (started !== 0) return started === null ? { outcome: "cancelled", outputs: {} } : fail("could not start the BuildKit container");
-    let ready = false;
-    for (let i = 0; i < 30 && !ready; i++) {
-      ready = (await d.capture(["docker", "exec", name, "buildctl", "debug", "workers"], { env: d.env })).code === 0;
-      if (!ready) await new Promise((r) => setTimeout(r, 1e3));
-    }
-    d.log("##[endgroup]");
-    if (!ready) return fail("BuildKit did not become ready within 30 seconds");
+    const started = await builder.start();
+    if (started === null) return { outcome: "cancelled", outputs: {} };
+    if (started) return fail(started);
     d.log(`##[group]Build ${parsed.tags.join(", ") || "(no tags)"} for ${parsed.platforms.join(", ")}`);
-    const built = await docker(["exec", name, "buildctl", ...args], null);
+    const built = await builder.buildctl(args);
     d.log("##[endgroup]");
     if (built === null) return { outcome: "cancelled", outputs: {} };
     if (built !== 0) return fail(`the build failed (buildctl exited ${built})`);
-    const meta3 = await d.capture(["docker", "exec", name, "cat", "/tmp/brnch-metadata.json"], { env: d.env });
+    const meta3 = await builder.readMetadata();
     let digest = "";
     try {
-      digest = String(JSON.parse(meta3.stdout)["containerimage.digest"] ?? "");
+      digest = String(JSON.parse(meta3)["containerimage.digest"] ?? "");
     } catch {
     }
-    const outputs = { metadata: meta3.stdout.slice(0, MAX_METADATA_OUTPUT) };
+    const outputs = { metadata: meta3.slice(0, MAX_METADATA_OUTPUT) };
     if (parsed.push) {
       if (!/^sha256:[a-f0-9]{64}$/.test(digest)) return fail("the build pushed, but BuildKit reported no image digest");
       const first2 = parsed.tags[0].replace(/[:@][^/]*$/, "");
@@ -52481,9 +53159,9 @@ async function runBuildImage(w, d) {
       d.log(`pushed ${outputs.image}`);
       if (parsed.cosignKey) {
         d.log(`##[group]Sign ${outputs.image} with cosign`);
-        const signArgs = ["run", "--rm", "--user", "0", "-v", `${auth}:/root/.docker:ro`, "-e", "DOCKER_CONFIG=/root/.docker", "-e", "COSIGN_KEY", "-e", "COSIGN_PASSWORD", COSIGN_IMAGE, "sign", "--key", "env://COSIGN_KEY", "--yes"];
+        const signArgs = ["sign", "--key", "env://COSIGN_KEY", "--yes"];
         if (!parsed.cosignTlog) signArgs.push("--use-signing-config=false", "--tlog-upload=false");
-        const signed = await docker([...signArgs, outputs.image], 5 * 6e4, { ...d.env, COSIGN_KEY: parsed.cosignKey, COSIGN_PASSWORD: parsed.cosignPassword ?? "" });
+        const signed = await builder.sign([...signArgs, outputs.image], { COSIGN_KEY: parsed.cosignKey, COSIGN_PASSWORD: parsed.cosignPassword ?? "" });
         d.log("##[endgroup]");
         if (signed === null) return { outcome: "cancelled", outputs };
         if (signed !== 0) return fail(`cosign could not sign ${outputs.image} (exit ${signed})`);
@@ -52494,8 +53172,9 @@ async function runBuildImage(w, d) {
     }
     return { outcome: "success", outputs };
   } finally {
-    await d.capture(["docker", "rm", "-f", name], { env: d.env });
+    await builder.stop();
     d.removeDir(auth);
+    await d.run(["rm", "-rf", context], { env: d.env, timeoutMs: 6e4 });
   }
 }
 
@@ -53170,6 +53849,14 @@ async function runCodeReviewStep(spec, host) {
   return ok && parsed.status !== "failed" ? "success" : "failure";
