bazilion 0.17.0 → 0.19.0

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { defineCommand as defineCommand36, runCommand, showUsage } from "citty";
+import { defineCommand as defineCommand38, runCommand, showUsage } from "citty";
 
 // package.json
 var package_default = {
   name: "bazilion",
-  version: "0.17.0",
+  version: "0.19.0",
   description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/teams/skills, and run the local daemon.",
   license: "MIT",
   repository: {
@@ -188,6 +188,60 @@ function createClient(cfg) {
         input
       )
     },
+    /**
+     * Specialist verification of a captured code change (BAZ-044).
+     *
+     * Creating a request does not execute anything: the verification state machine claims and runs
+     * it, and a blocked capture comes back as a typed blocker rather than an error.
+     */
+    verifications: (teamId) => {
+      const base = `/api/teams/${encodeURIComponent(teamId)}/verifications`;
+      return {
+        list: () => request("GET", base),
+        show: (requestId) => request("GET", `${base}/${encodeURIComponent(requestId)}`),
+        create: (input) => request("POST", base, input),
+        cancel: (requestId) => request("POST", `${base}/${encodeURIComponent(requestId)}/cancel`)
+      };
+    },
+    /**
+     * Revision-bound review packets (BAZ-043).
+     *
+     * A packet binds one captured revision. Findings are append-only, and resolving one requires an
+     * explicit decision or a named later revision — a moved line proves nothing.
+     */
+    reviewPackets: (teamId) => {
+      const base = `/api/teams/${encodeURIComponent(teamId)}/reviews`;
+      const item = (packetId2) => `${base}/${encodeURIComponent(packetId2)}`;
+      return {
+        list: () => request("GET", base),
+        show: (packetId2) => request("GET", item(packetId2)),
+        create: (input) => request("POST", base, input),
+        addFinding: (packetId2, input) => request("POST", `${item(packetId2)}/findings`, input),
+        resolveFinding: (packetId2, findingId, input) => request(
+          "POST",
+          `${item(packetId2)}/findings/${encodeURIComponent(findingId)}/resolve`,
+          input
+        ),
+        recordConclusion: (packetId2, input) => request("POST", `${item(packetId2)}/conclusion`, input),
+        export: (packetId2) => request("GET", `${item(packetId2)}/export`),
+        /**
+         * Publish the export as a durable artifact through BAZ-034's contract. `held` and `denied` are
+         * outcomes, not errors: the bytes exist and stay unreadable, and an approval names them.
+         */
+        deliverExport: (packetId2) => request("POST", `${item(packetId2)}/export/deliver`),
+        reportState: (packetId2, input) => request("POST", `${item(packetId2)}/reported`, input),
+        /**
+         * Resolve what a file link would do. Read-only: no editor runs unless `openLink` is called, and
+         * the link itself says which host it names and whether it is the reviewed revision or the live file.
+         */
+        link: (packetId2, options) => {
+          const params = new URLSearchParams({ path: options.path });
+          if (options.line !== void 0) params.set("line", String(options.line));
+          return request("GET", `${item(packetId2)}/link?${params}`);
+        },
+        openLink: (packetId2, options) => request("POST", `${item(packetId2)}/link/open`, options)
+      };
+    },
     /** Read-only Git change review and bounded source snapshots (BAZ-042). */
     repositoryReview: (teamId) => {
       const base = `/api/teams/${encodeURIComponent(teamId)}/review`;
@@ -2290,6 +2344,42 @@ function invalidateRestoredCodingEvidence(db, payload, targetHome) {
      WHERE state = 'retained' AND expires_at <= ?`
   ).run(restoredAt, restoredAt);
   db.prepare("DELETE FROM source_snapshots WHERE expires_at <= ?").run(restoredAt);
+  db.prepare("DELETE FROM verification_requests WHERE expires_at <= ?").run(restoredAt);
+  db.prepare(
+    `UPDATE verification_requests SET state = 'blocked'
+     WHERE state IN ('pending', 'awaiting_approval')
+       AND NOT EXISTS (SELECT 1 FROM source_snapshots snapshot
+                       WHERE snapshot.snapshot_id = verification_requests.snapshot_id
+                         AND snapshot.team_id = verification_requests.team_id
+                         AND snapshot.expires_at > ?)`
+  ).run(restoredAt);
+  db.prepare(
+    `UPDATE verification_attempts
+     SET state = 'uncertain', finished_at = ?, lease_owner = NULL, lease_expires_at = NULL,
+         error = 'execution was interrupted by a backup restore'
+     WHERE finished_at IS NULL`
+  ).run(restoredAt);
+  const invalidated = db.prepare(
+    `SELECT DISTINCT attempt.request_id AS request_id
+       FROM verification_check_outcomes outcome
+       JOIN verification_attempts attempt ON attempt.id = outcome.attempt_id
+       WHERE outcome.state IN ('succeeded', 'failed', 'timed_out', 'cancelled')`
+  ).all();
+  db.prepare(
+    `UPDATE verification_check_outcomes
+     SET state = 'unknown', command_id = NULL, exit_code = NULL, finished_at = ?
