bazilion 0.19.1 → 0.20.0

package/dist/daemon.js

@@ -271,12 +271,12 @@ var require_path_key = __commonJS({
   "../../node_modules/.pnpm/path-key@3.1.1/node_modules/path-key/index.js"(exports, module) {
     "use strict";
     var pathKey = (options = {}) => {
-      const environment = options.env || process.env;
+      const environment2 = options.env || process.env;
       const platform = options.platform || process.platform;
       if (platform !== "win32") {
         return "PATH";
       }
-      return Object.keys(environment).reverse().find((key3) => key3.toUpperCase() === "PATH") || "Path";
+      return Object.keys(environment2).reverse().find((key3) => key3.toUpperCase() === "PATH") || "Path";
     };
     module.exports = pathKey;
     module.exports.default = pathKey;
@@ -19276,14 +19276,14 @@ function remove(db, id) {
   db.raw.run("DELETE FROM agents WHERE id = ?", [id]);
 }
 function getTelegramTopicId(db, agentId) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT telegram_topic_id FROM agents WHERE id = ?"
   ).get(agentId);
-  return row?.telegram_topic_id ?? null;
+  return row2?.telegram_topic_id ?? null;
 }
 function findByTelegramTopicId(db, topicId) {
-  const row = db.raw.query("SELECT * FROM agents WHERE telegram_topic_id = ?").get(topicId);
-  return row ? toAgent(row) : null;
+  const row2 = db.raw.query("SELECT * FROM agents WHERE telegram_topic_id = ?").get(topicId);
+  return row2 ? toAgent(row2) : null;
 }
 function setTelegramTopicId(db, agentId, topicId) {
   db.raw.run(
@@ -19303,10 +19303,10 @@ function findByName(db, name) {
   ).all(name).map(toAgent);
 }
 function findByNameInGroup(db, teamId, name) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT * FROM agents WHERE team_id = ? AND name = ? AND status != 'archived' LIMIT 1"
   ).get(teamId, name);
-  return row ? toAgent(row) : null;
+  return row2 ? toAgent(row2) : null;
 }
 function listBoundUnlockedTopicsInGroup(db, teamId) {
   return db.raw.query(
@@ -19376,25 +19376,25 @@ __export(teamPolicies_exports, {
   replacePolicy: () => replacePolicy
 });
 function get2(db, teamId) {
-  const row = db.raw.query("SELECT * FROM team_policies WHERE team_id = ?").get(teamId);
-  return row ? {
-    teamId: row.team_id,
-    revision: row.revision,
-    baselineInstantiationId: row.baseline_instantiation_id,
-    updatedAt: row.updated_at
+  const row2 = db.raw.query("SELECT * FROM team_policies WHERE team_id = ?").get(teamId);
+  return row2 ? {
+    teamId: row2.team_id,
+    revision: row2.revision,
+    baselineInstantiationId: row2.baseline_instantiation_id,
+    updatedAt: row2.updated_at
   } : null;
 }
 function edges(db, teamId) {
   return db.raw.query(
     `SELECT * FROM team_policy_edges WHERE team_id = ?
        ORDER BY source_kind, source_id, target_kind, target_id`
-  ).all(teamId).map((row) => ({
-    teamId: row.team_id,
-    sourceKind: row.source_kind,
-    sourceId: row.source_id || null,
-    targetKind: row.target_kind,
-    targetId: row.target_id || null,
-    posture: row.posture
+  ).all(teamId).map((row2) => ({
+    teamId: row2.team_id,
+    sourceKind: row2.source_kind,
+    sourceId: row2.source_id || null,
+    targetKind: row2.target_kind,
+    targetId: row2.target_id || null,
+    posture: row2.posture
   }));
 }
 function detail(db, teamId) {
@@ -19464,7 +19464,7 @@ function placementEdgesPreview(db, teamId, agentId, placement, profileId) {
   };
   const peers = db.raw.query(
     "SELECT id FROM agents WHERE team_id = ? AND id <> ? ORDER BY id"
-  ).all(teamId, agentId).map((row) => row.id);
+  ).all(teamId, agentId).map((row2) => row2.id);
   const defaults = db.raw.query("SELECT * FROM profile_communication_defaults WHERE profile_id = ?").get(profileId);
   if (!defaults) return [];
   if (defaults.user_input) add2("user", null, "agent", agentId);
@@ -19492,12 +19492,12 @@ function instantiations(db, teamId) {
   return db.raw.query(
     `SELECT * FROM template_instantiations WHERE team_id = ?
        ORDER BY created_at ASC, id ASC`
-  ).all(teamId).map((row) => ({
-    id: row.id,
-    teamId: row.team_id,
-    templateId: row.template_id,
-    templateRevision: row.template_revision,
-    createdAt: row.created_at
+  ).all(teamId).map((row2) => ({
+    id: row2.id,
+    teamId: row2.team_id,
+    templateId: row2.template_id,
+    templateRevision: row2.template_revision,
+    createdAt: row2.created_at
   }));
 }
 function bindings(db, teamId) {
@@ -19505,18 +19505,18 @@ function bindings(db, teamId) {
     `SELECT b.* FROM source_slot_bindings b
        JOIN template_instantiations i ON i.id = b.instantiation_id
        WHERE i.team_id = ? ORDER BY b.agent_id ASC`
-  ).all(teamId).map((row) => ({
-    agentId: row.agent_id,
-    instantiationId: row.instantiation_id,
-    sourceSlotId: row.source_slot_id
+  ).all(teamId).map((row2) => ({
+    agentId: row2.agent_id,
+    instantiationId: row2.instantiation_id,
+    sourceSlotId: row2.source_slot_id
   }));
 }
 function agentState(db, teamId) {
-  return db.raw.query("SELECT * FROM team_agent_state WHERE team_id = ? ORDER BY agent_id ASC").all(teamId).map((row) => ({
-    agentId: row.agent_id,
-    teamId: row.team_id,
-    position: row.position_x === null || row.position_y === null ? null : { x: row.position_x, y: row.position_y },
-    display: row.display_json ? JSON.parse(row.display_json) : null
+  return db.raw.query("SELECT * FROM team_agent_state WHERE team_id = ? ORDER BY agent_id ASC").all(teamId).map((row2) => ({
+    agentId: row2.agent_id,
+    teamId: row2.team_id,
+    position: row2.position_x === null || row2.position_y === null ? null : { x: row2.position_x, y: row2.position_y },
+    display: row2.display_json ? JSON.parse(row2.display_json) : null
   }));
 }
 function requireTeamPolicy(db, teamId) {
@@ -19536,7 +19536,7 @@ function requireRevision(teamPolicy, expected) {
 }
 function validateEdges(db, teamId, policyEdges) {
   const members2 = new Set(
-    db.raw.query("SELECT id FROM agents WHERE team_id = ?").all(teamId).map((row) => row.id)
+    db.raw.query("SELECT id FROM agents WHERE team_id = ?").all(teamId).map((row2) => row2.id)
   );
   const keys2 = /* @__PURE__ */ new Set();
   for (const edge of policyEdges) {
@@ -19835,8 +19835,8 @@ function insert2(db, g2, paths2) {
   };
 }
 function get3(db, id, paths2) {
-  const row = db.raw.query("SELECT * FROM teams WHERE id = ?").get(id);
-  return row ? toTeam(row, paths2) : null;
+  const row2 = db.raw.query("SELECT * FROM teams WHERE id = ?").get(id);
+  return row2 ? toTeam(row2, paths2) : null;
 }
 function list2(db, paths2) {
   return db.raw.query("SELECT * FROM teams ORDER BY created_at ASC").all().map((r) => toTeam(r, paths2));
@@ -19851,10 +19851,10 @@ function setTelegramTopicNameFormat(db, id, format) {
   db.raw.run("UPDATE teams SET telegram_topic_name_format = ? WHERE id = ?", [format, id]);
 }
 function getTelegramIconColor(db, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT telegram_icon_color FROM teams WHERE id = ?"
   ).get(id);
-  return row?.telegram_icon_color ?? null;
+  return row2?.telegram_icon_color ?? null;
 }
 function setTelegramIconColor(db, id, color) {
   db.raw.run("UPDATE teams SET telegram_icon_color = ? WHERE id = ?", [color, id]);
@@ -20060,21 +20060,21 @@ __export(agentLessonProposals_exports, {
   updatePending: () => updatePending
 });
 import { randomUUID as randomUUID2 } from "crypto";
-function toProposal(row) {
+function toProposal(row2) {
   return {
-    id: row.id,
-    reviewId: row.review_id,
-    agentId: row.agent_id,
-    scope: row.scope,
-    text: row.text,
-    evidence: JSON.parse(row.evidence_json),
-    status: row.status,
-    version: row.version,
-    decidedAt: row.decided_at,
-    revokedAt: row.revoked_at,
-    appliedKey: row.applied_key,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
+    id: row2.id,
+    reviewId: row2.review_id,
+    agentId: row2.agent_id,
+    scope: row2.scope,
+    text: row2.text,
+    evidence: JSON.parse(row2.evidence_json),
+    status: row2.status,
+    version: row2.version,
+    decidedAt: row2.decided_at,
+    revokedAt: row2.revoked_at,
+    appliedKey: row2.applied_key,
+    createdAt: row2.created_at,
+    updatedAt: row2.updated_at
   };
 }
 function insert3(db, input) {
@@ -20100,8 +20100,8 @@ function insert3(db, input) {
   return proposal;
 }
 function get4(db, id) {
-  const row = db.raw.query("SELECT * FROM agent_lesson_proposals WHERE id = ?").get(id);
-  return row ? toProposal(row) : null;
+  const row2 = db.raw.query("SELECT * FROM agent_lesson_proposals WHERE id = ?").get(id);
+  return row2 ? toProposal(row2) : null;
 }
 function listForReview(db, reviewId) {
   return db.raw.query(
@@ -20190,8 +20190,8 @@ function insert4(db, p) {
   return { ...p, createdAt: now, updatedAt: now };
 }
 function get5(db, id) {
-  const row = db.raw.query("SELECT * FROM profiles WHERE id = ?").get(id);
-  return row ? toProfile(row) : null;
+  const row2 = db.raw.query("SELECT * FROM profiles WHERE id = ?").get(id);
+  return row2 ? toProfile(row2) : null;
 }
 function list3(db) {
   return db.raw.query("SELECT * FROM profiles ORDER BY created_at ASC").all().map(toProfile);
@@ -20263,16 +20263,16 @@ __export(profileCommunicationDefaults_exports, {
   set: () => set
 });
 function get6(db, profileId) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT user_input, user_output, outside_team_input, outside_team_output, peer_default
        FROM profile_communication_defaults WHERE profile_id = ?`
   ).get(profileId);
-  return row ? {
-    userInput: row.user_input === 1,
-    userOutput: row.user_output === 1,
-    outsideTeamInput: row.outside_team_input === 1,
-    outsideTeamOutput: row.outside_team_output === 1,
-    peerDefault: row.peer_default
+  return row2 ? {
+    userInput: row2.user_input === 1,
+    userOutput: row2.user_output === 1,
+    outsideTeamInput: row2.outside_team_input === 1,
+    outsideTeamOutput: row2.outside_team_output === 1,
+    peerDefault: row2.peer_default
   } : null;
 }
 function set(db, profileId, value) {
@@ -20351,10 +20351,10 @@ function list4(db, provider) {
 }
 function listAll(db) {
   const out = {};
-  for (const row of db.raw.query("SELECT * FROM provider_models ORDER BY provider ASC, added_at ASC").all()) {
-    const bucket = out[row.provider] ?? [];
-    bucket.push(row.model);
-    out[row.provider] = bucket;
+  for (const row2 of db.raw.query("SELECT * FROM provider_models ORDER BY provider ASC, added_at ASC").all()) {
+    const bucket = out[row2.provider] ?? [];
+    bucket.push(row2.model);
+    out[row2.provider] = bucket;
   }
   return out;
 }
@@ -20385,8 +20385,8 @@ __export(providerState_exports, {
   setEnabled: () => setEnabled
 });
 function isEnabled(db, providerId) {
-  const row = db.raw.query("SELECT * FROM provider_state WHERE provider_id = ?").get(providerId);
-  return row?.enabled === 1;
+  const row2 = db.raw.query("SELECT * FROM provider_state WHERE provider_id = ?").get(providerId);
+  return row2?.enabled === 1;
 }
 function setEnabled(db, providerId, enabled) {
   db.raw.run(
@@ -20797,8 +20797,8 @@ var sources = [
     )
   }
 ];
-function normalize(row) {
-  const { acknowledged_at, ...item } = row;
+function normalize(row2) {
+  const { acknowledged_at, ...item } = row2;
   return { ...item, key: `${item.kind}:${item.sourceId}`, acknowledgedAt: acknowledged_at };
 }
 function parseAttentionKey(key3) {
@@ -21022,7 +21022,7 @@ function schemaObjects(db) {
   ).all();
 }
 function schemaPayload(rows) {
-  return rows.map((row) => [row.type, row.name, row.tbl_name, normalizeSql(row.sql)].join("\0")).join("\n");
+  return rows.map((row2) => [row2.type, row2.name, row2.tbl_name, normalizeSql(row2.sql)].join("\0")).join("\n");
 }
 function expectedSchema(files) {
   if (canonicalSchemaObjects !== null) return canonicalSchemaObjects;
@@ -21041,7 +21041,7 @@ function assertMigrationCompatibility(db) {
   const expectedVersions = files.map((file) => file.version);
   let appliedVersions;
   try {
-    appliedVersions = db.raw.query("SELECT version FROM schema_migrations ORDER BY version").all().map((row) => row.version);
+    appliedVersions = db.raw.query("SELECT version FROM schema_migrations ORDER BY version").all().map((row2) => row2.version);
   } catch {
     throw new IncompatibleDatabaseError();
   }
@@ -21049,10 +21049,10 @@ function assertMigrationCompatibility(db) {
   const expectedObjects = expectedSchema(files);
   if (appliedVersions.length === 0) {
     const migrationTable = actualObjects.filter(
-      (row) => row.type === "table" && row.name === "schema_migrations"
+      (row2) => row2.type === "table" && row2.name === "schema_migrations"
     );
     const expectedMigrationTable = expectedObjects.filter(
-      (row) => row.type === "table" && row.name === "schema_migrations"
+      (row2) => row2.type === "table" && row2.name === "schema_migrations"
     );
     if (actualObjects.length !== 1 || migrationTable.length !== 1 || schemaPayload(migrationTable) !== schemaPayload(expectedMigrationTable)) {
       throw new IncompatibleDatabaseError();
@@ -21065,7 +21065,7 @@ function assertMigrationCompatibility(db) {
 }
 function runMigrations(db) {
   const existingObjects = schemaObjects(db);
-  if (existingObjects.length > 0 && !existingObjects.some((row) => row.type === "table" && row.name === "schema_migrations")) {
+  if (existingObjects.length > 0 && !existingObjects.some((row2) => row2.type === "table" && row2.name === "schema_migrations")) {
     throw new IncompatibleDatabaseError();
   }
   db.raw.exec(schemaMigrationsSql);
@@ -21138,44 +21138,44 @@ __export(teamTemplates_exports, {
   updateCanonicalMetadata: () => updateCanonicalMetadata
 });
 import { randomUUID as randomUUID4 } from "crypto";
-function toTemplate(row) {
+function toTemplate(row2) {
   return {
-    id: row.id,
-    name: row.name,
-    userMd: row.user_md,
-    currentRevision: row.current_revision,
-    deletedAt: row.deleted_at,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
+    id: row2.id,
+    name: row2.name,
+    userMd: row2.user_md,
+    currentRevision: row2.current_revision,
+    deletedAt: row2.deleted_at,
+    createdAt: row2.created_at,
+    updatedAt: row2.updated_at
   };
 }
-function toSlot(row) {
+function toSlot(row2) {
   return {
-    templateId: row.template_id,
-    slotId: row.slot_id,
-    position: row.position,
-    profileId: row.profile_id,
-    agentName: row.agent_name,
-    modelOverride: row.model_override,
-    reasoningLevel: row.reasoning_level,
-    layoutPosition: row.position_x === null || row.position_y === null ? null : { x: row.position_x, y: row.position_y },
-    display: row.display_json ? JSON.parse(row.display_json) : null,
-    tombstonedAt: row.tombstoned_at
-  };
-}
-function toEdge(row) {
+    templateId: row2.template_id,
+    slotId: row2.slot_id,
+    position: row2.position,
+    profileId: row2.profile_id,
+    agentName: row2.agent_name,
+    modelOverride: row2.model_override,
+    reasoningLevel: row2.reasoning_level,
+    layoutPosition: row2.position_x === null || row2.position_y === null ? null : { x: row2.position_x, y: row2.position_y },
+    display: row2.display_json ? JSON.parse(row2.display_json) : null,
+    tombstonedAt: row2.tombstoned_at
+  };
+}
+function toEdge(row2) {
   return {
-    templateId: row.template_id,
-    sourceKind: row.source_kind,
-    sourceId: row.source_id || null,
-    targetKind: row.target_kind,
-    targetId: row.target_id || null,
-    posture: row.posture
+    templateId: row2.template_id,
+    sourceKind: row2.source_kind,
+    sourceId: row2.source_id || null,
+    targetKind: row2.target_kind,
+    targetId: row2.target_id || null,
+    posture: row2.posture
   };
 }
 function get7(db, id) {
-  const row = db.raw.query("SELECT * FROM team_templates WHERE id = ?").get(id);
-  return row ? toTemplate(row) : null;
+  const row2 = db.raw.query("SELECT * FROM team_templates WHERE id = ?").get(id);
+  return row2 ? toTemplate(row2) : null;
 }
 function list5(db) {
   return db.raw.query("SELECT * FROM team_templates ORDER BY created_at ASC").all().map(toTemplate);
@@ -21658,26 +21658,26 @@ __export(agentReviews_exports, {
   setSource: () => setSource
 });
 import { randomUUID as randomUUID5 } from "crypto";
-function toReview(row) {
+function toReview(row2) {
   return {
-    id: row.id,
-    agentId: row.agent_id,
-    status: row.status,
-    trigger: row.trigger_kind,
-    sourceSessionId: row.source_session_id,
-    sourceStartOrdinal: row.source_start_ordinal,
-    sourceEndOrdinal: row.source_end_ordinal,
-    inputCharacters: row.input_characters,
-    turnsReviewed: row.turns_reviewed,
-    proposalCount: row.proposal_count,
-    attemptCount: row.attempt_count,
-    nextAttemptAt: row.next_attempt_at,
-    leaseExpiresAt: row.lease_expires_at,
-    startedAt: row.started_at,
-    finishedAt: row.finished_at,
-    lastError: row.last_error,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
+    id: row2.id,
+    agentId: row2.agent_id,
+    status: row2.status,
+    trigger: row2.trigger_kind,
+    sourceSessionId: row2.source_session_id,
+    sourceStartOrdinal: row2.source_start_ordinal,
+    sourceEndOrdinal: row2.source_end_ordinal,
+    inputCharacters: row2.input_characters,
+    turnsReviewed: row2.turns_reviewed,
+    proposalCount: row2.proposal_count,
+    attemptCount: row2.attempt_count,
+    nextAttemptAt: row2.next_attempt_at,
+    leaseExpiresAt: row2.lease_expires_at,
+    startedAt: row2.started_at,
+    finishedAt: row2.finished_at,
+    lastError: row2.last_error,
+    createdAt: row2.created_at,
+    updatedAt: row2.updated_at
   };
 }
 function insert5(db, agentId, trigger, now) {
@@ -21694,15 +21694,15 @@ function insert5(db, agentId, trigger, now) {
   return review;
 }
 function get8(db, id) {
-  const row = db.raw.query("SELECT * FROM agent_reviews WHERE id = ?").get(id);
-  return row ? toReview(row) : null;
+  const row2 = db.raw.query("SELECT * FROM agent_reviews WHERE id = ?").get(id);
+  return row2 ? toReview(row2) : null;
 }
 function getOpenForAgent(db, agentId) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT * FROM agent_reviews WHERE agent_id = ?
        AND status IN ('pending','running','retrying') LIMIT 1`
   ).get(agentId);
-  return row ? toReview(row) : null;
+  return row2 ? toReview(row2) : null;
 }
 function enqueueManual(db, agentId, now = Date.now()) {
   return db.raw.transaction(
@@ -21762,11 +21762,11 @@ function defer(db, id, nextAttemptAt = Date.now() + 1e3) {
   );
 }
 function getLatestCompleted(db, agentId) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT * FROM agent_reviews WHERE agent_id = ? AND status = 'completed'
        ORDER BY finished_at DESC LIMIT 1`
   ).get(agentId);
-  return row ? toReview(row) : null;
+  return row2 ? toReview(row2) : null;
 }
 function setSource(db, id, source) {
   db.raw.run(
@@ -21844,40 +21844,40 @@ function endpoint(kind, id, teamId) {
   if (kind === "agent") return { kind, id };
   return { kind, teamId: teamId ?? "__missing__" };
 }
-function toApproval(row) {
+function toApproval(row2) {
   return {
-    id: row.id,
-    attemptKind: row.attempt_kind,
-    attemptId: row.attempt_id,
-    operation: row.operation,
-    source: endpoint(row.source_kind, row.source_id, row.source_team_id),
-    target: endpoint(row.target_kind, row.target_id, row.target_team_id),
-    sourceTeamId: row.source_team_id,
-    targetTeamId: row.target_team_id,
-    channel: row.channel,
-    origin: row.origin,
-    requester: row.requester,
-    policyRefs: JSON.parse(row.policy_refs_json),
-    requiredEdgeIds: JSON.parse(row.required_edge_ids_json),
-    payloadKind: row.payload_kind,
-    status: row.status,
-    expiresAt: row.expires_at,
-    decidedAt: row.decided_at,
-    decidedBy: row.decided_by,
-    decisionReason: row.decision_reason,
-    deliveryError: row.delivery_error,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  };
-}
-function event(row) {
+    id: row2.id,
+    attemptKind: row2.attempt_kind,
+    attemptId: row2.attempt_id,
+    operation: row2.operation,
+    source: endpoint(row2.source_kind, row2.source_id, row2.source_team_id),
+    target: endpoint(row2.target_kind, row2.target_id, row2.target_team_id),
+    sourceTeamId: row2.source_team_id,
+    targetTeamId: row2.target_team_id,
+    channel: row2.channel,
+    origin: row2.origin,
+    requester: row2.requester,
+    policyRefs: JSON.parse(row2.policy_refs_json),
+    requiredEdgeIds: JSON.parse(row2.required_edge_ids_json),
+    payloadKind: row2.payload_kind,
+    status: row2.status,
+    expiresAt: row2.expires_at,
+    decidedAt: row2.decided_at,
+    decidedBy: row2.decided_by,
+    decisionReason: row2.decision_reason,
+    deliveryError: row2.delivery_error,
+    createdAt: row2.created_at,
+    updatedAt: row2.updated_at
+  };
+}
+function event(row2) {
   return {
-    id: row.id,
-    approvalId: row.approval_id,
-    event: row.event,
-    actor: row.actor,
-    detail: row.detail,
-    createdAt: row.created_at
+    id: row2.id,
+    approvalId: row2.approval_id,
+    event: row2.event,
+    actor: row2.actor,
+    detail: row2.detail,
+    createdAt: row2.created_at
   };
 }
 function raw(db, id) {
@@ -21971,16 +21971,16 @@ function request(db, input, operation, authorization, payloadKind, payload, opti
