bazilion 0.19.1 → 0.21.0-beta.1

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { defineCommand as defineCommand38, runCommand, showUsage } from "citty";
+import { defineCommand as defineCommand39, runCommand, showUsage } from "citty";
 
 // package.json
 var package_default = {
   name: "bazilion",
-  version: "0.19.1",
+  version: "0.21.0-beta.1",
   description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/teams/skills, and run the local daemon.",
   license: "MIT",
   repository: {
@@ -203,6 +203,21 @@ function createClient(cfg) {
         cancel: (requestId) => request("POST", `${base}/${encodeURIComponent(requestId)}/cancel`)
       };
     },
+    /**
+     * Publications to a code host (BAZ-046).
+     *
+     * One operator decision about a reviewed revision. Nothing here can merge, deploy, force a push or
+     * name a remote: the request has a packet, an optional branch and an optional commit message, and the
+     * rest is configuration the operator owns.
+     */
+    publications: (teamId) => {
+      const base = `/api/teams/${encodeURIComponent(teamId)}/publications`;
+      return {
+        list: () => request("GET", base),
+        show: (publicationId2) => request("GET", `${base}/${encodeURIComponent(publicationId2)}`),
+        create: (input) => request("POST", base, input)
+      };
+    },
     /**
      * Revision-bound review packets (BAZ-043).
      *
@@ -1372,69 +1387,34 @@ var chatCmd = defineCommand5({
       }
       return;
     }
+    if (bashApprovalMode === "interactive") {
+      console.error(
+        `usage: bazilion agent chat ${args2.id} --message "..." (one-shot) \u2014 for a conversational surface, use the web UI`
+      );
+      process.exitCode = 1;
+      return;
+    }
     console.log(`chatting with ${resolved.agent.name} (${resolved.model})`);
-    console.log("(type /exit to quit)");
+    console.log("(type /exit to quit; input is piped, commands run with auto_deny)");
     const rl = createInterface({ input: stdin, output: stdout });
     try {
-      if (bashApprovalMode === "interactive") {
-        let retryDraft = "";
-        while (true) {
-          const observed = await client.get(
-            `/api/agents/${resolved.agent.id}/sessions/head`
-          );
-          let line;
-          try {
-            const answer = rl.question("> ");
-            if (retryDraft) {
-              rl.write(retryDraft);
-              retryDraft = "";
-            }
-            line = await answer;
-          } catch {
-            break;
-          }
-          const trimmed = line.trim();
-          if (trimmed === "/exit" || trimmed === "/quit") break;
-          if (!trimmed) continue;
-          try {
-            await streamTurn(client, resolved.agent.id, trimmed, void 0, {
-              bashApprovalMode,
-              expectedSelection: observed.selection,
-              questionPrompt: {
-                question: (text2, signal) => rl.question(text2, { signal }),
-                write: (line2) => console.log(line2)
-              },
-              approvalPrompt: {
-                question: (question) => rl.question(question),
-                write: (output4) => console.log(output4)
-              }
-            });
-          } catch (err) {
-            retryDraft = trimmed;
-            console.error(
-              `error: ${err.message}. Review the preserved draft before retrying.`
-            );
-          }
-        }
-      } else {
-        rl.setPrompt("> ");
-        rl.prompt();
-        for await (const line of rl) {
-          const trimmed = line.trim();
-          if (trimmed === "/exit" || trimmed === "/quit") break;
-          if (!trimmed) {
-            rl.prompt();
-            continue;
-          }
-          try {
-            await streamTurn(client, resolved.agent.id, trimmed, void 0, {
-              bashApprovalMode
-            });
-          } catch (err) {
-            console.error(`error: ${err.message}`);
-          }
+      rl.setPrompt("> ");
+      rl.prompt();
+      for await (const line of rl) {
+        const trimmed = line.trim();
+        if (trimmed === "/exit" || trimmed === "/quit") break;
+        if (!trimmed) {
           rl.prompt();
+          continue;
+        }
+        try {
+          await streamTurn(client, resolved.agent.id, trimmed, void 0, {
+            bashApprovalMode
+          });
+        } catch (err) {
+          console.error(`error: ${err.message}`);
         }
+        rl.prompt();
       }
     } finally {
       rl.close();
@@ -2303,16 +2283,16 @@ import {
   mkdirSync as mkdirSync2,
   mkdtempSync,
   openSync as openSync2,
-  readdirSync,
-  readFileSync as readFileSync5,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync6,
   readSync,
   renameSync as renameSync2,
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename4, dirname as dirname2, isAbsolute, parse, posix, relative, resolve as resolve3 } from "path";
-import { DatabaseSync as DatabaseSync2, backup as sqliteBackup } from "node:sqlite";
+import { basename as basename4, dirname as dirname3, isAbsolute, parse, posix, relative, resolve as resolve3 } from "path";
+import { DatabaseSync as DatabaseSync4, backup as sqliteBackup } from "node:sqlite";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
 import { Decrypter, Encrypter } from "age-encryption";
@@ -2460,169 +2440,180 @@ function pauseRestoredUserQueue(database) {
 