+     WHERE state IN ('succeeded', 'failed', 'timed_out', 'cancelled', 'not_executed')`
+  ).run(restoredAt);
+  const reopen = db.prepare(`UPDATE verification_requests SET state = 'uncertain' WHERE id = ?`);
+  const invalidateAttempt = db.prepare(
+    `UPDATE verification_attempts
+     SET state = 'uncertain', error = 'evidence was invalidated by a backup restore'
+     WHERE request_id = ? AND state IN ('completed', 'failed')`
+  );
+  for (const row2 of invalidated) {
+    invalidateAttempt.run(row2.request_id);
+    reopen.run(row2.request_id);
+  }
   db.prepare("UPDATE workspace_writers SET state = 'recovery', recovery_mode = 'restored'").run();
   const teams = db.prepare("SELECT id FROM teams").all();
   const rebase = db.prepare("UPDATE workspace_writers SET root_path = ? WHERE team_id = ?");
@@ -2371,7 +2461,7 @@ function pauseRestoredUserQueue(database) {
 // src/backup-schema.ts
 import { createHash } from "crypto";
 var CANONICAL_MIGRATION = "0001_init";
-var CANONICAL_SCHEMA_HASH = "8454a37b1985d248bb25c6588d81b5f00506e13387600c4441ba01727d10bcaf";
+var CANONICAL_SCHEMA_HASH = "da37324d58fa517941ec0557529d00a7a812413f9fda7e5d611287ad42b47595";
 var CANONICAL_OBJECTS = [
   ["table", "team_coding_environments"],
   ["table", "workspace_writers"],
@@ -2384,6 +2474,28 @@ var CANONICAL_OBJECTS = [
   ["table", "source_snapshots"],
   ["index", "source_snapshots_retention"],
   ["index", "source_snapshots_team_time"],
+  ["table", "review_packets"],
+  ["index", "review_packets_team_time"],
+  ["index", "review_packets_reviewer_dispatch"],
+  ["index", "review_packets_retention"],
+  ["table", "review_findings"],
+  ["index", "review_findings_packet"],
+  ["index", "review_findings_unresolved"],
+  ["table", "review_conclusions"],
+  ["index", "review_conclusions_packet"],
+  ["table", "review_attempts"],
+  ["index", "review_attempts_one_open_per_packet"],
+  ["index", "review_attempts_lease"],
+  ["table", "verification_requests"],
+  ["index", "verification_requests_team_time"],
+  ["index", "verification_requests_recipient_dispatch"],
+  ["index", "verification_requests_retention"],
+  ["table", "verification_checks"],
+  ["table", "verification_attempts"],
+  ["index", "verification_attempts_one_open_per_request"],
+  ["index", "verification_attempts_lease"],
+  ["table", "verification_check_outcomes"],
+  ["index", "verification_check_outcomes_command"],
   ["table", "notification_settings"],
   ["table", "notification_receipts"],
   ["index", "notification_receipts_state"],
@@ -2401,6 +2513,8 @@ var CANONICAL_OBJECTS = [
   ["table", "agent_conversations"],
   ["table", "agent_conversation_selection"],
   ["index", "agent_results_team_time"],
+  ["index", "agent_results_session_source"],
+  ["index", "agent_results_packet_source"],
   ["index", "agent_triggers_agent"],
   ["index", "agent_triggers_enabled"],
   ["index", "agent_loop_break_events_agent_time"],
@@ -5619,7 +5733,7 @@ var skillCommand = defineCommand25({
 // src/commands/team.ts
 import { readFileSync as readFileSync11 } from "fs";
 import { stdin as stdin2 } from "process";
-import { defineCommand as defineCommand30 } from "citty";
+import { defineCommand as defineCommand32 } from "citty";
 
 // src/commands/team-coding-log.ts
 import { defineCommand as defineCommand26 } from "citty";
@@ -6175,20 +6289,466 @@ var teamPolicyCommand = defineCommand28({
 });
 
 // src/commands/team-review.ts
+import { defineCommand as defineCommand30 } from "citty";
+
+// src/commands/team-review-packet.ts
 import { defineCommand as defineCommand29 } from "citty";
-var slug = {
+var slug = { id: { type: "positional", required: true, description: "Team slug" } };
+var packetId = {
+  packetId: { type: "positional", required: true, description: "Review packet id" }
+};
+var SEVERITIES = ["blocker", "major", "minor", "info"];
+function printReport(report) {
+  const packet = report.packet;
+  const requester = packet.requester.kind === "agent" ? `agent ${packet.requester.agentId}` : "operator";
+  console.log(`${packet.id}  ${packet.state}${report.applicability.stale ? "  (stale)" : ""}`);
+  console.log(
+    `  change:   snapshot ${packet.snapshot.id} (base ${packet.snapshot.baseOid.slice(0, 12)}${packet.snapshot.complete ? "" : ", INCOMPLETE COVERAGE"})`
+  );
+  console.log(`  reviewer: ${packet.reviewerAgentId ?? "(none \u2014 nothing delegated)"}`);
+  console.log(`  asked by: ${requester}`);
+  console.log(
+    `  applicability: ${report.applicability.comparison === "identical" ? "unchanged since capture" : `${report.applicability.comparison} (never a pass)`}`
+  );
+  if (packet.summary) console.log(`  summary:  ${packet.summary}`);
+  console.log(
+    `  exported: ${packet.exportedAt ? `revision ${packet.exportRevision?.slice(0, 12)}` : "not exported"}`
+  );
+  if (report.findings.length === 0) {
+    console.log("  findings: none recorded");
+  } else {
+    console.log("  findings:");
+    for (const finding of report.findings) {
+      const lines = finding.lineStart === null ? "" : `:${finding.lineStart}${finding.lineEnd && finding.lineEnd !== finding.lineStart ? `-${finding.lineEnd}` : ""}`;
+      const resolution = finding.resolution ? ` resolved(${finding.resolution.kind})` : finding.state === "unverified" ? " UNVERIFIED \u2014 not correlated to the reviewed revision" : "";
+      console.log(`    [${finding.severity}] ${finding.path}${lines}${resolution}  ${finding.note}`);
+    }
+  }
+  if (report.conclusions.length === 0) {
+    console.log("  conclusions: none \u2014 a packet with findings is not yet a review");
+  } else {
+    for (const conclusion of report.conclusions) {
+      const who = conclusion.reviewer.kind === "agent" ? conclusion.reviewer.agentId : "operator";
+      console.log(
+        `  conclusion: ${conclusion.conclusion} (${who})${conclusion.note ? ` \u2014 ${conclusion.note}` : ""}`
+      );
+    }
+  }
+  const { facts } = report;
+  const reported = Object.entries(facts.reported).filter(([, value]) => value !== null).map(([key, value]) => `${key}=${value} (reported)`);
+  console.log(
+    `  facts:    change prepared=${facts.changePrepared} checks current=${facts.checksCurrent} reviewed=${facts.reviewed}`
+  );
+  if (reported.length > 0) console.log(`            ${reported.join(" ")}`);
+  console.log(
+    "  note:     a review conclusion is not acceptance, and this command never commits, pushes, merges or deploys"
+  );
+}
+var createCmd3 = defineCommand29({
+  meta: { name: "create", description: "Capture a review packet for a retained revision" },
+  args: {
+    ...slug,
+    snapshot: {
+      type: "string",
+      required: true,
+      description: "BAZ-042 snapshot id to review (see `team review snapshots`)"
+    },
+    reviewer: {
+      type: "string",
+      description: "Agent who should review. Omit for an operator-only packet (nothing is delegated)"
+    },
+    summary: { type: "string", description: "What the change is for, in the requester\u2019s words" },
+    json: { type: "boolean", description: "Emit the packet as JSON" }
+  },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    try {
+      const response = await client.reviewPackets(args2.id).create({
+        snapshotId: args2.snapshot,
+        reviewerAgentId: args2.reviewer ?? null,
+        summary: args2.summary ?? null
+      });
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      printReport(response.report);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var listCmd10 = defineCommand29({
+  meta: { name: "list", description: "List review packets for a Team" },
+  args: { ...slug, json: { type: "boolean", description: "Emit JSON" } },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    const response = await client.reviewPackets(args2.id).list();
+    if (args2.json) {
+      console.log(JSON.stringify(response, null, 2));
+      return;
+    }
+    if (response.packets.length === 0) {
+      console.log("no review packets");
+      return;
+    }
+    const rows = [
+      ["ID", "STATE", "REVIEWER", "FINDINGS", "OPEN", "CONCLUSION", "CHANGE"],
+      ...response.packets.map((entry3) => [
+        entry3.packet.id,
+        entry3.packet.state,
+        entry3.packet.reviewerAgentId ?? "(none)",
+        String(entry3.counts.findings),
+        String(entry3.counts.unresolved),
+        entry3.conclusion ?? "\u2014",
+        entry3.packet.snapshot.id.slice(0, 12)
+      ])
+    ];
+    for (const line of columnize(rows)) console.log(line);
+    console.log(
+      "\nA packet of an older revision stays listed; `packet show` reports whether it is stale."