     return toApproval(raced);
   }
 }
-function expireOne(db, row, now) {
-  if (row.status !== "pending" || row.expires_at > now) return false;
+function expireOne(db, row2, now) {
+  if (row2.status !== "pending" || row2.expires_at > now) return false;
   const changed = db.raw.run(
     `UPDATE communication_approvals
      SET status = 'expired', decided_at = ?, decided_by = 'system',
          decision_reason = 'approval expired', updated_at = ?
      WHERE id = ? AND status = 'pending' AND expires_at <= ?`,
-    [now, now, row.id, now]
+    [now, now, row2.id, now]
   ).changes;
-  if (changed) appendEvent(db, row.id, "expired", "system", "approval expired", now);
+  if (changed) appendEvent(db, row2.id, "expired", "system", "approval expired", now);
   return changed > 0;
 }
 function expirePending(db, now = Date.now()) {
@@ -21988,29 +21988,29 @@ function expirePending(db, now = Date.now()) {
     const rows = db.raw.query(
       "SELECT * FROM communication_approvals WHERE status = 'pending' AND expires_at <= ?"
     ).all(now);
-    for (const row of rows) expireOne(db, row, now);
+    for (const row2 of rows) expireOne(db, row2, now);
     return rows.length;
   })();
 }
 function get9(db, id, includePayload = false) {
   expirePending(db);
-  const row = raw(db, id);
-  if (!row) return null;
-  const approval = toApproval(row);
+  const row2 = raw(db, id);
+  if (!row2) return null;
+  const approval = toApproval(row2);
   if (!includePayload) return approval;
-  return detailFromRow(db, row);
+  return detailFromRow(db, row2);
 }
 function getByAttempt(db, attemptKind, attemptId, includePayload = false) {
   expirePending(db);
-  const row = rawByAttempt(db, attemptKind, attemptId);
-  if (!row) return null;
-  return includePayload ? detailFromRow(db, row) : toApproval(row);
+  const row2 = rawByAttempt(db, attemptKind, attemptId);
+  if (!row2) return null;
+  return includePayload ? detailFromRow(db, row2) : toApproval(row2);
 }
-function detailFromRow(db, row) {
+function detailFromRow(db, row2) {
   const events = db.raw.query(
     "SELECT * FROM communication_approval_events WHERE approval_id = ? ORDER BY created_at, rowid"
-  ).all(row.id).map(event);
-  return { ...toApproval(row), payload: JSON.parse(row.payload_json), events };
+  ).all(row2.id).map(event);
+  return { ...toApproval(row2), payload: JSON.parse(row2.payload_json), events };
 }
 function list6(db, filters = {}) {
   expirePending(db);
@@ -22032,8 +22032,8 @@ function list6(db, filters = {}) {
 function decide(db, id, decision, actor, reason, now = Date.now()) {
   expirePending(db, now);
   return db.raw.transaction(() => {
-    const row = raw(db, id);
-    if (!row) throw new Error(`approval_not_found: ${id}`);
+    const row2 = raw(db, id);
+    if (!row2) throw new Error(`approval_not_found: ${id}`);
     const current = raw(db, id);
     if (current.status !== "pending")
       throw new Error(`approval_state_conflict: current ${current.status}`);
@@ -22773,6 +22773,42 @@ var SERVICES = [
         description: "Numeric id of the forum-enabled supergroup the bot is admin in."
       }
     ]
+  },
+  {
+    id: "publication",
+    displayName: "Code host publication",
+    category: "integration",
+    hint: "Where an accepted change is committed and opened as a pull request",
+    fields: [
+      {
+        envVar: "PUBLICATION_HOST",
+        kind: "config",
+        label: "Host",
+        placeholder: "github",
+        description: 'The only supported host today. "local" points at a bare repository path and opens no pull request.'
+      },
+      {
+        envVar: "PUBLICATION_REPOSITORY",
+        kind: "config",
+        label: "Repository",
+        placeholder: "owner/name",
+        description: "For github: owner/name. For local: an absolute path to a bare repository. The Team repository's own origin is never used."
+      },
+      {
+        envVar: "PUBLICATION_BASE_BRANCH",
+        kind: "config",
+        label: "Base branch",
+        placeholder: "main",
+        description: "The branch a publication is based on and its pull request targets."
+      },
+      {
+        envVar: "GITHUB_TOKEN",
+        kind: "secret",
+        label: "GitHub token",
+        placeholder: "ghp_...",
+        description: "Needs contents:write and pull_requests:write on that repository. Used only for one push and one pull request."
+      }
+    ]
   }
 ];
 var FIELD_INDEX = (() => {
@@ -22812,8 +22848,8 @@ function isConfigKey(key3) {
 function openConfig(db) {
   return {
     get(key3) {
-      const row = db.raw.query("SELECT * FROM config WHERE key = ?").get(key3);
-      return row?.value;
+      const row2 = db.raw.query("SELECT * FROM config WHERE key = ?").get(key3);
+      return row2?.value;
     },
     set(key3, value) {
       if (!isConfigKey(key3)) {
@@ -22895,17 +22931,17 @@ function insert6(db, input) {
       now
     ]
   );
-  const row = get10(db, id);
-  if (!row) throw new Error("mcp server insert failed");
-  return row;
+  const row2 = get10(db, id);
+  if (!row2) throw new Error("mcp server insert failed");
+  return row2;
 }
 function get10(db, id) {
-  const row = db.raw.query("SELECT * FROM mcp_servers WHERE id = ?").get(id);
-  return row ? toServer(row) : null;
+  const row2 = db.raw.query("SELECT * FROM mcp_servers WHERE id = ?").get(id);
+  return row2 ? toServer(row2) : null;
 }
 function getByName(db, name) {
-  const row = db.raw.query("SELECT * FROM mcp_servers WHERE name = ?").get(name);
-  return row ? toServer(row) : null;
+  const row2 = db.raw.query("SELECT * FROM mcp_servers WHERE name = ?").get(name);
+  return row2 ? toServer(row2) : null;
 }
 function list7(db) {
   return db.raw.query("SELECT * FROM mcp_servers ORDER BY created_at ASC").all().map(toServer);
@@ -23008,8 +23044,8 @@ function send(db, input) {
   };
 }
 function get11(db, id) {
-  const row = db.raw.query("SELECT * FROM messages WHERE id = ?").get(id);
-  return row ? toMessage(row) : null;
+  const row2 = db.raw.query("SELECT * FROM messages WHERE id = ?").get(id);
+  return row2 ? toMessage(row2) : null;
 }
 function listInbox(db, agentId, opts) {
   const sql = opts?.unreadOnly ? "SELECT * FROM messages WHERE to_agent_id = ? AND read_at IS NULL AND policy_claimed_at IS NULL AND policy_disposition = 'deliverable' ORDER BY created_at ASC" : "SELECT * FROM messages WHERE to_agent_id = ? AND policy_disposition = 'deliverable' ORDER BY created_at ASC";
@@ -23124,9 +23160,9 @@ function openSecrets(db, password) {
   function listAll3() {
     return db.raw.query("SELECT * FROM secrets ORDER BY key ASC").all();
   }
-  function tryDecrypt(row) {
+  function tryDecrypt(row2) {
     try {
-      const envelope = JSON.parse(row.envelope);
+      const envelope = JSON.parse(row2.envelope);
       return decrypt(envelope, password);
     } catch {
       return void 0;
@@ -23134,9 +23170,9 @@ function openSecrets(db, password) {
   }
   return {
     get(key3) {
-      const row = getRow(key3);
-      if (!row) return void 0;
-      return tryDecrypt(row);
+      const row2 = getRow(key3);
+      if (!row2) return void 0;
+      return tryDecrypt(row2);
     },
     set(key3, value) {
       const envelope = JSON.stringify(encrypt(value, password));
@@ -23188,8 +23224,8 @@ function toMeta(r) {
   };
 }
 function get12(db, name) {
-  const row = db.raw.query("SELECT * FROM skill_meta WHERE name = ?").get(name);
-  return row ? toMeta(row) : null;
+  const row2 = db.raw.query("SELECT * FROM skill_meta WHERE name = ?").get(name);
+  return row2 ? toMeta(row2) : null;
 }
 function listAll2(db) {
   return db.raw.query("SELECT * FROM skill_meta ORDER BY name ASC").all().map(toMeta);
@@ -23234,8 +23270,8 @@ function list8(db) {
   return db.raw.query("SELECT * FROM telegram_allowed_users ORDER BY added_at ASC").all().map(toUser);
 }
 function get13(db, userId) {
-  const row = db.raw.query("SELECT * FROM telegram_allowed_users WHERE user_id = ?").get(userId);
-  return row ? toUser(row) : null;
+  const row2 = db.raw.query("SELECT * FROM telegram_allowed_users WHERE user_id = ?").get(userId);
+  return row2 ? toUser(row2) : null;
 }
 function isAllowed(db, userId) {
   return get13(db, userId) !== null;
@@ -23308,30 +23344,30 @@ function status(db) {
   const owner = db.raw.query(
     "SELECT user_id FROM telegram_allowed_users WHERE role = 'owner' ORDER BY added_at LIMIT 1"
   ).get();
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT digest, expires_at, created_at FROM telegram_pairing_challenge WHERE singleton = 1"
   ).get();
-  const active = row !== null && row.expires_at > Date.now();
-  if (row && !active) cancel2(db);
+  const active = row2 !== null && row2.expires_at > Date.now();
+  if (row2 && !active) cancel2(db);
   return {
     paired: owner !== null,
     challengeActive: active,
-    challengeExpiresAt: active ? row?.expires_at ?? null : null,
+    challengeExpiresAt: active ? row2?.expires_at ?? null : null,
     ownerUserId: owner?.user_id ?? null
   };
 }
 function consume(db, input) {
   return db.raw.transaction(() => {
     if (status(db).paired) return false;
-    const row = db.raw.query(
+    const row2 = db.raw.query(
       "SELECT digest, expires_at, created_at FROM telegram_pairing_challenge WHERE singleton = 1"
     ).get();
-    if (!row || row.expires_at <= Date.now()) {
+    if (!row2 || row2.expires_at <= Date.now()) {
       cancel2(db);
       return false;
     }
     const supplied = digest(input.code);
-    const expected = Buffer.from(row.digest, "hex");
+    const expected = Buffer.from(row2.digest, "hex");
     if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) return false;
     add(db, { ...input, role: "owner" });
     cancel2(db);
@@ -23355,22 +23391,22 @@ __export(triggerDispatches_exports, {
   succeed: () => succeed
 });
 import { randomUUID as randomUUID9 } from "crypto";
-function toDispatch(row) {
+function toDispatch(row2) {
   return {
-    id: row.id,
-    triggerId: row.trigger_id,
-    agentId: row.agent_id,
-    conversationId: row.conversation_id,
-    scheduledAt: row.scheduled_at,
-    status: row.status,
-    attemptCount: row.attempt_count,
-    nextAttemptAt: row.next_attempt_at,
-    leaseExpiresAt: row.lease_expires_at,
-    startedAt: row.started_at,
-    finishedAt: row.finished_at,
-    lastError: row.last_error,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
+    id: row2.id,
+    triggerId: row2.trigger_id,
+    agentId: row2.agent_id,
+    conversationId: row2.conversation_id,
+    scheduledAt: row2.scheduled_at,
+    status: row2.status,
+    attemptCount: row2.attempt_count,
+    nextAttemptAt: row2.next_attempt_at,
+    leaseExpiresAt: row2.lease_expires_at,
+    startedAt: row2.started_at,
+    finishedAt: row2.finished_at,
+    lastError: row2.last_error,
+    createdAt: row2.created_at,
+    updatedAt: row2.updated_at
   };
 }
 function materialize(db, input) {
@@ -23392,15 +23428,15 @@ function materialize(db, input) {
       now
     ]
   );
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT * FROM trigger_dispatches WHERE trigger_id = ? AND scheduled_at = ?"
   ).get(input.triggerId, input.scheduledAt);
-  if (!row) throw new Error("trigger dispatch materialization failed");
-  return toDispatch(row);
+  if (!row2) throw new Error("trigger dispatch materialization failed");
+  return toDispatch(row2);
 }
 function get14(db, id) {
-  const row = db.raw.query("SELECT * FROM trigger_dispatches WHERE id = ?").get(id);
-  return row ? toDispatch(row) : null;
+  const row2 = db.raw.query("SELECT * FROM trigger_dispatches WHERE id = ?").get(id);
+  return row2 ? toDispatch(row2) : null;
 }
 function listClaimable2(db, now = Date.now()) {
   return db.raw.query(
@@ -23431,8 +23467,8 @@ function claim2(db, id, options = {}) {
       [leaseExpiresAt, now, now, id, now, now]
     );
     if (Number(result.changes) !== 1) return null;
-    const row = db.raw.query("SELECT * FROM trigger_dispatches WHERE id = ?").get(id);
-    return row ? toDispatch(row) : null;
+    const row2 = db.raw.query("SELECT * FROM trigger_dispatches WHERE id = ?").get(id);
+    return row2 ? toDispatch(row2) : null;
   })();
 }
 function succeed(db, id, now = Date.now()) {
@@ -23541,8 +23577,8 @@ function insert7(db, input) {
   };
 }
 function get15(db, id) {
-  const row = db.raw.query("SELECT * FROM agent_triggers WHERE id = ?").get(id);
-  return row ? toTrigger(row) : null;
+  const row2 = db.raw.query("SELECT * FROM agent_triggers WHERE id = ?").get(id);
+  return row2 ? toTrigger(row2) : null;
 }
 function listForAgent3(db, agentId) {
   return db.raw.query(
@@ -23643,25 +23679,25 @@ function list9(db, opts) {
   return db.raw.query(sql).all().map(toToken);
 }
 function get16(db, id) {
-  const row = db.raw.query("SELECT * FROM web_tokens WHERE id = ?").get(id);
-  return row ? toToken(row) : null;
+  const row2 = db.raw.query("SELECT * FROM web_tokens WHERE id = ?").get(id);
+  return row2 ? toToken(row2) : null;
 }
 function findActiveByToken(db, token) {
   const tokenHash = hashToken(token);
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT * FROM web_tokens
        WHERE token_hash = ? AND revoked_at IS NULL
          AND (expires_at IS NULL OR expires_at > ?)`
   ).get(tokenHash, Date.now());
-  return row ? toToken(row) : null;
+  return row2 ? toToken(row2) : null;
 }
 function rejectionReason(db, token, now = Date.now()) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT expires_at, revoked_at FROM web_tokens WHERE token_hash = ?"
   ).get(hashToken(token));
-  if (!row) return "invalid";
-  if (row.revoked_at !== null) return "revoked";
-  if (row.expires_at !== null && row.expires_at <= now) return "expired";
+  if (!row2) return "invalid";
+  if (row2.revoked_at !== null) return "revoked";
+  if (row2.expires_at !== null && row2.expires_at <= now) return "expired";
   return "invalid";
 }
 function markUsed(db, id, when = Date.now()) {
@@ -23681,17 +23717,17 @@ var SESSION_ABSOLUTE_MS = 7 * 24 * 60 * 60 * 1e3;
 function hash(value) {
   return createHash4("sha256").update(value).digest("hex");
 }
-function toSession(row, currentId) {
+function toSession(row2, currentId) {
   return {
-    id: row.id,
-    deviceTokenId: row.device_token_id,
-    deviceLabel: row.device_label,
-    createdAt: row.created_at,
-    lastSeenAt: row.last_seen_at,
-    idleExpiresAt: row.idle_expires_at,
-    absoluteExpiresAt: row.absolute_expires_at,
-    revokedAt: row.revoked_at,
-    current: row.id === currentId
+    id: row2.id,
+    deviceTokenId: row2.device_token_id,
+    deviceLabel: row2.device_label,
+    createdAt: row2.created_at,
+    lastSeenAt: row2.last_seen_at,
+    idleExpiresAt: row2.idle_expires_at,
+    absoluteExpiresAt: row2.absolute_expires_at,
+    revokedAt: row2.revoked_at,
+    current: row2.id === currentId
   };
 }
 function create3(db, deviceTokenId, now = Date.now()) {
@@ -23734,15 +23770,15 @@ function authenticate(db, cookieValue, now = Date.now()) {
   const id = cookieValue.slice(0, separator);
   const secret = cookieValue.slice(separator + 1);
   if (!secret) return null;
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT s.*, t.label AS device_label
        FROM web_sessions s JOIN web_tokens t ON t.id = s.device_token_id
        WHERE s.id = ? AND s.secret_hash = ? AND s.revoked_at IS NULL
          AND s.idle_expires_at > ? AND s.absolute_expires_at > ?
          AND t.kind = 'device' AND t.revoked_at IS NULL AND t.expires_at > ?`
   ).get(id, hash(secret), now, now, now);
-  if (!row) return null;
-  const idleExpiresAt = Math.min(now + SESSION_IDLE_MS, row.absolute_expires_at);
+  if (!row2) return null;
+  const idleExpiresAt = Math.min(now + SESSION_IDLE_MS, row2.absolute_expires_at);
   db.raw.run("UPDATE web_sessions SET last_seen_at = ?, idle_expires_at = ? WHERE id = ?", [
     now,
     idleExpiresAt,
@@ -23750,9 +23786,9 @@ function authenticate(db, cookieValue, now = Date.now()) {
   ]);
   return {
     id,
-    deviceTokenId: row.device_token_id,
-    deviceLabel: row.device_label,
-    csrfHash: row.csrf_hash
+    deviceTokenId: row2.device_token_id,
+    deviceLabel: row2.device_label,
+    csrfHash: row2.csrf_hash
   };
 }
 function csrfMatches(session, csrf) {
@@ -23764,7 +23800,7 @@ function list10(db, opts = {}) {
     `SELECT s.*, t.label AS device_label FROM web_sessions s
        JOIN web_tokens t ON t.id = s.device_token_id
        ${where} ORDER BY s.created_at DESC`
-  ).all().map((row) => toSession(row, opts.currentId));
+  ).all().map((row2) => toSession(row2, opts.currentId));
 }
 function revoke3(db, id, now = Date.now()) {
   return db.raw.run("UPDATE web_sessions SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL", [
@@ -24985,15 +25021,15 @@ function saveCodingCommand(db, receipt) {
   pruneCodingCommands(db, receipt.teamId);
 }
 function getCodingCommand(db, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT receipt_json FROM coding_commands WHERE id = ?"
   ).get(id);
-  return row ? JSON.parse(row.receipt_json) : null;
+  return row2 ? JSON.parse(row2.receipt_json) : null;
 }
 function interruptCodingCommands(db, turnId) {
   const rows = db.raw.query("SELECT receipt_json FROM coding_commands").all();
-  for (const row of rows) {
-    const receipt = JSON.parse(row.receipt_json);
+  for (const row2 of rows) {
+    const receipt = JSON.parse(row2.receipt_json);
     if (turnId && receipt.turnId !== turnId) continue;
     if (!turnId) receipt.environment.inputFingerprint = null;
     if (receipt.state === "running") {
@@ -25024,15 +25060,15 @@ var receiptFields = `id, source_kind sourceKind, source_id sourceId, agent_id ag
 function publicDestination(binding) {
   return { id: binding.id, chatId: binding.chatId, topicId: binding.topicId };
 }
-function decode(row) {
-  const { destinationJson, ...receipt } = row;
+function decode(row2) {
+  const { destinationJson, ...receipt } = row2;
   return { ...receipt, destination: publicDestination(JSON.parse(destinationJson)) };
 }
 function settings(db) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${settingsFields} FROM notification_settings WHERE singleton = 1`
   ).get();
-  if (!row)
+  if (!row2)
     return {
       revision: 0,
       enabled: false,
@@ -25045,28 +25081,28 @@ function settings(db) {
       updatedAt: 0
     };
   return {
-    revision: row.revision,
-    enabled: row.enabled === 1,
-    restorePaused: row.restorePaused === 1,
-    kinds: JSON.parse(row.kindsJson),
-    timezone: row.timezone,
-    quietHours: row.quietJson === null ? null : JSON.parse(row.quietJson),
-    destination: row.destinationJson === null ? null : publicDestination(JSON.parse(row.destinationJson)),
-    eligibleAfter: row.eligibleAfter,
-    updatedAt: row.updatedAt
+    revision: row2.revision,
+    enabled: row2.enabled === 1,
+    restorePaused: row2.restorePaused === 1,
+    kinds: JSON.parse(row2.kindsJson),
+    timezone: row2.timezone,
+    quietHours: row2.quietJson === null ? null : JSON.parse(row2.quietJson),
+    destination: row2.destinationJson === null ? null : publicDestination(JSON.parse(row2.destinationJson)),
+    eligibleAfter: row2.eligibleAfter,
+    updatedAt: row2.updatedAt
   };
 }
 function destinationBinding(db) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT destination_json value FROM notification_settings WHERE singleton = 1"
   ).get();
-  return row?.value ? JSON.parse(row.value) : null;
+  return row2?.value ? JSON.parse(row2.value) : null;
 }
 function eligibilityCutoffs(db) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT kind_cutoffs_json value FROM notification_settings WHERE singleton=1"
   ).get();
-  return row ? JSON.parse(row.value) : {};
+  return row2 ? JSON.parse(row2.value) : {};
 }
 function hasRestoredHistory(db) {
   return db.raw.query(
@@ -25125,14 +25161,14 @@ function saveSettings(db, expectedRevision, next, binding, now = Date.now()) {
   })();
 }
 function get17(db, id) {
-  const row = db.raw.query(`SELECT ${receiptFields} FROM notification_receipts WHERE id=?`).get(id);
-  return row ? decode(row) : null;
+  const row2 = db.raw.query(`SELECT ${receiptFields} FROM notification_receipts WHERE id=?`).get(id);
+  return row2 ? decode(row2) : null;
 }
 function receiptBinding(db, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT destination_json value FROM notification_receipts WHERE id=?"
   ).get(id);
-  return row ? JSON.parse(row.value) : null;
+  return row2 ? JSON.parse(row2.value) : null;
 }
 function admit(db, item, binding, now = Date.now()) {
   return db.raw.transaction(() => {
@@ -25170,10 +25206,10 @@ function list11(db, options = {}) {
   let after = "";
   const params = [];
   if (options.cursor) {
-    const row = get17(db, options.cursor);
-    if (!row) throw new Error("notification_cursor_invalid");
+    const row2 = get17(db, options.cursor);
+    if (!row2) throw new Error("notification_cursor_invalid");
     after = ` AND (created_at ${comparison} ? OR (created_at = ? AND id ${comparison} ?))`;
-    params.push(row.createdAt, row.createdAt, row.id);
+    params.push(row2.createdAt, row2.createdAt, row2.id);
   }
   params.push(limit + 1);
   const rows = db.raw.query(`SELECT ${receiptFields} FROM notification_receipts
@@ -25234,8 +25270,202 @@ function recoverInterrupted(db, now = Date.now()) {
   );
 }
 