 // src/backup-schema.ts
 import { createHash } from "crypto";
-var CANONICAL_MIGRATION = "0001_init";
-var CANONICAL_SCHEMA_HASH = "da37324d58fa517941ec0557529d00a7a812413f9fda7e5d611287ad42b47595";
-var CANONICAL_OBJECTS = [
-  ["table", "team_coding_environments"],
-  ["table", "workspace_writers"],
-  ["table", "workspace_resources"],
-  ["table", "coding_commands"],
-  ["index", "coding_command_history"],
-  ["table", "coding_command_logs"],
-  ["index", "coding_command_logs_retention"],
-  ["index", "coding_command_logs_team_time"],
-  ["table", "source_snapshots"],
-  ["index", "source_snapshots_retention"],
-  ["index", "source_snapshots_team_time"],
-  ["table", "review_packets"],
-  ["index", "review_packets_team_time"],
-  ["index", "review_packets_reviewer_dispatch"],
-  ["index", "review_packets_retention"],
-  ["table", "review_findings"],
-  ["index", "review_findings_packet"],
-  ["index", "review_findings_unresolved"],
-  ["table", "review_conclusions"],
-  ["index", "review_conclusions_packet"],
-  ["table", "review_attempts"],
-  ["index", "review_attempts_one_open_per_packet"],
-  ["index", "review_attempts_lease"],
-  ["table", "verification_requests"],
-  ["index", "verification_requests_team_time"],
-  ["index", "verification_requests_recipient_dispatch"],
-  ["index", "verification_requests_retention"],
-  ["table", "verification_checks"],
-  ["table", "verification_attempts"],
-  ["index", "verification_attempts_one_open_per_request"],
-  ["index", "verification_attempts_lease"],
-  ["table", "verification_check_outcomes"],
-  ["index", "verification_check_outcomes_command"],
-  ["table", "notification_settings"],
-  ["table", "notification_receipts"],
-  ["index", "notification_receipts_state"],
-  ["index", "notification_receipts_time"],
-  ["table", "agent_questions"],
-  ["table", "question_receipt_key"],
-  ["index", "agent_questions_one_pending"],
-  ["index", "agent_questions_agent_time"],
-  ["table", "user_queue_controls"],
-  ["table", "user_queue_items"],
-  ["table", "user_queue_attachments"],
-  ["index", "user_queue_agent_order"],
-  ["index", "user_queue_status"],
-  ["index", "agent_conversations_agent_time"],
-  ["table", "agent_conversations"],
-  ["table", "agent_conversation_selection"],
-  ["index", "agent_results_team_time"],
-  ["index", "agent_results_session_source"],
-  ["index", "agent_results_packet_source"],
-  ["index", "agent_triggers_agent"],
-  ["index", "agent_triggers_enabled"],
-  ["index", "agent_loop_break_events_agent_time"],
-  ["index", "agent_loop_break_events_team_time"],
-  ["index", "agent_lesson_proposals_agent_status_time"],
-  ["index", "agent_lesson_proposals_review"],
-  ["index", "agent_reviews_agent_time"],
-  ["index", "agent_reviews_claimable"],
-  ["index", "agent_reviews_one_open_per_agent"],
-  ["index", "communication_approval_events_attempt"],
-  ["index", "communication_approvals_queue"],
-  ["index", "communication_approvals_teams"],
-  ["index", "idx_agents_telegram_topic_id"],
-  ["index", "idx_provider_models_provider"],
-  ["index", "messages_policy_delivery_queue"],
-  ["index", "messages_causal_chain"],
-  ["index", "messages_to_unread"],
-  ["index", "team_policy_baseline_owner"],
-  ["index", "team_policy_blocks_team_time"],
-  ["index", "team_template_active_position"],
-  ["index", "trigger_dispatches_claimable"],
-  ["index", "trigger_dispatches_trigger_time"],
-  ["index", "web_tokens_active"],
-  ["index", "web_sessions_active"],
-  ["index", "web_sessions_device"],
-  ["table", "agent_results"],
-  ["table", "agent_skills"],
-  ["table", "agent_loop_break_events"],
-  ["table", "agent_lesson_proposals"],
-  ["table", "agent_reviews"],
-  ["table", "agent_triggers"],
-  ["table", "agents"],
-  ["table", "attention_acknowledgements"],
-  ["table", "communication_approval_events"],
-  ["table", "communication_approval_message_grants"],
-  ["table", "communication_approvals"],
-  ["table", "config"],
-  ["table", "mcp_servers"],
-  ["table", "messages"],
-  ["table", "profile_communication_defaults"],
-  ["table", "profile_default_skills"],
-  ["table", "profiles"],
-  ["table", "provider_models"],
-  ["table", "provider_state"],
-  ["table", "schema_migrations"],
-  ["table", "secrets"],
-  ["table", "skill_meta"],
-  ["table", "source_slot_bindings"],
-  ["table", "team_agent_state"],
-  ["table", "team_policies"],
-  ["table", "team_policy_block_events"],
-  ["table", "team_policy_edges"],
-  ["table", "team_template_edges"],
-  ["table", "team_template_revision_edges"],
-  ["table", "team_template_revision_slots"],
-  ["table", "team_template_revisions"],
-  ["table", "team_template_slots"],
-  ["table", "team_templates"],
-  ["table", "teams"],
-  ["table", "telegram_allowed_users"],
-  ["table", "telegram_pairing_challenge"],
-  ["table", "template_instantiations"],
-  ["table", "trigger_dispatches"],
-  ["table", "web_tokens"],
-  ["table", "web_sessions"],
-  ["trigger", "create_team_policy"],
-  ["trigger", "prevent_detached_team_policy_delete"],
-  ["trigger", "validate_source_binding_insert"],
-  ["trigger", "validate_team_agent_state_insert"],
-  ["trigger", "validate_team_policy_baseline_update"],
-  ["trigger", "validate_team_policy_edge_insert"],
-  ["trigger", "validate_team_template_edge_insert"]
-];
+
+// ../daemon/src/core/db/migrate.ts
+import { readdirSync, readFileSync as readFileSync4 } from "fs";
+import { dirname, join as join2 } from "path";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+import { fileURLToPath } from "url";
+
+// ../daemon/src/core/db/client.ts
+import { backup, DatabaseSync as DatabaseSync2 } from "node:sqlite";
+function wrap(rawDb) {
+  const cache = /* @__PURE__ */ new Map();
+  let transactionDepth = 0;
+  let savepointSequence = 0;
+  function getStmt(sql) {
+    let s = cache.get(sql);
+    if (!s) {
+      s = rawDb.prepare(sql);
+      cache.set(sql, s);
+    }
+    return s;
+  }
+  return {
+    query(sql) {
+      const stmt = getStmt(sql);
+      return {
+        get(...params) {
+          const result = stmt.get(...params);
+          return result ?? null;
+        },
+        all(...params) {
+          return stmt.all(...params);
+        },
+        run(...params) {
+          return stmt.run(...params);
+        }
+      };
+    },
+    run(sql, params) {
+      const stmt = getStmt(sql);
+      return stmt.run(...params ?? []);
+    },
+    exec(sql) {
+      rawDb.exec(sql);
+    },
+    // node:sqlite has no callable `transaction` wrapper; use manual BEGIN/COMMIT/ROLLBACK.
+    transaction(fn) {
+      return () => {
+        const outermost = transactionDepth === 0;
+        const savepoint = outermost ? null : `bazilion_nested_${++savepointSequence}`;
+        if (outermost) rawDb.exec("BEGIN");
+        else rawDb.exec(`SAVEPOINT ${savepoint}`);
+        transactionDepth++;
+        try {
+          const result = fn();
+          if (outermost) rawDb.exec("COMMIT");
+          else rawDb.exec(`RELEASE SAVEPOINT ${savepoint}`);
+          return result;
+        } catch (err) {
+          if (outermost) rawDb.exec("ROLLBACK");
+          else {
+            rawDb.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
+            rawDb.exec(`RELEASE SAVEPOINT ${savepoint}`);
+          }
+          throw err;
+        } finally {
+          transactionDepth--;
+        }
+      };
+    }
+  };
+}
+function applyPragmas(rawDb, includeWal) {
+  if (includeWal) {
+    try {
+      rawDb.exec("PRAGMA journal_mode = WAL");
+    } catch {
+    }
+  }
+  rawDb.exec("PRAGMA foreign_keys = ON");
+}
+function openInMemoryDb() {
+  const raw = new DatabaseSync2(":memory:");
+  applyPragmas(raw, false);
+  return {
+    raw: wrap(raw),
+    backupTo(path) {
+      return backup(raw, path);
+    },
+    close() {
+      raw.close();
+    }
+  };
+}
+
+// ../daemon/src/core/db/migrate.ts
+var migrationsDir = join2(dirname(fileURLToPath(import.meta.url)), "migrations");
+var schemaMigrationsSql = `
+  CREATE TABLE IF NOT EXISTS schema_migrations (
+    version    TEXT PRIMARY KEY,
+    applied_at INTEGER NOT NULL
+  )
+`;
+function listMigrations() {
+  return readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).sort().map((file) => ({
+    version: file.replace(/\.sql$/, ""),
+    sql: readFileSync4(join2(migrationsDir, file), "utf8")
+  }));
+}
+var canonicalSchemaObjectsByPrefix = /* @__PURE__ */ new Map();
+function schemaObjects(db) {
+  return db.raw.query(
+    `SELECT type, name, tbl_name, sql
+       FROM sqlite_schema
+       WHERE sql IS NOT NULL AND substr(name, 1, 7) <> 'sqlite_'
+       ORDER BY type, name`
+  ).all();
+}
 function normalizeSql(sql) {
   return sql.replace(/\s+/g, " ").trim();
 }
-function assertCanonicalBackupSchema(db) {
-  const migrations = db.prepare("SELECT version FROM schema_migrations ORDER BY version").all();
-  if (migrations.length !== 1 || migrations[0]?.version !== CANONICAL_MIGRATION) {
+function expectedSchema(files, prefixLength) {
+  const cached = canonicalSchemaObjectsByPrefix.get(prefixLength);
+  if (cached) return cached;
+  const canonical = openInMemoryDb();
+  try {
+    canonical.raw.exec(schemaMigrationsSql);
+    for (const file of files.slice(0, prefixLength)) canonical.raw.exec(file.sql);
+    const objects = schemaObjects(canonical);
+    canonicalSchemaObjectsByPrefix.set(prefixLength, objects);
+    return objects;
+  } finally {
+    canonical.close();
+  }
+}
+function assertSchemaMatchesCanonicalChain(raw) {
+  const files = listMigrations();
+  const expectedVersions = files.map((file) => file.version);
+  const applied = raw.prepare("SELECT version FROM schema_migrations ORDER BY version").all().map((row2) => row2.version);
+  if (applied.length !== expectedVersions.length || applied.some((version, index) => version !== expectedVersions[index])) {
     throw new Error(
-      `schema_migrations must contain exactly ${CANONICAL_MIGRATION}; found ` + (migrations.map((row2) => row2.version).join(", ") || "none")
+      `schema_migrations must contain exactly ${expectedVersions.join(", ")}; found ` + (applied.join(", ") || "none")
     );
   }
-  const rows = db.prepare(
+  const rows = raw.prepare(
     `SELECT type, name, tbl_name, sql
        FROM sqlite_schema
-       WHERE sql IS NOT NULL AND name NOT LIKE 'sqlite_%'`
+       WHERE sql IS NOT NULL AND substr(name, 1, 7) <> 'sqlite_'
+       ORDER BY type, name`
   ).all();
-  const byKey = new Map(rows.map((row2) => [`${row2.type}\0${row2.name}`, row2]));
-  const canonicalKeys = new Set(CANONICAL_OBJECTS.map(([type, name]) => `${type}\0${name}`));
+  const canonical = expectedSchema(files, files.length);
+  const canonicalKeys = new Set(canonical.map((row2) => `${row2.type}\0${row2.name}`));
+  const actualKeys = new Map(rows.map((row2) => [`${row2.type}\0${row2.name}`, row2]));
+  for (const row2 of canonical) {
+    if (!actualKeys.has(`${row2.type}\0${row2.name}`)) {
+      throw new Error(`required canonical schema ${row2.type} is missing: ${row2.name}`);
+    }
+  }
   for (const row2 of rows) {
     if (!canonicalKeys.has(`${row2.type}\0${row2.name}`)) {
       throw new Error(`unexpected schema ${row2.type} is not canonical: ${row2.name}`);
     }
   }
-  const canonicalRows = [];
-  for (const [type, name] of CANONICAL_OBJECTS) {
-    const row2 = byKey.get(`${type}\0${name}`);
-    if (!row2) throw new Error(`required canonical schema ${type} is missing: ${name}`);
-    canonicalRows.push(row2);
-  }
-  const payload = canonicalRows.map((row2) => [row2.type, row2.name, row2.tbl_name, normalizeSql(row2.sql)].join("\0")).join("\n");
-  const actualHash = createHash("sha256").update(payload).digest("hex");
-  if (actualHash !== CANONICAL_SCHEMA_HASH) {
+  const payload = rows.map((row2) => [row2.type, row2.name, row2.tbl_name, normalizeSql(row2.sql)].join("\0")).join("\n");
+  const canonicalPayload = canonical.map((row2) => [row2.type, row2.name, row2.tbl_name, normalizeSql(row2.sql)].join("\0")).join("\n");
+  if (payload !== canonicalPayload) {
     throw new Error(
-      "canonical schema fingerprint does not match this Bazilion release; restore a backup created from the current clean-install schema"
+      "database schema does not match this release\u2019s canonical migration chain; restore a backup created from the current release"
     );
   }
+}
+
+// src/backup-schema.ts
+function assertCanonicalBackupSchema(db) {
+  assertSchemaMatchesCanonicalChain(db);
   for (const row2 of db.prepare("SELECT id, bytes, byte_length, sha256 FROM agent_results WHERE deleted_at IS NULL").iterate()) {
     const bytes = row2.bytes;
     if (!(bytes instanceof Uint8Array) || bytes.byteLength !== row2.byte_length || createHash("sha256").update(bytes).digest("hex") !== row2.sha256) {
@@ -2643,13 +2634,13 @@ import {
   lstatSync as lstatSync2,
   mkdirSync,
   openSync,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   realpathSync,
   renameSync,
   rmSync,
   writeSync
 } from "fs";
-import { basename as basename3, dirname, join as join2, resolve as resolve2 } from "path";
+import { basename as basename3, dirname as dirname2, join as join3, resolve as resolve2 } from "path";
 var DAEMON_LIVENESS_FILENAME = "daemon-runtime.json";
 var STALE_AFTER_MS = 6e4;
 var PROBE_TIMEOUT_MS = 750;
@@ -2659,15 +2650,15 @@ function canonicalHomeIdentity(home) {
     return realpathSync.native(absolute);
   } catch (error) {
     if (errorCode(error) !== "ENOENT") throw error;
-    const parent = dirname(absolute);
+    const parent = dirname2(absolute);
     if (parent === absolute) throw error;
-    return join2(canonicalHomeIdentity(parent), basename3(absolute));
+    return join3(canonicalHomeIdentity(parent), basename3(absolute));
   }
 }
 function daemonLivenessPath(home) {
   const canonicalHome = canonicalHomeIdentity(home);
   const identity = createHash2("sha256").update(canonicalHome).digest("hex").slice(0, 24);
-  return join2(dirname(canonicalHome), `.bazilion-runtime-${identity}.json`);
+  return join3(dirname2(canonicalHome), `.bazilion-runtime-${identity}.json`);
 }
 function errorCode(error) {
   return error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : void 0;
@@ -2705,7 +2696,7 @@ function parseRecord(raw) {
 function readRecord(path) {
   try {
     const stat = lstatSync2(path);
-    const raw = stat.isFile() ? readFileSync4(path, "utf8") : "";
+    const raw = stat.isFile() ? readFileSync5(path, "utf8") : "";
     return { raw, stat, record: stat.isFile() ? parseRecord(raw) : null };
   } catch (error) {
     if (errorCode(error) === "ENOENT") return null;
@@ -2762,7 +2753,7 @@ function writeRecord(fd, record) {
 function fsyncParentDirectory(path) {
   let directoryFd = null;
   try {
-    directoryFd = openSync(dirname(path), "r");
+    directoryFd = openSync(dirname2(path), "r");
     fsyncSync(directoryFd);
   } catch (error) {
     if (process.platform !== "win32") throw error;
@@ -2784,7 +2775,7 @@ function reclaimRecord(path, existing) {
     return null;
   }
   try {
-    renameSync(path, join2(claim, "stale-record.json"));
+    renameSync(path, join3(claim, "stale-record.json"));
     return claim;
   } catch (error) {
     if (errorCode(error) === "ENOENT") return null;
@@ -2793,9 +2784,9 @@ function reclaimRecord(path, existing) {
 }
 async function acquireHomeRestoreLock(home, operation = "restoring") {
   const targetHome = resolve2(home);
-  mkdirSync(dirname(targetHome), { recursive: true });
+  mkdirSync(dirname2(targetHome), { recursive: true });
   const path = daemonLivenessPath(targetHome);
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   const instanceId = randomUUID6();
   let fd = null;
   let reclaimClaim = null;
@@ -3040,7 +3031,7 @@ var createCmd = defineCommand9({
       } catch (error) {
         if (!(error instanceof Error) || !("code" in error) || error.code !== "EXDEV") throw error;
         const installPartial = resolve3(
-          dirname2(outAbs),
+          dirname3(outAbs),
           `.${basename4(outAbs)}.${randomUUID7()}.installing`
         );
         try {
@@ -3227,7 +3218,7 @@ function validateArchiveEntries(entries) {
 function validateAuthFile(path) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path, "utf8"));
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     throw new Error(`backup auth.json is invalid: ${detail}`);
@@ -3240,7 +3231,7 @@ function validateAuthFile(path) {
 function validateDatabase(path, authToken) {
   let db = null;
   try {
-    db = new DatabaseSync2(path, { readOnly: true });
+    db = new DatabaseSync4(path, { readOnly: true });
     const integrity = db.prepare("PRAGMA integrity_check").all();
     if (integrity.length !== 1 || integrity[0]?.integrity_check !== "ok") {
       const detail = integrity.map((row2) => row2.integrity_check).join("; ") || "no result";
@@ -3304,7 +3295,7 @@ function requireExtractedTeamSlot(path, rowLabel) {
 function rebaseRestoredHomeDirectories(database, payload, targetHome) {
   let db = null;
   try {
-    db = new DatabaseSync2(database);
+    db = new DatabaseSync4(database);
     db.exec("PRAGMA foreign_keys = ON");
     const profiles = db.prepare("SELECT id FROM profiles ORDER BY id").all();
     const agents = db.prepare("SELECT id FROM agents ORDER BY id").all();
@@ -3381,11 +3372,11 @@ function rebaseRestoredHomeDirectories(database, payload, targetHome) {
 function removeRebuildableQmdIndexes(payload) {
   const teamsDir = resolve3(payload, "teams");
   if (!existsSync2(teamsDir) || !lstatSync3(teamsDir).isDirectory()) return;
-  for (const team of readdirSync(teamsDir, { withFileTypes: true })) {
+  for (const team of readdirSync2(teamsDir, { withFileTypes: true })) {
     if (!team.isDirectory() || team.isSymbolicLink()) continue;
     const memoryDir = resolve3(teamsDir, team.name, "memory");
     if (!existsSync2(memoryDir) || !lstatSync3(memoryDir).isDirectory()) continue;
-    for (const entry3 of readdirSync(memoryDir, { withFileTypes: true })) {
+    for (const entry3 of readdirSync2(memoryDir, { withFileTypes: true })) {
       if (entry3.isFile() && entry3.name.startsWith(".qmd-index.sqlite")) {
         rmSync2(resolve3(memoryDir, entry3.name), { force: true });
       }
@@ -3393,7 +3384,7 @@ function removeRebuildableQmdIndexes(payload) {
   }
 }
 function revokeRestoredBrowserSessions(database) {
-  const db = new DatabaseSync2(database);
+  const db = new DatabaseSync4(database);
   try {
     db.prepare("UPDATE web_sessions SET revoked_at = ? WHERE revoked_at IS NULL").run(Date.now());
   } finally {
@@ -3403,7 +3394,7 @@ function revokeRestoredBrowserSessions(database) {
 function installValidatedPayload(payload, targetHome, staging, lifecycle, operations = { rename: renameSync2 }) {
   const previous = resolve3(staging, "previous-home");
   const hadPrevious = existsSync2(targetHome);
-  const targetParent = dirname2(targetHome);
+  const targetParent = dirname3(targetHome);
   const syncDirectory = operations.fsyncDirectory ?? fsyncDirectory;
   const recoveryError = (message, recoveryPath, cause) => {
     let markerError;
@@ -3538,7 +3529,7 @@ function readAgeIdentity(rawPath) {
   if (process.platform !== "win32" && (entry3.mode & 63) !== 0) {
     throw new Error(`age identity must be owner-only (chmod 600): ${path}`);
   }
-  const identities = readFileSync5(path, "utf8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
+  const identities = readFileSync6(path, "utf8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
   if (identities.length !== 1 || !identities[0]?.startsWith("AGE-SECRET-KEY-")) {
     throw new Error("age identity file must contain exactly one supported AGE-SECRET-KEY entry");
   }
@@ -3573,7 +3564,7 @@ var restoreCmd = defineCommand9({
     if (targetHome === parse(targetHome).root) {
       throw new Error(`refusing to restore over filesystem root: ${targetHome}`);
     }
-    const targetParent = dirname2(targetHome);
+    const targetParent = dirname3(targetHome);
     mkdirSync2(targetParent, { recursive: true });
     const restoreLock = await acquireHomeRestoreLock(targetHome);
     try {
@@ -3591,7 +3582,7 @@ var restoreCmd = defineCommand9({
         if (!lstatSync3(targetHome).isDirectory()) {
           throw new Error(`${targetHome} exists and is not a directory`);
         }
-        const entries = readdirSync(targetHome);
+        const entries = readdirSync2(targetHome);
         if (entries.length > 0 && !args2.force) {
           throw new Error(
             `${targetHome} is not empty. Pass --force to overwrite (destroys existing data).`
@@ -3714,7 +3705,7 @@ function credentialInventory(home) {
   const database = resolve3(home, "bazilion.db");
   const token = validateAuthFile(authFile);
   validateDatabase(database, token);
-  const db = new DatabaseSync2(database, { readOnly: true });
+  const db = new DatabaseSync4(database, { readOnly: true });
   try {
     const activeTokens = db.prepare(
       "SELECT COUNT(*) AS count FROM web_tokens WHERE revoked_at IS NULL AND kind = 'device' AND expires_at > ?"
@@ -3773,7 +3764,7 @@ var rotateBootstrapCmd = defineCommand9({
       throw new Error(`refusing to rotate filesystem root: ${targetHome}`);
     }
     const lock = await acquireHomeRestoreLock(targetHome);
-    const parent = dirname2(targetHome);
+    const parent = dirname3(targetHome);
     const staging = mkdtempSync(resolve3(parent, ".bazilion-rotate-"));
     const payload = resolve3(staging, "payload");
     let preserveStaging = false;
@@ -3783,7 +3774,7 @@ var rotateBootstrapCmd = defineCommand9({
           throw new Error(`bazilion server appears to be running at ${serverUrl} \u2014 stop it first.`);
         }
       }
-      const oldAuth = JSON.parse(readFileSync5(paths.authFile, "utf8"));
+      const oldAuth = JSON.parse(readFileSync6(paths.authFile, "utf8"));
       if (typeof oldAuth.token !== "string" || !oldAuth.token) {
         throw new Error("auth.json is missing the bootstrap token");
       }
@@ -3796,7 +3787,7 @@ var rotateBootstrapCmd = defineCommand9({
       });
       const stagedDb = resolve3(payload, "bazilion.db");
       rmSync2(stagedDb, { force: true });
-      const sourceDb = new DatabaseSync2(resolve3(targetHome, "bazilion.db"), { readOnly: true });
+      const sourceDb = new DatabaseSync4(resolve3(targetHome, "bazilion.db"), { readOnly: true });
       try {
         await sqliteBackup(sourceDb, stagedDb);
       } finally {
@@ -3805,7 +3796,7 @@ var rotateBootstrapCmd = defineCommand9({
       for (const suffix of ["-wal", "-shm", "-journal"])
         rmSync2(`${stagedDb}${suffix}`, { force: true });
       const newToken = randomBytes(24).toString("hex");
-      const db = new DatabaseSync2(stagedDb);
+      const db = new DatabaseSync4(stagedDb);
       try {
         db.exec("PRAGMA foreign_keys = ON; BEGIN IMMEDIATE");
         try {
@@ -4102,16 +4093,16 @@ var configCommand = defineCommand11({
 import { spawn } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { connect } from "net";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { defineCommand as defineCommand12 } from "citty";
-var bundledDaemonEntry = join3(import.meta.dirname, "daemon.js");
-var sourceDaemonEntry = join3(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
+var bundledDaemonEntry = join4(import.meta.dirname, "daemon.js");
+var sourceDaemonEntry = join4(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry = existsSync3(bundledDaemonEntry) ? bundledDaemonEntry : sourceDaemonEntry;
-var bundledWebServerEntry = join3(import.meta.dirname, "web-server.js");
-var sourceWebServerEntry = join3(import.meta.dirname, "..", "web-server.ts");
+var bundledWebServerEntry = join4(import.meta.dirname, "web-server.js");
+var sourceWebServerEntry = join4(import.meta.dirname, "..", "web-server.ts");
 var webServerEntry = existsSync3(bundledWebServerEntry) ? bundledWebServerEntry : sourceWebServerEntry;
-var bundledWebDist = join3(import.meta.dirname, "web");
-var sourceWebDist = join3(import.meta.dirname, "..", "..", "..", "web", "dist");
+var bundledWebDist = join4(import.meta.dirname, "web");
+var sourceWebDist = join4(import.meta.dirname, "..", "..", "..", "web", "dist");
 var webDist = existsSync3(bundledWebDist) ? bundledWebDist : sourceWebDist;
 function nodeArgs(entry3) {
   return entry3.endsWith(".ts") ? ["--import", "tsx/esm", entry3] : [entry3];
@@ -4274,7 +4265,7 @@ var dashboardCommand = defineCommand12({
             `web UI port ${webPort} is already in use. Re-run with --port <free-port>.`
           );
         }
-        if (!existsSync3(join3(webDist, "server", "server.js"))) {
+        if (!existsSync3(join4(webDist, "server", "server.js"))) {
           throw new Error(
             `bazilion web UI bundle not found at ${webDist}. Run "pnpm --filter @bazilion/web build" from the repository root of a source checkout, or reinstall the published package.`
           );
@@ -4679,7 +4670,7 @@ var inboxCommand = defineCommand15({
 });
 
