@tablation/crew 0.75.0 → 0.75.1

package/dist/cli.js

@@ -12505,1396 +12505,1444 @@ function formatWhoami(report) {
 `;
 }
 
-// src/cli.ts
-import { StaleWriteError as StaleWriteError9 } from "@tablation/client";
-
-// src/release-ship.ts
-var DAY_MS = 24 * 60 * 60 * 1e3;
-function releaserFor(release, shipName2) {
-  const named = release.ship;
-  if (!named || release.mode !== "local" && release.mode !== "integrate") return { releases: true, releaser: named ?? null };
-  return { releases: named.trim() === shipName2.trim(), releaser: named };
-}
-function nonReleaserNote(repo, releaser) {
-  return `release for ${repo} runs on ${releaser}`;
-}
-function missingReleaserWarning(repo, release, ships, now = Date.now()) {
-  if (release.ship || release.mode !== "local" && release.mode !== "integrate") return null;
-  const live = ships.filter((s) => s.last_seen && now - Date.parse(s.last_seen) <= DAY_MS);
-  if (live.length < 2) return null;
-  const names = live.map((s) => s.name ?? "?").join(", ");
-  return `${repo}: release.mode "${release.mode}" with no release.ship, and ${live.length} ships seen in the last day (${names}) \u2014 every one of them will try to release it. Set release.ship in .crew.yaml.`;
-}
-
-// src/watch.ts
-import { watch as watchFile, existsSync as existsSync23, statSync as statSync7, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
-var E = "\x1B[";
-var dim = (s) => `${E}2m${s}${E}0m`;
-var bold = (s) => `${E}1m${s}${E}0m`;
-var paintWith = (n) => (s) => `${E}${n}m${s}${E}0m`;
-var green = paintWith(32);
-var yellow = paintWith(33);
-var red = paintWith(31);
-var cyan = paintWith(36);
-var STEP_ORDER = ["poll", "sweep", "select", "worktree", "agent", "reconcile", "merge", "release", "idle"];
-var WORKING_STEPS = /* @__PURE__ */ new Set(["worktree", "agent", "reconcile", "merge", "release"]);
-function byRoute(events, route) {
-  return route ? events.filter((e) => e.route === route) : events;
+// src/seat-keys.ts
+import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl3 } from "@tablation/client";
+var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
+function keyIsAdmin(route) {
+  const role = route.resolved?.role;
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
 }
-function matches(e, f) {
-  if (f.role && e.role !== f.role) return false;
-  if (f.ticket && e.ticket !== f.ticket) return false;
-  if (f.route && e.route !== f.route) return false;
-  if (f.level === "warn" && e.level === "info") return false;
-  if (f.level === "error" && e.level !== "error") return false;
-  return true;
+var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
+var MEMBER_NO_KEY = 'no agent key for this seat \u2014 run `crew agents sync` (needs the "Mint agent keys" capability on your role)';
+var FORBIDDEN_LINE = 'seat keys: not minted \u2014 your role does not grant "Mint agent keys"; ask a workspace admin to add it to your project role (or run sync with an admin key)';
+function seatKeySlug(workspaceSlug, agentId) {
+  return `${workspaceSlug}#agent:${agentId}`;
 }
-function localTime(iso) {
-  const d = new Date(iso);
-  if (Number.isNaN(d.getTime())) return iso.slice(11, 19);
-  const pad = (n) => String(n).padStart(2, "0");
-  return `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
+function slugFor(route, agentId) {
+  const [workspaceSlug] = splitRoute(route.route);
+  return seatKeySlug(workspaceSlug, agentId);
 }
-function formatLine(e, showRoute = false) {
-  const t = dim(localTime(e.at));
-  const scope = e.role ? `${e.step}[${e.role}]` : e.step;
-  const paint = e.level === "error" ? red : e.level === "warn" ? yellow : cyan;
-  const route = showRoute ? `${dim(e.route)} ` : "";
-  const ticket = e.ticket ? ` ${bold(e.ticket)}` : "";
-  return `${t} ${route}${paint(scope.padEnd(14))}${ticket} ${e.message}`;
+function seatAgentId(route, role) {
+  return route.resolved?.agentPersonas?.[role]?.agentId;
 }
-function foldCycle(events) {
-  const last = events[events.length - 1];
-  if (!last) return null;
-  const ofCycle = events.filter((e) => e.cycle === last.cycle);
-  const first = ofCycle[0];
-  const state = {
-    cycle: last.cycle,
-    route: last.route,
-    step: last.step,
-    role: last.role,
-    ticket: [...ofCycle].reverse().find((e) => e.ticket && WORKING_STEPS.has(e.step))?.ticket,
-    startedAt: first.at,
-    lastAt: last.at,
-    warnings: ofCycle.filter((e) => e.level === "warn").length,
-    errors: ofCycle.filter((e) => e.level === "error").length
-  };
-  for (const e of ofCycle) {
-    if (typeof e.data?.rank === "number") state.rank = e.data.rank;
-    if (Array.isArray(e.data?.pending)) state.pending = e.data.pending;
-    if (Array.isArray(e.data?.blocked)) state.blockedTickets = e.data.blocked;
-    if (Array.isArray(e.data?.qaHeld)) state.qaHeldTickets = e.data.qaHeld;
-    if (e.step === "release" && typeof e.data?.cycles === "number") {
-      state.releaseBlockedCycles = e.data.cycles;
-      state.releaseBlockedReason = typeof e.data.reason === "string" ? e.data.reason : void 0;
-    }
+async function resolveReleaseKey(route, getStore = getSessionStore2) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
+  const agentId = route.resolved?.releaseAgentId;
+  if (!agentId) return ship(keyIsAdmin(route) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
+  try {
+    const session = await getStore().get(hostFromUrl3(route.baseUrl), slugFor(route, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship(keyIsAdmin(route) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
+  } catch {
+    return ship("OS keychain unavailable");
   }
-  return state;
-}
-function foldCycles(events) {
-  const routes = [...new Set(events.map((e) => e.route))];
-  return routes.map((r) => foldCycle(events.filter((e) => e.route === r))).filter((s) => s !== null).sort((a, b) => Date.parse(b.lastAt) - Date.parse(a.lastAt));
-}
-function renderHeader(s, now = Date.now()) {
-  if (!s) return dim("no cycle seen yet - waiting for the crew to run\n");
-  const elapsed = Math.max(0, Math.round((now - Date.parse(s.lastAt)) / 1e3));
-  const progress = STEP_ORDER.map((st) => st === s.step ? bold(green(st)) : dim(st)).join(dim(" > "));
-  const bits = [
-    `${bold(s.route)}  cycle ${s.cycle}`,
-    s.role ? `role ${bold(s.role)}` : null,
-    s.ticket ? `ticket ${bold(s.ticket)}` : null,
-    s.rank !== void 0 ? dim(`rank ${s.rank}`) : null,
-    s.pending?.length ? dim(`pending: ${s.pending.join(" ")}`) : null,
-    s.errors ? red(`${s.errors} error(s)`) : s.warnings ? yellow(`${s.warnings} warning(s)`) : null,
-    dim(`${elapsed}s in ${s.step}`)
-  ].filter(Boolean);
-  const releaseLine = s.releaseBlockedCycles ? red(
-    `release BLOCKED (${s.releaseBlockedCycles} cycle${s.releaseBlockedCycles === 1 ? "" : "s"}): ${s.releaseBlockedReason ?? "unknown reason"}`
-  ) : null;
-  const extra = [
-    releaseLine,
-    s.blockedTickets?.length ? dim(`blocked: ${s.blockedTickets.join(" ")}`) : null,
-    s.qaHeldTickets?.length ? dim(`qa holding: ${s.qaHeldTickets.join(" ")}`) : null
-  ].filter(Boolean);
-  const extraLines = extra.length ? `${extra.join("\n")}
-` : "";
-  return `${bits.join(dim("  |  "))}
-${extraLines}${progress}
-${dim("-".repeat(72))}
-`;
 }
-function renderHeaders(states, now = Date.now()) {
-  if (!states.length) return dim("no cycle seen yet - waiting for the crew to run\n");
-  return states.map((s) => renderHeader(s, now)).join("");
+async function resolveSeatKey(route, role, getStore = getSessionStore2) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
+  if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
+  const agentId = seatAgentId(route, role);
+  if (!agentId) return ship(keyIsAdmin(route) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
+  try {
+    const session = await getStore().get(hostFromUrl3(route.baseUrl), slugFor(route, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship(keyIsAdmin(route) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
+  } catch {
+    return ship("OS keychain unavailable");
+  }
 }
-function readFrom(file, from) {
-  if (!existsSync23(file)) return { events: [], offset: from };
-  const size = statSync7(file).size;
-  if (size < from) return readFrom(file, 0);
-  if (size === from) return { events: [], offset: from };
-  const fd = openSync4(file, "r");
-  const buf = Buffer.alloc(size - from);
-  readSync2(fd, buf, 0, buf.length, from);
-  closeSync4(fd);
-  const text = buf.toString("utf8");
-  const lastNewline = text.lastIndexOf("\n");
-  if (lastNewline === -1) return { events: [], offset: from };
-  const events = [];
-  for (const line of text.slice(0, lastNewline).split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      events.push(JSON.parse(line));
-    } catch {
-    }
+function describeStoreError(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (/User interaction is not allowed/i.test(msg)) {
+    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
   }
-  return { events, offset: from + Buffer.byteLength(text.slice(0, lastNewline + 1), "utf8") };
+  return "keychain unavailable (could not write to the OS keychain)";
 }
-function startWatch(o) {
-  const out = o.out ?? ((s) => process.stdout.write(s));
-  const filter = o.filter ?? {};
-  let all = [];
-  let offset = 0;
-  let paused = false;
-  const showRoute = () => !filter.route && new Set(all.map((e) => e.route)).size > 1;
-  const seed = readFrom(o.file, 0);
-  all = seed.events;
-  offset = seed.offset;
-  for (const e of all.slice(-(o.tail ?? 20)).filter((x) => matches(x, filter))) out(`${formatLine(e, showRoute())}
-`);
-  out(renderHeaders(foldCycles(byRoute(all, filter.route))));
-  const pump = () => {
-    const { events, offset: next } = readFrom(o.file, offset);
-    offset = next;
-    if (!events.length) return;
-    all = [...all, ...events].slice(-5e3);
-    if (paused) return;
-    for (const e of events) if (matches(e, filter)) out(`${formatLine(e, showRoute())}
-`);
-    out(renderHeaders(foldCycles(byRoute(all, filter.route))));
-  };
-  const timer = setInterval(pump, 1e3);
-  let watcher;
+async function mintMissingSeatKeys(route, o) {
+  const out = [];
+  if (!route.resolved) return out;
+  const resolved = route.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+  ];
+  let store;
   try {
-    watcher = watchFile(o.file, { persistent: false }, pump);
-  } catch {
+    store = (o.getStore ?? getSessionStore2)();
+  } catch (e) {
+    return targets.map(({ role }) => ({
+      role,
+      action: "failed",
+      detail: describeStoreError(e)
+    }));
   }
-  const stdin = process.stdin;
-  const stop = () => {
-    clearInterval(timer);
-    watcher?.close();
-    if (stdin.isTTY) {
-      stdin.setRawMode(false);
-      stdin.pause();
-      stdin.off("data", onKey);
-    }
-  };
-  const onKey = (k) => {
-    const s = k.toString();
-    if (s === " ") {
-      paused = !paused;
-      out(dim(paused ? "\n-- paused (space to resume) --\n" : "-- resumed --\n"));
+  const host = hostFromUrl3(route.baseUrl);
+  const base = route.baseUrl.replace(/\/+$/, "");
+  if (!o.dryRun) {
+    const probeSlug = seatKeySlug(splitRoute(route.route)[0], "_probe");
+    try {
+      await store.set(host, probeSlug, {
+        apiKey: "probe",
+        shipId: "",
+        workspaceId: resolved.workspaceId,
+        identityId: "_probe",
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      await store.clear(host, probeSlug);
+    } catch (e) {
+      const detail = `${describeStoreError(e)}; no keys minted`;
+      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
     }
-    if (s === "q" || s === "") {
-      stop();
-      process.exit(0);
-    }
-  };
-  if (stdin.isTTY) {
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.on("data", onKey);
   }
-  return stop;
-}
-
-// src/inbox.ts
-function matchMembers(rows, query) {
-  const q = query.trim().toLowerCase();
-  const asEmail = q.includes("@");
-  return rows.filter((r) => asEmail ? (r.email ?? "").toLowerCase() === q : (r.name ?? "").toLowerCase().includes(q)).map((r) => ({ id: r.id, name: r.name ?? "", email: r.email ?? "", by: asEmail ? "email" : "name" }));
-}
-async function gatherInbox(routes, ship, opts = {}) {
-  const items = [];
-  const errors = [];
-  const resolved = [];
-  await Promise.all(routes.map(async (route) => {
+  for (const { role, agentId } of targets) {
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug = slugFor(route, agentId);
     try {
-      const tracker = new Tracker(route, ship);
-      const [tickets, crewRows] = await Promise.all([tracker.openTickets(), tracker.crewRows()]);
-      const roster = buildRoster(configuredMembers(route), crewRows);
-      let mine;
-      if (opts.memberQuery) {
-        const hits = matchMembers(crewRows, opts.memberQuery);
-        resolved.push({
-          route: route.route,
-          names: hits.map((h) => h.name),
-          emails: hits.map((h) => h.email).filter(Boolean),
-          by: hits[0]?.by ?? null
-        });
-        mine = new Set(hits.map((h) => h.id));
-      } else {
-        mine = opts.memberIds ?? new Set([route.resolved?.operator].filter(Boolean));
+      if ((await store.get(host, slug))?.apiKey) {
+        out.push({ role, action: "already_stored" });
+        continue;
       }
-      const c = tracker.contract;
-      for (const t of tickets) {
-        if (!t.assignee_id || !mine.has(t.assignee_id)) continue;
-        if (opts.statuses && !opts.statuses.has(t.status)) continue;
-        if (!opts.includeClosed && c.statuses.resolved.includes(t.status)) continue;
-        items.push({
-          route: route.route,
-          ticket: t,
-          assignee: crewLabel(roster.get(t.assignee_id)),
-          rank: rankScalar(t, c),
-          effective: effectivePriority(t, c),
-          contract: c
+      if (o.dryRun) {
+        out.push({ role, action: "minted", detail: "dry run" });
+        continue;
+      }
+      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${resolveApiKey(route)}`,
+          "Content-Type": "application/json",
+          "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+        },
+        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
+      });
+      if (res.status === 403) {
+        out.push({ role, action: "forbidden" });
+        break;
+      }
+      if (!res.ok) {
+        out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
+        continue;
+      }
+      const body = await res.json();
+      if (!body.key) {
+        out.push({ role, action: "failed", detail: "response carried no key" });
+        continue;
+      }
+      try {
+        const session = {
