Epic: the barako CLI, an API wrapper agents drive, then config as code, scaffolding and deploy through BaryoVM

The `barako` CLI is how an agent, or a person at a terminal, drives barakoCMS. Model it in barakoCMS, edit it in barakoBrew, render it with barakoPress, deploy it anywhere with BaryoVM, and let Claude Code or any agent do the same work through `barako` instead of hand-written API calls.

## Decided with Arnel on 14 September 2026

- **It is a wrapper of the API, built for agents first.** Asked "create me a theme like this", Claude Code runs `barako` commands, never `curl`. What the CLI adds over raw HTTP is what makes an agent reliable: sign-in and scoped API keys handled once, one stable JSON document per command, errors that name the fix, a machine-readable description of what is valid, and `--dry-run` on every command that changes something.
- **A .NET tool** (`dotnet tool install -g barako`) on the .NET client. It is a client of the API and nothing more: no database access and no endpoints of its own (#345).
- **Declarative config as code is a layer on the same client, not a separate tool.** `plan`, `apply` and `export` (#345) compose the same commands, on 4.3.0.
- **`barako new` calls the npm `create-barako-app`** rather than rewriting it.
- **`barako deploy` calls BaryoVM** and carries no deploy code (BaryoDev/BaryoVM#82).

## Example: "create me a theme like this"

```sh
barako site theme get --json > theme.json # what the site has now
# the agent edits theme.json from the description or a screenshot
barako site theme set --file theme.json --dry-run # the change, with contrast warnings
barako site theme set --file theme.json --publish # save and publish; barakoPress picks it up on revalidate
```

## Example: "create an accounting table with these fields"

```sh
barako schema field-types --json # money, date, reference... so the file is valid first time
barako content-type create --file expense.json --dry-run
# + content type expense: Date (date, required), Vendor (string, required),
# Amount (money, required), Category (reference to category), Receipt (url)
barako content-type create --file expense.json # created; returns the stored name and id
barako role grant Accountant --type expense --create --read --update
```

An unknown type is refused with the accepted list, so the agent corrects itself on the next try. If the Accounting module is enabled, `barako schema` shows its own types first, so the agent extends those rather than creating a second ledger.

## Order

### 1. The API wrapper, for agents

- [ ] #169 commands for what the console does today: content types, entries, publish, roles, workflows, connectors, files. `--json` everywhere, `--dry-run` on writes, scoped keys.
- [ ] `barako site` and `barako site theme` over the `site` singleton (#793): get, set from a file, publish, with the shape checks barakoBrew's Theme screen makes (BaryoDev/barakoBrew#134).
- [ ] `barako schema`: field types, blueprints, block schemas and valid values, so an agent writes a correct file on the first try.
- [ ] A Claude Code skill shipped with the CLI (`barako agent init` writes it into a project), telling an agent to use `barako` instead of the API, to dry run before writing, and to read `barako schema` first.
- [ ] #582 an MCP server over the same commands, for agents that prefer typed tools to a shell.

### 2. Config as code, 4.3.0

- [ ] #345 `plan`, `apply`, `export` on the same client: idempotent, destructive changes refused without a flag, export round-trips to another instance.
- [ ] A site kit as a file (#721): blueprint, theme, site settings, pages, workflows, promoted from staging to production.

### 3. Starting and extending

- [ ] `barako new`: a configured site on the three published images by default (D22), or the Next.js starter from `create-barako-app`.
- [ ] `barako module new` and `barako plugin new`: scaffold a module or a barakoPress plugin (BaryoDev/barakoPress#25) and build the derived image.
- [x] #171 `barako module list`, `enable`, `disable`, `status`, once #170 lands.

### 4. Deploying

- [ ] `barako deploy`: hands the project to BaryoVM (`project release`, BaryoDev/BaryoVM#84).

## Done when

- In Claude Code, "give rckoronadal.org a darker blue header and Zilla Slab headings" results in `barako site theme` commands with a dry run shown before the change, and no direct API call.
- `barako new rckoronadal --site`, `barako apply -f site.yaml` and `barako deploy` take an empty VM to a configured rckoronadal.org, and running them again changes nothing.

This is an epic spanning the barako CLI, the .NET API client, config commands, scaffolding and BaryoVM deployment. Start by narrowing the work to one entry point, such as `barako site theme`, `barako schema`, or `plan`/`apply`/`export`, and read its linked issue (#793, #345 or #169). Done requires the selected command to follow the stated JSON, dry-run, idempotency or deployment behavior.

Written by the indexing model from the issue text.