 }
 
+// packages/cli/src/runner/checkout-retry.ts
+var CHECKOUT_RETRY_DELAYS_MS = [15e3, 3e4, 6e4, 12e4, 24e4];
+var RPC_FAILED = /\bRPC failed; (?:HTTP (?:429|5\d\d)\b|curl (?:6|7|16|18|28|35|52|55|56|92)\b)/;
+var UNABLE_TO_ACCESS = /\bunable to access '[^']*': (?:The requested URL returned error: (?:429|5\d\d)\b|Failed to connect|Could not resolve host|Connection timed out|Operation timed out|Recv failure|Send failure|Empty reply from server|OpenSSL SSL_)/;
+function transientGitFailure(line2) {
+  return RPC_FAILED.test(line2) || UNABLE_TO_ACCESS.test(line2);
+}
+
 // packages/cli/src/runner/executor.ts
 var NODE_OS = { linux: "Linux", darwin: "macOS", win32: "Windows" };
 var NODE_ARCH = { x64: "X64", arm64: "ARM64", arm: "ARM" };
@@ -53419,6 +54106,12 @@ var JobExecution = class {
     }
     spawnSync2("rm", ["-rf", "--", gone], { uid: this.owner.uid, gid: this.owner.gid, stdio: "ignore" });
   }
+  /** Wait `ms`, cut short when the job is cancelled: whether the job may go on. */
+  async pause(ms) {
+    const until = Date.now() + ms;
+    while (!this.cancelled && Date.now() < until) await new Promise((r) => setTimeout(r, Math.min(1e3, until - Date.now())));
+    return !this.cancelled;
+  }
   /** Run one process with streamed, masked output. Resolves to its exit code, or null if it was killed. */
   exec(cmd, o) {
     return new Promise((resolveExit) => {
@@ -53696,18 +54389,41 @@ var JobExecution = class {
     }
     const depth = w["fetch-depth"] === void 0 ? 1 : Number(w["fetch-depth"]);
     const env = this.gitEnv();
-    const git4 = (args) => this.exec(["git", ...args], { cwd: this.workspace, env, asStepUser: false, timeoutMs: 30 * 6e4 });
+    let transient = false;
+    const onLine = (l) => {
+      if (transientGitFailure(l)) transient = true;
+      return false;
+    };
+    const git4 = (args) => {
+      transient = false;
+      return this.exec(["git", ...args], { cwd: this.workspace, env, asStepUser: false, timeoutMs: 30 * 6e4, onLine });
+    };
+    const fetchCommit = async (args) => {
+      for (let attempt = 0; ; attempt++) {
+        const code2 = await git4(["fetch", ...args]);
+        const delay = CHECKOUT_RETRY_DELAYS_MS[attempt];
+        if (code2 === 0 || code2 === null || !transient) return code2;
+        if (delay === void 0 || Date.now() + delay >= this.deadline) {
+          this.log("##[error]the server kept failing the fetch; the repository's storage may be busy. Run the job again in a few minutes");
+          return code2;
+        }
+        this.log(`##[brnch] the server could not answer the fetch; retrying in ${delay / 1e3} s (attempt ${attempt + 2} of ${CHECKOUT_RETRY_DELAYS_MS.length + 1})`);
+        if (!await this.pause(delay)) return null;
+      }
+    };
     this.discard(this.workspace);
     mkdirSync3(this.workspace, { mode: 493 });
     const branch = a.ref.startsWith("refs/heads/") ? a.ref.slice("refs/heads/".length) : null;
     const fetchAndCheckout = async () => {
       for (const args of [["init", "-q"], ["remote", "add", "origin", this.gitUrl()]]) if (await git4(args) !== 0) return 1;
-      let code2 = depth > 0 ? await git4(["fetch", "--no-tags", "--prune", `--depth=${depth}`, "origin", a.head_sha]) : 1;
-      if (code2 !== 0) {
-        if (this.cancelled) return null;
-        if (depth > 0) this.log("##[brnch] shallow fetch is not available here; fetching full history of the commit");