+          apiKey: body.key,
+          shipId: o.shipName ?? "",
+          workspaceId: resolved.workspaceId,
+          identityId: agentId,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...body.id ? { keyId: body.id } : {}
+        };
+        await store.set(host, slug, session);
+      } catch (e) {
+        let revoked = false;
+        if (body.id) {
+          try {
+            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
+              method: "DELETE",
+              headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+            });
+            revoked = del2.ok;
+          } catch {
+            revoked = false;
+          }
+        }
+        out.push({
+          role,
+          action: "failed",
+          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
         });
+        continue;
       }
+      out.push({ role, action: "minted" });
     } catch (e) {
-      errors.push({ route: route.route, error: e.message });
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
     }
-  }));
-  items.sort((a, b) => a.rank - b.rank);
-  const byName = resolved.filter((r) => r.by === "name" && r.names.length);
-  const distinct = new Set(byName.flatMap((r) => r.names));
-  const ambiguous = byName.length > 1 && distinct.size > 1;
-  return { items, errors, resolved, ambiguous };
+  }
+  return out;
 }
-function renderInbox(items, byConnection = false, subject) {
-  if (items.length === 0) return `nothing assigned to ${subject ?? "you"}
-`;
-  const key = (i) => byConnection ? i.route : i.ticket.status;
-  const groups = /* @__PURE__ */ new Map();
-  for (const i of items) {
-    const g = groups.get(key(i));
-    if (g) g.push(i);
-    else groups.set(key(i), [i]);
+function describeMintOutcome(o) {
+  switch (o.action) {
+    case "minted":
+      return `${o.role}: agent key minted${o.detail ? ` (${o.detail})` : ""}`;
+    case "already_stored":
+      return `${o.role}: agent key already stored`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
+    case "forbidden":
+      return FORBIDDEN_LINE;
+    case "failed":
+      return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
   }
+}
+async function revokeSeatKeys(route, o) {
   const out = [];
-  for (const [name, group] of groups) {
-    out.push(`${name}  (${group.length})`);
-    for (const i of group) {
-      const t = i.ticket;
-      const where = byConnection ? t.status : i.route;
-      out.push(
-        `  ${displayKey(t).padEnd(10)} p${i.effective} ${(t.severity ?? "--").padEnd(3)} ${where.padEnd(14)} ${(t.title ?? "").slice(0, 62)}`
-      );
-    }
-    out.push("");
+  if (!route.resolved) return out;
+  const resolved = route.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+  ];
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore2)();
+  } catch (e) {
+    return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
   }
-  return out.join("\n");
-}
-
-// src/fleet.ts
-function agedConnectionRank(rawRank, role, route, decision, state, now) {
-  if (role !== "dev" && role !== "design") return rawRank;
-  const waiting = state.fairness(route.route).waiting();
-  if (!waiting || waiting.ticket !== decision.actionable.top?.issue_id) return rawRank;
-  return agedRankScalar(rawRank, { since: waiting.since, weight: route.weight }, now);
-}
-async function decideFleet(o) {
-  const now = o.now ?? Date.now();
-  const eligible = o.routes.filter((c) => o.enabledOnly === false ? true : c.enabled);
-  const entries = await Promise.all(eligible.map(async (route) => {
+  const host = hostFromUrl3(route.baseUrl);
+  const base = route.baseUrl.replace(/\/+$/, "");
+  for (const { role, agentId } of targets) {
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug = slugFor(route, agentId);
     try {
-      const decision = await decideCycle({ route, ship: o.ship, state: o.state, emit: o.emit.forRoute(route.route) });
-      const sel = decision.selection;
-      if (!sel.selected) return { route, decision, rank: NOTHING_ACTIONABLE };
-      const rawRank = sel.ranks[sel.selected] ?? NOTHING_ACTIONABLE;
-      return {
-        route,
-        decision,
-        role: sel.selected,
-        rank: agedConnectionRank(rawRank, sel.selected, route, decision, o.state, now)
-      };
+      const session = await store.get(host, slug);
+      if (!session?.apiKey) {
+        out.push({ role, action: "not_stored" });
+        continue;
+      }
+      if (!session.keyId) {
+        out.push({ role, action: "failed", detail: "no key id was recorded when this key was minted \u2014 revoke it from the seat's Agents row" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "revoked", detail: "dry run" });
+        continue;
+      }
+      const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${session.keyId}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+      });
+      if (!del2.ok && del2.status !== 404) {
+        out.push({ role, action: "failed", detail: `${del2.status} ${del2.statusText}` });
+        continue;
+      }
+      await store.clear(host, slug);
+      out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
     } catch (e) {
-      return { route, rank: NOTHING_ACTIONABLE, error: e.message };
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
     }
-  }));
-  for (const e of entries) {
-    if (e.error) o.emit.forRoute(e.route.route).error(`${e.route.route}: ${e.error}`, { step: "poll" });
   }
-  const contenders = entries.filter((e) => e.role && e.rank < NOTHING_ACTIONABLE);
-  const best = contenders.reduce(
-    (acc, e) => !acc || e.rank < acc.rank ? e : acc,
-    void 0
-  );
-  for (const e of entries) {
-    if (e.error || !e.decision) continue;
-    const won = best?.route.route === e.route.route;
-    o.state.fairness(e.route.route).record(e.decision.actionable.count, e.decision.actionable.top?.issue_id, won);
-    if (!o.dryRun) o.state.attention(e.route.route).persist(e.decision.attention);
+  return out;
+}
+function describeRevokeOutcome(o) {
+  switch (o.action) {
+    case "revoked":
+      return `${o.role}: agent key revoked and cleared from the keychain${o.detail ? ` (${o.detail})` : ""}`;
+    case "not_stored":
+      return `${o.role}: no agent key stored on this ship`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row`;
+    case "failed":
+      return `${o.role}: could not revoke the agent key (${o.detail ?? "unknown"}) \u2014 left in the keychain`;
   }
-  return {
-    entries,
-    winner: best && best.role && best.decision ? { route: best.route, role: best.role, decision: best.decision } : void 0,
-    unreachable: entries.filter((e) => e.error).map((e) => e.route.route)
-  };
 }
-var LOUD_STREAK = 5;
-function since(iso, now = Date.now()) {
-  const ms2 = Math.max(0, now - Date.parse(iso));
-  const mins = Math.round(ms2 / 6e4);
-  if (mins < 60) return `${mins}m`;
-  const hours = Math.round(mins / 60);
-  if (hours < 48) return `${hours}h`;
-  return `${Math.round(hours / 24)}d`;
+async function canMintAgentKeys(route, o = {}) {
+  const resolved = route.resolved;
+  if (!resolved) return void 0;
+  const agentId = seatAgentId(route, "dev") ?? SEAT_KEY_ROLES.map((r) => seatAgentId(route, r)).find(Boolean);
+  if (!agentId) return void 0;
+  try {
+    const res = await (o.fetchImpl ?? fetch)(`${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (res.ok) return true;
+    return res.status === 403 ? false : void 0;
+  } catch {
+    return void 0;
+  }
 }
-function renderFleet(f, state) {
-  const rows = f.entries.map((e) => {
-    if (e.error) return `  ${e.route.route.padEnd(16)} unreachable \u2014 ${e.error}`;
-    if (!e.role) return `  ${e.route.route.padEnd(16)} nothing pending`;
-    const pending = e.decision?.selection.pending.join(" ") ?? "";
-    const win = f.winner?.route.route === e.route.route ? "  <- runs this cycle" : "";
-    const streak = state?.fairness(e.route.route).streak() ?? 0;
-    const passedOver = !win && streak >= LOUD_STREAK ? `  ! passed over ${streak} cycles running` : "";
-    return `  ${e.route.route.padEnd(16)} ${e.role.padEnd(7)} rank ${String(e.rank).padStart(12)}  pending: ${pending}${win}${passedOver}`;
-  });
-  if (!rows.length) return "no enabled routes\n";
-  return `${rows.join("\n")}
-`;
+
+// src/seat-read-probe.ts
+var SEAT_NO_READ_REMEDY = "the project has no default role for agent keys \u2014 update the Issues app's template, then re-mint with `crew agents sync --revoke-seat-keys`, or assign the Crew seat role to the agent members";
+async function probeIssuesRead(route, apiKey, o = {}) {
+  const resolved = route.resolved;
+  if (!resolved?.models?.issues) return { state: "unknown", detail: "route has no resolved Issues table" };
+  const url = `${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/data-models/${resolved.models.issues}/records?limit=1`;
+  try {
+    const res = await (o.fetchImpl ?? fetch)(url, {
+      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (res.ok) return { state: "ok" };
+    if (res.status === 403) return { state: "forbidden" };
+    return { state: "unknown", detail: `HTTP ${res.status}` };
+  } catch (e) {
+    return { state: "unknown", detail: e.message };
+  }
 }
-function snapshot(tickets) {
+async function probeSeatReads(route, o = {}) {
+  const out = [];
+  const roles = [...SEAT_KEY_ROLES.filter((r) => route.resolved?.seats[r]), ...route.resolved?.releaseSeat ? ["release"] : []];
+  for (const role of roles) {
+    const id = role === "release" ? await resolveReleaseKey(route, o.getStore) : await resolveSeatKey(route, role, o.getStore);
+    if (id.kind !== "agent") continue;
+    out.push({ role, ...await probeIssuesRead(route, id.apiKey, o) });
+  }
+  return out;
+}
+function describeSeatForbidden(role) {
+  return `seat read:        ERROR ${role} agent key cannot read Issues (403) \u2014 ${SEAT_NO_READ_REMEDY}`;
+}
+function isForbiddenError(e) {
+  const status2 = e?.status;
+  if (status2 === 403) return true;
+  return /\b403\b/.test(e instanceof Error ? e.message : String(e));
+}
+var SEAT_FORBIDDEN_KEY = "seat_forbidden:release";
+function seatForbiddenItem(now = /* @__PURE__ */ new Date()) {
   return {
-    state: new Map(tickets.map((t) => [t.id, `${t.status}|${t.assignee_id ?? ""}|${t.updated_at}`]))
+    kind: "seat_forbidden",
+    key: SEAT_FORBIDDEN_KEY,
+    message: `release seat cannot read the Issues table (403) \u2014 ${SEAT_NO_READ_REMEDY}`,
+    since: now.toISOString()
   };
 }
-function changed(before, after) {
-  if (before.state.size !== after.state.size) return true;
-  for (const [id, v] of after.state) if (before.state.get(id) !== v) return true;
-  return false;
-}
-function nextRoles(decision, ran) {
-  return decision.selection.pending.filter((r) => !ran.includes(r)).sort((a, b) => (decision.selection.ranks[a] ?? 0) - (decision.selection.ranks[b] ?? 0));
+function seatForbiddenRepoLine(scope) {
+  return `${scope}: skipped \u2014 release seat cannot read Issues (see attention)`;
 }
 
-// src/ship-name.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync16, readFileSync as readFileSync22, renameSync as renameSync2, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname14 } from "path";
-import { parseDocument } from "yaml";
+// src/cli.ts
+import { StaleWriteError as StaleWriteError9 } from "@tablation/client";
 
-// src/machine-id.ts
-import { execFileSync as execFileSync4 } from "child_process";
-import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname13, join as join27 } from "path";
-function machineIdPathFor(stateDir) {
-  return join27(stateDir, "machine-id");
-}
-var sha256 = (s) => createHash4("sha256").update(s).digest("hex");
-function readRawMachineId(platform2 = process.platform) {
-  try {
-    if (platform2 === "darwin") {
-      const out = execFileSync4("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
-      });
-      return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
-    }
-    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync24(p)) {
-        const id = readFileSync21(p, "utf8").trim();
-        if (id) return id;
-      }
-    }
-  } catch {
-  }
-  return void 0;
+// src/release-ship.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function releaserFor(release, shipName2) {
+  const named = release.ship;
+  if (!named || release.mode !== "local" && release.mode !== "integrate") return { releases: true, releaser: named ?? null };
+  return { releases: named.trim() === shipName2.trim(), releaser: named };
 }
-function ensureMachineId(stateDir, opts = {}) {
-  if (opts.override?.trim()) return sha256(opts.override.trim());
-  const path = machineIdPathFor(stateDir);
-  if (existsSync24(path)) {
-    const cached = readFileSync21(path, "utf8").trim();
-    if (/^[0-9a-f]{64}$/.test(cached)) return cached;
-  }
-  const raw = (opts.read ?? readRawMachineId)();
-  if (!raw) return void 0;
-  const hashed = sha256(raw);
-  mkdirSync15(dirname13(path), { recursive: true });
-  writeFileSync17(path, `${hashed}
-`, { mode: 384 });
-  return hashed;
+function nonReleaserNote(repo, releaser) {
+  return `release for ${repo} runs on ${releaser}`;
 }
-function matchShipRows(ships, shipName2, machineId) {
-  const hasColumn = ships.some((r) => "machine_id" in r);
-  const byId = hasColumn && machineId ? ships.filter((r) => r.machine_id === machineId) : [];
-  if (byId.length > 0) return { rows: byId, by: "machine_id", hasColumn };
-  return { rows: ships.filter((r) => (r.name ?? "").trim() === shipName2.trim()), by: "name", hasColumn };
+function missingReleaserWarning(repo, release, ships, now = Date.now()) {
+  if (release.ship || release.mode !== "local" && release.mode !== "integrate") return null;
+  const live = ships.filter((s) => s.last_seen && now - Date.parse(s.last_seen) <= DAY_MS);
+  if (live.length < 2) return null;
+  const names = live.map((s) => s.name ?? "?").join(", ");
+  return `${repo}: release.mode "${release.mode}" with no release.ship, and ${live.length} ships seen in the last day (${names}) \u2014 every one of them will try to release it. Set release.ship in .crew.yaml.`;
 }
 
-// src/ship-name.ts
-var ShipNameError = class extends Error {
-};
-function validateShipName(raw) {
-  const name = raw.trim();
-  if (!name) throw new ShipNameError("the ship name cannot be empty");
-  if (/[\u0000-\u001f\u007f]/.test(name)) throw new ShipNameError("the ship name cannot contain control characters");
-  return name;
-}
-function planNameSync(local, row, lastSynced) {
-  if (local === row) return { drift: "none", action: "none" };
-  const rowMoved = lastSynced === void 0 || row !== lastSynced;
-  const localMoved = lastSynced === void 0 || local !== lastSynced;