+    );
+  }
+});
+var showCmd5 = defineCommand29({
+  meta: { name: "show", description: "Show one review packet, its findings and its conclusions" },
+  args: { ...slug, ...packetId, json: { type: "boolean", description: "Emit JSON" } },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    try {
+      const response = await client.reviewPackets(args2.id).show(args2.packetId);
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      printReport(response.report);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var findingCmd = defineCommand29({
+  meta: { name: "finding", description: "Record a finding against the packet\u2019s captured revision" },
+  args: {
+    ...slug,
+    ...packetId,
+    path: { type: "string", required: true, description: "Repository-relative path" },
+    severity: { type: "string", required: true, description: SEVERITIES.join(" | ") },
+    note: { type: "string", required: true, description: "What is wrong, with evidence" },
+    lines: {
+      type: "string",
+      description: 'Line context as "start" or "start-end". Context only: never identity.'
+    },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    if (!SEVERITIES.includes(args2.severity)) {
+      console.error(`severity must be one of: ${SEVERITIES.join(", ")}`);
+      process.exit(1);
+    }
+    const [start, end] = (args2.lines ?? "").split("-");
+    const body = {
+      path: args2.path,
+      severity: args2.severity,
+      note: args2.note,
+      ...start ? { lineStart: Number(start) } : {},
+      ...end ? { lineEnd: Number(end) } : {}
+    };
+    const client = createClient2();
+    try {
+      const response = await client.reviewPackets(args2.id).addFinding(args2.packetId, body);
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      console.log(
+        `finding recorded against revision ${response.report.packet.snapshot.id.slice(0, 12)}`
+      );
+      printReport(response.report);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var resolveCmd = defineCommand29({
+  meta: { name: "resolve", description: "Resolve a finding with explicit proof" },
+  args: {
+    ...slug,
+    ...packetId,
+    findingId: { type: "positional", required: true, description: "Finding id" },
+    kind: {
+      type: "string",
+      required: true,
+      description: "explicit (a decision) | linked_revision (a named later revision)"
+    },
+    note: { type: "string", required: true, description: "How it was resolved" },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    if (args2.kind !== "explicit" && args2.kind !== "linked_revision") {
+      console.error("kind must be `explicit` or `linked_revision`");
+      process.exit(1);
+    }
+    const client = createClient2();
+    try {
+      const response = await client.reviewPackets(args2.id).resolveFinding(args2.packetId, args2.findingId, {
+        resolutionKind: args2.kind,
+        resolutionNote: args2.note
+      });
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      printReport(response.report);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var concludeCmd = defineCommand29({
+  meta: { name: "conclude", description: "Record the reviewer\u2019s conclusion for this revision" },
+  args: {
+    ...slug,
+    ...packetId,
+    conclusion: {
+      type: "string",
+      required: true,
+      description: "changes_requested | commented | recommended"
+    },
+    note: { type: "string", description: "Why" },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    const allowed = ["changes_requested", "commented", "recommended"];
+    if (!allowed.includes(args2.conclusion)) {
+      console.error(`conclusion must be one of: ${allowed.join(", ")}`);
+      process.exit(1);
+    }
+    const client = createClient2();
+    try {
+      const response = await client.reviewPackets(args2.id).recordConclusion(args2.packetId, {
+        conclusion: args2.conclusion,
+        note: args2.note ?? null
+      });
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      printReport(response.report);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var snapshotCmd = defineCommand29({
+  meta: { name: "snapshots", description: "List retained revisions that could be reviewed" },
+  args: { ...slug, json: { type: "boolean", description: "Emit JSON" } },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    const list8 = await client.repositoryReview(args2.id).snapshots();
+    if (args2.json) {
+      console.log(JSON.stringify(list8, null, 2));
+      return;
+    }
+    if (list8.snapshots.length === 0) {
+      console.log("no retained revisions \u2014 capture one with `team review capture`");
+      return;
+    }
+    const rows = [
+      ["SNAPSHOT", "CAPTURED", "ENTRIES", "COMPLETE"],
+      ...list8.snapshots.map((snapshot) => [
+        snapshot.snapshotId.slice(0, 16),
+        new Date(snapshot.createdAt).toISOString(),
+        String(snapshot.entryCount),
+        snapshot.complete ? "yes" : "NO"
+      ])
+    ];
+    for (const line of columnize(rows)) console.log(line);
+  }
+});
+var reportedCmd = defineCommand29({
+  meta: {
+    name: "reported",
+    description: "Record an operator-reported external state (never verified by Bazilion)"
+  },
+  args: {
+    ...slug,
+    ...packetId,
+    state: {
+      type: "positional",
+      required: true,
+      description: "committed | pushed | pullRequest | merged | deployed | productionAccepted"
+    },
+    reference: {
+      type: "string",
+      description: "What the operator is pointing at: a commit id, a URL, a release name. Omit to clear it."
+    },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    try {
+      const response = await client.reviewPackets(args2.id).reportState(args2.packetId, {
+        state: args2.state,
+        reference: args2.reference ?? null
+      });
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      const reported = Object.entries(response.report.packet.reported).filter(([, value]) => value !== null).map(([key, value]) => `${key}=${value}`);
+      console.log(
+        `recorded (reported, not verified): ${reported.length > 0 ? reported.join(" ") : "nothing reported"}`
+      );
+      console.log(
+        "Bazilion did not check this: there is no code-host integration, so it is whatever you reported."