+// ../daemon/src/core/repos/publications.ts
+import { randomUUID as randomUUID19 } from "crypto";
+var PUBLICATION_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var PublicationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+var COLUMNS = `id, team_id, packet_id, snapshot_id, host, repository, base_branch, head_branch,
+  base_oid, commit_message, notify_agent_id, state, refusal_reason, refusal_detail, commit_oid,
+  signed, pull_request_number, pull_request_url, error, created_at, finished_at`;
+function toRecord(row2) {
+  return {
+    id: row2.id,
+    teamId: row2.team_id,
+    packetId: row2.packet_id,
+    snapshotId: row2.snapshot_id,
+    host: row2.host,
+    repository: row2.repository,
+    baseBranch: row2.base_branch,
+    headBranch: row2.head_branch,
+    baseOid: row2.base_oid,
+    commitMessage: row2.commit_message,
+    notifyAgentId: row2.notify_agent_id,
+    state: row2.state,
+    refusalReason: row2.refusal_reason,
+    refusalDetail: row2.refusal_detail,
+    commitOid: row2.commit_oid,
+    // Always false. Read from the row rather than assumed, so a future migration that stores 1 would
+    // surface here instead of being silently reported as unsigned.
+    signed: row2.signed === 1,
+    pullRequestNumber: row2.pull_request_number,
+    pullRequestUrl: row2.pull_request_url,
+    error: row2.error,
+    createdAt: row2.created_at,
+    finishedAt: row2.finished_at
+  };
+}
+function createPublication(db, input) {
+  const now = input.now ?? Date.now();
+  const id = randomUUID19();
+  return inTx(db, () => {
+    const published = db.raw.query(
+      "SELECT id FROM publications WHERE packet_id = ? AND state = 'published'"
+    ).get(input.packetId);
+    if (published) {
+      throw new PublicationError(
+        "already_published",
+        "this packet already has a published revision; publishing it again would duplicate the work"
+      );
+    }
+    db.raw.run(
+      `INSERT INTO publications (
+         id, team_id, packet_id, snapshot_id, host, repository, base_branch, head_branch, base_oid,
+         commit_message, notify_agent_id, state, signed, created_at, updated_at
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, ?, ?)`,
+      [
+        id,
+        input.teamId,
+        input.packetId,
+        input.snapshotId,
+        input.host,
+        input.repository,
+        input.baseBranch,
+        input.headBranch,
+        input.baseOid,
+        input.commitMessage,
+        input.notifyAgentId ?? null,
+        now,
+        now
+      ]
+    );
+    const created = getPublication(db, id);
+    if (!created)
+      throw new PublicationError("publication_not_found", "the publication could not be read back");
+    return created;
+  });
+}
+function getPublication(db, id) {
+  const row2 = db.raw.query(`SELECT ${COLUMNS} FROM publications WHERE id = ?`).get(id);
+  return row2 ? toRecord(row2) : null;
+}
+function listPublications(db, teamId, limit = 50) {
+  return db.raw.query(
+    `SELECT ${COLUMNS} FROM publications WHERE team_id = ? ORDER BY created_at DESC, id DESC LIMIT ?`
+  ).all(teamId, limit).map(toRecord);
+}
+function claimPublication(db, input) {
+  const now = input.now ?? Date.now();
+  return inTx(db, () => {
+    const result = db.raw.run(
+      `UPDATE publications
+          SET state = 'publishing', claimed_by = ?, lease_expires_at = ?, updated_at = ?
+        WHERE id = ? AND state = 'pending'
+          AND NOT EXISTS (
+            SELECT 1 FROM publications p2
+             WHERE p2.packet_id = publications.packet_id AND p2.state = 'published'
+          )`,
+      [input.leaseOwner, now + input.leaseMs, now, input.id]
+    );
+    if (Number(result.changes) === 0) return null;
+    return getPublication(db, input.id);
+  });
+}
+function refusePublication(db, input) {
+  const now = input.now ?? Date.now();
+  const record3 = inTx(db, () => {
+    const result = db.raw.run(
+      `UPDATE publications
+          SET state = 'refused', refusal_reason = ?, refusal_detail = ?, lease_expires_at = NULL,
+              claimed_by = NULL, finished_at = ?, updated_at = ?
+        WHERE id = ? AND state IN ('pending', 'publishing')`,
+      [input.reason, input.detail, now, now, input.id]
+    );
+    if (Number(result.changes) === 0) {
+      throw new PublicationError(
+        "publication_conflict",
+        "a publication that already left the machine cannot be refused"
+      );
+    }
+    return row(db, input.id);
+  });
+  return record3;
+}
+function settlePublicationPublished(db, input) {
+  const now = input.now ?? Date.now();
+  inTx(db, () => {
+    const result = db.raw.run(
+      `UPDATE publications
+          SET state = 'published', commit_oid = ?, pull_request_number = ?, pull_request_url = ?,
+              lease_expires_at = NULL, claimed_by = NULL, finished_at = ?, updated_at = ?
+        WHERE id = ? AND state = 'publishing'`,
+      [input.commitOid, input.pullRequestNumber, input.pullRequestUrl, now, now, input.id]
+    );
+    if (Number(result.changes) === 0) {
+      throw new PublicationError("publication_conflict", "the publication was not being published");
+    }
+  });
+  return row(db, input.id);
+}
+function settlePublicationUncertain(db, input) {
+  return settleUnsent(
+    db,
+    input.id,
+    "uncertain",
+    input.error || "the attempt was interrupted before its outcome was recorded",
+    input.now
+  );
+}
+function settleUnsent(db, id, state3, error2, now = Date.now()) {
+  inTx(db, () => {
+    const result = db.raw.run(
+      `UPDATE publications
+          SET state = ?, error = ?, lease_expires_at = NULL, claimed_by = NULL,
+              finished_at = ?, updated_at = ?
+        WHERE id = ? AND state = 'publishing'`,
+      [state3, error2, now, now, id]
+    );
+    if (Number(result.changes) === 0) {
+      throw new PublicationError("publication_conflict", `the publication was not being published`);
+    }
+  });
+  return row(db, id);
+}
+function recoverExpiredPublications(db, now = Date.now()) {
+  const expired = db.raw.query(
+    "SELECT id FROM publications WHERE state = 'publishing' AND lease_expires_at <= ?"
+  ).all(now);
+  const recovered = [];
+  for (const { id } of expired) {
+    settlePublicationUncertain(db, {
+      id,
+      error: "the publishing process did not finish; whether the branch reached the host is unknown",
+      now
+    });
+    recovered.push(id);
+  }
+  return recovered;
+}
+function row(db, id) {
+  const record3 = getPublication(db, id);
+  if (!record3) throw new PublicationError("publication_not_found", "the publication is gone");
+  return record3;
+}
+function notePublicationError(db, id, error2, now = Date.now()) {
+  db.raw.run("UPDATE publications SET error = ?, updated_at = ? WHERE id = ?", [
+    error2.slice(0, 400),
+    now,
+    id
+  ]);
+}
+
 // ../daemon/src/core/repos/questions.ts
-import { createHash as createHash6, randomUUID as randomUUID19 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID20 } from "crypto";
 
 // ../daemon/src/lib/question-input.ts
 var QUESTION_LIMITS = Object.freeze({
@@ -25336,8 +25566,8 @@ var fields = `id, agent_id AS agentId, team_id AS teamId, conversation_id AS con
  created_at AS createdAt, expires_at AS expiresAt, settled_at AS settledAt, delivered_at AS deliveredAt, answer_json AS answerJson,
  response_request_id AS responseRequestId, no_answer_reason AS noAnswerReason, continuation,
  consumed_at AS consumedAt, delivery_approval_id AS deliveryApprovalId, answer_approval_id AS answerApprovalId`;
-function decode2(row) {
-  const { questionJson, answerJson, ...item } = row;
+function decode2(row2) {
+  const { questionJson, answerJson, ...item } = row2;
   return {
     ...item,
     question: parseQuestionInput(JSON.parse(questionJson)),
@@ -25345,10 +25575,10 @@ function decode2(row) {
   };
 }
 function get18(db, agentId, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${fields} FROM agent_questions WHERE agent_id = ? AND id = ?`
   ).get(agentId, id);
-  return row ? decode2(row) : null;
+  return row2 ? decode2(row2) : null;
 }
 function list12(db, agentId, limit = 20, conversationId) {
   if (!Number.isInteger(limit) || limit < 1 || limit > 100)
@@ -25381,7 +25611,7 @@ function create4(db, input, now = Date.now()) {
       COALESCE(SUM(status = 'pending'), 0) AS pending, COALESCE(SUM(turn_id = ?), 0) AS turn FROM agent_questions`).get(input.turnId);
     if (!count3 || count3.total >= QUESTION_LIMITS.recordsPerHome || count3.pending >= QUESTION_LIMITS.pendingPerHome || count3.turn >= QUESTION_LIMITS.perTurn)
       throw new Error("Question capacity reached");
-    const id = randomUUID19();
+    const id = randomUUID20();
     db.raw.run(
       `INSERT INTO agent_questions (id, agent_id, team_id, conversation_id, turn_id, tool_call_id,
       question_json, binding_json, status, created_at, expires_at, continuation) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, 'waiting')`,
@@ -25493,10 +25723,10 @@ function retireClosedApprovals(db, now) {
     WHERE q.status != 'pending' AND a.status = 'pending'
       AND a.payload_kind IN ('question_delivery', 'question_answer')
   `).all();
-  for (const row of rows)
+  for (const row2 of rows)
     decide(
       db,
-      row.id,
+      row2.id,
       "cancel",
       "system",
       "Originating question is closed",
@@ -25507,13 +25737,13 @@ var digest2 = (value) => createHash6("sha256").update(JSON.stringify(value)).dig
 function approvalSnapshot(db, agentId, id) {
   const question = get18(db, agentId, id);
   if (!question) return null;
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT binding_json, proposal_json FROM agent_questions WHERE id = ?"
   ).get(id);
-  if (!row || Buffer.byteLength(row.binding_json) > 16384 || row.proposal_json && Buffer.byteLength(row.proposal_json) > 32768)
+  if (!row2 || Buffer.byteLength(row2.binding_json) > 16384 || row2.proposal_json && Buffer.byteLength(row2.proposal_json) > 32768)
     throw new Error("Question binding unavailable");
-  const proposal = row.proposal_json ? parseQuestionResponse(
-    JSON.parse(row.proposal_json),
+  const proposal = row2.proposal_json ? parseQuestionResponse(
+    JSON.parse(row2.proposal_json),
     question.question,
     question.conversationId
   ) : null;
@@ -25525,7 +25755,7 @@ function approvalSnapshot(db, agentId, id) {
     turnId: question.turnId,
     toolCallId: question.toolCallId,
     question: question.question,
-    binding: JSON.parse(row.binding_json)
+    binding: JSON.parse(row2.binding_json)
   });
   return {
     question,
@@ -25582,7 +25812,7 @@ function ownsApproval(db, capturedId, providedId) {
 }
 
 // ../daemon/src/core/repos/review-packets.ts
-import { randomUUID as randomUUID20 } from "crypto";
+import { randomUUID as randomUUID21 } from "crypto";
 var REVIEW_PACKET_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var REVIEW_LIMITS = {
   summary: 2e3,
@@ -25612,7 +25842,7 @@ function assertLength(value, max, field) {
 }
 function createReviewPacket(db, input) {
   const now = input.now ?? Date.now();
-  const id = randomUUID20();
+  const id = randomUUID21();
   if (input.summary) assertLength(input.summary, REVIEW_LIMITS.summary, "summary");
   db.raw.run(
     `INSERT INTO review_packets (
@@ -25639,16 +25869,16 @@ function createReviewPacket(db, input) {
   return created;
 }
 function getReviewPacket(db, id, now = Date.now()) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${PACKET_COLUMNS} FROM review_packets WHERE id = ? AND expires_at > ?`
   ).get(id, now);
-  return row ? toPacket(row) : null;
+  return row2 ? toPacket(row2) : null;
 }
 function getTeamReviewPacket(db, teamId, id, now = Date.now()) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${PACKET_COLUMNS} FROM review_packets WHERE id = ? AND team_id = ? AND expires_at > ?`
   ).get(id, teamId, now);
-  return row ? toPacket(row) : null;
+  return row2 ? toPacket(row2) : null;
 }
 function listReviewPackets(db, teamId, limit = 50, now = Date.now()) {
   return db.raw.query(
@@ -25691,7 +25921,7 @@ function addReviewFinding(db, input) {
         `a packet holds at most ${REVIEW_LIMITS.findings} findings`
       );
     }
-    const id = randomUUID20();
+    const id = randomUUID21();
     db.raw.run(
       `INSERT INTO review_findings (
          id, packet_id, author_kind, author_agent_id, path, line_start, line_end, severity, note,
@@ -25712,14 +25942,14 @@ function addReviewFinding(db, input) {
         input.now ?? Date.now()
       ]
     );
-    const row = getReviewFinding(db, id);
-    if (!row) throw new ReviewPacketError("finding_not_found", "the finding could not be read back");
-    return row;
+    const row2 = getReviewFinding(db, id);
+    if (!row2) throw new ReviewPacketError("finding_not_found", "the finding could not be read back");
+    return row2;
   });
 }
 function getReviewFinding(db, id) {
-  const row = db.raw.query(`SELECT ${FINDING_COLUMNS} FROM review_findings WHERE id = ?`).get(id);
-  return row ? toFinding(row) : null;
+  const row2 = db.raw.query(`SELECT ${FINDING_COLUMNS} FROM review_findings WHERE id = ?`).get(id);
+  return row2 ? toFinding(row2) : null;
 }
 function listReviewFindings(db, packetId) {
   return db.raw.query(
@@ -25760,7 +25990,7 @@ function resolveReviewFinding(db, input) {
 }
 function recordReviewConclusion(db, input) {
   if (input.note) assertLength(input.note, REVIEW_LIMITS.note, "conclusion note");
-  const id = randomUUID20();
+  const id = randomUUID21();
   db.raw.run(
     `INSERT INTO review_conclusions (
        id, packet_id, reviewer_kind, reviewer_agent_id, conclusion, note, snapshot_id, created_at
@@ -25781,12 +26011,14 @@ function recordReviewConclusion(db, input) {
       input.now ?? Date.now()
     ]
   );
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${CONCLUSION_COLUMNS} FROM review_conclusions
        WHERE packet_id = ? AND reviewer_kind = ? AND reviewer_agent_id IS ?`
   ).get(input.packetId, input.reviewerKind, input.reviewerAgentId ?? null);
-  if (!row) throw new ReviewPacketError("packet_not_found", "the conclusion could not be read back");
-  return toConclusion(row);
+  if (!row2) throw new ReviewPacketError("packet_not_found", "the conclusion could not be read back");
+  const packet = getReviewPacket(db, input.packetId);
+  if (packet?.state === "open") setReviewPacketState(db, input.packetId, "reviewed");
+  return toConclusion(row2);
 }
 function listReviewConclusions(db, packetId) {
   return db.raw.query(
@@ -25801,7 +26033,7 @@ function claimReviewAttempt(db, input) {
     const next = (db.raw.query(
       "SELECT COALESCE(MAX(attempt_number), 0) AS n FROM review_attempts WHERE packet_id = ?"
     ).get(input.packetId)?.n ?? 0) + 1;
-    const id = randomUUID20();
+    const id = randomUUID21();
     db.raw.run(
       `INSERT INTO review_attempts (
          id, packet_id, attempt_number, supersedes_attempt_id, state, lease_owner, lease_expires_at, created_at
@@ -25824,8 +26056,8 @@ function claimReviewAttempt(db, input) {
   });
 }
 function getReviewAttempt(db, id) {
-  const row = db.raw.query(`SELECT ${ATTEMPT_COLUMNS} FROM review_attempts WHERE id = ?`).get(id);
-  return row ? toAttempt(row) : null;
+  const row2 = db.raw.query(`SELECT ${ATTEMPT_COLUMNS} FROM review_attempts WHERE id = ?`).get(id);
+  return row2 ? toAttempt(row2) : null;
 }
 function listReviewAttempts(db, packetId) {
   return db.raw.query(
@@ -25836,11 +26068,11 @@ function finishReviewAttempt(db, input) {
   if (input.error != null) assertLength(input.error, REVIEW_LIMITS.summary, "error");
   const now = input.now ?? Date.now();
   return inTx(db, () => {
-    const row = db.raw.query(
+    const row2 = db.raw.query(
       `SELECT ${ATTEMPT_COLUMNS} FROM review_attempts WHERE id = ? AND lease_owner = ?`
     ).get(input.attemptId, input.leaseOwner);
-    if (!row) return false;
-    const attempt = toAttempt(row);
+    if (!row2) return false;
+    const attempt = toAttempt(row2);
     if (attempt.finishedAt !== null) return false;
     db.raw.run(
       `UPDATE review_attempts
@@ -25877,24 +26109,24 @@ var PACKET_COLUMNS = "id, team_id, requester_kind, requester_agent_id, reviewer_
 var FINDING_COLUMNS = "id, packet_id, author_kind, author_agent_id, path, line_start, line_end, severity, note, snapshot_id, state, resolution_kind, resolution_note, resolved_at, resolved_by_kind, resolved_by_agent_id, created_at";
 var CONCLUSION_COLUMNS = "id, packet_id, reviewer_kind, reviewer_agent_id, conclusion, note, snapshot_id, created_at";
 var ATTEMPT_COLUMNS = "id, packet_id, attempt_number, supersedes_attempt_id, state, lease_owner, lease_expires_at, started_at, finished_at, error, created_at";
-function toPacket(row) {
+function toPacket(row2) {
   return {
-    id: row.id,
-    teamId: row.team_id,
-    requesterKind: row.requester_kind,
-    requesterAgentId: row.requester_agent_id,
-    reviewerAgentId: row.reviewer_agent_id,
-    snapshotId: row.snapshot_id,
-    snapshotComplete: row.snapshot_complete === 1,
-    head: row.head,
-    baseOid: row.base_oid,
-    summary: row.summary,
-    state: row.state,
-    exportedAt: row.exported_at,
-    exportRevision: row.export_revision,
-    reported: parseReported(row.reported_json),
-    createdAt: row.created_at,
-    expiresAt: row.expires_at
+    id: row2.id,
+    teamId: row2.team_id,
+    requesterKind: row2.requester_kind,
+    requesterAgentId: row2.requester_agent_id,
+    reviewerAgentId: row2.reviewer_agent_id,
+    snapshotId: row2.snapshot_id,
+    snapshotComplete: row2.snapshot_complete === 1,
+    head: row2.head,
+    baseOid: row2.base_oid,
+    summary: row2.summary,
+    state: row2.state,
+    exportedAt: row2.exported_at,
+    exportRevision: row2.export_revision,
+    reported: parseReported(row2.reported_json),
+    createdAt: row2.created_at,
+    expiresAt: row2.expires_at
   };
 }
 function parseReported(json) {
@@ -25934,57 +26166,57 @@ function recordReportedState(db, input) {
   ]);
   return next;
 }
-function toFinding(row) {
+function toFinding(row2) {
   return {
-    id: row.id,
-    packetId: row.packet_id,
-    authorKind: row.author_kind,
-    authorAgentId: row.author_agent_id,
-    path: row.path,
-    lineStart: row.line_start,
-    lineEnd: row.line_end,
-    severity: row.severity,
-    note: row.note,
-    snapshotId: row.snapshot_id,
-    state: row.state,
-    resolutionKind: row.resolution_kind,
-    resolutionNote: row.resolution_note,
-    resolvedAt: row.resolved_at,
-    resolvedByKind: row.resolved_by_kind,
-    resolvedByAgentId: row.resolved_by_agent_id,
-    createdAt: row.created_at
-  };
-}
-function toConclusion(row) {
+    id: row2.id,
+    packetId: row2.packet_id,
+    authorKind: row2.author_kind,
+    authorAgentId: row2.author_agent_id,
+    path: row2.path,
+    lineStart: row2.line_start,
+    lineEnd: row2.line_end,
+    severity: row2.severity,
+    note: row2.note,
+    snapshotId: row2.snapshot_id,
+    state: row2.state,
+    resolutionKind: row2.resolution_kind,
+    resolutionNote: row2.resolution_note,
+    resolvedAt: row2.resolved_at,
+    resolvedByKind: row2.resolved_by_kind,
+    resolvedByAgentId: row2.resolved_by_agent_id,
+    createdAt: row2.created_at
+  };
+}
+function toConclusion(row2) {
   return {
-    id: row.id,
-    packetId: row.packet_id,
-    reviewerKind: row.reviewer_kind,
-    reviewerAgentId: row.reviewer_agent_id,
-    conclusion: row.conclusion,
-    note: row.note,
-    snapshotId: row.snapshot_id,
-    createdAt: row.created_at
+    id: row2.id,
+    packetId: row2.packet_id,
+    reviewerKind: row2.reviewer_kind,
+    reviewerAgentId: row2.reviewer_agent_id,
+    conclusion: row2.conclusion,
+    note: row2.note,
+    snapshotId: row2.snapshot_id,
+    createdAt: row2.created_at
   };
 }
-function toAttempt(row) {
+function toAttempt(row2) {
   return {
-    id: row.id,
-    packetId: row.packet_id,
-    attemptNumber: row.attempt_number,
-    supersedesAttemptId: row.supersedes_attempt_id,
-    state: row.state,
-    leaseOwner: row.lease_owner,
-    leaseExpiresAt: row.lease_expires_at,
-    startedAt: row.started_at,
-    finishedAt: row.finished_at,
-    error: row.error,
-    createdAt: row.created_at
+    id: row2.id,
+    packetId: row2.packet_id,
+    attemptNumber: row2.attempt_number,
+    supersedesAttemptId: row2.supersedes_attempt_id,
+    state: row2.state,
+    leaseOwner: row2.lease_owner,
+    leaseExpiresAt: row2.lease_expires_at,
+    startedAt: row2.started_at,
+    finishedAt: row2.finished_at,
+    error: row2.error,
+    createdAt: row2.created_at
   };
 }
 