-  if (rowMoved && localMoved) return { drift: "both", action: "row-wins" };
-  if (rowMoved) return { drift: "row", action: "adopt" };
-  return { drift: "local", action: "push" };
+// src/watch.ts
+import { watch as watchFile, existsSync as existsSync23, statSync as statSync7, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
+var E = "\x1B[";
+var dim = (s) => `${E}2m${s}${E}0m`;
+var bold = (s) => `${E}1m${s}${E}0m`;
+var paintWith = (n) => (s) => `${E}${n}m${s}${E}0m`;
+var green = paintWith(32);
+var yellow = paintWith(33);
+var red = paintWith(31);
+var cyan = paintWith(36);
+var STEP_ORDER = ["poll", "sweep", "select", "worktree", "agent", "reconcile", "merge", "release", "idle"];
+var WORKING_STEPS = /* @__PURE__ */ new Set(["worktree", "agent", "reconcile", "merge", "release"]);
+function byRoute(events, route) {
+  return route ? events.filter((e) => e.route === route) : events;
 }
-function shipNameOfYaml(text) {
-  const v = parseDocument(text).getIn(["ship", "name"]);
-  return typeof v === "string" && v.trim() ? v.trim() : void 0;
+function matches(e, f) {
+  if (f.role && e.role !== f.role) return false;
+  if (f.ticket && e.ticket !== f.ticket) return false;
+  if (f.route && e.route !== f.route) return false;
+  if (f.level === "warn" && e.level === "info") return false;
+  if (f.level === "error" && e.level !== "error") return false;
+  return true;
 }
-function setShipNameInYaml(text, name) {
-  const doc = parseDocument(text);
-  doc.setIn(["ship", "name"], name);
-  return doc.toString();
+function localTime(iso) {
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return iso.slice(11, 19);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
 }
-function pickShipRow(rows, machineId, byName = []) {
-  const hasColumn = rows.some((r) => "machine_id" in r);
-  if (!hasColumn || !machineId) return { kind: "unsupported" };
-  const byId = rows.filter((r) => r.machine_id === machineId);
-  if (byId.length === 1) return { kind: "row", row: byId[0], by: "machine_id" };
-  if (byId.length > 1) return { kind: "ambiguous" };
-  const names = new Set(byName.map((n) => n.trim()));
-  const named = rows.filter((r) => !r.machine_id && names.has((r.name ?? "").trim()));
-  if (named.length === 1) return { kind: "row", row: named[0], by: "name" };
-  return { kind: named.length > 1 ? "ambiguous" : "none" };
+function formatLine(e, showRoute = false) {
+  const t = dim(localTime(e.at));
+  const scope = e.role ? `${e.step}[${e.role}]` : e.step;
+  const paint = e.level === "error" ? red : e.level === "warn" ? yellow : cyan;
+  const route = showRoute ? `${dim(e.route)} ` : "";
+  const ticket = e.ticket ? ` ${bold(e.ticket)}` : "";
+  return `${t} ${route}${paint(scope.padEnd(14))}${ticket} ${e.message}`;
 }
-async function syncRouteName(i) {
-  const picked = pickShipRow(i.rows, i.machineId);
-  if (picked.kind !== "row") {
-    const status2 = picked.kind === "none" ? "no-row" : picked.kind;
-    return { status: status2, drift: "none", action: "none", name: i.local };
-  }
-  const rowName = (picked.row.name ?? "").trim();
-  if (!rowName) return { status: "no-row", drift: "none", action: "none", name: i.local };
-  const { drift, action } = planNameSync(i.local, rowName, i.lastSynced);
-  const base = { drift, rowId: picked.row.id, rowName };
-  if (action === "push") {
-    if (!i.rename) return { status: "ok", ...base, action, name: i.local };
-    try {
-      await i.rename(picked.row.id, i.local);
-    } catch (e) {
-      return { status: "refused", ...base, action: "none", name: i.local, error: e.message };
+function foldCycle(events) {
+  const last = events[events.length - 1];
+  if (!last) return null;
+  const ofCycle = events.filter((e) => e.cycle === last.cycle);
+  const first = ofCycle[0];
+  const state = {
+    cycle: last.cycle,
+    route: last.route,
+    step: last.step,
+    role: last.role,
+    ticket: [...ofCycle].reverse().find((e) => e.ticket && WORKING_STEPS.has(e.step))?.ticket,
+    startedAt: first.at,
+    lastAt: last.at,
+    warnings: ofCycle.filter((e) => e.level === "warn").length,
+    errors: ofCycle.filter((e) => e.level === "error").length
+  };
+  for (const e of ofCycle) {
+    if (typeof e.data?.rank === "number") state.rank = e.data.rank;
+    if (Array.isArray(e.data?.pending)) state.pending = e.data.pending;
+    if (Array.isArray(e.data?.blocked)) state.blockedTickets = e.data.blocked;
+    if (Array.isArray(e.data?.qaHeld)) state.qaHeldTickets = e.data.qaHeld;
+    if (e.step === "release" && typeof e.data?.cycles === "number") {
+      state.releaseBlockedCycles = e.data.cycles;
+      state.releaseBlockedReason = typeof e.data.reason === "string" ? e.data.reason : void 0;
     }
-    return { status: "ok", ...base, action, name: i.local };
-  }
-  if (action === "adopt" || action === "row-wins") return { status: "ok", ...base, action, name: rowName, from: i.local };
-  return { status: "ok", ...base, action, name: i.local };
-}
-function readSyncedName(resolvedFile) {
-  if (!existsSync25(resolvedFile)) return void 0;
-  try {
-    const v = JSON.parse(readFileSync22(resolvedFile, "utf8")).shipName;
-    return typeof v === "string" ? v : void 0;
-  } catch {
-    return void 0;
   }
+  return state;
 }
-function writeSyncedName(resolvedFile, name) {
-  if (!existsSync25(resolvedFile)) return;
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
-  } catch {
-    return;
-  }
-  if (raw.shipName === name) return;
-  raw.shipName = name;
-  mkdirSync16(dirname14(resolvedFile), { recursive: true });
-  const tmp = `${resolvedFile}.tmp${process.pid}`;
-  writeFileSync18(tmp, `${JSON.stringify(raw, null, 2)}
-`);
-  renameSync2(tmp, resolvedFile);
+function foldCycles(events) {
+  const routes = [...new Set(events.map((e) => e.route))];
+  return routes.map((r) => foldCycle(events.filter((e) => e.route === r))).filter((s) => s !== null).sort((a, b) => Date.parse(b.lastAt) - Date.parse(a.lastAt));
 }
-async function reconcileShipName(i) {
-  let local = i.ship.name;
-  try {
-    local = shipNameOfYaml(readFileSync22(i.configFile, "utf8")) ?? local;
-  } catch {
-  }
-  const resolvedFile = resolvedPathFor(i.stateDir, i.route);
-  const lastSynced = readSyncedName(resolvedFile);
-  let rows = [];
-  try {
-    rows = await i.rows();
-  } catch {
-  }
-  const result = await syncRouteName({
-    local,
-    lastSynced,
-    rows,
-    machineId: i.machineId,
-    rename: i.readOnly ? void 0 : i.rename
-  });
-  if (i.readOnly || result.status === "unsupported") return result;
-  if (result.status === "refused") {
-    i.emit?.warn(`could not rename the Ships row to "${local}": ${result.error}`, { step: "poll", data: { event: "ship_rename_refused", route: i.route, to: local } });
-    return result;
-  }
-  if (result.status !== "ok") return result;
-  if (result.action === "adopt" || result.action === "row-wins") {
-    const text = readFileSync22(i.configFile, "utf8");
-    writeFileSync18(i.configFile, setShipNameInYaml(text, result.name));
-    i.ship.name = result.name;
-    if (result.action === "row-wins") {
-      i.emit?.warn(
-        `ship name changed in both crew.yaml ("${result.from}") and the Ships table ("${result.name}"); the Ships row wins`,
-        { step: "poll", data: { event: "ship_renamed", route: i.route, from: result.from, to: result.name, source: "table", conflict: true } }
-      );
-    } else {
-      i.emit?.emit(`ship renamed to "${result.name}" in the Ships table; crew.yaml updated`, {
-        step: "poll",
-        data: { event: "ship_renamed", route: i.route, from: result.from, to: result.name, source: "table" }
-      });
+function renderHeader(s, now = Date.now()) {
+  if (!s) return dim("no cycle seen yet - waiting for the crew to run\n");
+  const elapsed = Math.max(0, Math.round((now - Date.parse(s.lastAt)) / 1e3));
+  const progress = STEP_ORDER.map((st) => st === s.step ? bold(green(st)) : dim(st)).join(dim(" > "));
+  const bits = [
+    `${bold(s.route)}  cycle ${s.cycle}`,
+    s.role ? `role ${bold(s.role)}` : null,
+    s.ticket ? `ticket ${bold(s.ticket)}` : null,
+    s.rank !== void 0 ? dim(`rank ${s.rank}`) : null,
+    s.pending?.length ? dim(`pending: ${s.pending.join(" ")}`) : null,
+    s.errors ? red(`${s.errors} error(s)`) : s.warnings ? yellow(`${s.warnings} warning(s)`) : null,
+    dim(`${elapsed}s in ${s.step}`)
+  ].filter(Boolean);
+  const releaseLine = s.releaseBlockedCycles ? red(
+    `release BLOCKED (${s.releaseBlockedCycles} cycle${s.releaseBlockedCycles === 1 ? "" : "s"}): ${s.releaseBlockedReason ?? "unknown reason"}`
+  ) : null;
+  const extra = [
+    releaseLine,
+    s.blockedTickets?.length ? dim(`blocked: ${s.blockedTickets.join(" ")}`) : null,
+    s.qaHeldTickets?.length ? dim(`qa holding: ${s.qaHeldTickets.join(" ")}`) : null
+  ].filter(Boolean);
+  const extraLines = extra.length ? `${extra.join("\n")}
+` : "";
+  return `${bits.join(dim("  |  "))}
+${extraLines}${progress}
+${dim("-".repeat(72))}
+`;
+}
+function renderHeaders(states, now = Date.now()) {
+  if (!states.length) return dim("no cycle seen yet - waiting for the crew to run\n");
+  return states.map((s) => renderHeader(s, now)).join("");
+}
+function readFrom(file, from) {
+  if (!existsSync23(file)) return { events: [], offset: from };
+  const size = statSync7(file).size;
+  if (size < from) return readFrom(file, 0);
+  if (size === from) return { events: [], offset: from };
+  const fd = openSync4(file, "r");
+  const buf = Buffer.alloc(size - from);
+  readSync2(fd, buf, 0, buf.length, from);
+  closeSync4(fd);
+  const text = buf.toString("utf8");
+  const lastNewline = text.lastIndexOf("\n");
+  if (lastNewline === -1) return { events: [], offset: from };
+  const events = [];
+  for (const line of text.slice(0, lastNewline).split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
     }
-  } else if (result.action === "push") {
-    i.emit?.emit(`ship name "${result.name}" pushed to the Ships table`, {
-      step: "poll",
-      data: { event: "ship_renamed", route: i.route, from: result.rowName, to: result.name, source: "crew.yaml" }
-    });
   }
-  writeSyncedName(resolvedFile, result.name);
-  return result;
+  return { events, offset: from + Buffer.byteLength(text.slice(0, lastNewline + 1), "utf8") };
 }
-async function reconcileRouteShipName(o) {
-  const fallback = { status: "unsupported", drift: "none", action: "none", name: o.ship.name };
-  if (!o.route.resolved?.shipsModelId) return fallback;
+function startWatch(o) {
+  const out = o.out ?? ((s) => process.stdout.write(s));
+  const filter = o.filter ?? {};
+  let all = [];
+  let offset = 0;
+  let paused = false;
+  const showRoute = () => !filter.route && new Set(all.map((e) => e.route)).size > 1;
+  const seed = readFrom(o.file, 0);
+  all = seed.events;
+  offset = seed.offset;
+  for (const e of all.slice(-(o.tail ?? 20)).filter((x) => matches(x, filter))) out(`${formatLine(e, showRoute())}
+`);
+  out(renderHeaders(foldCycles(byRoute(all, filter.route))));
+  const pump = () => {
+    const { events, offset: next } = readFrom(o.file, offset);
+    offset = next;
+    if (!events.length) return;
+    all = [...all, ...events].slice(-5e3);
+    if (paused) return;
+    for (const e of events) if (matches(e, filter)) out(`${formatLine(e, showRoute())}
+`);
+    out(renderHeaders(foldCycles(byRoute(all, filter.route))));
+  };
+  const timer = setInterval(pump, 1e3);
+  let watcher;
   try {
-    const machineId = o.machineId ?? ensureMachineId(o.ship.stateDir);
-    const tracker = new Tracker(o.route, o.ship);
-    return await reconcileShipName({
-      route: o.route.route,
-      configFile: o.configFile,
-      stateDir: o.ship.stateDir,
-      ship: o.ship,
-      machineId,
-      rows: () => tracker.shipRows(),
-      rename: (id, name) => tracker.renameShipRow(id, name),
-      emit: o.emit,
-      readOnly: o.readOnly
-    });
+    watcher = watchFile(o.file, { persistent: false }, pump);
   } catch {
-    return fallback;
-  }
-}
-
-// src/connect.ts
-var ConnectHttpError = class extends Error {
-  status;
-  path;
-  constructor(status2, path, statusText) {
-    super(`${path}: ${status2} ${statusText}`);
-    this.name = "ConnectHttpError";
-    this.status = status2;
-    this.path = path;
   }
-};
-async function get(o, path) {
-  const res = await fetch(`${o.baseUrl.replace(/\/+$/, "")}/api${path}`, {
-    headers: {
-      Authorization: `Bearer ${o.apiKey}`,
-      // Cloudflare 403s default agents on this host.
-      "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+  const stdin = process.stdin;
+  const stop = () => {
+    clearInterval(timer);
+    watcher?.close();
+    if (stdin.isTTY) {
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdin.off("data", onKey);
     }
-  });
-  if (!res.ok) throw new ConnectHttpError(res.status, path, res.statusText);
-  return await res.json();
-}
-async function post2(o, path, body) {
-  const res = await fetch(`${o.baseUrl.replace(/\/+$/, "")}/api${path}`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${o.apiKey}`,
-      "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0",
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new ConnectHttpError(res.status, path, res.statusText);
-  return await res.json();
-}
-async function patch(o, path, body) {
-  const res = await fetch(`${o.baseUrl.replace(/\/+$/, "")}/api${path}`, {
-    method: "PATCH",
-    headers: {
-      Authorization: `Bearer ${o.apiKey}`,
-      "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0",
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new ConnectHttpError(res.status, path, res.statusText);
-  return await res.json();
-}
-async function del(o, path) {
-  const res = await fetch(`${o.baseUrl.replace(/\/+$/, "")}/api${path}`, {
-    method: "DELETE",
-    headers: {
-      Authorization: `Bearer ${o.apiKey}`,
-      "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+  };
+  const onKey = (k) => {
+    const s = k.toString();
+    if (s === " ") {
+      paused = !paused;
+      out(dim(paused ? "\n-- paused (space to resume) --\n" : "-- resumed --\n"));
+    }
+    if (s === "q" || s === "") {
+      stop();
+      process.exit(0);
     }
-  });
-  if (!res.ok) throw new ConnectHttpError(res.status, path, res.statusText);
-}
-async function provisionReleaseLocks(o, locksModelId, route, repoNames) {
-  const scopes = [...new Set(repoNames)].sort().map((r) => releaseLockScope(route, r));
-  if (scopes.length === 0) return [];
-  const client2 = {
-    // The Locks table is a handful of rows, so read it whole and match in
-    // memory rather than depend on the HTTP filter syntax.