+      );
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var linkCmd = defineCommand29({
+  meta: {
+    name: "link",
+    description: "Resolve where a file link points, and where it would open"
+  },
+  args: {
+    ...slug,
+    ...packetId,
+    path: { type: "string", required: true, description: "Changed path in the reviewed revision" },
+    line: { type: "string", description: "Line to point at" },
+    open: {
+      type: "boolean",
+      description: "Actually open it on the daemon host (requires a configured editor)"
+    },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    const options = {
+      path: args2.path,
+      ...args2.line ? { line: Number(args2.line) } : {}
+    };
+    try {
+      if (args2.open) {
+        const { link: link2, result } = await client.reviewPackets(args2.id).openLink(args2.packetId, options);
+        console.log(result.opened ? `opened: ${result.detail}` : `not opened: ${result.detail}`);
+        console.log(`host: ${link2.host.daemon ?? "unknown"} (owns the workspace)`);
+        return;
+      }
+      const { link } = await client.reviewPackets(args2.id).link(args2.packetId, options);
+      if (args2.json) {
+        console.log(JSON.stringify(link, null, 2));
+        return;
+      }
+      console.log(`copy:  ${link.copyTarget}`);
+      console.log(`host:  ${link.host.daemon ?? "unknown"} (owns the workspace)`);
+      console.log(`file:  ${link.hostPath ?? "(not part of the reviewed revision)"}`);
+      console.log(
+        `mode:  ${link.mode === "live" ? "the reviewed revision (the tree still matches the capture)" : link.mode === "stale" ? "the CURRENT file \u2014 the tree moved since the capture" : "unknown"}`
+      );
+      console.log(`open:  ${link.canOpen ? link.command : "not configured on the daemon host"}`);
+      for (const note of link.notes) console.log(`  note: ${note}`);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var exportCmd = defineCommand29({
+  meta: { name: "export", description: "Print the patch and handoff text for a packet\u2019s revision" },
+  args: {
+    ...slug,
+    ...packetId,
+    patch: { type: "boolean", description: "Print only the unified patch" },
+    deliver: {
+      type: "boolean",
+      description: "Publish the export as a durable artifact for the requesting Agent (subject to policy)"
+    },
+    handoff: { type: "boolean", description: "Print only the handoff text" },
+    json: { type: "boolean", description: "Emit the export as JSON" }
+  },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    try {
+      if (args2.deliver) {
+        const { delivery } = await client.reviewPackets(args2.id).deliverExport(args2.packetId);
+        if (delivery.kind === "delivered") {
+          console.log(`delivered: ${delivery.resultName} (result ${delivery.resultId})`);
+          console.log(
+            delivery.noticeHeld ? "the requester\u2019s notice is held for approval; the artifact itself is available" : "the requester was told where to find it"
+          );
+        } else if (delivery.kind === "held") {
+          console.log(`held for approval: ${delivery.detail}`);
+          console.log(`result ${delivery.resultId} stays unreadable until it is released`);
+        } else {
+          console.log(`not delivered (${delivery.kind}): ${delivery.detail}`);
+        }
+        return;
+      }
+      const { export: result } = await client.reviewPackets(args2.id).export(args2.packetId);
+      if (args2.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+      if (args2.patch || !args2.handoff)
+        console.log(result.patch || "(no patch: see the handoff limitations)");
+      if (!args2.patch) {
+        if (!args2.handoff) console.log("");
+        console.log(result.handoff);
+      }
+      if (!args2.patch && result.limitations.length > 0) {
+        console.error(
+          `
+handoff names ${result.limitations.length} limitation(s), and a conclusion is not acceptance`
+        );
+      }
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var teamReviewPacketCommand = defineCommand29({
+  meta: {
+    name: "packet",
+    description: "Revision-bound review packets: captured revision, findings, conclusion and handoff"
+  },
+  subCommands: {
+    create: createCmd3,
+    list: listCmd10,
+    show: showCmd5,
+    finding: findingCmd,
+    resolve: resolveCmd,
+    conclude: concludeCmd,
+    reported: reportedCmd,
+    link: linkCmd,
+    export: exportCmd,
+    snapshots: snapshotCmd
+  }
+});
+
+// src/commands/team-review.ts
+var slug2 = {
   id: { type: "positional", required: true, description: "Team slug" }
 };
 function printIssues(changes) {
   for (const issue of changes.issues) console.log(`note: ${issue.code}: ${issue.message}`);
 }
-var showCmd5 = defineCommand29({
+var showCmd6 = defineCommand30({
   meta: {
     name: "show",
     description: "List changes since a baseline (read-only)"
   },
   args: {
-    ...slug,
+    ...slug2,
     base: {
       type: "string",
       description: "Comparison base: branch, tag or commit id (default HEAD)"
@@ -6247,13 +6807,13 @@ var showCmd5 = defineCommand29({
     printIssues(changes);
   }
 });
-var captureCmd = defineCommand29({
+var captureCmd = defineCommand30({
   meta: {
     name: "capture",
     description: "Capture a bounded source snapshot for a Team (read-only)"
   },
   args: {
-    ...slug,
+    ...slug2,
     base: { type: "string", description: "Comparison base (default HEAD)" },
     include: {
       type: "string",
@@ -6290,9 +6850,9 @@ var captureCmd = defineCommand29({
     for (const issue of snapshot.issues) console.log(`  note: ${issue.code}: ${issue.message}`);
   }
 });
-var snapshotsCmd = defineCommand29({
+var snapshotsCmd = defineCommand30({
   meta: { name: "snapshots", description: "List retained source snapshots for a Team" },
-  args: { ...slug, json: { type: "boolean", description: "Emit JSON" } },
+  args: { ...slug2, json: { type: "boolean", description: "Emit JSON" } },
   async run({ args: args2 }) {
     const client = createClient2();
     const list8 = await client.repositoryReview(args2.id).snapshots();
@@ -6314,10 +6874,10 @@ var snapshotsCmd = defineCommand29({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var snapshotCmd = defineCommand29({
+var snapshotCmd2 = defineCommand30({
   meta: { name: "snapshot", description: "Show one retained source snapshot" },
   args: {
-    ...slug,
+    ...slug2,
     snapshot: { type: "positional", required: true, description: "Snapshot id" },
     json: { type: "boolean", description: "Emit JSON" }
   },
@@ -6340,21 +6900,240 @@ var snapshotCmd = defineCommand29({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var teamReviewCommand = defineCommand29({