 // ../daemon/src/core/repos/user-queue.ts
-import { createHash as createHash7, randomUUID as randomUUID21 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID22 } from "crypto";
 var QUEUE_LIMITS = Object.freeze({
   perAgent: 20,
   perHome: 100,
@@ -26039,10 +26271,10 @@ function normalize2(message, attachments2) {
   return { message, files, total };
 }
 function control(db, agentId) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT paused, revision, reason FROM user_queue_controls WHERE agent_id = ?"
   ).get(agentId);
-  return row ? { ...row, paused: row.paused === 1 } : { paused: false, revision: 0, reason: null };
+  return row2 ? { ...row2, paused: row2.paused === 1 } : { paused: false, revision: 0, reason: null };
 }
 function ensureControl(db, agentId) {
   db.raw.run("INSERT INTO user_queue_controls (agent_id) VALUES (?) ON CONFLICT DO NOTHING", [
@@ -26054,18 +26286,18 @@ function attachments(db, id) {
     `SELECT id, name, mime_type AS mimeType, byte_length AS byteLength, sha256 FROM user_queue_attachments WHERE item_id = ? ORDER BY ordinal`
   ).all(id);
 }
-function hydrate(db, row) {
+function hydrate(db, row2) {
   return {
-    ...row,
-    payloadRetained: row.payloadRetained === 1,
-    attachments: attachments(db, row.id)
+    ...row2,
+    payloadRetained: row2.payloadRetained === 1,
+    attachments: attachments(db, row2.id)
   };
 }
 function get19(db, agentId, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${fields2} FROM user_queue_items WHERE agent_id = ? AND id = ?`
   ).get(agentId, id);
-  return row ? hydrate(db, row) : null;
+  return row2 ? hydrate(db, row2) : null;
 }
 function list13(db, agentId, options = {}) {
   const { all = false, limit = 20, offset = 0 } = options;
@@ -26077,7 +26309,7 @@ function list13(db, agentId, options = {}) {
   ).all(agentId, limit, offset);
   const total = db.raw.query(`SELECT count(*) n FROM user_queue_items WHERE ${where}`).get(agentId)?.n ?? 0;
   return {
-    items: rows.map((row) => hydrate(db, row)),
+    items: rows.map((row2) => hydrate(db, row2)),
     control: control(db, agentId),
     total,
     limit,
@@ -26172,7 +26404,7 @@ function accept(db, input, replacement) {
       db.raw.run(
         `INSERT INTO user_queue_attachments (id,item_id,ordinal,name,mime_type,byte_length,sha256,bytes) VALUES (?,?,?,?,?,?,?,?)`,
         [
-          randomUUID21(),
+          randomUUID22(),
           input.id,
           ordinal,
           file.name,
@@ -26192,10 +26424,10 @@ function readInput(db, agentId, id) {
   const item = get19(db, agentId, id);
   if (!item?.payloadRetained || item.text === null)
     throw new Error("Queue input no longer retained");
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT provenance_json, input_digest FROM user_queue_items WHERE id = ?"
   ).get(id);
-  if (!row) throw new Error("Queue input unavailable");
+  if (!row2) throw new Error("Queue input unavailable");
   const retainedSize = db.raw.query(
     "SELECT count(*) n, coalesce(sum(length(bytes)),0) bytes FROM user_queue_attachments WHERE item_id = ?"
   ).get(id);
@@ -26213,7 +26445,7 @@ function readInput(db, agentId, id) {
     };
   });
   const normalized = normalize2(item.text, restored);
-  const provenance = JSON.parse(row.provenance_json);
+  const provenance = JSON.parse(row2.provenance_json);
   const actualDigest = hash2(
     JSON.stringify({
       agentId: item.agentId,
@@ -26226,9 +26458,9 @@ function readInput(db, agentId, id) {
       replaces: item.supersedesId
     })
   );
-  if (actualDigest !== row.input_digest)
+  if (actualDigest !== row2.input_digest)
     throw new Error("Queue input binding is missing or corrupt");
-  return { item, attachments: restored, provenance, digest: row.input_digest };
+  return { item, attachments: restored, provenance, digest: row2.input_digest };
 }
 function setPaused(db, agentId, paused, expectedRevision, reason = null) {
   if (typeof paused !== "boolean" || !Number.isSafeInteger(expectedRevision) || expectedRevision < 0 || reason !== null && (typeof reason !== "string" || reason.length > 500))
@@ -26324,11 +26556,11 @@ function recoverInterrupted3(db) {
     const agents = db.raw.query(
       `SELECT DISTINCT agent_id FROM user_queue_items WHERE ${interrupted}`
     ).all();
-    for (const row of agents) {
-      ensureControl(db, row.agent_id);
+    for (const row2 of agents) {
+      ensureControl(db, row2.agent_id);
       db.raw.run(
         "UPDATE user_queue_controls SET paused = 1, revision = revision + 1, reason = 'interrupted' WHERE agent_id = ?",
-        [row.agent_id]
+        [row2.agent_id]
       );
     }
     return Number(
@@ -26371,36 +26603,36 @@ function pruneTerminalInput(db, now = Date.now()) {
   })();
 }
 function findAttempt(db, source, attemptId) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${fields2} FROM user_queue_items WHERE source = ? AND attempt_id = ?`
   ).get(source, attemptId);
-  return row ? hydrate(db, row) : null;
+  return row2 ? hydrate(db, row2) : null;
 }
 function agentsWithOpenItems(db) {
   return db.raw.query(
     `SELECT DISTINCT agent_id FROM user_queue_items WHERE status IN (${openStates})`
-  ).all().map((row) => row.agent_id);
+  ).all().map((row2) => row2.agent_id);
 }
 function validateInput(message, attachments2) {
   normalize2(message, attachments2);
 }
 function readProvenance(db, agentId, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT provenance_json FROM user_queue_items WHERE agent_id = ? AND id = ? AND length(provenance_json) <= 16384"
   ).get(agentId, id);
-  if (!row?.provenance_json) throw new Error("Queue provenance unavailable");
-  return JSON.parse(row.provenance_json);
+  if (!row2?.provenance_json) throw new Error("Queue provenance unavailable");
+  return JSON.parse(row2.provenance_json);
 }
 function approvalReference(db, agentId, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT input_digest FROM user_queue_items WHERE id = ? AND agent_id = ?"
   ).get(id, agentId);
-  if (!row) throw new QueueConflictError("Queue approval input unavailable");
-  return { agentId, itemId: id, inputDigest: row.input_digest };
+  if (!row2) throw new QueueConflictError("Queue approval input unavailable");
+  return { agentId, itemId: id, inputDigest: row2.input_digest };
 }
 
 // ../daemon/src/core/repos/verification-requests.ts
-import { randomUUID as randomUUID22 } from "crypto";
+import { randomUUID as randomUUID23 } from "crypto";
 var VERIFICATION_REQUEST_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var VERIFICATION_MAX_CHECKS = 8;
 var VERIFICATION_LIMITS = {
@@ -26422,61 +26654,61 @@ var REQUEST_COLUMNS = "id, team_id, requester_kind, requester_agent_id, recipien
 var CHECK_COLUMNS = "request_id, ordinal, command, cwd, purpose, timeout_ms";
 var OUTCOME_COLUMNS = "attempt_id, ordinal, state, command_id, exit_code, started_at, finished_at";
 var ATTEMPT_COLUMNS2 = "id, request_id, attempt_number, supersedes_attempt_id, state, lease_owner, lease_expires_at, started_at, finished_at, error, observed_writes_json, created_at";
-function toRequest(row) {
+function toRequest(row2) {
   return {
-    id: row.id,
-    teamId: row.team_id,
-    requesterKind: row.requester_kind === "agent" ? "agent" : "operator",
-    requesterAgentId: row.requester_agent_id,
-    recipientAgentId: row.recipient_agent_id,
-    messageId: row.message_id,
-    sourceSessionId: row.source_session_id,
-    snapshotId: row.snapshot_id,
-    snapshotComplete: row.snapshot_complete === 1,
-    head: row.head,
-    baseOid: row.base_oid,
-    environment: JSON.parse(row.environment_json),
-    summary: row.summary,
-    state: row.state,
-    createdAt: row.created_at,
-    expiresAt: row.expires_at
-  };
-}
-function toCheck(row) {
+    id: row2.id,
+    teamId: row2.team_id,
+    requesterKind: row2.requester_kind === "agent" ? "agent" : "operator",
+    requesterAgentId: row2.requester_agent_id,
+    recipientAgentId: row2.recipient_agent_id,
+    messageId: row2.message_id,
+    sourceSessionId: row2.source_session_id,
+    snapshotId: row2.snapshot_id,
+    snapshotComplete: row2.snapshot_complete === 1,
+    head: row2.head,
+    baseOid: row2.base_oid,
+    environment: JSON.parse(row2.environment_json),
+    summary: row2.summary,
+    state: row2.state,
+    createdAt: row2.created_at,
+    expiresAt: row2.expires_at
+  };
+}
+function toCheck(row2) {
   return {
-    requestId: row.request_id,
-    ordinal: row.ordinal,
-    command: row.command,
-    cwd: row.cwd,
-    purpose: row.purpose,
-    timeoutMs: row.timeout_ms
+    requestId: row2.request_id,
+    ordinal: row2.ordinal,
+    command: row2.command,
+    cwd: row2.cwd,
+    purpose: row2.purpose,
+    timeoutMs: row2.timeout_ms
   };
 }
-function toOutcome(row) {
+function toOutcome(row2) {
   return {
-    attemptId: row.attempt_id,
-    ordinal: row.ordinal,
-    state: row.state,
-    commandId: row.command_id,
-    exitCode: row.exit_code,
-    startedAt: row.started_at,
-    finishedAt: row.finished_at
+    attemptId: row2.attempt_id,
+    ordinal: row2.ordinal,
+    state: row2.state,
+    commandId: row2.command_id,
+    exitCode: row2.exit_code,
+    startedAt: row2.started_at,
+    finishedAt: row2.finished_at
   };
 }
-function toAttempt2(row) {
+function toAttempt2(row2) {
   return {
-    id: row.id,
-    requestId: row.request_id,
-    attemptNumber: row.attempt_number,
-    supersedesAttemptId: row.supersedes_attempt_id,
-    state: row.state,
-    leaseOwner: row.lease_owner,
-    leaseExpiresAt: row.lease_expires_at,
-    startedAt: row.started_at,
-    finishedAt: row.finished_at,
-    error: row.error,
-    observedWrites: parseObservedWrites(row.observed_writes_json),
-    createdAt: row.created_at
+    id: row2.id,
+    requestId: row2.request_id,
+    attemptNumber: row2.attempt_number,
+    supersedesAttemptId: row2.supersedes_attempt_id,
+    state: row2.state,
+    leaseOwner: row2.lease_owner,
+    leaseExpiresAt: row2.lease_expires_at,
+    startedAt: row2.started_at,
+    finishedAt: row2.finished_at,
+    error: row2.error,
+    observedWrites: parseObservedWrites(row2.observed_writes_json),
+    createdAt: row2.created_at
   };
 }
 function parseObservedWrites(json) {
@@ -26492,7 +26724,7 @@ var VerificationRequestError = class extends Error {
 };
 function createVerificationRequest(db, input) {
   const now = input.now ?? Date.now();
-  const id = input.id ?? randomUUID22();
+  const id = input.id ?? randomUUID23();
   if (input.checks.length < 1)
     throw new VerificationRequestError("a request needs at least one check");
   if (input.checks.length > VERIFICATION_MAX_CHECKS) {
@@ -26553,17 +26785,17 @@ function createVerificationRequest(db, input) {
   });
 }
 function getVerificationRequest(db, teamId, id, now = Date.now()) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${REQUEST_COLUMNS} FROM verification_requests
        WHERE team_id = ? AND id = ? AND expires_at > ?`
   ).get(teamId, id, now);
-  return row ? toRequest(row) : null;
+  return row2 ? toRequest(row2) : null;
 }
 function getVerificationRequestById(db, id, now = Date.now()) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     `SELECT ${REQUEST_COLUMNS} FROM verification_requests WHERE id = ? AND expires_at > ?`
   ).get(id, now);
-  return row ? toRequest(row) : null;
+  return row2 ? toRequest(row2) : null;
 }
 function listVerificationRequests(db, teamId, limit = 50, now = Date.now()) {
   return db.raw.query(
@@ -26594,11 +26826,11 @@ function claimVerificationAttempt(db, input) {
   if (!input.leaseOwner) throw new VerificationRequestError("a claim requires an owner");
   if (input.leaseMs <= 0) throw new VerificationRequestError("a claim requires a positive lease");
   return inTx(db, () => {
-    const row = db.raw.query(
+    const row2 = db.raw.query(
       `SELECT ${REQUEST_COLUMNS} FROM verification_requests WHERE id = ? AND expires_at > ?`
     ).get(input.requestId, now);
-    if (!row) return null;
-    const request2 = toRequest(row);
+    if (!row2) return null;
+    const request2 = toRequest(row2);
     const terminal = VERIFICATION_TERMINAL_REQUEST_STATES.includes(request2.state);
     if (!terminal && request2.state !== "pending") return null;
     if (terminal && !input.rerun) return null;
@@ -26610,7 +26842,7 @@ function claimVerificationAttempt(db, input) {
       `SELECT id, attempt_number FROM verification_attempts WHERE request_id = ?
          ORDER BY attempt_number DESC LIMIT 1`
     ).get(input.requestId);
-    const attemptId = randomUUID22();
+    const attemptId = randomUUID23();
     db.raw.run(
       `INSERT INTO verification_attempts
         (id, request_id, attempt_number, supersedes_attempt_id, state, lease_owner,
@@ -26643,11 +26875,11 @@ function finishVerificationAttempt(db, input) {
   const now = input.now ?? Date.now();
   if (input.error != null) assertLength2(input.error, VERIFICATION_LIMITS.error, "error");
   return inTx(db, () => {
-    const row = db.raw.query(
+    const row2 = db.raw.query(
       `SELECT ${ATTEMPT_COLUMNS2} FROM verification_attempts WHERE id = ? AND lease_owner = ?`
     ).get(input.attemptId, input.leaseOwner);
-    if (!row) return false;
-    const attempt = toAttempt2(row);
+    if (!row2) return false;
+    const attempt = toAttempt2(row2);
     if (attempt.finishedAt !== null) return false;
     db.raw.run(
       `UPDATE verification_attempts
@@ -26713,22 +26945,22 @@ function recoverInterruptedVerificationAttempts(db, daemonIdentity, now = Date.n
       `SELECT id, request_id, lease_owner FROM verification_attempts WHERE finished_at IS NULL`
     ).all();
     const recovered = [];
-    for (const row of rows) {
-      if (row.lease_owner === daemonIdentity) continue;
+    for (const row2 of rows) {
+      if (row2.lease_owner === daemonIdentity) continue;
       db.raw.run(
         `UPDATE verification_attempts
          SET state = 'uncertain', finished_at = ?, lease_owner = NULL, lease_expires_at = NULL,
              error = 'execution was interrupted before it reported an outcome'
          WHERE id = ?`,
-        [now, row.id]
+        [now, row2.id]
       );
       db.raw.run(
         `UPDATE verification_check_outcomes SET state = 'unknown', finished_at = ?
          WHERE attempt_id = ? AND state = 'not_executed'`,
-        [now, row.id]
+        [now, row2.id]
       );
-      setRequestState(db, row.request_id, "uncertain");
-      recovered.push(row.request_id);
+      setRequestState(db, row2.request_id, "uncertain");
+      recovered.push(row2.request_id);
     }
     return recovered;
   });
@@ -26749,13 +26981,13 @@ function validateCheck(check) {
     throw new VerificationRequestError("timeout is outside its bounded contract");
   }
 }
-function validateEnvironment(environment) {
-  if (!environment.image)
+function validateEnvironment(environment2) {
+  if (!environment2.image)
     throw new VerificationRequestError("the admitted environment has no image");
-  if (environment.sandbox !== "off" && environment.sandbox !== "docker") {
+  if (environment2.sandbox !== "off" && environment2.sandbox !== "docker") {
     throw new VerificationRequestError("the admitted environment has an unknown shell backend");
   }
-  if (environment.env && Object.keys(environment.env).length > 32) {
+  if (environment2.env && Object.keys(environment2.env).length > 32) {
     throw new VerificationRequestError("the admitted environment carries too many variables");
   }
 }
@@ -26862,14 +27094,14 @@ function reconcilePrivateResults(db, options = {}) {
 }
 
 // ../daemon/src/lib/coding-environment/lifecycle.ts
-import { randomUUID as randomUUID26 } from "crypto";
+import { randomUUID as randomUUID27 } from "crypto";
 