-    list: async (model, params) => {
-      const want = JSON.parse(params?.filters ?? "[]")[0]?.value;
-      const rows = await get(
-        o,
-        `/data-models/${model}/records?limit=500`
-      );
-      return rows.filter((r) => r.scope === want).slice(0, params?.limit ?? rows.length);
-    },
-    create: (model, body) => post2(o, `/data-models/${model}/records`, body),
-    remove: (model, id) => del(o, `/data-models/${model}/records/${id}`)
   };
-  return ensureLockRows(client2, locksModelId, scopes);
+  if (stdin.isTTY) {
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on("data", onKey);
+  }
+  return stop;
 }
-var ISSUES_TEMPLATE_IDENTIFIERS = ["tablation.issues", "crew.issues"];
-async function resolveIssuesTemplateKeys(o) {
-  const keys = new Set(ISSUES_TEMPLATE_IDENTIFIERS);
-  await Promise.all(ISSUES_TEMPLATE_IDENTIFIERS.map(async (identifier) => {
+
+// src/inbox.ts
+function matchMembers(rows, query) {
+  const q = query.trim().toLowerCase();
+  const asEmail = q.includes("@");
+  return rows.filter((r) => asEmail ? (r.email ?? "").toLowerCase() === q : (r.name ?? "").toLowerCase().includes(q)).map((r) => ({ id: r.id, name: r.name ?? "", email: r.email ?? "", by: asEmail ? "email" : "name" }));
+}
+async function gatherInbox(routes, ship, opts = {}) {
+  const items = [];
+  const errors = [];
+  const resolved = [];
+  await Promise.all(routes.map(async (route) => {
     try {
-      const t = await get(
-        o,
-        `/library-templates/by-identifier/${encodeURIComponent(identifier)}`
-      );
-      if (t.id) keys.add(t.id);
-      if (t.identifier) keys.add(t.identifier);
-    } catch {
+      const tracker = new Tracker(route, ship);
+      const [tickets, crewRows] = await Promise.all([tracker.openTickets(), tracker.crewRows()]);
+      const roster = buildRoster(configuredMembers(route), crewRows);
+      let mine;
+      if (opts.memberQuery) {
+        const hits = matchMembers(crewRows, opts.memberQuery);
+        resolved.push({
+          route: route.route,
+          names: hits.map((h) => h.name),
+          emails: hits.map((h) => h.email).filter(Boolean),
+          by: hits[0]?.by ?? null
+        });
+        mine = new Set(hits.map((h) => h.id));
+      } else {
+        mine = opts.memberIds ?? new Set([route.resolved?.operator].filter(Boolean));
+      }
+      const c = tracker.contract;
+      for (const t of tickets) {
+        if (!t.assignee_id || !mine.has(t.assignee_id)) continue;
+        if (opts.statuses && !opts.statuses.has(t.status)) continue;
+        if (!opts.includeClosed && c.statuses.resolved.includes(t.status)) continue;
+        items.push({
+          route: route.route,
+          ticket: t,
+          assignee: crewLabel(roster.get(t.assignee_id)),
+          rank: rankScalar(t, c),
+          effective: effectivePriority(t, c),
+          contract: c
+        });
+      }
+    } catch (e) {
+      errors.push({ route: route.route, error: e.message });
     }
   }));
-  return keys;
-}
-async function listLibraryTemplates(o) {
-  return get(o, "/library-templates");
+  items.sort((a, b) => a.rank - b.rank);
+  const byName = resolved.filter((r) => r.by === "name" && r.names.length);
+  const distinct = new Set(byName.flatMap((r) => r.names));
+  const ambiguous = byName.length > 1 && distinct.size > 1;
+  return { items, errors, resolved, ambiguous };
 }
-async function previewTemplateInstall(o, templateId, workspaceId) {
-  return get(o, `/library-templates/${templateId}/install-preview?workspaceId=${workspaceId}`);
+function renderInbox(items, byConnection = false, subject) {
+  if (items.length === 0) return `nothing assigned to ${subject ?? "you"}
+`;
+  const key = (i) => byConnection ? i.route : i.ticket.status;
+  const groups = /* @__PURE__ */ new Map();
+  for (const i of items) {
+    const g = groups.get(key(i));
+    if (g) g.push(i);
+    else groups.set(key(i), [i]);
+  }
+  const out = [];
+  for (const [name, group] of groups) {
+    out.push(`${name}  (${group.length})`);
+    for (const i of group) {
+      const t = i.ticket;
+      const where = byConnection ? t.status : i.route;
+      out.push(
+        `  ${displayKey(t).padEnd(10)} p${i.effective} ${(t.severity ?? "--").padEnd(3)} ${where.padEnd(14)} ${(t.title ?? "").slice(0, 62)}`
+      );
+    }
+    out.push("");
+  }
+  return out.join("\n");
 }
-async function installTemplate(o, templateId, workspaceId, projectName) {
-  return post2(o, `/library-templates/${templateId}/install`, {
-    workspaceId,
-    ...projectName ? { projectName } : {}
-  });
+
+// src/fleet.ts
+function agedConnectionRank(rawRank, role, route, decision, state, now) {
+  if (role !== "dev" && role !== "design") return rawRank;
+  const waiting = state.fairness(route.route).waiting();
+  if (!waiting || waiting.ticket !== decision.actionable.top?.issue_id) return rawRank;
+  return agedRankScalar(rawRank, { since: waiting.since, weight: route.weight }, now);
 }
-async function listWorkspaces(o) {
-  const res = await get(
-    o,
-    "/auth/my-workspaces"
+async function decideFleet(o) {
+  const now = o.now ?? Date.now();
+  const eligible = o.routes.filter((c) => o.enabledOnly === false ? true : c.enabled);
+  const entries = await Promise.all(eligible.map(async (route) => {
+    try {
+      const decision = await decideCycle({ route, ship: o.ship, state: o.state, emit: o.emit.forRoute(route.route) });
+      const sel = decision.selection;
+      if (!sel.selected) return { route, decision, rank: NOTHING_ACTIONABLE };
+      const rawRank = sel.ranks[sel.selected] ?? NOTHING_ACTIONABLE;
+      return {
+        route,
+        decision,
+        role: sel.selected,
+        rank: agedConnectionRank(rawRank, sel.selected, route, decision, o.state, now)
+      };
+    } catch (e) {
+      return { route, rank: NOTHING_ACTIONABLE, error: e.message };
+    }
+  }));
+  for (const e of entries) {
+    if (e.error) o.emit.forRoute(e.route.route).error(`${e.route.route}: ${e.error}`, { step: "poll" });
+  }
+  const contenders = entries.filter((e) => e.role && e.rank < NOTHING_ACTIONABLE);
+  const best = contenders.reduce(
+    (acc, e) => !acc || e.rank < acc.rank ? e : acc,
+    void 0
   );
-  return res.workspaces.map((w) => ({ slug: w.path ?? w.slug, name: w.name, role: w.role }));
+  for (const e of entries) {
+    if (e.error || !e.decision) continue;
+    const won = best?.route.route === e.route.route;
+    o.state.fairness(e.route.route).record(e.decision.actionable.count, e.decision.actionable.top?.issue_id, won);
+    if (!o.dryRun) o.state.attention(e.route.route).persist(e.decision.attention);
+  }
+  return {
+    entries,
+    winner: best && best.role && best.decision ? { route: best.route, role: best.role, decision: best.decision } : void 0,
+    unreachable: entries.filter((e) => e.error).map((e) => e.route.route)
+  };
 }
-var eq = (a, b) => (a ?? "").trim().toLowerCase() === b.trim().toLowerCase();
-function seatFor(rows, role) {
-  const r = rows.find((x) => (x.name ?? "").toLowerCase().includes(role.toLowerCase()));
-  return r?.id;
+var LOUD_STREAK = 5;
+function since(iso, now = Date.now()) {
+  const ms2 = Math.max(0, now - Date.parse(iso));
+  const mins = Math.round(ms2 / 6e4);
+  if (mins < 60) return `${mins}m`;
+  const hours = Math.round(mins / 60);
+  if (hours < 48) return `${hours}h`;
+  return `${Math.round(hours / 24)}d`;
 }
-var REQUIRED_TABLES = ["Issues"];
-async function missingTables(o, projectId) {
-  const models = await get(o, `/data-models?projectId=${projectId}`);
-  return REQUIRED_TABLES.filter((t) => !models.some((m) => eq(m.name, t)));
+function renderFleet(f, state) {
+  const rows = f.entries.map((e) => {
+    if (e.error) return `  ${e.route.route.padEnd(16)} unreachable \u2014 ${e.error}`;
+    if (!e.role) return `  ${e.route.route.padEnd(16)} nothing pending`;
+    const pending = e.decision?.selection.pending.join(" ") ?? "";
+    const win = f.winner?.route.route === e.route.route ? "  <- runs this cycle" : "";
+    const streak = state?.fairness(e.route.route).streak() ?? 0;
+    const passedOver = !win && streak >= LOUD_STREAK ? `  ! passed over ${streak} cycles running` : "";
+    return `  ${e.route.route.padEnd(16)} ${e.role.padEnd(7)} rank ${String(e.rank).padStart(12)}  pending: ${pending}${win}${passedOver}`;
+  });
+  if (!rows.length) return "no enabled routes\n";
+  return `${rows.join("\n")}
+`;
 }
-async function discover(o) {
-  const problems = [];
-  const provisioning = [];
-  const ws = await get(o, `/workspaces/${encodeURIComponent(o.workspace).replace(/%3A/gi, ":")}`);
-  const out = {
-    workspaceId: ws.id,
-    workspaceSlug: ws.path ?? ws.slug,
-    workspaceName: ws.name,
-    models: {},
-    seats: {},
-    holds: [],
-    candidates: [],
-    problems,
-    provisioning
+function snapshot(tickets) {
+  return {
+    state: new Map(tickets.map((t) => [t.id, `${t.status}|${t.assignee_id ?? ""}|${t.updated_at}`]))
   };
+}
+function changed(before, after) {
+  if (before.state.size !== after.state.size) return true;
+  for (const [id, v] of after.state) if (before.state.get(id) !== v) return true;
+  return false;
+}
+function nextRoles(decision, ran) {
+  return decision.selection.pending.filter((r) => !ran.includes(r)).sort((a, b) => (decision.selection.ranks[a] ?? 0) - (decision.selection.ranks[b] ?? 0));
+}
+
+// src/ship-name.ts
+import { existsSync as existsSync25, mkdirSync as mkdirSync16, readFileSync as readFileSync22, renameSync as renameSync2, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname14 } from "path";
+import { parseDocument } from "yaml";
+
+// src/machine-id.ts
+import { execFileSync as execFileSync4 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync24, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync17 } from "fs";
+import { dirname as dirname13, join as join27 } from "path";
+function machineIdPathFor(stateDir) {
+  return join27(stateDir, "machine-id");
+}
+var sha256 = (s) => createHash4("sha256").update(s).digest("hex");
+function readRawMachineId(platform2 = process.platform) {
   try {
-    const me = await get(o, `/auth/me?workspaceId=${ws.id}`);
-    out.role = me.role;
-    out.meEmail = me.email;
-    out.meId = me.id;
-    out.meIdentityId = me.identityId;
-    out.meName = me.name;
+    if (platform2 === "darwin") {
+      const out = execFileSync4("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+      return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
+    }
+    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      if (existsSync24(p)) {
+        const id = readFileSync21(p, "utf8").trim();
+        if (id) return id;
+      }
+    }
   } catch {
   }
-  if (o.project) {
-    try {
-      const p = await get(
-        o,
-        `/projects/${encodeURIComponent(o.project)}?workspaceId=${ws.id}`
-      );
-      out.projectId = p.id;
-      out.projectSlug = p.slug;
-      out.projectName = p.name;
-    } catch {
-      const projects = await get(o, `/projects?workspaceId=${ws.id}`);
-      const hit = projects.find((p) => eq(p.name, o.project));
-      if (hit) {
-        out.projectId = hit.id;
-        out.projectSlug = hit.slug;
-        out.projectName = hit.name;
-      } else problems.push(`no project named or slugged "${o.project}" \u2014 have: ${projects.map((p) => p.name).join(", ") || "(none)"}`);
-    }
-  } else {
-    const projects = await get(o, `/projects?workspaceId=${ws.id}`);
-    const issuesKeys = await resolveIssuesTemplateKeys(o);
-    const defaultCandidate = projects.find((p) => !!p.sourceTemplateId && issuesKeys.has(p.sourceTemplateId)) ?? projects.find((p) => eq(p.slug ?? "", "issues"));
-    if (defaultCandidate && (await missingTables(o, defaultCandidate.id)).length === 0) {
-      out.projectId = defaultCandidate.id;
-      out.projectSlug = defaultCandidate.slug;
-      out.projectName = defaultCandidate.name;
-    } else {
-      const options = await Promise.all(
-        projects.map(async (p) => ({ id: p.id, name: p.name, slug: p.slug, missing: await missingTables(o, p.id) }))
-      );
-      const qualifying = options.filter((p) => p.missing.length === 0);
-      if (qualifying.length === 1) {
-        out.projectId = qualifying[0].id;
-        out.projectSlug = qualifying[0].slug;
-        out.projectName = qualifying[0].name;
-      } else if (qualifying.length > 1) {
-        out.projectOptions = qualifying;
-        problems.push(
-          `${qualifying.length} projects in this workspace all have the tables a route needs \u2014 name one: ${qualifying.map((p) => p.slug ?? p.name).join(", ")}`
-        );
-      } else {
-        const isAdmin = out.role === "WORKSPACE_ADMIN" || out.role === "PLATFORM_ADMIN";
-        out.offerTemplateInstall = isAdmin;
-        problems.push(
-          `no project in this workspace has the tables a route needs (${REQUIRED_TABLES.join(", ")}) \u2014 ` + (isAdmin ? "install an Issues-tracker template for this workspace (Library, in the app), then rerun." : "ask a workspace admin to set one up, then rerun.")