+var teamReviewCommand = defineCommand30({
   meta: {
     name: "review",
     description: "Read-only Git change review and bounded source snapshots"
   },
   subCommands: {
-    show: showCmd5,
+    show: showCmd6,
     capture: captureCmd,
     snapshots: snapshotsCmd,
-    snapshot: snapshotCmd
+    snapshot: snapshotCmd2,
+    packet: teamReviewPacketCommand
+  }
+});
+
+// src/commands/team-verify.ts
+import { defineCommand as defineCommand31 } from "citty";
+var slug3 = {
+  id: { type: "positional", required: true, description: "Team slug" }
+};
+var OUTCOME_GLYPH = {
+  not_executed: "not run",
+  succeeded: "ok",
+  failed: "FAIL",
+  skipped: "skipped",
+  blocked: "blocked",
+  timed_out: "timeout",
+  cancelled: "cancelled",
+  unknown: "unknown"
+};
+function latestAttempt(report) {
+  return [...report.attempts].sort((a, b) => b.attemptNumber - a.attemptNumber)[0];
+}
+function printReport2(report) {
+  const { request } = report;
+  const requester = request.requester.kind === "agent" ? `agent ${request.requester.agentId}` : "operator";
+  console.log(`${request.id}  ${request.state}`);
+  console.log(
+    `  change:    snapshot ${request.snapshot.id} (base ${request.snapshot.baseOid.slice(0, 12)}${request.snapshot.complete ? "" : ", INCOMPLETE COVERAGE"})`
+  );
+  console.log(`  specialist: ${request.recipientAgentId}   requested by: ${requester}`);
+  console.log(`  environment: ${request.environment.image} (shell ${request.environment.sandbox})`);
+  console.log(
+    `  applicability: ${report.applicability.comparison === "identical" ? "unchanged since capture" : `${report.applicability.comparison} (never a pass)`}`
+  );
+  if (request.summary) console.log(`  requested: ${request.summary}`);
+  const attempt = latestAttempt(report);
+  const outcomes = new Map((attempt?.outcomes ?? []).map((outcome) => [outcome.ordinal, outcome]));
+  console.log("  checks:");
+  for (const check of report.checks) {
+    const outcome = outcomes.get(check.ordinal);
+    const state = outcome?.state ?? "not_executed";
+    const receipt = outcome?.commandId ? `  receipt ${outcome.commandId}` : outcome?.receiptUnavailable ? "  receipt no longer available" : "";
+    const exit = outcome?.exitCode === null || outcome?.exitCode === void 0 ? "" : ` exit ${outcome.exitCode}`;
+    console.log(
+      `    [${check.ordinal}] ${OUTCOME_GLYPH[state]}${exit}${receipt}  ${check.command} (${check.purpose})`
+    );
+  }
+  const writes = attempt?.observedWrites;
+  if (writes?.undeclaredPaths.length) {
+    const declared = writes.declaredPaths.length ? writes.declaredPaths.join(", ") : "none declared";
+    console.log(
+      `  wrote outside the declared output paths (${declared}): ${writes.undeclaredPaths.join(", ")}${writes.truncated ? " \u2026" : ""}`
+    );
+  } else if (writes?.comparison === "unknown") {
+    console.log(
+      "  writes: could not be established (the tree could not be compared to the capture)"
+    );
+  }
+  if (attempt?.error) console.log(`  note: ${attempt.error}`);
+  if (!attempt) console.log("  note: no attempt has run yet");
+}
+var createCmd4 = defineCommand31({
+  meta: {
+    name: "create",
+    description: "Capture a verification request against a snapshot (does not run checks)"
+  },
+  args: {
+    ...slug3,
+    agent: { type: "string", required: true, description: "Team member who will verify" },
+    snapshot: { type: "string", required: true, description: "BAZ-042 snapshot id to verify" },
+    check: {
+      type: "string",
+      required: true,
+      description: 'A check as "<command> :: <purpose> [:: <cwd>] [:: <timeoutSeconds>]". Repeat up to eight times.'
+    },
+    summary: { type: "string", description: "Optional acceptance summary for the specialist" },
+    writable: {
+      type: "string",
+      description: "Declared writable output path for checks. Repeat for each path."
+    },
+    json: { type: "boolean", description: "Emit the request as JSON" }
+  },
+  async run({ args: args2 }) {
+    const raw = collectFlagValues(process.argv, "check");
+    if (raw.length === 0) {
+      console.error("at least one --check is required");
+      process.exit(1);
+    }
+    const checks = raw.map((value) => {
+      const [command, purpose, cwd, timeoutSeconds] = value.split("::").map((part) => part.trim());
+      if (!command || !purpose) {
+        console.error(`a check needs a command and a purpose: ${value}`);
+        process.exit(1);
+      }
+      const seconds = timeoutSeconds ? Number(timeoutSeconds) : 120;
+      if (!Number.isFinite(seconds) || seconds < 1 || seconds > 300) {
+        console.error(`a check timeout must be 1-300 seconds: ${value}`);
+        process.exit(1);
+      }
+      return {
+        command,
+        purpose,
+        cwd: cwd || ".",
+        timeoutMs: Math.round(seconds * 1e3)
+      };
+    });
+    const writablePaths = collectFlagValues(process.argv, "writable");
+    const client = createClient2();
+    try {
+      const response = await client.verifications(args2.id).create({
+        recipientAgentId: args2.agent,
+        snapshotId: args2.snapshot,
+        checks,
+        summary: args2.summary ?? null,
+        ...writablePaths.length > 0 ? { writablePaths } : {}
+      });
+      if ("blocked" in response) {
+        console.error(`blocked (${response.blocked.reason}): ${response.blocked.detail}`);
+        process.exit(1);
+      }
+      if (args2.json) {
+        console.log(JSON.stringify(response.request, null, 2));
+        return;
+      }
+      console.log(
+        `captured ${response.request.request.id} (state ${response.request.request.state})`
+      );
+      console.log("the specialist is admitted by the verification scheduler; nothing has run yet");
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var listCmd11 = defineCommand31({
+  meta: { name: "list", description: "List verification requests for a Team" },
+  args: {
+    ...slug3,
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    const response = await client.verifications(args2.id).list();
+    if (args2.json) {
+      console.log(JSON.stringify(response, null, 2));
+      return;
+    }
+    if (response.requests.length === 0) {
+      console.log("no verification requests");
+      return;
+    }
+    const rows = [
+      ["ID", "STATE", "SPECIALIST", "CHANGE"],
+      ...response.requests.map((entry3) => [
+        entry3.request.id,
+        entry3.request.state,
+        entry3.request.recipientAgentId,
+        entry3.request.snapshot.id.slice(0, 12)
+      ])
+    ];
+    for (const line of columnize(rows)) console.log(line);
+    console.log("run `bazilion team verify show <slug> <id>` for a request's current applicability");
+  }
+});
+var showCmd7 = defineCommand31({