 // ../daemon/src/lib/coding-environment/resources.ts
-import { randomUUID as randomUUID24 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 
 // ../daemon/src/runtime/shell/docker.ts
 import { spawn } from "child_process";
-import { randomUUID as randomUUID23 } from "crypto";
+import { randomUUID as randomUUID24 } from "crypto";
 import { closeSync as closeSync2, constants as constants2, mkdtempSync as mkdtempSync2, openSync as openSync2, rmSync as rmSync9, writeFileSync as writeFileSync6 } from "fs";
 import { access, lstat, realpath, stat } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -27359,7 +27591,7 @@ function createPreparedDockerBashOperations(runtime, lifecycle) {
       }
       await assertDockerExecutableIdentity(runtime.dockerPath, runtime.executableIdentity);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID23().replaceAll("-", "")}`;
+      const containerName = lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID24().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image: runtime.image,
         resolvedImage: runtime.imageId,
@@ -27408,7 +27640,7 @@ async function preflightProtectedDockerEngine(input) {
 }
 async function proveProtectedContainerCreation(engine, workspace, readOnlyMounts, lifecycle, signal) {
   if (signal?.aborted) throw new Error("aborted");
-  const containerName = lifecycle?.name("preflight") ?? `bazilion-preflight-${process.pid}-${randomUUID23().replaceAll("-", "")}`;
+  const containerName = lifecycle?.name("preflight") ?? `bazilion-preflight-${process.pid}-${randomUUID24().replaceAll("-", "")}`;
   const dockerClientEnv = { DOCKER_HOST: engine.endpoint };
   const spec = buildDockerRunSpec({
     image: engine.image,
@@ -27740,7 +27972,7 @@ function createDockerBashOperations(options) {
       const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
       const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = options.lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID23().replaceAll("-", "")}`;
+      const containerName = options.lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID24().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image,
         env,
@@ -28396,7 +28628,7 @@ var WorkspaceResources = class {
   }
   register(lease, resource) {
     return inTx(this.db, () => {
-      const id = randomUUID24();
+      const id = randomUUID25();
       lease.attach({ id, kind: resource.kind });
       this.db.raw.run(
         "INSERT INTO workspace_resources (id, writer_id, kind, identity_json) VALUES (?, ?, ?, ?)",
@@ -28406,13 +28638,13 @@ var WorkspaceResources = class {
     });
   }
   async cleanupResource(id, observedNormalExit = false) {
-    const row = this.db.raw.query(`SELECT r.*, w.recovery_mode FROM workspace_resources r
+    const row2 = this.db.raw.query(`SELECT r.*, w.recovery_mode FROM workspace_resources r
         JOIN workspace_writers w ON w.id = r.writer_id WHERE r.id = ?`).get(id);
-    if (!row) return false;
-    if (row.recovery_mode === "restored") return false;
-    if (row.cleanup_confirmed) return true;
-    const identity2 = JSON.parse(row.identity_json);
-    const confirmed = row.kind === "worker" ? await terminateWorkerProcess(identity2, observedNormalExit) : await terminateRecordedContainer(identity2, row.creation_acknowledged === 1);
+    if (!row2) return false;
+    if (row2.recovery_mode === "restored") return false;
+    if (row2.cleanup_confirmed) return true;
+    const identity2 = JSON.parse(row2.identity_json);
+    const confirmed = row2.kind === "worker" ? await terminateWorkerProcess(identity2, observedNormalExit) : await terminateRecordedContainer(identity2, row2.creation_acknowledged === 1);
     if (confirmed)
       this.db.raw.run("UPDATE workspace_resources SET cleanup_confirmed = 1 WHERE id = ?", [id]);
     return confirmed;
@@ -28423,18 +28655,18 @@ var WorkspaceResources = class {
       "SELECT * FROM workspace_resources WHERE writer_id = ? ORDER BY CASE kind WHEN 'worker' THEN 0 ELSE 1 END"
     ).all(writer.id);
     if (writer.resources.some(
-      (resource) => !rows.some((row) => row.id === resource.id && row.kind === resource.kind)
+      (resource) => !rows.some((row2) => row2.id === resource.id && row2.kind === resource.kind)
     ))
       return false;
-    for (const row of rows) {
-      if (!await this.cleanupResource(row.id)) return false;
+    for (const row2 of rows) {
+      if (!await this.cleanupResource(row2.id)) return false;
     }
     return true;
   }
 };
 
 // ../daemon/src/lib/coding-environment/workspace.ts
-import { randomUUID as randomUUID25 } from "crypto";
+import { randomUUID as randomUUID26 } from "crypto";
 import { realpathSync as realpathSync3 } from "fs";
 import { isAbsolute as isAbsolute3, relative as relative2 } from "path";
 var WorkspaceBusyError = class extends Error {
@@ -28462,15 +28694,15 @@ function workspaceIdentity(registeredRoot) {
     directory.close();
   }
 }
-function view(row) {
+function view(row2) {
   return {
-    id: row.id,
-    teamId: row.team_id,
-    root: row.root_path,
-    rootIdentity: row.root_identity,
-    kind: row.kind,
-    resources: JSON.parse(row.resources_json),
-    ...row.recovery_mode === "restored" ? { restored: true } : {}
+    id: row2.id,
+    teamId: row2.team_id,
+    root: row2.root_path,
+    rootIdentity: row2.root_identity,
+    kind: row2.kind,
+    resources: JSON.parse(row2.resources_json),
+    ...row2.recovery_mode === "restored" ? { restored: true } : {}
   };
 }
 var WorkspaceCoordinator = class {
@@ -28478,7 +28710,7 @@ var WorkspaceCoordinator = class {
     this.db = db;
   }
   db;
-  identity = randomUUID25();
+  identity = randomUUID26();
   leases = /* @__PURE__ */ new Set();
   issued = /* @__PURE__ */ new WeakSet();
   claim(teamId, registeredRoot, kind) {
@@ -28486,13 +28718,13 @@ var WorkspaceCoordinator = class {
     return inTx(this.db, () => {
       const exclusive = true;
       const rows = this.db.raw.query("SELECT * FROM workspace_writers").all();
-      for (const row of rows) {
-        if (!(row.recovery_mode === "restored" && row.team_id === teamId) && !overlappingWorkspaceRoots(row.root_path, root.root) && row.root_identity !== root.rootIdentity)
+      for (const row2 of rows) {
+        if (!(row2.recovery_mode === "restored" && row2.team_id === teamId) && !overlappingWorkspaceRoots(row2.root_path, root.root) && row2.root_identity !== root.rootIdentity)
           continue;
-        const recovery = row.daemon_identity !== this.identity || row.state === "recovery";
-        if (recovery || exclusive || row.exclusive === 1) throw new WorkspaceBusyError(recovery);
+        const recovery = row2.daemon_identity !== this.identity || row2.state === "recovery";
+        if (recovery || exclusive || row2.exclusive === 1) throw new WorkspaceBusyError(recovery);
       }
-      const id = randomUUID25();
+      const id = randomUUID26();
       this.db.raw.run(
         `INSERT INTO workspace_writers
         (id, team_id, root_path, root_identity, daemon_identity, kind, exclusive, state, created_at)
@@ -28527,21 +28759,21 @@ var WorkspaceCoordinator = class {
   }
   /** The recovery host must terminate/reap each recorded resource before acknowledging it. */
   async recover(writerId, teardown) {
-    const row = this.db.raw.query("SELECT * FROM workspace_writers WHERE id = ?").get(writerId);
-    if (!row) return true;
-    if (row.recovery_mode === "restored") return false;
-    if (this.leases.has(writerId) || row.daemon_identity === this.identity && row.state === "active")
+    const row2 = this.db.raw.query("SELECT * FROM workspace_writers WHERE id = ?").get(writerId);
+    if (!row2) return true;
+    if (row2.recovery_mode === "restored") return false;
+    if (this.leases.has(writerId) || row2.daemon_identity === this.identity && row2.state === "active")
       throw new WorkspaceBusyError();
     this.db.raw.run("UPDATE workspace_writers SET state = 'recovery' WHERE id = ?", [writerId]);
-    if (!await teardown(view(row))) return false;
+    if (!await teardown(view(row2))) return false;
     this.db.raw.run("DELETE FROM workspace_writers WHERE id = ? AND state = 'recovery'", [writerId]);
     return true;
   }
   attach(id, resource) {
     if (!this.leases.has(id)) throw new Error("Workspace lease is no longer active");
-    const row = this.db.raw.query("SELECT * FROM workspace_writers WHERE id = ?").get(id);
-    if (row?.state !== "active") throw new Error("Workspace lease requires recovery");
-    const resources2 = JSON.parse(row.resources_json);
+    const row2 = this.db.raw.query("SELECT * FROM workspace_writers WHERE id = ?").get(id);
+    if (row2?.state !== "active") throw new Error("Workspace lease requires recovery");
+    const resources2 = JSON.parse(row2.resources_json);
     if (resources2.some((item) => item.kind === resource.kind && item.id === resource.id)) return;
     resources2.push(resource);
     this.db.raw.run("UPDATE workspace_writers SET resources_json = ? WHERE id = ?", [
@@ -28611,7 +28843,7 @@ var WorkspaceLifecycle = class {
     const prefix = `bazilion-${lease.writer.id}-`;
     const records2 = /* @__PURE__ */ new Map();
     return {
-      name: (kind) => `${prefix}${kind}-${randomUUID26()}`,
+      name: (kind) => `${prefix}${kind}-${randomUUID27()}`,
       beforeCreate: async (identity2) => {
         if (!identity2.containerName.startsWith(prefix) || !/^bazilion-[a-z0-9-]{1,160}$/.test(identity2.containerName) || records2.has(identity2.containerName))
           throw new Error("Invalid turn container identity");
@@ -28646,7 +28878,7 @@ var WorkspaceLifecycle = class {
 };
 
 // ../daemon/src/lib/conversation-target.ts
-import { randomUUID as randomUUID28 } from "crypto";
+import { randomUUID as randomUUID29 } from "crypto";
 
 // ../daemon/src/core/repos/conversations.ts
 var columns = "id, agent_id AS agentId, title, title_revision AS titleRevision, created_at AS createdAt, updated_at AS updatedAt";
@@ -28681,11 +28913,11 @@ function get20(db, agentId, id) {
   ).get(agentId, id);
 }
 function filename(db, agentId, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT filename FROM agent_conversations WHERE agent_id = ? AND id = ?"
   ).get(agentId, id);
-  if (!row) throw new Error("Conversation not found");
-  return row.filename;
+  if (!row2) throw new Error("Conversation not found");
+  return row2.filename;
 }
 function list14(db, agentId, limit = 20, offset = 0) {
   if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100 || !Number.isSafeInteger(offset) || offset < 0)
@@ -28768,7 +29000,7 @@ function rename(db, agentId, id, value, expectedRevision) {
 }
 
 // ../daemon/src/lib/conversation-file.ts
-import { randomUUID as randomUUID27 } from "crypto";
+import { randomUUID as randomUUID28 } from "crypto";
 import {
   closeSync as closeSync4,
   constants as constants4,
@@ -28818,7 +29050,7 @@ function readCanonicalSessionFile(directory, filename2, sessionId, minimumEntryO
     const header = entries[0]?.entry;
     if (header?.type !== "session" || header.id !== sessionId)
       throw new Error("Result source session does not match the active Agent session");
-    return entries.filter((row, index) => index === 0 || row.offset >= minimumEntryOffset).map((row) => row.entry);
+    return entries.filter((row2, index) => index === 0 || row2.offset >= minimumEntryOffset).map((row2) => row2.entry);
   } finally {
     closeSync3(fd);
   }
@@ -28833,7 +29065,7 @@ function createConversationFile(paths2, agentId, conversationId, cwd) {
   if (realpathSync5(directory) !== directory) throw new Error("Conversation escaped its Agent");
   const filename2 = `${conversationId}.jsonl`;
   const destination = join16(directory, filename2);
-  const staging = join16(directory, `.conversation-${randomUUID27()}.tmp`);
+  const staging = join16(directory, `.conversation-${randomUUID28()}.tmp`);
   const header = SessionManager.inMemory(cwd, { id: conversationId }).getHeader();
   const fd = openSync4(staging, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL, 384);
   try {
@@ -28871,7 +29103,7 @@ function resolveConversationTarget(db, paths2, agentId, pinnedId) {
       db,
       agentId,
       {
-        requestId: randomUUID28(),
+        requestId: randomUUID29(),
         expectedSelection: { conversationId: null, revision: 0 }
       },
       (newId) => createConversationFile(paths2, agentId, newId, agent.team.path)
@@ -28938,22 +29170,22 @@ async function runAgentLifecycleMutation(agentId, mutation) {
 }
 
 // ../daemon/src/lib/agent-loop-guard.ts
-import { randomUUID as randomUUID29 } from "crypto";
+import { randomUUID as randomUUID30 } from "crypto";
 var DEFAULT_MAX_HOPS = 8;
-function toEvent(row) {
+function toEvent(row2) {
   return {
-    id: row.id,
-    causalChainId: row.causal_chain_id,
-    parentMessageId: row.parent_message_id,
-    fromAgentId: row.from_agent_id,
-    toAgentId: row.to_agent_id,
-    sourceTeamId: row.source_team_id,
-    targetTeamId: row.target_team_id,
-    attemptedHop: row.attempted_hop,
-    maxHops: row.max_hops,
-    reason: row.reason,
-    origin: row.origin,
-    createdAt: row.created_at
+    id: row2.id,
+    causalChainId: row2.causal_chain_id,
+    parentMessageId: row2.parent_message_id,
+    fromAgentId: row2.from_agent_id,
+    toAgentId: row2.to_agent_id,
+    sourceTeamId: row2.source_team_id,
+    targetTeamId: row2.target_team_id,
+    attemptedHop: row2.attempted_hop,
+    maxHops: row2.max_hops,
+    reason: row2.reason,
+    origin: row2.origin,
+    createdAt: row2.created_at
   };
 }
 function agentLoopMaxHops(db, env = process.env) {
@@ -28990,8 +29222,8 @@ function enforceMessageCausality(db, input) {
   const target = agents_exports.get(db, input.to);
   if (!source || !target) return null;
   const event2 = {
-    id: randomUUID29(),
-    causalChainId: input.causality.causalChainId ?? input.causality.parentMessageId ?? randomUUID29(),
+    id: randomUUID30(),
+    causalChainId: input.causality.causalChainId ?? input.causality.parentMessageId ?? randomUUID30(),
     parentMessageId: input.causality.parentMessageId,
     fromAgentId: input.from,
     toAgentId: input.to,
@@ -30384,8 +30616,8 @@ function assertRepositoryContext(value, teamId) {
     throw new Error("Invalid repository context report");
   const instructions = value.instructions;
   const commands = value.commands;
-  const git = value.git;
-  if (!keys(instructions, ["state", "issues", "files"]) || !keys(commands, ["state", "issues", "sources", "candidates"]) || !keys(git, [
+  const git2 = value.git;
+  if (!keys(instructions, ["state", "issues", "files"]) || !keys(commands, ["state", "issues", "sources", "candidates"]) || !keys(git2, [
     "state",
     "root",
     "branch",
@@ -30416,7 +30648,7 @@ function assertRepositoryContext(value, teamId) {
       "kind",
       "packageManager"
     ]) && string(candidate.source) && digest3(candidate.sha256) && string(candidate.location) && string(candidate.cwd) && string(candidate.command) && ["script", "excerpt"].includes(String(candidate.kind)) && [null, "npm", "pnpm", "yarn"].includes(candidate.packageManager)
-  ) || !["available", "unavailable", "not_repository"].includes(String(git.state)) || ![null, "branch", "detached", "unborn"].includes(git.headState) || ![git.root, git.branch, git.head].every((value2) => value2 === null || string(value2)) || ![git.staged, git.unstaged, git.untracked, git.conflicted].every(count2) || !list15(git.issues, 128, issue))
+  ) || !["available", "unavailable", "not_repository"].includes(String(git2.state)) || ![null, "branch", "detached", "unborn"].includes(git2.headState) || ![git2.root, git2.branch, git2.head].every((value2) => value2 === null || string(value2)) || ![git2.staged, git2.unstaged, git2.untracked, git2.conflicted].every(count2) || !list15(git2.issues, 128, issue))
     throw new Error("Invalid repository context report");
   const report2 = value;
   if (report2.instructions.files.reduce((bytes, file) => bytes + Buffer.byteLength(file.content), 0) > 128 * 1024 || report2.instructions.state === "complete" && (report2.rootIdentity === null || report2.instructions.issues.length > 0))
@@ -36214,7 +36446,7 @@ function createBrowserHost(config2) {
 }
 
 // ../daemon/src/lib/coding-environment/agent-host.ts
-import { createHash as createHash10, randomUUID as randomUUID32 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID33 } from "crypto";
 
 // ../daemon/src/core/repos/coding-command-logs.ts
 var CODING_LOG_BYTES = 2 * 1024 * 1024;
@@ -36233,38 +36465,38 @@ function headBytes(value, limit) {
 function mayDisclose(view2, audience) {
   return audience === "producer" || view2.releasedAt !== null;
 }
-var COLUMNS = `command_id, team_id, agent_id, turn_id, tool_call_id, state, text,
+var COLUMNS2 = `command_id, team_id, agent_id, turn_id, tool_call_id, state, text,
   byte_length, observed_bytes, redacted, truncated, created_at, expires_at, released_at, retired_at`;
-function expiryDue(row, now) {
-  return row.state === "retained" && row.expires_at <= now;
+function expiryDue(row2, now) {
+  return row2.state === "retained" && row2.expires_at <= now;
 }
-function liveText(row, now) {
-  return row.state === "retained" && !expiryDue(row, now) ? row.text : null;
+function liveText(row2, now) {
+  return row2.state === "retained" && !expiryDue(row2, now) ? row2.text : null;
 }
-function availabilityOf(row, now) {
-  if (row.state === "deleted") return "deleted";
-  if (row.state === "expired" || expiryDue(row, now)) return "expired";
-  return row.truncated === 1 ? "truncated" : "available";
+function availabilityOf(row2, now) {
+  if (row2.state === "deleted") return "deleted";
+  if (row2.state === "expired" || expiryDue(row2, now)) return "expired";
+  return row2.truncated === 1 ? "truncated" : "available";
 }
-function toView(row, now) {
+function toView(row2, now) {
   return {
-    commandId: row.command_id,
-    teamId: row.team_id,
-    agentId: row.agent_id,
-    turnId: row.turn_id,
-    toolCallId: row.tool_call_id,
-    availability: availabilityOf(row, now),
-    byteLength: row.byte_length,
-    observedBytes: row.observed_bytes,
-    redacted: row.redacted === 1,
-    createdAt: row.created_at,
-    expiresAt: row.expires_at,
-    releasedAt: row.released_at,
-    retiredAt: row.retired_at
+    commandId: row2.command_id,
+    teamId: row2.team_id,
+    agentId: row2.agent_id,
+    turnId: row2.turn_id,
+    toolCallId: row2.tool_call_id,
+    availability: availabilityOf(row2, now),
+    byteLength: row2.byte_length,
+    observedBytes: row2.observed_bytes,
+    redacted: row2.redacted === 1,
+    createdAt: row2.created_at,
+    expiresAt: row2.expires_at,
+    releasedAt: row2.released_at,
+    retiredAt: row2.retired_at
   };
 }
 function rowFor(db, commandId) {
-  return db.raw.query(`SELECT ${COLUMNS} FROM coding_command_logs WHERE command_id = ?`).get(commandId) ?? null;
+  return db.raw.query(`SELECT ${COLUMNS2} FROM coding_command_logs WHERE command_id = ?`).get(commandId) ?? null;
 }
 function unavailableLog(commandId) {
   return {
@@ -36284,8 +36516,8 @@ function unavailableLog(commandId) {
   };
 }
 function getCodingCommandLog(db, commandId, now = Date.now()) {
-  const row = rowFor(db, commandId);
-  return row ? toView(row, now) : unavailableLog(commandId);
+  const row2 = rowFor(db, commandId);
+  return row2 ? toView(row2, now) : unavailableLog(commandId);
 }
 function saveCodingCommandLog(db, input) {
   const now = input.now ?? Date.now();
@@ -36294,7 +36526,7 @@ function saveCodingCommandLog(db, input) {
   const observed = Math.max(input.observedBytes, byteLength);
   const truncated = retained.truncated || input.truncated || !input.redacted && input.observedBytes > byteLength;
   db.raw.run(
-    `INSERT INTO coding_command_logs (${COLUMNS})
+    `INSERT INTO coding_command_logs (${COLUMNS2})
      VALUES (?, ?, ?, ?, ?, 'retained', ?, ?, ?, ?, ?, ?, ?, NULL, NULL)
      ON CONFLICT(command_id) DO UPDATE SET
        state = 'retained',
@@ -36344,10 +36576,10 @@ function releaseCodingCommandLog(db, commandId, now = Date.now()) {
 function readCodingCommandLog(db, commandId, options, now = Date.now()) {
   const view2 = getCodingCommandLog(db, commandId, now);
   if (!mayDisclose(view2, options.audience)) return null;
-  const row = rowFor(db, commandId);
+  const row2 = rowFor(db, commandId);
   const limit = Math.min(Math.max(options.limit ?? CODING_LOG_PAGE_BYTES, 1), CODING_LOG_BYTES);
-  const text3 = row ? liveText(row, now) : null;
-  if (!row || text3 === null) {
+  const text3 = row2 ? liveText(row2, now) : null;
+  if (!row2 || text3 === null) {
     return {
       commandId,
       availability: view2.availability,
@@ -36374,14 +36606,14 @@ function readCodingCommandLog(db, commandId, options, now = Date.now()) {
 function searchCodingCommandLog(db, commandId, needle, options, now = Date.now()) {
   const view2 = getCodingCommandLog(db, commandId, now);
   if (!mayDisclose(view2, options.audience)) return null;
-  const row = rowFor(db, commandId);
+  const row2 = rowFor(db, commandId);
   const empty = {
     commandId,
     availability: view2.availability,
     matches: [],
     bounded: false
   };
-  const text3 = row ? liveText(row, now) : null;
+  const text3 = row2 ? liveText(row2, now) : null;
   if (text3 === null || !needle) return empty;
   const scanned = Buffer.byteLength(text3) > CODING_LOG_SEARCH_SCAN_BYTES;
   const haystack = scanned ? headBytes(text3, CODING_LOG_SEARCH_SCAN_BYTES) : text3;
@@ -36434,7 +36666,7 @@ function pruneCodingCommandLogs(db, now = Date.now(), budgetBytes = CODING_LOG_H
 }
 