 // src/commands/login.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
 import { defineCommand as defineCommand16 } from "citty";
 function normalizeServer(raw) {
   let url;
@@ -4722,7 +4713,7 @@ var loginCommand = defineCommand16({
         `${paths.authFile} not found. Start the daemon with "bazilion serve" first \u2014 login stores the remote there.`
       );
     }
-    const auth = JSON.parse(readFileSync6(paths.authFile, "utf8"));
+    const auth = JSON.parse(readFileSync7(paths.authFile, "utf8"));
     if (args2.clear) {
       if (!auth.remote) {
         console.log("no remote stored \u2014 nothing to clear");
@@ -4972,9 +4963,9 @@ var memoryCommand = defineCommand18({
 // src/commands/profile.ts
 import { spawn as spawn2 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { readFileSync as readFileSync8, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // ../../packages/api-types/src/git-review.ts
 var REVIEW_LIMITS = {
@@ -5051,7 +5042,7 @@ var createCmd2 = defineCommand19({
   },
   async run({ args: args2 }) {
     const skillsMode = parseSkillsMode(args2["skills-mode"]);
-    const readTemplate = (path) => path ? readFileSync7(path, "utf8") : void 0;
+    const readTemplate = (path) => path ? readFileSync8(path, "utf8") : void 0;
     const body = {
       id: args2.id,
       name: args2.name,
@@ -5126,7 +5117,7 @@ var editCmd2 = defineCommand19({
     const { content } = await client.get(
       `/api/profiles/${args2.id}/files/${file}`
     );
-    const tmpPath = join4(tmpdir2(), `bazilion-${args2.id}-${file}-${randomBytes2(4).toString("hex")}`);
+    const tmpPath = join5(tmpdir2(), `bazilion-${args2.id}-${file}-${randomBytes2(4).toString("hex")}`);
     writeFileSync4(tmpPath, content);
     try {
       const editor = process.env.EDITOR ?? process.env.VISUAL ?? "vi";
@@ -5136,7 +5127,7 @@ var editCmd2 = defineCommand19({
         child.on("close", (c) => resolve6(c ?? 0));
       });
       if (code !== 0) throw new Error(`editor exited with code ${code}`);
-      const updated = readFileSync7(tmpPath, "utf8");
+      const updated = readFileSync8(tmpPath, "utf8");
       if (updated === content) {
         console.log("(no changes)");
         return;
@@ -5482,10 +5473,10 @@ var sendCommand = defineCommand22({
 // src/commands/serve.ts
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { defineCommand as defineCommand23 } from "citty";
-var bundledDaemonEntry2 = join5(import.meta.dirname, "daemon.js");
-var sourceDaemonEntry2 = join5(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
+var bundledDaemonEntry2 = join6(import.meta.dirname, "daemon.js");
+var sourceDaemonEntry2 = join6(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry2 = existsSync5(bundledDaemonEntry2) ? bundledDaemonEntry2 : sourceDaemonEntry2;
 var serveCommand = defineCommand23({
   meta: {
@@ -5591,7 +5582,7 @@ var sessionCommand = defineCommand24({
 });
 