+  meta: { name: "show", description: "Show one verification request and its evidence" },
+  args: {
+    ...slug3,
+    requestId: { type: "positional", required: true, description: "Verification request id" },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    try {
+      const response = await client.verifications(args2.id).show(args2.requestId);
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      printReport2(response.request);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var cancelCmd2 = defineCommand31({
+  meta: { name: "cancel", description: "Cancel a pending or running verification request" },
+  args: {
+    ...slug3,
+    requestId: { type: "positional", required: true, description: "Verification request id" },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    try {
+      const response = await client.verifications(args2.id).cancel(args2.requestId);
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      console.log(`cancelled or cancelled-pending: ${response.request.request.id}`);
+      printReport2(response.request);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var verifyCommand = defineCommand31({
+  meta: {
+    name: "verify",
+    description: "Specialist verification of a captured code change (BAZ-044)"
+  },
+  subCommands: {
+    create: createCmd4,
+    list: listCmd11,
+    show: showCmd7,
+    cancel: cancelCmd2
   }
 });
 
 // src/commands/team.ts
-var addCmd2 = defineCommand30({
+var addCmd2 = defineCommand32({
   meta: {
     name: "add",
     description: "Register a team at ~/.bazilion/teams/<slug>/ (use --link to point at an existing tree)"
@@ -6378,7 +7157,7 @@ var addCmd2 = defineCommand30({
     console.log(`registered team ${g.id} at ${g.path}`);
   }
 });
-var listCmd10 = defineCommand30({
+var listCmd12 = defineCommand32({
   meta: { name: "list", description: "List teams" },
   async run() {
     const client = createClient2();
@@ -6391,7 +7170,7 @@ var listCmd10 = defineCommand30({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var rmCmd5 = defineCommand30({
+var rmCmd5 = defineCommand32({
   meta: { name: "rm", description: "Remove a team registration" },
   args: {
     id: { type: "positional", required: true }
@@ -6412,7 +7191,7 @@ async function readStdin() {
   for await (const chunk of stdin2) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8");
 }
-var userMdShowCmd = defineCommand30({
+var userMdShowCmd = defineCommand32({
   meta: { name: "show", description: "Print the team's USER.md" },
   args: { id: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -6422,7 +7201,7 @@ var userMdShowCmd = defineCommand30({
     if (g.userMd && !g.userMd.endsWith("\n")) process.stdout.write("\n");
   }
 });
-var userMdSetCmd = defineCommand30({
+var userMdSetCmd = defineCommand32({
   meta: {
     name: "set",
     description: "Replace the team's USER.md (from --file, --from-stdin, or inline text)"
@@ -6448,7 +7227,7 @@ var userMdSetCmd = defineCommand30({
     console.log(`updated USER.md for team ${args2.id} (${content.length} bytes)`);
   }
 });
-var userMdClearCmd = defineCommand30({
+var userMdClearCmd = defineCommand32({
   meta: { name: "clear", description: "Clear the team's USER.md to empty" },
   args: { id: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -6458,7 +7237,7 @@ var userMdClearCmd = defineCommand30({
     console.log(`cleared USER.md for team ${args2.id}`);
   }
 });
-var userMdCmd = defineCommand30({
+var userMdCmd = defineCommand32({
   meta: { name: "user-md", description: "View or edit a team's USER.md" },
   subCommands: {
     show: userMdShowCmd,
@@ -6466,7 +7245,7 @@ var userMdCmd = defineCommand30({
     clear: userMdClearCmd
   }
 });
-var topicFormatShowCmd = defineCommand30({
+var topicFormatShowCmd = defineCommand32({
   meta: { name: "show", description: "Print the team's Telegram topic-name template" },
   args: { id: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -6475,7 +7254,7 @@ var topicFormatShowCmd = defineCommand30({
     console.log(g.telegramTopicNameFormat ?? "(default naming)");
   }
 });
-var topicFormatSetCmd = defineCommand30({
+var topicFormatSetCmd = defineCommand32({
   meta: {
     name: "set",
     description: "Set the topic-name template. Tokens: {agent.name} {team.name} {team.slug} (must include {agent.name})"
@@ -6495,7 +7274,7 @@ var topicFormatSetCmd = defineCommand30({
     console.log(`set topic-name template for team ${args2.id}: ${g.telegramTopicNameFormat}`);
   }
 });
-var topicFormatClearCmd = defineCommand30({
+var topicFormatClearCmd = defineCommand32({
   meta: { name: "clear", description: "Clear the template (revert to built-in naming)" },
   args: { id: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -6505,7 +7284,7 @@ var topicFormatClearCmd = defineCommand30({
     console.log(`cleared topic-name template for team ${args2.id}`);
   }
 });
-var topicFormatCmd = defineCommand30({
+var topicFormatCmd = defineCommand32({
   meta: {
     name: "topic-format",
     description: "View or edit a team's Telegram forum-topic name template"
@@ -6516,7 +7295,7 @@ var topicFormatCmd = defineCommand30({
     clear: topicFormatClearCmd
   }
 });
-var contextCmd = defineCommand30({
+var contextCmd = defineCommand32({
   meta: {
     name: "context",
     description: "Inspect repository instructions, Git state and command suggestions"
@@ -6563,15 +7342,16 @@ var contextCmd = defineCommand30({
       console.log(`  ${issue.code}${issue.path ? `: ${safe2(issue.path)}` : ""} \u2014 ${issue.message}`);
   }
 });
-var teamCommand = defineCommand30({
+var teamCommand = defineCommand32({
   meta: { name: "team", description: "Manage teams (collaboration contexts)" },
   subCommands: {
     environment: teamEnvironmentCommand,
     log: teamCodingLogCommand,
     review: teamReviewCommand,
+    verify: verifyCommand,
     context: contextCmd,
     add: addCmd2,
-    list: listCmd10,
+    list: listCmd12,
     rm: rmCmd5,
     "user-md": userMdCmd,
     "topic-format": topicFormatCmd,
@@ -6581,7 +7361,7 @@ var teamCommand = defineCommand30({
 
 // src/commands/team-template.ts
 import { readFileSync as readFileSync12 } from "fs";
-import { defineCommand as defineCommand31 } from "citty";
+import { defineCommand as defineCommand33 } from "citty";
 function jsonFile(path) {
   try {
     return JSON.parse(readFileSync12(path, "utf8"));
@@ -6609,7 +7389,7 @@ function printTeam(detail) {
       console.log(line);
   }
 }
-var list7 = defineCommand31({
+var list7 = defineCommand33({
   meta: { name: "list", description: "List canonical Team templates" },
   args: { json: { type: "boolean", description: "Emit stable JSON" } },
   async run({ args: args2 }) {
@@ -6623,7 +7403,7 @@ var list7 = defineCommand31({