 // ../daemon/src/lib/communication.ts
-import { randomUUID as randomUUID31 } from "crypto";
+import { randomUUID as randomUUID32 } from "crypto";
 
 // ../daemon/src/lib/question-approval.ts
 function questionApprovalReference(snapshot, kind) {
@@ -36529,7 +36761,7 @@ function questionVisible(db, item) {
 }
 
 // ../daemon/src/core/repos/results.ts
-import { createHash as createHash9, randomUUID as randomUUID30 } from "crypto";
+import { createHash as createHash9, randomUUID as randomUUID31 } from "crypto";
 var MAX_RESULT_BYTES = 25 * 1024 * 1024;
 var MAX_RETAINED_RESULT_BYTES = 1024 * 1024 * 1024;
 var columns2 = `id, team_id AS teamId, agent_id AS agentId, source_kind AS sourceKind,
@@ -36592,7 +36824,7 @@ function publish(db, input) {
         "Result storage is full (1 GiB). Delete saved results before delivering more files."
       );
     }
-    const id = randomUUID30();
+    const id = randomUUID31();
     db.raw.run(
       `INSERT INTO agent_results
       (id, team_id, agent_id, source_kind, session_id, tool_call_id, review_packet_id, review_revision,
@@ -36660,12 +36892,12 @@ function listReleased(db, opts = {}) {
   return { results, total, limit, offset };
 }
 function readCaptured(db, id) {
-  const row = db.raw.query(
+  const row2 = db.raw.query(
     "SELECT bytes, byte_length, sha256 FROM agent_results WHERE id = ? AND deleted_at IS NULL"
   ).get(id);
-  if (!row) throw new Error("Captured result is unavailable");
-  const bytes = Buffer.from(row.bytes);
-  if (bytes.byteLength !== row.byte_length || createHash9("sha256").update(bytes).digest("hex") !== row.sha256) {
+  if (!row2) throw new Error("Captured result is unavailable");
+  const bytes = Buffer.from(row2.bytes);
+  if (bytes.byteLength !== row2.byte_length || createHash9("sha256").update(bytes).digest("hex") !== row2.sha256) {
     throw new Error("Captured result failed integrity verification");
   }
   return bytes;
@@ -36912,7 +37144,7 @@ function isUserFacingFrame(frame) {
 }
 function sendAgentMessage(db, input) {
   const attemptKind = input.attemptKind ?? "agent_tool";
-  const attemptId = input.attemptId ?? randomUUID31();
+  const attemptId = input.attemptId ?? randomUUID32();
   const outcome = db.raw.transaction(
     () => {
       const causality = resolveMessageCausality(db, input);
@@ -37241,29 +37473,29 @@ function claimDeliverableInbox(db, agentId, onAllowed, conversationId) {
 
 // ../daemon/src/core/repos/source-snapshots.ts
 var SOURCE_SNAPSHOT_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
-var COLUMNS2 = "snapshot_id, team_id, captured_by, agent_id, turn_id, tool_call_id, complete, head, base_oid, entry_count, captured_content_bytes, manifest_json, created_at, expires_at";
-function toRecord(row) {
+var COLUMNS3 = "snapshot_id, team_id, captured_by, agent_id, turn_id, tool_call_id, complete, head, base_oid, entry_count, captured_content_bytes, manifest_json, created_at, expires_at";
+function toRecord2(row2) {
   return {
-    snapshotId: row.snapshot_id,
-    teamId: row.team_id,
-    capturedBy: row.captured_by === "agent" ? "agent" : "operator",
-    agentId: row.agent_id,
-    turnId: row.turn_id,
-    toolCallId: row.tool_call_id,
-    complete: row.complete === 1,
-    head: row.head,
-    baseOid: row.base_oid,
-    entryCount: row.entry_count,
-    capturedContentBytes: row.captured_content_bytes,
-    manifestJson: row.manifest_json,
-    createdAt: row.created_at,
-    expiresAt: row.expires_at
+    snapshotId: row2.snapshot_id,
+    teamId: row2.team_id,
+    capturedBy: row2.captured_by === "agent" ? "agent" : "operator",
+    agentId: row2.agent_id,
+    turnId: row2.turn_id,
+    toolCallId: row2.tool_call_id,
+    complete: row2.complete === 1,
+    head: row2.head,
+    baseOid: row2.base_oid,
+    entryCount: row2.entry_count,
+    capturedContentBytes: row2.captured_content_bytes,
+    manifestJson: row2.manifest_json,
+    createdAt: row2.created_at,
+    expiresAt: row2.expires_at
   };
 }
 function saveSourceSnapshot(db, input) {
   const now = input.now ?? Date.now();
   db.raw.run(
-    `INSERT INTO source_snapshots (${COLUMNS2})
+    `INSERT INTO source_snapshots (${COLUMNS3})
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
      ON CONFLICT(snapshot_id, team_id) DO NOTHING`,
     [
@@ -37286,11 +37518,11 @@ function saveSourceSnapshot(db, input) {
   pruneSourceSnapshots(db, now);
 }
 function getSourceSnapshot(db, teamId, snapshotId, now = Date.now()) {
-  const row = db.raw.query(
-    `SELECT ${COLUMNS2} FROM source_snapshots
+  const row2 = db.raw.query(
+    `SELECT ${COLUMNS3} FROM source_snapshots
        WHERE team_id = ? AND snapshot_id = ? AND expires_at > ?`
   ).get(teamId, snapshotId, now);
-  return row ? toRecord(row) : null;
+  return row2 ? toRecord2(row2) : null;
 }
 function pruneSourceSnapshots(db, now = Date.now()) {
   const result = db.raw.run("DELETE FROM source_snapshots WHERE expires_at <= ?", [now]);
@@ -37298,10 +37530,10 @@ function pruneSourceSnapshots(db, now = Date.now()) {
 }
 function listSourceSnapshots(db, teamId, limit = 50, now = Date.now()) {
   return db.raw.query(
-    `SELECT ${COLUMNS2} FROM source_snapshots
+    `SELECT ${COLUMNS3} FROM source_snapshots
        WHERE team_id = ? AND expires_at > ?
        ORDER BY created_at DESC, snapshot_id LIMIT ?`
-  ).all(teamId, now, limit).map(toRecord);
+  ).all(teamId, now, limit).map(toRecord2);
 }
 
 // ../daemon/src/lib/git/capture.ts
@@ -37327,13 +37559,13 @@ async function captureRepositoryGit(root, budgetMs = INSPECTION_BUDGET_MS) {
   const marker = root.entry(".git");
   if (!marker?.isDirectory() || marker.isSymbolicLink())
     throw new ContextReadError("unsupported_git_metadata");
-  const git = root.directory(".git");
-  if (git.entry("commondir") || git.entry("gitdir")) {
+  const git2 = root.directory(".git");
+  if (git2.entry("commondir") || git2.entry("gitdir")) {
     throw new ContextReadError("unsupported_git_metadata");
   }
-  const info = git.entry("info");
+  const info = git2.entry("info");
   if (info) {
-    const dir = git.directory("info");
+    const dir = git2.directory("info");
     if (dir.entry("sparse-checkout")) throw new ContextReadError("unsupported_git_metadata");
   }
   const scratch = mkdtempSync4(join25(tmpdir4(), "bazilion-context-git-"));
@@ -37387,7 +37619,7 @@ async function captureRepositoryGit(root, budgetMs = INSPECTION_BUDGET_MS) {
       ...args
     ];
     const runGit = (args) => rawGit(inspectionArgs(args));
-    const capturedConfig = git.read("config", METADATA_READ);
+    const capturedConfig = git2.read("config", METADATA_READ);
     const configLines = ["[core]", "repositoryformatversion = 0", "bare = false", "filemode = true"];
     if (capturedConfig) {
       bytes += capturedConfig.length;
@@ -37442,7 +37674,7 @@ objectformat = ${value}`
       }
     }
     if (info) {
-      const exclude = git.directory("info").read("exclude", METADATA_READ);
+      const exclude = git2.directory("info").read("exclude", METADATA_READ);
       if (exclude) {
         bytes += exclude.length;
         mkdirSync9(join25(scratch, "info"), { mode: 448 });
@@ -37470,7 +37702,7 @@ objectformat = ${value}`
       }
     };
     for (const name of ["HEAD", "index", "packed-refs", "shallow"]) {
-      const content = git.read(name, Math.min(METADATA_READ_LARGE, METADATA_BYTES - bytes));
+      const content = git2.read(name, Math.min(METADATA_READ_LARGE, METADATA_BYTES - bytes));
       if (content) {
         count3++;
         bytes += content.length;
@@ -37479,13 +37711,13 @@ objectformat = ${value}`
     }
     for (const name of ["refs", "objects"]) {
       mkdirSync9(join25(scratch, name), { mode: 448 });
-      if (git.entry(name)) copy(git.directory(name), join25(scratch, name), 0);
+      if (git2.entry(name)) copy(git2.directory(name), join25(scratch, name), 0);
     }
-    if (git.list().some((name) => name.startsWith("sharedindex.")))
+    if (git2.list().some((name) => name.startsWith("sharedindex.")))
       throw new ContextReadError("unsupported_git_metadata");
     writeFileSync12(join25(scratch, "config"), `${configLines.join("\n")}
 `, { mode: 384 });
-    const validate2 = () => git.validate();
+    const validate2 = () => git2.validate();
     validate2();
     return { root, runGit, validate: validate2, cleanup };
   } catch (error2) {
@@ -37512,6 +37744,23 @@ var REVIEW_LIMITS2 = {
   patchBytes: 256 * 1024
 };
 
+// ../../packages/api-types/src/publication.ts
+var PUBLICATION_LIMITS = {
+  repository: 200,
+  branch: 200,
+  commitMessage: 2e3,
+  refusalDetail: 400,
+  error: 400,
+  /** Branches that are never published to, whatever the host says. */
+  protectedBranches: ["main", "master", "trunk", "develop", "release"]
+};
+
+// ../../packages/api-types/src/verification.ts
+var VERIFICATION_OUTCOME_LIMITS = [
+  "Facts above are executor-owned. A non-zero exit is a result about the commands that ran, never proof about later code, and this is not an approval to publish, merge or deploy.",
+  "Declared output paths are not enforced, so a change they do not cover appears above rather than being prevented."
+];
+
 // ../../packages/api-types/src/index.ts
 var PROFILE_FILES = [
   "profile.json",
@@ -38696,15 +38945,15 @@ function createCodingHost(input) {
           throw new Error("Command contains protected credential material");
         starting = true;
         try {
-          const environment = await snapshot(command.cwd);
+          const environment2 = await snapshot(command.cwd);
           const receipt = {
-            id: randomUUID32(),
+            id: randomUUID33(),
             agentId: input.agentId,
             teamId: input.teamId,
             turnId: input.turnId,
             toolCallId: raw2.toolCallId,
             input: command,
-            environment,
+            environment: environment2,
             startedAt: Date.now(),
             finishedAt: null,
             state: "running",
@@ -39033,7 +39282,7 @@ function createDbMessagingHost(db, opts = {}) {
 }
 
 // ../daemon/src/lib/question-service.ts
-import { randomUUID as randomUUID34 } from "crypto";
+import { randomUUID as randomUUID35 } from "crypto";
 
 // ../daemon/src/lib/question-consumption.ts
 import { isDeepStrictEqual } from "util";
@@ -39089,8 +39338,8 @@ function key(db, create7) {
     db.raw.run("INSERT OR IGNORE INTO question_receipt_key (singleton, key) VALUES (1, ?)", [
       randomBytes5(32)
     ]);
-  const row = db.raw.query("SELECT key FROM question_receipt_key WHERE singleton = 1").get();
-  return row ? Buffer.from(row.key) : null;
+  const row2 = db.raw.query("SELECT key FROM question_receipt_key WHERE singleton = 1").get();
+  return row2 ? Buffer.from(row2.key) : null;
 }
 function signQuestionReceipt(db, agentId, result) {
   const item = get18(db, agentId, result.questionId);
@@ -39561,7 +39810,7 @@ function parseTelegramQuestionReply(db, authToken, update3) {
 }
 
 // ../daemon/src/lib/attachments.ts
-import { randomUUID as randomUUID33 } from "crypto";
+import { randomUUID as randomUUID34 } from "crypto";
 import { closeSync as closeSync9, constants as constants10, fstatSync as fstatSync7, openSync as openSync9, writeFileSync as writeFileSync13 } from "fs";
 import { join as join26, posix } from "path";
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
@@ -39588,7 +39837,7 @@ function saveInputFiles(agentDir, files, options = {}) {
       lines.push(`[attachment "${label}" skipped: too large (${fmtBytes(buf.byteLength)} > 25 MB)]`);
       continue;
     }
-    const filename2 = `${randomUUID33().slice(0, 8)}-${safeName(label)}`;
+    const filename2 = `${randomUUID34().slice(0, 8)}-${safeName(label)}`;
     const path = join26(dir, filename2);
     let fd;
     try {
@@ -39618,13 +39867,13 @@ var CodingEnvironmentRevisionError = class extends Error {
   }
 };
 function getCodingEnvironment(db, teamId) {
-  const row = db.raw.query("SELECT * FROM team_coding_environments WHERE team_id = ?").get(teamId);
-  if (!row) return null;
+  const row2 = db.raw.query("SELECT * FROM team_coding_environments WHERE team_id = ?").get(teamId);
+  if (!row2) return null;
   return {
-    teamId: row.team_id,
-    revision: row.revision,
-    config: validateCodingEnvironmentConfig(JSON.parse(row.config_json)),
-    updatedAt: row.updated_at
+    teamId: row2.team_id,
+    revision: row2.revision,
+    config: validateCodingEnvironmentConfig(JSON.parse(row2.config_json)),
+    updatedAt: row2.updated_at
   };
 }
 function putCodingEnvironment(db, teamId, expectedRevision, input) {
@@ -39649,14 +39898,14 @@ function putCodingEnvironment(db, teamId, expectedRevision, input) {
 // ../daemon/src/lib/coding-environment/resolve.ts
 function resolveTeamCodingEnvironment(db, teamId, env) {
   const fallback = resolveShellSecurityConfig(env).sandboxImage;
-  const environment = getCodingEnvironment(db, teamId);
-  if (!environment) return { image: fallback };
+  const environment2 = getCodingEnvironment(db, teamId);
+  if (!environment2) return { image: fallback };
   return {
-    image: environment.config.image,
+    image: environment2.config.image,
     coding: validateDockerCodingSelection({
-      revision: environment.revision,
-      cwd: environment.config.cwd,
-      env: environment.config.env
+      revision: environment2.revision,
+      cwd: environment2.config.cwd,
+      env: environment2.config.env
     })
   };
 }
@@ -40461,7 +40710,7 @@ var QuestionService = class {
       turn.conversation.id
     ).length;
     this.#attached.add(turn);
-    const turnId = randomUUID34();
+    const turnId = randomUUID35();
     const listeners = /* @__PURE__ */ new Set();
     if (onQuestion) listeners.add(onQuestion);
     this.#turns.set(turnId, {
@@ -42505,7 +42754,7 @@ function renderTable(token) {
   const widths = [];
   for (let c = 0; c < cols; c++) {
     let w2 = headers[c]?.length ?? 0;
-    for (const row of rows) w2 = Math.max(w2, row[c]?.length ?? 0);
+    for (const row2 of rows) w2 = Math.max(w2, row2[c]?.length ?? 0);
     widths[c] = w2;
   }
   const fmt = (cells) => cells.map((cell, c) => c === cols - 1 ? cell : cell.padEnd(widths[c] ?? 0)).join("  ").trimEnd();
@@ -43028,15 +43277,15 @@ function captureVerificationRequest(db, paths2, intent, env = process.env) {
       "the captured change has incomplete coverage, so a result could not be tied to it"
     );
   }
-  const environment = admittedEnvironment(db, team.id, env);
-  if (!environment) {
+  const environment2 = admittedEnvironment(db, team.id, env);
+  if (!environment2) {
     return blocked2(
       "environment_unavailable",
       "the Team has no usable admitted environment to freeze with the request"
     );
   }
   if (intent.writablePaths && intent.writablePaths.length > 0) {
-    const bounded3 = [];
+    const bounded4 = [];
     for (const path of intent.writablePaths) {
       if (typeof path !== "string" || path.length === 0 || path.length > 1e3) {
         return blocked2("unsupported", "declared writable paths are outside their bounded contract");
@@ -43051,12 +43300,22 @@ function captureVerificationRequest(db, paths2, intent, env = process.env) {
           `declared writable path must be inside the workspace: ${path}`
         );
       }
-      bounded3.push(parts.join("/"));
+      bounded4.push(parts.join("/"));
     }
-    if (bounded3.length > 16) {
+    if (bounded4.length > 16) {
       return blocked2("unsupported", "too many declared writable paths");
     }
-    environment.writablePaths = bounded3;
+    environment2.writablePaths = bounded4;
+  }
+  for (const check of intent.checks) {
+    try {
+      codingRelativePath(check.cwd);
+    } catch {
+      return blocked2(
+        "unsupported",
+        `a check working directory must be a path inside the workspace: ${String(check.cwd)}`
+      );
+    }
   }
   try {
     const request2 = createVerificationRequest(db, {
@@ -43070,7 +43329,7 @@ function captureVerificationRequest(db, paths2, intent, env = process.env) {
       snapshotComplete: snapshot.complete,
       head: snapshot.head,
       baseOid: snapshot.baseOid,
-      environment,
+      environment: environment2,
       summary: intent.summary ?? null,
       checks: intent.checks
     });
@@ -43566,7 +43825,7 @@ function bound(value) {
 }
 
 // ../daemon/src/lib/review/dispatch.ts
-import { randomUUID as randomUUID35 } from "crypto";
+import { randomUUID as randomUUID36 } from "crypto";
 
 // ../daemon/src/lib/review/preparation.ts
 async function prepareChangeReviewTurn(input) {
@@ -43785,6 +44044,25 @@ async function readRevisionPatch(db, paths2, packet, path) {
   }
   return { path, patch: change.patch, truncated: change.patchTruncated, reason: null };
 }
+async function readRevisionContentAvailability(db, paths2, packet) {
+  let comparison = null;
+  try {
+    const applicability = await readSnapshotApplicability(
+      db,
+      paths2,
+      packet.teamId,
+      packet.snapshotId
+    );
+    comparison = applicability.comparison;
+  } catch {
+    comparison = null;
+  }
+  if (comparison === "identical") return { contentAvailable: true, contentUnavailableReason: null };
+  return {
+    contentAvailable: false,
+    contentUnavailableReason: comparison === "changed" ? "the working tree changed after the capture, so the reviewed revision\u2019s content is no longer reproducible" : "the reviewed revision could not be compared with the working tree"
+  };
+}
 
 // ../daemon/src/lib/review/reviewer-capability.ts
 function createReviewCapabilityHost(input) {
@@ -43798,17 +44076,15 @@ function createReviewCapabilityHost(input) {
         contentUnavailableReason: revision4.reason
       };
     }
-    const applicability = await readSnapshotApplicability(
+    const { contentAvailable, contentUnavailableReason } = await readRevisionContentAvailability(
       input.db,
       input.paths,
-      packet.teamId,
-      packet.snapshotId
-    ).catch(() => null);
-    const contentAvailable = applicability?.comparison === "identical";
+      packet
+    );
     return {
       changes: revision4.changes,
       contentAvailable,
-      contentUnavailableReason: contentAvailable ? null : applicability?.comparison === "changed" ? "the working tree changed after the capture, so the reviewed revision\u2019s content is no longer reproducible" : "the reviewed revision could not be compared with the working tree"
+      contentUnavailableReason
     };
   }
   return {
@@ -43912,7 +44188,7 @@ function refused(message) {
 }
 
 // ../daemon/src/lib/review/dispatch.ts
-var REVIEW_DISPATCH_OWNER = randomUUID35();
+var REVIEW_DISPATCH_OWNER = randomUUID36();
 var REVIEW_LEASE_MS = 10 * 60 * 1e3;
 var dispatchRegistry = () => {
   const global2 = globalThis;
@@ -44100,10 +44376,10 @@ function buildReviewDigest(input, options = {}) {
   }
   selected.reverse();
   const firstUserIndex = selected.findIndex((entry) => entry.role === "user");
-  const bounded3 = firstUserIndex >= 0 ? selected.slice(firstUserIndex) : selected;
-  characters = bounded3.reduce((total, entry) => total + entry.text.length, 0);
-  const first = bounded3[0];
-  const last = bounded3.at(-1);
+  const bounded4 = firstUserIndex >= 0 ? selected.slice(firstUserIndex) : selected;
+  characters = bounded4.reduce((total, entry) => total + entry.text.length, 0);
+  const first = bounded4[0];
+  const last = bounded4.at(-1);
   if (!first || !last) return null;
   return {
     sessionId: last.sessionId,
@@ -44111,7 +44387,7 @@ function buildReviewDigest(input, options = {}) {
     endOrdinal: last.ordinal,
     inputCharacters: characters,
     turnsReviewed: userTurns,
-    entries: bounded3
+    entries: bounded4
   };
 }
 