-        );
-      }
-    }
-  }
-  if (!out.projectId) return out;
-  const models = await get(o, `/data-models?projectId=${out.projectId}`);
-  const find = (name) => models.find((m) => eq(m.name, name))?.id;
-  for (const [key, name] of [["issues", "Issues"], ["comments", "Comments"], ["crew", "Crew"]]) {
-    const id = find(name);
-    if (id) out.models[key] = id;
-    else problems.push(`no "${name}" table \u2014 have: ${models.map((m) => m.name).join(", ")}`);
+  return void 0;
+}
+function ensureMachineId(stateDir, opts = {}) {
+  if (opts.override?.trim()) return sha256(opts.override.trim());
+  const path = machineIdPathFor(stateDir);
+  if (existsSync24(path)) {
+    const cached = readFileSync21(path, "utf8").trim();
+    if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
-  if (out.models.issues) {
-    try {
-      const issuesModel = await get(o, `/data-models/${out.models.issues}`);
-      const statusField = issuesModel.fields.find((f) => f.columnName === DEFAULT_CONTRACT.columns.status);
-      const known = /* @__PURE__ */ new Set([
-        ...DEFAULT_CONTRACT.statuses.open,
-        ...DEFAULT_CONTRACT.statuses.resolved,
-        DEFAULT_CONTRACT.statuses.draft
-      ]);
-      out.unrecognizedStatuses = (statusField?.fieldType?.choiceOptions ?? []).filter((opt) => !known.has(opt.value)).sort((a, b) => (a.position ?? 0) - (b.position ?? 0)).map((opt) => ({ value: opt.value, label: opt.label ?? void 0, position: opt.position ?? void 0 }));
-    } catch {
-    }
+  const raw = (opts.read ?? readRawMachineId)();
+  if (!raw) return void 0;
+  const hashed = sha256(raw);
+  mkdirSync15(dirname13(path), { recursive: true });
+  writeFileSync17(path, `${hashed}
+`, { mode: 384 });
+  return hashed;
+}
+function matchShipRows(ships, shipName2, machineId) {
+  const hasColumn = ships.some((r) => "machine_id" in r);
+  const byId = hasColumn && machineId ? ships.filter((r) => r.machine_id === machineId) : [];
+  if (byId.length > 0) return { rows: byId, by: "machine_id", hasColumn };
+  return { rows: ships.filter((r) => (r.name ?? "").trim() === shipName2.trim()), by: "name", hasColumn };
+}
+
+// src/ship-name.ts
+var ShipNameError = class extends Error {
+};
+function validateShipName(raw) {
+  const name = raw.trim();
+  if (!name) throw new ShipNameError("the ship name cannot be empty");
+  if (/[\u0000-\u001f\u007f]/.test(name)) throw new ShipNameError("the ship name cannot contain control characters");
+  return name;
+}
+function planNameSync(local, row, lastSynced) {
+  if (local === row) return { drift: "none", action: "none" };
+  const rowMoved = lastSynced === void 0 || row !== lastSynced;
+  const localMoved = lastSynced === void 0 || local !== lastSynced;
+  if (rowMoved && localMoved) return { drift: "both", action: "row-wins" };
+  if (rowMoved) return { drift: "row", action: "adopt" };
+  return { drift: "local", action: "push" };
+}
+function shipNameOfYaml(text) {
+  const v = parseDocument(text).getIn(["ship", "name"]);
+  return typeof v === "string" && v.trim() ? v.trim() : void 0;
+}
+function setShipNameInYaml(text, name) {
+  const doc = parseDocument(text);
+  doc.setIn(["ship", "name"], name);
+  return doc.toString();
+}
+function pickShipRow(rows, machineId, byName = []) {
+  const hasColumn = rows.some((r) => "machine_id" in r);
+  if (!hasColumn || !machineId) return { kind: "unsupported" };
+  const byId = rows.filter((r) => r.machine_id === machineId);
+  if (byId.length === 1) return { kind: "row", row: byId[0], by: "machine_id" };
+  if (byId.length > 1) return { kind: "ambiguous" };
+  const names = new Set(byName.map((n) => n.trim()));
+  const named = rows.filter((r) => !r.machine_id && names.has((r.name ?? "").trim()));
+  if (named.length === 1) return { kind: "row", row: named[0], by: "name" };
+  return { kind: named.length > 1 ? "ambiguous" : "none" };
+}
+async function syncRouteName(i) {
+  const picked = pickShipRow(i.rows, i.machineId);
+  if (picked.kind !== "row") {
+    const status2 = picked.kind === "none" ? "no-row" : picked.kind;
+    return { status: status2, drift: "none", action: "none", name: i.local };
   }
-  if (out.models.issues) {
+  const rowName = (picked.row.name ?? "").trim();
+  if (!rowName) return { status: "no-row", drift: "none", action: "none", name: i.local };
+  const { drift, action } = planNameSync(i.local, rowName, i.lastSynced);
+  const base = { drift, rowId: picked.row.id, rowName };
+  if (action === "push") {
+    if (!i.rename) return { status: "ok", ...base, action, name: i.local };
     try {
-      await get(o, `/data-models/${out.models.issues}/events?limit=1`);
+      await i.rename(picked.row.id, i.local);
     } catch (e) {
-      if (e instanceof ConnectHttpError && e.status === 404) problems.push(EVENT_LOG_MISSING);
+      return { status: "refused", ...base, action: "none", name: i.local, error: e.message };
     }
+    return { status: "ok", ...base, action, name: i.local };
   }
-  out.areaModelId = find("Projects");
-  out.reposModelId = find("Repos");
-  out.shipsModelId = find("Ships");
-  out.epicsModelId = find("Epics");
-  out.locksModelId = find("Locks");
+  if (action === "adopt" || action === "row-wins") return { status: "ok", ...base, action, name: rowName, from: i.local };
+  return { status: "ok", ...base, action, name: i.local };
+}
+function readSyncedName(resolvedFile) {
+  if (!existsSync25(resolvedFile)) return void 0;
   try {
-    const views = await get(o, `/views?workspaceId=${ws.id}`);
-    const candidates = views.filter((v) => v.recordLinkOnly === true && v.published === true && !!v.publicSlug && (v.pages ?? []).some((p) => (p.components ?? []).some((c) => c.dataModelId === out.models.issues)));
-    if (candidates.length === 1) {
-      out.recordLinkViewId = candidates[0].id;
-    } else if (candidates.length === 0) {
-      problems.push("no record-link-only view bound to Issues \u2014 attention events will carry no link");
-    } else {
-      problems.push(
-        `${candidates.length} record-link-only views bound to Issues \u2014 set resolved.recordLinkViewId by hand`
-      );
-    }
+    const v = JSON.parse(readFileSync22(resolvedFile, "utf8")).shipName;
+    return typeof v === "string" ? v : void 0;
   } catch {
+    return void 0;
   }
-  if (out.reposModelId) {
-    const repos = await get(
-      o,
-      `/data-models/${out.reposModelId}/records?limit=200`
-    );
-    out.repoNames = Object.fromEntries(repos.map((r) => [r.id, r.name ?? ""]));
-    const remotes = Object.fromEntries(
-      repos.filter((r) => r.remote).map((r) => [r.id, r.remote])
-    );
-    if (Object.keys(remotes).length > 0) out.repoRemotes = remotes;
+}
+function writeSyncedName(resolvedFile, name) {
+  if (!existsSync25(resolvedFile)) return;
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
+  } catch {
+    return;
   }
-  if (o.area) {
-    if (!out.areaModelId) problems.push(`--area given but this project has no "Projects" table`);
-    else {
-      const areas = await get(o, `/data-models/${out.areaModelId}/records?limit=200`);
-      const hit = areas.find((a) => eq(a.name, o.area));
-      if (hit) {
-        out.areaId = hit.id;
-        out.areaName = hit.name;
-      } else problems.push(`no area named "${o.area}" \u2014 have: ${areas.map((a) => a.name).join(", ")}`);
-    }
+  if (raw.shipName === name) return;
+  raw.shipName = name;
+  mkdirSync16(dirname14(resolvedFile), { recursive: true });
+  const tmp = `${resolvedFile}.tmp${process.pid}`;
+  writeFileSync18(tmp, `${JSON.stringify(raw, null, 2)}
+`);
+  renameSync2(tmp, resolvedFile);
+}
+async function reconcileShipName(i) {
+  let local = i.ship.name;
+  try {
+    local = shipNameOfYaml(readFileSync22(i.configFile, "utf8")) ?? local;
+  } catch {
   }
-  let shipRowId;
-  if (out.shipsModelId && o.ship && !o.dryRun) {
-    const shipRows = await get(
-      o,
-      `/data-models/${out.shipsModelId}/records?limit=200`
-    );
-    const hostPassengers = o.ship.hostPassengers ?? false;
-    const sshPublicKey = o.ship.sshPublicKey;
-    let shipColumns = /* @__PURE__ */ new Set();
-    try {
-      const shipsModel = await get(o, `/data-models/${out.shipsModelId}`);
-      shipColumns = new Set((shipsModel.fields ?? []).map((f) => f.columnName));
-    } catch {
-    }
-    let ownerId;
-    if (out.meId) {
-      if (shipColumns.has("owner_id")) ownerId = out.meId;
-      else provisioning.push("could not record the ship owner \u2014 the Ships table has no owner_id column yet (update the Issues template)");
-    }
-    const machineId = shipColumns.has("machine_id") ? o.ship.machineId : void 0;
-    let mine;
-    let matchedBy = "name";
-    let writeMachineId = false;
-    const byName = shipRows.filter((r) => (r.name ?? "").trim() === o.ship.name.trim());
-    if (machineId) {
-      const byId = shipRows.filter((r) => (r.machine_id ?? "") === machineId);
-      if (byId.length > 0) {
-        mine = byId;
-        matchedBy = "machine_id";
-      } else {
-        mine = byName.filter((r) => !r.machine_id);
-        writeMachineId = true;
-      }
+  const resolvedFile = resolvedPathFor(i.stateDir, i.route);
+  const lastSynced = readSyncedName(resolvedFile);
+  let rows = [];
+  try {
+    rows = await i.rows();
+  } catch {
+  }
+  const result = await syncRouteName({
+    local,
+    lastSynced,
+    rows,
+    machineId: i.machineId,
+    rename: i.readOnly ? void 0 : i.rename
+  });
+  if (i.readOnly || result.status === "unsupported") return result;
+  if (result.status === "refused") {
+    i.emit?.warn(`could not rename the Ships row to "${local}": ${result.error}`, { step: "poll", data: { event: "ship_rename_refused", route: i.route, to: local } });
+    return result;
+  }
+  if (result.status !== "ok") return result;
+  if (result.action === "adopt" || result.action === "row-wins") {
+    const text = readFileSync22(i.configFile, "utf8");
+    writeFileSync18(i.configFile, setShipNameInYaml(text, result.name));
+    i.ship.name = result.name;
+    if (result.action === "row-wins") {
+      i.emit?.warn(
+        `ship name changed in both crew.yaml ("${result.from}") and the Ships table ("${result.name}"); the Ships row wins`,
+        { step: "poll", data: { event: "ship_renamed", route: i.route, from: result.from, to: result.name, source: "table", conflict: true } }
+      );
     } else {
-      mine = byName;
-    }
-    if (mine.length === 1) {
-      shipRowId = mine[0].id;
-      out.shipRow = { id: shipRowId, name: o.ship.name, action: "matched", matchedBy };
-      const patchBody = {};
-      if (matchedBy === "machine_id") {
-        const rowName = (mine[0].name ?? "").trim();
-        const route = `${out.workspaceSlug}/${out.projectSlug ?? out.projectId}`;
-        const plan = planNameSync(o.ship.name.trim(), rowName, o.ship.lastSyncedName?.(route));
-        if (plan.action === "push") {
-          patchBody.name = o.ship.name.trim();
-          provisioning.push(`renamed Ships row "${rowName}" to "${o.ship.name.trim()}" (crew.yaml changed)`);
-        } else if (plan.action === "adopt" || plan.action === "row-wins") {
-          out.shipRow.name = rowName;
-          out.shipNameAdopted = rowName;
-          provisioning.push(`matched Ships row "${rowName}" by machine id \u2014 this host's name becomes "${rowName}"${plan.action === "row-wins" ? " (crew.yaml also changed; the Ships row wins)" : ""}`);
-        }
-        patchBody.last_seen = (/* @__PURE__ */ new Date()).toISOString();
-      }
-      if (writeMachineId) patchBody.machine_id = machineId;
-      if ((mine[0].host_passengers ?? false) !== hostPassengers) patchBody.host_passengers = hostPassengers;
-      if (sshPublicKey !== void 0 && (mine[0].ssh_public_key ?? "") !== sshPublicKey) {
-        patchBody.ssh_public_key = sshPublicKey;
-      }
-      if (ownerId !== void 0 && (mine[0].owner_id ?? "") !== ownerId) patchBody.owner_id = ownerId;
-      if (Object.keys(patchBody).length > 0) {
-        await patch(o, `/data-models/${out.shipsModelId}/records/${shipRowId}`, patchBody);
-        if ("host_passengers" in patchBody) provisioning.push(`synced host_passengers=${hostPassengers} onto Ships row "${o.ship.name}"`);
-        if ("ssh_public_key" in patchBody) provisioning.push(`synced ssh_public_key onto Ships row "${o.ship.name}"`);
-        if ("owner_id" in patchBody) provisioning.push(`recorded owner on Ships row "${o.ship.name}"`);
-      }
-    } else if (mine.length === 0) {
-      const created = await post2(o, `/data-models/${out.shipsModelId}/records`, {
-        name: o.ship.name,
-        ...o.ship.platform ? { platform: o.ship.platform } : {},
-        host_passengers: hostPassengers,
-        ...sshPublicKey !== void 0 ? { ssh_public_key: sshPublicKey } : {},
-        ...ownerId !== void 0 ? { owner_id: ownerId } : {},
-        ...writeMachineId ? { machine_id: machineId } : {}
+      i.emit?.emit(`ship renamed to "${result.name}" in the Ships table; crew.yaml updated`, {
+        step: "poll",
+        data: { event: "ship_renamed", route: i.route, from: result.from, to: result.name, source: "table" }
       });
-      shipRowId = created.id;
-      out.shipRow = { id: shipRowId, name: o.ship.name, action: "created", matchedBy };
-      provisioning.push(`created Ships row "${o.ship.name}"`);
-    } else {
-      problems.push(
-        matchedBy === "machine_id" ? `${mine.length} Ships rows carry this machine's id \u2014 which one is this machine?` : `${mine.length} Ships rows named "${o.ship.name}" \u2014 which one is this machine?`
-      );
     }
+  } else if (result.action === "push") {
+    i.emit?.emit(`ship name "${result.name}" pushed to the Ships table`, {
+      step: "poll",
+      data: { event: "ship_renamed", route: i.route, from: result.rowName, to: result.name, source: "crew.yaml" }
+    });
   }
-  let agentIdFor = () => void 0;
-  if (shipRowId) {
+  writeSyncedName(resolvedFile, result.name);
+  return result;
+}
+async function reconcileRouteShipName(o) {
+  const fallback = { status: "unsupported", drift: "none", action: "none", name: o.ship.name };
+  if (!o.route.resolved?.shipsModelId) return fallback;
+  try {
+    const machineId = o.machineId ?? ensureMachineId(o.ship.stateDir);
+    const tracker = new Tracker(o.route, o.ship);
+    return await reconcileShipName({
+      route: o.route.route,
+      configFile: o.configFile,
+      stateDir: o.ship.stateDir,
+      ship: o.ship,
+      machineId,
+      rows: () => tracker.shipRows(),
+      rename: (id, name) => tracker.renameShipRow(id, name),
+      emit: o.emit,
+      readOnly: o.readOnly
+    });
+  } catch {
+    return fallback;
+  }
+}
+
+// src/connect.ts
+var ConnectHttpError = class extends Error {
+  status;
+  path;
+  constructor(status2, path, statusText) {
+    super(`${path}: ${status2} ${statusText}`);
+    this.name = "ConnectHttpError";
+    this.status = status2;
+    this.path = path;
+  }
+};
+async function get(o, path) {
+  const res = await fetch(`${o.baseUrl.replace(/\/+$/, "")}/api${path}`, {
+    headers: {
+      Authorization: `Bearer ${o.apiKey}`,
+      // Cloudflare 403s default agents on this host.
+      "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+    }
+  });
+  if (!res.ok) throw new ConnectHttpError(res.status, path, res.statusText);
+  return await res.json();
+}
+async function post2(o, path, body) {
+  const res = await fetch(`${o.baseUrl.replace(/\/+$/, "")}/api${path}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${o.apiKey}`,
+      "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new ConnectHttpError(res.status, path, res.statusText);
+  return await res.json();
+}
+async function patch(o, path, body) {
+  const res = await fetch(`${o.baseUrl.replace(/\/+$/, "")}/api${path}`, {
+    method: "PATCH",
+    headers: {
+      Authorization: `Bearer ${o.apiKey}`,
+      "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new ConnectHttpError(res.status, path, res.statusText);
+  return await res.json();
+}
+async function del(o, path) {
+  const res = await fetch(`${o.baseUrl.replace(/\/+$/, "")}/api${path}`, {
+    method: "DELETE",
+    headers: {
+      Authorization: `Bearer ${o.apiKey}`,
+      "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+    }
+  });
+  if (!res.ok) throw new ConnectHttpError(res.status, path, res.statusText);
+}
+async function provisionReleaseLocks(o, locksModelId, route, repoNames) {
+  const scopes = [...new Set(repoNames)].sort().map((r) => releaseLockScope(route, r));
+  if (scopes.length === 0) return [];
+  const client2 = {
+    // The Locks table is a handful of rows, so read it whole and match in
+    // memory rather than depend on the HTTP filter syntax.