-        code2 = await git4(["fetch", "--no-tags", "origin", a.head_sha]);
-      }
+      let code2;
+      if (depth > 0) {
+        code2 = await fetchCommit(["--no-tags", "--prune", `--depth=${depth}`, "origin", a.head_sha]);
+        if (code2 !== 0 && code2 !== null && !transient) {
+          this.log("##[brnch] the shallow fetch failed; fetching full history of the commit");
+          code2 = await fetchCommit(["--no-tags", "origin", a.head_sha]);
+        }
+      } else code2 = await fetchCommit(["--no-tags", "origin", a.head_sha]);
       if (code2 !== 0) return code2;
       return git4(branch ? ["checkout", "-q", "-B", branch, a.head_sha] : ["checkout", "-q", "--detach", a.head_sha]);
     };
@@ -53752,6 +54468,7 @@ var JobExecution = class {
   async buildImageStep(w, env) {
     const r = await runBuildImage(w, {
       baseUrl: this.opts.baseUrl,
+      fetch: (url2, init) => fetch(url2, init),
       registryHost: this.a.registry_host ?? null,
       repository: this.a.repository.full_name,
       jobToken: this.a.job_token,
@@ -53759,6 +54476,7 @@ var JobExecution = class {
       workspace: this.workspace,
       temp: this.temp,
       hosted: this.opts.hosted,
+      stepUser: this.opts.stepUser ? { uid: this.opts.stepUser.uid, gid: this.opts.stepUser.gid } : null,
       log: (l) => this.log(l),
       run: (cmd, o) => this.exec(cmd, { cwd: this.workspace, env: o.env, asStepUser: false, timeoutMs: o.timeoutMs, onLine: this.onCommandLine }),
       capture: async (cmd, o) => {
@@ -53973,12 +54691,81 @@ function sanitizedEnv(env) {
   return out;
 }
 
+// packages/cli/src/runner/resources.ts
+import { statfs } from "node:fs/promises";
+import { cpus, freemem, totalmem, uptime } from "node:os";
+function cpuPercent(before, after) {
+  if (!before.length || before.length !== after.length) return null;
+  let idle = 0;
+  let total = 0;
+  for (let i = 0; i < after.length; i++) {
+    for (const key of ["user", "nice", "sys", "idle", "irq"]) {
+      const delta = after[i].times[key] - before[i].times[key];
+      if (delta < 0 || !Number.isFinite(delta)) return null;
+      total += delta;
+      if (key === "idle") idle += delta;
+    }
+  }
+  return total > 0 ? Math.round((1 - idle / total) * 1e3) / 10 : null;
+}
+var RunnerResourceCollector = class {
+  constructor(workDir, jobSlots) {
+    this.workDir = workDir;
+    this.jobSlots = jobSlots;
+  }
+  workDir;
+  jobSlots;
+  previous = null;
+  disk = null;
+  diskPending = false;
+  sample() {
+    const at = performance.now();
+    try {
+      this.refreshDisk();
+      const current = cpus();
+      const interval = this.previous ? Math.round(at - this.previous.at) : 0;
+      const cpu = this.previous && interval > 0 && interval <= 6e5 ? cpuPercent(this.previous.cpus, current) : null;
+      this.previous = { cpus: current, at };
+      const disk = this.disk && at - this.disk.at <= 6e4 ? this.disk : null;
+      const totalMemory = totalmem();
+      const parsed = RunnerResourceSnapshot.safeParse({
+        cpu_percent: cpu,
+        cpu_count: current.length,
+        cpu_interval_ms: cpu === null ? null : interval,
+        memory_total_bytes: totalMemory,
+        memory_available_bytes: Math.min(totalMemory, Math.max(0, freemem())),
+        disk_total_bytes: disk?.total ?? null,