 // src/commands/skill.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
 import { basename as basename5, resolve as resolve4 } from "path";
 import { defineCommand as defineCommand25 } from "citty";
 function printFindings(findings, prefix = "  ") {
@@ -5661,7 +5652,7 @@ var importCmd = defineCommand25({
     let result;
     try {
       if (isLocalZip) {
-        const bytes = readFileSync8(absFrom);
+        const bytes = readFileSync9(absFrom);
         const file = new File([bytes], basename5(absFrom), { type: "application/zip" });
         const fd = new FormData();
         fd.set("file", file);
@@ -5731,9 +5722,9 @@ var skillCommand = defineCommand25({
 });
 
 // src/commands/team.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { stdin as stdin2 } from "process";
-import { defineCommand as defineCommand32 } from "citty";
+import { defineCommand as defineCommand33 } from "citty";
 
 // src/commands/team-coding-log.ts
 import { defineCommand as defineCommand26 } from "citty";
@@ -5793,7 +5784,7 @@ var teamCodingLogCommand = defineCommand26({
 });
 
 // src/commands/team-environment.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { defineCommand as defineCommand27 } from "citty";
 var args = { id: { type: "positional", required: true, description: "Team slug" } };
 var teamEnvironmentCommand = defineCommand27({
@@ -5819,7 +5810,7 @@ var teamEnvironmentCommand = defineCommand27({
       },
       async run({ args: args2 }) {
         const input = JSON.parse(
-          readFileSync9(args2.file, "utf8")
+          readFileSync10(args2.file, "utf8")
         );
         console.log(
           JSON.stringify(await createClient2().codingEnvironment.configure(args2.id, input), null, 2)
@@ -5830,7 +5821,7 @@ var teamEnvironmentCommand = defineCommand27({
 });
 
 // src/commands/team-policy.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { defineCommand as defineCommand28 } from "citty";
 
 // src/team-interchange.ts
@@ -6047,7 +6038,7 @@ function edgeDiff(before, after) {
 // src/commands/team-policy.ts
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync10(path, "utf8"));
+    return JSON.parse(readFileSync11(path, "utf8"));
   } catch (error) {
     throw new Error(`invalid JSON: ${error.message}`);
   }
@@ -6288,17 +6279,139 @@ var teamPolicyCommand = defineCommand28({
   }
 });
 
+// src/commands/team-publish.ts
+import { defineCommand as defineCommand29 } from "citty";
+var slug = { id: { type: "positional", required: true, description: "Team slug" } };
+var publicationId = {
+  publicationId: { type: "positional", required: true, description: "Publication id" }
+};
+function printReport(report) {
+  const publication = report.publication;
+  console.log(`${publication.id}  ${publication.state}`);
+  console.log(`  packet:     ${publication.packetId}`);
+  console.log(
+    `  change:     snapshot ${publication.snapshotId.slice(0, 12)} (base ${publication.baseOid.slice(0, 12)})`
+  );
+  console.log(`  target:     ${publication.host} ${publication.repository}`);
+  console.log(
+    `  branch:     ${publication.headBranch} (base ${publication.baseBranch})${publication.commitOid ? `
+  commit:     ${publication.commitOid}${publication.signed ? "" : " (unsigned)"}` : ""}`
+  );
+  if (publication.pullRequestUrl) {
+    console.log(`  pull request: ${publication.pullRequestUrl}`);
+  } else if (publication.state === "published") {
+    console.log("  pull request: none was opened");
+  }
+  if (publication.refusalReason) {
+    console.log(`  refused:    ${publication.refusalReason} \u2014 ${publication.refusalDetail ?? ""}`);
+  }
+  if (publication.error) console.log(`  note:       ${publication.error}`);
+  console.log(`  ${report.guidance}`);
+}
+function printList(list8) {
+  if (list8.publications.length === 0) {
+    console.log("no publications");
+    return;
+  }
+  const rows = list8.publications.map((publication) => [
+    publication.id,
+    publication.state,
+    publication.headBranch,
+    publication.commitOid ? publication.commitOid.slice(0, 10) : "-",
+    publication.pullRequestNumber ? `#${publication.pullRequestNumber}` : "-",
+    publication.refusalReason ?? ""
+  ]);
+  for (const line of columnize(rows)) console.log(line);
+}
+var createCmd3 = defineCommand29({
+  meta: {
+    name: "create",
+    description: "Publish a reviewed revision to a new branch (and open a pull request)"
+  },
+  args: {
+    ...slug,
+    packet: { type: "string", required: true, description: "Review packet id to publish" },
+    branch: {
+      type: "string",
+      description: "Branch to publish to (default: bazilion/review-<packet prefix>)"
+    },
+    message: { type: "string", description: "Commit message (default: derived from the packet)" },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    try {
+      const response = await client.publications(args2.id).create({
+        teamId: args2.id,
+        packetId: args2.packet,
+        ...args2.branch ? { headBranch: args2.branch } : {},
+        ...args2.message ? { commitMessage: args2.message } : {}
+      });
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      if ("blocked" in response) {
+        console.error(`refused: ${response.blocked.reason} \u2014 ${response.blocked.detail}`);
+        process.exit(1);
+      }
+      printReport(response.report);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var listCmd10 = defineCommand29({
+  meta: { name: "list", description: "List publications for a Team" },
+  args: { ...slug, json: { type: "boolean", description: "Emit JSON" } },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    const response = await client.publications(args2.id).list();
+    if (args2.json) {
+      console.log(JSON.stringify(response, null, 2));
+      return;
+    }
+    printList(response);
+  }
+});
+var showCmd5 = defineCommand29({
+  meta: { name: "show", description: "Show one publication and its outcome" },
+  args: { ...slug, ...publicationId, json: { type: "boolean", description: "Emit JSON" } },
+  async run({ args: args2 }) {
+    const client = createClient2();
+    try {
+      const response = await client.publications(args2.id).show(args2.publicationId);
+      if (args2.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+      }
+      printReport(response.report);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }
+});
+var teamPublishCommand = defineCommand29({
+  meta: {
+    name: "publish",
+    description: "Publish a reviewed revision to a code host (BAZ-046)"
+  },
+  subCommands: { create: createCmd3, list: listCmd10, show: showCmd5 }
+});
+
 // src/commands/team-review.ts
-import { defineCommand as defineCommand30 } from "citty";
+import { defineCommand as defineCommand31 } from "citty";
 