       console.log(line);
   }
 });
-var show6 = defineCommand31({
+var show6 = defineCommand33({
   meta: { name: "show", description: "Show a canonical Team template" },
   args: {
     id: { type: "positional", required: true },
@@ -6637,7 +7417,7 @@ var show6 = defineCommand31({
     else printTeam(detail);
   }
 });
-var exportCommand2 = defineCommand31({
+var exportCommand2 = defineCommand33({
   meta: {
     name: "export",
     description: "Export a portable versioned Team-template document to stdout"
@@ -6677,7 +7457,7 @@ function printImportDiff(current, document) {
   for (const value of diff2.added) console.log(`  + ${value}`);
   for (const value of diff2.removed) console.log(`  - ${value}`);
 }
-var importCommand2 = defineCommand31({
+var importCommand2 = defineCommand33({
   meta: {
     name: "import",
     description: "Validate, diff, and explicitly apply a portable Team-template document"
@@ -6758,7 +7538,7 @@ var importCommand2 = defineCommand31({
     );
   }
 });
-var teamTemplateCommand = defineCommand31({
+var teamTemplateCommand = defineCommand33({
   meta: {
     name: "team-template",
     description: "Inspect and exchange canonical Team templates"
@@ -6767,8 +7547,8 @@ var teamTemplateCommand = defineCommand31({
 });
 
 // src/commands/telegram.ts
-import { defineCommand as defineCommand32 } from "citty";
-var setCmd2 = defineCommand32({
+import { defineCommand as defineCommand34 } from "citty";
+var setCmd2 = defineCommand34({
   meta: {
     name: "set",
     description: "Save bot token + supergroup chat ID (paired write)"
@@ -6786,7 +7566,7 @@ var setCmd2 = defineCommand32({
     console.log(`saved \xB7 token ${state.botTokenPreview} \xB7 chat ${state.chatId}`);
   }
 });
-var clearCmd = defineCommand32({
+var clearCmd = defineCommand34({
   meta: {
     name: "clear",
     description: "Remove stored bot token + chat ID"
@@ -6797,7 +7577,7 @@ var clearCmd = defineCommand32({
     console.log("cleared");
   }
 });
-var showCmd6 = defineCommand32({
+var showCmd8 = defineCommand34({
   meta: {
     name: "show",
     description: "Show what credentials are stored (token is masked)"
@@ -6818,7 +7598,7 @@ var showCmd6 = defineCommand32({
     }
   }
 });
-var reconnectCmd = defineCommand32({
+var reconnectCmd = defineCommand34({
   meta: {
     name: "reconnect",
     description: "Apply a pending supergroup chat-id migration + re-activate the bot"
@@ -6829,7 +7609,7 @@ var reconnectCmd = defineCommand32({
     console.log(`reconnected \xB7 chat ${state.chatId}`);
   }
 });
-var configCmd = defineCommand32({
+var configCmd = defineCommand34({
   meta: {
     name: "config",
     description: "Manage Telegram credentials (bot token + chat ID)"
@@ -6837,10 +7617,10 @@ var configCmd = defineCommand32({
   subCommands: {
     set: setCmd2,
     clear: clearCmd,
-    show: showCmd6
+    show: showCmd8
   }
 });
-var healthCmd = defineCommand32({
+var healthCmd = defineCommand34({
   meta: {
     name: "health",
     description: "Run the four-step preflight against the Telegram Bot API"
@@ -6879,7 +7659,7 @@ var healthCmd = defineCommand32({
     if (!allOk) process.exitCode = 1;
   }
 });
-var botStatusCmd = defineCommand32({
+var botStatusCmd = defineCommand34({
   meta: {
     name: "status",
     description: "Show polling state of the live bot"
@@ -6904,7 +7684,7 @@ var botStatusCmd = defineCommand32({
     if (!p.running) process.exitCode = 1;
   }
 });
-var botRestartCmd = defineCommand32({
+var botRestartCmd = defineCommand34({
   meta: {
     name: "restart",
     description: "Force-restart the bot (tears down + brings up from current creds)"
@@ -6915,7 +7695,7 @@ var botRestartCmd = defineCommand32({
     console.log("restart requested");
   }
 });
-var botCmd = defineCommand32({
+var botCmd = defineCommand34({
   meta: {
     name: "bot",
     description: "Inspect / control the live polling bot"
@@ -6925,7 +7705,7 @@ var botCmd = defineCommand32({
     restart: botRestartCmd
   }
 });
-var bindCmd = defineCommand32({
+var bindCmd = defineCommand34({
   meta: {
     name: "bind",
     description: "Create a Telegram topic for an agent (manual fallback for /talk)"
@@ -6943,7 +7723,7 @@ var bindCmd = defineCommand32({
     console.log(`  ${result.deepLink}`);
   }
 });
-var unbindCmd = defineCommand32({
+var unbindCmd = defineCommand34({
   meta: {
     name: "unbind",
     description: "Clear an agent's Telegram topic binding (topic stays in Telegram as orphan)"
@@ -6957,7 +7737,7 @@ var unbindCmd = defineCommand32({
     console.log(`unbound agent ${args2.agent}`);
   }
 });
-var listBindingsCmd = defineCommand32({
+var listBindingsCmd = defineCommand34({
   meta: {
     name: "list",
     description: "List agents and their Telegram topic bindings"
@@ -6985,7 +7765,7 @@ var listBindingsCmd = defineCommand32({
     }
   }
 });
-var allowCmd = defineCommand32({
+var allowCmd = defineCommand34({
   meta: { name: "allow", description: "Add a Telegram user id to the allowlist" },
   args: {
     userId: { type: "positional", required: true, description: "Numeric Telegram user id" },
@@ -7001,7 +7781,7 @@ var allowCmd = defineCommand32({
     console.log(`allowed ${u.userId} (${u.role})`);
   }
 });
-var denyCmd = defineCommand32({
+var denyCmd = defineCommand34({
   meta: { name: "deny", description: "Remove a Telegram user id from the allowlist" },
   args: { userId: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -7010,7 +7790,7 @@ var denyCmd = defineCommand32({
     console.log(`removed ${args2.userId}`);
   }
 });
-var allowedCmd = defineCommand32({
+var allowedCmd = defineCommand34({
   meta: { name: "allowed", description: "List allowlisted Telegram users" },
   async run() {
     const client = createClient2();
@@ -7025,7 +7805,7 @@ var allowedCmd = defineCommand32({
     }
   }
 });
-var pairingCreateCmd = defineCommand32({
+var pairingCreateCmd = defineCommand34({
   meta: { name: "create", description: "Generate a one-time Telegram owner pairing code" },
   async run() {
     const result = await createClient2().post(
@@ -7036,7 +7816,7 @@ var pairingCreateCmd = defineCommand32({
     console.log("send `/pair <code>` in the configured \u2699 bazilion service topic");
   }
 });
-var pairingStatusCmd = defineCommand32({
+var pairingStatusCmd = defineCommand34({
   meta: { name: "status", description: "Show Telegram owner pairing status" },
   async run() {
     const result = await createClient2().get("/api/config/telegram/pairing");
@@ -7047,14 +7827,14 @@ var pairingStatusCmd = defineCommand32({
       console.log(`expires: ${new Date(result.challengeExpiresAt).toISOString()}`);
   }
 });
-var pairingCancelCmd = defineCommand32({
+var pairingCancelCmd = defineCommand34({
   meta: { name: "cancel", description: "Cancel the active Telegram pairing code" },