+        disk_available_bytes: disk?.available ?? null,
+        uptime_seconds: Math.floor(uptime()),
+        job_slots: this.jobSlots
+      });
+      return parsed.success ? parsed.data : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  refreshDisk() {
+    if (this.diskPending) return;
+    this.diskPending = true;
+    void statfs(this.workDir).then((s) => {
+      const total = s.blocks * s.bsize;
+      const available = Math.min(total, Math.max(0, s.bavail * s.bsize));
+      this.disk = Number.isSafeInteger(total) && total > 0 && Number.isSafeInteger(available) ? { total, available, at: performance.now() } : null;
+    }).catch(() => {
+      this.disk = null;
+    }).finally(() => {
+      this.diskPending = false;
+    });
+  }
+};
+
 // packages/cli/src/runner/agent.ts
 var RunnerAgent = class {
   constructor(cfg, opts) {
     this.cfg = cfg;
     this.opts = opts;
     this.client = this.clientFor(cfg);
+    this.resources = new RunnerResourceCollector(opts.workDir, opts.once || cfg.ephemeral ? 1 : opts.jobs);
   }
   cfg;
   opts;
@@ -53990,6 +54777,7 @@ var RunnerAgent = class {
   exit = null;
   heartbeatTimer = null;
   taken = 0;
+  resources;
   clientFor(cfg) {
     return createClient({ baseUrl: cfg.url, token: cfg.credential, userAgent: `${BRAND.cli}-runner/${BRAND.version}`, headers: { "x-brnch-runner-version": BRAND.version }, ...this.opts.fetch ? { fetch: this.opts.fetch } : {} });
   }
@@ -54027,7 +54815,7 @@ var RunnerAgent = class {
   }
   async heartbeat() {
     try {
-      const r = await this.client.runner.heartbeat({ running_jobs: [...this.running.keys()] });
+      const r = await this.client.runner.heartbeat({ running_jobs: [...this.running.keys()], resources: this.resources.sample() });
       for (const id2 of r.cancel_jobs) this.running.get(id2)?.exec.cancel("cancelled by the server");
       for (const id2 of r.forget_jobs) this.running.get(id2)?.exec.abort("the server reassigned this job");
       if (r.removed) {
@@ -54074,6 +54862,7 @@ var RunnerAgent = class {
     await this.client.runner.diagnostics(diagnostics(this.cfg)).catch(() => void 0);
     const unhook = this.opts.onSignal?.((s) => this.shutdown(s)) ?? (() => void 0);
     this.heartbeatTimer = setInterval(() => void this.heartbeat(), Math.max(1, me.heartbeat_seconds) * 1e3);
+    await this.heartbeat();
     const single = this.opts.once || this.cfg.ephemeral;
     let backoff = 1e3;
     try {
@@ -55091,6 +55880,13 @@ var EXAMPLES = {
   "deploy run": [`${c7} deploy run production --wait || echo "deploy failed (exit $?)"`, `${c7} deploy run dpt_123 --commit 0123456789abcdef0123456789abcdef01234567`],
   "deploy update": [`${c7} deploy update production --build "npm run build:prod"`, `${c7} deploy update production --disable`],
   "deploy rollback": [`${c7} deploy rollback production --to dpl_123`],
+  "db sources add": [
+    `${c7} db suggest                                  # the migration directories found`,
+    `${c7} db sources add --name app --path db/migrations --format atlas --engine postgres --connection icn_123 --organization acme --database app --revisions-schema app_atlas`,
+    `op read "op://Infra/app-dsn/credential" | ${c7} db sources add --name app \u2026 --credential-mode dsn --dsn-file -`
+  ],
+  "db plan": [`${c7} db plan app`, `${c7} db plan app --ref my-branch --live`],