 // src/commands/team-review-packet.ts
-import { defineCommand as defineCommand29 } from "citty";
-var slug = { id: { type: "positional", required: true, description: "Team slug" } };
+import { defineCommand as defineCommand30 } from "citty";
+var slug2 = { id: { type: "positional", required: true, description: "Team slug" } };
 var packetId = {
   packetId: { type: "positional", required: true, description: "Review packet id" }
 };
 var SEVERITIES = ["blocker", "major", "minor", "info"];
-function printReport(report) {
+function printReport2(report) {
   const packet = report.packet;
   const requester = packet.requester.kind === "agent" ? `agent ${packet.requester.agentId}` : "operator";
   console.log(`${packet.id}  ${packet.state}${report.applicability.stale ? "  (stale)" : ""}`);
@@ -6344,10 +6457,10 @@ function printReport(report) {
     "  note:     a review conclusion is not acceptance, and this command never commits, pushes, merges or deploys"
   );
 }
-var createCmd3 = defineCommand29({
+var createCmd4 = defineCommand30({
   meta: { name: "create", description: "Capture a review packet for a retained revision" },
   args: {
-    ...slug,
+    ...slug2,
     snapshot: {
       type: "string",
       required: true,
@@ -6372,16 +6485,16 @@ var createCmd3 = defineCommand29({
         console.log(JSON.stringify(response, null, 2));
         return;
       }
-      printReport(response.report);
+      printReport2(response.report);
     } catch (error) {
       console.error(error instanceof Error ? error.message : String(error));
       process.exit(1);
     }
   }
 });
-var listCmd10 = defineCommand29({
+var listCmd11 = defineCommand30({
   meta: { name: "list", description: "List review packets for a Team" },
-  args: { ...slug, json: { type: "boolean", description: "Emit JSON" } },
+  args: { ...slug2, json: { type: "boolean", description: "Emit JSON" } },
   async run({ args: args2 }) {
     const client = createClient2();
     const response = await client.reviewPackets(args2.id).list();
@@ -6411,9 +6524,9 @@ var listCmd10 = defineCommand29({
     );
   }
 });
-var showCmd5 = defineCommand29({
+var showCmd6 = defineCommand30({
   meta: { name: "show", description: "Show one review packet, its findings and its conclusions" },
-  args: { ...slug, ...packetId, json: { type: "boolean", description: "Emit JSON" } },
+  args: { ...slug2, ...packetId, json: { type: "boolean", description: "Emit JSON" } },
   async run({ args: args2 }) {
     const client = createClient2();
     try {
@@ -6422,17 +6535,17 @@ var showCmd5 = defineCommand29({
         console.log(JSON.stringify(response, null, 2));
         return;
       }
-      printReport(response.report);
+      printReport2(response.report);
     } catch (error) {
       console.error(error instanceof Error ? error.message : String(error));
       process.exit(1);
     }
   }
 });
-var findingCmd = defineCommand29({
+var findingCmd = defineCommand30({
   meta: { name: "finding", description: "Record a finding against the packet\u2019s captured revision" },
   args: {
-    ...slug,
+    ...slug2,
     ...packetId,
     path: { type: "string", required: true, description: "Repository-relative path" },
     severity: { type: "string", required: true, description: SEVERITIES.join(" | ") },
@@ -6466,17 +6579,17 @@ var findingCmd = defineCommand29({
       console.log(
         `finding recorded against revision ${response.report.packet.snapshot.id.slice(0, 12)}`
       );
-      printReport(response.report);
+      printReport2(response.report);
     } catch (error) {
       console.error(error instanceof Error ? error.message : String(error));
       process.exit(1);
     }
   }
 });
-var resolveCmd = defineCommand29({
+var resolveCmd = defineCommand30({
   meta: { name: "resolve", description: "Resolve a finding with explicit proof" },
   args: {
-    ...slug,
+    ...slug2,
     ...packetId,
     findingId: { type: "positional", required: true, description: "Finding id" },
     kind: {
@@ -6502,17 +6615,17 @@ var resolveCmd = defineCommand29({
         console.log(JSON.stringify(response, null, 2));
         return;
       }
-      printReport(response.report);
+      printReport2(response.report);
     } catch (error) {
       console.error(error instanceof Error ? error.message : String(error));
       process.exit(1);
     }
   }
 });
-var concludeCmd = defineCommand29({
+var concludeCmd = defineCommand30({
   meta: { name: "conclude", description: "Record the reviewer\u2019s conclusion for this revision" },
   args: {
-    ...slug,
+    ...slug2,
     ...packetId,
     conclusion: {
       type: "string",
@@ -6538,16 +6651,16 @@ var concludeCmd = defineCommand29({
         console.log(JSON.stringify(response, null, 2));
         return;
       }
-      printReport(response.report);
+      printReport2(response.report);
     } catch (error) {
       console.error(error instanceof Error ? error.message : String(error));
       process.exit(1);
     }
   }
 });
-var snapshotCmd = defineCommand29({
+var snapshotCmd = defineCommand30({
   meta: { name: "snapshots", description: "List retained revisions that could be reviewed" },
-  args: { ...slug, json: { type: "boolean", description: "Emit JSON" } },
+  args: { ...slug2, json: { type: "boolean", description: "Emit JSON" } },
   async run({ args: args2 }) {
     const client = createClient2();
     const list8 = await client.repositoryReview(args2.id).snapshots();
@@ -6571,13 +6684,13 @@ var snapshotCmd = defineCommand29({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var reportedCmd = defineCommand29({
+var reportedCmd = defineCommand30({
   meta: {
     name: "reported",
     description: "Record an operator-reported external state (never verified by Bazilion)"
   },
   args: {
-    ...slug,
+    ...slug2,
     ...packetId,
     state: {
       type: "positional",
@@ -6614,13 +6727,13 @@ var reportedCmd = defineCommand29({
     }
   }
 });
-var linkCmd = defineCommand29({
+var linkCmd = defineCommand30({
   meta: {
     name: "link",
     description: "Resolve where a file link points, and where it would open"
   },
   args: {
-    ...slug,
+    ...slug2,
     ...packetId,
     path: { type: "string", required: true, description: "Changed path in the reviewed revision" },
     line: { type: "string", description: "Line to point at" },
@@ -6662,10 +6775,10 @@ var linkCmd = defineCommand29({
     }
   }
 });
-var exportCmd = defineCommand29({
+var exportCmd = defineCommand30({
   meta: { name: "export", description: "Print the patch and handoff text for a packet\u2019s revision" },
   args: {
-    ...slug,
+    ...slug2,
     ...packetId,
     patch: { type: "boolean", description: "Print only the unified patch" },
     deliver: {
@@ -6716,15 +6829,15 @@ handoff names ${result.limitations.length} limitation(s), and a conclusion is no
     }
   }
 });
-var teamReviewPacketCommand = defineCommand29({
+var teamReviewPacketCommand = defineCommand30({
   meta: {
     name: "packet",
     description: "Revision-bound review packets: captured revision, findings, conclusion and handoff"
   },
   subCommands: {
-    create: createCmd3,
-    list: listCmd10,
-    show: showCmd5,
+    create: createCmd4,
+    list: listCmd11,
+    show: showCmd6,
     finding: findingCmd,
     resolve: resolveCmd,
     conclude: concludeCmd,
@@ -6736,19 +6849,19 @@ var teamReviewPacketCommand = defineCommand29({
 });
 
 // src/commands/team-review.ts
-var slug2 = {
+var slug3 = {
   id: { type: "positional", required: true, description: "Team slug" }
 };
 function printIssues(changes) {
   for (const issue of changes.issues) console.log(`note: ${issue.code}: ${issue.message}`);
 }
-var showCmd6 = defineCommand30({
+var showCmd7 = defineCommand31({
   meta: {
     name: "show",
     description: "List changes since a baseline (read-only)"
   },
   args: {
-    ...slug2,
+    ...slug3,
     base: {
       type: "string",
       description: "Comparison base: branch, tag or commit id (default HEAD)"
@@ -6807,13 +6920,13 @@ var showCmd6 = defineCommand30({
     printIssues(changes);
   }
 });
-var captureCmd = defineCommand30({
+var captureCmd = defineCommand31({
   meta: {
     name: "capture",
     description: "Capture a bounded source snapshot for a Team (read-only)"
   },
   args: {
-    ...slug2,
+    ...slug3,
     base: { type: "string", description: "Comparison base (default HEAD)" },
     include: {
       type: "string",
@@ -6850,9 +6963,9 @@ var captureCmd = defineCommand30({
     for (const issue of snapshot.issues) console.log(`  note: ${issue.code}: ${issue.message}`);
   }
 });
-var snapshotsCmd = defineCommand30({
+var snapshotsCmd = defineCommand31({
   meta: { name: "snapshots", description: "List retained source snapshots for a Team" },
-  args: { ...slug2, json: { type: "boolean", description: "Emit JSON" } },
+  args: { ...slug3, json: { type: "boolean", description: "Emit JSON" } },
   async run({ args: args2 }) {
     const client = createClient2();
     const list8 = await client.repositoryReview(args2.id).snapshots();
@@ -6874,10 +6987,10 @@ var snapshotsCmd = defineCommand30({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var snapshotCmd2 = defineCommand30({
+var snapshotCmd2 = defineCommand31({
   meta: { name: "snapshot", description: "Show one retained source snapshot" },
   args: {
-    ...slug2,
+    ...slug3,
     snapshot: { type: "positional", required: true, description: "Snapshot id" },
     json: { type: "boolean", description: "Emit JSON" }
   },
@@ -6900,13 +7013,13 @@ var snapshotCmd2 = defineCommand30({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var teamReviewCommand = defineCommand30({
+var teamReviewCommand = defineCommand31({
   meta: {
     name: "review",
     description: "Read-only Git change review and bounded source snapshots"
   },
   subCommands: {
-    show: showCmd6,
+    show: showCmd7,
     capture: captureCmd,
     snapshots: snapshotsCmd,
     snapshot: snapshotCmd2,
@@ -6915,8 +7028,8 @@ var teamReviewCommand = defineCommand30({
 });
 