@@ -44353,9 +44629,9 @@ async function dispatchClaimableReviews(now = Date.now()) {
 }
 
 // ../daemon/src/lib/verification/admission.ts
-import { randomUUID as randomUUID36 } from "crypto";
+import { randomUUID as randomUUID37 } from "crypto";
 var VERIFICATION_LEASE_MS = 10 * 60 * 1e3;
-var VERIFICATION_DISPATCH_OWNER = randomUUID36();
+var VERIFICATION_DISPATCH_OWNER = randomUUID37();
 async function admitVerificationRequest(db, paths2, requestId2, now = Date.now()) {
   const request2 = getVerificationRequestById(db, requestId2, now);
   if (!request2) return { kind: "deferred", requestId: requestId2, reason: "unknown_or_expired" };
@@ -44493,7 +44769,7 @@ function safeTeam3(db, paths2, teamId) {
 }
 
 // ../daemon/src/lib/verification/executor.ts
-import { randomUUID as randomUUID37 } from "crypto";
+import { randomUUID as randomUUID38 } from "crypto";
 import { existsSync as existsSync17 } from "fs";
 import { join as join28, posix as posix2, relative as relative8, sep as sep7 } from "path";
 import { createLocalBashOperations as createLocalBashOperations3 } from "@earendil-works/pi-coding-agent";
@@ -44524,14 +44800,14 @@ function createProtectedCheckExecutor(input) {
       }
       const container = buildContainerOperations(input, env, config2.envAllowlist, absoluteCwd);
       if ("blocked" in container) return blocked3("environment_unavailable", container.blocked);
-      const commandId = randomUUID37();
+      const commandId = randomUUID38();
       const startedAt = Date.now();
       const receipt = {
         id: commandId,
         agentId: input.request.recipientAgentId,
         teamId: input.request.teamId,
         turnId: input.attemptId,
-        toolCallId: `verification:${input.attemptId}:${randomUUID37()}`,
+        toolCallId: `verification:${input.attemptId}:${randomUUID38()}`,
         input: {
           command,
           cwd: relative9,
@@ -44824,12 +45100,7 @@ function renderResult2(input) {
     }
   }
   if (attempt.error) lines.push("", `Limitation: ${attempt.error}`);
-  lines.push(
-    "",
-    "Facts above are executor-owned. A non-zero exit is a result about the commands that ran, never",
-    "proof about later code, and this is not an approval to publish, merge or deploy. Declared output",
-    "paths are not enforced, so a change they do not cover appears above rather than being prevented."
-  );
+  lines.push("", VERIFICATION_OUTCOME_LIMITS[0], VERIFICATION_OUTCOME_LIMITS[1]);
   const payload = lines.join("\n");
   return payload.length > MAX_RESULT_CHARACTERS2 ? `${payload.slice(0, MAX_RESULT_CHARACTERS2)}
 [result truncated]` : payload;
@@ -45029,7 +45300,7 @@ async function fingerprintWorkspace(root) {
     let children;
     try {
       children = await readdir(join29(root, dir), { withFileTypes: true }).then(
-        (rows) => rows.map((row) => row.name)
+        (rows) => rows.map((row2) => row2.name)
       );
     } catch {
       continue;
@@ -45266,7 +45537,7 @@ async function dispatchPendingVerifications(now = Date.now()) {
        ORDER BY created_at LIMIT 20`
   ).all(now);
   void paths2;
-  await Promise.allSettled(pending.map((row) => dispatchVerificationRequest(row.id)));
+  await Promise.allSettled(pending.map((row2) => dispatchVerificationRequest(row2.id)));
 }
 function currentSecrets() {
   const { db, authToken } = getCtx();
@@ -45673,6 +45944,7 @@ async function tick() {
   for (const agentId of recipients) {
     work.push(fireInboxWake(agentId));
   }
+  recoverExpiredPublications(ctx.db, now);
   work.push(dispatchClaimableReviews(now));
   work.push(dispatchPendingVerifications(now));
   for (const packet of dispatchableReviews()) {
@@ -45743,6 +46015,7 @@ function bootstrap(paths2) {
     interruptCodingCommands(db);
     recoverInterruptedVerificationAttempts(db, VERIFICATION_DISPATCH_OWNER);
     recoverInterruptedReviewAttempts(db, Date.now());
+    recoverExpiredPublications(db);
     reconcileApprovalHolds(db);
     recoverInterruptedResultDeliveries(db);
     reconcilePrivateResults(db);
@@ -45910,7 +46183,7 @@ async function authMiddleware(c, next) {
 }
 
 // ../daemon/src/routes/agents.ts
-import { randomUUID as randomUUID39 } from "crypto";
+import { randomUUID as randomUUID40 } from "crypto";
 import { existsSync as existsSync19, readFileSync as readFileSync12 } from "fs";
 import { join as join30 } from "path";
 import { Hono } from "hono";
@@ -47235,7 +47508,7 @@ async function notifyTelegramQueueStatus(db, agentId, itemId) {
 }
 
 // ../daemon/src/lib/user-queue-admission.ts
-import { randomUUID as randomUUID38 } from "crypto";
+import { randomUUID as randomUUID39 } from "crypto";
 async function enqueueTelegramInput(binding, message, attachments2, context = getCtx()) {
   validateInput(message, attachments2);
   const { db, paths: paths2, authToken } = context;
@@ -47254,7 +47527,7 @@ async function enqueueTelegramInput(binding, message, attachments2, context = ge
     const existing = findAttempt(db, "telegram", binding.authorization.attemptId);
     return db.raw.transaction(() => {
       const item = accept(db, {
-        id: existing?.id ?? randomUUID38(),
+        id: existing?.id ?? randomUUID39(),
         agentId,
         teamId: existing?.teamId ?? agent.team.id,
         conversationId,
@@ -49074,7 +49347,7 @@ agentsRouter.post("/:id/chat", async (c) => {
   if (!message && attachments2.length === 0) {
     return c.json({ error: "message or an attachment is required" }, 400);
   }
-  const requestAttemptId = c.req.header("x-request-id") ?? randomUUID39();
+  const requestAttemptId = c.req.header("x-request-id") ?? randomUUID40();
   let preparedTurn;
   try {
     preparedTurn = await prepareAgentTurn({
@@ -51432,13 +51705,13 @@ function assertSnapshotIntegrity(path) {
   try {
     const rows = snapshot.prepare("PRAGMA integrity_check").all();
     if (rows.length !== 1 || rows[0]?.integrity_check !== "ok") {
-      const detail3 = rows.map((row) => row.integrity_check).join("; ") || "no result";
+      const detail3 = rows.map((row2) => row2.integrity_check).join("; ") || "no result";
       throw new Error(`SQLite snapshot failed integrity_check: ${detail3}`);
     }
-    for (const row of snapshot.prepare("SELECT id, bytes, byte_length, sha256 FROM agent_results WHERE deleted_at IS NULL").iterate()) {
-      const bytes = row.bytes;
-      if (!(bytes instanceof Uint8Array) || bytes.byteLength !== row.byte_length || createHash17("sha256").update(bytes).digest("hex") !== row.sha256) {
-        throw new Error(`Result snapshot integrity verification failed: ${row.id}`);
+    for (const row2 of snapshot.prepare("SELECT id, bytes, byte_length, sha256 FROM agent_results WHERE deleted_at IS NULL").iterate()) {
+      const bytes = row2.bytes;
+      if (!(bytes instanceof Uint8Array) || bytes.byteLength !== row2.byte_length || createHash17("sha256").update(bytes).digest("hex") !== row2.sha256) {
+        throw new Error(`Result snapshot integrity verification failed: ${row2.id}`);
       }
     }
     const foreignKeyErrors = snapshot.prepare("PRAGMA foreign_key_check").all();
@@ -51505,7 +51778,7 @@ function createBackupArchive(paths2, snapshot) {
 }
 
 // ../daemon/src/lib/daemon-liveness.ts
-import { createHash as createHash18, randomUUID as randomUUID40 } from "crypto";
+import { createHash as createHash18, randomUUID as randomUUID41 } from "crypto";
 import {
   chmodSync as chmodSync2,
   closeSync as closeSync10,
@@ -51675,7 +51948,7 @@ function acquireDaemonLiveness(paths2) {
   mkdirSync11(dirname6(resolve7(paths2.home)), { recursive: true });
   const path = daemonLivenessPath(paths2.home);
   mkdirSync11(dirname6(path), { recursive: true });
-  const instanceId = randomUUID40();
+  const instanceId = randomUUID41();
   const startedAt = Date.now();
   let fd = null;
   let reclaimClaim = null;
@@ -52190,7 +52463,7 @@ import { bodyLimit } from "hono/body-limit";
 import { HTTPException } from "hono/http-exception";
 
 // ../daemon/src/lib/notification-control.ts
-import { randomUUID as randomUUID41 } from "crypto";
+import { randomUUID as randomUUID42 } from "crypto";
 
 // ../daemon/src/lib/notification-authorization.ts
 function authorizeAttentionNotification(db, item, captured) {
@@ -52355,7 +52628,7 @@ var NotificationControl = class {
     );
     for (const item of items) byKind[item.kind]++;
     const value = {
-      id: randomUUID41(),
+      id: randomUUID42(),
       settingsRevision: revision4,
       destinationId: binding.id,
       kinds,
@@ -52573,7 +52846,7 @@ var NotificationDispatcher = class {
       const known = new Set(
         this.db.raw.query(
           "SELECT source_kind || ':' || source_id key FROM notification_receipts WHERE destination_id=?"
-        ).all(binding.id).map((row) => row.key)
+        ).all(binding.id).map((row2) => row2.key)
       );
       let admitted = 0;
       const cutoffs = eligibilityCutoffs(this.db);
@@ -53265,7 +53538,7 @@ async function parseImportInput(request2) {
 }
 
 // ../daemon/src/routes/team-templates.ts
-import { randomUUID as randomUUID42 } from "crypto";
+import { randomUUID as randomUUID43 } from "crypto";
 import { Hono as Hono17 } from "hono";
 var teamTemplatesRouter = new Hono17();
 teamTemplatesRouter.get("/", (c) => {
@@ -53305,7 +53578,7 @@ teamTemplatesRouter.post("/import", async (c) => {
       if (!profiles_exports.get(db, parsed.profileId)) {
         throw new Error(`profile not found: ${parsed.profileId}`);
       }
-      const slotId = randomUUID42();
+      const slotId = randomUUID43();
       keyToSlot.set(clientKey, slotId);
       return { ...parsed, slotId };
     });
@@ -53597,7 +53870,7 @@ function canonicalError(c, error2) {
 }
 
 // ../daemon/src/routes/teams.ts
-import { join as join37 } from "path";
+import { join as join39 } from "path";
 import { Hono as Hono18 } from "hono";
 
 // ../daemon/src/lib/coding-environment/management.ts
@@ -53753,6 +54026,604 @@ function lineRange(request2, _captured) {
   return { start, end };
 }
 