+    list: async (model, params) => {
+      const want = JSON.parse(params?.filters ?? "[]")[0]?.value;
+      const rows = await get(
+        o,
+        `/data-models/${model}/records?limit=500`
+      );
+      return rows.filter((r) => r.scope === want).slice(0, params?.limit ?? rows.length);
+    },
+    create: (model, body) => post2(o, `/data-models/${model}/records`, body),
+    remove: (model, id) => del(o, `/data-models/${model}/records/${id}`)
+  };
+  return ensureLockRows(client2, locksModelId, scopes);
+}
+var ISSUES_TEMPLATE_IDENTIFIERS = ["tablation.issues", "crew.issues"];
+async function resolveIssuesTemplateKeys(o) {
+  const keys = new Set(ISSUES_TEMPLATE_IDENTIFIERS);
+  await Promise.all(ISSUES_TEMPLATE_IDENTIFIERS.map(async (identifier) => {
     try {
-      const agentsModel = await get(o, `/data-models/agents?workspaceId=${ws.id}`);
-      const agentRows = await get(
+      const t = await get(
         o,
-        `/data-models/${agentsModel.id}/records?limit=200`
+        `/library-templates/by-identifier/${encodeURIComponent(identifier)}`
       );
-      agentIdFor = (role) => agentRows.find((r) => r.name === PERSONA_NAME[role])?.id;
+      if (t.id) keys.add(t.id);
+      if (t.identifier) keys.add(t.identifier);
     } catch {
     }
-  }
-  if (out.models.crew) {
-    const rows = await get(
-      o,
-      `/data-models/${out.models.crew}/records?limit=200`
-    );
-    let seatShipId = shipRowId;
-    if (!seatShipId && o.dryRun && o.ship && out.shipsModelId) {
-      try {
-        const shipRows = await get(
-          o,
-          `/data-models/${out.shipsModelId}/records?limit=200`
-        );
-        const byId = o.ship.machineId ? shipRows.filter((r) => r.machine_id === o.ship.machineId) : [];
-        const mineRows = byId.length > 0 ? byId : shipRows.filter((r) => (r.name ?? "").trim() === o.ship.name.trim() && !r.machine_id);
-        if (mineRows.length === 1) seatShipId = mineRows[0].id;
-      } catch {
-      }
-    }
-    const scoped = seatShipId ? rows.filter((r) => r.ship_id === seatShipId) : rows.filter((r) => !r.ship_id);
-    const unclaimed = seatShipId ? rows.filter((r) => !r.ship_id) : [];
-    for (const role of ["dev", "design", "qa", "triage"]) {
-      const searchTerm = role === "dev" ? "develop" : role;
-      let id = seatFor(scoped, searchTerm);
-      let seatAction = "matched";
-      if (!id && seatShipId && !shipRowId) {
-        const legacyId = seatFor(unclaimed, searchTerm);
-        if (legacyId) {
-          id = legacyId;
-          seatAction = "claimed";
-        }
-      } else if (!id && shipRowId) {
-        const legacyId = seatFor(unclaimed, searchTerm);
-        if (legacyId) {
-          await patch(o, `/data-models/${out.models.crew}/records/${legacyId}`, { ship_id: shipRowId });
-          id = legacyId;
-          seatAction = "claimed";
-          provisioning.push(`claimed existing Crew row for the ${role} seat`);
-        } else {
-          const created = await post2(o, `/data-models/${out.models.crew}/records`, {
-            name: `${PERSONA_NAME[role]} agent`,
-            ship_id: shipRowId,
-            ...agentIdFor(role) ? { agent_id: agentIdFor(role) } : {}
-          });
-          id = created.id;
-          seatAction = "created";
-          provisioning.push(`created Crew row for the ${role} seat`);
-        }
-      }
-      if (id) {
-        out.seats[role] = id;
-        const rowShip = rows.find((r) => r.id === id)?.ship_id ?? shipRowId ?? void 0;
-        (out.seatRows ??= []).push({ role, id, action: seatAction, ...rowShip ? { shipId: rowShip } : {} });
-      } else if (o.dryRun && o.ship && out.shipsModelId) {
-        (out.seatRows ??= []).push({ role, id: "", action: "would-create" });
-      } else problems.push(`no Crew row looking like the ${role} seat \u2014 create one, or omit that role`);
-    }
-    const pairId = seatFor(scoped, "pair") || (seatShipId ? seatFor(unclaimed, "pair") : void 0);
-    if (pairId) out.seats.pair = pairId;
-    if (shipRowId) {
-      const releaseId = seatFor(scoped, "release");
-      if (releaseId) out.releaseSeat = releaseId;
-      else {
-        const created = await post2(o, `/data-models/${out.models.crew}/records`, {
-          name: "Release agent",
-          ship_id: shipRowId
-        });
-        out.releaseSeat = created.id;
-        provisioning.push("created Crew row for the release seat");
-      }
-    }
-    const seatIds = /* @__PURE__ */ new Set([...Object.values(out.seats), ...out.releaseSeat ? [out.releaseSeat] : []]);
-    const holdRows = rows.filter((r) => !seatIds.has(r.id));
-    out.holds = holdRows.map((r) => ({ id: r.id, name: r.name ?? "", email: r.email, user_id: r.user_id }));
-    out.crewModelId = out.models.crew;
-    const people = holdRows.filter((r) => !r.agent_id && (!r.ship_id || !!r.user_id));
-    const members = /* @__PURE__ */ new Map();
+  }));
+  return keys;
+}
+async function listLibraryTemplates(o) {
+  return get(o, "/library-templates");
+}
+async function previewTemplateInstall(o, templateId, workspaceId) {
+  return get(o, `/library-templates/${templateId}/install-preview?workspaceId=${workspaceId}`);
+}
+async function installTemplate(o, templateId, workspaceId, projectName) {
+  return post2(o, `/library-templates/${templateId}/install`, {
+    workspaceId,
+    ...projectName ? { projectName } : {}
+  });
+}
+async function listWorkspaces(o) {
+  const res = await get(
+    o,
+    "/auth/my-workspaces"
+  );
+  return res.workspaces.map((w) => ({ slug: w.path ?? w.slug, name: w.name, role: w.role }));
+}
+var eq = (a, b) => (a ?? "").trim().toLowerCase() === b.trim().toLowerCase();
+function seatFor(rows, role) {
+  const r = rows.find((x) => (x.name ?? "").toLowerCase().includes(role.toLowerCase()));
+  return r?.id;
+}
+var REQUIRED_TABLES = ["Issues"];
+async function missingTables(o, projectId) {
+  const models = await get(o, `/data-models?projectId=${projectId}`);
+  return REQUIRED_TABLES.filter((t) => !models.some((m) => eq(m.name, t)));
+}
+async function discover(o) {
+  const problems = [];
+  const provisioning = [];
+  const ws = await get(o, `/workspaces/${encodeURIComponent(o.workspace).replace(/%3A/gi, ":")}`);
+  const out = {
+    workspaceId: ws.id,
+    workspaceSlug: ws.path ?? ws.slug,
+    workspaceName: ws.name,
+    models: {},
+    seats: {},
+    holds: [],
+    candidates: [],
+    problems,
+    provisioning
+  };
+  try {
+    const me = await get(o, `/auth/me?workspaceId=${ws.id}`);
+    out.role = me.role;
+    out.meEmail = me.email;
+    out.meId = me.id;
+    out.meIdentityId = me.identityId;
+    out.meName = me.name;
+  } catch {
+  }
+  if (o.project) {
     try {
-      const list = await get(
+      const p = await get(
         o,
-        `/workspaces/${out.workspaceId}/members`
+        `/projects/${encodeURIComponent(o.project)}?workspaceId=${ws.id}`
       );
-      for (const m of Array.isArray(list) ? list : []) {
-        const key = m.id ?? m.userId;
-        if (key) members.set(key, { identityId: m.identityId, email: m.email });
-      }
+      out.projectId = p.id;
+      out.projectSlug = p.slug;
+      out.projectName = p.name;
     } catch {
+      const projects = await get(o, `/projects?workspaceId=${ws.id}`);
+      const hit = projects.find((p) => eq(p.name, o.project));
+      if (hit) {
+        out.projectId = hit.id;
+        out.projectSlug = hit.slug;
+        out.projectName = hit.name;
+      } else problems.push(`no project named or slugged "${o.project}" \u2014 have: ${projects.map((p) => p.name).join(", ") || "(none)"}`);
     }
-    for (const h of out.holds) {
-      const e = h.user_id ? members.get(h.user_id)?.email : void 0;
-      if (e) h.memberEmail = e;
-    }
-    out.candidates = people.map((r) => ({
-      id: r.id,
-      name: r.name ?? "",
-      email: r.email,
-      user_id: r.user_id,
-      detail: r.email || (r.user_id ? members.get(r.user_id)?.email : void 0) || void 0
-    }));
-    const isMine = (r) => !!r.user_id && (r.user_id === out.meId || !!out.meIdentityId && members.get(r.user_id)?.identityId === out.meIdentityId);
-    const emailOf = (r) => [r.email, r.user_id ? members.get(r.user_id)?.email : void 0].filter((e) => !!e);
-    if (!out.meId) {
-      if (out.candidates.length === 0) problems.push("no non-seat Crew rows \u2014 which row is the operator?");
-      else {
-        const byEmail = out.meEmail ? people.filter((r) => emailOf(r).some((e) => eq(e, out.meEmail))) : [];
-        if (byEmail.length === 1) out.operator = byEmail[0].id;
-        else if (out.candidates.length === 1) out.operator = out.candidates[0].id;
-      }
+  } else {
+    const projects = await get(o, `/projects?workspaceId=${ws.id}`);
+    const issuesKeys = await resolveIssuesTemplateKeys(o);
+    const defaultCandidate = projects.find((p) => !!p.sourceTemplateId && issuesKeys.has(p.sourceTemplateId)) ?? projects.find((p) => eq(p.slug ?? "", "issues"));
+    if (defaultCandidate && (await missingTables(o, defaultCandidate.id)).length === 0) {
+      out.projectId = defaultCandidate.id;
+      out.projectSlug = defaultCandidate.slug;
+      out.projectName = defaultCandidate.name;
     } else {
-      const candidates = people.filter((r) => !r.user_id || isMine(r));
-      const mine = people.find(isMine);
-      const byEmail = out.meEmail ? candidates.filter((r) => emailOf(r).some((e) => eq(e, out.meEmail))) : [];
-      const unlinked = people.filter((r) => !r.user_id);
-      const only = candidates.length === 1 && unlinked.length === 1 ? candidates[0] : void 0;
-      const pick = mine ?? (byEmail.length === 1 ? byEmail[0] : only);
-      if (pick) {
-        out.operator = pick.id;
-        out.operatorAction = isMine(pick) ? "matched" : "linked";
-        if (!isMine(pick) && o.ship) await linkOperatorRow(o, out, pick);
+      const options = await Promise.all(
+        projects.map(async (p) => ({ id: p.id, name: p.name, slug: p.slug, missing: await missingTables(o, p.id) }))
+      );
+      const qualifying = options.filter((p) => p.missing.length === 0);
+      if (qualifying.length === 1) {
+        out.projectId = qualifying[0].id;
+        out.projectSlug = qualifying[0].slug;
+        out.projectName = qualifying[0].name;
+      } else if (qualifying.length > 1) {
+        out.projectOptions = qualifying;
+        problems.push(
+          `${qualifying.length} projects in this workspace all have the tables a route needs \u2014 name one: ${qualifying.map((p) => p.slug ?? p.name).join(", ")}`
+        );
       } else {
-        out.operatorCompared = `signed in as ${out.meEmail ?? "unknown email"} (identity ${out.meIdentityId ?? out.meId}); ` + (people.length === 0 ? "no person rows in the Crew table" : people.map((r) => {
-          const m = r.user_id ? members.get(r.user_id) : void 0;
-          return `"${r.name || "unnamed row"}" <${r.email ?? "no email"}>` + (r.user_id ? ` linked to member ${m?.email ?? r.user_id}${m?.identityId ? ` (identity ${m.identityId})` : ""}` : " unlinked");
-        }).join("; "));
-        if (o.ship && (!o.interactive || candidates.length === 0)) await createOperatorRow(o, out);
+        const isAdmin = out.role === "WORKSPACE_ADMIN" || out.role === "PLATFORM_ADMIN";
+        out.offerTemplateInstall = isAdmin;
+        problems.push(
+          `no project in this workspace has the tables a route needs (${REQUIRED_TABLES.join(", ")}) \u2014 ` + (isAdmin ? "install an Issues-tracker template for this workspace (Library, in the app), then rerun." : "ask a workspace admin to set one up, then rerun.")
+        );
       }
     }
   }
-  return out;
-}
-async function linkOperatorRow(o, found, row) {
-  const name = row.name || row.id;
-  if (!found.meId || !found.crewModelId) return;
-  if (o.dryRun) {
-    found.provisioning.push(`would link Crew row "${name}" to your account`);
-    return;
-  }
-  const body = { user_id: found.meId };
-  if (!row.email && found.meEmail) body.email = found.meEmail;
-  try {
-    await patch(o, `/data-models/${found.crewModelId}/records/${row.id}`, body);
-    found.provisioning.push(`linked Crew row "${name}" to your account`);
-  } catch (e) {
-    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
-    found.provisioning.push(
-      `could not link your Crew row (no write access) \u2014 ask a workspace admin to set user_id on "${name}"`
-    );
-  }
-}
-async function createOperatorRow(o, found) {
-  if (!found.meId || !found.crewModelId) return;
-  const name = found.meName || found.meEmail || "Operator";
-  if (o.dryRun) {
-    found.provisioning.push(`would create Crew row "${name}" for you`);
-    return;
+  if (!out.projectId) return out;
+  const models = await get(o, `/data-models?projectId=${out.projectId}`);
+  const find = (name) => models.find((m) => eq(m.name, name))?.id;
+  for (const [key, name] of [["issues", "Issues"], ["comments", "Comments"], ["crew", "Crew"]]) {
+    const id = find(name);
+    if (id) out.models[key] = id;
+    else problems.push(`no "${name}" table \u2014 have: ${models.map((m) => m.name).join(", ")}`);
   }
-  try {
-    const created = await post2(o, `/data-models/${found.crewModelId}/records`, {
-      name,
-      ...found.meEmail ? { email: found.meEmail } : {},
-      user_id: found.meId
-    });
-    found.operator = created.id;
-    found.operatorAction = "created";
-    found.holds.push({ id: created.id, name, email: found.meEmail, user_id: found.meId });
-    found.candidates.push({ id: created.id, name, email: found.meEmail, user_id: found.meId, detail: found.meEmail });
-    found.provisioning.push(`created Crew row "${name}" for you`);
-  } catch (e) {
-    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
-    found.provisioning.push("could not create your Crew row (no write access) \u2014 ask a workspace admin to add one with your user_id");
+  if (out.models.issues) {
+    try {
+      const issuesModel = await get(o, `/data-models/${out.models.issues}`);
+      const statusField = issuesModel.fields.find((f) => f.columnName === DEFAULT_CONTRACT.columns.status);
+      const known = /* @__PURE__ */ new Set([
+        ...DEFAULT_CONTRACT.statuses.open,
+        ...DEFAULT_CONTRACT.statuses.resolved,
+        DEFAULT_CONTRACT.statuses.draft
+      ]);
+      out.unrecognizedStatuses = (statusField?.fieldType?.choiceOptions ?? []).filter((opt) => !known.has(opt.value)).sort((a, b) => (a.position ?? 0) - (b.position ?? 0)).map((opt) => ({ value: opt.value, label: opt.label ?? void 0, position: opt.position ?? void 0 }));
+    } catch {
+    }
   }
-}
-function renderConnection(d, route, dir, opts = {}) {
-  const apiKeyFileLine = opts.keychainBacked ? `    # apiKey: resolved automatically from the OS keychain (crew connect) \u2014 no apiKeyFile needed` : opts.apiKeyFile ? `    apiKeyFile: "${opts.apiKeyFile}"` : `    apiKeyFile: "REPLACE \u2014 a file holding this workspace's key"`;
-  const apiKeyVarLine = opts.keychainBacked ? "" : opts.apiKeyVar ? `
-    apiKeyVar: ${opts.apiKeyVar}` : `
-    apiKeyVar: REPLACE_KEY_VAR`;
-  return `  - route: ${route}
-    enabled: false          # arm it deliberately, once doctor is green
-${opts.area ? `    area: "${opts.area}"
-` : ""}    ${dir === null ? "repos: {}              # `crew repos clone` / `crew repos add` fill this in" : `dir: "${dir}"`}
-    # worktreePrefix: omitted \u2014 each repo derives its own from its checkout's
-    # directory name (ISSUE-400). Only set this if every repo this route
-    # serves genuinely wants the SAME prefix, which is rare once an area has
-    # more than one repo.