 // src/commands/team-verify.ts
-import { defineCommand as defineCommand31 } from "citty";
-var slug3 = {
+import { defineCommand as defineCommand32 } from "citty";
+var slug4 = {
   id: { type: "positional", required: true, description: "Team slug" }
 };
 var OUTCOME_GLYPH = {
@@ -6932,7 +7045,7 @@ var OUTCOME_GLYPH = {
 function latestAttempt(report) {
   return [...report.attempts].sort((a, b) => b.attemptNumber - a.attemptNumber)[0];
 }
-function printReport2(report) {
+function printReport3(report) {
   const { request } = report;
   const requester = request.requester.kind === "agent" ? `agent ${request.requester.agentId}` : "operator";
   console.log(`${request.id}  ${request.state}`);
@@ -6971,13 +7084,13 @@ function printReport2(report) {
   if (attempt?.error) console.log(`  note: ${attempt.error}`);
   if (!attempt) console.log("  note: no attempt has run yet");
 }
-var createCmd4 = defineCommand31({
+var createCmd5 = defineCommand32({
   meta: {
     name: "create",
     description: "Capture a verification request against a snapshot (does not run checks)"
   },
   args: {
-    ...slug3,
+    ...slug4,
     agent: { type: "string", required: true, description: "Team member who will verify" },
     snapshot: { type: "string", required: true, description: "BAZ-042 snapshot id to verify" },
     check: {
@@ -7044,10 +7157,10 @@ var createCmd4 = defineCommand31({
     }
   }
 });
-var listCmd11 = defineCommand31({
+var listCmd12 = defineCommand32({
   meta: { name: "list", description: "List verification requests for a Team" },
   args: {
-    ...slug3,
+    ...slug4,
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args: args2 }) {
@@ -7074,10 +7187,10 @@ var listCmd11 = defineCommand31({
     console.log("run `bazilion team verify show <slug> <id>` for a request's current applicability");
   }
 });
-var showCmd7 = defineCommand31({
+var showCmd8 = defineCommand32({
   meta: { name: "show", description: "Show one verification request and its evidence" },
   args: {
-    ...slug3,
+    ...slug4,
     requestId: { type: "positional", required: true, description: "Verification request id" },
     json: { type: "boolean", description: "Emit JSON" }
   },
@@ -7089,17 +7202,17 @@ var showCmd7 = defineCommand31({
         console.log(JSON.stringify(response, null, 2));
         return;
       }
-      printReport2(response.request);
+      printReport3(response.request);
     } catch (error) {
       console.error(error instanceof Error ? error.message : String(error));
       process.exit(1);
     }
   }
 });
-var cancelCmd2 = defineCommand31({
+var cancelCmd2 = defineCommand32({
   meta: { name: "cancel", description: "Cancel a pending or running verification request" },
   args: {
-    ...slug3,
+    ...slug4,
     requestId: { type: "positional", required: true, description: "Verification request id" },
     json: { type: "boolean", description: "Emit JSON" }
   },
@@ -7112,28 +7225,28 @@ var cancelCmd2 = defineCommand31({
         return;
       }
       console.log(`cancelled or cancelled-pending: ${response.request.request.id}`);
-      printReport2(response.request);
+      printReport3(response.request);
     } catch (error) {
       console.error(error instanceof Error ? error.message : String(error));
       process.exit(1);
     }
   }
 });
-var verifyCommand = defineCommand31({
+var verifyCommand = defineCommand32({
   meta: {
     name: "verify",
     description: "Specialist verification of a captured code change (BAZ-044)"
   },
   subCommands: {
-    create: createCmd4,
-    list: listCmd11,
-    show: showCmd7,
+    create: createCmd5,
+    list: listCmd12,
+    show: showCmd8,
     cancel: cancelCmd2
   }
 });
 
 // src/commands/team.ts
-var addCmd2 = defineCommand32({
+var addCmd2 = defineCommand33({
   meta: {
     name: "add",
     description: "Register a team at ~/.bazilion/teams/<slug>/ (use --link to point at an existing tree)"
@@ -7157,7 +7270,7 @@ var addCmd2 = defineCommand32({
     console.log(`registered team ${g.id} at ${g.path}`);
   }
 });
-var listCmd12 = defineCommand32({
+var listCmd13 = defineCommand33({
   meta: { name: "list", description: "List teams" },
   async run() {
     const client = createClient2();
@@ -7170,7 +7283,7 @@ var listCmd12 = defineCommand32({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var rmCmd5 = defineCommand32({
+var rmCmd5 = defineCommand33({
   meta: { name: "rm", description: "Remove a team registration" },
   args: {
     id: { type: "positional", required: true }
@@ -7191,7 +7304,7 @@ async function readStdin() {
   for await (const chunk of stdin2) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8");
 }
-var userMdShowCmd = defineCommand32({
+var userMdShowCmd = defineCommand33({
   meta: { name: "show", description: "Print the team's USER.md" },
   args: { id: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -7201,7 +7314,7 @@ var userMdShowCmd = defineCommand32({
     if (g.userMd && !g.userMd.endsWith("\n")) process.stdout.write("\n");
   }
 });
-var userMdSetCmd = defineCommand32({
+var userMdSetCmd = defineCommand33({
   meta: {
     name: "set",
     description: "Replace the team's USER.md (from --file, --from-stdin, or inline text)"
@@ -7215,7 +7328,7 @@ var userMdSetCmd = defineCommand32({
   async run({ args: args2 }) {
     let content;
     if (args2["from-stdin"]) content = await readStdin();
-    else if (args2.file) content = readFileSync11(args2.file, "utf8");
+    else if (args2.file) content = readFileSync12(args2.file, "utf8");
     else if (args2.text !== void 0) content = args2.text;
     else {
       console.error("team user-md set: provide --file, --from-stdin, or --text");
@@ -7227,7 +7340,7 @@ var userMdSetCmd = defineCommand32({
     console.log(`updated USER.md for team ${args2.id} (${content.length} bytes)`);
   }
 });
-var userMdClearCmd = defineCommand32({
+var userMdClearCmd = defineCommand33({
   meta: { name: "clear", description: "Clear the team's USER.md to empty" },
   args: { id: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -7237,7 +7350,7 @@ var userMdClearCmd = defineCommand32({
     console.log(`cleared USER.md for team ${args2.id}`);
   }
 });
-var userMdCmd = defineCommand32({
+var userMdCmd = defineCommand33({
   meta: { name: "user-md", description: "View or edit a team's USER.md" },
   subCommands: {
     show: userMdShowCmd,
@@ -7245,7 +7358,7 @@ var userMdCmd = defineCommand32({
     clear: userMdClearCmd
   }
 });
-var topicFormatShowCmd = defineCommand32({
+var topicFormatShowCmd = defineCommand33({
   meta: { name: "show", description: "Print the team's Telegram topic-name template" },
   args: { id: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -7254,7 +7367,7 @@ var topicFormatShowCmd = defineCommand32({
     console.log(g.telegramTopicNameFormat ?? "(default naming)");
   }
 });
-var topicFormatSetCmd = defineCommand32({
+var topicFormatSetCmd = defineCommand33({
   meta: {
     name: "set",
     description: "Set the topic-name template. Tokens: {agent.name} {team.name} {team.slug} (must include {agent.name})"
@@ -7274,7 +7387,7 @@ var topicFormatSetCmd = defineCommand32({
     console.log(`set topic-name template for team ${args2.id}: ${g.telegramTopicNameFormat}`);
   }
 });
-var topicFormatClearCmd = defineCommand32({
+var topicFormatClearCmd = defineCommand33({
   meta: { name: "clear", description: "Clear the template (revert to built-in naming)" },
   args: { id: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -7284,7 +7397,7 @@ var topicFormatClearCmd = defineCommand32({
     console.log(`cleared topic-name template for team ${args2.id}`);
   }
 });
-var topicFormatCmd = defineCommand32({
+var topicFormatCmd = defineCommand33({
   meta: {
     name: "topic-format",
     description: "View or edit a team's Telegram forum-topic name template"
@@ -7295,7 +7408,7 @@ var topicFormatCmd = defineCommand32({
     clear: topicFormatClearCmd
   }
 });
-var contextCmd = defineCommand32({
+var contextCmd = defineCommand33({
   meta: {
     name: "context",
     description: "Inspect repository instructions, Git state and command suggestions"
@@ -7342,16 +7455,17 @@ var contextCmd = defineCommand32({
       console.log(`  ${issue.code}${issue.path ? `: ${safe2(issue.path)}` : ""} \u2014 ${issue.message}`);
   }
 });
-var teamCommand = defineCommand32({
+var teamCommand = defineCommand33({
   meta: { name: "team", description: "Manage teams (collaboration contexts)" },
   subCommands: {
     environment: teamEnvironmentCommand,
     log: teamCodingLogCommand,
     review: teamReviewCommand,
     verify: verifyCommand,
+    publish: teamPublishCommand,
     context: contextCmd,
     add: addCmd2,
-    list: listCmd12,
+    list: listCmd13,
     rm: rmCmd5,
     "user-md": userMdCmd,
     "topic-format": topicFormatCmd,
@@ -7360,11 +7474,11 @@ var teamCommand = defineCommand32({
 });
 
 // src/commands/team-template.ts
-import { readFileSync as readFileSync12 } from "fs";
-import { defineCommand as defineCommand33 } from "citty";
+import { readFileSync as readFileSync13 } from "fs";
+import { defineCommand as defineCommand34 } from "citty";
 function jsonFile(path) {
   try {
-    return JSON.parse(readFileSync12(path, "utf8"));
+    return JSON.parse(readFileSync13(path, "utf8"));
   } catch (error) {
     throw new Error(`invalid JSON: ${error.message}`);
   }
@@ -7389,7 +7503,7 @@ function printTeam(detail) {
       console.log(line);
   }
 }
-var list7 = defineCommand33({
+var list7 = defineCommand34({
   meta: { name: "list", description: "List canonical Team templates" },
   args: { json: { type: "boolean", description: "Emit stable JSON" } },
   async run({ args: args2 }) {
@@ -7403,7 +7517,7 @@ var list7 = defineCommand33({
       console.log(line);
   }
 });
-var show6 = defineCommand33({
+var show6 = defineCommand34({
   meta: { name: "show", description: "Show a canonical Team template" },
   args: {
     id: { type: "positional", required: true },
@@ -7417,7 +7531,7 @@ var show6 = defineCommand33({
     else printTeam(detail);
   }
 });
-var exportCommand2 = defineCommand33({
+var exportCommand2 = defineCommand34({
   meta: {
     name: "export",
     description: "Export a portable versioned Team-template document to stdout"
@@ -7457,7 +7571,7 @@ function printImportDiff(current, document) {
   for (const value of diff2.added) console.log(`  + ${value}`);
   for (const value of diff2.removed) console.log(`  - ${value}`);
 }
-var importCommand2 = defineCommand33({
+var importCommand2 = defineCommand34({
   meta: {
     name: "import",
     description: "Validate, diff, and explicitly apply a portable Team-template document"
@@ -7538,7 +7652,7 @@ var importCommand2 = defineCommand33({
     );
   }
 });
-var teamTemplateCommand = defineCommand33({
+var teamTemplateCommand = defineCommand34({
   meta: {
     name: "team-template",
     description: "Inspect and exchange canonical Team templates"
@@ -7547,8 +7661,8 @@ var teamTemplateCommand = defineCommand33({
 });
 