   async run() {
     await createClient2().del("/api/config/telegram/pairing/challenge");
     console.log("pairing challenge cancelled");
   }
 });
-var pairingResetCmd = defineCommand32({
+var pairingResetCmd = defineCommand34({
   meta: { name: "reset", description: "Revoke the Telegram owner and require re-pairing" },
   args: {
     yes: { type: "boolean", description: "Confirm destructive owner reset", required: true }
@@ -7065,7 +7845,7 @@ var pairingResetCmd = defineCommand32({
     console.log("Telegram owner reset; ingress is closed until re-paired");
   }
 });
-var pairingCmd = defineCommand32({
+var pairingCmd = defineCommand34({
   meta: { name: "pairing", description: "Manage single-owner Telegram pairing" },
   subCommands: {
     create: pairingCreateCmd,
@@ -7074,7 +7854,7 @@ var pairingCmd = defineCommand32({
     reset: pairingResetCmd
   }
 });
-var telegramCommand = defineCommand32({
+var telegramCommand = defineCommand34({
   meta: {
     name: "telegram",
     description: "Telegram integration: credentials, health, bot lifecycle, bindings, access"
@@ -7095,7 +7875,7 @@ var telegramCommand = defineCommand32({
 });
 
 // src/commands/token.ts
-import { defineCommand as defineCommand33 } from "citty";
+import { defineCommand as defineCommand35 } from "citty";
 import qrcode from "qrcode-terminal";
 function tokenRow(t) {
   const last = t.lastUsedAt ? new Date(t.lastUsedAt).toISOString() : "(never)";
@@ -7124,7 +7904,7 @@ function resolveQrServer(override) {
   }
   return url.origin;
 }
-var createCmd3 = defineCommand33({
+var createCmd5 = defineCommand35({
   meta: { name: "create", description: "Mint a new web token (shown once)" },
   args: {
     label: { type: "positional", required: true, description: "Human-readable label" },
@@ -7167,7 +7947,7 @@ var createCmd3 = defineCommand33({
     qrcode.generate(pairUrl, { small: true }, (qr) => console.log(qr));
   }
 });
-var listCmd11 = defineCommand33({
+var listCmd13 = defineCommand35({
   meta: { name: "list", description: "List web tokens" },
   args: {
     all: { type: "boolean", description: "Include revoked tokens" }
@@ -7183,7 +7963,7 @@ var listCmd11 = defineCommand33({
     for (const line of columnize(tokens.map(tokenRow))) console.log(line);
   }
 });
-var showLocalCmd = defineCommand33({
+var showLocalCmd = defineCommand35({
   meta: {
     name: "show-local",
     description: "Print the bootstrap web token stored in ~/.bazilion/auth.json"
@@ -7193,7 +7973,7 @@ var showLocalCmd = defineCommand33({
     console.log(readAuthFile(paths.authFile).token);
   }
 });
-var revokeCmd2 = defineCommand33({
+var revokeCmd2 = defineCommand35({
   meta: { name: "revoke", description: "Revoke a web token" },
   args: {
     id: { type: "positional", required: true }
@@ -7204,19 +7984,19 @@ var revokeCmd2 = defineCommand33({
     console.log(`revoked token ${args2.id}`);
   }
 });
-var tokenCommand = defineCommand33({
+var tokenCommand = defineCommand35({
   meta: { name: "token", description: "Manage web tokens for API/CLI clients" },
   subCommands: {
-    create: createCmd3,
-    list: listCmd11,
+    create: createCmd5,
+    list: listCmd13,
     revoke: revokeCmd2,
     "show-local": showLocalCmd
   }
 });
 
 // src/commands/trigger.ts
-import { defineCommand as defineCommand34 } from "citty";
-var addCmd3 = defineCommand34({
+import { defineCommand as defineCommand36 } from "citty";
+var addCmd3 = defineCommand36({
   meta: { name: "add", description: "Add an interval / cron trigger to an agent" },
   args: {
     agent: { type: "positional", required: true },
@@ -7264,7 +8044,7 @@ function triggerRow(t) {
   const msgPreview = t.message.length > 60 ? `${t.message.slice(0, 60)}\u2026` : t.message;
   return [t.id, state, spec, `last: ${last}`, `"${msgPreview}"`];
 }
-var listCmd12 = defineCommand34({
+var listCmd14 = defineCommand36({
   meta: { name: "list", description: "List triggers for an agent" },
   args: {
     agent: { type: "positional", required: true }
@@ -7281,7 +8061,7 @@ var listCmd12 = defineCommand34({
     for (const line of columnize(triggers.map(triggerRow))) console.log(line);
   }
 });
-var rmCmd6 = defineCommand34({
+var rmCmd6 = defineCommand36({
   meta: { name: "rm", description: "Delete a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -7292,7 +8072,7 @@ var rmCmd6 = defineCommand34({
     console.log(`removed trigger ${args2.id}`);
   }
 });
-var enableCmd3 = defineCommand34({
+var enableCmd3 = defineCommand36({
   meta: { name: "enable", description: "Enable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -7304,7 +8084,7 @@ var enableCmd3 = defineCommand34({
     console.log(`enabled trigger ${args2.id}`);
   }
 });
-var disableCmd3 = defineCommand34({
+var disableCmd3 = defineCommand36({
   meta: { name: "disable", description: "Disable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -7316,7 +8096,7 @@ var disableCmd3 = defineCommand34({
     console.log(`disabled trigger ${args2.id}`);
   }
 });
-var historyCmd = defineCommand34({
+var historyCmd = defineCommand36({
   meta: { name: "history", description: "Show recent dispatches for a trigger" },
   args: {
     id: { type: "positional", required: true },
@@ -7344,11 +8124,11 @@ var historyCmd = defineCommand34({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var triggerCommand = defineCommand34({
+var triggerCommand = defineCommand36({
   meta: { name: "trigger", description: "Manage scheduled agent triggers" },
   subCommands: {
     add: addCmd3,
-    list: listCmd12,
+    list: listCmd14,
     rm: rmCmd6,
     enable: enableCmd3,
     disable: disableCmd3,
@@ -7360,7 +8140,7 @@ var triggerCommand = defineCommand34({
 import { existsSync as existsSync7, lstatSync as lstatSync4, readdirSync as readdirSync2, realpathSync as realpathSync2, rmSync as rmSync4 } from "fs";
 import { homedir as homedir2 } from "os";
 import { isAbsolute as isAbsolute2, join as join6, parse as parse2, relative as relative2, resolve as resolve5, sep } from "path";
-import { defineCommand as defineCommand35 } from "citty";
+import { defineCommand as defineCommand37 } from "citty";
 function makeLineReader() {
   let buffer = "";
   let ended = false;
@@ -7447,7 +8227,7 @@ function assertSafeUninstallHome(home) {
   }
   return target;
 }
-var uninstallCommand = defineCommand35({
+var uninstallCommand = defineCommand37({
   meta: {
     name: "uninstall",
     description: "Wipe bazilion state from ~/.bazilion (or BAZILION_HOME)"
@@ -7551,7 +8331,7 @@ var uninstallCommand = defineCommand35({
 
 // src/index.ts
 var VERSION = package_default.version;
-var main = defineCommand36({
+var main = defineCommand38({
   meta: {
     name: "bazilion",
     version: VERSION,