+  "db approve": [`${c7} db runs --source app`, `${c7} db approve dmr_123 --reason "reviewed the plan"`],
   version: [`${c7} version`, `${c7} version --json`],
   upgrade: [`${c7} upgrade --check`, `${c7} upgrade`, `${c7} upgrade --force`],
   doctor: [`${c7} doctor`, `${c7} doctor --json | jq '.checks[] | select(.status != "ok")'`],
@@ -55231,6 +56027,7 @@ function buildProgram(rt) {
   registerMemory(program2, rt);
   registerIntegrations(program2, rt);
   registerDeploy(program2, rt);
+  registerDb(program2, rt);
   registerDelegate(program2, rt);
   registerAgents(program2, rt);
   registerCodingAgents(program2, rt);
@@ -55305,17 +56102,44 @@ function report2(e, deps, state2) {
 `);
   return exitCode;
 }
-async function run2(argv, overrides = {}) {
+function agentToolFlag(argv) {
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--agent-tool") return argv[i + 1] ?? null;
+    if (argv[i].startsWith("--agent-tool=")) return argv[i].slice("--agent-tool=".length);
+  }
+  return null;
+}
+async function run2(argv, overrides = {}, parentStatus) {
   const merged = { ...nodeDeps(), ...overrides };
-  const deps = merged;
   const split = splitGitArgs(argv);
   const state2 = { exitCode: EXIT.OK, wroteResult: false, secrets: [], json: wantsJson(split.argv) };
+  state2.status = parentStatus ?? (programStatusEnabled(merged, detectAgent(merged.env, agentToolFlag(split.argv))) ? statusReporter(merged.stderr) : silentStatus);
+  const status = state2.status;
+  const deps = {
+    ...merged,
+    prompt: async (q) => {
+      const answered2 = status.ask();
+      try {
+        return await merged.prompt(q);
+      } finally {
+        answered2();
+      }
+    },
+    keys: merged.keys ? (fn2) => {
+      const answered2 = status.ask();
+      const stop = merged.keys(fn2);
+      return () => {
+        stop();
+        answered2();
+      };
+    } : null
+  };
   const invoke2 = async (sub, o = {}) => {
     const out = [];
     const err = [];
     const errSink = (s) => void err.push(s);
-    const quiet = o.quiet ? { stderr: { write: errSink }, stderrIsTTY: false, spawnGit: (args, g2) => deps.spawnGit(args, { ...g2, onOutput: errSink }) } : {};
-    const code2 = await run2(sub, { ...deps, ...o.cwd ? { cwd: o.cwd } : {}, ...o.capture ? { stdout: { write: (s) => out.push(s) } } : {}, ...quiet });
+    const quiet = o.quiet ? { stderr: { write: errSink }, stderrIsTTY: false, spawnGit: (args, g2) => merged.spawnGit(args, { ...g2, onOutput: errSink }) } : {};
+    const code2 = await run2(sub, { ...merged, ...o.cwd ? { cwd: o.cwd } : {}, ...o.capture ? { stdout: { write: (s) => out.push(s) } } : {}, ...quiet }, status);
     return { code: code2, stdout: out.join(""), stderr: err.join("") };
   };
   const program2 = buildProgram({ deps, state: state2, gitArgs: split.gitArgs, invoke: invoke2 });
@@ -55330,6 +56154,11 @@ async function run2(argv, overrides = {}) {
       await sendCrashReport(r, { baseUrl: state2.baseUrl ?? crashServer(deps.env), fetch: deps.sys.fetch, stderr: deps.stderr });
     }
   }
+  if (!parentStatus) {
+    const name = commandPath(program2, split.argv);
+    const what = name ? `${BRAND.cli} ${name}` : BRAND.cli;
+    status.finish(code === EXIT.OK, code === EXIT.OK ? `${what} finished` : `${what} failed (exit ${code})`);
+  }
   await saveBookmark(deps, state2);
   await updateHint(deps, state2);
   return code;