 // src/commands/telegram.ts
-import { defineCommand as defineCommand34 } from "citty";
-var setCmd2 = defineCommand34({
+import { defineCommand as defineCommand35 } from "citty";
+var setCmd2 = defineCommand35({
   meta: {
     name: "set",
     description: "Save bot token + supergroup chat ID (paired write)"
@@ -7566,7 +7680,7 @@ var setCmd2 = defineCommand34({
     console.log(`saved \xB7 token ${state.botTokenPreview} \xB7 chat ${state.chatId}`);
   }
 });
-var clearCmd = defineCommand34({
+var clearCmd = defineCommand35({
   meta: {
     name: "clear",
     description: "Remove stored bot token + chat ID"
@@ -7577,7 +7691,7 @@ var clearCmd = defineCommand34({
     console.log("cleared");
   }
 });
-var showCmd8 = defineCommand34({
+var showCmd9 = defineCommand35({
   meta: {
     name: "show",
     description: "Show what credentials are stored (token is masked)"
@@ -7598,7 +7712,7 @@ var showCmd8 = defineCommand34({
     }
   }
 });
-var reconnectCmd = defineCommand34({
+var reconnectCmd = defineCommand35({
   meta: {
     name: "reconnect",
     description: "Apply a pending supergroup chat-id migration + re-activate the bot"
@@ -7609,7 +7723,7 @@ var reconnectCmd = defineCommand34({
     console.log(`reconnected \xB7 chat ${state.chatId}`);
   }
 });
-var configCmd = defineCommand34({
+var configCmd = defineCommand35({
   meta: {
     name: "config",
     description: "Manage Telegram credentials (bot token + chat ID)"
@@ -7617,10 +7731,10 @@ var configCmd = defineCommand34({
   subCommands: {
     set: setCmd2,
     clear: clearCmd,
-    show: showCmd8
+    show: showCmd9
   }
 });
-var healthCmd = defineCommand34({
+var healthCmd = defineCommand35({
   meta: {
     name: "health",
     description: "Run the four-step preflight against the Telegram Bot API"
@@ -7659,7 +7773,7 @@ var healthCmd = defineCommand34({
     if (!allOk) process.exitCode = 1;
   }
 });
-var botStatusCmd = defineCommand34({
+var botStatusCmd = defineCommand35({
   meta: {
     name: "status",
     description: "Show polling state of the live bot"
@@ -7684,7 +7798,7 @@ var botStatusCmd = defineCommand34({
     if (!p.running) process.exitCode = 1;
   }
 });
-var botRestartCmd = defineCommand34({
+var botRestartCmd = defineCommand35({
   meta: {
     name: "restart",
     description: "Force-restart the bot (tears down + brings up from current creds)"
@@ -7695,7 +7809,7 @@ var botRestartCmd = defineCommand34({
     console.log("restart requested");
   }
 });
-var botCmd = defineCommand34({
+var botCmd = defineCommand35({
   meta: {
     name: "bot",
     description: "Inspect / control the live polling bot"
@@ -7705,7 +7819,7 @@ var botCmd = defineCommand34({
     restart: botRestartCmd
   }
 });
-var bindCmd = defineCommand34({
+var bindCmd = defineCommand35({
   meta: {
     name: "bind",
     description: "Create a Telegram topic for an agent (manual fallback for /talk)"
@@ -7723,7 +7837,7 @@ var bindCmd = defineCommand34({
     console.log(`  ${result.deepLink}`);
   }
 });
-var unbindCmd = defineCommand34({
+var unbindCmd = defineCommand35({
   meta: {
     name: "unbind",
     description: "Clear an agent's Telegram topic binding (topic stays in Telegram as orphan)"
@@ -7737,7 +7851,7 @@ var unbindCmd = defineCommand34({
     console.log(`unbound agent ${args2.agent}`);
   }
 });
-var listBindingsCmd = defineCommand34({
+var listBindingsCmd = defineCommand35({
   meta: {
     name: "list",
     description: "List agents and their Telegram topic bindings"
@@ -7765,7 +7879,7 @@ var listBindingsCmd = defineCommand34({
     }
   }
 });
-var allowCmd = defineCommand34({
+var allowCmd = defineCommand35({
   meta: { name: "allow", description: "Add a Telegram user id to the allowlist" },
   args: {
     userId: { type: "positional", required: true, description: "Numeric Telegram user id" },
@@ -7781,7 +7895,7 @@ var allowCmd = defineCommand34({
     console.log(`allowed ${u.userId} (${u.role})`);
   }
 });
-var denyCmd = defineCommand34({
+var denyCmd = defineCommand35({
   meta: { name: "deny", description: "Remove a Telegram user id from the allowlist" },
   args: { userId: { type: "positional", required: true } },
   async run({ args: args2 }) {
@@ -7790,7 +7904,7 @@ var denyCmd = defineCommand34({
     console.log(`removed ${args2.userId}`);
   }
 });
-var allowedCmd = defineCommand34({
+var allowedCmd = defineCommand35({
   meta: { name: "allowed", description: "List allowlisted Telegram users" },
   async run() {
     const client = createClient2();
@@ -7805,7 +7919,7 @@ var allowedCmd = defineCommand34({
     }
   }
 });
-var pairingCreateCmd = defineCommand34({
+var pairingCreateCmd = defineCommand35({
   meta: { name: "create", description: "Generate a one-time Telegram owner pairing code" },
   async run() {
     const result = await createClient2().post(
@@ -7816,7 +7930,7 @@ var pairingCreateCmd = defineCommand34({
     console.log("send `/pair <code>` in the configured \u2699 bazilion service topic");
   }
 });
-var pairingStatusCmd = defineCommand34({
+var pairingStatusCmd = defineCommand35({
   meta: { name: "status", description: "Show Telegram owner pairing status" },
   async run() {
     const result = await createClient2().get("/api/config/telegram/pairing");
@@ -7827,14 +7941,14 @@ var pairingStatusCmd = defineCommand34({
       console.log(`expires: ${new Date(result.challengeExpiresAt).toISOString()}`);
   }
 });
-var pairingCancelCmd = defineCommand34({
+var pairingCancelCmd = defineCommand35({
   meta: { name: "cancel", description: "Cancel the active Telegram pairing code" },
   async run() {
     await createClient2().del("/api/config/telegram/pairing/challenge");
     console.log("pairing challenge cancelled");
   }
 });
-var pairingResetCmd = defineCommand34({
+var pairingResetCmd = defineCommand35({
   meta: { name: "reset", description: "Revoke the Telegram owner and require re-pairing" },
   args: {
     yes: { type: "boolean", description: "Confirm destructive owner reset", required: true }
@@ -7845,7 +7959,7 @@ var pairingResetCmd = defineCommand34({
     console.log("Telegram owner reset; ingress is closed until re-paired");
   }
 });
-var pairingCmd = defineCommand34({
+var pairingCmd = defineCommand35({
   meta: { name: "pairing", description: "Manage single-owner Telegram pairing" },
   subCommands: {
     create: pairingCreateCmd,
@@ -7854,7 +7968,7 @@ var pairingCmd = defineCommand34({
     reset: pairingResetCmd
   }
 });
-var telegramCommand = defineCommand34({
+var telegramCommand = defineCommand35({
   meta: {
     name: "telegram",
     description: "Telegram integration: credentials, health, bot lifecycle, bindings, access"
@@ -7875,14 +7989,14 @@ var telegramCommand = defineCommand34({
 });
 