-    # What a host must be to build this \u2014 unix, macos, linux, or windows \u2014
-    # belongs in each repo's own .crew.yaml, not here (see docs/REPO_SPEC.md).
-    baseUrl: ${opts.baseUrl ? `"${opts.baseUrl}"` : '"REPLACE \u2014 the same baseUrl as your other routes"'}
-${opts.hostPassengers ? "    hostPassengers: true\n" : ""}${apiKeyFileLine}${apiKeyVarLine}
-`;
-}
-
-// src/cli.ts
-import {
-  getSessionStore as getSessionStore3,
-  hostFromUrl as hostFromUrl4,
-  loginWithDeviceCode,
-  getOrCreateShipId,
-  DeviceLoginError
-} from "@tablation/client";
-
-// src/seat-keys.ts
-import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl3 } from "@tablation/client";
-var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
-function keyIsAdmin(route) {
-  const role = route.resolved?.role;
-  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
-}
-var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
-var MEMBER_NO_KEY = 'no agent key for this seat \u2014 run `crew agents sync` (needs the "Mint agent keys" capability on your role)';
-var FORBIDDEN_LINE = 'seat keys: not minted \u2014 your role does not grant "Mint agent keys"; ask a workspace admin to add it to your project role (or run sync with an admin key)';
-function seatKeySlug(workspaceSlug, agentId) {
-  return `${workspaceSlug}#agent:${agentId}`;
-}
-function slugFor(route, agentId) {
-  const [workspaceSlug] = splitRoute(route.route);
-  return seatKeySlug(workspaceSlug, agentId);
-}
-function seatAgentId(route, role) {
-  return route.resolved?.agentPersonas?.[role]?.agentId;
-}
-async function resolveReleaseKey(route, getStore = getSessionStore2) {
-  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
-  const agentId = route.resolved?.releaseAgentId;
-  if (!agentId) return ship(keyIsAdmin(route) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
-  try {
-    const session = await getStore().get(hostFromUrl3(route.baseUrl), slugFor(route, agentId));
-    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship(keyIsAdmin(route) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
-  } catch {
-    return ship("OS keychain unavailable");
+  if (out.models.issues) {
+    try {
+      await get(o, `/data-models/${out.models.issues}/events?limit=1`);
+    } catch (e) {
+      if (e instanceof ConnectHttpError && e.status === 404) problems.push(EVENT_LOG_MISSING);
+    }
   }
-}
-async function resolveSeatKey(route, role, getStore = getSessionStore2) {
-  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
-  if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
-  const agentId = seatAgentId(route, role);
-  if (!agentId) return ship(keyIsAdmin(route) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
+  out.areaModelId = find("Projects");
+  out.reposModelId = find("Repos");
+  out.shipsModelId = find("Ships");
+  out.epicsModelId = find("Epics");
+  out.locksModelId = find("Locks");
   try {
-    const session = await getStore().get(hostFromUrl3(route.baseUrl), slugFor(route, agentId));
-    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship(keyIsAdmin(route) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
+    const views = await get(o, `/views?workspaceId=${ws.id}`);
+    const candidates = views.filter((v) => v.recordLinkOnly === true && v.published === true && !!v.publicSlug && (v.pages ?? []).some((p) => (p.components ?? []).some((c) => c.dataModelId === out.models.issues)));
+    if (candidates.length === 1) {
+      out.recordLinkViewId = candidates[0].id;
+    } else if (candidates.length === 0) {
+      problems.push("no record-link-only view bound to Issues \u2014 attention events will carry no link");
+    } else {
+      problems.push(
+        `${candidates.length} record-link-only views bound to Issues \u2014 set resolved.recordLinkViewId by hand`
+      );
+    }
   } catch {
-    return ship("OS keychain unavailable");
   }
-}
-function describeStoreError(e) {
-  const msg = e instanceof Error ? e.message : String(e);
-  if (/User interaction is not allowed/i.test(msg)) {
-    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
+  if (out.reposModelId) {
+    const repos = await get(
+      o,
+      `/data-models/${out.reposModelId}/records?limit=200`
+    );
+    out.repoNames = Object.fromEntries(repos.map((r) => [r.id, r.name ?? ""]));
+    const remotes = Object.fromEntries(
+      repos.filter((r) => r.remote).map((r) => [r.id, r.remote])
+    );
+    if (Object.keys(remotes).length > 0) out.repoRemotes = remotes;
   }
-  return "keychain unavailable (could not write to the OS keychain)";
-}
-async function mintMissingSeatKeys(route, o) {
-  const out = [];
-  if (!route.resolved) return out;
-  const resolved = route.resolved;
-  const doFetch = o.fetchImpl ?? fetch;
-  const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
-  ];
-  let store;
-  try {
-    store = (o.getStore ?? getSessionStore2)();
-  } catch (e) {
-    return targets.map(({ role }) => ({
-      role,
-      action: "failed",
-      detail: describeStoreError(e)
-    }));
+  if (o.area) {
+    if (!out.areaModelId) problems.push(`--area given but this project has no "Projects" table`);
+    else {
+      const areas = await get(o, `/data-models/${out.areaModelId}/records?limit=200`);
+      const hit = areas.find((a) => eq(a.name, o.area));
+      if (hit) {
+        out.areaId = hit.id;
+        out.areaName = hit.name;
+      } else problems.push(`no area named "${o.area}" \u2014 have: ${areas.map((a) => a.name).join(", ")}`);
+    }
   }
-  const host = hostFromUrl3(route.baseUrl);
-  const base = route.baseUrl.replace(/\/+$/, "");
-  if (!o.dryRun) {
-    const probeSlug = seatKeySlug(splitRoute(route.route)[0], "_probe");
+  let shipRowId;
+  if (out.shipsModelId && o.ship && !o.dryRun) {
+    const shipRows = await get(
+      o,
+      `/data-models/${out.shipsModelId}/records?limit=200`
+    );
+    const hostPassengers = o.ship.hostPassengers ?? false;
+    const sshPublicKey = o.ship.sshPublicKey;
+    let shipColumns = /* @__PURE__ */ new Set();
     try {
-      await store.set(host, probeSlug, {
-        apiKey: "probe",
-        shipId: "",
-        workspaceId: resolved.workspaceId,
-        identityId: "_probe",
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      await store.clear(host, probeSlug);
-    } catch (e) {
-      const detail = `${describeStoreError(e)}; no keys minted`;
-      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
+      const shipsModel = await get(o, `/data-models/${out.shipsModelId}`);
+      shipColumns = new Set((shipsModel.fields ?? []).map((f) => f.columnName));
+    } catch {
     }
-  }
-  for (const { role, agentId } of targets) {
-    if (!agentId) {
-      out.push({ role, action: "no_agent" });
-      continue;
+    let ownerId;
+    if (out.meId) {
+      if (shipColumns.has("owner_id")) ownerId = out.meId;
+      else provisioning.push("could not record the ship owner \u2014 the Ships table has no owner_id column yet (update the Issues template)");
     }
-    const slug = slugFor(route, agentId);
-    try {
-      if ((await store.get(host, slug))?.apiKey) {
-        out.push({ role, action: "already_stored" });
-        continue;
-      }
-      if (o.dryRun) {
-        out.push({ role, action: "minted", detail: "dry run" });
-        continue;
+    const machineId = shipColumns.has("machine_id") ? o.ship.machineId : void 0;
+    let mine;
+    let matchedBy = "name";
+    let writeMachineId = false;
+    const byName = shipRows.filter((r) => (r.name ?? "").trim() === o.ship.name.trim());
+    if (machineId) {
+      const byId = shipRows.filter((r) => (r.machine_id ?? "") === machineId);
+      if (byId.length > 0) {
+        mine = byId;
+        matchedBy = "machine_id";
+      } else {
+        mine = byName.filter((r) => !r.machine_id);
+        writeMachineId = true;
       }
-      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${resolveApiKey(route)}`,
-          "Content-Type": "application/json",
-          "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
-        },
-        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
-      });
-      if (res.status === 403) {
-        out.push({ role, action: "forbidden" });
-        break;
+    } else {
+      mine = byName;
+    }
+    if (mine.length === 1) {
+      shipRowId = mine[0].id;
+      out.shipRow = { id: shipRowId, name: o.ship.name, action: "matched", matchedBy };
+      const patchBody = {};
+      if (matchedBy === "machine_id") {
+        const rowName = (mine[0].name ?? "").trim();
+        const route = `${out.workspaceSlug}/${out.projectSlug ?? out.projectId}`;
+        const plan = planNameSync(o.ship.name.trim(), rowName, o.ship.lastSyncedName?.(route));
+        if (plan.action === "push") {
+          patchBody.name = o.ship.name.trim();
+          provisioning.push(`renamed Ships row "${rowName}" to "${o.ship.name.trim()}" (crew.yaml changed)`);
+        } else if (plan.action === "adopt" || plan.action === "row-wins") {
+          out.shipRow.name = rowName;
+          out.shipNameAdopted = rowName;
+          provisioning.push(`matched Ships row "${rowName}" by machine id \u2014 this host's name becomes "${rowName}"${plan.action === "row-wins" ? " (crew.yaml also changed; the Ships row wins)" : ""}`);
+        }
+        patchBody.last_seen = (/* @__PURE__ */ new Date()).toISOString();
       }
-      if (!res.ok) {
-        out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
-        continue;
+      if (writeMachineId) patchBody.machine_id = machineId;
+      if ((mine[0].host_passengers ?? false) !== hostPassengers) patchBody.host_passengers = hostPassengers;
+      if (sshPublicKey !== void 0 && (mine[0].ssh_public_key ?? "") !== sshPublicKey) {
+        patchBody.ssh_public_key = sshPublicKey;
       }
-      const body = await res.json();
-      if (!body.key) {
-        out.push({ role, action: "failed", detail: "response carried no key" });
-        continue;
+      if (ownerId !== void 0 && (mine[0].owner_id ?? "") !== ownerId) patchBody.owner_id = ownerId;
+      if (Object.keys(patchBody).length > 0) {
+        await patch(o, `/data-models/${out.shipsModelId}/records/${shipRowId}`, patchBody);
+        if ("host_passengers" in patchBody) provisioning.push(`synced host_passengers=${hostPassengers} onto Ships row "${o.ship.name}"`);
+        if ("ssh_public_key" in patchBody) provisioning.push(`synced ssh_public_key onto Ships row "${o.ship.name}"`);
+        if ("owner_id" in patchBody) provisioning.push(`recorded owner on Ships row "${o.ship.name}"`);
       }
+    } else if (mine.length === 0) {
+      const created = await post2(o, `/data-models/${out.shipsModelId}/records`, {
+        name: o.ship.name,
+        ...o.ship.platform ? { platform: o.ship.platform } : {},
+        host_passengers: hostPassengers,
+        ...sshPublicKey !== void 0 ? { ssh_public_key: sshPublicKey } : {},
+        ...ownerId !== void 0 ? { owner_id: ownerId } : {},
+        ...writeMachineId ? { machine_id: machineId } : {}
+      });
+      shipRowId = created.id;
+      out.shipRow = { id: shipRowId, name: o.ship.name, action: "created", matchedBy };
+      provisioning.push(`created Ships row "${o.ship.name}"`);
+    } else {
+      problems.push(
+        matchedBy === "machine_id" ? `${mine.length} Ships rows carry this machine's id \u2014 which one is this machine?` : `${mine.length} Ships rows named "${o.ship.name}" \u2014 which one is this machine?`
+      );
+    }
+  }
+  let agentIdFor = () => void 0;
+  if (shipRowId) {
+    try {
+      const agentsModel = await get(o, `/data-models/agents?workspaceId=${ws.id}`);
+      const agentRows = await get(
+        o,
+        `/data-models/${agentsModel.id}/records?limit=200`
+      );
+      agentIdFor = (role) => agentRows.find((r) => r.name === PERSONA_NAME[role])?.id;
+    } catch {
+    }
+  }
+  if (out.models.crew) {
+    const rows = await get(
+      o,
+      `/data-models/${out.models.crew}/records?limit=200`
+    );
+    let seatShipId = shipRowId;
+    if (!seatShipId && o.dryRun && o.ship && out.shipsModelId) {
       try {
-        const session = {
-          apiKey: body.key,
-          shipId: o.shipName ?? "",
-          workspaceId: resolved.workspaceId,
-          identityId: agentId,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          ...body.id ? { keyId: body.id } : {}
-        };
-        await store.set(host, slug, session);
-      } catch (e) {
-        let revoked = false;
-        if (body.id) {
-          try {
-            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
-              method: "DELETE",
-              headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-            });
-            revoked = del2.ok;
-          } catch {
-            revoked = false;
-          }
+        const shipRows = await get(
+          o,
+          `/data-models/${out.shipsModelId}/records?limit=200`
+        );
+        const byId = o.ship.machineId ? shipRows.filter((r) => r.machine_id === o.ship.machineId) : [];
+        const mineRows = byId.length > 0 ? byId : shipRows.filter((r) => (r.name ?? "").trim() === o.ship.name.trim() && !r.machine_id);
+        if (mineRows.length === 1) seatShipId = mineRows[0].id;
+      } catch {
+      }
+    }
+    const scoped = seatShipId ? rows.filter((r) => r.ship_id === seatShipId) : rows.filter((r) => !r.ship_id);
+    const unclaimed = seatShipId ? rows.filter((r) => !r.ship_id) : [];
+    for (const role of ["dev", "design", "qa", "triage"]) {
+      const searchTerm = role === "dev" ? "develop" : role;
+      let id = seatFor(scoped, searchTerm);
+      let seatAction = "matched";
+      if (!id && seatShipId && !shipRowId) {
+        const legacyId = seatFor(unclaimed, searchTerm);
+        if (legacyId) {
+          id = legacyId;
+          seatAction = "claimed";
+        }
+      } else if (!id && shipRowId) {
+        const legacyId = seatFor(unclaimed, searchTerm);
+        if (legacyId) {
+          await patch(o, `/data-models/${out.models.crew}/records/${legacyId}`, { ship_id: shipRowId });
+          id = legacyId;
+          seatAction = "claimed";
+          provisioning.push(`claimed existing Crew row for the ${role} seat`);
+        } else {
+          const created = await post2(o, `/data-models/${out.models.crew}/records`, {
+            name: `${PERSONA_NAME[role]} agent`,
+            ship_id: shipRowId,
+            ...agentIdFor(role) ? { agent_id: agentIdFor(role) } : {}
+          });
+          id = created.id;
+          seatAction = "created";
+          provisioning.push(`created Crew row for the ${role} seat`);
         }
-        out.push({
-          role,
-          action: "failed",
-          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
-        });
-        continue;
       }
-      out.push({ role, action: "minted" });
-    } catch (e) {
-      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
+      if (id) {
+        out.seats[role] = id;
+        const rowShip = rows.find((r) => r.id === id)?.ship_id ?? shipRowId ?? void 0;
+        (out.seatRows ??= []).push({ role, id, action: seatAction, ...rowShip ? { shipId: rowShip } : {} });
+      } else if (o.dryRun && o.ship && out.shipsModelId) {
+        (out.seatRows ??= []).push({ role, id: "", action: "would-create" });
+      } else problems.push(`no Crew row looking like the ${role} seat \u2014 create one, or omit that role`);