+// ../daemon/src/lib/publication/config.ts
+var PUBLICATION_CONFIG = {
+  host: "PUBLICATION_HOST",
+  repository: "PUBLICATION_REPOSITORY",
+  baseBranch: "PUBLICATION_BASE_BRANCH"
+};
+var PUBLICATION_CREDENTIAL_KEY = "GITHUB_TOKEN";
+var HOSTS = ["github", "local"];
+function resolvePublicationTarget(db, authToken) {
+  const config2 = openConfig(db);
+  const configured = config2.get(PUBLICATION_CONFIG.host)?.trim().toLowerCase() ?? "";
+  if (!configured) {
+    return {
+      ok: false,
+      reason: "host_not_configured",
+      detail: `no publication host is configured (set ${PUBLICATION_CONFIG.host}); nothing was sent`
+    };
+  }
+  if (!HOSTS.includes(configured)) {
+    return {
+      ok: false,
+      reason: "host_not_configured",
+      detail: `the configured publication host is not supported by this build: ${configured}`
+    };
+  }
+  const repository = config2.get(PUBLICATION_CONFIG.repository)?.trim() ?? "";
+  if (!repository) {
+    return {
+      ok: false,
+      reason: "host_not_configured",
+      detail: `no repository is configured (set ${PUBLICATION_CONFIG.repository}); nothing was sent`
+    };
+  }
+  const baseBranch = config2.get(PUBLICATION_CONFIG.baseBranch)?.trim() || "main";
+  const credential = openSecrets(db, authToken).get(PUBLICATION_CREDENTIAL_KEY)?.trim() ?? "";
+  if (!credential) {
+    return {
+      ok: false,
+      reason: "credential_missing",
+      detail: `no credential is stored for ${configured} (set ${PUBLICATION_CREDENTIAL_KEY}); nothing was sent`
+    };
+  }
+  return {
+    ok: true,
+    target: { host: configured, repository, baseBranch, credential }
+  };
+}
+
+// ../daemon/src/lib/publication/revision-content.ts
+import { createHash as createHash19 } from "crypto";
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join36 } from "path";
+function readReviewedRevisionFiles(db, paths2, packet) {
+  const record3 = getSourceSnapshot(db, packet.teamId, packet.snapshotId);
+  if (!record3) {
+    return {
+      ok: false,
+      reason: "revision_unavailable",
+      detail: "the reviewed revision is no longer retained, so its content cannot be committed"
+    };
+  }
+  if (!record3.complete) {
+    return {
+      ok: false,
+      reason: "revision_unavailable",
+      detail: "the reviewed revision has incomplete coverage, so publishing it would commit a partial change"
+    };
+  }
+  let snapshot;
+  try {
+    snapshot = JSON.parse(record3.manifestJson);
+  } catch {
+    return {
+      ok: false,
+      reason: "revision_unavailable",
+      detail: "the reviewed revision manifest could not be read"
+    };
+  }
+  const files = [];
+  const removed = [];
+  for (const entry of snapshot.entries) {
+    if (entry.kind === "deleted") {
+      removed.push(entry.path);
+      continue;
+    }
+    if (entry.kind !== "file") {
+      return {
+        ok: false,
+        reason: "revision_not_reproducible",
+        detail: `the reviewed revision records ${entry.path} as ${entry.kind}, so its content cannot be committed`
+      };
+    }
+    if (!entry.digest) {
+      return {
+        ok: false,
+        reason: "revision_not_reproducible",
+        detail: `the reviewed revision captured no content for ${entry.path}`
+      };
+    }
+    let content;
+    try {
+      content = readFileSync15(join36(paths2.teamDir(packet.teamId), entry.path));
+    } catch {
+      return {
+        ok: false,
+        reason: "revision_not_reproducible",
+        detail: `the reviewed content for ${entry.path} can no longer be read`
+      };
+    }
+    const digest4 = createHash19("sha256").update(content).digest("hex");
+    if (digest4 !== entry.digest) {
+      return {
+        ok: false,
+        reason: "revision_not_reproducible",
+        detail: `the content of ${entry.path} no longer matches the reviewed revision, so committing it would publish a different change`
+      };
+    }
+    files.push({ path: entry.path, content });
+  }
+  if (files.length === 0 && removed.length === 0) {
+    return {
+      ok: false,
+      reason: "revision_unavailable",
+      detail: "the reviewed revision records no changed content to publish"
+    };
+  }
+  return { ok: true, files, removed };
+}
+
+// ../daemon/src/lib/publication/capture.ts
+function defaultHeadBranch(packetId) {
+  return `bazilion/review-${packetId.slice(0, 8)}`;
+}
+function validateHeadBranch(branch) {
+  if (branch.length === 0 || branch.length > PUBLICATION_LIMITS.branch) {
+    return { ok: false, detail: "the branch name is empty or too long" };
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch)) {
+    return {
+      ok: false,
+      detail: `the branch name has characters this build will not publish: ${branch}`
+    };
+  }
+  if (branch.includes("..") || branch.includes("//") || branch.endsWith("/") || branch.endsWith(".lock")) {
+    return { ok: false, detail: `the branch name is not a valid ref: ${branch}` };
+  }
+  const protectedName = PUBLICATION_LIMITS.protectedBranches.find(
+    (name) => name === branch || branch.endsWith(`/${name}`)
+  );
+  if (protectedName) {
+    return {
+      ok: false,
+      detail: `this build never publishes to ${branch}: it is the protected branch ${protectedName}`
+    };
+  }
+  return { ok: true };
+}
+async function capturePublication(db, paths2, authToken, intent) {
+  const packet = getReviewPacket(db, intent.packetId);
+  if (!packet || packet.teamId !== intent.teamId) {
+    return refused2("packet_unknown", "the review packet is unknown in this Team");
+  }
+  if (packet.state !== "reviewed") {
+    return refused2(
+      "packet_not_reviewed",
+      `the packet is ${packet.state}: publishing is a decision about a reviewed revision, not a promise about one`
+    );
+  }
+  const conclusions = listReviewConclusions(db, packet.id);
+  if (conclusions.length === 0) {
+    return refused2(
+      "missing_reviewer_conclusion",
+      "the packet has no recorded conclusion, so there is nothing reviewed to publish"
+    );
+  }
+  const target = resolvePublicationTarget(db, authToken);
+  if (!target.ok) return refused2(target.reason, target.detail);
+  const headBranch = (intent.headBranch ?? "").trim() || defaultHeadBranch(packet.id);
+  const branch = validateHeadBranch(headBranch);
+  if (!branch.ok) return refused2("branch_protected", branch.detail);
+  const files = readReviewedRevisionFiles(db, paths2, packet);
+  if (!files.ok) {
+    if (files.reason === "revision_not_reproducible") {
+      return refused2("revision_not_reproducible", files.detail);
+    }
+    return refused2("revision_unavailable", files.detail);
+  }
+  if (files.files.length === 0 && files.removed.length === 0) {
+    return refused2("nothing_to_publish", "the reviewed revision holds no change to publish");
+  }
+  const commitMessage = (intent.commitMessage ?? "").trim() || `${conclusionTitle(conclusions[0]?.conclusion ?? "reviewed")}: ${packet.summary?.trim() || "reviewed change"}`;
+  try {
+    const publication = createPublication(db, {
+      teamId: intent.teamId,
+      packetId: packet.id,
+      snapshotId: packet.snapshotId,
+      host: target.target.host,
+      repository: target.target.repository,
+      baseBranch: target.target.baseBranch,
+      headBranch,
+      baseOid: packet.baseOid,
+      commitMessage: bounded3(commitMessage, PUBLICATION_LIMITS.commitMessage),
+      notifyAgentId: packet.requesterKind === "agent" ? packet.requesterAgentId : null
+    });
+    return { kind: "captured", publication };
+  } catch (error2) {
+    if (error2 instanceof PublicationError) {
+      return refused2(error2.code, error2.message);
+    }
+    throw error2;
+  }
+}
+function conclusionTitle(conclusion) {
+  return conclusion === "changes_requested" ? "Reviewed change with requested changes" : conclusion === "recommended" ? "Reviewed change" : "Reviewed change (inconclusive review)";
+}
+function bounded3(value, max) {
+  return value.length <= max ? value : `${value.slice(0, max - 1)}\u2026`;
+}
+function refused2(reason, detail3) {
+  return { kind: "refused", reason, detail: bounded3(detail3, PUBLICATION_LIMITS.refusalDetail) };
+}
+
+// ../daemon/src/lib/publication/git-publish.ts
+import { execFile as execFile2 } from "child_process";
+import { mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync7, rmSync as rmSync18, writeFileSync as writeFileSync17 } from "fs";
+import { dirname as dirname7, join as join37 } from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile2);
+var COMMAND_BUDGET_MS = 6e4;
+var MAX_OUTPUT = 64 * 1024;
+var AUTHOR_NAME = "Bazilion";
+var AUTHOR_EMAIL = "bazilion@localhost";
+async function publishRevisionCommit(input) {
+  const scratch = mkdtempSync7(join37(input.scratchParentDir ?? "/tmp", "bazilion-publish-"));
+  const gitDir = join37(scratch, "repo");
+  const gitEnv = environment(scratch, input.remoteUrl, input.credential);
+  const run = (args, cwd = scratch) => git(["-C", gitDir, ...args], cwd, gitEnv);
+  try {
+    await git(
+      [
+        "-c",
+        "init.templateDir=",
+        "clone",
+        "--no-checkout",
+        "--no-hardlinks",
+        "--quiet",
+        input.teamDir,
+        gitDir
+      ],
+      scratch,
+      gitEnv
+    );
+    try {
+      await run(["rev-parse", "--verify", "--quiet", `${input.baseOid}^{commit}`]);
+    } catch {
+      return {
+        ok: false,
+        reason: "base_unknown",
+        detail: "the pinned base commit is not present in the Team repository"
+      };
+    }
+    const existing = await remoteHeads(input, gitEnv);
+    if (existing.includes(input.headBranch)) {
+      return {
+        ok: false,
+        reason: "head_branch_exists",
+        detail: `the remote already has a branch named ${input.headBranch}; publishing over it is not something this build will do`
+      };
+    }
+    await run(["checkout", "--quiet", "--detach", input.baseOid]);
+    for (const file of input.files) {
+      const target = join37(gitDir, file.path);
+      mkdirSync12(dirname7(target), { recursive: true });
+      writeFileSync17(target, file.content);
+    }
+    for (const path of input.removed) {
+      await run(["rm", "--quiet", "--ignore-unmatch", "--", path]);
+    }
+    await run(["add", "--all", "--", "."]);
+    await run([
+      "-c",
+      "commit.gpgsign=false",
+      "-c",
+      `user.name=${AUTHOR_NAME}`,
+      "-c",
+      `user.email=${AUTHOR_EMAIL}`,
+      "commit",
+      "--quiet",
+      "--no-verify",
+      "-m",
+      input.commitMessage
+    ]);
+    const commitOid = await run(["rev-parse", "HEAD"]);
+    try {
+      await run(["push", "--quiet", input.remoteUrl, `HEAD:refs/heads/${input.headBranch}`]);
+    } catch (error2) {
+      return {
+        ok: false,
+        reason: "push_rejected",
+        detail: `the push was refused: ${summarize(error2)}`
+      };
+    }
+    return { ok: true, commitOid };
+  } catch (error2) {
+    return { ok: false, reason: "commit_failed", detail: summarize(error2) };
+  } finally {
+    rmSync18(scratch, { recursive: true, force: true });
+  }
+}
+async function remoteHeads(input, env) {
+  const output = await git(["ls-remote", "--heads", input.remoteUrl], process.cwd(), env);
+  return output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).map((line) => line.split(/\s+/)[1] ?? "").filter((ref) => ref.startsWith("refs/heads/")).map((ref) => ref.slice("refs/heads/".length));
+}
+function environment(scratch, remoteUrl, credential) {
+  const env = {
+    PATH: process.env.PATH,
+    HOME: scratch,
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: "/dev/null",
+    // Never prompt: a missing credential must fail, not hang a daemon thread waiting for a terminal.
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "",
+    SSH_ASKPASS: "",
+    GIT_LFS_SKIP_SMUDGE: "1"
+  };
+  const entries = [
+    ["credential.helper", ""],
+    ["core.hooksPath", "/dev/null"],
+    ["core.autocrlf", "false"],
+    ["gc.auto", "0"],
+    ["http.followRedirects", "false"]
+  ];
+  if (/^https?:\/\//.test(remoteUrl)) {
+    const basic = Buffer.from(`x-access-token:${credential}`, "utf8").toString("base64");
+    entries.push(["http.extraheader", `Authorization: Basic ${basic}`]);
+  }
+  entries.forEach(([key3, value], index) => {
+    env[`GIT_CONFIG_KEY_${index}`] = key3;
+    env[`GIT_CONFIG_VALUE_${index}`] = value;
+  });
+  env.GIT_CONFIG_COUNT = String(entries.length);
+  return env;
+}
+async function git(args, cwd, env) {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd,
+      env,
+      timeout: COMMAND_BUDGET_MS,
+      maxBuffer: MAX_OUTPUT,
+      encoding: "utf8"
+    });
+    return stdout.trim();
+  } catch (error2) {
+    throw new Error(summarize(error2));
+  }
+}
+function summarize(error2) {
+  const stderr = typeof error2 === "object" && error2 !== null && "stderr" in error2 ? String(error2.stderr ?? "") : "";
+  const message = stderr.trim() || (error2 instanceof Error ? error2.message : String(error2)) || "unknown failure";
+  return message.length > 300 ? `${message.slice(0, 300)}\u2026` : message;
+}
+
+// ../daemon/src/lib/publication/host/github.ts
+var API = "https://api.github.com";
+var REQUEST_TIMEOUT_MS = 3e4;
+function createGitHubAdapter(input) {
+  const apiBase = input.apiBaseUrl ?? API;
+  const doFetch = input.fetchImpl ?? fetch;
+  const headers = {
+    accept: "application/vnd.github+json",
+    authorization: `Bearer ${input.credential}`,
+    "content-type": "application/json",
+    "user-agent": "bazilion",
+    "x-github-api-version": "2022-11-28"
+  };
+  return {
+    remoteUrl(target) {
+      if (!/^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(target.repository)) {
+        return {
+          ok: false,
+          reason: "origin_not_configured",
+          detail: `the configured repository is not a GitHub owner/name: ${target.repository}`
+        };
+      }
+      return { ok: true, url: `https://github.com/${target.repository}.git` };
+    },
+    async openPullRequest(target) {
+      let response;
+      try {
+        response = await doFetch(`${apiBase}/repos/${target.repository}/pulls`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            title: target.title,
+            head: target.headBranch,
+            base: target.baseBranch,
+            body: target.body
+          }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+        });
+      } catch {
+        return {
+          ok: false,
+          reason: "host_unavailable",
+          detail: "the host could not be reached, so whether the branch has a pull request is unknown"
+        };
+      }
+      if (!response.ok) {
+        const text3 = await safeText(response);
+        return {
+          ok: false,
+          reason: "host_refused",
+          detail: `the host refused the pull request (${response.status}): ${text3}`
+        };
+      }
+      const body = await response.json().catch(() => null);
+      const outcome = {
+        pullRequestNumber: typeof body?.number === "number" ? body.number : null,
+        pullRequestUrl: typeof body?.html_url === "string" ? body.html_url : null
+      };
+      return { ok: true, outcome };
+    }
+  };
+}
+async function safeText(response) {
+  try {
+    const text3 = await response.text();
+    return text3.replace(/\s+/g, " ").slice(0, 200);
+  } catch {
+    return "no response body";
+  }
+}
+
+// ../daemon/src/lib/publication/host/local.ts
+function createLocalAdapter(input) {
+  return {
+    remoteUrl(target) {
+      if (!target.repository.startsWith("/")) {
+        return {
+          ok: false,
+          reason: "origin_not_configured",
+          detail: `a local publication needs an absolute repository path, got: ${target.repository}`
+        };
+      }
+      void input.credentialPresent;
+      return { ok: true, url: target.repository };
+    },
+    async openPullRequest() {
+      return {
+        ok: true,
+        outcome: { pullRequestNumber: null, pullRequestUrl: null }
+      };
+    }
+  };
+}
+
+// ../daemon/src/lib/publication/execute.ts
+var PUBLICATION_LEASE_MS = 2 * 60 * 1e3;
+var PUBLICATION_OWNER = `publication-${process.pid}`;
+async function executePublication(db, paths2, authToken, publicationId, opts = {}) {
+  const claimed = claimPublication(db, {
+    id: publicationId,
+    leaseOwner: PUBLICATION_OWNER,
+    leaseMs: opts.leaseMs ?? PUBLICATION_LEASE_MS,
+    ...opts.now !== void 0 ? { now: opts.now } : {}
+  });
+  if (!claimed) return "not_claimed";
+  const refuse = (reason, detail3) => {
+    refusePublication(db, {
+      id: claimed.id,
+      reason,
+      detail: detail3.slice(0, 400),
+      ...opts.now !== void 0 ? { now: opts.now } : {}
+    });
+    return "refused";
+  };
+  const packet = getReviewPacket(db, claimed.packetId);
+  if (!packet) return refuse("packet_unknown", "the review packet is gone");
+  const files = readReviewedRevisionFiles(db, paths2, packet);
+  if (!files.ok) return refuse(files.reason, files.detail);
+  const resolved = resolvePublicationTarget(db, authToken);
+  if (!resolved.ok) return refuse(resolved.reason, resolved.detail);
+  const adapter = opts.adapter ?? adapterFor(resolved.target.host, resolved.target.credential);
+  const hostTarget = {
+    host: resolved.target.host,
+    repository: resolved.target.repository,
+    baseBranch: claimed.baseBranch,
+    headBranch: claimed.headBranch,
+    commitMessage: claimed.commitMessage,
+    title: claimed.commitMessage,
+    body: publicationBody(claimed, packet.summary)
+  };
+  const remote = adapter.remoteUrl(hostTarget);
+  if (!remote.ok) return refuse(remote.reason, remote.detail);
+  const pushed = await publishRevisionCommit({
+    teamDir: paths2.teamDir(claimed.teamId),
+    baseOid: claimed.baseOid,
+    headBranch: claimed.headBranch,
+    commitMessage: claimed.commitMessage,
+    files: files.files,
+    removed: files.removed,
+    remoteUrl: remote.url,
+    credential: resolved.target.credential,
+    ...opts.scratchParentDir ? { scratchParentDir: opts.scratchParentDir } : {}
+  });
+  if (!pushed.ok) {
+    return refuse(pushed.reason, pushed.detail);
+  }
+  const opened = await adapter.openPullRequest(hostTarget);
+  const settled = settlePublicationPublished(db, {
+    id: claimed.id,
+    commitOid: pushed.commitOid,
+    pullRequestNumber: opened.ok ? opened.outcome.pullRequestNumber : null,
+    pullRequestUrl: opened.ok ? opened.outcome.pullRequestUrl : null,
+    ...opts.now !== void 0 ? { now: opts.now } : {}
+  });
+  if (!opened.ok) {
+    noteBranchWithoutPullRequest(db, settled, opened.detail);
+  }
+  notifyOutcome(db, settled, opened.ok ? null : opened.detail);
+  return "published";
+}
+function adapterFor(host2, credential) {
+  return host2 === "github" ? createGitHubAdapter({ credential }) : createLocalAdapter({ credentialPresent: credential.length > 0 });
+}
+function publicationBody(publication, summary) {
+  return [
+    `Reviewed revision ${publication.snapshotId.slice(0, 12)} (base ${publication.baseOid.slice(0, 12)}).`,
+    summary ? `
+${summary}` : "",
+    "",
+    "Published by Bazilion from a reviewed packet. The commit is unsigned.",
+    "Nothing was merged or deployed."
+  ].join("\n").trim();
+}
+function noteBranchWithoutPullRequest(db, publication, detail3) {
+  notePublicationError(
+    db,
+    publication.id,
+    `the branch was published, but no pull request was opened: ${detail3}`
+  );
+}
+function notifyOutcome(db, publication, detail3) {
+  const to = publication.notifyAgentId;
+  if (!to) return;
+  const packet = getReviewPacket(db, publication.packetId);
+  const from = packet?.reviewerAgentId;
+  if (!from) return;
+  const lines = [
+    `Publication of ${publication.packetId}: ${publication.state}.`,
+    `branch ${publication.headBranch}`,
+    publication.commitOid ? `commit ${publication.commitOid}` : "",
+    publication.pullRequestUrl ? `pull request ${publication.pullRequestUrl}` : "no pull request was opened",
+    "The commit is unsigned, and nothing was merged or deployed.",
+    detail3 ?? ""
+  ].filter((line) => line.length > 0);
+  try {
+    sendAgentMessage(db, {
+      from,
+      to,
+      payload: lines.join("\n"),
+      origin: "publication_result",
+      attemptKind: "publication_result",
+      attemptId: publication.id
+    });
+  } catch {
+  }
+}
+
+// ../daemon/src/lib/publication/report.ts
+function buildPublicationReport(publication) {
+  const facts = {
+    // Any non-refused row got this far only after every path's digest matched the capture.
+    contentFromReviewedRevision: publication.state !== "refused",
+    nothingSent: publication.state === "refused",
+    pullRequestOpened: publication.pullRequestUrl !== null && publication.pullRequestNumber !== null,
+    unsigned: !publication.signed
+  };
+  return { publication, facts, guidance: guidanceFor(publication) };
+}
+function guidanceFor(publication) {
+  switch (publication.state) {
+    case "pending":
+      return "Nothing has been sent. Publishing commits the reviewed revision to a new branch and opens a pull request; it never merges or deploys.";
+    case "publishing":
+      return "An attempt is in progress. Until it settles, whether the branch reached the host is unknown.";
+    case "published":
+      return publication.pullRequestUrl ? "The branch is on the host and a pull request is open. Nothing was merged and nothing was deployed; those stay yours to report." : "The branch is on the host, but no pull request came back. Nothing was merged and nothing was deployed.";
+    case "refused":
+      return "Nothing was sent: no commit, no push, no pull request. Fix the reason below and publish again; the review itself is unchanged.";
+    case "failed":
+      return "The attempt ended without publishing. Nothing is known to be on the host, but check before retrying if the failure happened late.";
+    case "uncertain":
+      return "Whether the branch reached the host is unknown, so this is never retried automatically. Check the host first: a branch that is already there will make a retry refuse.";
+  }
+}
+
 // ../daemon/src/lib/review/export.ts
 var MAX_PATCH_BYTES = 2e5;
 async function buildReviewExport(db, paths2, teamId, packetId) {
@@ -54010,11 +54881,11 @@ function renderExportDocument(exported) {
 }
 
 // ../daemon/src/lib/review/file-link.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile as execFile3 } from "child_process";
 import { hostname } from "os";
-import { isAbsolute as isAbsolute10, join as join36 } from "path";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile2);
+import { isAbsolute as isAbsolute10, join as join38 } from "path";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile3);
 var EDITOR_TEMPLATE_ENV = "BAZILION_REVIEW_EDITOR";
 var EDITOR_MAP_ENV = "BAZILION_REVIEW_EDITOR_MAP";
 function buildFileLink(input) {
@@ -54025,7 +54896,7 @@ function buildFileLink(input) {
   const known = revision4.ok && revision4.changes.some((change) => change.path === input.path);
   const line = input.line !== null && input.line >= 1 ? input.line : null;
   const copyTarget = line === null ? input.path : `${input.path}:${line}`;
-  const hostPath = known ? join36(team.path, input.path) : null;
+  const hostPath = known ? join38(team.path, input.path) : null;
   const template = env[EDITOR_TEMPLATE_ENV]?.trim();
   const mapped = hostPath ? mapHostPath(hostPath, env[EDITOR_MAP_ENV]) : null;
   if (!known) {
@@ -54079,7 +54950,7 @@ async function openFileLink(link) {
   const [command, ...args] = argv;
   if (!command) return { opened: false, detail: "the configured editor command is empty" };
   try {
-    await execFileAsync(command, args, { timeout: 1e4 });
+    await execFileAsync2(command, args, { timeout: 1e4 });
     return { opened: true, detail: `ran ${command} on ${link.hostPath} (daemon host)` };
   } catch (error2) {
     return {
@@ -54276,6 +55147,7 @@ teamsRouter.post("/:id/reviews/:packetId/findings", async (c) => {
     return c.json({ error: "The path is outside the reviewed scope", code: "invalid_path" }, 400);
   }
   try {
+    const availability = await readRevisionContentAvailability(db, paths2, packet);
     const finding = addReviewFinding(db, {
       packetId,
       authorKind: "operator",
@@ -54285,7 +55157,8 @@ teamsRouter.post("/:id/reviews/:packetId/findings", async (c) => {
       lineStart: readLine(body.lineStart),
       lineEnd: readLine(body.lineEnd),
       // The finding is about the revision this packet captured — not about whatever is on disk now.
-      snapshotId: packet.snapshotId
+      snapshotId: packet.snapshotId,
+      state: availability.contentAvailable ? "open" : "unverified"
     });
     const report2 = await readReviewPacketReport(db, paths2, packet.teamId, packetId);
     return c.json({ finding, report: report2 }, 201);
@@ -54610,14 +55483,14 @@ teamsRouter.put("/:id/coding-environment", async (c) => {
     return c.json({ error: "Invalid coding environment request" }, 400);
   const request2 = body;
   try {
-    const environment = await configureTeamCodingEnvironment(
+    const environment2 = await configureTeamCodingEnvironment(
       db,
       team,
       request2.expectedRevision,
       request2.config
     );
     c.header("Cache-Control", "no-store");
-    return c.json(environment);
+    return c.json(environment2);
   } catch (error2) {
     if (error2 instanceof WorkspaceBusyError)
       return c.json({ error: error2.message, code: error2.message }, 409);
@@ -54697,12 +55570,12 @@ teamsRouter.get("/:id/policy/blocks", (c) => {
       WHERE ${filters.join(" AND ")}
       ORDER BY created_at DESC, id DESC LIMIT ?`
   ).all(...params);
-  const page = rows.slice(0, limit).map((row) => ({
-    ...row,
-    policyRefs: JSON.parse(String(row.policy_refs_json)),
-    componentOutcomes: JSON.parse(String(row.component_outcomes_json)),
-    matchedEdgeIds: JSON.parse(String(row.matched_edge_ids_json)),
-    requiredEdgeIds: JSON.parse(String(row.required_edge_ids_json)),
+  const page = rows.slice(0, limit).map((row2) => ({
+    ...row2,
+    policyRefs: JSON.parse(String(row2.policy_refs_json)),
+    componentOutcomes: JSON.parse(String(row2.component_outcomes_json)),
+    matchedEdgeIds: JSON.parse(String(row2.matched_edge_ids_json)),
+    requiredEdgeIds: JSON.parse(String(row2.required_edge_ids_json)),
     policy_refs_json: void 0,
     component_outcomes_json: void 0,
     matched_edge_ids_json: void 0,
@@ -54906,7 +55779,7 @@ async function openMemory(rawId) {
   const { db, paths: paths2 } = getCtx();
   const team = teams_exports.get(db, rawId, paths2);
   if (!team) throw new TeamMemoryNotFoundError(`team not found: ${rawId}`);
-  const mem = qmdBackend(join37(team.path, "memory"));
+  const mem = qmdBackend(join39(team.path, "memory"));
   await mem.init();
   return { mem, team };
 }
@@ -55074,6 +55947,93 @@ teamsRouter.post("/:id/verifications/:requestId/cancel", async (c) => {
 async function report(db, paths2, record3) {
   return readVerificationReport(db, paths2, record3.teamId, record3.id);
 }
+teamsRouter.get("/:id/publications", async (c) => {
+  const { db, paths: paths2 } = getCtx();
+  c.header("Cache-Control", "no-store");
+  try {
+    const team = requireTeam(db, paths2, c.req.param("id"));
+    return c.json({ publications: listPublications(db, team.id).map(toWirePublication) });
+  } catch (error2) {
+    return reviewFailure(c, error2);
+  }
+});
+teamsRouter.post("/:id/publications", async (c) => {
+  const { db, paths: paths2, authToken } = getCtx();
+  c.header("Cache-Control", "no-store");
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return c.json({ error: "Invalid publication request" }, 400);
+  }
+  const input = body;
+  if (typeof input.packetId !== "string") {
+    return c.json({ error: "Invalid publication request" }, 400);
+  }
+  if (input.headBranch !== void 0 && typeof input.headBranch !== "string") {
+    return c.json({ error: "Invalid publication request" }, 400);
+  }
+  if (input.commitMessage !== void 0 && typeof input.commitMessage !== "string") {
+    return c.json({ error: "Invalid publication request" }, 400);
+  }
+  try {
+    const team = requireTeam(db, paths2, c.req.param("id"));
+    const captured = await capturePublication(db, paths2, authToken, {
+      teamId: team.id,
+      packetId: input.packetId,
+      ...typeof input.headBranch === "string" ? { headBranch: input.headBranch } : {},
+      ...typeof input.commitMessage === "string" ? { commitMessage: input.commitMessage } : {}
+    });
+    if (captured.kind === "refused") {
+      return c.json({ blocked: { reason: captured.reason, detail: captured.detail } }, 409);
+    }
+    await executePublication(db, paths2, authToken, captured.publication.id);
+    const settled = getPublication(db, captured.publication.id);
+    if (!settled) return c.json({ error: "Publication not found" }, 404);
+    return c.json({ report: buildPublicationReport(settled) }, 201);
+  } catch (error2) {
+    if (error2 instanceof PublicationError) {
+      return c.json({ blocked: { reason: error2.code, detail: error2.message } }, 409);
+    }
+    return reviewFailure(c, error2);
+  }
+});
+teamsRouter.get("/:id/publications/:publicationId", async (c) => {
+  const { db, paths: paths2 } = getCtx();
+  c.header("Cache-Control", "no-store");
+  try {
+    const team = requireTeam(db, paths2, c.req.param("id"));
+    const publication = getPublication(db, c.req.param("publicationId"));
+    if (!publication || publication.teamId !== team.id) {
+      return c.json({ error: "Publication not found" }, 404);
+    }
+    return c.json({ report: buildPublicationReport(publication) });
+  } catch (error2) {
+    return reviewFailure(c, error2);
+  }
+});
+function toWirePublication(record3) {
+  return {
+    id: record3.id,
+    teamId: record3.teamId,
+    packetId: record3.packetId,
+    snapshotId: record3.snapshotId,
+    host: record3.host,
+    repository: record3.repository,
+    baseBranch: record3.baseBranch,
+    headBranch: record3.headBranch,
+    baseOid: record3.baseOid,
+    commitMessage: record3.commitMessage,
+    state: record3.state,
+    signed: record3.signed,
+    commitOid: record3.commitOid,
+    pullRequestNumber: record3.pullRequestNumber,
+    pullRequestUrl: record3.pullRequestUrl,
+    refusalReason: record3.refusalReason,
+    refusalDetail: record3.refusalDetail,
+    error: record3.error,
+    createdAt: record3.createdAt,
+    finishedAt: record3.finishedAt
+  };
+}
 
 // ../daemon/src/routes/telegram.ts
 import { Hono as Hono19 } from "hono";