 // src/commands/token.ts
-import { defineCommand as defineCommand35 } from "citty";
+import { defineCommand as defineCommand36 } from "citty";
 import qrcode from "qrcode-terminal";
 function tokenRow(t) {
   const last = t.lastUsedAt ? new Date(t.lastUsedAt).toISOString() : "(never)";
   const expired = t.expiresAt !== null && t.expiresAt <= Date.now();
   const state = t.revokedAt ? "revoked" : expired ? "expired" : "active";
   const expires = t.expiresAt ? new Date(t.expiresAt).toISOString() : "(never)";
-  return [t.id, t.kind, state, t.label, `expires: ${expires}`, `last: ${last}`];
+  return [t.id, t.kind, state, t.label, t.scopes.join(" "), `expires: ${expires}`, `last: ${last}`];
 }
 function resolveQrServer(override) {
   const raw = override ?? loadClientConfig().serverUrl;
@@ -7904,7 +8018,7 @@ function resolveQrServer(override) {
   }
   return url.origin;
 }
-var createCmd5 = defineCommand35({
+var createCmd6 = defineCommand36({
   meta: { name: "create", description: "Mint a new web token (shown once)" },
   args: {
     label: { type: "positional", required: true, description: "Human-readable label" },
@@ -7919,19 +8033,29 @@ var createCmd5 = defineCommand35({
     expiresDays: {
       type: "string",
       description: "Device lifetime in days (default 90, maximum 365)"
+    },
+    scope: {
+      type: "string",
+      description: "Authorization scope; repeat for more (read, write, approvals, admin). Default: all scopes."
     }
   },
-  async run({ args: args2 }) {
+  async run({ args: args2, rawArgs }) {
     const client = createClient2();
     const expiresInDays = args2.expiresDays === void 0 ? void 0 : Number(args2.expiresDays);
     if (expiresInDays !== void 0 && !Number.isInteger(expiresInDays)) {
       throw new Error("--expires-days must be an integer");
     }
-    const body = { label: args2.label, expiresInDays };
+    const scopes = collectFlagValues(rawArgs, "scope");
+    const body = {
+      label: args2.label,
+      expiresInDays,
+      ...scopes.length > 0 ? { scopes } : {}
+    };
     const res = await client.post("/api/tokens", body);
-    console.log(`id:    ${res.meta.id}`);
-    console.log(`label: ${res.meta.label}`);
-    console.log(`kind:  ${res.meta.kind}`);
+    console.log(`id:     ${res.meta.id}`);
+    console.log(`label:  ${res.meta.label}`);
+    console.log(`kind:   ${res.meta.kind}`);
+    console.log(`scopes: ${res.meta.scopes.join(" ")}`);
     console.log(
       `expires: ${res.meta.expiresAt ? new Date(res.meta.expiresAt).toISOString() : "(never)"}`
     );
@@ -7947,7 +8071,44 @@ var createCmd5 = defineCommand35({
     qrcode.generate(pairUrl, { small: true }, (qr) => console.log(qr));
   }
 });
-var listCmd13 = defineCommand35({
+var pairCmd = defineCommand36({
+  meta: {
+    name: "pair",
+    description: "Mint a one-paste pairing setup code for a new device (10 min, single use)"
+  },
+  args: {
+    scope: {
+      type: "string",
+      description: "Authorization scope for the minted device credential; repeat for more. Default: all scopes."
+    },
+    server: {
+      type: "string",
+      description: "Server URL to embed in the setup code (default: detect LAN IP; pass the gateway HTTPS origin for remote devices)"
+    }
+  },
+  async run({ args: args2, rawArgs }) {
+    const client = createClient2();
+    const scopes = collectFlagValues(rawArgs, "scope");
+    const res = await client.post("/api/pair/codes", {
+      ...scopes.length > 0 ? { scopes } : {}
+    });
+    let setupUrl = res.setupUrl;
+    if (args2.server) {
+      const serverUrl = resolveQrServer(args2.server);
+      setupUrl = `bazilion-pair://pair?server=${encodeURIComponent(serverUrl)}&code=${encodeURIComponent(res.code)}`;
+    }
+    console.log(`id:     ${res.meta.id}`);
+    console.log(`scopes: ${res.meta.scopes.join(" ")}`);
+    console.log(`expires: ${new Date(res.meta.expiresAt).toISOString()} (10 minutes, single use)`);
+    console.log("");
+    console.log(`setup URL (paste or scan on the new device):`);
+    console.log(setupUrl);
+    console.log("");
+    console.log("the code admits exactly one credential exchange; after that it is inert.");
+    qrcode.generate(setupUrl, { small: true }, (qr) => console.log(qr));
+  }
+});
+var listCmd14 = defineCommand36({
   meta: { name: "list", description: "List web tokens" },
   args: {
     all: { type: "boolean", description: "Include revoked tokens" }
@@ -7963,7 +8124,7 @@ var listCmd13 = defineCommand35({
     for (const line of columnize(tokens.map(tokenRow))) console.log(line);
   }
 });
-var showLocalCmd = defineCommand35({
+var showLocalCmd = defineCommand36({
   meta: {
     name: "show-local",
     description: "Print the bootstrap web token stored in ~/.bazilion/auth.json"
@@ -7973,7 +8134,7 @@ var showLocalCmd = defineCommand35({
     console.log(readAuthFile(paths.authFile).token);
   }
 });
-var revokeCmd2 = defineCommand35({
+var revokeCmd2 = defineCommand36({
   meta: { name: "revoke", description: "Revoke a web token" },
   args: {
     id: { type: "positional", required: true }
@@ -7984,19 +8145,20 @@ var revokeCmd2 = defineCommand35({
     console.log(`revoked token ${args2.id}`);
   }
 });
-var tokenCommand = defineCommand35({
+var tokenCommand = defineCommand36({
   meta: { name: "token", description: "Manage web tokens for API/CLI clients" },
   subCommands: {
-    create: createCmd5,
-    list: listCmd13,
+    create: createCmd6,
+    pair: pairCmd,
+    list: listCmd14,
     revoke: revokeCmd2,
     "show-local": showLocalCmd
   }
 });
 
 // src/commands/trigger.ts
-import { defineCommand as defineCommand36 } from "citty";
-var addCmd3 = defineCommand36({
+import { defineCommand as defineCommand37 } from "citty";
+var addCmd3 = defineCommand37({
   meta: { name: "add", description: "Add an interval / cron trigger to an agent" },
   args: {
     agent: { type: "positional", required: true },
@@ -8044,7 +8206,7 @@ function triggerRow(t) {
   const msgPreview = t.message.length > 60 ? `${t.message.slice(0, 60)}\u2026` : t.message;
   return [t.id, state, spec, `last: ${last}`, `"${msgPreview}"`];
 }
-var listCmd14 = defineCommand36({
+var listCmd15 = defineCommand37({
   meta: { name: "list", description: "List triggers for an agent" },
   args: {
     agent: { type: "positional", required: true }
@@ -8061,7 +8223,7 @@ var listCmd14 = defineCommand36({
     for (const line of columnize(triggers.map(triggerRow))) console.log(line);
   }
 });
-var rmCmd6 = defineCommand36({
+var rmCmd6 = defineCommand37({
   meta: { name: "rm", description: "Delete a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -8072,7 +8234,7 @@ var rmCmd6 = defineCommand36({
     console.log(`removed trigger ${args2.id}`);
   }
 });
-var enableCmd3 = defineCommand36({
+var enableCmd3 = defineCommand37({
   meta: { name: "enable", description: "Enable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -8084,7 +8246,7 @@ var enableCmd3 = defineCommand36({
     console.log(`enabled trigger ${args2.id}`);
   }
 });
-var disableCmd3 = defineCommand36({
+var disableCmd3 = defineCommand37({
   meta: { name: "disable", description: "Disable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -8096,7 +8258,7 @@ var disableCmd3 = defineCommand36({
     console.log(`disabled trigger ${args2.id}`);
   }
 });
-var historyCmd = defineCommand36({
+var historyCmd = defineCommand37({
   meta: { name: "history", description: "Show recent dispatches for a trigger" },
   args: {
     id: { type: "positional", required: true },
@@ -8124,11 +8286,11 @@ var historyCmd = defineCommand36({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var triggerCommand = defineCommand36({
+var triggerCommand = defineCommand37({
   meta: { name: "trigger", description: "Manage scheduled agent triggers" },
   subCommands: {
     add: addCmd3,
-    list: listCmd14,
+    list: listCmd15,
     rm: rmCmd6,
     enable: enableCmd3,
     disable: disableCmd3,
@@ -8137,10 +8299,10 @@ var triggerCommand = defineCommand36({
 });
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, lstatSync as lstatSync4, readdirSync as readdirSync2, realpathSync as realpathSync2, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync7, lstatSync as lstatSync4, readdirSync as readdirSync3, realpathSync as realpathSync2, rmSync as rmSync4 } from "fs";
 import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join6, parse as parse2, relative as relative2, resolve as resolve5, sep } from "path";
-import { defineCommand as defineCommand37 } from "citty";
+import { isAbsolute as isAbsolute2, join as join7, parse as parse2, relative as relative2, resolve as resolve5, sep } from "path";
+import { defineCommand as defineCommand38 } from "citty";
 function makeLineReader() {
   let buffer = "";
   let ended = false;
@@ -8227,7 +8389,7 @@ function assertSafeUninstallHome(home) {
   }
   return target;
 }
-var uninstallCommand = defineCommand37({
+var uninstallCommand = defineCommand38({
   meta: {
     name: "uninstall",
     description: "Wipe bazilion state from ~/.bazilion (or BAZILION_HOME)"
@@ -8246,15 +8408,15 @@ var uninstallCommand = defineCommand37({
   async run({ args: args2 }) {
     const paths = resolveCliPaths(args2.home);
     const targetHome = assertSafeUninstallHome(paths.home);
-    const dbFile = join6(targetHome, "bazilion.db");
-    const profilesDir = join6(targetHome, "profiles");
-    const agentsDir = join6(targetHome, "agents");
-    const teamsDir = join6(targetHome, "teams");
-    const legacyGroupsDir = join6(targetHome, "groups");
-    const skillsDir = join6(targetHome, "skills");
-    const logsDir = join6(targetHome, "logs");
-    const legacyConfigFile = join6(targetHome, "config.json");
-    const legacySecretsFile = join6(targetHome, "secrets.enc");
+    const dbFile = join7(targetHome, "bazilion.db");
+    const profilesDir = join7(targetHome, "profiles");
+    const agentsDir = join7(targetHome, "agents");
+    const teamsDir = join7(targetHome, "teams");
+    const legacyGroupsDir = join7(targetHome, "groups");
+    const skillsDir = join7(targetHome, "skills");
+    const logsDir = join7(targetHome, "logs");
+    const legacyConfigFile = join7(targetHome, "config.json");
+    const legacySecretsFile = join7(targetHome, "secrets.enc");
     if (!existsSync7(targetHome)) {
       const uninstallLock2 = await acquireHomeRestoreLock(targetHome, "uninstalling");
       try {
@@ -8273,7 +8435,7 @@ var uninstallCommand = defineCommand37({
       `${dbFile}-wal`,
       `${dbFile}-shm`,
       `${dbFile}-journal`,
-      join6(targetHome, "auth.json"),
+      join7(targetHome, "auth.json"),
       legacyConfigFile,
       legacySecretsFile,
       profilesDir,
@@ -8307,10 +8469,10 @@ var uninstallCommand = defineCommand37({
         for (const p of fullWipeTargets) {
           if (removePath(p)) console.log(`removed ${p}`);
         }
-        if (readdirSync2(targetHome).length === 0 && !homeIsSymlink) {
+        if (readdirSync3(targetHome).length === 0 && !homeIsSymlink) {
           rmSync4(targetHome, { recursive: true, force: true });
           console.log(`removed ${targetHome}`);
-        } else if (homeIsSymlink && readdirSync2(targetHome).length === 0) {
+        } else if (homeIsSymlink && readdirSync3(targetHome).length === 0) {
           console.log(`kept ${targetHome}: symlinked BAZILION_HOME root is now empty`);
         } else {
           console.log(`${targetHome} still has unmanaged files; left in place`);
@@ -8331,7 +8493,7 @@ var uninstallCommand = defineCommand37({
 
 // src/index.ts
 var VERSION = package_default.version;
-var main = defineCommand38({
+var main = defineCommand39({
   meta: {
     name: "bazilion",
     version: VERSION,