     }
-  }
-  return out;
-}
-function describeMintOutcome(o) {
-  switch (o.action) {
-    case "minted":
-      return `${o.role}: agent key minted${o.detail ? ` (${o.detail})` : ""}`;
-    case "already_stored":
-      return `${o.role}: agent key already stored`;
-    case "no_agent":
-      return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
-    case "forbidden":
-      return FORBIDDEN_LINE;
-    case "failed":
-      return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
-  }
-}
-async function revokeSeatKeys(route, o) {
-  const out = [];
-  if (!route.resolved) return out;
-  const resolved = route.resolved;
-  const doFetch = o.fetchImpl ?? fetch;
-  const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
-  ];
-  let store;
-  try {
-    store = (o.getStore ?? getSessionStore2)();
-  } catch (e) {
-    return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
-  }
-  const host = hostFromUrl3(route.baseUrl);
-  const base = route.baseUrl.replace(/\/+$/, "");
-  for (const { role, agentId } of targets) {
-    if (!agentId) {
-      out.push({ role, action: "no_agent" });
-      continue;
+    const pairId = seatFor(scoped, "pair") || (seatShipId ? seatFor(unclaimed, "pair") : void 0);
+    if (pairId) out.seats.pair = pairId;
+    if (shipRowId) {
+      const releaseId = seatFor(scoped, "release");
+      if (releaseId) out.releaseSeat = releaseId;
+      else {
+        const created = await post2(o, `/data-models/${out.models.crew}/records`, {
+          name: "Release agent",
+          ship_id: shipRowId
+        });
+        out.releaseSeat = created.id;
+        provisioning.push("created Crew row for the release seat");
+      }
     }
-    const slug = slugFor(route, agentId);
+    const seatIds = /* @__PURE__ */ new Set([...Object.values(out.seats), ...out.releaseSeat ? [out.releaseSeat] : []]);
+    const holdRows = rows.filter((r) => !seatIds.has(r.id));
+    out.holds = holdRows.map((r) => ({ id: r.id, name: r.name ?? "", email: r.email, user_id: r.user_id }));
+    out.crewModelId = out.models.crew;
+    const people = holdRows.filter((r) => !r.agent_id && (!r.ship_id || !!r.user_id));
+    const members = /* @__PURE__ */ new Map();
     try {
-      const session = await store.get(host, slug);
-      if (!session?.apiKey) {
-        out.push({ role, action: "not_stored" });
-        continue;
-      }
-      if (!session.keyId) {
-        out.push({ role, action: "failed", detail: "no key id was recorded when this key was minted \u2014 revoke it from the seat's Agents row" });
-        continue;
+      const list = await get(
+        o,
+        `/workspaces/${out.workspaceId}/members`
+      );
+      for (const m of Array.isArray(list) ? list : []) {
+        const key = m.id ?? m.userId;
+        if (key) members.set(key, { identityId: m.identityId, email: m.email });
       }
-      if (o.dryRun) {
-        out.push({ role, action: "revoked", detail: "dry run" });
-        continue;
+    } catch {
+    }
+    for (const h of out.holds) {
+      const e = h.user_id ? members.get(h.user_id)?.email : void 0;
+      if (e) h.memberEmail = e;
+    }
+    out.candidates = people.map((r) => ({
+      id: r.id,
+      name: r.name ?? "",
+      email: r.email,
+      user_id: r.user_id,
+      detail: r.email || (r.user_id ? members.get(r.user_id)?.email : void 0) || void 0
+    }));
+    const isMine = (r) => !!r.user_id && (r.user_id === out.meId || !!out.meIdentityId && members.get(r.user_id)?.identityId === out.meIdentityId);
+    const emailOf = (r) => [r.email, r.user_id ? members.get(r.user_id)?.email : void 0].filter((e) => !!e);
+    if (!out.meId) {
+      if (out.candidates.length === 0) problems.push("no non-seat Crew rows \u2014 which row is the operator?");
+      else {
+        const byEmail = out.meEmail ? people.filter((r) => emailOf(r).some((e) => eq(e, out.meEmail))) : [];
+        if (byEmail.length === 1) out.operator = byEmail[0].id;
+        else if (out.candidates.length === 1) out.operator = out.candidates[0].id;
       }
-      const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${session.keyId}`, {
-        method: "DELETE",
-        headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-      });
-      if (!del2.ok && del2.status !== 404) {
-        out.push({ role, action: "failed", detail: `${del2.status} ${del2.statusText}` });
-        continue;
+    } else {
+      const candidates = people.filter((r) => !r.user_id || isMine(r));
+      const mine = people.find(isMine);
+      const byEmail = out.meEmail ? candidates.filter((r) => emailOf(r).some((e) => eq(e, out.meEmail))) : [];
+      const unlinked = people.filter((r) => !r.user_id);
+      const only = candidates.length === 1 && unlinked.length === 1 ? candidates[0] : void 0;
+      const pick = mine ?? (byEmail.length === 1 ? byEmail[0] : only);
+      if (pick) {
+        out.operator = pick.id;
+        out.operatorAction = isMine(pick) ? "matched" : "linked";
+        if (!isMine(pick) && o.ship) await linkOperatorRow(o, out, pick);
+      } else {
+        out.operatorCompared = `signed in as ${out.meEmail ?? "unknown email"} (identity ${out.meIdentityId ?? out.meId}); ` + (people.length === 0 ? "no person rows in the Crew table" : people.map((r) => {
+          const m = r.user_id ? members.get(r.user_id) : void 0;
+          return `"${r.name || "unnamed row"}" <${r.email ?? "no email"}>` + (r.user_id ? ` linked to member ${m?.email ?? r.user_id}${m?.identityId ? ` (identity ${m.identityId})` : ""}` : " unlinked");
+        }).join("; "));
+        if (o.ship && (!o.interactive || candidates.length === 0)) await createOperatorRow(o, out);
       }
-      await store.clear(host, slug);
-      out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
-    } catch (e) {
-      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
     }
   }
   return out;
 }
-function describeRevokeOutcome(o) {
-  switch (o.action) {
-    case "revoked":
-      return `${o.role}: agent key revoked and cleared from the keychain${o.detail ? ` (${o.detail})` : ""}`;
-    case "not_stored":
-      return `${o.role}: no agent key stored on this ship`;
-    case "no_agent":
-      return `${o.role}: no linked Agents row`;
-    case "failed":
-      return `${o.role}: could not revoke the agent key (${o.detail ?? "unknown"}) \u2014 left in the keychain`;
+async function linkOperatorRow(o, found, row) {
+  const name = row.name || row.id;
+  if (!found.meId || !found.crewModelId) return;
+  if (o.dryRun) {
+    found.provisioning.push(`would link Crew row "${name}" to your account`);
+    return;
+  }
+  const body = { user_id: found.meId };
+  if (!row.email && found.meEmail) body.email = found.meEmail;
+  try {
+    await patch(o, `/data-models/${found.crewModelId}/records/${row.id}`, body);
+    found.provisioning.push(`linked Crew row "${name}" to your account`);
+  } catch (e) {
+    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
+    found.provisioning.push(
+      `could not link your Crew row (no write access) \u2014 ask a workspace admin to set user_id on "${name}"`
+    );
   }
 }
-async function canMintAgentKeys(route, o = {}) {
-  const resolved = route.resolved;
-  if (!resolved) return void 0;
-  const agentId = seatAgentId(route, "dev") ?? SEAT_KEY_ROLES.map((r) => seatAgentId(route, r)).find(Boolean);
-  if (!agentId) return void 0;
+async function createOperatorRow(o, found) {
+  if (!found.meId || !found.crewModelId) return;
+  const name = found.meName || found.meEmail || "Operator";
+  if (o.dryRun) {
+    found.provisioning.push(`would create Crew row "${name}" for you`);
+    return;
+  }
   try {
-    const res = await (o.fetchImpl ?? fetch)(`${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
-      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    const created = await post2(o, `/data-models/${found.crewModelId}/records`, {
+      name,
+      ...found.meEmail ? { email: found.meEmail } : {},
+      user_id: found.meId
     });
-    if (res.ok) return true;
-    return res.status === 403 ? false : void 0;
-  } catch {
-    return void 0;
+    found.operator = created.id;
+    found.operatorAction = "created";
+    found.holds.push({ id: created.id, name, email: found.meEmail, user_id: found.meId });
+    found.candidates.push({ id: created.id, name, email: found.meEmail, user_id: found.meId, detail: found.meEmail });
+    found.provisioning.push(`created Crew row "${name}" for you`);
+  } catch (e) {
+    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
+    found.provisioning.push("could not create your Crew row (no write access) \u2014 ask a workspace admin to add one with your user_id");
   }
 }
+function renderConnection(d, route, dir, opts = {}) {
+  const apiKeyFileLine = opts.keychainBacked ? `    # apiKey: resolved automatically from the OS keychain (crew connect) \u2014 no apiKeyFile needed` : opts.apiKeyFile ? `    apiKeyFile: "${opts.apiKeyFile}"` : `    apiKeyFile: "REPLACE \u2014 a file holding this workspace's key"`;
+  const apiKeyVarLine = opts.keychainBacked ? "" : opts.apiKeyVar ? `
+    apiKeyVar: ${opts.apiKeyVar}` : `
+    apiKeyVar: REPLACE_KEY_VAR`;
+  return `  - route: ${route}
+    enabled: false          # arm it deliberately, once doctor is green
+${opts.area ? `    area: "${opts.area}"
+` : ""}    ${dir === null ? "repos: {}              # `crew repos clone` / `crew repos add` fill this in" : `dir: "${dir}"`}
+    # worktreePrefix: omitted \u2014 each repo derives its own from its checkout's
+    # directory name (ISSUE-400). Only set this if every repo this route
+    # serves genuinely wants the SAME prefix, which is rare once an area has
+    # more than one repo.
+    # What a host must be to build this \u2014 unix, macos, linux, or windows \u2014
+    # belongs in each repo's own .crew.yaml, not here (see docs/REPO_SPEC.md).
+    baseUrl: ${opts.baseUrl ? `"${opts.baseUrl}"` : '"REPLACE \u2014 the same baseUrl as your other routes"'}
+${opts.hostPassengers ? "    hostPassengers: true\n" : ""}${apiKeyFileLine}${apiKeyVarLine}
+`;
+}
+
+// src/cli.ts
+import {
+  getSessionStore as getSessionStore3,
+  hostFromUrl as hostFromUrl4,
+  loginWithDeviceCode,
+  getOrCreateShipId,
+  DeviceLoginError
+} from "@tablation/client";
 
 // src/capability-check.ts
 var WRITE_LEVELS = /* @__PURE__ */ new Set(["WRITE", "DELETE"]);
@@ -17392,6 +17440,7 @@ ${changed2.map((c) => `  - ${c}
         let seen = precheckTickets.get(c.route);
         if (!seen) precheckTickets.set(c.route, seen = tracker.openTickets());
         const { byRepo: preByRepo, unplaceable: preUnplaceable } = ticketsByRepo(c, await seen);
+        clearShipAttention(state, SEAT_FORBIDDEN_KEY);
         const preModes = { modes: await tracker.projectWorkModes(), agentAssignees: /* @__PURE__ */ new Set() };
         const pre = withoutManualVerified(
           preByRepo.get(target.name) ?? [],
@@ -17699,6 +17748,12 @@ ${changed2.map((c) => `  - ${c}
       await sweepClosedTickets(c, target, repo.branch, tracker, dryRun, remit);
       return summary;
     } catch (e) {
+      if (isForbiddenError(e)) {
+        await raiseShipAttention({ state, emit: remit, route: c, ship: cfg.ship }, seatForbiddenItem());
+        const line = seatForbiddenRepoLine(scope);
+        remit.warn(line, { step: "release" });
+        return { scope, tests: "skipped", outcome: "error", detail: line };
+      }
       remit.warn(`release phase failed: ${e.message}`, { step: "release" });
       return { scope, tests: "skipped", outcome: "error", detail: e.message };
     } finally {
@@ -18439,6 +18494,15 @@ ${changed2.map((c) => `  - ${c}
           process.stdout.write(`${describeMintOutcome(o)}
 `);
         }
+        if (!dryRun) {
+          for (const p of await probeSeatReads(target, { userAgent: cfg.ship.userAgent })) {
+            if (p.state === "forbidden") {
+              process.stdout.write(`${describeSeatForbidden(p.role)}
+`);
+              process.exitCode = 1;
+            }
+          }
+        }
       }
       if (run2.diverged) process.exitCode = 1;
       break;
@@ -19379,6 +19443,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             mintOutcomes = await mintMissingSeatKeys({ ...existingRoute, resolved: { ...existingRoute.resolved, seats: found.seats } }, { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name });
             for (const o of mintOutcomes) process.stderr.write(`${describeMintOutcome(o)}
 `);
+            for (const p of await probeSeatReads({ ...existingRoute, resolved: { ...existingRoute.resolved, seats: found.seats } }, { userAgent: cfg.ship.userAgent })) {
+              if (p.state === "forbidden") process.stderr.write(`${describeSeatForbidden(p.role)}
+`);
+            }
           } catch (e) {
             process.stderr.write(`seat keys: skipped (${e.message})
 `);
@@ -19543,6 +19611,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
               const minted = await mintMissingSeatKeys(syncRoute, { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name });
               for (const m of minted) process.stderr.write(`  ${describeMintOutcome(m)}
 `);
+              for (const p of await probeSeatReads(syncRoute, { userAgent: cfg.ship.userAgent })) {
+                if (p.state === "forbidden") process.stderr.write(`  ${describeSeatForbidden(p.role)}
+`);
+              }
               if (run2.readOnly) {
                 const missing = run2.personaResult.outcomes.some((p) => p.action === "missing");
                 process.stderr.write(missing ? "  A workspace admin has to open the Crew app or run `crew agents sync` once before this ship's seats can run.\n" : "  Seats are linked to the workspace's existing personas.\n");
@@ -20662,6 +20734,13 @@ watermark:  ${state.watermark()}
             passed += f.passed;
           }
         }
+        if (!flag("offline")) {
+          for (const p of await probeSeatReads(route, { userAgent: cfg.ship.userAgent })) {
+            if (p.state === "forbidden") {
+              problems.push({ severity: "blocker", kind: "seat_cannot_read_issues", route: route.route, message: `${p.role} agent key cannot read Issues (403)`, remedy: SEAT_NO_READ_REMEDY });
+            } else if (p.state === "ok") passed++;
+          }
+        }
         problems.push(...attentionProblems(openShipAttention(state), problems));
         if (problems.some((p) => p.severity === "blocker")) process.exitCode = 1;
         process.stdout.write(`${JSON.stringify({ offline: flag("offline"), pushAuth, tools: toolRows, problems, passed }, null, 2)}
@@ -20801,6 +20880,19 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
 `
         );
       }
+      if (!flag("offline")) {
+        for (const p of await probeSeatReads(roleRoute, { userAgent: cfg.ship.userAgent })) {
+          if (p.state === "forbidden") {
+            process.stdout.write(`${describeSeatForbidden(p.role)}
+`);
+            process.exitCode = 1;
+          } else {
+            process.stdout.write(p.state === "ok" ? `seat read:        ${p.role} can read Issues
+` : `seat read:        ${p.role} could not be checked (${p.detail})
+`);
+          }
+        }
+      }
       const [ships, crewRows] = await Promise.all([tracker.shipRows(), tracker.crewRows()]);
       if (ships.length === 0) {
         process.stdout.write("ship record:       this workspace has no Ships table (fine)\n");